Cambridge Analytica’s grab of 50 million Facebook users’ data

Facebook appears to be getting tougher on people who break its rules.

Hot on the heels of banning the Britain First group from its network, Facebook has announced it has suspended political data analytics firm Cambridge Analytica, and its parent company Strategic Communication Laboratories (SCL).

But the reason for the organisations being blocked from Facebook are very different. Britain First is accused of spreading vile hateful messages about Muslims, but Cambridge Analytica is accused of acquiring the data of more than 50 million Facebook users via an illegitimate route.

Cambridge Analytica is the shady data analytics firm that specialises in “psychographic” profiling. In short, they scoop up data online and use it to create personality profiles for voters.

That knowledge could be extremely useful, as individuals can then be targeted with content targeted to appeal to them, and perhaps influence their behaviour. Maybe even change their likelihood to vote in a particular direction.

Cambridge Analytica is widely credited for helping Donald Trump’s successful campaign on social media to be elected President of the United States.

Investigations published this weekend by the New York Times and The Guardian have said that the profiles of some 50 million Facebook users were gathered without their knowledge, with a little help from a personality quiz created by a University of Cambridge professor.

Here’s what appears to have happened:

• Psychology professor Aleksandr Kogan, created an app called “thisisyourdigitallife” which offered to make personality predictions. 270,000 people downloaded it, and in the process made it possible for the app to scoop up personal information and details of their Facebook activity.
• The app also asked for permission to request “more limited information” from a user’s friends. As a consequence details from some 50 million Facebook profiles were gathered.
• Facebook app developers aren’t supposed to share users’ personal information with third parties, but Kogan appears to have passed the details on to SCL/Cambridge Analytica and Christopher Wylie of Eunoia Technologies.
• Facebook says it learned of the violation in 2015, removed the app, and demanded assurances that Kogan and third-parties had destroyed the data.
• Facebook has heard that the data was not deleted as promised, and has suspended the various parties pending further information.
• Cambridge Analytica has issued a press release saying that it deleted the data “when it became clear” that the data had not been obtained in line with Facebook’s terms of service.

Much of the fuel on the fire has been poured by Christopher Wylie, Cambridge Analytica’s former director of research who the media has styled as a whistleblower.

Here is Wylie speaking to the UK’s Channel 4 News:

Never forget. Without your data, Facebook can’t make its fortune.

You may wish to ponder that next time you take an online personality quiz. You may want to rethink how wise it is to share so much information on social networks. You may wish to take a long look at your privacy settings, and determine if they configured appropriately.

You may simply want to opt out of social networks that exploit your data in the first place.

For more discussion on this topic, listen to this episode of the “Smashing Security” podcast.

For much more information and background on the controversy surrounding Facebook and Cambridge Analytica, read the following articles:

• Revealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach
• ‘I created Steve Bannon’s psychological warfare tool’: meet the data war whistleblower
• How Trump Consultants Exploited the Facebook Data of Millions

Further reading: Cambridge Analytica controversy: Was there a Facebook data breach?

Update: Facebook now admits that as many as 87 million people have had their details improperly shared with Cambridge Analytica.

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.