Secret Emails Could Expose Facebook Over Cambridge Analytica

Private emails could contradict Facebook CEO Mark Zuckerberg’s sworn testimony about when Facebook learned about the Cambridge Analytica data breach.

The social media giant and Washington, D.C.’s attorney general are sparring over an internal email chain that allegedly shows Facebook employees discussing Cambridge Analytica data harvesting scandal in September 2015. Those alleged emails came months before Facebook claims it learned that Cambridge Analytica, a political consulting firm founded by backers of Donald Trump, was scraping millions of Facebook users’ information without their knowledge.

Facebook and the attorney general are in court Friday to argue whether those emails can be viewed by the public. If unsealed, their contents might contradict sworn testimony Zuckerberg made before Congress last year. It’s part of a lawsuit filed by D.C. Attorney General Karl Racine, accusing Facebook of failing to protect user data.

Facebook claims it learned about Cambridge Analytica’s dealings at the same time as the public, in December 2015. That’s when the Guardian reported that Republican Sen. Ted Cruz’s presidential campaign was using psychological profiles compiled from tens of millions of unwitting Facebook users’ personal information.

The data was mined by former psychology professor Aleksandr Kogan using a personality quiz. Kogan later sold the data to Cambridge Analytica, who hired him as a contractor in 2014.

Subsequent revelations, including statements from a whistleblower in 2018, showed that Kogan’s app had exploited a feature of Facebook’s architecture that also let it harvest personal information from friends of people who used the app. Up to 87 million users may have had their information scraped, Facebook estimated.

The terms-of-service in the app told users’ plainly that Kogan intended to “edit, copy, disseminate, publish, transfer, append or merge with other databases, sell, license (by whatever means and on whatever terms) and archive your contribution and data.” Facebook was given the terms-of-service during the app approval process, but later admitted it never read the language. App users’ friends received no disclosure.

“When Facebook learned about Kogan’s breach of Facebook’s data use policies in December 2015, we took immediate action,” Zuckerberg testified before Congress last year. “The company retained an outside firm to assist in investigating Kogan’s actions, to demand that Kogan and each party he had shared data with delete the data and any derivatives of the data, and to obtain certifications that they had done so.”

But the D.C. attorney general’s office claims to have documents indicating otherwise. On Monday, the office filed a motion to unseal emails from September 2015, which purportedly showed U.S.-based Facebook employees expressing concerns about Cambridge Analytica.

“A D.C.-based Facebook employee warned the company that Cambridge Analytica was a ‘[redacted]’ asked other Facebook employees to ‘[redacted]’ and received responses that Cambridge Analytica’s data-scraping practices were ‘[redacted]’ with Facebook’s Platform Policy,” the redacted motion to unseal reads.

Facebook has fought back against revealing the emails’ contents, and is going to court Friday afternoon for a judgment on whether the emails will be made public.

“The Document contains sensitive commercial information regarding the ‘inner workings’ of Facebook's business that should be protected against disclosure,” Facebook wrote in a motion opposing release of the email.  Making it public “could provide competitors with valuable insights into how Facebook operates. The general public itself has little or no interest in this Document that could warrant exposing Facebook to the risks that would inevitably accompany disclosure.”

The company told the Guardian that those emails pertained to a different Cambridge Analytica incident, and not the breach reported in December 2015.

“In September 2015 employees heard speculation that Cambridge Analytica was scraping data, something that is unfortunately common for any internet service,” a Facebook  spokesperson said. “In December 2015, we first learned through media reports that Kogan sold data to Cambridge Analytica, and we took action. Those were two different things.”

It’s a response typical of the company’s approach to scandal, effectively arguing the email should stay private because it pertains to a completely different alleged data spill—engineered, not by a psychology researcher, but directly by Cambridge Analytica—that the company has taken pains to conceal.

“Facebook has not publicly disseminated the Document or its contents and, given its confidentiality, has sought assurances from any government agencies or entities to whom it has produced the Document that they too would maintain its confidentiality,” the company wrote in its court brief.

The A.G.’s motion accuses Facebook of “seek[ing] to avoid publicizing its employees’ candid assessments of how multiple third-parties violated Facebook’s policies.”

The battle over the document is just one front in a protracted war between Facebook and multiple governments. In the U.K., the company is facing a similar investigation into whether it violated users’ privacy. The U.K. has stricter laws for data misuse, suggesting graver consequences for Facebook if it is found to have been negligent with users’ information. Last July, the U.K. slapped Facebook with a £500,000 (approximately $660,000) fine over the Cambridge Analytica scandal. Facebook is currently appealing the ruling.

British lawmaker Damian Collins, who has led his country’s charge against Facebook, suggested the September 2015 emails could mean the company was misleading in testimony before British Parliament.

“This important new information could suggest that Facebook has consistently mislead the @CommonsCMS about what it knew and when about Cambridge Analytica,” he tweeted Thursday.

Last week Kogan filed a defamation lawsuit against Facebook accusing the company of scapegoating him when it claimed falsely that his app was approved under false pretenses.

“Instead of accepting the uncomfortable glare of the spotlight and accepting responsibility for any mistakes it might have made, Facebook went into ‘PR crisis mode,’ quickly seizing upon Dr. Kogan as a convenient scapegoat,” Kogan’s complaint charges.