Regulating Facebook won't prevent data breaches

After revelations that political consulting firm Cambridge Analytica allegedly appropriated Facebook user data to advise Donald Trump’s 2016 U.S. presidential campaign, many are calling for greater regulation^[1] of social media networks, saying a “massive data breach^[2]” has occurred.

The idea that governments can regulate their way into protecting citizen privacy is appealing, but I believe it misses the mark.

What happened with Cambridge Analytica wasn’t a breach or a leak. It was a wild violation of academic research ethics. The story is still developing, but a college researcher has now acknowledged^[3] that he harvested Facebook users’ data and gave it to another company.

A scholar and his company failed to protect sensitive research data. A university did not do enough to stop him. Regulating Facebook won’t solve these problems.

What Kogan did wrong

I am a professor of media and information policy^[4] at the Quello Center at Michigan State University, and I was one of the first academics to study the internet. The quality and integrity of digital research is of great concern to me.

I think the Cambridge Analytica-Facebook incident is a total disaster. I just don’t think it’s a government regulatory failure.

Here’s the story, at least what the media has confirmed so far.

Aleksandr Kogan^[5] is a Cambridge University data scientist and psychology department lecturer. Outside of the university, Kogan also collected and analyzed Facebook user data^[6] – presumably with the knowledge of Facebook^[7] – for his company Global Science Research.

Through online surveys, he was reportedly able to gather sensitive personal information on tens of millions^[8] of American Facebook users, including demographic data, private messages, information about their friends and possibly even information about the friends of their friends.

Kogan then provided this data to a political consulting firm^[9], Cambridge Analytica. According to the New York Times, the company analyzed that information, aiming to help shape the 2016 Trump campaign’s messages and identify potential Trump voters.

That was never his intent, Kogan said in a March 21 BBC radio interview^[10]. He reports being “stunned” that his “perfectly legal” research on the happiness and well-being of Facebook users was deployed as a political tool.

What Facebook did wrong

So did Facebook do something wrong, then? In my opinion, not really.

Facebook already has strict guidelines^[11] outlining what can and can’t be done with user data, which the researcher appears to have violated by passing the personal data he collected to Cambridge Analytica.

When Facebook launched in 2004, it quickly became a goldmine for social researchers. Suddenly, studies that previously relied only on survey data to gather information about individuals could directly observe how people connected to one another^[12], what they liked, and what bound groups together.

In the early years, the company took an open and experimental attitude toward this kind of data mining, even teaming up with researchers to study how tweaking certain features of individual’s Facebook pages affected voter turnout^[13], say, or impacted their moods^[14].

Those studies, conducted without the informed consent of its participants – Facebook users – were widely criticized^[15] by social science researchers. In 2014, Facebook strengthened its existing guidelines^[16] on how user data can be gathered, analyzed and used.

Today, the company requires an extensive internal review of every request to extract personal data from users for research purposes.

In other words, Facebook self-regulated.

It may have been lax in enforcing its guidelines, though. The company says^[17] that once it learned that Cambridge Analytica had used Kogan’s data set for unauthorized purposes, it insisted that the data be deleted.

According to current press reports, Cambridge Analytica did not comply^[18]. For a while, it seems, Facebook did nothing to punish the company.

I believe this fallout from this scandal – including a Federal Trade Commission investigation^[19] – will push Facebook to take enforcement much more seriously^[20].

After all, as CEO Mark Zuckerberg said in a March 21 Facebook post^[21], the company “made mistakes” and it “has a responsibility to protect” its users.

Cambridge Analytica’s Facebook account has now been suspended^[22]. And under both U.S.^[23] and U.K.^[24] law, individuals or firms accused of unauthorized disclosure of personal information can face prosecution.

What academia does wrong

For me, what the Cambridge Analytica fiasco exposes is that university ethical review processes are not yet equipped for the digital age.

University researchers are bound by strict ethical guidelines. Across the world – particularly in the U.K., with its strong social research traditions^[25] – academics who want to study the attitudes or behavior of private individuals must first pass a stringent review process. They must also obtain explicit, informed consent from those who participate in their research.

It is impossible for me to imagine that an ethics board at the University of Cambridge would have ever approved of Kogan sharing his data with Cambridge Analytica^[26].

Universities around the globe actually encourage faculty to develop entrepreneurial companies, as Kogan did. That helps their research reach beyond campus to foster innovation in business, industry and government.

But the norms and rules that protect participants in academic research – such as not sharing identifiable personal data – do not stop at the door of the university.

Kogan’s exploits show that professors’ outside jobs may raise conflicts of interest and may have escaped the reach of institutional review. This is an area of academic work-for-hire that universities need to review with an eye toward updating how they enforce research ethics.

I’ve briefed institutional review boards at a number of universities, and I can attest that members often don’t understand how the internet has been transforming the way data is created^[27], gathered, analyzed and shared on the internet and social media networks.

Frequently, the authorities who grant professors and students permission to conduct their studies are anchored in the standards of medical research, not modern social science.

Many schools also generally fail to understand how cutting-edge some academic fields have become. Big data and computational analytics is one of the most innovative scientific fields today^[28].

Legitimate, company-approved access to social media user data allows researchers to study some of the most urgent issues of the 21st century^[29], including fake news, political echo chambers and technological trends. So it is not surprising that political campaigns would want to appropriate these research practices.

Until they come up with new rules, I fear universities’ lack of digital savvy will remain a threat to online privacy.

References

1. ^{^} many are calling for greater regulation (www.cnbc.com)
2. ^{^} massive data breach (constitution.com)
3. ^{^} a college researcher has now acknowledged (www.theguardian.com)
4. ^{^} a professor of media and information policy (scholar.google.com)
5. ^{^} Aleksandr Kogan (money.cnn.com)
6. ^{^} collected and analyzed Facebook user data (www.youtube.com)
7. ^{^} presumably with the knowledge of Facebook (www.vox.com)
8. ^{^} tens of millions (www.theverge.com)
9. ^{^} provided this data to a political consulting firm (www.nytimes.com)
10. ^{^} Kogan said in a March 21 BBC radio interview (www.bbc.com)
11. ^{^} strict guidelines (techcrunch.com)
12. ^{^} how people connected to one another (www.theatlantic.com)
13. ^{^} affected voter turnout (www.nature.com)
14. ^{^} impacted their moods (www.theguardian.com)
15. ^{^} widely criticized (www.theguardian.com)
16. ^{^} strengthened its existing guidelines (techcrunch.com)
17. ^{^} says (www.wired.com)
18. ^{^} Cambridge Analytica did not comply (www.wired.com)
19. ^{^} a Federal Trade Commission investigation (www.vox.com)
20. ^{^} Facebook to take enforcement much more seriously (www.nytimes.com)
21. ^{^} March 21 Facebook post (www.facebook.com)
22. ^{^} Facebook account has now been suspended (fortune.com)
23. ^{^} U.S. (www.legalmatch.com)
24. ^{^} U.K. (ico.org.uk)
25. ^{^} particularly in the U.K., with its strong social research traditions (www.esrc.ac.uk)
26. ^{^} sharing his data with Cambridge Analytica (www.bigdata.cam.ac.uk)
27. ^{^} the internet has been transforming the way data is created (mitpress.mit.edu)
28. ^{^} most innovative scientific fields today (www.amazon.co.uk)
29. ^{^} allows researchers to study some of the most urgent issues of the 21st century (mitpress.mit.edu)