The corrective measures required post-Facebook data breach

The corrective measures required post-Facebook data breach

FacebookBy Sameer Dhanrajani,

The Facebook data breach raises urgent questions that need to be answered responsibly by our industry — given its terrifying scale and impact. In today’s world, data is a form of soft power, and it is essential for those who wield it, to use it responsibly so that consumer confidence isn’t compromised.

The challenge is that, at an idea-generation stage, it can be difficult to draw a clear, bright line between whether data is being used for optimisation or for manipulation.

Take, for instance, the Obama and Trump campaigns in the US. The former used the same digital platforms for optimising communication and ensuring voter confidence and dissemination of information. On the other hand, British political consulting firm Cambridge Analytica used the same platforms but with malafide intent — to manipulate the views and preferences of voters.

As investigations continue, it is increasingly clear that data was stolen, models used were unauthorised for the purpose they were being used, the messages (in many cases) were outright lies.

So the whole operation was questionable from the get-go. It is, therefore, extremely critical to demarcate this difference — are the final consumers of a data-driven model being actively manipulated or is data being used to merely optimise a communications strategy?

It is also essential to clearly define the parties involved in the data “lifecycle” and their roles and responsibilities, with regard to how data is being used. There are usually three parties in this lifecycle, each requiring a different kind of oversight and norms.

First are the data originators, those that capture and store the data. And I’m not only talking about Facebook and Google, but also a wide range of other originators — for e.g. Equifax (which holds extremely sensitive consumer credit information), banks (which store individual-centric financial information), telecom organisations (which hold a treasure trove of communications and browsing information), etc.

Two safeguards are critical here.

One, data security safeguards to ensure the privacy (external parties shouldn’t be able to see it) and integrity (external parties shouldn’t be able to change it) of the data. This can be improved by ring-fencing the data sources and ensuring advanced security measures.

And two, ensuring explicit consumer consent for sharing and using this data. This can be done by introducing easy-to-understand verbiage around fair-use — where their data could be used and for what purposes.

These two interventions — data security and informing users where data could be shared — are the key and will go a long way in winning back consumer trust in these platforms.

The second type of entity involved is the data processing companies which employ intelligent algorithms over the data to extract insights. This includes companies like Cambridge Analytica.

Given that data processing companies also have access to a large scale of data, entrusted by clients, it is imperative that their systems are subject to similar levels of security, compliance and governance norms.

This can be resolved through globally-agreed standards of security, enforced through regular third-party audits. We need to be held to the same standards as the data sources themselves when it comes to security of the data so that we aren’t the weak link in the event of a data leak.

There may also be value in exploring how we can expressly declare the nature of algorithms employed and the source of these algorithms (in cases where there is a patent to one), to an unaffiliated third-party regulator. This will ensure better transparency around what the data is being used for.

Finally, we have the third party in the data lifecycle: The buyers of the data — organisations that pay for the data and algorithm-driven insights around it. In this case, they are the political organisations that are beneficiaries of the analysis work by the processing companies.

Here, let’s go back to my earlier point of drawing the line between what is optimisation and manipulation.

Are the data buying organisations sponsoring an ad because they feel consumers genuinely stand to benefit from the content, or are they using the data to manipulate users into actions that are not in their best interest?

More importantly, does the ad-sponsoring organisation have the authority to display that ad, or are they a geo-political adversary? This can be cleared up by implementing fair-usage policies around what the extracted data is being used for, who is using it, and what are the implications of that data — all of which needs to be made more transparent and subject to governance norms in certain cases.

Obviously, the three parties interplay with each other. For instance, Facebook and Google are two of these parties — the source and the processor. Thus, it needs to be ensured that they be accountable to both sets of norms.

It is imperative that all parties in the data lifecycle take seriously the trust with which data is being shared with them by their users — for their own good. The way things stand right now, biting around the edges of this debate is not going to win back lost consumer confidence in our industry and we are all the losers in the long term.

(Sameer Dhanrajani is Chief Strategy Officer at analytics service provider Fractal Analytics. The views expressed are personal. He can be contacted at sameerdhanrajani@gmail.com)

—IANS

US authorities confirm Facebook probe for data leaks

US authorities confirm Facebook probe for data leaks

FacebookNew York : The US Federal Trade commission has confirmed that it was investigating Facebook after the leak of personal and other data on some 50 million users to political consulting firm Cambridge Analytica.

The FTC said on Monday that it “takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook”.

“Today, the FTC is confirming that it has an open non-public investigation into these practices,” Efe news quoted Acting FTC Bureau of Consumer Protection Director, Tom Pahl, as saying.

Pahl emphasized that the agency is committed to using “all of its tools” to protect the privacy of consumers and that the main such tool is “enforcement action” against companies that do not fulfill their promises in the data privacy area or that violate the law.

He explained that the FTC is acting against firms that do not abide by the “Privacy Shield” agreement regulating data transfer with the European Union and against companies that undertake “unfair acts” that harm consumers or violate the FTC Act.

“The FTC is firmly and fully committed to using all of its tools to protect the privacy of consumers. Companies who have settled previous FTC actions must also comply with FTC order provisions imposing privacy and data security requirements,” a statement said.

“Accordingly, the FTC takes very seriously recent press reports raising substantial concerns about the privacy practices of Facebook.”

Rob Sherman, Facebook’s deputy privacy chief, said in a statement last week that the social networking firm remains “strongly committed to protecting people’s information,” adding that “we appreciate the opportunity to answer questions the FTC may have”.

A week ago, after the controversial leak of private information on millions of users came to light, press reports said that the FTC was investigating whether Facebook violated the terms of a 2011 consent agreement requiring user consent for sharing data by providing use data to Cambridge Analytica in 2014.

The London-based political research organization, which collaborated with the election campaign of Donald Trump in the runup to the 2016 vote, used the leaked information to develop a computer programme to predict the decisions of US voters and influence them.

In 2011, Facebook promised to ask for the consent of its users before making certain changes in their privacy preferences, as part of an agreement with the government, which accused the firm of abusing consumers by sharing with third parties more information than users had authorized.

Breaking that agreement could result in the tech firm facing a fine of $40,000 per violation, the CNBC financial network said.

Facebook CEO Mark Zuckerberg on March 21 admitted that it was a “breach of trust” to allow an app developed by Cambridge University professor Aleksandr Kogan to collect data for Cambridge Analytica, and he added that the firm will “fix” the problem by, among other things, investigating all apps that could access users’ personal data before 2014 and banning any developer that “does not agree to a thorough audit”.

After Monday’s announcement, Facebook shares fell by as much as 6 per cent on Wall Street.

Last week, the firm suffered significantly in the markets as its stock price plunged, reducing the value of outstanding shares by some $50 billion.

—IANS

Congress sharing users’ data with Singapore-based firm: BJP

Congress sharing users’ data with Singapore-based firm: BJP

SmartphoneNew Delhi : The Bharatiya Janata Party (BJP) on Monday accused the Congress of sharing users’ date to a Singapore-based firm.

The accusation comes a day after Congress President Rahul Gandhi referred to a media report in which a French vigilante hacker in a series of tweets alleged that the personal data including email IDs, photos, gender and names of the users of Prime Minister Modi’s mobile app were being sent to a third party domain without their consent.

“Hi! My name is Rahul Gandhi. I am the President of India’s oldest political party. When you sign up for our official Application, I give all your data to my friends in Singapore,” BJP leader Amit Malviya said in a series of tweets attaching screenshots of the Congress’ website privacy policy listings.

Malviya is in-charge of BJP’s national Information and Technology wing.

“Full marks to Congress for stating upfront that they’ll give your data to practically anyone – undisclosed vendors, unknown volunteers, even groups with similar causes. In theft of all forms, Congress has never been discreet!

“When Congress says they will share your data with like-minded groups, the implications are grave. From Maoists, stone pelters, Bharat ke Tukde Gang, Chinese embassy to globally ‘renowned’ organisations like Cambridge Analytica, the field is extensive and wide open.

https://twitter.com/malviyamit/status/978099990848565254

“Inspired by Sonia Gandhi’s all power no accountability dictum, Congress will take all your data, even share it worldwide with organisations like Cambridge Analytica but will not take responsibility of it! Their own policy says so,” the BJP leader said.

Earlier, the BJP accused the Congress of compromising national security by roping in political data analytics firm Cambridge Analytica to run its 2019 election campaign.

The London-based data consultancy firm is currently in the midst of a global row after reports surfaced that the data of more than 50 million Facebook users were inappropriately used by Cambridge Analytica, in activities allegedly connected with US President Donald Trump during his 2016 presidential campaign.

—IANS