6

Background:

One of the bigger news stories of this week is that a firm called Cambridge Analytica obtained data from Facebook, which was then analyzed and sold to politicians for the purposes of making targeted ads. Here's an article about it

Most of what I've read and heard about it suggests that they obtained access to any information which you make available to your friends:

The data, a portion of which was viewed by The New York Times, included details on users’ identities, friend networks and “likes.” The idea was to map personality traits based on what people had liked on Facebook, and then use that information to target audiences with digital ads.

Researchers in 2014 asked users to take a personality survey and download an app, which scraped some private information from their profiles and those of their friends, activity that Facebook permitted at the time and has since banned.


The issue is that when I talk with people about this issue, I want to be doubly sure that "information you share with your friends" is an accurate description of what was harvested. If there was any information harvested that goes beyond that description I would like to be aware of it so that I don't embarrass myself in front of people.

Exactly what information was made available to Cambridge Analytica? More specifically, Is there anything that you might reasonably expect to be private even from your Friends?

I care primarily about users who didn't interact with the app, however including information for those who did would be a bonus.

  • Do you mean from the users who interacted with the Facebook app, or the friends of those users? Most coverage implies that the volume of data was different in the two cases. – origimbo Mar 21 '18 at 22:39
  • @origimbo Mostly the users that didn't interact with the app. – Sam I am says Reinstate Monica Mar 21 '18 at 22:43
  • 5
    While this is a good question, and there is certainly due to be a political angle to the wider story, I'm not sure what this specific question has to do with politics. – Joe C Mar 22 '18 at 7:11
11

In simplest terms, it seems that the answer is that at most any information that a user had opted to share with his/her friends was available to Facebook apps prior to 2014.

The documentation for the "user" object under v1.0 of the Facebook Graph API can still be found on the wayback machine: Facebook documentation 2010. However there is some Javascript on that page that interacts poorly with Archive.org and/or my browser, so I've provided a screenshot of the first part of the table here:

enter image description here

This table continues for a total of almost 30 rows; in summary:

  • all users' names, gender, locale, facebook id, and verification status are listed as "Publicly Available", meaning that the app would be able to harvest this information from all of the friends of anyone running the app.
  • users email addresses, "bio" and "quotes" sections seem not to be available to apps run by friends regardless of user permissions.
  • quite a lot of other info is potentially available, but sharing could be turned off by users in their privacy settings. (see this question)

So depending on user settings (and which fields they had filled out in their profile), the app could also potentially access users':

  • birthday
  • education and work history
  • "about me" blurb
  • hometown
  • relationship status & desires
  • religion & political affiliation

I'm not sure of the status at the time this particular app was active, as Facebook did modify privacy options over time, but I think that most of these permissions were "opt-out" ie. allowed by default. Also I believe at some point users were allowed to share these things with their friends but not with their friends' apps, presumably in order to allow users to address this use case while still being "social" with their friend graph.

I must say that the ability to build a graph of all this information linked to specific peoples' names, locales, and circle of acquaintances would be seriously enticing to marketers of any stripe, even if some of the information were a bit sparse due to users opting out. IMHO it is pretty naive to think that similar data dumps do not exist elsewhere; could be in the hands of just about anyone who was doing any major app deployment on Facebook pre-2014.

  • It appears the 'treat apps differently' option came in during the major 2014 changes, around the tail end of when Aleksandr Kogan was running his data collection techcrunch.com/2014/05/02/f8/… – origimbo Mar 23 '18 at 15:52
  • 1
    @origimbo Nice find-- it seems that FB rolled their changes out with "grandfathering", so apps from prior to April 2014 were allowed to keep using the v1.0 API for some time, about a year I think. So I guess they recognized the possibility of this sort of behaviour and chose to at least give users the option of opting out during the transition period. I'll see if I can work this into the answer... – jkf Mar 23 '18 at 16:42
1

The information that was shared was what people liked, who their friends were, and some information about those friends. Medium.com reported :

Users’ FRIENDS info available: About me, actions, activities, b-day, check-ins, education, events, games, groups, hometown, interests, likes, location, notes, online status, tags, photos, questions, relationships, religion/politics, status, subscriptions, website, work history

Apps could continue to collect information over time once consent was given. Consent did not expire. In addition, apps could access private messages in the Facebook mailbox. While that is not explicitly friend information, the app would be able to see both sides of the conversation. I.e. they can't see the friend's mailbox, but they can see messages sent from the friend to the person who gave consent and messages sent to friends.

This was version 1.0 of the Graph API. Since 2014, Facebook has been using version 2.0, which provides less information. In particular, it requires friends to consent to provide their information. So if none of someone's friends have consented, that person's friends' list will show as empty. Newer restrictions include expiring consent from apps that have not been used for three months or more.

People who did not consent to share information but whose friends consented had part of their friend's list shared. This is because friendship is a two-party relationship but only one party's consent was needed. In addition, some information (see quoted block above) was released transitively. If the friend could see the information, then the friend could consent to release that information.

If someone did not consent, Cambridge Analytica would not get their complete friends list, but they would get those parts of it that consented. This is significant even without the transitive information, because there are correlations based on a person's friends. For example, if your friends are rural or urban, then you probably are as well. Same thing with liberal/conservative and other characterizations. That network evaluation was important as well.

  • upvoted, best ans available at this time, we are bound to learn more as time goes on – BobE Mar 22 '18 at 2:16
  • So does (did) the API provide a breakdown of categories of people's "likes"? ie. "John's friend Bob likes guns" as opposed to "Bob likes John's post #123456, which shows John shooting a gun?" – jkf Mar 22 '18 at 3:28
  • @SamIam I also found this answer not specific enough, and have dug up the old Facebook API documentation which clarifies things somewhat. (As this [mis]feature was already deprecated in 2014). Hang on and I will get an answer up. – jkf Mar 22 '18 at 5:20
  • This post seems to be significantly more useful after the edit. Thank you – Sam I am says Reinstate Monica Mar 22 '18 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .