In our 733rd issue:

• MINILINKS
• ANNOUNCEMENTS

We Watched The Zuckerberg Hearings So You Don't Have To

In most issues of EFFector, we give an overview of all the work we’re doing at EFF right now. This week, we present a deep dive on the recent Facebook data revelations and Mark Zuckerberg's testimony before Congress.

As the nation searched for answers in the wake of Facebook’s Cambridge Analytica scandal, Mark Zuckerberg testified last week before a joint session of the Senate Judiciary and Commerce Committees as well as the House Energy and Commerce Committee. While many users’ suspicions were affirmed, many important questions went unasked, unanswered, or deflected. Can users trust tech companies to handle their personal information? Can a surveillance-based, advertising-powered platform provide real user privacy protections? If not, how should users, legislators, and the company itself respond?

These have long been important questions for users and platforms to explore. This particular scandal with Facebook and Cambridge Analytica was unique only in that it combined sweeping data collection, indiscriminate sharing, lax safeguards, and manipulative advertising into the perfect privacy storm. Several years ago, Facebook’s Graph API allowed a researcher to engage in voracious collection of millions of people’s data without anything resembling informed consent. Then Facebook failed to step in as Cambridge Analytica subjected that user data to privacy-invasive machine learning techniques for targeted advertising purposes. Perhaps worst of all, Facebook never notified users of a known bad actor’s unauthorized access to their data.

A Pivotal Time for Online Privacy

When a former Cambridge Analytica employee came forward to the press last month, it broke the dam on over a decade of Facebook privacy concerns.

This Cambridge Analytica fiasco and subsequent fallout serve as a reminder of the serious privacy risks that users face when their personal information is captured, analyzed, indefinitely stored, and shared by a constellation of data brokers, marketers, and social media companies.

Facebook has responded with a stream of statements and changes, from reorganizing privacy settings to locking down APIs to ending relationships with third-party data brokers. But none of these changes have addressed the problem at the core of not only Facebook’s but much of the popular web’s privacy problems: We can’t be full participants in 21st-century social and political discourse without providing advertisers and others a constant stream of our most intimate personal details.

You shouldn’t have to be a settings wizard in order to enjoy a popular platform in a safe, private way. Platforms should protect your privacy by default and by design, collecting information only with your affirmative, informed consent. You should have meaningful control over your information and your experience. And, if you decide that a particular platform isn’t doing a good enough job protecting the data you’ve entrusted it with, you should be able to leave and take all your information with you. These are just a few of the privacy rights that any responsible social media platform should provide for its users.

Word Games in Congress

Unfortunately, Mark Zuckerberg’s testimony in front of Congress gave us little confidence that the company is committed to providing the transparency and accountability at the foundation of those privacy rights. Instead, the hearings were full of technically accurate but deceptively incomplete word games, as well as hand-waving about AI, confusion about the roles of platforms and ISPs, and shocking inaccuracies about Section 230. Zuckerberg was unable to provide even ballpark answers about the scale at which Facebook tracks users and non-users across the web, and promised that his team would follow up at a later date a whopping 40 times.

With the hearings over, the question remains: What next? Above all, the guiding question should not be: What legislation do we need to make sure there is never another Cambridge Analytica? Rather, we should be asking: What privacy protections are missing, and how can we fill that gap while respecting other essential values like speech, user empowerment, and competition?

What Comes Next

A knee-jerk urge to slap rules on Facebook risks enshrining it as the sole guardian of our discourse and data, with the quasi-authoritarian power to police speech and squash rivals. It’s important to consider how any reactions to the Cambridge Analytica scandal, legislative or otherwise, might help or hinder potential future competitors. While Facebook has the vast resources to comply with whatever requirements Congress throws at it, smaller start-ups may not.

Facebook’s surveillance business model and data-hungry design have created real problems for its users’ privacy rights. But some of those problems can be fixed. Going forward, we can look for answers in existing laws, pressure from users and investors, and focused legislative steps where necessary. We need to be both creative and judicious to ensure that today’s solutions don’t become tomorrow’s unexpected problems.

miniLinks

Facebook's Week of shame: the Cambridge Analytica Fallout

How the dam broke. (The Guardian)

A Short History of Facebook's Privacy Gaffes

The recent scandal may result in significant reimagining of how we share our information online, and what responsibility platforms have to protect their users' information. But, it's certainly not the first time users have questioned their trust in Facebook. (Wired)

The Facebook Privacy Setting That Doesn't Do Anything at All

It shouldn't be entirely surprising that users struggled to understand how each privacy setting worked. At times, so did Facebook. (Wired)

The Giant List of Shit Mark Zuckerberg Swears He'll Get Back to Congress on

Mark Zuckerberg did face some important questions during the congressional hearings. We're still waiting for answers on many of them. (Gizmodo)

Supported by Donors

Our members make it possible for EFF to bring legal and technological expertise into crucial battles about online rights. Whether defending free speech online or challenging unconstitutional surveillance, your participation makes a difference. Every donation gives technology users who value freedom online a stronger voice and more formidable advocate.

If you aren't already, please consider becoming an EFF member today.

Administrivia

Editor: Nathan Sheard, Grassroots Advocacy Organizer
editor@eff.org

EFFector is a publication of the Electronic Frontier Foundation.
eff.org

Membership & donation queries: membership@eff.org

General EFF, legal, policy, or online resources queries: info@eff.org

Reproduction of this publication in electronic media is encouraged. MiniLinks do not necessarily represent the views of EFF.

Back issues of EFFector

This newsletter is printed from 100% recycled electrons.

EFF appreciates your support and respects your privacy. Privacy Policy.

Unsubscribe or change your email preferences, or opt out of all EFF email