Advertisement

SKIP ADVERTISEMENT

‘You Are the Product’: Targeted by Cambridge Analytica on Facebook

Video
bars
0:00/2:31
-0:00

transcript

How Cambridge Analytica Exploited the Facebook Data of Millions

Tens of millions of American Facebook users had their data harvested by Cambridge Analytica and a British-based researcher. Here’s how it happened.

In 2014, you may have taken a quiz online, something that looked like this. And if you did, you probably shared your personal data, and your friends’ personal data, with the company that worked for President Trump’s 2016 campaign. Here’s how it happened. It begins with a political consulting firm, Cambridge Analytica. It partnered with a U.K.-based academic, Aleksandr Kogan, who was using Facebook data for research purposes. Quizzes were sent to around 300,000 Americans. They looked innocuous — over 100 personality traits to agree or disagree with. And you got paid less than $5. But there was a catch. To take the survey, you had to log into Facebook, which gave Kogan access to your profile, including your birth date, location and, most importantly, your Facebook likes. Kogan combined the quiz results with your Facebook data to develop a psychometric model, a sort of personality profile. He then combined this with voter records and sent them to Cambridge Analytica. C.A. claimed that these models were the heart of how they profiled you — your neuroses and other exploitable traits. But Kogan and C.A. didn’t stop there. His app also grabbed the personal data of your Facebook friends and compiled similar profiles of them. In just months, 270,000 people took Kogan’s survey, and the data of up to 87 million friends was also harvested — close to one-quarter of all U.S. Facebook users. C.A. then used that data to target people, maybe you, with political messaging. C.A. said this targeting helped the Trump campaign’s strategy, but the campaign disputes this. Kogan’s work claimed to be for academic research, but he also shared your information with Cambridge Analytica — a violation of Facebook’s policies. So, was it a data breach? Facebook says no — that no passwords were stolen and no systems were infiltrated. But Mark Zuckerberg has said it was a breach of trust between Facebook and its users. The U.S. Federal Trade Commission is investigating the case.

Video player loading
Tens of millions of American Facebook users had their data harvested by Cambridge Analytica and a British-based researcher. Here’s how it happened.

Christopher Deason stumbled upon the psychological questionnaire on June 9, 2014. He was taking a lot of online surveys back then, each one earning him a few dollars to help pay the bills. Nothing about this one, which he saw on an online job platform, struck him as “creepy or weird,” he said later.

So at 6:37 that evening, Mr. Deason completed the first step of the survey: He granted access to his Facebook account.

Less than a second later, a Facebook app had harvested not only Mr. Deason’s profile data, but also data from the profiles of 205 of his Facebook friends. Their names, birth dates and location data, as well as lists of every Facebook page they had ever liked, were downloaded — without their knowledge or express consent — before Mr. Deason could even begin reading the first survey question.

The information was added to a huge database being compiled for Cambridge Analytica, the political data firm with links to Donald J. Trump’s 2016 presidential campaign. None of the people whose data was collected knew it had happened, not even Mr. Deason. “I don’t think I would have gone forward with it if I had,” Mr. Deason, 27, said in a recent interview.

Mr. Deason and his Facebook friends became early entries in a database that would ultimately encompass tens of millions of Facebook profiles and is now at the center of a crisis facing the social media giant. News of Cambridge Analytica’s data collection, first reported last month by The New York Times and The Observer of London, has spurred a #DeleteFacebook movement and brought the social network under intensifying scrutiny from lawmakers and regulators in the United States and Britain.

Still, few of the roughly 214 million Americans with Facebook profiles know whether their data was among the information swept up for Cambridge Analytica. Facebook, which learned of the data misuse in December 2015, plans to begin telling affected users on Monday, a day before its founder, Mark Zuckerberg, is to testify before Congress. Records reviewed by The Times show that roughly 300,000 people took the survey, but because of the access to friends’ information allowed at the time, Facebook said that as many as 87 million users could have been affected.

But The Times, which has viewed a set of raw data from the profiles that Cambridge Analytica paid an academic researcher to obtain, contacted nearly two dozen affected Facebook users in recent weeks. Some were angry — one woman compared it to being robbed — while others were annoyed but unsurprised, having grown cynical about tech giants’ use of the data they collect. They are some of the first known affected Facebook users to be publicly identified. And nearly all said the misuse of their data had given them second thoughts about staying on Facebook.

Image
When Christopher Deason took an online survey in 2014, he and his Facebook friends unknowingly became early entries in a database that would eventually encompass tens of millions of Facebook profiles.Credit...Michael Shroyer for The New York Times

“I’ve come to grips with the fact that you are the product on the internet,” said Mark Snyder, 32, who lives in Pompano Beach, Fla., and was among Mr. Deason’s friends whose data was collected.

“If you sign up for anything and it isn’t immediately obvious how they’re making money, they’re making money off of you,” said Mr. Snyder, who maintains computer networks for a living.

Mr. Zuckerberg has said the misuse of data represented a “breach of trust” by the company. But even he has suggested that other app developers could have done the same.

Until April 2015, Facebook allowed some app developers to collect some private information from the profiles of users who downloaded apps, and from those of their friends. Facebook has said it allowed this kind of data collection to help developers improve the “in-app” experience for users. But Facebook appears to have done little to verify how developers were using the data or whether they were providing any kind of experience on Facebook at all.

The questionnaire used to collect data for Cambridge Analytica was not actually on Facebook. It was hosted by a company called Qualtrics, which provides a platform for online surveys. It consisted of dozens of questions often used by psychology researchers to assess personality, such as whether the respondent prefers to be alone, tries to lead others and loves large parties (the answer choices range from “disagree strongly” to “agree strongly”). The questionnaire took about 10 to 20 minutes to complete.

When respondents authorized access to their Facebook profiles, the app performed its sole function: to take the users’ data and that of their friends. There was no “in-app” experience to speak of; this was not intended to be the sort of cute online quiz that tells users which “Friends” character they most resemble or how their brunch preferences reveal their inner Disney princess.

Facebook has said that people who took the quiz were told that their data would be used only for academic purposes, claiming that it and its users were misled by Cambridge Analytica and the researcher it hired, Aleksandr Kogan, a 28-year-old Russian-American academic. But the fine print that accompanied the questionnaire may have told users that their data could be used for commercial purposes, according to a draft of the survey’s terms of service that was reviewed by The Times.

Image
Jim Symbouras’s profile data was collected dozens of times after Facebook friends of his were directed to the online survey.Credit...Sam Hodgson for The New York Times

Selling users’ Facebook data would have been an outright violation of the company’s rules at the time. Yet the company does not appear to have regularly checked to make sure that apps complied with its rules. And the final wording of the survey’s terms of service is now most likely unknowable: Facebook executives said they deleted the app in December 2015 when they found out about the data harvesting.

Cambridge Analytica used the Facebook data to help build tools that it claimed could identify the personalities of American voters and influence their behavior. The firm has said that its so-called psychographic modeling techniques underpinned its work for Mr. Trump’s campaign in 2016, setting off a still-unsettled debate about whether the firm’s technology worked.

The uproar over Cambridge Analytica’s misuse of the data has added to questions Facebook was already confronting over the use of its platform by those seeking to spread Russian propaganda and fake news.

“Cambridge Analytica is the big story on the topic, but there have been numerous stories about Facebook either selling user data or giving third parties access and using it to help advertising,” Mr. Deason said.

He was especially irked by the ways Facebook and other social media directed advertisements based on what users posted or viewed online.

If he recommends, say, a Dell laptop to a friend, he said, “I go to the next page on Facebook and there’s a Dell ad.”

“That bothers me,” he said.

Mr. Deason, who runs a computer business in Roanoke, Va., is probably among Facebook’s more tech-savvy users. He is keeping his account open for now because his business has its own page and he moderates Facebook groups dedicated to computers.

“But if I were just working my 9-to-5 at the local bank or whatever, and coming home and getting on Facebook to check on my friends and whatnot, yeah, I would delete Facebook,” he said.

Many people who took the survey do not have a background in technology, including Jim Symbouras, 56, a municipal worker in New York City.

His data was collected dozens of times after 52 of his Facebook friends were directed to the psychological questionnaire, many by a site called Swagbucks. The site lets people earn gift cards to Amazon and other retailers in exchange for taking surveys or watching video advertisements.

Mr. Symbouras does not personally know any of the Facebook friends who granted the app access to his data. He met them in Facebook groups where Swagbucks users traded tips for finding good deals.

Amy Risner, 52, of Collinwood, Tenn., was one of those Facebook friends. Ms. Risner, who does not work full time, vaguely recalled the questionnaire — “It was real long, that’s what I remember” — but was certain she never saw any notice that her data or that of her friends would be collected.

“If it would have said anything like that about taking my information — my personal information — I would have backed out of it and not done it,” Ms. Risner said.

Facebook, though, is a tough habit to kick. Asked if she was thinking about deleting her account, Ms. Risner said, “I’m just too nosy to stay off it.”

Follow Matthew Rosenberg on Twitter at @AllMattNYT, and Gabriel J.X. Dance at @gabrieldance

Malachy Browne contributed reporting.

A version of this article appears in print on  , Section A, Page 1 of the New York edition with the headline: Affected Users Say Facebook Betrayed Them. Order Reprints | Today’s Paper | Subscribe

Advertisement

SKIP ADVERTISEMENT