Whistleblower says Facebook knew risks but failed to act

The Facebook leak to Cambridge Analytica was “worse than a data breach”, a whistleblower said yesterday.

Whistleblower Sandy Parakilas, 38, worked at Facebook in 2011 and 2012.

The Facebook leak to Cambridge Analytica was “worse than a data breach” because the company failed to safeguard users even after it understood the risks, a whistleblower said yesterday.

Sandy Parakilas, 38, worked at Facebook in 2011 and 2012, two years before the data of 50 million users was obtained by a Cambridge University researcher and shared with the British firm in violation of Facebook’s terms.

Mr Parakilas told MPs he had warned senior executives that poor safeguards could enable “foreign powers” or data brokers to harvest users’ data without their consent. Speaking by video link, he told the House of Commons media committee that Facebook had not acted on his concerns before the leak.

He said the company’s previous practices that permitted developers to access data of users and their friends were “far outside the boundaries of what should have been allowed”. The company had failed to properly investigate a number of other reports of data misuse, suggesting that it had turned a blind eye because it feared incurring legal liability.

Mr Parakilas has told The Observer there was no control of data once it left the company’s servers.

He told the committee that he did not remember “a single physical audit of a developer’s storage” after reports of data misuse. When Facebook stopped allowing developers to access data on the “friends” of users it had acted to prevent rival social networks from obtaining their details, he said.

“Facebook didn’t want its data to go to data brokers, but their primary motive was to motivate the huge ecosystem of apps in the fastest way,” he said. “There were people like me saying it could go to data brokers; I think it was a risk they were willing to take.”

Mr Parakilas criticised Facebook for failing to notify users, sue Cambridge Analytica or call in law enforcement after reports that the British firm used the data to target voters. Instead, it continued to accept Cambridge Analytica’s assurances that it had destroyed the records obtained without consent.

WEB World Whistleblower Facebook graphic

Facebook has denied reports that users were victims of a data “breach”, saying that the data was obtained by the researcher Aleksandr Kogan in line with its own terms and conditions.

Massachusetts Institute of Technology researchers warned yesterday that while Facebook has made it harder to gather users’ data since 2014, software developers could harvest large quantities of data without users’ permission or knowledge. In a blog post, they added that “such activity can be made difficult to distinguish from ordinary” browsing.

News Corp chief executive Robert Thomson said Facebook and YouTube were guilty of publishing “pernicious” and “reprehensible” content because they refused to spend the money required to keep their sites safe.

He warned that social media users struggled to differentiate between fact and fiction because they had been “socialised to accept” dubious content online. He also expressed fears that the tech titans could manipulate their algorithms for political and commercial gain — to penalise com­petitors or censor stories they did not like. News Corp is the ultimate owner of The Times and The Australian. Mr Thomson warned that Facebook was in a “state of denial” about its role in enabling the spread of harmful content.

The Times