Why the Cambridge Analytica Scandal is More Business As Usual Than News
As a Ph.D. student specializing in technology use, I’ve done a lot of research on Facebook. I even met Dr. Alexandr Kogan — of recent Cambridge Analytica fame — in person when he spoke at an international conference for psychologists. When I first heard of the outrage Cambridge Analytica had caused, I thought perhaps a hacker had broken into Facebook’s servers, or someone at the company had stolen financial information from someone’s fundraiser to sell on the black market. However, I was instead surprised to find that the public was angered by a procedure that is regularly used by social scientists, and — when done correctly — fits the ethical standards of the Belmont Report, which protects United States participants from exploitation. Some serious misunderstandings have arisen about how social media research is conducted, how consent is obtained, and how Facebook and other similar platforms operate. Although I don’t necessarily condone Facebook’s actions, I want to dispel some of these misconceptions so that the process of social media research doesn’t grind to a halt as a result of panic, and so that maybe more people will read the fine print before
What data did they get exactly?
Although I’ve never been under the hood at Facebook (I was cut after the last round of interviews for an internship), I’m very familiar with the data Facebook collects and how it is accessed and used by external parties like Cambridge Analytica. At its core, Facebook only really has what you have explicitly given it: your pictures, your profile information, your likes, your friend connections, and any text information you have posted such as status updates, comments, or private messages. This information is stored under your account and is available to those to whom you give access through something called an API — an application program interface. You can download it from Facebook yourself under your general account settings. However, all of that is a ton of data to look through, and even with Cambridge Analytica’s subset of 270,000 users, you can rest assured no one is reading your private messages to determine whether you’re liberal or conservative. Instead, Facebook can conduct large scale analyses with samples of people who consent to tell Facebook their political leanings, and find what patterns of likes, word usage, or social connections are typically associated with different positions. They can then use this as a baseline to predict where you fall on the political spectrum based on what you’ve liked and who you know, a process called machine learning. These predictions can be scarily accurate, as many people have noticed, but they are far from deterministic. These categories were formed based on pools of multiple peoples’ data, and trying to pass them off as accurate for each individual person is overreaching. Other more recent features such as facial recognition have been added, but (as my friend who was repeatedly tagged in my pictures as someone else can attest) they have a long way to go.
How did they get it?
You know that quiz you agreed to on Facebook that was going to tell you what Disney Princess you are? Or that app that pops up your Horoscope every time you sign on? These are mini plug-ins you can add on Facebook that are actually created by third parties outside of Facebook, whether it’s Horoscopes.com or a game like Candy Crush. You know that brief, annoying page that interrupts you when you are trying to sign into the app that says “this app will have access to…” with a list containing items like your email address, your location, and occasionally the right for the app to post to your wall? That’s how. Dr. Kogan simply created an app called “This is Your Digital Life” that advertised exactly what it was doing — figuring out your personality based on your behaviors on Facebook, and giving you a breakdown of your major traits. You explicitly gave it permission to do this, and to do this, you gave it access to your API. This method has been used by several research labs, including the myPersonality Project, to collect data, and as long as they inform you that the information will be used for research, this is legal and consistent with Facebook’s terms of service.
But was it ethical?
The first principle of the Belmont Report, a document that we academics in the United States use to guide ethical treatment of human subjects, is called “Respect for persons.” It states, among other things, that people participating in research have a right to informed consent, or full knowledge of the study and how their data will be used. Since the app has now been removed from Facebook, it’s unclear whether a script was shown detailing the required information to potential participants. Since Dr. Kogan was associated with Cambridge, it is most likely that an institutional review board (IRB) or a similar entity required him to do so when conducting the research. However, most likely information would only be included for the original study. You see, “This is Your Digital Life” was created to study personality and other factors based on location (which was the subject of the talk I attended by Kogan). However, according to a statement by Cambridge University, Kogan then reportedly rebranded his app, collecting more data to sell to Cambridge Analytica, who then used it as a basis for targeting political ads. This would have been against Facebook’s terms of service, but not against Cambridge’s policies, as Kogan assures no university resources were used in the new study.
“We have previously sought and received assurances from Dr Kogan that no University resources or facilities and none of the data collected for his academic research were used for his work with GSR [Kogan’s personal business] or the company’s subsequent work with any other party [i.e., Cambridge Analytica].
We understand from Dr Kogan that he originally created a Facebook app for academic research; however, he states that when the app was repurposed for use by GSR, it was rebranded and released with new terms and conditions, and it was made clear that this was commercial, not academic, research.”
— Statement from the University of Cambridge about Dr. Aleksandr Kogan, University of Cambridge, 2018
More importantly, it would be against most interpretations of the Respect for Persons principle. Although participants gave (presumably) informed consent for their data to be used by Kogan’s company, they didn’t necessarily consent to it being used by Cambridge Analytica. This may be why Kogan’s use of the same data for further academic study was rejected by Cambridge’s IRB (see statement below), assuming they use similar ethics guidelines to the United States. However, unless Facebook had knowledge of this exchange of information, it isn’t certain whether they’ve done anything wrong.
“In 2015, Dr Kogan applied to the University for ethical approval to use data collected on behalf of GSR for his academic research. His application was reviewed and subsequently rejected.”
— Statement from the University of Cambridge about Dr. Aleksandr Kogan, University of Cambridge, 2018
Of course, this isn’t the first time Facebook has gotten in trouble over less-than-obvious consent procedures, and that is a story for another time. Particularly problematic about their policies is the option for apps to take data from participants’ friends, who did not themselves consent to the app. However, Facebook stopped doing that in 2015, ironically right after the “This is Your Digital Life” project was executed. Further, Facebook founder Mark Zuckerberg’s recent testimony before congress demonstrates a gross misunderstanding about how Facebook handles data. Zuckerberg was asked how many “data categories” they keep, when in fact any categories such as “liberal” come from predictive algorithms performed on the data after the fact. He was asked how his platforms support themselves (possibly implying he was selling data), whether individuals were reading people’s’ private messages (machine learning makes this unnecessary), and whether he planned to give them the option to limit the release of data (the data is not released unless individuals grant access through agreeing to sign into apps). If you feel taken advantage of, its because Facebook and creators of Facebook apps knew about users’ tendencies not to read fine print and agreement scripts, and to passively click “I agree” in order to reach short term gratifications. If you feel watched and manipulated, you’re forgetting about years of political and market research determining when to run ads on television and what groups to target in order to get the largest response. This is business as usual — it’s just that, with the preponderance of individual information you now post on the internet, advertisers can mind your business much better than before.
