Facebook CEO Mark Zuckerberg: We shouldn't have trusted Cambridge Analytica's certification, won't repeat mistake

WASHINGTON/LONDON: Breaking five days of silence, Facebook CEO Mark Zuckerberg apologized for a "major breach of trust," admitted mistakes and outlined steps to protect user data in light of a privacy scandal involving a Trump-connected data-mining firm. Facebook first learned of this breach of privacy more than two years ago, but hadn't mentioned it publicly until Friday.

"I am really sorry that happened," Zuckerberg said of the scandal involving data mining firm Cambridge Analytica. Facebook has a "responsibility" to protect its users' data, he said in a Wednesday interview on CNN. If it fails, he said, "we don't deserve to have the opportunity serve people."

His mea culpa on cable television came a few hours after he acknowledged his company's mistakes in a Facebook post, but without saying he was sorry.

Zuckerberg announced new steps to rein in the leakage of data to outside developers and third-party apps, while giving users more control over their information through a special toolbar.

ALSO READ | Cambridge Analytica row: How is data mined and how are voters influenced?

Zuckerberg said he will testify before Congress if he is the person at Facebook best placed to answer their questions, and that he is not opposed to regulating internet titans such as the social network.

"I am actually not sure we shouldn't be regulated," the Facebook co-founder and chief told CNN.

"Technology is an increasingly important trend in the world; the question is more the right regulation than should it be regulated."

Zuckerberg said measures had been in place since 2014 to prevent the sort of abuse revealed over the weekend but the social network needed to "step up" to do more. 

CLICK BELOW TO WATCH VIDEO

Even before the scandal broke, Facebook has already taken the most important steps to prevent a recurrence, Zuckerberg said. For example, in 2014, it reduced access outside apps had to user data.

However, some of the measures didn't take effect until a year later, allowing Cambridge to access the data in the intervening months.

Zuckerberg acknowledged that there is more to do.

The scandal erupted when a whistleblower revealed that British data consultant Cambridge Analytica (CA) had created psychological profiles on 50 million Facebook users via a personality prediction app, created by a researcher named Aleksandr Kogan.

The app was downloaded by 270,000 people, but also scooped up their friends' data without consent -- as was possible under Facebook's rules at the time ---  including those who never downloaded the app or gave explicit consent.

Facebook says it discovered last week that CA may not have deleted the data as it certified.

"We should not have trusted Cambridge Analytica's certification, and we are not going to make that mistake again," Zuckerberg said.

READ HERE | How Facebook likes could profile voters for manipulation

Facebook is reviewing how much data was accessed by every app at the social network, and will conduct full forensic audits if it notices anything suspicious, according to its chief executive.

In his Facebook post, Zuckerberg said it will ban developers who don't agree to an audit. An app's developer will no longer have access to data from people who haven't used that app in three months. Data will also be generally limited to user names, profile photos and email, unless the developer signs a contract with Facebook and gets user approval. In a separate post, Facebook said it will inform people whose data was misused by apps.

'Breach of trust'

"This was a breach of trust between Kogan, Cambridge Analytica and Facebook," Zuckerberg wrote in a post at the social network.

"But it was also a breach of trust between Facebook and the people who share their data with us and expect us to protect it."

"We need to fix that."

Zuckerberg's apology followed another day of damaging accusations against the world's biggest social network as calls mounted for investigations on both sides of the Atlantic.

READ FULL POST HERE

Max Schrems, a Vienna-based activist who has brought online data protection cases before European courts, told AFP he complained to the Irish Data Protection Authority in 2011 about the controversial data harvesting methods.

Schrems also recounted meeting with Facebook representatives the following year to discuss concerns around apps operating in this fashion.

"They explicitly said that in their view, by using the platform you consent to a situation where other people can install an app and gather your data," Schrems said.

ABC News reported that special counsel Robert Mueller, who is investigating Russian interference in the 2016 campaign, was looking at Cambridge Analytica's role in the Trump effort.

The British firm has maintained it did not use Facebook data in the Trump campaign, but its now-suspended CEO boasted in secret recordings that his company was deeply involved in the race.

#DeleteFacebook

The data scandal has ratcheted up the pressure on Facebook -- already under fire for allowing fake news to proliferate on its platform during the US presidential election.

A movement to quit the social network gathered momentum, while a handful of lawsuits emerged which could turn into class actions in a costly distraction for the company.

One of those calling it quits was a high-profile co-founder of the WhatsApp messaging service acquired by Facebook in 2014.

"It is time. #deletefacebook," Brian Acton said in a tweet protesting the social media giant's handling of the crisis.

Kogan says he is being made a scapegoat

Both Facebook and CA have denied wrongdoing, as attention focused increasingly on Kogan, the inventor of the controversial app -- a personality survey dubbed This Is Your Digital Life.

But Kogan said in an interview he was "stunned" by the allegations against him, claiming CA had assured him his activities were above board.

"I'm being basically used as a scapegoat by both Facebook and Cambridge Analytica," he told the BBC.

The University of Cambridge psychologist said CA had approached him to do the work, and that he did not know how the firm would use the data collected with his app. 

"One of the great mistakes I did here was I just didn't ask enough questions," he said. "I had never done a commercial project. I didn't really have any reason to doubt their sincerity. That's certainly something I strongly regret now." He said the firm paid some $800,000 for the work, but it went to participants in the survey. "My motivation was to get a dataset I could do research on," he said. "I have never profited from this in any way personally."

Call for investigation

European Union officials have called for an urgent investigation while British, US and EU lawmakers have asked Zuckerberg to give evidence.

British Prime Minister Theresa May has urged Facebook and CA to cooperate with the national information commissioner's probe.

"The allegations are clearly very concerning," she told MPs.

Facebook shares steadied Wednesday, gaining 0.74 percent after steep declines this week that wiped out some $50 billion in market value.

But questions abounded on the future of Facebook.

Analyst Brian Wieser at Pivotal Research said in a research note that Facebook "is exhibiting signs of systemic mismanagement," possibly from growing too fast.

'Zuckerberg's response is just the beginning'

David Carroll, a professor at Parsons School of Design in New York who sued Cambridge Analytica in the U.K., said he was not satisfied with Zuckerberg's response, but acknowledged that "this is just the beginning."

He said it was "insane" that Facebook had yet to take legal action against Cambridge parent SCL Group over the inappropriate data use. Carroll himself sued Cambridge Friday to recover data on him that the firm had obtained.

Sandy Parakilas, who worked in data protection for Facebook in 2011 and 2012, told a U.K. parliamentary committee Wednesday that the company was vigilant about its network security but lax when it came to protecting users' data.

He said personal data including email addresses and in some cases private messages was allowed to leave Facebook servers with no real controls on how the data was used after that.

"The real challenge here is that Facebook was allowing developers to access the data of people who hadn't explicitly authorized that," he said, adding that the company had "lost sight" of what developers did with the data.

(With inputs from AP, AFP)