The perils of Facebook friendship just became painfully clear.
Virginia Attorney General Mark Herring said Wednesday that 7,100 Facebook users in the state along with 1.7 million of their Facebook friends may have had their personal information exposed to an outside firm harvesting data for the successful political campaign of President Donald Trump.
More than 99.5 percent of them did nothing to expose their personal information on the social network.
“While we continue to await a fuller explanation about this incident from Facebook and its leadership, an important first step is getting our arms around the scale of the exposure,” said Herring, one of 37 state attorneys general who have asked specific questions about the privacy breach.
His announcement came the same day Cambridge Analytica, a political consulting firm that harvested the information collected through Facebook, announced that it would cease most operations and file for bankruptcy.
The decision came less than two months after the firm — co-founded by former Trump adviser and Richmond native Steve Bannon — and Facebook became embroiled in a data-harvesting scandal that compromised the information of up to 87 million people.
The revelations about the misuse of data, by The New York Times along with The Observer of London, plunged the social media giant into crisis and prompted regulators and lawmakers to begin investigations into Cambridge Analytica.
In a statement Wednesday, Facebook said, “This doesn’t change our commitment and determination to understand exactly what happened and make sure it doesn’t happen again. We are continuing with our investigation in cooperation with the relevant authorities.”
The source of the alleged breach was a Facebook quiz app, called ThisIsYourDigitalLife. The third-party research app collected information not only on Facebook users who approved it but also their friends.
Herring said 7,103 users in Virginia installed the application, which then exposed 1.7 million of their friends to having personal data collected by Cambridge Analytica. For Virginia, the number of “total impacted users” is 1,709,835, according to information that Facebook posted Tuesday.
“The fact that 1 in 5 Virginians may have had their personal information shared without permission is extremely troubling,” the attorney general said in a statement. “I’d encourage all Virginians to take this opportunity to review their privacy settings and make sure they understand just what they may be sharing with Facebook and other social media platforms.”
Gov. Ralph Northam also expressed concern through spokesman Brian Coy, who said, “Privacy is a fundamental right and there’s clear cause for concern here.”
In total, Facebook has said that Cambridge Analytica had access to data on 87 million people, including 71 million Americans, in its efforts to create detailed profiles about voters’ backgrounds and behaviors, as well as what types of political messages might appeal to them based on their personalities.
Herring’s estimates of the effect of the alleged breach in Virginia came from Facebook’s response to a letter that he and other attorneys general sent to CEO Mark Zuckerberg late last month.
Their questions included:
- How many users in each state may have been affected?
- Were the terms of service clear and understandable?
- What controls did Facebook have over data given to developers?
- What safeguards did the company have in place?
- When did it learn of the breach?
Larry Sabato, director of the Center for Politics at the University of Virginia, said Wednesday, “I don’t think there are any tears being shed over the death of Cambridge Analytica, but what they did is being duplicated by others.”
“It’s one of the risks being online, particularly Facebook,” Sabato said.