Sandy Parakilas, the platform operations manager at Facebook responsible for policing data breaches by third-party software developers between 2011 and 2012... [said] “My concerns were that all of the data that left Facebook servers to developers could not be monitored by Facebook, so we had no idea what developers were doing with the data” ... Parakilas said Facebook had terms of service and settings that “people didn’t read or understand” and the company did not use its enforcement mechanisms, including audits of external developers, to ensure data was not being misused....Here's the earlier post: "'Facebook allowed the Obama campaign to access the personal data of users during the 2012 campaign because they supported the Democratic candidate...'"
“It has been painful watching,” he said. “Because I know that they could have prevented it.” Asked what kind of control Facebook had over the data given to outside developers, he replied: “Zero. Absolutely none. Once the data left Facebook servers there was not any control, and there was no insight into what was going on.”
And here's my post from 2 days ago, criticizing Facebook for making a narrow, legalistic argument Facebook... for itself." I said: "That's not going to work. We didn't give it to X. We gave it to Y who gave it to X. It's a laundering argument." And I recommended that Facebook fall back onto the argument that "It's good to use this data to facilitate communication, especially on topics of great public concern."
I'm still trying to get a grip on this story, but my orientation to it is that I'm skeptical that there was any "leak" or "breach" of security. It think Facebook did what it intended to do, but there's just some static over that choice because it became apparent that Mercer money had energized a right-wing use of the data.
ADDED: Bloomberg reports this morning that the Federal Trade Commission is investigating Facebook for possibly violating a consent decree:
Under the 2011 settlement, Facebook agreed to get user consent for certain changes to privacy settings as part of a settlement of federal charges that it deceived consumers and forced them to share more personal information than they intended. That complaint arose after the company changed some user settings without notifying its customers, according to an FTC statement at the time.Did Facebook make changes that they didn't tell users about or did users just not "read or understand" what Facebook told them?