Zuckerberg weighed naming Cambridge Analytica as a concern in 2017, months before data leak was revealed

CNN
 — 

Mark Zuckerberg considered disclosing in 2017 that Facebook

(FB) was investigating “organizations like Cambridge Analytica” alongside Russian foreign intelligence actors as part of an election security assessment before ultimately removing the reference at his advisers’ suggestion, according to a 2019 deposition conducted by the Securities and Exchange Commission and reviewed by CNN.

The omitted reference provides insight into Zuckerberg’s thinking on Cambridge Analytica in the critical months before press reports would reveal that the data analysis firm affiliated with Donald Trump’s 2016 presidential campaign had improperly gained access to tens of millions of Facebook users’ personal information. The data leak prompted a global outcry that led to hearings, an apology tour from Zuckerberg and Facebook’s $5 billion privacy settlement with the US government.

The deposition transcript suggests that in 2017, Zuckerberg considered Cambridge Analytica a potential election concern on par with Russian election meddling efforts even though he said he did not know about the data leak first discovered by Facebook staffers in 2015. It also points to how Facebook staffers had opportunities to brief Zuckerberg on that leak, but chose not to, prior to reports about the incident that surfaced in 2018.

Zuckerberg’s remarks in the deposition offer the clearest picture yet of what Zuckerberg knew about Cambridge Analytica, and when. The timeline of events has previously been scrutinized intensely by US lawmakers, state attorneys general and investors who have sued Facebook, now known as Meta, for allegedly breaching its fiduciary duties in connection with the data leak incident.

Meta declined to comment on the release of the transcript, saying its case with the SEC involving the deposition had been settled for more than three years. The settlement in 2019 for $100 million resolved US government allegations that Facebook had misled investors for years after staffers first discovered the data leak.

The SEC deposition transcript was released Tuesday by the Real Facebook Oversight Board, a watchdog group, that had obtained the document via a public records request. The transcript was first reported on Tuesday by Reuters, which had obtained the document through a separate records request.

“This transcript reveals that something changed between January 2017 and September 2017 for Zuckerberg to deem Cambridge Analytica a threat commensurate with Russian Intelligence,” said Zamaan Qureshi, policy advisor at the Real Facebook Oversight Board. “But for reasons the Facebook CEO has still not disclosed, the world would only learn about Cambridge Analytica in March 2018.”

In September 2017, Zuckerberg released a public statement about Facebook’s efforts to safeguard election integrity, saying the company would look into the impact that foreign actors, “Russian groups and other former Soviet states,” and “organizations like the campaigns” had on Facebook during the 2016 elections.

But according to the court documents, Zuckerberg had originally proposed naming Russian foreign intelligence and Cambridge Analytica in the same breath.

“We are already looking into foreign actors including Russian intelligence, actors in other former Soviet states and organizations like Cambridge Analytica,” Zuckerberg initially wrote, according to the draft the SEC produced in the deposition and that Zuckerberg testified was authentic.

Zuckerberg testified that the reference to Cambridge Analytica was removed after a staffer recommended against naming specific organizations. “This was not something I think was particularly important to the overall communication,” he said, according to the transcript. “So I think when people raised this, I just took it out.”

The testimony suggests he became aware of Cambridge Analytica around the same time as the general public, through press reporting around the 2016 election on the firm’s marketing claims. But it also suggests that he was kept in the dark about the Cambridge Analytica-linked data leak that predated the election and would eventually lead to Facebook’s broader reckoning with regulators and policymakers.

The Cambridge Analytica saga began with a psychology professor who harvested data on millions of Facebook users through an app offering a personality test, then gave it to a service promising to use vague and sophisticated techniques to influence voters during a high-stakes election where the winning presidential candidate won narrowly in several key states.

A 2020 report by the UK Information Commissioner’s Office later cast significant doubt on Cambridge Analytica’s capabilities, suggesting many of them had been exaggerated. But the improper sharing of Facebook data triggered a cascade of events that has culminated in numerous investigations and lawsuits.

After hearing about Cambridge Analytica’s claims that it could use personal data to build “psychographic profiles” of voters who could then be targeted with effective political advertising, Zuckerberg began asking subordinates whether the firm’s marketing had any merit.

In one January 2017 email produced by the SEC, Zuckerberg asked staffers to “explain to me what they actually did from an analytics and ad perspective and how advanced it was.”

Explaining his thought process further, Zuckerberg testified: “Like, are these folks actually doing anything novel? Or are they just talking about data in a puffed-up way …. My understanding from those conversations is that, to summarize it very quickly, it was much closer to the latter.”

But even though Facebook as an organization knew by that point, in 2017, that Cambridge Analytica had obtained Facebook users’ personal information in violation of the platform’s policies, that incident was never raised to Zuckerberg as a piece of potentially relevant context, according to the deposition. Following Facebook’s discovery of the leak, the company required Cambridge Analytica to delete the data it had improperly obtained through a third party and ordered the firm to sign a certification indicating its compliance.

Zuckerberg testified that he did not get “fully up to speed” on the 2015 data leak, and Facebook’s response to it, until March 2018, when public reports about the incident emerged.

In the deposition, Zuckerberg explained that he was not briefed earlier likely because Facebook considered the 2015 incident a “closed case until 2018, when new allegations came up that suggested that maybe Cambridge Analytica had lied to us” about having deleted the Facebook data. (The UK ICO’s report later found that Cambridge Analytica did appear to take some steps toward deleting the data, but it also expressed doubts about whether those steps were effective enough.)

Zuckerberg reaffirmed in his testimony that had Facebook moved more swiftly to implement an existing and separate plan restricting app developers’ access to Facebook information, the data leak could likely have been avoided from the start.