The developer of the quiz app Cambridge Analytica used to collect the data of some 87 million Facebook users also had access to their private messages, according to a warning sent by the social media giant to affected users.
Through Aleksandr Kogan’s “This Is Your Digital Life” app, the Cambridge University researcher was able to collect the data, which was then shared with consulting firm Cambridge Analytica. Data was collected not just from users who installed the app, but from their friends and contacts, too.
In the wake of the scandal, Facebook sent out automatic notifications to affected users. At the bottom of the notification, in fine print, read: “A small number of people who logged into This Is Your Digital Life also shared their own news feed, timeline, posts and messages, which may have included posts and messages from you.”
Kogan downplayed the extent of this snooping, and told the New York Times that private messages were only harvested from a small number of people, likely “a couple thousand.” He also said that the messages were for a separate research project, and were never provided to Cambridge Analytica.
Users granted Kogan permission to do this. Mailbox access was included in the list of permissions they accepted when they installed his app. Kogan insists that only the messages of app users were gathered, not those of their friends. He also told the Times that the data “was obviously sensitive so we tried to be careful about who could access it.”
However, in a 2014 lecture in a Russian university, Kogan told students that through his app, he could predict “basically anything” about a person “quick and cheap,” and that this project had major commercial benefits. Reading users’ messages was central to the project.
“It’s messaging… this is private information, which no one sees,” Kogan told the students. “You can also load all of that. We usually load 3,000 (messages) per person. And there they talk about everything.”
The revelation that third-party apps read users’ explicitly private data comes just days after Facebook CEO Mark Zuckerberg faced a five-hour grilling in front of the House Energy and Commerce Committee. He repeatedly told the committee that users have full control over who sees their information.
“Every time someone chooses to share, they choose who they want to share it with,” said Zuckerberg.
The Facebook chief also told the panel that his company had introduced new privacy controls, but stopped short of saying he would be willing to alter the company’s business model to better protect user privacy.
Facebook is conducting an internal audit to discover how many third-party apps scraped user data. Zuckerberg told Rep. Jan Schakowsky (D-IL) that such an audit could take “many months,” and that he expected to find “a handful” of breaches from other firms.
Following over a month of privacy scandals at the social media company, a majority of Americans believe their personal data is unsafe with Facebook. Six in 10 Americans also think the government should increase regulations on social media and technology companies in general to prevent their private user data from being shared without their consent.