Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook sued for ‘losing control’ of users’ data

bbc.com

Post reply on HN
Print view View original

151–160 of 198 posts

Re: Facebook sued for ‘losing control’ of users’ data

#151

Post by matsemann »

Nextgrid wrote: post #3

I'm no Facebook fan but the reasons behind the lawsuit are bad and could set a bad precedent. Cambridge Analytica used the Facebook API to ask users to share data about them & their friends. Stupid users agreed to that. The argument here isn't that Facebook is playing fast and loose with tracking & user data (which would be a legitimate argument), it's that Facebook is allowing people to grant access to their data to…

> Facebook is a neutral carrier here, and they acted on behalf of the user - he decided that Cambridge Analytica should have had access to his data.

You say that like it's okay that anyone else can press a button and then share my data. It's not my friends' to share, I'd say fb is at fault here for providing this to third parties.

Re: Facebook sued for ‘losing control’ of users’ data

#152

Post by ysavir »

dragontamer wrote: post #141
ysavir wrote: post #118

Earlier quoted context omitted.

> There's no way for Z to even know that X exists Other than the time that X explicitly and directly asked Z for access to their data, you mean. This isn't similar to a case where I stored my users' info in a database on Cloud Hosting Service Inc machines, CHS's lax security allowed the data to be hacked, and I am now accountable to my users because I used an insecure service. Facebook's role in this situation was, l…

Doesn't change my overall point. Asking for Z to sue X has a number of issues: 1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause. 2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells th…

> Doesn't change my overall point.

That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan.

If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford.

But if you really want to use comparisons, let's use one that's appropriate:

I purchase an iPhone from Apple. In this scenario, Apple has a policy that app developers can't share data with 3rd parties. I download an app and grant it permission to my data. The app developer then shares that data with someone else. Who is at fault? Who is the victim? Should I sue Apple? Should I sue the app developer? Can I really sue anyone considering I myself downloaded the app and granted it access to my data?

Re: Facebook sued for ‘losing control’ of users’ data

#153

Post by mandevil »

btown wrote: post #128
Ajedi32 wrote: post #102

Earlier quoted context omitted.

From the link: > The claim that this is a data breach is completely false. Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked. Users knowingly _agreed_ to share their data with D…

And Facebook is being sued for... not having technical mitigations to guard against contractual breaches?

Well sure, I don't have a contract with Dr. Kogan, so what can I sue him for? There is no breach of any contract between us. I do have a contract with Facebook, so they are pretty much the only people I can sue. They can turn around and sue Dr. Kogan because they did have a contract with him, but I can't sue him directly for breaching a contract I'm not a part of.

Re: Facebook sued for ‘losing control’ of users’ data

#154

Post by ArnoVW »

musingsole wrote: post #147
ArnoVW wrote: post #140

Earlier quoted context omitted.

the way the legal system works: you are responsible for your contracts. If your supplier messes up, your customers sue you, you sue your supplier.

I haven't seen it phrased that way before, and now that I have, I simultaneously accept the logic of it and am horrified by the bureaucratic churn that must spin up just to ferry legal responsibility to (in theory) the correct party.

'luckily' it is expensive to sue, so everything works out.

Consider the alternative: the laptop you bought on Amazon catches fire and burns down the school of your daughter. The school contacts your insurance, who now has to contact a component supplier in Shenzen (who supplied the power supply), and sue them under Chinese law, instead of Amazon.

Re: Facebook sued for ‘losing control’ of users’ data

#155

Post by ergocoder »

orangeoxidation wrote: post #139
ysavir wrote: post #96

Earlier quoted context omitted.

And does anything about this make Facebook liable for the way CA used the data willingly given to them by their users? Facebook is either: 1. a neutral party, acting on the wishes of its users, who asked to grant CA access to their data. The victims are users and the aggressor is CA for misusing data. Or: 2. a victim party, after CA went against their policies. CA is the aggressor in this scenario, and the users are…

> Cambridge Analytica's app on Facebook had harvested the data of people who interacted with it - and that of friends who had not given consent. This is the problem (quote from op article). Facebook collected data on people and than shared this data to third parties without their consent. That friends gave consent to this has no relevance. They don't have the right to do so and they didn't do it themselves. Facebook…

Yeah, it's relevant.

If you share your friend's data, it's primarily your fault.

You know your friend's email, and you decide to share it with someone else.

Now I agree that FB should bear some responsibility since it's such a large platform.

But it's you who is mainly at fault for sharing.

If you shout your friend's email in a hotel's lobby, you wouldn't blame the hotel, right?

Re: Facebook sued for ‘losing control’ of users’ data

#156

Post by dragontamer »

ysavir wrote: post #152
dragontamer wrote: post #141

Earlier quoted context omitted.

Doesn't change my overall point. Asking for Z to sue X has a number of issues: 1. Z doesn't know Y's policy towards X. Is the problem truly Y's fault or X's fault? "Z sues Y" doesn't necessarily implicate Y as the root cause, it just proves that Y was "along the way" towards the root cause. 2. Y sues X is a totally separate question. Consider the case where a car-parts company creates a suspension ("X"), who sells th…

> Doesn't change my overall point. That's because you keep making points that ignore that the end users knowingly granted permission to Dr. Kogan . If I buy a car, I don't expect the transmission manufacturer to be part of the specs or shopping process, so yes, I would sue Ford. But if Ford says "comes with Goodyear tires", and then one of those tires proves faulty, I'll be suing Goodyear, not Ford. But if you really…

Analogies seem to be failing. So lets actually talk about the case then.

Cambridge Analytica asked user A for permission. Facebook allowed CA to gather information about B (A's friend), and B NEVER provided consent. B now is wondering who to sue: Facebook or CA.

My opinion: (IANAL). B sues Facebook. Then, Facebook sues CA.

This leads to a few results:

1. If B loses its case against Facebook, the game is over.

2. If B wins its case against Facebook, Facebook continues and sues CA.

3. If Facebook loses vs CA, then the game is over and Facebook is found to be at fault. If Facebook wins vs CA, then CA was at fault.

4. If CA was at fault, then maybe CA will then sue its consultant over the issue, and it may continue. So on and so forth until the root cause is discovered, wherein the game ends.

Simple process. At least... simple if everyone could afford the proper legal process. B probably can't afford it and many "Bs" need to gather together for a class action lawsuit and all that jazz.

The hardest part of the puzzle is what exactly B would be suing over. It feels like B was damaged as a whole, since Facebook leaked B's information to CA. But its hard for me to formalize the complaint. Then again: that's a lawyer's job to find out.

Re: Facebook sued for ‘losing control’ of users’ data

#157

Post by munk-a »

musingsole wrote: post #147
ArnoVW wrote: post #140

Earlier quoted context omitted.

the way the legal system works: you are responsible for your contracts. If your supplier messes up, your customers sue you, you sue your supplier.

I haven't seen it phrased that way before, and now that I have, I simultaneously accept the logic of it and am horrified by the bureaucratic churn that must spin up just to ferry legal responsibility to (in theory) the correct party.

I think that this can end up resulting in less bureaucratic churn then the other approach. In this particular case a bunch of users had their data forwarded by one entity - if CA had harvested data from multiple sources using the Facebook API then I think it'd be unreasonable for those users to need to legally pursue each terms violator - Facebook may also refuse to share the identity of the breach for a variety of reasons[1] making the lawsuit without an identified defendant which doesn't really help matters.

1. Proprietary customer information, privacy, just generally not talking.

Re: Facebook sued for ‘losing control’ of users’ data

#158

Post by saiya-jin »

musingsole wrote: post #147
ArnoVW wrote: post #140

Earlier quoted context omitted.

the way the legal system works: you are responsible for your contracts. If your supplier messes up, your customers sue you, you sue your supplier.

I haven't seen it phrased that way before, and now that I have, I simultaneously accept the logic of it and am horrified by the bureaucratic churn that must spin up just to ferry legal responsibility to (in theory) the correct party.

The real world is ridiculously complex place, something about almost endless fractal. I too would like to see companies like FB burn because they gave us plenty of reasons in the past, but in this case...

I look it from outdoor equipment perspective - if on my goretex jacket an YKK zipper fails, for me the jacket manufacturer (say Rab) would be the one to raise a warranty ticket/questions, not japanese YKK which produce billions of zippers for everybody all the time. Although Rab is just buying products from DuPont (sigh...), YKK, threads etc. and putting them together (at least that's a more common situation compared to manufacturing it yourself).

I guess in real world Rab would swallow my specific issue while in warranty and issue a fix/replacement, and if they see enough issues with supplier they raise it in batch mode ie for discount for future or one-time compensation.

Re: Facebook sued for ‘losing control’ of users’ data

#159

Post by smolder »

Nextgrid wrote: post #104
JustSomeNobody wrote: post #81

Earlier quoted context omitted.

> Stupid users agreed to that. Can we not do this, please? People are being manipulated like never before. Almost anyone is susceptible.

There's plenty of manipulation out there (including by Facebook themselves), but I wouldn't consider an OAuth consent prompt as manipulation? Cambridge Analytica may have lied about their intentions, but when requesting access, the Facebook consent prompt is very clear about what data would be shared. Why should Facebook be on the hook for CA's lies?

Being able to share your friends data or even your own so coarsely was a bad design. If it were me designing an API for Facebook apps, you'd only be able to present user data to users from packaged queries, none of the user data would be directly accessible to the app maker, and monetization would only be through ad display or in-app purchases. It'd be a much less popular API since you can't extract users data, but IMO, it's the only sensible form such an API can take.

Re: Facebook sued for ‘losing control’ of users’ data

#160

Post by intricatedetail »

Nextgrid wrote: post #3

I'm no Facebook fan but the reasons behind the lawsuit are bad and could set a bad precedent. Cambridge Analytica used the Facebook API to ask users to share data about them & their friends. Stupid users agreed to that. The argument here isn't that Facebook is playing fast and loose with tracking & user data (which would be a legitimate argument), it's that Facebook is allowing people to grant access to their data to…

Just because there is no law specifying exactly what happened it doesn't mean something is legal. Like there is no law that says it's illegal to hit people wearing yellow hats, but if you did that you'd certainly get in trouble. The same way you cannot agree for someone to murder you. Just because users agreed it means nothing.
Post reply on HN