Facebook does not plan to notify half-billion users affected by data leak

1. I don't trust Facebook to not track me. When I left Facebook for good in 2014 it was because, for the second time after setting all my settings as private as I could (show photos only to friends, etc.), Facebook somehow reverted everything to "public".

2. Their algorithm is still aimed at generating controversy rather than truth, and that's enough for me to not use it.

The first move is usually to legally object to the fine if it's more than the cost of doing business, leading to years of back and forth. Look at the fine the EU imposed on Intel in 2009 which keeps getting contested and reexamined. Increasing the cost and friction for the ones trying to recoup the fine makes them more willing to negotiate a faster settlement (usually better deal for the company). It's a good bargaining chip for the company if they have very few assets under that jurisdiction or it's a market they can afford to lose. So the company pays some of the fine and then sees much stricter controls applied to them in particular, not via law but via the settlement.

Finally the company is represented by a CEO and/or board and those are the people ultimately responsible for disregarding a court decision. There could be attempts to hold them responsible but the US is famous for protecting any CEO from prison time (inside or outside of US borders). The US has a history of refusing to extradite CEOs convicted simply because they can purchase their way out of any trouble, it's only a matter of price. So this last step is mostly symbolic, the CEO is convicted because justice has to be served in the accusing jurisdiction.

What is truly damaging about this breach is that it allows for bidirectional mapping of phone ⭤ name (and often location, since the data can include town/employer).

The risk is much bigger than "I'm going to get more phone spam."

Examples:

- An abusive ex/stalker type can now search by name and find his ex's phone number and maybe even city/town.

- Have you ever dealt with an irate person via phone? (craigslist deal gone wrong/creepy, for example). This person can now know your name and even photo since the leak includes your fb id.

I am certain that both of these things will happen in the next few months or years. If privacy changes are to happen at the legislative/personal responsibility level, it would behoove an organization like the EFF to find one such case and use it to sue the living daylights out of FB. I think it's also worth mentioning these sorts of risks instead of focusing on "spam".

Unfortunately, even if that were to happen, we'd end up with a moral panic, which almost always ends up punishing the wrong people. What we really need is a change in the kinds of data that are allowed to be kept, and a change in data/identification infrastructure.

Things like:

- The creation of a standardized & subsidized token/OTP platform. In the US for example, you should be able to go to the post office and get a NIST approved token generator, which should be mandated to be used by all banks and replace SMS and SSN as authentication.

- A pseudonimity middle-layer (ie, Stripe for Privacy). For example, when I buy a t-shirt online, I should be able to simply give the merchant my pseudonym, and they shouldn't store my actual name & address. If they want to store that there should be much much higher data protection requirements.

This infrastructure should be free market but with a "public option" in order to prevent oligopolization of these services.