Mar 14, 2019 2:17 PM

Facebook's Sloppy Data-Sharing Deals Might Be Criminal

Prosecutors in New York reportedly are investigating the company's sharing agreements with other firms, which may have exposed personal information without user consent.

In the past nine days, Facebook has said it is rethinking its business and a presidential candidate said it should be broken up. In the past 24 hours, the company’s services, including Facebook, Instagram, WhatsApp, Messenger, and Oculus, froze for most of a day and a newspaper revealed that a new crop of prosecutors is investigating the company for criminal behavior related to a slew of data partnerships.

For most companies, this would be a catastrophe. For Facebook, it’s just another week and a half.

For the past 15 years, Mark Zuckerberg has pushed Facebook to be the most innovative, influential, fast-growing, and profitable company in the world---to move fast and break things. It worked great, as we all know. It also broke a lot of things Facebook didn't anticipate. And the cleanup bills are piling up.

The new investigation, by federal prosecutors in the Eastern District of New York, is related to deals with more than 150 partners, including many big tech companies. Those deals allowed the partners to see Facebook user data, sometimes without user consent. The New York Times, which broke the news on Wednesday night, reported on these partnerships in December. While Facebook phased out almost all the deals more than two years ago, it accidentally left some of the data connections open into early 2018, the paper said then.

The probe adds to an already impressive list of queries and charges from lawmakers, regulators, and prosecutors. The company is under investigation by the Federal Trade Commission for its role in the Cambridge Analytica scandal, which burst into public view a year ago Sunday. Cambridge Analytica also sparked a Securities and Exchange Commission investigation and a criminal investigation by prosecutors from the Northern District of California.

The FTC is widely expected to levy its largest-ever fine against Facebook in the coming weeks, perhaps in the billions of dollars. Facebook had already told the agency in a 2011 consent decree that it would improve its privacy and data collection practices. That agreement laid out enormous fines for the company for violations. Facebook executives now talk about when, not if, the company will be regulated in some way.

In response to the Times report of the latest criminal probe, a Facebook spokesperson said, “It has already been reported that there are ongoing federal investigations, including by the Department of Justice. As we’ve said before, we are cooperating with investigators and take those probes seriously. We've provided public testimony, answered questions, and pledged that we will continue to do so."

The new investigation reportedly includes grand jury subpoenas for records from at least two smartphone manufacturers. Their partnerships with Facebook allegedly gave them access to the personal information of millions of Facebook users.

The smartphone revolution, the app economy, and the explosion in people’s desire to share information has made some data arrangements between companies almost a requirement, and Facebook is not the only company to have them. Some of Facebook’s arrangements, for example, allowed Netflix users to recommend movies and TV shows to Facebook friends via Facebook Messenger. Users agreed to these arrangements.

But the Times also said the data sharing allowed companies like Amazon and Microsoft’s Bing search engine to know the friends of many Facebook users without their consent. In its December story, the Times said that years after a data-sharing arrangement the newspaper had with Facebook expired, the pipes and permissions that allowed that data to flow back and forth remained open. It seemed akin to calling your credit card company, telling them to close your account, only to discover years later that the company had left it active.

What’s troubling even to Facebook fans is that these deals and the new investigation are yet other indicators of how arrogant, greedy, and sloppy about data collection and user privacy the company was for most of the past 15 years. Given its history of overpromising and underdelivering on privacy, it should be no surprise that prosecutors are looking to see if criminal acts were also committed.

For more than a year, Facebook has been working hard to convince its users and advertisers that it is a changed company. It’s spent billions of dollars and hired tens of thousands of people to better get the content appearing on its platforms under control. Just last week Zuckerberg said that he was pivoting Facebook toward more private encrypted interactions. “I understand that many people don't think Facebook can or would even want to build this kind of privacy-focused platform---because frankly we don't currently have a strong reputation for building privacy protective services, and we've historically focused on tools for more open sharing,” he said in a Facebook post.

But Zuckerberg has made big promises before and not delivered. In fact, he’s built the company that way. “Move fast, break things, apologize, repeat.” That’s taken what sounded like a crazy idea 15 years ago and transformed it into the sixth-most-valuable company in the world. Back then sharing photos or much of anything online using your real name was something few wanted to do. Zuckerberg changed that, believing that people were less worried about privacy than they said they were and wanted to share more online than they knew how to. Mining that gap was a stroke of real genius.

But those days are over. Facebook needs a new guiding star. It will need to find a way to remain just as profitable. But most important, it will need to regain user trust. Financially, Facebook has underpromised and overdelivered for the past 15 years. Now it will need to do the same to convince users it is protecting them.