What Should Congress Ask Mark Zuckerberg? -- Talking Tech w/ Nuala O'Connor & Michelle De Mooy
This week, Facebook’s CEO Mark Zuckerberg will be testifying before both the House and Senate about how the data of Facebook’s users was used by Cambridge Analytica to target swing voters. The questioning will undoubtedly go beyond just this issue, especially with the recent admission by Facebook that all of its users likely had their information scraped from the site. <br><br>To preview the hearings and the broader issues around the Facebook Cambridge Analytica story, I’m joined by CDT’s two privacy powerhouses, our President & CEO Nuala O’Connor and our Director of Privacy & Data Michelle De Mooy. <br><br>More on Nuala: twitter.com/privacymama<br>More on Michelle: bit.ly/michelledm<br>More on our host, Brian: bit.ly/cdtbrian<br><br>Attribution: sounds used from Psykophobia, Taira Komori, BenKoning, Zabuhailo, bloomypetal, guitarguy1985, bmusic92, and offthesky of freesound.org.
Top Keywords
- facebook 0.014
- data 0.013
- privacy 0.013
- breach 0.010
- equifax 0.009
- nuala 0.008
- zuckerberg 0.007
- users 0.007
- michelle 0.006
- data breach 0.006
- privacy settings 0.006
- delete 0.005
Transcript
Welcome to Tech Talk. Bye.
CT. Tea. Welcome to CDT's tech talk where we dish on tech and Internet policy while also explaining what these policies mean to our daily lives. I'm Brian Wasilowski, and it's time to talk tech. It's Zuckerberg week. This week, Facebook CEO, Mark Zuckerberg, will be testifying before both the house and senate about how the data of Facebook's users was used by Cambridge Analytica to target swing voters. And the questioning will undoubtedly go beyond just this issue, especially with the recent admission by Facebook that all of its users likely had their information scraped from the site. To preview the hearings and the broader issues around Facebook and Cambridge Analytica, we have our privacy powerhouses here, president and CEO Nuala O'Connor and our director of privacy and data, Michelle Desmoy. Welcome. Hi, Brian. Thank you. Do you like that? Privacy powerhouses? That's pretty awesome. Right? Yeah.
I think it's good. So
That's another way of imagining it. That's another way of imagining it. I love it. You can get capes or like tiaras or something. Yeah. I mean, you run this place, you can get whatever you want.
I think we will today, in fact.
Well, alright. Let's get to this here. So top level overview. Cambridge Analytica story, why is this such a big deal?
To me, the big reveal this is Nuala just to differentiate. To to me, the big issue is that people didn't realize trivial data about themselves, not necessarily their credit card number or or their health status, serious data that we already think should be protected. But things like, what kind of dog breed do you have or what's your favorite color when you're taking these quizzes on Facebook are suddenly being taken, amalgamated, lumped together, and used to make decisions about you in the real world, decisions that have real world consequences like what kind of political advertising you see online and what kind of information you receive, to me, that's a level above what we thought was happening when you go to shop for a red sweater and suddenly you get ads for red sweaters on every website you get to. The consequences of information decision making
based on trivial data are, I think, are much greater than we all had assumed. What do you think, Michelle? I agree. And I think one way that I would put that too is there's a direct line between privacy and democracy that we don't always get. I think it really was clear to people why this is a fundamental freedom and principle worth protecting. I think your your question about why this is such a big deal, I think in part, it's it's on the heels of lots of little problems. Lots of things have happened, related to, you know, Equifax or data breach, you know, Grindr from Grindr to Strava to a million other issues where people are starting to realize how invasive some of these practices can be. And I think one of the best parts of this, at least from my perspective, is the call for, a renewed look at US privacy law.
So one of the things, and this is not a question I asked in advance was, I recently was talking to a group of students and they asked me which is worse, this Facebook situation or the Equifax breach?
And I'm like, that's a really tough question. Do you do either of you have an opinion on that? Well, I'll start, but I'm sure we both do. Yeah. And what a great question for us. Oh, yes. They we're great. That's ideal. And I think it shows the difference of as a classic breach and something that now every state in The union has a law about, which is data breach notification. You saw the last one. Right? The la the fiftieth state finally went into effect this week. Right? Fifteen or sixteen years after, frankly, one of our founders, Deirdre Mulligan, really was instrumental in proposing the first California law. So it's taken us this long to get to comprehensive legislation on data breach, which is the technical loss of or misuse or intrusion in a security sense. And so it's important to note that the Facebook Cambridge Analytica situation is not a classic data breach and therefore is also not covered by any of these laws. Right? So here's what I would say to that. While the Equifax situation was a very serious one and and a and a massive breach affecting with real world consequences like potential identity theft and misuse, we actually already have laws about that, against that, and to protect the victims and to help them redress the wrongs. I actually think in some ways the Facebook situation, this most recent, set of facts, is bigger in a sense not only numerically. Right? Because so many people in The United States and around the world use Facebook, but because we don't have the kind of legislative regulatory and kind of social response tools that we already have for the classic data breach. We don't have a good framework for considering the consequences. Michelle, I love that privacy and democracy. That's exactly right. We don't because we don't have agency or the freedom to move around the Internet without being surveilled essentially, we don't have the full engagement of freedom of expression. But we're also seeing that there are consequences becoming an educated electorate. If we don't fully see everything that somebody on the other side of the aisle or somebody across the street from us is seeing, we don't have the same world understanding.
The only thing I would add is in speaking of transparency, there there was a great deal of, angst about Equifax, but nothing like there was there has been about Facebook. And I think in parts because people really had no idea that Equifax had so much information about them. Right. There's no direct relationship to consumers. In fact, the customers of Equifax are banks or financial institutions. So the idea that there's this direct line again from users to a platform that presents itself as a service for them when, you know, there's a lot going on under the sea under the platform and around areas that users had no idea. So that unexpected and indirect relationship,
of Equifax, I think, resonated differently than the one Yeah. With Facebook. Personal connection people have with Facebook that, you know, and especially considering its friends. I think one of the things that resonated most with me about this story was people were sharing information about their friends as well unknowingly. So it was kind of a a breach of trust in that respect. That's a huge breach of trust. I don't think we can underestimate that because
the idea that you unknowingly expose your friends to some kind of risk, whether it's a privacy risk or even the risk of somehow becoming a tool in an influence campaign, I think, is really, really distasteful to a lot of people. And, of course, the sort of partisan politics that have surrounded this election, I think, have also intensified the interest in this. Sure. So alright. I said it was Zuckerberg week. Tuesday and Wednesday, Mark Zuckerberg will be testifying. That's twice. That's a lot for any one individual to, testify in one week. So he'll undoubtedly
be, tired after the fact. And we're all gonna be watching it here at CDT. What are you hoping that members of Congress ask him? What do you want answers to?
Well well, Brian, a lot. Where should I begin?
I think the key questions include what Facebook considers to be, its user privacy rights. So thinking about not their privacy settings as much as what do you think your user privacy is worth, not to your customers, but to your users? And what type of expectations should they truly have when they come on to your platform? Not as as dictated by your terms and conditions or your privacy settings, but when push comes to shove. Right? These decisions or this incident makes it look like they value their user privacy pretty low on on the totem pole. When you have data sharing agreements that have no enforcement, have no way of of having accountability related to them, that is a signal that it's not something that is valued. So I think those questions would be important. I think also getting into the business model of Facebook to understand how user data is actually monetized, not just because I think that's an important question in terms of regulatory framework, but also for users to hear, to get some transparency that they have not had. You know, what what are the most desirable traits for a user? What is the most valuable, characteristics of users for from a customer standpoint? And, of course, Facebook's customers are advertisers.
What about you, Nuala?
So I'm reminded of an article. I think it was Tim O'Reilly who wrote a couple years ago that said, whose black box do you trust? Right? And we we are now engaging in an online world where so many decisions are made about us in infinitesimal time. Right? You know, the algorithms on various platforms are changing in fractions of a second, and they are affecting not only the ads we're seeing, but the content we're seeing. I'm not necessarily asking to know again, I've said this before. The all the ones and zeros or even every instantaneous change in the algorithm, but I do wanna know the values. I think what you're getting to is factors and values in the decisions that companies are making about me in the digital world and how they are affecting what I'm seeing as opposed to what my next door neighbor is seeing. And I think, yeah, some incident response kind of protocols about how when do they know and what it and how do they know it. That's important as well. Yes. I do hope and I take note kind of schadenfreude or no joy in the in in the the pain or misfortune of of any individual CEO or company, but I I do wanna see some good come out of this. Really, I think inflection point in the conversation around our relationship with our own data and our relationship with companies that process data. And so I really hope we we go to a kind of a higher level higher first, the the details of what happened, but then the higher level conversation about what's fair. Mhmm. What's a fair deal in the individual when trafficking with data? And I think you're right. It goes to issues of transparency and accountability and and and user understanding. And, ultimately, I hope greater individual control over their online experience and their data. That's not to say that companies can't make a reasonable living in the digital world, but there's gotta be a lot more accountability to the end user.
Michelle? I agree. I also think, the question around ad transparency, I think, is important it's certainly of interest to the the area of privacy connecting to democracy. What types of you know, I know Facebook has announced some ads transparency measures, but I think the key to some of those is, yes, it's good to make those public and to make it more clear who's advertising what, but there's some questions still about targeting that's a part of that. And I think Nuala was getting to some of that. How are you targeting users and who is targeting users? In other words, maybe not just fast forward, but in the past. What what has gone on on the site? You know, give us more information about what occurred, who was buying up political ads, how they were used, to influence and target people. Those kinds of questions, I think they really have yet to answer in-depth. So less privacy, although still important, but I think the election integrity questions are really important also. Sure. Do you think, think I mean, the Honest Ads Act plays a role in this. It seemed as though on, I guess, it was sixty minutes and then a follow-up that,
Zuckerberg himself almost endorsed it. I know that Senator Klobuchar certainly jumped on that and took it as an endorsement. Do you think that that's a a potential solution or part of the solution?
I think it's it's a start. Yeah. And I think it it's a positive start. And, you know, senator Klobuchar is is a great champion for privacy and for election integrity. So I I think she has really thought it through, and so I think it would it would make a step forward. I would just add that a lot of the changes they've made relate to election integrity or add transparency, and a little bit about, data brokers, but really nothing about privacy has changed. You know, they've they've changed some of their privacy settings. They've centralized their privacy settings, and all of that is great. But the actual nuts and bolts of the control that users have and the actual transparency that users have about the the layers of data brokers, none of that has really changed. So my hope is that there will be a way for the congress to introduce legislation that will change that. Well, let's get to that then. So regardless of of what happens this week and and what, Mark Zuckerberg says,
What do you think Congress should be doing? What action actions should be coming?
An omnibus federal privacy law in my lifetime. It
sounds familiar. Did you say that at tech prom? What's that? I'm
gonna keep saying I'm gonna will it into being in my sheer force of of desire. This is something listen. Many, many good and responsible companies and advocacy organizations and academics have been saying for many, many years. I was in the earlier coalition that was led, in fact, I think at some point by Microsoft and and, GE was in it when I was there and and other great tech companies. But this is not just about tech companies. I mean, I think what what I'm really saying is that this is about the trafficking in personal data and personal attributes, as part of the economic lifeblood of certainly the Internet, but every company has data whether you're online or offline. Right. Many comp pretty much everyone is an Internet company in some ways, whether you're just paying your employees or whatever. And there should be constructs of data stewardship and what Jack Balkin at Yale calls data fiduciaries. That there is some inherent corporate, civic, or social responsibility to the collection, use, and dissemination of personal information about your customers, your vendors, your suppliers, your partners, or whatever relationship you have with the human being. And that there's some dignity, inherent dignity in the individual and that is attendant to their data as well as to their body. And so, I think this it's a lofty goal and this may be one that we're talk hopefully, I'm living a long time because in my lifetime is, you know, gives us a little more runway. But but in the short term, Marcel's right. There are issues around data brokers. There are issues around election ads. There are issues of transparency and accountability and redress and data deletion. All of these are good steps. I think the ultimate end end goal shouldn't also skew our vision that there is good work to be done today, tomorrow, next week,
with the goal in mind that ultimately individual humans have more agency and control over their digital self. Yep. Yep. And I think at the risk of sounding slightly cynical, sometimes these hearings can be a way for congress to sort of yell at, CEOs. Sure. And and then there's some some value to that, I I suppose, to the public campaign ads. And for the public to learn things that maybe they didn't. Sure. But really, from my perspective and related to what Nuala just articulated, I'm laser focused on getting protections for people. You know, it's not necessarily about holding companies accountable in this, you know, we're gonna slap you, with some fines and some other ways. It's really about long term change that we have needed for quite a while. And I think that it's if we can propose and sustain legislation that is reasonable and logical and really puts the the person first, I think we can do that. Yeah. And it seems like it's something that should not be partisan. So I agree. And I think there is some some I think some partisans are coming around, shall we say. I think it's clear that, there everybody has sort of skin in this game. Every a lot of people are on Facebook Sure. But also just we all use the digital ecosystem, and our personal data is out there. So I think to the extent that we can message that this isn't a partisan issue, that this is something that affects the fundamental rights of Americans, then I think we will succeed in getting lots of lots of stakeholders on board. Great.
One other question now. A lot of times people will pivot this to what should I do, you know, the individual users you were just talking about. And one of the things, you know, certainly had a hashtag campaign out there deleting Facebook. Would you advise deleting Facebook? Is that a viable option? What should people actually be doing?
I think that and I said this in a recent article. I think it's really personal. I I I really in the same way that I'm not trying to dictate exactly what every platform product and service should do in legally, I don't think we should dictate all of the choices available to people that a choice to delete is a choice that you should have. So that's that's as far as we would go. But I do think, deciding whether or not to do it is tricky. A lot of you know, as the company has said, this is about connecting all of your friends and family. And so to the extent that that's the only way that you can talk to your relatives in another country or show them your kids' pictures, that's a really important connection to keep. Yeah. So I think it's tiers of what you're comfortable with. And although their privacy settings aren't perfect, they are a tool that you can use to protect some information. So usually what I would say to somebody is if you wanna delete, I think you should go for it. But also there are other options before deletion that you might consider.
Very helpful.
Can I even add to that? I totally agree. I wouldn't I I want solutions that people have real choices whether they and and when they delete, that delete really means delete. The data's really gone away. It's really de identified. It does not exist anymore. There's no account. But even more, I've seen a great thread of conversation among technologists, ironically, on Twitter, about the privilege that that argument shows. It is Mhmm. Really not that easy for someone who has a small business on Facebook or, as you point out, has relatives in in another country and it's the most cost effective way for them to communicate. Right. It's a it's an o it is a little bit of a simplistic knee jerk reaction to say, oh, just delete it. Right. That's easier maybe for you than for me. And so I think that's not always the answer. And I'm also a very much a change from within kinda person. So I'd rather stand and fight, you know, even with my my be loyal opposition. I'm a as everyone knows, I have huge Facebook user, both a critic and a and a and a and a user at the same time. So I think I think it is a somewhat simplistic answer to that does it's not a one size fits all solution. Right. Yeah. Would that there be lots of different platforms that that reflect different kind of norms and and ways of talking to each other and ways of including or de identifying data? Yeah.
I think that makes a really good point. Just one final point that there need to be competitors in this space. So to the extent that this raises those people or gives them some some sense that they can enter into a space that's really dominated by Facebook, I think that's a good thing. Yeah. Facebook may not agree, but
I think it's a good thing.
At the beginning of any relationship. Yeah. Well, unquestionably, this is a story that's gonna continue make headlines and certainly people are a little bit more aware now. And so, hopefully, all you're setting out for those very ambitious goals are reached. Thank you for joining me, my privacy dynamic duo here, and we'll have you on again no doubt very, very soon. Thank you, Michelle and Nuala. Thank you, Ryan. Thank you, Michelle. Thank you, Nuala. That's it for this episode of Tech Talk. If you're gonna be watching the Mark Zuckerberg hearings on television, likely C SPAN, and want to follow along with CDT, our own Joe Jerome is going to be live tweeting. His hashtag is or his handle is joejeroem. And then you can also follow sedemtech, and we'll be retweeting him. Thanks so much for listening.
