Why is everyone so worried about Facebook and Cambridge Analytica?

Facebook has been engulfed in a growing scandal over the way it harvests data.

The problems began when it emerged that Cambridge Analytica, a political data company, had been using Facebook to gather information. But it is quickly broadening out – casting a light on the way data is gathered on Facebook more generally, and how it is used to sway people not only to buy things but to change how they vote and who runs the world.

Amid the confusion, various claims have come from the companies involved and the activists and users who oppose them. Here’s the truth on the furore – and what you should do about it.

1. What has happened?

   In short, people’s data has been collected to try and understand more about them and change how they vote. That’s been the work of Cambridge Analytica, a data company that has been credited – rightly or wrongly – with helping both the Donald Trump and Brexit campaigns achieve their victories.

   A whistleblower revealed that the site had been able to Hoover up 50 million user profiles by having them take a quiz on the site that gave them access to some of the data that Facebook had collected about them. That data was taken, it is claimed, to help target the kind of political ads that have received sustained scrutiny in the wake of those results – and have been given at least some of the blame (or credit) for making them happen.

2. Why is that important?

   This is significant only really because of the way the data might have been used. (This sort of data is collected by dodgy companies all of the time, and it’s most likely you’ve already been caught up in something similar by downloading a questionable app or taking a quiz.)

   This time around, though, the data was not being used for just any advertising. It was allegedly being utilised to direct messages for campaigns helped out by data firm Cambridge Analytica: Brexit and Donald Trump.

   How much of a part that marketing, or Cambridge Analytica, had to do with either of those results is still a mystery, and we’ll never truly know.

   But the fact some were so disgusted and surprised by those results makes this use of the data particularly egregious to them. It plays into all sorts of broader narratives – that those votes were stolen, and don’t really represent the true state of affairs, and that Facebook was somehow responsible – as well as turning the light back on a company and website that most people use every day.

3. Why are we only hearing about this now?

   Because, over the weekend, reports appeared in The Guardian and The New York Times detailing to a much fuller extent the amount of data Cambridge Analytica had access to.

   The company built special software that tricked people into giving up their personal information by appearing to be a fun Facebook quiz, the reports claimed. (Cambridge Analytica has denied using it and says it has been deleted.) That was then used against those people, trying to learn more about them and change the way they vote.

4. Doesn’t this sort of stuff happen all the time?

   Yes. The Cambridge Analytica disclosures are especially newsworthy and relate to current affairs – but that kind of data-gathering is happening on a daily basis.

   Many of the apparently innocent games or quizzes you’ve signed up to on the site will be doing the same sort of information-gathering: asking Facebook for your personal details and then taking them away for whatever purposes they want. And Facebook itself is doing the same, with everything you post or do on the site being fed into a set of data that is then used to serve you relevant advertising.

   What’s different this time is that the new reports appear to show how that data is being directly used to influence the democratic process. But even that isn’t entirely new.

5. Is it really a “data breach”?

   There’s been some confusion in the wake of the initial reporting, which was very clear in calling what happened a data breach. Data was lost, that’s for sure, but a breach usually suggests that there has been some sort of wall or protection that has been undone, and that isn’t what’s happened – in fact, the whole system works exactly as it should, and as it does without much controversy every day.

   This is what Facebook has argued, in disputing The Guardian’s initial headline. Using the word breach might suggest to users that the site’s security systems have been broken into – which would be very damaging for the company itself, and worrying for users. That hasn’t happened.

   Facebook put out a statement specifically addressing this claim.

   "The claim that this is a data breach is completely false," it said. "Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent. People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked."

   But the end result is arguably the same as a real breach. People lost control of important data about themselves and they didn’t know anything about it.

   It's still important to recognise, though, that nothing was actually breached – Facebook's failing wasn't in its security protocols or the way it protects data. The question is about who it lets use its site to harvest data, and how they're allowed to do so.

   Facebook is clear that its security wasn't compromised. But that has only led to questions of how that data was then found.

6. What should I do?

   The most important advice applies generally to the Internet: be alert and cautious about everything you do. Just about every service is trying to take your data – which shows just how valuable it is, and therefore how important it is to make sure it doesn’t get into the hands of people who want to exploit you with it.

   Sometimes, the data harvesting might be necessary to fund the development and upkeep of the service itself, which is what Facebook argues. At other times, it might genuinely improve the service – as with Google, though of course it also uses that information to sell ads.

   Withdrawing from this process can be both personally useful and a kind of small-scale activism. It’s personally useful because you’ll get to avoid having your data Hoovered up and used against you. But it also serves as a message to companies that data-gathering can be dangerous.

   The same caution should apply to the things you read on the internet, too, especially if you don’t know where it has come from. The Cambridge Analytica data – like any data – won’t change anything by itself, and it’s how it’s used that’s really damaging. In the case of the recent news, for instance, the data was collected to build a database of voters and attempt to sway them by showing them ads.