Skip to main contentSkip to navigationSkip to navigation
Facebook’s representative, Richard Allan
Facebook’s representative, Richard Allan, who often looked uncomfortable during hours of questioning by MPs. Photograph: AFP/Getty Images
Facebook’s representative, Richard Allan, who often looked uncomfortable during hours of questioning by MPs. Photograph: AFP/Getty Images

Facebook was warned of apparent Russian data trawl in 2014, MPs told

This article is more than 5 years old

Social media firm claims no breach was found after it carried out investigation

A Facebook engineer warned the company in 2014 that users apparently based in Russia were scooping vast amounts of data from the site on a daily basis, lawmakers from nine countries have been told, in heated exchanges about whether the social media company poses a threat to democracy.

Facebook’s representative, Richard Allan, often looked uncomfortable during hours of questioning by members of the House of Commons, where he once sat as a Liberal Democrat MP, and parliamentarians from eight other countries. An empty seat was left for th e company’s founder and CEO, Mark Zuckerberg, underlining the committee’s frustration about his refusal to appear.

Allan was questioned on Facebook’s failures to crack down on posts inflaming hatred in Sri Lanka, faltering efforts to protect user privacy and data, the company’s problems regulating fake accounts and misinformation, and the slow pace of efforts to improve transparency of political advertising.

The Tory MP Damian Collins, who convened the international committee, asked about the mass harvesting of data in 2014, which had not previously been reported. According to Allan’s testimony, Collins appeared to have obtained the information from internal documents, confidential evidence in a US lawsuit that Collins seized this week using obscure parliamentary powers.

“An engineer at Facebook notified the company in October 2014 that entities with Russian IP addresses had been using a Pinterest API key to pull over 3bn data points a day [from Facebook],” he said. “Now was that reported to any external body at the time?”

Allan did not directly answer the question but, following the hearing, Facebook confirmed that the data collection had been investigated. “The engineers who had flagged these initial concerns subsequently looked into this further and found no evidence of specific Russian activity,” the company said.

A spokesperson added that it had investigated the potentially suspicious activity and insisted it was not a data breach. It said they were legitimate data requests for approximately 6m items a day, not the 3bn claimed by the engineer.

On the basis of questioning by the committee, it appeared the cache of documents emerged from a lawsuit launched by the small software developer Six4Three in 2015. It had invested $250,000 in a controversial app that allowed users to filter through friends’ photos to find images of them in swimwear and sued Facebook after the company cut off access to the data of users’ friends, which its app relied on. Facebook has said the claims have no merit.

The documents were provided to Six4Three’s lawyers by Facebook during the legal process. They are alleged to contain significant revelations about decisions on data and privacy controls that led to the Cambridge Analytica scandal, including confidential emails between senior executives, and correspondence with Zuckerberg.

Allan described the emails as a “partial set of data”, obtained by a “hostile litigant”. It was not clear if he had seen them.

Collins told a news conference that he considered them important and he aimed to publish a selection after redacting personal details. “Facebook is trying to pretend that these are all spurious allegations or carefully selected internal documents designed to give a false impression. I think that is a misrepresentation of these documents,” he said after the committee meeting. “I would hope that we will be in a position to publish them very soon, within the next week or so.”

Facebook later released copies of an email chain in question to a reporter from CNN. The emails, which have names and contact information redacted, appear to support Facebook’s assertion. “OK, things are not as bad as they seemed, apologies for the trash,” the engineer writes. “There was a series of unfortunate coincidences that made me think the worst.”

Collins responded to the release on Twitter, writing, “Facebook have broken the seal on the court documents from California; will they now ask for the rest to be released? These emails show there was no external investigation of Russian IP addresses calling for Facebook data & don’t confirm how much was taken.”

The California judge who ordered the documents sealed will hold a hearing between US software company Six4Three and Facebook on Friday.

During the Commons hearing, the Labour MP Paul Farrelly said the company’s behaviour made him think of racketeering. “Is that a fair thought to have in my mind?” he asked Allan.

One of the key concerns of the committee was the lack of oversight on Facebook. The Singaporean politician Edwin Tong asked about the role of Facebook posts in stirring religious tensions in Sri Lanka, where the company’s inaction when asked to remove them ultimately led the government to block the platform.

“I’m ashamed that these things happen,” said Allan, and appeared to agree with calls for greater regulation, even though Facebook has poured millions into lobbying to limit controls worldwide. Among current battles, it is appealing a record £500,000 fine from the UK’s data watchdog.

Asked what Facebook needed to do to prevent its platforms being used to spread abuse, Allan said the company needed to make its own controls stronger but also needed better controls from lawmakers: “Frankly you and your colleagues standing over us.”

The Canadian politician Charlie Angus accused the company of “corporate fraud on a massive scale” for doctoring video-viewing metrics it presented to advertisers. He also attacked Facebook’s dominance of online life, through its eponymous platform, the photo-sharing app Instagram and the messaging service WhatsApp.

“The problem is Facebook,” Angus said, calling for it to be broken up. “Unprecedented economic control of every form of social discourse and communication.”

The information commissioner, Elizabeth Denham, in later testimony challenged Facebook’s decision to appeal against its record fine, raising questions about Allan’s claims that the company was newly committed to working with regulators.

Facebook argues that the core of the Information Commissioner’s Office enforcement is now broader than the simple questions raised in the Cambridge Analytica case, owing to the lack of harm to British citizens from that scandal.

Denham said the company was being held accountable for flaws in its general business model, not the Cambridge Analytica data breach.

“Our fine for Facebook wasn’t about whether UK users’ data was shared with Cambridge Analytica. We fined Facebook because it allowed apps and app developers to harvest the personal data of its customers,” Denham told the international grand committee on disinformation.

How search for bikini photos put focus on users’ data

Six4Three, the US software company at the heart of Facebook’s latest public relations crisis, is an unlikely player in a global tussle over data, democracy and the role of social media.

Five years ago, the company created its Pikinis app, which searched through photos uploaded to Facebook by users and their friends and filtered out any of people in swimwear. It was unsurprisingly slammed as “creepy” when it was first unveiled.

Soon after, Facebook decided to cut off developers’ access to the data of users’ friends, in effect dooming the company. That could have left Six4Three nothing more than an unsavoury footnote to the privacy abuses of Facebook’s early years, but the company’s founders decided to sue.

In the course of the slow-moving legal process, Facebook handed over to Six4Three’s lawyers the cache of internal documents that were subsequently seized by the UK parliament this week. They were given to Six4Three as part of a legal process called discovery, which allows lawyers for either party to ask for evidence from the other.

Facebook has said that the claims had no merit and the company would “continue to defend ourselves vigorously”. It has sought to keep the documents private and they are currently sealed under order of the San Mateo superior court in California.

Facebook’s response to the case has included attacking the premise of the app and presenting itself as a champion of privacy. “Facebook is trying to protect bikini photos, but it’s not easy,” read one headline on the Bloomberg news service. But Six4Three says the company lured it to invest $250,000 under false pretences.

Pikinis has some echoes of one of Facebook’s precursors, a website created by Mark Zuckerberg when he was a student at Harvard University that allowed users to compare pictures of two students and rate the one they thought was more attractive. The site was rapidly shut down by Harvard authorities.

Additional reporting by Julia Carrie Wong in San Francisco

Most viewed

Most viewed