HARTFORD, CT — Connecticut Attorney General George Jepsen wrote Facebook on Monday asking the social network to provide his office with information about how it could have allowed a company to harvest personal information from 50 million users.
The letter is in response to news reports this weekend indicating that personal information from as many as 50 million Facebook profiles was provided to a company without the users’ knowledge or consent. That information found its way to Cambridge Analytica, the data analytics firm that worked for Donald Trump’s presidential campaign.
Jepsen is requesting information on how Facebook shares, sells, or otherwise provides access to personal information to third parties.
“Facebook has stated publicly that this incident was not the result of a technical data breach, but rather was caused by a third party application developer’s violations of Facebook policies,” Jepsen wrote. “Even if true, serious questions remain concerning Facebook’s policies and practices, including those governing the dissemination of personal information to third parties and the disclosures and consents associated with such dissemination as well as the oversight Facebook exercises over those for whom it has facilitated access to users’ personal data.”
Paul Grewal, vice president and deputy general counsel for Facebook, wrote on Saturday that it was not a data breach.
“People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked,” Grewal said.
It was simply handed over to Cambridge Analytica through a third party who was given access to more than 200,000 Facebook user profiles through an app it developed.
The accounts of those who violated Facebook’s policies have been suspended, Grewal said in his post.
Grewal said Dr. Aleksandr Kogan, a psychology professor at the University of Cambridge, “lied to us and violated our Platform Policies by passing data from an app that was using Facebook Login to SCL/Cambridge Analytica, a firm that does political, government, and military work around the globe.”
In a statement released Monday, Facebook said they have retained a digital forensics firm to conduct a comprehensive audit of Cambridge Analytica. But it has since suspended that audit after being asked by the UK Information Commissioner’s Office, which has announced it is pursuing a warrant to conduct its own on-site investigation.
Meanwhile, “Cambridge Analytica has agreed to comply and afford the firm complete access to their servers and systems. We have approached the other parties involved — Christopher Wylie and Aleksandr Kogan — and asked them to submit to an audit as well. Mr. Kogan has given his verbal agreement to do so. Mr. Wylie thus far has declined,” according to the statement posted on its website.
Jepsen said Connecticut wants the information before April 3.
That includes how many Connecticut Facebook users may have unknowingly provided their information to Cambridge Analytica and the terms of service.
He also wants a timeline of events, any notice provided to users related to the dissemination of their information, all consent received from Facebook users, and he wants to know whether personal information from the Facebook users has been deleted.
Massachusetts Attorney General Maura Healey announced on Saturday that her office was opening an investigation into the data breach.
Jepsen, who isn’t seeking re-election, hasn’t gone as far as opening an investigation, but that might be the next step depending on how Facebook responds.
Chris Mattei, who is running for attorney general, tweeted that Jepsen should follow Massachusetts and open an investigation.
Rep. Michael D’Agostino, D-Hamden, who is exploring a run for attorney general, also said he thinks Jepsen should open an investigation.
“We also deserve to be able to interact with each other online, without political operatives and foreign powers harvesting our information in an attempt to manipulate us,” D’Agostino said. “I will continue to fight for Connecticut residents’ right to privacy and work to protect our personal information.”
