According to a 2019 deposition conducted by the Securities and Exchange Commission and reviewed by CNN, Mark Zuckerberg considered disclosing in 2017 that Facebook (FB) was investigating “organisations like Cambridge Analytica” alongside Russian foreign intelligence actors as part of an election security assessment before ultimately removing the reference at the advice of his advisers.
The omitted reference provides insight into Zuckerberg’s thinking on Cambridge Analytica in the critical months before press reports revealed that the data analysis firm affiliated with Donald Trump’s 2016 presidential campaign had improperly gained access to tens of millions of Facebook users’ personal information. The data leak sparked a global outcry, prompting hearings, an apology tour by Zuckerberg, and Facebook’s $5 billion privacy settlement with the US government.
According to the deposition transcript, Zuckerberg considered Cambridge Analytica a potential election concern on par with Russian election meddling efforts in 2017, despite the fact that he claimed he was unaware of the data leak discovered by Facebook staffers in 2015. It also highlights how Facebook employees had opportunities to brief Zuckerberg on the leak prior to the incident being reported in 2018.
Zuckerberg’s deposition remarks provide the clearest picture yet of what Zuckerberg knew about Cambridge Analytica and when. The timeline of events has previously been closely scrutinised by US lawmakers, state attorneys general, and investors who have sued Facebook, now known as Meta, for allegedly breaching its fiduciary duties in connection with the data leak incident.
Meta declined to comment on the transcript’s release, claiming that its case with the SEC involving the deposition had been settled for more than three years. The $100 million settlement in 2019 resolved US government allegations that Facebook misled investors for years after staffers discovered the data leak.
The SEC deposition transcript was released on Tuesday by the Real Facebook Oversight Board, a watchdog group that obtained the document through a public records request. The transcript was first reported on Tuesday by Reuters, which obtained it through a separate records request.
“This transcript reveals that something changed between January 2017 and September 2017 for Zuckerberg to consider Cambridge Analytica a threat comparable to Russian intelligence,” said Zamaan Qureshi, policy advisor at the Real Facebook Oversight Board. “However, for reasons the Facebook CEO has yet to reveal, the world would only learn about Cambridge Analytica in March 2018.”
A CEO in the dark
In September 2017, Zuckerberg issued a public statement about Facebook’s efforts to protect election integrity, stating that the company would investigate the impact that foreign actors, “Russian groups and other former Soviet states,” and “organisations like the campaigns” had on Facebook during the 2016 elections.
However, according to court documents, Zuckerberg originally proposed naming Russian foreign intelligence and Cambridge Analytica in the same breath.
“We are already looking into foreign actors, including Russian intelligence, actors in other former Soviet states, and organisations like Cambridge Analytica,” Zuckerberg initially wrote, according to the draught that the SEC produced in the deposition and that Zuckerberg testified was authentic.
According to Zuckerberg, the reference to Cambridge Analytica was removed after a staffer advised against naming specific organisations. “This was not something I thought was particularly important to the overall communication,” he said, according to the transcript. “So I think when people brought it up, I just took it out.”
According to his testimony, he became aware of Cambridge Analytica around the same time the general public did, through press coverage of the firm’s marketing claims during the 2016 election. However, it also suggests that he was kept in the dark about the Cambridge Analytica-linked data leak that occurred prior to the election and would eventually lead to Facebook’s broader reckoning with regulators and policymakers.
The Cambridge Analytica saga began with a psychology professor harvesting data on millions of Facebook users via a personality test app, then giving it to a service promising to use vague and sophisticated techniques to influence voters during a high-stakes election in which the winning presidential candidate won narrowly in several key states.
A 2020 report by the UK Information Commissioner’s Office cast significant doubt on Cambridge Analytica’s capabilities, implying that many of them had been exaggerated. However, the improper sharing of Facebook data set off a chain of events that resulted in a slew of investigations and lawsuits.
Zuckerberg is briefed
After learning about Cambridge Analytica’s claims that it could use personal data to create “psychographic profiles” of voters who could then be targeted with effective political advertising, Zuckerberg began questioning subordinates about the firm’s marketing.
In one January 2017 email obtained by the SEC, Zuckerberg asked staffers to “explain to me what they actually did from an analytics and ad perspective and how advanced it was.”
“Like, are these folks actually doing anything novel?” Zuckerberg explained further. Or are they simply exaggerating about data…. To summarise quickly, my understanding from those conversations was that it was much closer to the latter.”
According to the deposition, even though Facebook as an organisation knew by that point in 2017, that Cambridge Analytica had obtained Facebook users’ personal information in violation of the platform’s policies, that incident was never raised to Zuckerberg as a piece of potentially relevant context. Following Facebook’s discovery of the leak, the company ordered Cambridge Analytica to delete the data it had improperly obtained through a third party and to sign a certification indicating compliance.
Zuckerberg testified that he did not become “fully up to speed” on the 2015 data leak and Facebook’s response to it until March 2018, when public reports about the incident surfaced.
In his deposition, Zuckerberg explained that he was not briefed earlier because Facebook considered the 2015 incident a “closed case until 2018, when new allegations surfaced that suggested that maybe Cambridge Analytica had lied to us” about deleting the Facebook data. (The UK ICO’s report later found that Cambridge Analytica did appear to take some steps toward deleting the data, but it also expressed doubts about whether those steps were effective enough.)
In his testimony, Zuckerberg reiterated that if Facebook had moved more quickly to implement an existing and separate plan restricting app developers’ access to Facebook information, the data leak could have been avoided from the start.
