Mark Zuckerberg’s apology tour continues this week when the Facebook founder and CEO will appear at hearings in the Senate and House of Representatives to discuss his company’s practices.
It will be a public opportunity for lawmakers to make a show that they’re taking a tough stance on Facebook — and a chance for Zuckerberg to face some important questions about what his business is up to and how it plans to address some past wrongs.
The Cambridge Analytica scandal has given birth to myriad questions about Facebook’s practices regarding data and security — and, of course, concerns about the platform’s role in the dissemination of Russian disinformation in US politics continue. On Tuesday in the Senate and Wednesday in the House, lawmakers will have the opportunity to ask Zuckerberg about those matters and more, and they’re ready to take it.
“We have a problem,” said Sen. John Kennedy (R-LA), who sits on the Senate Judiciary Committee, which will hold a joint hearing with the Senate Commerce Committee at which Zuckerberg will testify, on Face the Nation on Sunday. “Our promised digital utopia has minefields in it. Mr. Zuckerberg has not exhausted himself in being forthcoming.”
Expect a show
Given the public attention on and worries about Facebook, lawmakers from both parties are likely to take the opportunity to make a show of their outrage.
“Lawmakers will put their indignation on full display for television cameras during what will likely be a very tough grilling of Zuckerberg,” Mark Hamrick, a senior economic analyst at Bankrate.com, told me. “No doubt some will be sincere. But one must also note that Congress has been ineffective and noticeably absent in policing against and reacting to data privacy abuses, including in the wake of the Equifax disaster.”
Beyond the Cambridge Analytica-fueled privacy debate, questions about Russian meddling in the 2016 election and its consistent efforts to interfere in US politics remain. Facebook last week said it would require those running political and issue ads on its platform to be verified, and it’s upping efforts at transparency. What else is it doing on the political meddling front, and what measures does it have in place to make sure it works?
“This will be one of the most contentious hearings we have seen since bank CEOs went to the Hill during the financial crisis,” said Isaac Boltansky, an analyst at Washington, DC-based research firm Compass Point.
There are three groups of lawmakers to watch out for in the Senate, Boltansky said:
- Big names who could grab headlines, such as Sens. Lindsey Graham (R-SC) and Dick Durbin (D-IL)
- Former state attorneys general, such as Sens. Richard Blumenthal (D-CT) and Kamala Harris (D-CA)
- The 2020 presidential hopefuls, including Sens. Cory Booker (D-CA) and Harris
In the House, the figures to keep an eye on include House Energy Committee Chair Greg Walden (R-OR) and ranking member Frank Pallone Jr. (D-NJ) as well as Majority Whip Steve Scalise (R-LA).
“We want [Zuckerberg] to account for Facebook’s failure to protect their user data and then, of course, their subsequent failure to take any meaningful action for years,” Pallone told me in a phone interview.
In prepared testimony to the House committee released ahead of the hearing, Zuckerberg will tell lawmakers he’s sorry for what happened. “We didn’t take a broad enough view of our responsibility, and that was a big mistake,” he plans to say.
Facebook has announced a number of steps it plans to take on its own to address concerns about its practices in recent weeks and days, including enacting new measures to prevent election meddling and spelling out its terms and data policy more clearly. Zuckerberg also took part in an hour-long Q&A session with reporters last week. All of that is likely an effort to avoid fireworks in Congress if at all possible. “I’m assuming that his people are not planning to have him break news,” Rebecca MacKinnon, an internet freedom advocate and director of Ranking Digital Rights, said. “They broke all their news last week so that he doesn’t have to break it in the hearings.”
I’ve spoken with a variety of experts, observers, and stakeholders in recent days to find out what sorts of questions Congress can and should ask.
1) What “malicious actors” have user data?
Facebook in a post last week announcing new plans to restrict data access revealed that “malicious actors” have abused its features to scrape public profile information. It didn’t say who those actors are.
2) Are there more shoes to drop?
Just last week, Facebook acknowledged that 87 million people’s information might have been accessed by Cambridge Analytica, suspended more Russian-linked accounts, and said data from most of its 2 billion users is vulnerable. “How can Facebook be sure more user data has not been misused, and how can the company identify other third parties that may have inappropriately acquired or misused user data?” wrote Michelle De Mooy, director for privacy and data at the Center for Democracy & Technology, in a recent blog post.
3) If you’re open to regulation, why oppose state efforts to regulate?
Zuckerberg has said he’s open to Facebook being regulated, but Facebook has repeatedly opposed state privacy laws, noted Joe Jerome, policy counsel at the Center for Data & Technology. That includes existing laws on the books such as the Illinois Biometric Information Privacy Act, which covers sensitive facial recognition data, and a California consumer privacy initiative on the ballot in November. “Hopefully this hearing will clarify the company’s approach to privacy laws,” Jerome said.
4) Are you the right person to lead Facebook?
Zuckerberg has said he still believes he is the right person to lead Facebook, and because of Facebook’s shareholder setup in which Zuckerberg controls the majority of the company’s voting stock, he can’t be fired unless he fires himself.
“Facebook’s governance also faces questions, including whether Zuckerberg should continue to serve in both CEO and chair capacities and whether he holds too much power as shareholder,” Hamrick, from Bankrate.com, said. “The marketplace will, to some degree, help determine the outcome of these issues, particularly if the stock continues to come under pressure.”
5) Does Facebook’s business model need to change?
Facebook has defended its business model, which essentially positions its users as the product: It depends fundamentally on providing advertisers with user data to help them target potential consumers. Is there a willingness to try and change the business model that doesn’t depend on extracting and exploiting user data? Facebook COO Sheryl Sandberg said in an interview with Today that an opt-out tool to keep Facebook from using profile data for advertising would be a “paid product.”
6) Who owns Facebook’s user data?
There are a lot of questions about who, ultimately, owns the data on Facebook’s platform and what users should reasonably expect is and isn’t being done with their information. Yes, people put their information on Facebook’s platform voluntarily, but they didn’t sign up, for example, to have that used by Cambridge Analytica.
Europe is about to enact a law that, among other things, allows for data portability — meaning users can take their information from one platform for another — and lets users have their information deleted. Would Facebook be open to giving users in the US the same rights?
It’s also worth noting that Facebook’s default user settings promote sharing data inside and outside the platform.
7) What do you think about the agreement with the FTC?
The Federal Trade Commission in March confirmed that it is investigating Facebook over the possible misuse of the personal information of what Facebook has since confirmed to be as many as 87 million of its users by Cambridge Analytica. At issue is whether Facebook violated a 2011 consent decree with the FTC over charges that it deceived consumers about their privacy.
The Electronic Privacy Information Center (EPIC) is encouraging Congress this week to get beyond what Zuckerberg has and can do and to instead focus on the FTC order, said EPIC president Marc Rotenberg in an email. He believes the Cambridge Analytica debacle could have been prevented had the FTC enforced the order. “I am confident this will happen,” he said.
“Does Facebook believe the terms of the FTC’s 2011 consent decree meaningfully improved Facebook’s privacy practices?,” wrote De Mooy in the CDT blog post.
8) Europe is about to take a big step in regulating Facebook. Why not apply those standards in the United States?
Europe on May 25 will enact the General Data Protection Regulation, or GDPR, a new privacy law designed to make sure users know and understand the data companies collect about them and consent to sharing it. Zuckerberg has said he intends to apply the guidelines outlined in the law to users worldwide — but has also acknowledged it won’t be the same format everywhere.
“What format does he see for the United States?” said Mike Litt, consumer campaign director at the United States Public Interest Research Group, in an email. “Would he support a privacy law that guarantees many of those protections for American consumers? Does he support a privacy bill of rights that requires consent from consumers before their information can be used?”
9) How are we supposed to trust that this time is different?
Facebook has consistently waited to address problems until after the damage has been done or it’s been caught. It suspended Cambridge Analytica from its platform the day before news reports were published about what happened when it was clear they couldn’t keep the incident under wraps.
Lawmakers will likely press Zuckerberg on what he plans to do to be more proactive with harm assessment, risk mitigation, and addressing problems before it’s too late. “Isn’t it time for Facebook to stop this pattern of act first and break things and then fix it later?” MacKinnon said.
“If Facebook can’t fix its privacy problems then how can Americans trust them to be caretakers of their sensitive information?” said Sen. Bill Nelson (D-FL) in a statement after meeting with Zuckerberg on Capitol Hill on Monday.