Zuckerberg wrote an apology and $57.3 billion in market value vanished. What exactly is Facebook's big trouble?

Inevitable, really.

This morning, Zuckerberg apologized again:

I want to share an update on the Cambridge Analytica situation — including the steps we've already taken to address this important issue, and what we plan to do next. We have a responsibility to protect your data, and if we can't do that, we don't deserve to serve you. I've been working to understand exactly what happened and how to make sure it doesn't happen again. The good news is that the most important steps to prevent this from happening again were taken years ago. But we still made mistakes, there is still more to do, and we need to act now. Here is what happened: In 2007, we launched the Facebook Platform, hoping it would help more apps become social. Your calendar should show your friends' birthdays, your map should show your friends' addresses, your address book should show your friends' photos. To make that possible, we let people log into other apps with their Facebook accounts, and let those apps see information such as a user's social connections. In 2013, a Cambridge University researcher named Aleksandr Kogan built a personality quiz app. About 300,000 people installed it, and in doing so shared their own information and their friends' information with it. Under the platform rules Facebook ran on at the time, that gave Kogan access to data on tens of millions of users. In 2014, to stop apps from abusing data, we announced a redesign of the whole platform to limit what third-party apps could see. Apps like Kogan's could no longer ask for a user's friends' data unless those friends used the app too. And developers now had to get Facebook's approval before asking users for any sensitive information. Those limits made it impossible for any app like Kogan's to collect user data on that scale. In 2015, we learned from reporters at The Guardian that Kogan had passed the data he collected to Cambridge Analytica. That broke our developer rules, which forbid developers from sharing collected information without the user's permission. We banned Kogan's app from the platform immediately, and asked both Kogan and Cambridge Analytica to certify that they had deleted all the improperly obtained data. They gave us that certification. Last week, we learned from reports in The Guardian, The New York Times and Channel 4 that Cambridge Analytica may not have deleted the data as promised. We immediately barred the company from using any Facebook service. Cambridge says it has deleted all the data, and has agreed to let us send an outside auditor to confirm it. We are also helping government regulators investigate. This broke the trust between Kogan, Cambridge Analytica and Facebook. It also broke the trust between Facebook and the people who give us their data and expect us to protect it. We have to fix it. We took important steps back in 2014 to keep bad actors from getting at user data this way. But there is far more for us to do. Here are the changes coming next: First, we will investigate every app that had access to large amounts of user data before we tightened our data rules. Apps that show suspicious behavior will get a full review. Any developer who refuses to cooperate with the audit will lose access to the platform. If we find developers who misused user data, we will ban them as well, and tell everyone affected — including the people caught up in Kogan's app. Second, we will restrict developers' access to user data much further, to head off other kinds of abuse. For example, if someone hasn't used an app for three months, we will cut the data a developer can see down to name, profile photo and email address. Before a developer can reach other private data, such as the posts a user has written, we will require not only the user's consent but a signed electronic contract. We will announce more changes in the coming days. Third, we want you to know exactly which apps you have allowed to take your data. Next month we will put a tool at the top of the Facebook News Feed showing every app you have used, so you can manage what they are allowed to do with your information. The tool already exists in privacy settings; now we are moving it to the top of the feed where everyone will see it. On top of the data-access measures we took in 2014, I believe what we do next will keep the platform safe. I started Facebook, and to the last day I am responsible for what happens on it. I take seriously anything that can protect this community. Something like Cambridge Analytica can no longer happen with new apps, but that does not undo what we failed to do in the past. We will learn from this and make our community and our platform safer. I want to thank every one of you for continuing to believe in our mission and for building this community with us. I know fixing all of this will take longer than we would like, but I promise we will get there, and serve you better over the long run.

The apology is classic Zuckerberg: a detailed account of what happened and how Facebook let someone slip through the gap; then what Facebook will do so it doesn't happen again; a reminder along the way that protecting user data is ultimately Facebook's job; and, at the end, a line about his own responsibility.

It leaves a great deal unanswered. This carefully worded statement is not enough to settle the storm Facebook has set off over the past few days.

According to reports last Saturday in The Guardian and The New York Times, Cambridge Analytica — the campaign data firm controlled by the Trump camp — used the profiles of 50 million Facebook users, taken without their knowledge, to aim messages at voters during the U.S. election. While Trump was running for president, the company took $6 million from him to make campaign ads.

Because it touches the presidential election, the story has become the most fiercely argued subject in America over the past few days.

Facebook has already paid dearly. Over the past two trading days its market value briefly fell by $57.3 billion — close to two Weibos. The crisis set off by the leak of user information is still spreading.

So what exactly was leaked?

This leak does not mean Cambridge Analytica got hold of those 50 million users' email addresses, passwords or bank accounts.

When you log into a game with your WeChat account, the game gets your basic information, and some games will also connect you to WeChat friends already playing.

Facebook works the same way, except that outside China this kind of login arrived earlier and spread much wider.

In 2013, the Cambridge University researcher Aleksandr Kogan built a personality quiz app. Some 300,000 Facebook users installed it, and in doing so handed over their own data along with their friends' data.

Under Facebook's platform rules at the time, Kogan could reach essentially everything about those 300,000 users and their friends.

The app presented itself as academic research. The Guardian reported that the quiz paid its takers — and that to qualify for the money, you first had to have more than 185 friends. That is why 300,000 people taking a quiz ended up exposing at least 50 million users.

Zuckerberg says Facebook changed the rule in 2014, restricting the ability of apps like Kogan's to reach a user's friends.

But Kogan had already sold the data to Cambridge Analytica. Facebook learned this from a Guardian reporter in 2015 and told everyone involved to delete it.

Clearly, it was never fully deleted.

Cambridge Analytica set up a separate company to mine the data. What Kogan collected went beyond the basics of gender, age, job and education: it included what people did on Facebook day to day — which articles they posted, which they read, which pages they liked.

The story was first taken to The Guardian by a former Cambridge Analytica employee, Christopher Wylie. Wylie said mining the data cost Cambridge Analytica about $1 million.

Cambridge Analytica processed what it had and pulled out the kind of detail targeted marketing runs on.

Aiming marketing at people by their preferences is what every company sitting on data does. Google, Facebook, and in China Weibo, WeChat, Toutiao and Baidu all sell advertising the same way: work out what a user likes, then put an advertiser's ad in front of that user as precisely as possible. Taobao recommending products from your search and purchase history is the plainest example.

Usually, though, that "user" is a blur. Data matters in digital advertising precisely because each tech company holds its own users' data and no one else's. Cambridge Analytica got preference data on 50 million Facebook users — and knew who each of them was.

The other problem is how fine-grained that data was. Kogan's private emails show he derived profiles far more detailed than anything a commercial platform lets advertisers filter by:

Gender, age, political leaning (conservative / liberal / libertarian / not engaged), IQ, type of job, college major, religious leaning, satisfaction with life, openness, interests (the military, violent cults, intellectual pursuits and so on), and how much you believe in astrology, on a five-point scale.

Facebook's ad tools may offer a political-leaning setting too, but aiming an ad at everyone tagged "20-30 years old" and "supports the Democrats" cannot work as well as aiming a campaign ad at people who "visited Trump's campaign page three times" or "liked Trump."

There is, of course, no evidence that the profiles Cambridge Analytica derived were accurate.

And even with sharper targeting data, the Trump campaign spent far less on advertising than Hillary Clinton — under one-eighth as much.

As with several episodes since the election, many people are once again citing this one to explain how America elected Trump.

Facebook's response came far too late

The Guardian and New York Times reports had America's attention last Saturday. Facebook was slow to answer.

Only a few hours ago did CEO Mark Zuckerberg and the COO say, formally, "we made mistakes." Five days had passed since the reports appeared.

In his Facebook post, Zuckerberg wrote: "We have a responsibility to protect your data, and if we can't do that, we don't deserve to serve you."

After the Cambridge Analytica scandal, Facebook changed what developers may see: when someone logs into an app with a Facebook account, the developer starts with very little information; when the user stops using the app, the developer loses access; and anything more requires further permission from Facebook.

This came too late.

And the permissions were not the only late thing. Through the whole crisis, Facebook's leadership stayed quiet. The tech investor Jason Calacanis told CNBC on Monday: "As the CEO of a social media giant, Zuckerberg has done a very bad job lately." He thinks Zuckerberg should hand the job to someone else.

It took five days for Zuckerberg to speak.

At Tuesday's internal briefing for Facebook employees, neither Zuckerberg nor COO Sheryl Sandberg turned up. The Daily Beast, citing people who knew about the meeting, reported that it was led by Facebook counsel Paul Grewal.

Facebook did the same thing last fall, when Congress came asking questions: it sent its chief lawyer, Colin Stretch, rather than any executive, to hand over material on Russia's use of Facebook to interfere in the U.S. election.

Part of the reason this leak has blown up so large is that, once again, it runs into the presidential election.

Any subject that drags in "how did Americans put Trump in office" cannot stay small. And with feelings running this high, Facebook sending no one from the top brought another round of attacks.

Last September, Facebook told the U.S. congressional intelligence committees that during the 2016 presidential election Russian agents had interfered by quietly buying political ads on the platform. Facebook's own report found 500 fake accounts "likely operated from Russia" that had bought ads on the platform during the election to sway it.

Over two years, Russia posted more than 80,000 items on Facebook meant to influence American politics, and about 126 million Americans saw them. For scale: 135 million people voted in the election that put Trump in office.

At the start of 2018, in his new year's resolution, Zuckerberg said this year's Facebook felt a little like the period just after the 2009 financial crisis: a company with a list of problems to solve.

First, he said, he would make sure Facebook was not interfered with from abroad, and would go after inflammatory and hateful speech, so that users had a comfortable place to be social.

Now a new crisis has arrived. The resolution looks harder to keep.

The U.S. Federal Trade Commission has stepped in and opened an investigation. Facebook could face a $2 trillion fine.

Bloomberg reported that Nordea, the largest bank in the Nordic region, has barred its sustainable investment unit from buying any more Facebook stock. The questions its head, Sasja Beslik, put to the company are the ones many ordinary users would ask: "This happened in 2016 — why are we only hearing about it now? Is this crisis only about the United States? Has the data been used in other elections, or for other purposes?"

The crisis has dragged down other social networks too. Twitter fell more than 10% at one point, and Snap dropped 2.56%.

Brian Acton, one of the two founders of the messaging app WhatsApp, joined the #deleteFacebook campaign on Twitter on Tuesday night, writing: "It is time. Delete Facebook." Acton made billions of dollars when WhatsApp was sold to Facebook.

As privacy breaches go, what leaked here is less damaging than the credit-card and account data spilled every year. But attach Trump to it, and the charge of misleading the world, and it becomes an enormous story.

A social network knows this much about us because users chose the arrangement: users pick a free social network → the network collects data and sells ads for advertisers → the network adds features → users hand over more information → the network collects more data and aims advertisers' ads more precisely.

Every time you tap "log in with your such-and-such account," you give a social network more data. Who studies it afterward, and what they do with it, you have no idea.

Cover image from EnriqueMendez on Visual hunt / CC BY-NC-SA