Information Security Breach: Facebook and Cambridge Analytica

This report examines the 2018 Facebook data breach involving Cambridge Analytica, a British political consulting firm. The report details how Cambridge Analytica harvested personal data from millions of Facebook users through a third-party app, 'this is your digital life', without their explicit consent. It explores how this data was used, primarily to influence the 2016 US presidential election and the Brexit campaign. The report discusses the methods of data extraction, the public exposure of the breach, and the resulting impact on Facebook's business, including declining user numbers and stock value. Furthermore, it analyzes the ethical and legal implications of the data breach, highlighting issues of user privacy, data security, and the misuse of personal information. Finally, the report concludes with recommendations for enhancing information security, increasing transparency, and empowering users with greater control over their data, suggesting improvements for Facebook's policies and practices.

Running Head: Information Security Breach
IT FOR BUSINESS

1
Information Security Breach
Executive Summary
The report will be discussing a recent news where in information security was breached and was
the main concern among the people. The discussion is related to a social media giant named
Facebook whose data has been retrieved by a third party British Firm called Cambridge
Analytica. The discussion will be focused on the various aspects related to the information
security breach of Facebook and what was the incident all about. The effect of such activities on
Facebook’s business will also be a major issue addressed in this report
Table of Contents

2
Information Security Breach
Executive Summary.....................................................................................................................................1
Introduction.................................................................................................................................................3
About the Information Security Breach.......................................................................................................3
How was the Information extracted?..........................................................................................................4
How the breach came out in public?...........................................................................................................5
What was the use of the data?....................................................................................................................5
The aftermath of the effect and impact on business...................................................................................6
Conclusion and Recommendation...............................................................................................................6
References...................................................................................................................................................8
Appendices................................................................................................................................................10
Introduction
With the advancement in the field of technology, people are becoming more tech-savvy and are
more curious to explore the technological tools being developed nowadays. People and
businesses are now using information technology tools to make their life easier and better. But

3
Information Security Breach
using such tools not only brings various advantages but also has several drawbacks which are
mainly concerned with the data and information security.
Especially, for an organization, information security is a major concern as their business
operations are totally dependent on such information. Information is basically the data collected
throughout the business process which may include people's personal data as well. The data
breach has always been trending news every day so it is always a challenge for an organization
to take care of the information security aspect so that the risk related to the data breach is
minimized.
In this report, a recent information security breach of Facebook will be discussed. An American
social media giant, Facebook provides a platform for people to connect with other people across
the globe. The report will be based on how a British company called Cambridge Analytica has
extracted the personal data of millions of accounts of people on Facebook. What exactly was the
motive behind this and how the company was successful in breaking into this social media
service provider. Also, the discussion will be focused on how people got to know the breach and
what was the impact of such an incident on people. Along, with this, the various aspects related
to information security breach and its impact on business will be discussed.
About the Information Security Breach
Recently, Facebook has been trending in news and on social media due to the fact that about 50
million of Facebook profile's data has been extracted by a British firm called Cambridge
Analytica. Cambridge Analytica is a British firm which assists businesses to change the behavior
of audience by using several data mining and data analysis techniques. It uses data brokerage and
strategized communication in order to help in the election of recent US president Donald Trump
(Guardian, 2018).
The firm specially harvested millions of data from Facebook profiles and used it allegedly to
map the behavior of voters for two of the important campaigns. One for Brexit and the other is
for Presidential elections in the United States of America. This news raised a concern of
information security amongst the people and people were anxious about the personal data
collected as a huge population of people are active users of this social media service provider
(Sørensen, 2016).
The person in question was none other than the founder of Facebook Mark Zuckerberg, who took
the charge and accepted the blame of such data breach. Such security issues about the stolen

4
Information Security Breach
information or missing data are always a major setback for every organization, especially when
there is an organization like Facebook who has its users spread across every corner of the globe.
The scandal had a huge impact on the business of Facebook with its shares tumbling down to a
great extent which also resulted in the reduction in the number of active users on Facebook (SBS
News, 2018).
How was the Information extracted?
This series of events raised a question on how the firm Cambridge Analytica was able to extract
the data of such a huge number of people. As the scale of data extracted was very huge which
marked as one of the largest data leaks in the history. The information was extracted using an
app called ‘this is your digital life' developed by a Cambridge psychology professor who goes by
the name Aleksandr Kogan. Back in 2015, the professor developed this app which prompted the
users to share their personal information. The app was basically a quiz about the personality of
peoples that extracted the user's Facebook data. Almost, 270,000 Facebook users fell into the
trap of information sharing and signed up for the personality test (Frenkel, 2018).
Global Science Research is a company which is headed by professor Kogan who already had a
deal with the firm Cambridge Analytica that the information collected through the app will be
shared with the British firm. Not only that the app collected the user's personal information and
data but it also had an effect on the Facebook friends of that user. The app also harvested the
personal information of the user's Facebook friends who might not have been provided the
permission of sharing their data (Think, 2018).
This incident was not ethically correct and raised a question on user's private data. It is not
morally subjective to collect private information of people without their consent. On this event,
Cambridge Analytica commented that it had signed a deal with Kogan's company in a good faith
to extract data of Facebook users in a manner similar to the other third-party apps which also
collects the personal details of such users (Isaak and Hanna, 2018).
How the breach came out in public?
The event raised a question among the masses concerning how the breach was exposed. This
kicked off an investigation in finding out the source of the information security breach. A
British daily newspaper, The Guardian came out in public to announce that they were
approached by a whistleblower who was a member of the firm Cambridge Analytica. The person

5
Information Security Breach
shared all the insights and exposed the internal affairs of the firm out in the public. The firm has
exploited millions of data collected through Facebook for personal greed and they built models
in order to make good use of what they knew about people and target them. The whistleblower
admitted that this was the principle of operation of the British firm (Kleinsman and Buckley,
2015).
Facebook initially denied of this fiasco and barely admitted that there was any data breach. They
said that the app collected the data from its users in a legitimate way. But later on, they had to
admit that there was a violation of rules when the data collected was merely to sell it to the
British firm Cambridge Analytica. According to a report shared by the New York Times, there
are copies of the data leaked which are still easily accessible online (Martin, Borah and
Palmatier, 2017).
What was the use of the data?
The data was extracted by a data analysis company called Cambridge Analytica which
specializes in this field. Anyone who is having enough money can hire the firm to work for them.
In this case, the data which was outsourced from the app developed by Kogan was used by the
firm to accomplish two major campaigns. One of them was to boost the Brexit campaign and the
other major event was the US presidential election. The data extracted by the British firm was
used in helping Donald trump getting elected for the post of President of the United States.
This was one of the major news that breaks out in the past bringing Facebook in the limelight.
It affected the business of the Facebook to a great extent and many users were found switching
out of this social media platform. The data retrieved from Facebook profiles were used to
construct a psychological profile and to create a campaign related to politics that could influence
their views (Jørgensen and Desai, 2017).
The aftermath of the effect and impact on business
Initially, Facebook didn't agree with the statements that people made and denied to state such
incident even a data breach. They believed that the app used a legal way to collect the data of
Facebook profile. However, later they accepted the fact that the act of sharing data with the data
analysis firm was illegal and should be condemned. Questions were raised on Aleksandr Kogan,
and were accused of data theft by enticing millions of people to share their personal data by

6
Information Security Breach
using login details of Facebook. Kogan had lied to Facebook and its users regarding the motive
behind the data theft (Spiekermann et al., 2015).
The aftermath of this effect resulted in people's anger towards Facebook and declining of shares.
The concern was that Facebook knew of this data collection since 2015 but there was no action
taken in order to mitigate this issue and protect its users. The founder Mark Zuckerberg testified
in front of the official delegates and admitted of the data collection process. As a remedial step,
the social network traced out all the groups who had the data and asked them to delete the data
permanently. This incident was like a dark spot into the bottom and the business environment
was affected due to this (Edwards, Hofmeyr and Forrest, 2016).
Conclusion and Recommendation
With proper analysis of the report it can be concluded that in today's world, information security
is the major issue that needs to be tackled in order to survive in the business environment. As this
is one of the major factors on which the companies rely on in order to make their business
process more efficient. The similar incident is shared here which is of Facebook who only deals
in the hefty amount of personal information.
All the ethical complications have been considered by the business but still, it had to face this
issue of the data breach. The incident had a severe impact on its customers as their personal data
was at stake.
The company, as a measure to ensure that such incident doesn't take place in future, has taken
actions related to user’s privacy. By giving more control to their users over their data, it has
minimized the gaps and reduced the possibility of the data breach. Therefore, the company has
been able to get back its image in the public a social media service provider which is important
to survive the competitive environment.
Recommendations
Although, Facebook has taken several measures to ensure the privacy of its users, still there is a
huge margin of improvement. It is recommended that the company should allow more access and
controls to its users regarding the kind of data they are willing to share. A transparency should be
maintained wherein people are clearly informed about the level of data access an app has. While

7
Information Security Breach
logging into third-party apps using Facebook, it is to be ensured what type of data a user is
willing to share.
Also, proper measures should be taken in order to maintain such a huge amount of data which
can be done if the company hires a third party to take care of this data.
It is the sheer responsibility of the company to make sure that their customer's data and
information are private and it's up to them to share the amount of data on their will. By ensuring
such step, a level of trust can be strengthened between the company and its users which are
ultimately helpful for the company's business.
References
Edwards, B., Hofmeyr, S. and Forrest, S., 2016. Hype and heavy tails: A closer look at data
breaches. Journal of Cybersecurity, 2(1), pp.3-14.

8
Information Security Breach
Frenkel,S., 2018. Facebook Security Breach Exposes Accounts of 50 Million Users. [Online].
Available at: https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-
breach.html . [Accessed on 28 September, 2018].
Guardian, 2018. Facebook to contact 87 million users affected by data breach. [Online].
Available at: https://www.theguardian.com/technology/2018/apr/08/facebook-to-contact-the-87-
million-users-affected-by-data-breach . [Accessed on 28 September, 2018].
Isaak, J. and Hanna, M.J., 2018. User Data Privacy: Facebook, Cambridge Analytica, and
Privacy Protection. Computer, 51(8), pp.56-59.
Jørgensen, R.F. and Desai, T., 2017. Right to Privacy Meets Online Platforms: Exploring Privacy
Complaints against Facebook and Google. Nordic Journal of Human Rights, 35(2), pp.106-126.
Kleinsman, J. and Buckley, S., 2015. Facebook study: a little bit unethical but worth it?. Journal
of Bioethical inquiry, 12(2), pp.179-182.
Martin, K.D., Borah, A. and Palmatier, R.W., 2017. Data privacy: Effects on customer and firm
performance. Journal of Marketing, 81(1), pp.36-58.
SBS News., 2018. Facebook privacy scandal widens as 87 million now affected by data breach.
[Online]. Available at: https://www.sbs.com.au/news/facebook-privacy-scandal-widens-as-87-
million-now-affected-by-data-breach . [Accessed on 28 September, 2018].
Sørensen, E.J., 2016. The post that wasn't: Facebook monitors everything users type and not
publish. Computer Law & Security Review, 32(1), pp.146-151.
Spiekermann, S., Acquisti, A., Böhme, R. and Hui, K.L., 2015. The challenges of personal data
markets and privacy. Electronic Markets, 25(2), pp.161-167.
Think, 2018. The Facebook data breach is a scandal of our own making. Legally, there's nothing
we can do about it. [Online]. Available at: https://www.nbcnews.com/think/opinion/facebook-
data-breach-scandal-our-own-making-legally-there-s-ncna862211 . [Accessed on 28 September,
2018].

9
Information Security Breach
Appendices
(Source: Think, 2018).