Audit Approved of Facebook Policies, Even After Cambridge Analytica Leak (nytimes.com) 73
Nicholas Confessore reports via The New York Times: An auditing firm responsible for monitoring Facebook for federal regulators told them last year that the company had sufficient privacy protections in place, even after the social media giant lost control of a huge trove of user data that was improperly obtained by the political consulting firm Cambridge Analytica. The assertion, by PwC, came in a report submitted to the Federal Trade Commission in early 2017. The report, a redacted copy of which is available on the commission's website, is one of several periodic reviews of Facebook's compliance with a 2011 federal consent decree, which required Facebook to take wide-ranging steps to prevent the abuse of users' information and to inform them how it was being shared with other companies. The accounting firm, formerly known as PricewaterhouseCoopers, effectively gave Facebook a clean bill of health. "Facebook's privacy controls were operating with sufficient effectiveness to provide reasonable assurance to protect the privacy" of users, said the assessment, which stretched from February 2015 to February 2017. But during that period, Facebook was aware that a researcher based in Britain, Aleksandr Kogan, had provided Cambridge Analytica with private Facebook data from millions of users.
The system is broken (Score:1)
how do we regulate the regulators?
Re:The system is broken (Score:5, Insightful)
They do have a page to see what data they hold on you if you don't have an account, but to use it of course you need to....send them your data so they can check for matches. Catch 22.
Re: (Score:2)
In that order? it's just that I'd have trouble telling them apart.
Re: (Score:1)
Yeah, a law giving us the power of subpoena to our own data and how/where/when it was acquired sounds fair to me. Hey, we're just *filing for discovery*.
Re:The system is broken (Score:4, Informative)
The Cambridge Analytica leak was the result of technical incompetence, and poor code review, not bad policy at the level an auditor would see. It is not reasonable to expect a financial auditor to discover bad code.
Re: (Score:1, Interesting)
Re: The system is broken (Score:2)
Incoherent rant is incoherent.
Re: (Score:2)
Just about any app can do what they are butt hurt at cambridge and guess what Clinton campaign used the same thing and so did Obama camp in 2012 that PIONEERED the practice to use it like it was.
Citations that The Clinton campaign and the Kenyan Terror baby used Cambridge Analytica needed.
Re: The system is broken (Score:1)
This is the first time I've seen that splendid sobriquet so I apologize for being picky but shouldn't "baby" in "Kenyan Terror baby" have a capital B because we are referring not to a random baby suffering from Kenyan Terror but a specific, indeed The, Kenyan Terror Baby? Is there more than one?
Re: (Score:2)
This is the first time I've seen that splendid sobriquet so I apologize for being picky but shouldn't "baby" in "Kenyan Terror baby" have a capital B because we are referring not to a random baby suffering from Kenyan Terror but a specific, indeed The, Kenyan Terror Baby? Is there more than one?
Good point and agreed. It shall now be The Kenyan Terror Baby.
Re: (Score:2, Insightful)
An audit is not complete ... (Score:1)
... if it not comprehensive
I used to work with Moody, an international recognize firm which stresses its independence
The audits that we had carried out must not do favor for any party, and must be comprehensive, over and beyond what has been described in the jobscope
Often we dug through many outside sources about the real nature of the client we were about to audit, before we even accepted them as a client
Re:The Facebook business model is broken (Score:2)
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
The Cambridge Analytica leak was the result of technical incompetence, and poor code review, not bad policy at the level an auditor would see. It is not reasonable to expect a financial auditor to discover bad code.
Nothing short of hilarious that while giving Cambridge Analytica and gawd knows who else people's personal data to be weaponized, they present a redacted copy of the audit to the public. Gotta protect privacy yaknow
Re: The system is broken (Score:2)
Us deplorable commoners just can't handle the truth.
Re: (Score:2)
How the fuck do you think they make money by NOT charging for their product!!!
Re: (Score:2)
The real problem is we are expecting some mythical set of pure perfection, anything less then then perfect will be punished.
You could be the best driver in the world, and still get into a car accident. Your automobile may fail even after a properly performed inspection.
Regulators and only look for issues they know about. With a rapidly growing company like Facebook there are new issues that appear and happen before regulators or Facebook even know where to look, and often risks are identified, but no pract
They do their job (Score:5, Insightful)
Re:They do their job (Score:5, Informative)
Yep, posting anonymously for obvious reasons, but I work for a financial services firm, and we had an issue that meant people unfairly getting rejected for mortgages because the analytics team had completely fucked up some scoring calculations. This was reported to the regulator as we had a legal obligation to do so, and we had to get auditors in to confirm the validity of our fix and processes, and to prevent this happening again.
The auditor was also PwC, and I had to work closely with them to help provide them the information they need.
Make no mistake, when people pay a company like PwC to "audit" them and "hold them to account", they're not paying for that at all. What they're paying for is for a company with a big legal department backing it's auditors to come in and help them evade any legal ramifications stemming from their mistake. The auditors don't for example remotely report back to anyone independent any failings, so there's no holding to account off the back of these audits. All they do is linger around, charging by the day to help try and spot any mistakes you've made and help you cover them up, when you've done that they sign the audit off as having passed.
So let's be clear here, you could be guilty of gross incompetence, abject illegality, and you can call in a company like PwC, you can ask them to help you make everything legal for as long as it takes, then at the end of it they sign off as "audit passed". That is, they're not auditing the company that made the mistake, they're auditing the company that they spent weeks, or even months plastering over the mistake.
You could argue this is sufficient in itself, because at least the company being audited has made up for it's mistakes, but again, we're talking about what is sometimes absolute illegality here in some cases, with some companies, and if companies are allowed to cover that up with no transparency over how bad things were and what went wrong, and no legal punishment for something that by law, should have legal punishment such as a fine, or even penalties against execs, then there's absolutely zero incentive for companies to ever improve, so once the auditors have gone, odds are, they'll just slip back into their ways if it's financially beneficial to do so. In our case for example, it was "good job everyone in passing the audit", when in reality it should've been "analysts, you need to improve your processes and start ensuring your calculations are accompanied with mathematical proofs where appropriate and sufficient test cases as to allow automated validation and regression testing".
What PwC offers isn't an audit per-se, it's a cover up service, no one should be surprised when a paid cover up service declares everything a-ok.
Honestly, given that PwC is also the prime culprit for "tax efficiency" which too many times has turned out to actually be outright tax evasion, rather than just avoidance too, then this company should be shut down. It's entire existence is built around supporting corporate criminality. It's not the only one, but it's definitely the most prominent one.
Re: (Score:1)
It's not an auditors job to air your dirty laundry (the levels of NDAs they're under would prohibit it anyway). They are there to make sure you use soap. Granted they likely would try to argue you showed them a box that looked like soap, it's their job - their bond - to prove that it was. They will become liable if it comes out later that you in fact did not use soap.
Re: (Score:2)
It's the same with consultants (though perhaps less legally questionable). e.g. CEO wants to outsource to somewhere, but doesn't want responsibility for the decision. Calls in management consultants. After paying them lots of money they write a report recommending outsourcing to somewhere. If outsourcing program works out, CEO claims responsibility. If it crashes and burns CEO blames the consultants.
I think of them as professional fall guys.
Re: They do their job (Score:2)
Nothing of what you said is considered external auditing. That's closer to "IT consultation" or at best internal auditing.
Internal Auditiors report directly to the CFO. External Auditors report to the auditing firm's partners and clients shareholders.
Re: (Score:2)
The GGP isn't talking about the Analytics team or that department. He is talking about the auditors who would be an independent department.
Internal auditors will report to the VP of Risk Management, Chief Audit Executive or similar. All such positions usually report to the CFO (in the US). The audit aspect of the CFO's job reports to the Board of Directors, Audit Committee , and/or SEC (via fiduciary duty). Basically they don't [usually] go to the CEO or any of their reports like the COO (it would be a
Re: (Score:2)
Internal Audit [wikipedia.org]: "Internal auditing departments are led by a Chief Audit Executive ("CAE") who generally reports to the Audit Committee of the Board of Directors, with administrative reporting to the Chief Executive Officer (In the United States this reporting relationship is required by law for publicly traded companies)."
Audit Committee [wikipedia.org]: "The chief audit executive (CAE), director of audit, director of internal audit, auditor general, or controller general is a high level independent corporate executive wit
Re: (Score:2)
The type of audit Facebook had is not this. These types of audits do something else:
They make sure that controls are in place -- that the company being audited has working internal methods (internal audits) to catch things -- things li
Re: (Score:2)
PwC (Score:2)
Right. So this is like how Carillion (a big construction conglomerate in the UK) became insolvent just months after KPMG had given them the green light in an audit (for which they took millions in fees). Or how the various ratings agencies gave CDOs investment grade ratings despite them being based on total junk.
I mean, it is just a sort of formalised corruption at this point. In south east asian they do it with brown paper bags under the table, over here they just buy the politicians so that what they are
Re: (Score:2)
who paid for it, Facebook or the FTC?
I care more about who chose the auditing company.
The FTC should have chosen a company that specialized in testing the security of other companies. The FTC should have told the security company, "Test Facebook, send your results to us and to Facebook, send the bill to Facebook, and tell us if they give you any problems."
security audits utterly useless (Score:2)
Re: (Score:1)
Sorry, that's not how it works. If PWC, or anyone else, did any *REAL* audits they would very quickly find themselves with no clients, i.e., out of business. PWC and all other "auditors" are in the CYA and Plausible Deniability business. Period.
Except audits are _required_ in many fields. An audit is legal assurance (and yes I realize the irony). It will be interesting if Facebook tries to punt their obligations (and presumably fines), to PwC. Would be like ratting on the mob, Zuckerberg wouldn't last too long.
I'd be pulling money out of their stock about now before Facebook execs dump it for their "retirements". Their current over inflated evaluation still amazes me.
Poor article & post - a fluff about nothing. (Score:3)
The article and post play into the usual misunderstandings of what a true external audit is. A auditor NEVER gives a clean bill of health to ANYONE.
It would be the equivalent of saying "My 14 year old daughter is incapable of lying!" Or to hit closer to this group "This networked system is totally secure for the next 10 years!" No, those are stupid! Any competent IT guy would say "This system has all the latest patches and best industry practices to remain secure." They would check a few patches and see if they were applied quickly enough to come to that conclusion.
An auditor collects enough information from a client for an owner of the firm to provide a SECONDARY agreeing or decenting OPINION of the company's financial or security or operational position. The company can say "We are going bankrupt." and the auditor will say "I think they are right!"
operating with sufficient effectiveness to provide reasonable assurance
The key words that you will find in almost all audit work is "sufficient effectiveness" and "reasonable assurance". Which is complete true in this situation. Facebook doesn't have policies that give your data out to anyone. They don't violate their policies by doing such. A partner did really go above and beyond what they should have. Facebook failed to regulate such partner but may have had reasonable measures to prevent abuse.
Also, keep in mind that auditors are not here to catch the client in lies, nor catch collusion between people (reportee buys a car, mgr approves, they sell & split profits).
Basically the article is "Auditors did their job but it wasn't enough to prevent this."
Ease up on the auditors, look at the dates. (Score:2)
So it doesn't look to me like the auditors weren't doing their job, it looks like they did their job, helped uncover what happened, and were still able to give Facebook the thumbs up because they had already fixed the problem months before the audit began.
Anyone surprised? (Score:2)
Audits are, effectively, useless (Score:3)
Limited vocabulary (Score:2)
Do none of these NYTimes twats know the word "scraping"? They seem Hell bent on trying to make what occurred appear like some l33t hacking operation.
Have We Learned Nothing From Enron? (Score:2)
If you've hired a "Big Accounting Firm", you've already failed. Alll those sleazeballs that advertise on the Sunday political shows? Do not hire them. Not ever. For anything. People who know, don't hire BDO. Or PWC, or any of the other "Big 4" Sleaze Firms.
Of course it did (Score:3)
It didn't audit as a "leak" because it WASN'T A LEAK?
This was the facebook API working essentially as intended. To a malign purpose (ie helping Trump) and to a degree in excess of what the researcher was expected to pull, but this was in no sense someone 'hacking' fb's systems to get information that wasn't intended to be collected somehow.