Slashdot Mirror
Audit Approved of Facebook Policies, Even After Cambridge Analytica Leak (nytimes.com)
Nicholas Confessore reports via The New York Times: An auditing firm responsible for monitoring Facebook for federal regulators told them last year that the company had sufficient privacy protections in place, even after the social media giant lost control of a huge trove of user data that was improperly obtained by the political consulting firm Cambridge Analytica. The assertion, by PwC, came in a report submitted to the Federal Trade Commission in early 2017. The report, a redacted copy of which is available on the commission's website, is one of several periodic reviews of Facebook's compliance with a 2011 federal consent decree, which required Facebook to take wide-ranging steps to prevent the abuse of users' information and to inform them how it was being shared with other companies. The accounting firm, formerly known as PricewaterhouseCoopers, effectively gave Facebook a clean bill of health. "Facebook's privacy controls were operating with sufficient effectiveness to provide reasonable assurance to protect the privacy" of users, said the assessment, which stretched from February 2015 to February 2017. But during that period, Facebook was aware that a researcher based in Britain, Aleksandr Kogan, had provided Cambridge Analytica with private Facebook data from millions of users.
how do we regulate the regulators?
Problems: 1) auditors are paid by the auditees, 2) they do their job, what they were asked for, and not more. Why do you think these audit / consultancy firms are that expensive? An audit, done to reveal the kind of recent leaks, would only truly work if done by a public institution.
Slashdot, fix the reply notifications... You won't get away with it...
... if it not comprehensive
I used to work with Moody, an international recognize firm which stresses its independence
The audits that we had carried out must not do favor for any party, and must be comprehensive, over and beyond what has been described in the jobscope
Often we dug through many outside sources about the real nature of the client we were about to audit, before we even accepted them as a client
The Cambridge Analytica leak shows us that Facebook has surprisingly no clue or hold on their assets. If user data is the product, that product is freely harvested by third parties outside the control of Facebook.
Right. So this is like how Carillion (a big construction conglomerate in the UK) became insolvent just months after KPMG had given them the green light in an audit (for which they took millions in fees). Or how the various ratings agencies gave CDOs investment grade ratings despite them being based on total junk.
I mean, it is just a sort of formalised corruption at this point. In south east asian they do it with brown paper bags under the table, over here they just buy the politicians so that what they are doing is fully 'legal' in the sense that it doesn't break any of the laws they have paid to get written.
At least in Asia there is some semblance of equality in that the intrinsic power structure is weakened at all levels by corruption (a regular prole can still buy off the local cop). In the west the rigid formalised power structure means that only those at the top get all the benefits of 'flexible' rules while the rest of us are kept under the thumb.
Security audits and privacy audits are utterly useless for this case....Is the data secure? Is it private? The answer is no, and an audit like this is merely saying "we tried" even though in reality they weren't trying, they just wanted cya ability in court.
"First they came for the slanderers and i said nothing."
who paid for it, Facebook or the FTC?
I care more about who chose the auditing company.
The FTC should have chosen a company that specialized in testing the security of other companies. The FTC should have told the security company, "Test Facebook, send your results to us and to Facebook, send the bill to Facebook, and tell us if they give you any problems."
Sorry, that's not how it works. If PWC, or anyone else, did any *REAL* audits they would very quickly find themselves with no clients, i.e., out of business. PWC and all other "auditors" are in the CYA and Plausible Deniability business. Period.
Except audits are _required_ in many fields. An audit is legal assurance (and yes I realize the irony). It will be interesting if Facebook tries to punt their obligations (and presumably fines), to PwC. Would be like ratting on the mob, Zuckerberg wouldn't last too long.
I'd be pulling money out of their stock about now before Facebook execs dump it for their "retirements". Their current over inflated evaluation still amazes me.
The article and post play into the usual misunderstandings of what a true external audit is. A auditor NEVER gives a clean bill of health to ANYONE.
It would be the equivalent of saying "My 14 year old daughter is incapable of lying!" Or to hit closer to this group "This networked system is totally secure for the next 10 years!" No, those are stupid! Any competent IT guy would say "This system has all the latest patches and best industry practices to remain secure." They would check a few patches and see if they were applied quickly enough to come to that conclusion.
An auditor collects enough information from a client for an owner of the firm to provide a SECONDARY agreeing or decenting OPINION of the company's financial or security or operational position. The company can say "We are going bankrupt." and the auditor will say "I think they are right!"
operating with sufficient effectiveness to provide reasonable assurance
The key words that you will find in almost all audit work is "sufficient effectiveness" and "reasonable assurance". Which is complete true in this situation. Facebook doesn't have policies that give your data out to anyone. They don't violate their policies by doing such. A partner did really go above and beyond what they should have. Facebook failed to regulate such partner but may have had reasonable measures to prevent abuse.
Also, keep in mind that auditors are not here to catch the client in lies, nor catch collusion between people (reportee buys a car, mgr approves, they sell & split profits).
Basically the article is "Auditors did their job but it wasn't enough to prevent this."
So it doesn't look to me like the auditors weren't doing their job, it looks like they did their job, helped uncover what happened, and were still able to give Facebook the thumbs up because they had already fixed the problem months before the audit began.
This is the same PWC that theoretically audited AIG before they went belly up with the financial crash. They also "audited" JPMC and then was fined for basically not doing their job. Seriously, PWC is who you hire when you want to report results without actually doing an audit. https://en.wikipedia.org/wiki/...
Those of us old enough remember the Arthur Andersen debacle only too well. The modus operandi is always the same: the companies carrying out the audit, usually requested by the companies being audited, simply do like the proverbial $25 whore.
Do none of these NYTimes twats know the word "scraping"? They seem Hell bent on trying to make what occurred appear like some l33t hacking operation.
-==- Buy a Mac and leave me alone!
If you've hired a "Big Accounting Firm", you've already failed. Alll those sleazeballs that advertise on the Sunday political shows? Do not hire them. Not ever. For anything. People who know, don't hire BDO. Or PWC, or any of the other "Big 4" Sleaze Firms.
It shows Facebook doing business as usual. They knew about this in 2012 and did not care.
It didn't audit as a "leak" because it WASN'T A LEAK?
This was the facebook API working essentially as intended. To a malign purpose (ie helping Trump) and to a degree in excess of what the researcher was expected to pull, but this was in no sense someone 'hacking' fb's systems to get information that wasn't intended to be collected somehow.
-Styopa