Oral evidence: Fake News, HC 363

Oral evidence, 26 April 2018.

Witness

Mike Schroepfer.

Chair

Good morning and welcome to this further session of the Digital, Culture, Media and Sport Select Committee on our inquiry into disinformation and fake news. We are very pleased to welcome Mike Schroepfer to give evidence to the Committee today. This follows evidence that we took from Facebook in Washington in February but there has been quite a lot of significant developments since then that have given cause for the Committee to consider other questions we want to put to the company, so we are grateful to have the opportunity to do that today. There is no time limit on this session so I cannot say exactly what time we will finish. I do propose that we will take a short 15-minute break at 1.00 pm if we are still running at that point and then resume shortly after that. Mr Schroepfer, if I could start the questions. How much money do you think you will spend on your next car?

Mike Schroepfer

I am sorry, sir, can you repeat the question? I didn’t hear it.

Chair

How much money do you think you will spend on your next car?

Mike Schroepfer

I don’t know.

Chair

Okay. What is the rough square footage of your home?

Mike Schroepfer

I don’t know that off the top of my head either.

Chair

Okay, but Facebook gathers that information about you as a Facebook user, as it does from its other users too.

Mike Schroepfer

I doubt Facebook knows the square footage of my home or how much I am going to spend on my next car.

Chair

But those are categories of user information that Facebook gathers data points on, based on your use of Facebook and the way you use the internet, the other sites you visit.

Mike Schroepfer

I want to clarify one thing, Mr Chairman. First of all, may I just say two sentences to introduce—

Chair

We will go straight into the questions, if that is okay.

Mike Schroepfer

Of course.

Chair

Just for the benefit of the people in the room as well, we have received your written statement, which we are grateful for, and the Committee has published that now. It is available online for everybody who wants to see it although, having read the statement, I am pretty sure we will cover off a lot of the subject matter as we go through the session.

Mike Schroepfer

Great.

Chair

Facebook gathers that information. Those are categories of information that Facebook gathers about Facebook users: how much money you spent on your car or are likely to spend on your next car; how big your home is. Facebook may have a good idea of the answers to those questions even though you were not able to answer them. Why does Facebook gather that data about its users?

Mike Schroepfer

I want to clarify one thing. I have looked recently at my ads preferences, which is a feature on Facebook that any one of you or your constituents can use right now to look at the interests that we have understood that you have. That is what we allow advertisers to find and advertise against. In my interests there was nothing about my home or the purchase price of my car or anything even close to that level of detailed information. It said things like I have a liking for coffee, that there are certain events and other things I am interested in; I am interested in new technology; I am interested in travel; I like cats. These are all things that you would find in your interest category. They are things that our advertisers can then advertise again. The key thing is if you do not like those categories, you can change them or delete them if you so choose at any time in the ad preferences. That is the basic way it works with the advertisers.

Chair

But the ad preferences is based on Facebook’s analysis of the things it thinks you are interested in. That would be correct, wouldn’t it? You may not be in the market for buying a new car, so there might not be very much information about that, but if you are interested in coffee there will be.

Mike Schroepfer

The basis of our service, the thing we provide, is a way for us to provide personalised experiences. Setting aside ads for a second, when I log into Facebook the thing that I get is a personalised news feed. This is updates mostly from my friends but possibly from pages I follow or other things. The whole purpose is to provide the information that is most relevant to me. The feedback we get from people over and over again is that when they find things on Facebook that they are not interested in or are not relevant to them, that is the worst form of experience. The best way to provide them relevant information is to have an idea of the things they are interested in so that we can provide that information for them. As I said, it is a key principle of ours that we are overt with what that information is, those interests, and allow you to control it if you want to change it or delete those things.

Chair

As well as people’s consumer preferences, Facebook seeks to gather information about an individual’s political interests and their likelihood to engage in political activity. That is correct, isn’t it?

Mike Schroepfer

There is a wide of variety of interests that people can participate in on Facebook and politics is one of them.

Chair

Yes, exactly. If in my ad preferences I said that I did not want to receive political advertising, could you guarantee that I wouldn’t?

Mike Schroepfer

The way it works is you can decide which interests advertisers would want to use in order to find people who are interested in those topics. Just like there is no way for me to prevent a political advertisement coming on my TV or showing up in a newspaper that I might pick up, even if I have said that I am not interested in politics, for example, political advertisers may choose to try to advertise to everyone in the United States at which point I may see one of those advertisements. We try to use the interests to help advertisers find their audience but there may be places where those advertisers are trying to reach a broad audience even if I have not declared any interest in what they are looking for.

Chair

If I expressly said I do not want to see political advertising, what you are saying is that you could not guarantee I would not see political advertising in my news feed?

Mike Schroepfer

Like most forms of advertising, if there are advertisers who want to reach all people, it is hard to say, “No, you can’t reach that particular person”.

Chair

I might buy The Times newspaper and there might be an advert in that. I can’t control what the advertising is. I might generally expect the advertising is relevant to me as a reader of that paper but I can’t control it. Isn’t that very different though from your own personal news feed on Facebook where you cannot block a certain category of advertising from reaching you?

Mike Schroepfer

I want to clarify one thing. My humble apologies, I forgot one important thing, which is I was referring to the ads preferences that describe the interests that advertisers can use to find you as an audience. There is another feature in the product, which is if you see any advertisement and decide that you don’t like it, there is a control to say, “I don’t want to see this advertisement” or “I don’t want to see anything from this advertiser again”. In the US if one of the political parties is advertising to me, I could decide to mute all ads from that particular party, which is a feature you absolutely do not have on a newspaper or television. By doing that and hiding pages and other things, you can control the sorts of ad you would see, even if they were broad-based trying to reach all of the UK or the US.

Chair

One of the difficulties there, and this is one of the things that we have been looking at in this inquiry, is that political advertising does not necessarily come from registered political parties. It can come from multiple different entities using different pages on Facebook to base their advertising on. If you can’t turn off political advertising—you said you can’t—even if you block an individual advertiser, it does not mean to say you will not get something very similar from a different entity. You have to be consistently blocking those people. That would be the case, wouldn’t it?

Mike Schroepfer

This is one of the places where we are doing a lot of work. As we said in my written statement, we are showing ads transparency here in the UK that will let me see all the other ads from that advertiser. Specific to your question of political ads, we are going to mark all of the political ads prior to the 2019 elections here in the UK. We are going to provide a searchable archive of all of those ads and explain who paid for them and provide a lot more transparency for people who want to understand this. I understand the concerns about giving people control over political advertising. It is an important issue that we are working on.

Chair

I think we have established that people do not have control over political advertising to the extent that they can stop receiving it. We have certainly established that. If I am an advertiser wishing to target a political audience on Facebook, that is based on their metadata—that is right, isn’t it—the data trail that that person has created through using the platform? Is that correct?

Mike Schroepfer

Again, I want to clarify one thing. You can mute ads from advertisers on Facebook, which is a feature you do not typically have on most other media.

Chair

I think we have covered that point. Political advertising can be based partly on people’s metadata trail from Facebook itself. You would be looking at what someone is interested in on Facebook, what they do, and from that surmising that person might be receptive to receiving political advertising. Is that correct?

Mike Schroepfer

We build a list of interests to try to understand what people are interested in.

Chair

Yes, I know, but we will stick to politics. Politics is one of those interests; I think we have established that. My activity on Facebook, my metadata from Facebook can be used to put me in a category where I might receive political advertising from an organisation. Would that be correct?

Mike Schroepfer

Let me give you an example of interests that people might use for political advertising. One of the key ways that we understand interests is that there are pages on Facebook. These are places where you obtain information from public entities and if you like or follow that page we will use that as a signal that you are interested in that category of topics. If I liked a political issue about immigration or something else, that possibly could be used as a signal to understand that people who are interested in that category of things might want to receive advertising on it.

Chair

But it would be more than likes, wouldn’t it? It could be posts I have put on Facebook about political issues?

Mike Schroepfer

We don’t scan your posts for advertising data.

Chair

That would not be part of my metadata profile on Facebook?

Mike Schroepfer

I think the easiest way to do this is on a very individual level look at your ad preferences and you can see exactly what we have computed for you as your set of ad preferences. If you or any of your constituents want to look at those you can see—

Chair

I am talking about you rather than me, in a way. I am talking about what the company does rather than what my personal ad preferences are. You track Facebook IDs of users as they visit other sites that are off Facebook. That could also include political websites I have visited that could be part of my data profile on Facebook. Would that be correct?

Mike Schroepfer

The way this works is that any website that wants to include functionality from Facebook or any number of other folks can choose to include features like our “like” button, for example, or “share” button that would allow you to like or share that information. When I visit that page, we would get a log of that visit on to our servers. As an example, on your website, when I looked at my news about my testimony this morning, you have this sort of third-party information from six different companies—Google, LinkedIn, Twitter, Hotjar, Pingdom and Facebook—all on that site and so when a user visits that site their browser will send a cookie, a piece of information, to each one of those third parties.

Chair

In general, not just thinking of political advertising or political websites, what proportion of websites do you think have Facebook tracking software on them?

Mike Schroepfer

I do not have a number for the proportion of the sites that have decided to include some of our software, given how large the internet is. I don’t know.

Chair

You are probably best placed to give an educated guess. What do you think that would be?

Mike Schroepfer

I am an engineer, so I don’t like to speculate on things that I have not studied. I honestly don’t know the proportion offhand.

Chair

A half, a third?

Mike Schroepfer

I would suspect much less.

Chair

Much less—10%?

Mike Schroepfer

Again, I am guessing at a number, which I don’t like to do.

Chair

I wonder if you could give us a range, that was all. I am not going to hold you to a number but if you could give us a range. It is quite important to your business. I would have thought it is the sort of thing that someone in your position would know.

Mike Schroepfer

It is not a statistic I have tracked since I can remember working there.

Chair

Facebook can gather data about people’s political preferences and opinions, based on their metadata from the site itself and from tracking the way they visit other sites. You hold that data and that can be of benefit to people who wish to advertise through Facebook. Before we even get to the GDPR rules, given that the current UK data protection rules put very strict restrictions on people holding political data, private companies holding political data, do you think that what Facebook does now is legal?

Mike Schroepfer

It is my understanding that what we do is clearly legal. I want to be clear on one thing, especially as part of the GDPR. There are sensitive categories of information that you are not allowed to use and target against and I believe political opinions is one of those. That is actually part of our GDPR set of screens that we are showing to every single European user to let them be aware of that and choose whether they want to opt into that or use that or not. I believe there has to be clear consent to do that.

Chair

Are you satisfied at the moment that everyone on Facebook that is being targeted for political advertising in Europe—or in the UK rather, to be more specific—has given their express consent that they wish to receive it?

Mike Schroepfer

It is my understanding that we are compliant with the law.

Chair

If I have not only given my consent not to receive, I have actually told you I do not want to receive it and yet I still receive it, do you feel that is legal?

Mike Schroepfer

Even if you go into the ads preferences and delete all the information in there and so the only thing the advertiser is using to find you is to say that you are a person in the UK and I want to contact you, just like a TV or a newspaper ad would, I believe that is legal.

Chair

You met with the UK Information Commissioner this week, didn’t you?

Mike Schroepfer

We met with her office on Tuesday, that is correct.

Chair

Did she raise any concerns with you about whether the way Facebook holds political data might be in breach of UK law?

Mike Schroepfer

No. We talked extensively about the ongoing investigation with Cambridge Analytica and others and we provided her staff with a variety of details about that.

Chair

If a political advertiser wishes to upload to a custom audience to Facebook to help target their audience, do you ask them or does Facebook have a way of checking or asking them to confirm that the people within that target audience have given their consent to receive political advertising?

Mike Schroepfer

It is a requirement that anyone who is advertising with us using information they have, like a mailing list that they have got through some other means, has legal rights to have that data. It is a certification we ask that the advertisers do with us that the data they are using, the information, for example an e-mail list, is something that they have acquired legally.

Chair

The onus is on them to make sure that the data is correct and that the consents have been given?

Mike Schroepfer

Yes, because the important thing is that we do not actually see the data. When an advertiser decides to use, for example, e-mail, they have a mailing list for people who visited my shop, they have a list of e-mail addresses, we do not get the e-mails in raw form so I do not know what the e-mails are. We get it in a thing called hashed, which means that we can’t reverse it. If I had never seen that e-mail before, I can’t store it. We throw the data away afterwards because we are not responsible for storing that data. We can’t even see the data so we could not validate it if we wanted to and so it is a requirement that the person who has acquired that mailing list confirms that they have the rights to that information.

Chair

If the same advertiser who has a custom audience asks Facebook to create a lookalike audience as well, could you guarantee that no one who had opted out of political advertising would be included in that lookalike audience?

Mike Schroepfer

The controls we have for ads are to allow you to decide the set of interests that you would like us to use in order to have advertisers reach you. You can decide that you would like to no longer receive advertisements from a particular advertiser. If I had chosen that I did not want to receive ads from this advertiser, I would not get this ad even if I had given them my e-mail address through some other means.

Chair

You said at the beginning that even if you had opted out of political advertising you could still receive it. What I am asking you is if an advertiser came along and said, “I want a Facebook lookalike audience for this custom audience I have created” could you guarantee that someone who had opted out of political advertising would not be included in the lookalike audience because they have already told you they do not want to receive that advertising?

Mike Schroepfer

I want to be clear and my humble apologies if I—these are complicated topics and I am sure I was not clear on them. There is not an opt-out for political advertising. What you do have is a set of controls over what interests you would like to use and you can remove all of the interests if that is what you want. It is basic information; age, location, gender is the baseline information that you have as information on Facebook. In that case if an advertiser said, “I would like to reach all folks in the United Kingdom”, regardless of whether it is a product or a political ad, you would be a candidate for that ad unless you had chosen to say, “I don’t want ads from this advertiser anymore because I don’t like it”.

Chair

There is the individual advertiser and you don’t like the ad, but what you are saying is there is not an opt-out for categories of advertising. You can remove your preferences, which might make it less likely you would receive it, but there is not an opt-out for political advertising. That is what you said, isn’t it?

Mike Schroepfer

There is no specific category-by-category opt-outs. There is a way to control the interests we use. I think it would make it very unlikely that unless the advertiser was trying to reach a very broad audience, for example every citizen in the UK, that you would see that sort of advertising. It is very important that when I mute an ad from that advertiser you no longer see any ads from that advertiser. These are controls that don’t exist on most platforms and certainly not on TV and print. I can also tell Facebook that I just don’t like this ad and we will use that as a signal in our systems to say, “Ads like this aren’t interesting to this person” and we will show fewer of those.

Chair

A lot of work has been put on the user there. What we are concerned about is that in some of the political campaigns it is not like saying, “I am going to block ads from the Republican Party, from the Democrat Party”. It is thousands and thousands of different pages with thousands and thousands of different messages that people are receiving all the time from multiple different advertisers. That is a pretty weak tool to stop people getting messages they don’t want. What you are saying is that someone can’t even opt out of it. Going back to my earlier question, from what you said as well, even if you had said, “I don’t want to receive political advertising, I have removed that preference from my ad preferences”, Facebook could still sell you through a lookalike audience to a political advertiser. For me, that is the extrapolation of what you said. Is that correct?

Mike Schroepfer

I don’t think so. I think the key thing that we are missing in all of this is limited budgets, even for political advertisers, and they want to spend those budgets really well to reach the audiences that are interesting to them. When I, as a user, take all of these things out, the way the advertiser is most likely to find me is a very broad-based campaign, advertising to all users in the UK. That is going to look more similar to a TV campaign or others that are quite expensive per person because by definition I will reach a bunch of people who are not interested or are not even eligible for this particular issue that I am concerned about. The way our systems work is that we want to provide ads that are most interesting to you, so if there is a broad-based campaign running and there is something that is more local, like a coffee shop around the corner from me, it is much more likely I am going to get that ad than this broad-based campaign because it is much more expensive for that advertiser to deliver that. I agree that there is not one big master control but I can set this set of interests I have. I can tell Facebook, “I don’t like this particular ad”, even though I am not blocking the advertiser, because maybe the content is not good. We will use that to say we are going to show fewer ads like this. Through this set of controls you can dramatically reduce that sort of experience. We are motivated to show you the ads that you want to see, so if you do not want to see the political ads you are not going to click on them. You are going to X them out and say, “I don’t like these ads” and very quickly you are going to get into an actual product experience that has few to none of those ads on the platform. It is not within our incentive to show you things that you don’t like. That is counter to the whole basis of our business.

Chair

Yes, but the concern we have, particularly looking at political messaging and political campaigns—and this is very different from a lot of the consumer advertising you would find on Facebook—is that people are launching highly specified campaigns. They are creating custom audiences based on people’s opinions, their fears. It is based on geographies. It is a tool to target messaging at them and it is augmented by getting lookalike audiences from Facebook to target people with stuff the advertiser thinks they want to see. There is no real protection for a voter against that at all because from what you have said, even if they have opted out of political messaging, they would still receive it and if someone came to you with a custom audience and asked you to create a lookalike audience you would include them in that as well. In very specific political campaigning, this is being used as a really powerful tool to reach people with messaging that they may not want to receive or to try to influence their behaviour.

Mike Schroepfer

I appreciate the line of questioning because political advertising is a really important issue. I want to clarify a few things. Once again, what you are raising is this issue of targeting these small audiences or targeting based on interests and you used the word “fears”. I want to clarify a couple of things. First of all, we think one of the best tools to work on this problem is to give everyone radical transparency on what is happening here. One of the concerns that has been raised is what if an advertiser is targeting just this segment of the audience. That is why in June you will be able to see for any particular advertiser the entire spectrum of ads they are running at this moment in time and who they are advertising them against. We are going further for political ads because we understand how important it is and we are releasing extensive information about those political ads, including who they were trying to reach, how much they have spent, how many times they were viewed—very detailed information about the political campaigns. This is the work we are doing in time prior to the UK election in 2019. The questions you are raising are important and the way to really answer them is for everyone—you don’t have to bring me out here. Anyone who is interested in researching this topic wants to make sure that things are being used appropriately, has the ability to see in real time what is going on and then after the fact if they want to do analysis we can do that through an historical log. The issues you are raising are important and I think getting into the details of how these things are actually working is really critical. I disagree with one point, which is once I remove a bunch of these interests and other things, it is harder for advertisers to target me directly. They have to reach me through some of these broader-based campaigns. That is the basis of these controls. In general what we find when we work with advertisers, both political and not, is messages that people want to receive, that they like, are the ones that work the best. This is not about fears or profiles of people. This is about that in the commercial sector if you send me a tea ad I am not going to click on it because I am a coffee drinker. In the political sector, there may be issues that I am very passionate about and issues that I am not passionate about. Talking about the issues I am passionate about is probably a better way to engage me and that is the thing that the content of the ad and how people engage with that ad is probably the biggest signal in that. If people run ads and people just look at them but don’t engage in any form—they don’t click, they don’t visit a website to buy a product, they don’t visit a coffee shop—those ads are going to be ineffective and expensive.

Chair

As I say, I think there is a big difference between consumer advertising and political advertising, and I think we have seen that from the content. Just looking at the content that was presented to the United States Congress, content that came from ads run by the Internet Research Agency in St Petersburg, a lot of those were fear-based, highly targeted; they are seeking to influence people’s actions and behaviours, making people turn up to fake rallies and demonstrations. This is the reality of how these tools are being used. Transparency is good and what you are suggesting on transparency is helpful but all that means is that the Russians, rather than doing it from an office in St Petersburg, would have to find a different mechanism for running the advertising. The transparency shows you who is doing it but it does not allow you to stop what is happening.

Mike Schroepfer

I agree with you on a few things. The first is I agree with you that political ads are in a different category and this is why we are doing a whole bunch of work very specific to political ads. There is transparency work and others. I agree with you 100% that we need to provide tools to protect against bad ads and tools to help everyone, yourself included, understand how these tools are used. I also want to highlight that what happened in 2016 with the Russian Internet Research Agency, the Russian IRA, is awful. It is a terrible idea that a nation state would be using our products to interfere in the elections of a democratic nation. It is against everything we stand for and the key weapon in that is to find out the actors. The problem here is that they were masquerading as citizens of the US and spreading issues on the site. Being able to identify them and take them down, which we did after the election, and what we are doing now is proactively looking for actors like that on the platform. That is why last month we announced that we had taken down another 270 pages, including an alleged news site based in Russia, because we found detailed technical links between those and removed them from the platform. They can’t post organically or advertise. That is an issue that is of great importance too in the ongoing fight against those sort of adversarial actors. I would agree with you.

Chair

You are quite right that the ads that were found were Russians masquerading as Americans, but not very successfully because they were making payments in roubles to run the advertising, which is in breach of US election law because they were making those payments from Russia. Why didn’t the Facebook ad review team spot that at the time and stop the advertising?

Mike Schroepfer

We were slow to understand the impact of this at the time.

Chair

Yes, about six months after the event or longer, a year after the event.

Mike Schroepfer

I understand and I am way more disappointed in this than you are. I am sorry, I shouldn’t have said that.

Chair

It is a high bar.

Mike Schroepfer

You are right. I am sorry, I shouldn’t have said that. I just want you to know that it is something that we are working very hard on. It is a critical issue and this is why we are taking proactive enforcement against these.

Chair

Did the Internet Research Agency use any particular Facebook targeting tools in their advertising?

Mike Schroepfer

I don’t know specifically what tools they used in the advertising offhand. If it is of interest to you I am sure we can follow up with that information.

Chair

Yes. I think it is quite important. We have been talking about a number of different tools that political advertisers could use. Did the Russians use those same tools? Did they have a custom audience for state-by-state campaigns or did they use lookalike audiences for Facebook as part of their advertising spend?

Mike Schroepfer

Yes. Unfortunately I don’t have that because that is with the US election. I came prepared with information for you on particularly Cambridge Analytica and issues here. I did not come with the figures on what tools the IRA used. If it is important, I will be happy to follow up shortly after the Committee.

Chair

I think it is important to us. We have lots of questions about the other topics we will come on to. These tools could be used across the board. We have been concerned about Russian activity in UK elections, in the referendum, in other elections here. After several times of asking, Facebook did some work looking to identify that, after initially saying they wouldn’t. Facebook also said that is not necessarily a complete survey. The reason the IRA case in regards to the American elections is interesting is that it is the most exposed and we want to understand what happened to make it easier to identify similar activity in the UK as well.

Mike Schroepfer

Absolutely, and we would be happy to follow up offline. I want to make sure you have all the data you need. I want to clarify one thing. We did look several times to understand connections between the Russian IRA and the Brexit referendum in 2016 that you mentioned. We found $1 of spend and this is us looking through all the same means that we have been using to find this information proactively. This is the extent of what we found, which is almost nothing. I would be happy to share that.

Chair

It could have been done in other ways, I think. We don’t know that it happened but if it did happen it was done in a different way. We can say that.

Mike Schroepfer

I can’t prove a negative and the challenge with these things is that we are dealing with adversarial actors. These are paid adversaries in a building who work nine to five, trying to exploit radio, TV, internet, Facebook, all different forms of medium, for whatever their political goals are. I also want to highlight that we have been reacting much more aggressively to this, by both human and technical means, but we treat this as an ongoing issue not something that we have looked at and clarified. There is a day-to-day fight on these things. The key thing here is people trying to create inauthentic identities on Facebook, claiming they are someone other than who they are. To give you a sense of the scale of that problem and the means, while we are in this testimony today it is likely we will be blocking hundreds of thousands of attempts by people around the world to create fake accounts through automated systems. This is literally a day-to-day fight to make sure that people who are trying to abuse the platform are kept off it and to make sure that people use Facebook for what we want it for, which is to share it with our friends.

Chair

I think that is right. That is why I asked the question about what tools the Internet Research Agency might have used because understanding the tools they have used is vital to understanding how you can disrupt that activity and understand it better. You say you don’t know. Are there people at Facebook who would know that? Is that something Facebook knows?

Mike Schroepfer

Yes. If the specific ad campaigns are important, I am happy to provide that information. I just don’t have it in front of me. The biggest weapon we found in this defence is to find the actor, find the account and take it down. If they are running hundreds of ads and we can take down the account, we stop all of those and stop all future ads. Whether they are advertising broad, using lookalikes, using interest, it is to some degree the root cause is identifying the actor, someone who might be IRA rather than a legitimate advertiser. All of our energy is focused on how do we consistently identify people like that on the platform, either at registration time or after, and get them off the platform as quickly as possible. This is one of the reasons I do not have that information because our focus and energy is on keeping those people off our platform.

Chair

In cases like that—and there are similar cases in the UK and we will come on and talk about some of those—would the UK Information Commissioner’s Office have access to the data analytics tools used on Facebook to support targeting to look at whether it breaches the law or how bad actors are doing it?

Mike Schroepfer

As we mentioned before, I visited the office personally this week. We are providing them extensive information, including access to senior personnel. We are doing analytics for them to understand issues related to Cambridge Analytica and others. We are also working with your Election Commission on issues related to the election, providing them all the same information. Any time that they need information for their investigations, we are working our hardest to give it to them.

Chair

I want to ask a couple more questions about the news feed in particular. Do you think there is a case for saying that political advertising should not be in the news feed?

Mike Schroepfer

I will tell you the conversation we had, which is that this is not an issue of revenue for us. Political advertising is a very small, low single-digit percentage of our overall advertising. The decisions here have nothing to do with money or revenue. What we do know is that advertising is a critical way to reach audiences and particularly those who don’t have an established name, who are running for a new office and would like to reach people. The combination of being able to reach them organically via pages and via advertising is a powerful tool of free speech. There is a number of challenges that you have raised and there is a number of things we need to do better. Transparency is the most important so we can see that the bulk of this advertising happening is legitimate advertising from legitimate political actors who are trying to reach their constituents. Saying that we would just cut all of them off for access would probably in many ways do harm to people’s ability to reach their audience and constituents.

Chair

Or you could arrange it differently. When I go on my Gmail account, Google sifts out promotional messaging, messaging from social networks that I am a member of, from my main e-mails. Facebook looked at doing something similar through Explore, putting paid advertising from brands, political organisations in a different feed, not the news feed, and you abandoned that experiment. Why was that?

Mike Schroepfer

What we have found time and time again is experiences that are natural and seamless. The basic experience that people have in Facebook is you launch it and go to your news feed. It is the first thing in the product and it is the way that I am able to keep up with my friends and family. My family lives all over the country and are far away from me, so it is a way for me to share with them what is going on with my little kids on a daily basis. That is the best part of Facebook. As I am scrolling through it I will get updates from friends, primarily, but also from pages that I have shown interest in. Putting the advertisements directly in line rather than the disruptive sort of stop your experience, put it over here or make me go to another tab to find those things is something that is a better overall consumer experience.

Chair

You have made a lot of money out of running ads in the news feed as a company, haven’t you? When that change came in it did a lot to grow advertising revenue on Facebook.

Mike Schroepfer

This is the basis of when we moved to the mobile platform, mobile is a constrained device so there is not a lot of—

Chair

Only so many buttons you can have at the bottom.

Mike Schroepfer

The key thing here is when you are doing advertising in mobile it can be very disruptive—I am sure you have used an application that takes over your whole screen and you are hunting around looking for the X to get this thing out of my way before I get to the thing I am actually trying to do; that drives everyone sort of crazy—or you can integrate the advertising into the experience. I am never stopped or disrupted. If I don’t like this ad, just a flick of the finger and it has gone. It is scrolled right past me. Just like the story from my friend who posted the third cat video of the day, that goes right past me on the news feed. That detailed integrated experience, where it is not somewhere else and it is not disruptive, is the thing that we have found is a better consumer experience. You are right, it has been good for our business because we have found when we build things that people like and work well our interests are aligned; it is also generally good for our business.

Chair

From what I have read about, the research that Facebook did on the pilots of Explore was that users did not like the separation, but it could just be that they were not engaging with ads as much because they found they did not need them. They did not miss them from the news feed. They were happy with the content they got from their friends and family and colleagues, the things that they are directly interested in, and they were not necessarily that bothered about receiving pushed promotional advertising.

Mike Schroepfer

What we found is that the integrated news feed product is the basis of the products we have built. If you look at many other products that are like ours, they are very similar. I think they have come to similar conclusions about having an integrated place that I launch and scroll and I do not have to think much about navigating around to find all these different things, and I can get updates. That is the basic power of the product. Instead of sifting through a big inbox, I can, with a simple scroll on my cell phone, get quick updates on my brother and my sister and my mum who are all in different places than I am. That ability to connect with people easily is the basis of the product.

Chair

Facebook, and Mark Zuckerberg in particular, seem to have gone though a Damascene conversion on the issue of fake news over the last few months, from that it was not a problem to now recognising that it is a problem. The reason I am going to ask you about this is that you said that Facebook is the network that connects people around the world, with huge audiences and huge numbers. The combination of the news feed plus targeted advertising has been probably the catalyst for fake news organisations, be they the Russians or people creating click rate spam news or bad actors seeking to influence the outcome of elections. This is the pipe through which the fake news comes and there does not seem to be that much you can do to control it, other than asking users to block out things they do not want to see.

Mike Schroepfer

I disagree that there is not much we can do. We are a product that is based on free expression. The basis of the product is I launch it and I can have a box or I can type what I want, I can share a link from any news article or any website I want and I share it with my friends. That is the meat and potatoes of what our product is and we believe very strongly that the individual’s right to share what they want is critical to free expression. The evolution that has happened over time is we have realised that, as I think you are asking, that same platform can be abused by bad actors. It can be a nation state; it can be a spammer who is just trying to make money; it can be someone who is trying to spread spam or malware. When I am not here talking to you, my primary job back home is to build our technological systems and to do things like build capabilities that are state of the art around the world and have been immensely successful in reducing the sort of content that is not welcome on Facebook. If we had time, I would love to go into lots of detail on the things we are doing there. I agree that it is a problem and it is something that we are making good progress on but have a lot of work to do.

Chair

You have probably been aware since you have been in the UK of the issues raised by Martin Lewis about the use of his image and profile by fraudsters seeking to scam people into investing in schemes that they falsely claim he has endorsed. Have you seen anything on that?

Mike Schroepfer

I have seen news report on it, yes.

Chair

He makes two points I want to ask you about, which I think are quite important. First, it is often beholden on him as an individual to complain to Facebook about the adverts but if they are not being served to him, certainly if they are being posted as dark ads, how can someone complain about an ad that they can’t see?

Mike Schroepfer

You have raised a couple of issues there and I think they are critical, so I am going to take each of them. The first is the core issue of fraudulent ads is a problem and it is not welcome on our platform, whether it is this case or others. We have both manual and automated systems to try to detect these systems, but these are people who are financially motivated to try to evade whatever systems we have in place. We use things to classify these ads in a certain way. They will abbreviate the name, so instead of Martin Lewis they will say M Lewis or they will misspell the name slightly such that even when we put in technical measures they will work around it. They keep running ads and they will get blocked and blocked until they figure out they can get one. This is a place where taking down the actor is often the most important thing. In the case of Mr Lewis, he reported in the order of 50 ads to us. As a result of that we did a more extensive investigation using our technical tools, found thousands of other ads that were a problem, and took all of those down proactively. More importantly, we found the dozens of actors, people who are fraudulently advertising on the platform and took them off the platform. That obviously takes everything they have advertised and prevents them from advertising in the future. I think that is the important thing. The second issue you raised is also an important one, again about transparency: how does he see these things? This is where in June you will basically be able to see every running ad on the platform. I want to highlight that I think we are trying to catch all of these things proactively. I do not want the onus to be put on people to go and find these things and people reporting. We are trying to get to a mode over time, particularly with technical systems, that can catch this stuff upfront. We want to get to a mode where people reporting bad content of any kind is the sort of defence of last resort and that the vast majority of this stuff is caught upfront by automated systems. I know that is true of authentic accounts, bad content on the platform; 90%-plus of nudity on the platform is flagged and removed by automated systems before any human ever sees it, which was not true five years because we did not have the technical capability. That is the future that I am personally spending my time trying to get us to so that people like Mr Lewis don’t have to spend time doing it because our systems do it for him.

Chair

But Mr Lewis said he does not advertise himself. He does not use any adverts that have his image in. Why doesn’t Facebook use the facial recognition technology it already has to identify ads posted by fraudsters using his image to prevent them going up?

Mike Schroepfer

The first thing is that we have not had facial recognition enabled in the EU until just recently. It was not even a feature we could offer to our users, so we are just in the process of rolling that out, so we need to do that first to make sure we can offer that feature for consumers. We are investigating ways to do that. It is challenging to do technically at scale and it is one of the things I am hopeful for in the future that would catch more of these things automatically. Usually what we end up doing is a series of different features would figure out that these ads are bad, so it is not the picture, it is the wording. We will catch classes of ads and say we are pretty sure this is a financial ads and maybe financial ads we should take a little bit more scrutiny on upfront because there is the risk for fraud. This is why, for example, we took a hard look at the hype going around cryptocurrencies and decided that when we started looking at the ads being run there the vast majority of those were not good ads. We just banned the entire category and said, “You can’t run cryptocurrency ads because we think the likely harm to the consumer is high there”. When we can do things like that, combined with catching the actors—because this is ultimately a person who is running a fraudulent ad and get them off the platform—that is the really effective long-term defence of these things.

Chair

You can run facial recognition at scale, clearly, as a business?

Mike Schroepfer

I am happy to dive into the details on this. I am not sure we have the systems yet to be able to do that, running this across 2 billion people for every single ad that is uploaded, to figure out—

Chair

But you are running facial recognition across 2 billion users for their pictures and things. The idea is that you have facial recognition software and you could automatically tag on their pictures unless they have opted out of that.

Mike Schroepfer

The challenge here, and forgive me if I go into some detail, is that when any of these systems happen and you are trying to match, there is this ad running, is this particular—does it match, the larger the search space you use if you are looking across a large set of people, the more likely you will have a false positive, that two people tend to look the same and you will not be able to make automated decisions that said this is for sure this person. This is why I say that it may be one of the tools but usually what ends up happening is a portfolio of tools. Maybe it is something about the image, maybe the fact that it has Lewis in the name, maybe the fact that it is a financial ad, wording that is consistent with financial ads, and we tend to use a basket of features in this in order to detect these things. You are right, the thrust of this is that we are working hard to provide more technical means that move this from reactive to proactive, which means we catch this stuff at creation time and it does not run on the platform and harm a consumer, which is the most important thing, and it does not put work on anyone else to go and chase these things down.

Chair

My concern over this section we have just discussed is that a lot of the tools do seem to work for the advertiser more than work for the consumer.

Simon Hart

What is Facebook’s definition of a political ad and how much money are you spending on this project as a percentage of your annual turnover?

Mike Schroepfer

This project to provide the archive of political and social ads? Is that what you are referring to?

Simon Hart

The wider description of what you are doing to tackle this problem. Presumably there is a budget and we wondered what it was.

Mike Schroepfer

On all of these issues, I don’t know the specific budget. Let me explain why I don’t, because I don’t review dollar figure budgets on a regular basis. We talk about priorities that the teams are working on. I can’t remember a meeting in recent memory with our advertising team that was not about protecting ads transparency or political advertisements. The whole focus of that team for quite a while now, the senior leadership team in particular, has been on these issues.

Simon Hart

Okay, and the definition of a political ad?

Mike Schroepfer

There are two categories of this. There is a lot of detail here that I want to make sure I don’t get wrong in this proceeding, so if we want detailed information let’s follow up in writing. The gist of this is that there are ads run by a candidate, which I think everyone can understand, a political ad run by a candidate for a campaign. The more challenging part of this is issues of political interest during a campaign. I think that honestly the really hard part of this is defining exactly what the scope is of those issues. We have been working with third parties and others to define more public lists of interest in these things and this is the area that if you are interested in getting into the details I would be happy to provide more details on, because it is work in progress on that. It would be easier for us to implement just the first but we have said that as hard as this is, we think it is important, because a lot of the issues the Chairman has raised are not about a candidate running an ad. It is about broader issue ads. Whatever we do we have to figure out a way to correctly encompass that.

Jo Stevens

Mr Schroepfer, I am going to ask you some questions about Cambridge Analytica and SCL and Facebook and GSR. You will know that we had Dr Aleksandr Kogan give evidence to us on Tuesday. Did Facebook read the GSR app’s terms and conditions?

Mike Schroepfer

We require that people have terms and conditions and we have an automated check to make sure they are there. At the time, this was in 2014 or maybe earlier, we didn’t read all of the terms and conditions.

Jo Stevens

You didn’t read their terms and conditions?

Mike Schroepfer

No.

Jo Stevens

Do you ever read any terms and conditions of developers who puts apps on Facebook?

Mike Schroepfer

We made a big change. This happened prior to the platform changes we announced in 2014 and the key changes we made there were twofold. One was to significantly reduce developers’ access to data, for example friends’ data that they could access. The second was to move to a proactive review process where if an app developer wanted access to additional data they would have to go to a review with our teams. Primarily what they are doing is looking at the app, looking at the developer, trying to understand what data that developer is asking for. If I am building a music application it makes sense that I may want to get my likes so I can understand what music I may like but getting my birthday may not be relevant. We would want to make sure what those apps are asking and there is a set of principles we have, the minimum set of data needed to provide the functionality for the consumer. That process is—

Jo Stevens

Prior to you putting those measures in place, you did not ever read terms and conditions of any developer’s apps that were put on Facebook; is that right?

Mike Schroepfer

I can’t say we never read them. I think it was not a requirement that we read them.

Jo Stevens

What was the date when Facebook found out that the data from the GSR app was being used in contravention of terms and conditions? Was that before The Guardian report in 2015 or after?

Mike Schroepfer

My understanding is we found out about this in December 2015 from The Guardian report and that is when we initiated our proceedings to contact all the parties and make sure that the data was deleted.

Jo Stevens

You found out from The Guardian report?

Mike Schroepfer

That is my understanding.

Jo Stevens

Do you rely on the press to tell you when there has been compromised data?

Mike Schroepfer

No, not at all. That certainly happened in this case. In I believe it was 2011 we had started a specific program to allow people to report any issues they may have with a developer and we would follow up and do that. We had an enforcement team that would regularly be following up on these things. When we made this platform change in 2014 we would regularly be rejecting applications that wanted to be on the platform. I wish we had found this ourselves but it is certainly not the only—we definitely do find these things through other means.

Jo Stevens

You mentioned having an enforcement team in 2011. How many developers did you take any enforcement action against between 2011 and 2014?

Mike Schroepfer

I don’t have that data in front of me.

Jo Stevens

Can you send it to us afterwards?

Mike Schroepfer

We will get you the information, yes.

Jo Stevens

Thank you very much. Why did Facebook threaten to sue The Guardian just last month when they had given you advance warning about the story that they were going to publish, when previously you had acted on information that The Guardian had given to you to show that GSR had compromised Facebook users’ data?

Mike Schroepfer

It is my understanding that we were sending them a letter to correct some facts they had in the article and it is a fairly standard legal letter to make sure that we had the facts right in the article as it was published.

Jo Stevens

Why not just ask them to correct the facts? Why threaten to sue them?

Mike Schroepfer

My understanding—I was not involved in the specific issue—is that we do talk to them but we do also, in many cases in the UK, send a letter specifying what it is we want corrected in a story to make sure that the facts are accurate. That is what we have done.

Jo Stevens

With an accompanying threat of litigation?

Mike Schroepfer

The broader issue is that bringing these issues to light is critical. The implication that we are trying to make these things be hidden I think is a fair question and it is not what we intend to do. This is one of the reasons, for example, we initiated a data bounty program just recently where we would pay people money if they told us about data breaches or data misuse of any form so that we can better find these things. We have been doing a similar process with bug bounty programs. I would always prefer that we stop these things in advance or catch them ourselves but the first goal is to protect people so if there is data out there that we do not know about we can’t protect it, so we want people to find it.

Jo Stevens

We are trying to protect freedom of speech here and freedom of speech through accurate newspaper reporting. I am sure you can understand why we think it is bullying to threaten a newspaper with litigation when they are actually pointing out to you faults with your own organisation or its governance.

Mike Schroepfer

It is my understanding that we did not threaten to sue, but the broader point is I agree with you that the media is absolutely critical to raise these issues and they and others have raised critical issues. Through bug bounty, through the journalism, through internal systems we need to find these issues. As I talked about before with ads, we think transparency on all these issues is the most important tool in the long run to make sure that everyone agrees that these systems are working in the ways they want. I agree with you that we want independent and vocal journalism.

Jo Stevens

Let’s go back to December 2015 when you find out via The Guardian that GSR has compromised Facebook users’ data. What did you do at that point?

Mike Schroepfer

We contacted the parties involved, Mr Kogan, Cambridge Analytica and others, and I believe we went through a process of certifying through them that the data either did not exist or was deleted and had signed-off agreement from them that that was the case.

Jo Stevens

Who were the others that you mentioned? You mentioned Kogan, Cambridge Analytica and others.

Mike Schroepfer

There was Mr Kogan, Cambridge Analytica and I believe there was two other parties involved. I am happy to provide that in private session. I do not know if that information is on public record yet and I know that there is an ongoing—

Jo Stevens

I would like you to answer the question, please. Who did you contact? Who were the two others?

Mike Schroepfer

Immediately after these proceedings I am happy to give you that information. The only reasons I am being careful is I know that your Information Commissioner has an active investigation ongoing and I do not know if the names of all these parties are out there. I want to be deferential to their investigation, but I will provide you the information immediately after in a private non-public session.

Chair

There is no reason in law why you cannot provide that information now. It is not sub judice. There are no charges being brought by the Information Commissioner. You are free to say that now.

Mike Schroepfer

Okay. My understanding is there was a researcher at the University of Toronto and it was Mr Wylie and his company.

Jo Stevens

How did you ensure that the data had been removed or deleted?

Mike Schroepfer

We retained outside counsel and had legal certification that that data was deleted.

Jo Stevens

That was not just data. Was that derivatives? Did it cover everything? Did you check that everything had been deleted?

Mike Schroepfer

They were required to certify that all of the data and its derivatives were deleted.

Jo Stevens

You took them at their word?

Mike Schroepfer

It was a legal certification so, yes.

Jo Stevens

Does Facebook plan to take legal action against Aleksandr Kogan or against Cambridge Analytica?

Mike Schroepfer

I think the key concern that brought all of this to light is recent events where there are the allegations that Cambridge Analytica still had this data and that is the thing that brought all this to light. We had started an investigation and have deferred to your Information Commissioner who is doing an ongoing investigation of them. We want to wait and defer to theirs before we understand what legal action we are going to take against any of the parties.

Jo Stevens

You have not ruled it out?

Mike Schroepfer

We want to basically get to the heart of the matter first before we talk legal issues. Understanding the facts of the situation is the key thing here.

Jo Stevens

Does the non-disclosure agreement that Facebook has signed with Aleksandr Kogan, which he told us about on Tuesday, prevent you or him from taking legal action in the future?

Mike Schroepfer

I am not actually sure. I have not reviewed that document in detail so I am not sure.

Jo Stevens

Aleksandr Kogan gave us evidence on Tuesday that he had been made to sign a non-disclosure agreement with Facebook and he would not answer our questions because he is under duty under that disclosure agreement. You don’t know anything about the agreement?

Mike Schroepfer

I will tell you that that was a confidentiality clause that was part of the legal agreement we had certifying that this data was deleted and removed. There is a standard confidentiality clause in it, like in any other contract. We contacted Mr Kogan’s lawyers. It was a surprise to me on Tuesday that he felt he could not talk about this, so we clarified yesterday with his legal team that we are happy for him to discuss all the matters involved here.

Jo Stevens

If he is happy, I am sure you are happy to discuss it as well. What was the date of the agreement?

Mike Schroepfer

I don’t know the exact date of the agreement. I am happy to talk with my legal team and we can provide the legal agreement in its entirety to you after this proceeding.

Jo Stevens

I think you are going to be here for quite a while, Mr Schroepfer, so perhaps your colleagues behind you can find out and give you the information so that you can tell us during the hearing today when it was signed, why it was necessary, who was party to the agreement and whether any payment was made to Dr Kogan in order for him to sign the gagging clause, the non-disclosure clause that you have referred to. Perhaps your colleagues could find that out. Thank you.

Chair

Just on that point, you rightly asked for Facebook to provide that information to us. From what you said, Mr Schroepfer, hearing what you said in this forum, if Aleksandr Kogan wished to provide that information to us there would be no restriction on him doing so. Is that correct?

Mike Schroepfer

I want to make two things very crystal clear. I am happy to provide the documents in their entirety to this Committee immediately after these proceedings, and I want to be clear that we contacted Mr Kogan yesterday and I am saying to you today that any thought that there is any confidentiality, we waive any concerns of that. We want to make sure the truth of this matter comes out and Mr Kogan feels free to discuss it. I think he has been very forthright in what he said and we want to make sure that that information gets to you and others.

Jo Stevens

When you realised about this data compromise and the unlawful use here in the UK of that data, did you inform the Information Commissioner’s Office here in the UK?

Mike Schroepfer

I don’t believe we did.

Jo Stevens

Why not?

Mike Schroepfer

At the time we thought that the matter was resolved. We had received legal certification from all the parties involved that the data was not there again. The issue at hand was a developer had used our platform, collected some data and then resold that data to a third party. That reselling of the data was the issue. We had thought that the matter was resolved.

Jo Stevens

Facebook felt they had no responsibility to report to the Information Commissioner that it was the fault of the developer. This is the developer that Facebook had not read the terms and conditions of its app that went on to Facebook in the first place, is that right?

Mike Schroepfer

We did not inform the Commissioner at the time.

Jo Stevens

Do you intend to take any legal action against the University of Cambridge?

Mike Schroepfer

I am not aware of any pending legal action on any of these matters. The first priority for us is to make sure all the facts of the matter get written out. This is again why I want to defer to your Information Commissioner, the Electoral Commission and others. We want to give them all the data they have. We want to not get in the way of those investigations, so that they can do this. This is why, for example, we had begun an audit with Cambridge Analytica but stood down at the request of your commissioner so they could take precedence. I am not aware of any current plans to do legal proceedings. I think our priority right now is to understand what has happened and to co-operate fully with the Information Commissioner and others.

Jo Stevens

Were you aware that there were other employees at the University of Cambridge building apps that were similar to the ones built by Aleksandr Kogan?

Mike Schroepfer

I do not think so.

Jo Stevens

You mentioned that you have contacted all the Facebook users whose data was compromised, UK Facebook users.

Mike Schroepfer

Yes.

Jo Stevens

When did that happen?

Mike Schroepfer

That has happened over the last few weeks. This is a control that has showed up in the very front of the product at the top of the newsfeed for every single one of the people affected by this across the world, including everyone in the UK who was affected.

Jo Stevens

It is two and a half years since the breach occurred and you are only now telling the affected users. Why the delay?

Mike Schroepfer

As Mark has said himself, in retrospect it was a mistake we did not inform people at the time. This is why we are informing people now and committing to do so in the future.

Jo Stevens

Why did you not inform them at the time? What was the decision process, who made that decision?

Mike Schroepfer

I do not know who made that decision.

Jo Stevens

You are the Chief Technology Officer, Mr Schroepfer, why don’t you know?

Mike Schroepfer

I understand. I was not involved in the discussion. I do not know what happened. I am guessing the key thing at the time is the teams were focused on making sure people’s data was safe and deleted and not used. That was the priority at the time.

Jo Stevens

It was a bit late for that, wasn’t it? Don’t you think? Going on to the ICO and the investigation into Cambridge Analytica, why did Facebook choose Stroz Friedberg as the auditor for Cambridge Analytica?

Mike Schroepfer

I do not know the specific selection process for that particular forensic auditor.

Jo Stevens

Who made the decision?

Mike Schroepfer

I believe it was the team investigating the issue.

Jo Stevens

Who heads that team?

Mike Schroepfer

There are several people on the legal team working on this, on the privacy team and on the platform team. I do not know exactly who chose—

Jo Stevens

Who heads the team, please? Do you know who heads up that team?

Mike Schroepfer

Which team? We have multiple teams working on this.

Jo Stevens

Who has overall responsibility for the people who are doing that investigation?

Mike Schroepfer

There is a person on our platform enforcement team who is leading up the audit of all the applications on the platform.

Jo Stevens

Who is that person?

Mike Schroepfer

With respect, I prefer not to name people in a public setting. If it is of interest to this Committee I am happy to give it to you after the fact.

Jo Stevens

This is an investigation by the ICO and you say you will co-operate in any investigation.

Mike Schroepfer

They have this information.

Jo Stevens

We would like to know who is responsible in your company for that.

Mike Schroepfer

I understand, and we have provided that information to it. I am happy to provide this information to you. These proceedings are public and I am trying to be sensitive to naming individuals in a public proceeding.

Jo Stevens

What is sensitive about it? There are details for who is responsible for different parts of Facebook publicly available. I do not understand the sensitivity.

Mike Schroepfer

Again, with respect, I am happy to provide this information. If your goal is to get the information, I am happy to provide it to you. I am not sure why it needs to be broadcast on public TV.

Jo Stevens

When did Facebook hire Joseph Chancellor?

Mike Schroepfer

I believe in 2015.

Jo Stevens

When in 2015, do you know?

Mike Schroepfer

My recollection is November of 2015.

Jo Stevens

Just before The Guardian told you about the data breach. Were you aware that he was a cofounder of GSR?

Mike Schroepfer

I don’t believe we were.

Jo Stevens

When did you find out that he was a cofounder of GSR?

Mike Schroepfer

I think we first learned about that fairly recently. It was well after the December 2015 event. I would have to look at records but it might have been as recent as last year.

Jo Stevens

When The Guardian were working on the stories I have talked about in 2015 and in March 2018 about Cambridge Analytica, were you aware that Joseph Chancellor was an employee of Facebook and a cofounder of GSR?

Mike Schroepfer

We did not understand his possible involvement in this until quite recently, so not in 2015.

Jo Stevens

Have you investigated the work that Joseph Chancellor was doing with GSR?

Mike Schroepfer

We are doing so now.

Jo Stevens

You are doing it now. Have you made him sign a non-disclosure agreement?

Mike Schroepfer

Not related to this issue, no.

Jo Stevens

You have made him sign one related to other issues?

Mike Schroepfer

Every employee in the company has a non-disclosure agreement as a standard part of our employment clause.

Jo Stevens

Is that part of the employee contract or is that a separate agreement? If Facebook employs somebody, do they automatically make them sign a confidentiality clause?

Mike Schroepfer

Yes, because every Facebook employee is exposed to a lot of confidential information on a daily basis and we want to make sure that they understand that. One of the things that we try to do as a company is to be very open with what is happening and publish information quite widely, so it is important that every employee knows that we share things with them are not yet public information and we want to make sure they understand to keep that confidential.

Chair

You made Dr Kogan sign an NDA and he is a director of GSR, but you did not make Joseph Chancellor sign an NDA, and he is a director of GSR.

Mike Schroepfer

I want to be clear. In the proceedings that happened post-December 2015, Mr Kogan was the author of the application. In our platform tools it was his name on the application. He said himself that he wrote the application. In the agreements that we had signed with the parties involved, it was Mr Kogan. Mr Chancellor was not mentioned in those agreements. It was not an NDA, it was a confidentiality clause as a part of the contract for that agreement, which I will provide to you after these proceedings.

Jo Stevens

I think Mr Chancellor co-signed GSR’s 4 June 2014 agreement with SCL Elections, obviously an affiliate of Cambridge Analytica. Have you ever seen that document?

Mike Schroepfer

No, I have not.

Paul Farrelly

I am not going to dwell on this, but if you only found out recently about Mr Chancellor’s involvement with Dr Kogan, you have either not asked him for his CV or he has missed it off his CV.

Mike Schroepfer

I do not know exactly why we did not know but I am telling you the facts that I know.

Chair

When you said recently, I think you also said last year, is that correct?

Mike Schroepfer

I believe last year is the first time we understood his involvement.

Chair

When The Observer reported on the data breach earlier this year, you were aware that Joseph Chancellor had worked with Aleksandr Kogan at GSR?

Mike Schroepfer

Yes. To understand the timeline here, the issue is that in the most recent article the allegations were that the data still existed. Our key concern is does Cambridge Analytica still have this data, which is in violation—that is when we started the investigation of all of these things with Mr Kogan, Mr Chancellor and others.

Paul Farrelly

I only have a couple of questions in this section but we are going to come back to elections and manipulation later on. When we had Dr Kogan in front of us, it was quite clear that he was willing and able to play fast and loose with Facebook, because whatever Facebook’s terms and conditions said in writing he thought you never enforce them. He told us that therefore, in his use of semantics, he did not consider you had a policy. It is a dubious position to hold but in this inquiry that we are doing the question is: how much does Facebook care?

Mike Schroepfer

We care a great deal. I disagree with the assessment that we did not have a policy. I want you to understand that the goal of the platform was for consumers to be able to use applications and take the data they have on Facebook. One of the constant pieces of feedback we get from people is data portability. They want to take the data they share with Facebook and bring it to another application, to build a great social experience. Whether that is a game or a calendar or a music app, we want to make that as easy as possible. As we have talked about in many parts of this hearing earlier with issues of elections and ads and false news, those same tools, because they are easy and great for the consumer, can go wrong. This is why we have gone through several iterations of the platform, where we have effectively locked down parts of the platform, which increases friction and makes it less easy for the consumer to use these things but does safeguard that data more, and been a lot more proactive in the review and enforcement of these things. This was not a lack of care. I will let you make your own assessment, because you get to be the judge, but I will tell you that our primary product is designed to help people share safely with a limited audience. If you want to say it to the world, you can publish it on a blog or on Twitter. If you want to share it with your friends only, that is the primary things Facebook does. If we violate that trust and that data goes somewhere else, we are violating the core principles of our product and that is a big problem. This is why I wanted to come to you personally today to talk about this, because this is a serious issue.

Paul Farrelly

His justification for the neat little trick that he discovered where he could harvest not just thousands but millions of people’s data and then sell it on for political purposes, was that he had his terms and conditions up there for 18 months, making it clear he could sell it to anyone he wanted for whatever purpose, and you never took him to task. Yet you have said you try to make sure that all your developers and people who use your platform like that have terms and conditions but by an automated method. What does the automated method do, just check whether the words “terms and conditions” are there, irrespective of the content?

Mike Schroepfer

I think the issue you raise is again an important one. Whatever he wrote in that document, he could write terms and conditions that was a carbon-copy clone of ours and then go and do what he did, which is sell the data. The terms and conditions are one part of it but the much broader issue is how do we protect data and make sure it is there. Since the terms and conditions are a very small part of this, I think the broader issue is technically locking down the platform, proactively reviewing the application. If you are asking me do I wish we had done more of this back then—

Paul Farrelly

That is rather deflecting the question. At least he was upfront about it and you never took him to task. When you did discover this app—and perhaps others, about which you will give some more details later—you stopped new people doing it but you did not stop the existing people doing it for a year. They got a year’s grace, so if you cared, you did not care 100%.

Mike Schroepfer

What you are referring to is in 2014 we announced the changes. Any new app had to abide by these changes, or any revisions to the app. Then there was a grace period until 2015 to have people migrate to this new API. The reason we did this is these changes were significant enough that if we had flipped them on immediately, we would break a large portion of the internet, many apps on the internet, instantaneously. Like any platform developer for a mobile operating system or a system you run on your desktop, you have to give developers time to update their applications to make sure that they do not break when the user changes to the service or uses the new API. This is a fairly standard technique to allow the applications to move so we do not break a bunch of consumer experiences across the web at the time.

Paul Farrelly

You were giving a period of grace for activities to continue that you considered a disgrace.

Mike Schroepfer

The key thing here again, as I said, is there is a strong trade-off between ease of use and friction of the consumer, the ability for me to take all my data, including this information, to this application, and safety, which is how easy is it for someone to abuse this. You can set that pendulum in multiple places. What we were doing over time is moving much more towards safety. This was not a disgrace. The vast majority of the developers on the platform are building great experiences. These are name-brand companies you have heard of, like Spotify and Airbnb and Pinterest. If you talk to them they would say that Facebook was fundamental to helping them grow their business in the early days. That was the goal of the platform and we saw a lot of great things happening. We wanted to, over time, further restrict these sorts of bad activities. There is a limit to how fast we can move to getting these things done without causing undue consumer harm. Literally, if we change some of these things, you would go and visit a site or an app, like your music player, and it would be broken because we had cut off access to the API. Doing that for hundreds of millions of consumers did not seem like the right thing to do at the time.

Paul Farrelly

When we come to elections we will have a few more questions about how much Facebook really cares.

Ian C. Lucas

Can you confirm, following the breach in December 2015 that you found out about from The Guardian, that Cambridge Analytica certified to you that they had deleted the information they had from GSR?

Mike Schroepfer

That is my understanding, that we did get a certification from Cambridge Analytica.

Ian C. Lucas

Did you receive that in writing?

Mike Schroepfer

I believe so.

Ian C. Lucas

Could you please send us a copy of that?

Mike Schroepfer

I will check with the legal team. I am assuming we can but I will double-check with them and provide it for you immediately after if we can.

Ian C. Lucas

You received a certification from Mr Kogan and you received a certification from Cambridge Analytica. Were there any other organisations you received a certification from at that stage?

Mike Schroepfer

There were multiple parties involved in these. I will provide you all the documents immediately after these proceedings that we can give you.

Ian C. Lucas

When you say multiple, are you talking about 50, are you talking about three?

Mike Schroepfer

No, no, it was primarily Mr Kogan, Mr Wylie and Cambridge Analytica. There may have been one other. I need to provide you with the documents to get the full details.

Ian C. Lucas

I will return to this.

Julian Knight

I apologise for my lateness. I had to answer questions on behalf of the Public Accounts Commission. Mr Schroepfer, your company spent the first part of our inquiry effectively threatening journalists with being sued, with legal action. As a former journalist myself, I can tell you the impact of that on journalists is pretty serious. People lose their homes over those things, especially when multi-billion-pound organisations come knocking. Your head of news partnership, Ms Campbell Brown, said that it was a mistake to go after these journalists for telling the truth, for telling you where you were going wrong. Will you go further? Will you apologise today for this bullying behaviour by your company?

Mike Schroepfer

Again I want to be clear, my understanding is that we wanted to make sure the facts were straight. We believe deeply in the need of journalists to be free to investigate all of these matters. It is the same principle we have freedom of expression with our core product.

Julian Knight

Sorry to cut across you, Mr Schroepfer, but why is your first instinct to send legal letters? If you are so wanting the truth and wanting journalists to express themselves, why is the first thing you did to send legal letters?

Mike Schroepfer

My understanding is this is common practice in the UK in terms of correcting letters. I may be wrong.

Julian Knight

You are wrong. You are wrong in that respect.

Mike Schroepfer

The important thing is to get the facts on the matter right.

Julian Knight

I am really surprised in a country that has the first amendment, you have freedom of speech and, I have to say, a very robust press, that the excuse is that it is a cultural thing and that this is normal thing to do in Great Britain. It really is not in that respect. I am going to ask you again, will you apologise for this bullying behaviour?

Mike Schroepfer

I am sorry that journalists feel that we are trying to prevent them from getting the truth out. That is not the intent, so I am sorry.

Julian Knight

Thank you. Your boss, in a rather folksy way, said in front of the Senate Committee that there had been something bad going on at Cambridge University, I think his phrase was. Again your company is going legal, potentially. That is the implication. Isn’t this simply a diversion?

Mike Schroepfer

I am not sure what your question is.

Julian Knight

Mark Zuckerberg said that he thought there was something going bad at Cambridge University. Cambridge University is obviously, whether it is some people who have worked there, involved in some way in design of these apps. Is this not your company again looking at a diversion? You are pretending to be the victim in this respect, when it is your own looseness that has caused this information to get out there.

Mike Schroepfer

I want to be clear on a few things. First, Cambridge University is an excellent, fine institution. We have probably dozens, maybe hundreds, of graduates of that university working at our company. It is one of the finest institutions in the UK. I want to make that clear. Secondly, the real issue here is Cambridge Analytica and the sale of data to them and what they did with that data. That is the primary focus of my time and energy: to understand what is happening there. There are two components to this. There are people who did things against our terms and service and did things that we do not like. That is partially on them. We have said repeatedly that the mistakes we made were not being aggressive enough in enforcing all of these things and having both technical and operational controls over these, which we started to make changes in 2014 and have made many more, including ones that I detailed last month. I acknowledge both we needed to do more and that others had done some things here. That is the way I would look at it.

Julian Knight

Your lawyers were at Cambridge Analytica, knowing full well of the involvement of the Information Commissioner. You were there when the Information Commissioner was trying to get a warrant, which hopefully we will see a speeded-up process of. What would you say to those who view this almost as an attempt to pervert the course of justice?

Mike Schroepfer

I want to be very clear, I still do not know what data they do or do not have.

Julian Knight

Your lawyers were there all day.

Mike Schroepfer

Yes, it takes time to analyse these systems. Our primary goal is to understand what data is or is not there and make sure that people are protected. We wanted to do that as quickly as possible. If we had dragged our feet and waited, you would rightfully accuse us of not taking this seriously. As soon as the Information Commissioner asked us to stand down so that they could take precedence, we said, “Of course your investigation takes precedence” and we moved into a mode where we are trying to provide—

Julian Knight

It was just coincidental that you were there on that day, that you decided to come on that day, rather than the fact is that you knew the Information Commissioner was coming knocking and you decided to get in there in order that you could ascertain what was going on, so you could protect your own corporate position, when what you should be doing is protecting the integrity of the inquiry?

Mike Schroepfer

What we were trying to do is get there and get to the answers as quickly as we can.

Julian Knight

Regardless of the actual inquiry going on?

Mike Schroepfer

Once we understood that the Information Commissioner wanted to take precedence, we immediately deferred to them with no argument. Personally I have met with the staff. We are providing extensive technical data analytics and others, to them to assist in the investigation. Their goals, your goals, our goals are all the same: to make sure we understand the facts here and what exactly happened so we are not guessing at that. We wanted to get to the facts as quickly as we could.

Julian Knight

Yes, damage limitation. The reason why I have asked you these particular questions is it outlines for me a pattern of behaviour, an MO, if you like, for your company: bullying journalists, threatening academic institutions and impeding, potentially impeding, investigations by lawful authorities. I put it to you today that Facebook is a morality-free zone, destructive to a fundamental right of privacy. You are not an innocent party wronged by the likes of Cambridge Analytica, but you are the problem. Your company is the problem. What do you say to that?

Mike Schroepfer

I respectfully disagree with that assessment.

Julian Knight

You see yourself as somehow morally innocent in this respect, despite this catalogue of behaviour.

Mike Schroepfer

I think what you want from an organisation is transparency and responsibility. You want us to say when we are responsible for things, which we have in multiple cases. We have talked about the mistakes we have made.

Julian Knight

Only when you have been dragged kicking and screaming into that situation by inquiries such as this.

Mike Schroepfer

You want transparency on things like ads and whatnot. This is not where I spend my day job. The core of the job is to try to build a service that helps billion of people around the world connect with each other every single day. That is the core of what we are trying to do. Whether it is a nation state actor or a spammer or a developer abusing the platform, we need to do a better job policing all of those abusers of the platform, but I think great things are happening every single day on our products and that is what we try to focus on.

Julian Knight

One final question. You have mentioned there about monitoring regulation. In America your spokespeople constant references to regulation. This, of course, was self-regulation, which has been shown, frankly, to have been utterly worthless. This is witnessed by the information free-for-all that we have had. Do you think the time has come for robust regulation and empowerment of consumers over their information? Do you think you effectively need regulation right now in order to ensure that there is a level playing field, everyone knows what they are doing and, crucially, consumers get real ownership over their information, what could often be quite personal information?

Mike Schroepfer

I agree with you on a few key things here. First of all, whether there is regulation or not, making sure the consumers have visibility, control and can get access and take their information with them, I agree 100%. We have had a feature to do this since 2011, we have made it even more robust in recent weeks and years. Ironically, part of the issue of the platform is we made it easy to people to take their data to third-party developers to build great social experiences, and then abuse has ensued. The challenges with these things are we definitely want to provide control and data access and data portability. We need to balance those things with security and abuse and the bad things that happened when people can get a download of their entire data to a bad actor, so I agree strongly with that. In terms of regulation, there are multiple laws and regulatory bodies that we are under the guise of right now. Obviously the GDPR is coming into effect just next month. We have been regulated in Europe by the Irish GPC, who has done extensive audits of our systems over multiple years. In the US we are regulated by the FTC and the Privacy Commissioner and in Canada and others. The question is honestly how do we ensure that the regulations and the practices achieve the goals that you want, which is that consumers have safety, they have transparency, they understand how this stuff works and they have control. The details of implementing that is where all the really hard work is.

Julie Elliott

I want to move on much more to what has happened in this inquiry regarding elections. Mark Zuckerberg, your boss, maintains that Facebook had no influence on elections. Can you remind us how many adverts were paid for by the Internet Research Agency in US elections?

Mike Schroepfer

The IRA are spending—I am sorry, I did not come with the figures for the US elections with the IRA, because I thought you would be—

Julie Elliott

Can you provide us with that information?

Mike Schroepfer

Of course. I came prepared to talk about the UK referendum.

Julie Elliott

A follow-on to that is can you remind us how many adverts were paid for by the IRA in the UK referendum?

Mike Schroepfer

Yes, it was about $1 of spend.

Julie Elliott

Because when we look at it, that does not seem to stack up to what we have been hearing. Are you confident that that figure is correct?

Mike Schroepfer

We have looked extensively at the information we can find. In the 2016 US election, the counts involved in the IRA issues there, the Russian IRA—as we announced last month, we found proactively another 270 pages that were not only the IRA but a news agency in Russia that clearly had close ties to the IRA, which was found by us. In all of these investigations we have not found any clear participation in the UK referendum. Again, these are adversarial actors that are trying to evade our systems and platforms. Is it possible we missed something? Yes. I do think we have looked pretty hard.

Julie Elliott

Can I draw your attention to the written statement you have given us, where you have said, “Our records show that AIQ spent approximately US$2 million on ads from pages that appear to be associated with the 2016 referendum”?