Oral evidence: Disinformation and ‘fake news’, HC 363

Oral evidence, 27 November 2018.

Witness

Richard Allan.

Chair

Good morning. I call this meeting of the Select Committee on Digital, Culture, Media and Sport to order. We are meeting with our international guests in this Grand Committee. We welcome Members of the Parliaments of Argentina, Canada, France, Singapore, Ireland, Belgium, Brazil and Latvia. This is the first time that multiple Committees have joined together for a hearing in the House of Commons since 1933, when the Joint Committee on Indian Constitutional Reform invited parliamentarians from India to join the Committee. We can therefore say that this is the first time that parliamentarians have gathered from such a number of international jurisdictions in one place. The fact that this meeting is taking place with representatives from right across the globe shows how seriously we and our colleagues in other Parliaments take these issues. I welcome Lord Allan from Facebook, who is giving evidence to us today. As you can see from the name plate beside you, we were still rather hoping that your boss might make a surprise appearance. Nevertheless, we are grateful to have you with us. I call Charlie Angus to ask the first questions.

Charlie Angus

Thank you, Chair, and thank you, Mr Allan. I would say at the outset how deeply disappointed we are about Mark Zuckerberg’s decision to ignore the summons from so many different nations. This is an unprecedented situation that we are dealing with—this many parliamentarians and legislators. As my first question, I would like to ask you about the corporate decision of Facebook to blow off this meeting with Mark Zuckerberg. How was that arrived at? Who gave Mr Zuckerberg the advice to ignore this Committee?

Richard Allan

I wouldn’t characterise the decision as a blowing off. It was a decision that we took to try to understand—

Charlie Angus

You say it is not blowing off and you are trying to understand. We are trying to understand who advised Mr Zuckerberg. Was that his decision or did Facebook say, to protect Mr Zuckerberg, “Stay away from this meeting?”

Richard Allan

I will take responsibility for decision making around appearances in front of committees. For the record, this year we have appeared in front of numerous committees of different institutions, including Mr Zuckerberg himself appearing before two congressional committees and the European Parliament, and—there are other representatives from different Parliaments here—for example, in Ireland, and we have appeared in front of committees in Canada. Our intent is to be there, to answer the questions that you have for us.

Charlie Angus

But not Mr Zuckerberg?

Richard Allan

For some appearances, Mr Zuckerberg has made himself available, but not for every appearance, and apologies for that.

Charlie Angus

I guess for me, being from Canada, we see ourselves as in the Westminster tradition, which is the heart of the democratic system to us in the west. The Westminster tradition has seen many threats, bumps and bruises over the centuries but we have never seen anything quite like Facebook where, while we have been playing on our phones and apps, our democratic institutions and our civil conversation seem to have been upended by frat boy billionaires from California. So Mr Zuckerberg’s decision not to appear here at Westminster to me speaks volumes, particularly since this has been the subject of an investigation into whether Facebook apps upended one of the most important votes in British history. When Mr Zuckerberg says that the plan was to move fast and break things, and that breaking may have involved our democratic institutions, does he not believe or not think that parliamentarians around the world are willing to push back?

Richard Allan

Just to be clear, Mr Zuckerberg has gone on the record to say that addressing some of the valid issues you have raised around the impact of connectivity in general, and of Facebook in particular, on elections of the democratic process is a top priority for the company. He personally has been on the record discussing the kind of solutions we need and he is directing the work. Indeed, as we sit here today there are reviews of a Facebook engineering product going on that he is leading and which will help here.

Charlie Angus

Let’s just go into what he is on the record on. We understand that in response to this unprecedented bad corporate publicity—I think you would admit that we have never seen a corporation under the spotlight like this—Mr Zuckerberg hired the Republican party-linked Definers. We learned from that that one of the solutions in response to this bad press was to try to link George Soros—there were a lot of issues around Soros and antisemitic conspiracy theory—and then to suggest that attacking Facebook was somehow in itself antisemitic. Don’t you see that by using the same tactics of misinformation, rather than being accountable, you have lost public trust and cannot be trusted to police yourselves? Has not Mr Zuckerberg put your company in that position?

Richard Allan

I’m not going to disagree with you that we have damaged public trust with some of the actions we have taken. Again, just for the record, on the issue of the hiring of this outside firm, Mr Zuckerberg himself said that that was not what he expected of us. He was not personally responsible for the hiring. Elliot Schrage, who runs policy and comms at Facebook, has publicly stated that he was responsible and takes responsibility for it. Mr Zuckerberg has given instructions for us now, as a team, to look very carefully at all the relationships we have with different external agencies to make sure that we behave—

Charlie Angus

That’s wonderful. I’m sorry to cut you off but I have to be respectful of my colleagues. It’s this thing that Facebook is always sorry, they are always on a journey. We asked the head of Facebook Canada about the allegations of genocide in Myanmar, where the international community spoke out again and again and again about the mass killings that were happening. The Facebook rep for Canada said, “We admit we’re not perfect. We’re on a journey.” We are not asking you to be perfect; we are asking your company to be accountable when issues come up, such as genocide, such as misinformation. Once again, “Mr Zuckerberg is looking into this.” We don’t know that Mr Zuckerberg is looking into this because he has refused to show up to speak to parliamentarians from around the world. I put it to you that you have lost the trust of the international community to self-police and that we have to start looking at a method of holding you and your company to account, because Mr Zuckerberg, who is not here, does not appear willing to do the job himself.

Richard Allan

Again, I am going to agree with you. One of the areas that I am working on right now is precisely to understand the kind of regulatory framework that is in everyone’s interest. We have accepted, and Mr Zuckerberg has said himself that we accept, that this requires a regulatory framework and action by responsible companies like ours. It is the two in tandem, and as we go on to discuss false news and elections, I think the regulatory piece is going to be a really important part of that.

Chair

I don’t think it is up to Facebook to determine what regulatory structure it should be under. It should be up to Parliaments to determine that and that is why we here. I call Ian Lucas.

Ian C. Lucas

Can you confirm that Facebook first learned of the GSR/Cambridge Analytica data incident from the press in December 2015?

Richard Allan

I can confirm that is when I first learned about that incident, yes, and I think that is where people generally in the company who were following these issues would learn about it—from the press.

Ian C. Lucas

When did Mark Zuckerberg first know of the GSR/Cambridge Analytica incident?

Richard Allan

Later, when it became—

Ian C. Lucas

Do you know the precise date?

Richard Allan

I don’t know the precise date, but what I do know is—

Ian C. Lucas

Have you asked Mr Zuckerberg when that precise date was?

Richard Allan

My understanding, and we have given responses to your Committee, was that this was the more recent round—

Ian C. Lucas

No, I’m sorry, Lord Allan. You haven't given responses to this Committee. I asked Mike Schroepfer in April this precise question and he said he didn’t know. He told me the buck stopped with Mark Zuckerberg. I wanted Mr Zuckerberg to come to answer this question. You have had six months’ notice of this question and I would have expected you to have been able to answer it today, so I am going to ask it again. When did Mark Zuckerberg first know, precisely, of the GSR/Cambridge Analytica incident?

Richard Allan

We have, with respect, provided written answers to your Committee following Mike Schroepfer’s session. My understanding from those written answers—I will double check—is that it was March 2018, when the second round of stories occurred, that he was made aware of this situation. There were others of us who were closer to what was happening in the United Kingdom who had read the original Guardian stories by Harry Davies in December 2015.

Ian C. Lucas

Can you give me an example of a data incident or breach other than the GSR/Cambridge Analytica case where Facebook has taken action?

Richard Allan

We have taken action against a number of applications that failed to meet our policies. Those policies cover a range of issues, both the behaviour of the application and their use of data.

Ian C. Lucas

Can you name one case?

Richard Allan

I will come back to you on that, if I may. There have been other applications that we have disabled.

Ian C. Lucas

Can I quote to you Mark Zuckerberg’s evidence to the US Senate earlier this year? He was asked this question then and he said, “I don’t have all the examples of apps that we have banned here, but if you would like, I can have my team follow up after this.” He gave the Senate the same answer you are giving me now.

Richard Allan

And again, for the record, we have answered thousands of questions that came from different parts of the United States Congress.

Ian C. Lucas

Lord Allan, that is a pretty important question. Did he supply a list? Presumably, Mark Zuckerberg respects the US Senate.

Richard Allan

Absolutely.

Ian C. Lucas

Did he supply a list?

Richard Allan

I don’t have in front of me today all of the answers to all of the questions.

Ian C. Lucas

Did he supply a list? Let me answer that. He didn’t supply a list and we still do not have the details of any company that was banned by Facebook on that basis. Do you know who Joseph Chancellor is?

Richard Allan

Yes.

Ian C. Lucas

You know that he was employed by Facebook.

Richard Allan

Yes.

Ian C. Lucas

Why was he employed by Facebook?

Richard Allan

Mr Chancellor, as I understand it, is somebody who had a track record as an academic working on relevant areas.

Ian C. Lucas

You know that he was a co-founder of GSR.

Richard Allan

Yes.

Ian C. Lucas

So GSR, in December 2015, was the source of the breach to Cambridge Analytica, and Joseph Chancellor was an employee of the company at that time—of Facebook.

Richard Allan

Yes.

Ian C. Lucas

So what action did you take against Joseph Chancellor at that time?

Richard Allan

We have not taken action against Joseph Chancellor.

Ian C. Lucas

But this was an extremely serious incident, wasn’t it?

Richard Allan

Again, the incident related to GSR occurred before Mr Chancellor’s employment with Facebook.

Ian C. Lucas

Yes, but you have said some pretty negative things about Aleksandr Kogan, who was the partner of Joseph Chancellor, but you didn’t take any steps at all against Joseph Chancellor.

Richard Allan

I am not aware of us taking any steps against Mr Chancellor.

Ian C. Lucas

Well, you didn’t because he was employed until earlier this year by Facebook. Isn't it the case that you don’t actually take steps against app developers when they pass on information?

Richard Allan

That is not true. Let me be very clear about how the system works. We have a social network. The social network has the data of individuals on it. The individual chooses when they wish to install a third-party application. Our expectation is that all third-party applications that access Facebook data have their own privacy policies and comply with privacy law just as we are required to do, and that they behave in a reputable way. If any information leads us to believe that that is not the case, we will prevent access to our platform by those applications.

Ian C. Lucas

You still haven’t given me an example of a single case where you have done that.

Richard Allan

I will check the records, Mr Lucas, and come back to you.

Ian C. Lucas

But the fact is that there aren’t any of these cases. We have asked repeatedly for them. May I just quote you a section of evidence that Aleksandr Kogan gave to us? The Chair asked him a question about Joseph Chancellor; he asked whether it wasn’t a bit odd that Joseph Chancellor was being employed by Facebook. Aleksandr Kogan did not think it was odd. He said, “The reason I don’t think it’s odd is because in my view Facebook’s comments are PR crisis mode. I don’t believe they actually think these things, because I think they realise that the platform has been mined left and right by thousands of others.” Isn’t that the truth?

Richard Allan

Again, I don’t accept that characterisation. Our terms are quite clear for our expectations of third-party developers. If, as was the case with GSR, they breach those terms, they potentially find themselves in trouble not just with us—

Ian C. Lucas

But you still have not given me an example.

Richard Allan

I will come back to you, Mr Lucas, with an example. I do not want to defame—

Ian C. Lucas

It is incredible. You haven’t given me an example.

Richard Allan

I will come back to you.

Ian C. Lucas

We have had repeated hearings. You are the third Facebook person to come to our Committee, and you still cannot give me one example of Facebook banning someone for sharing data.

Richard Allan

I will come back to you with an example.

Ian C. Lucas

There aren’t any examples.

Richard Allan

We have banned very many apps over the years for a variety of forms of abuse.

Ian C. Lucas

Why when Congress asked you for a list did you not provide one?

Richard Allan

I have said I will check whether or not we did provide that. I know that we provided answers to thousands of questions to Congress.

Ian C. Lucas

Isn’t the truth in all this that you knew exactly what was going on, because the whole model is about sharing information? You knew that app developers were sharing information and the only time you ever took action is when you were found out.

Richard Allan

Again, to be very clear about the app model, it is something that is intended to add value for Facebook, for the developer, and for the user. The user gets a feature that we are not going to provide to them. If the feature is useful they will install the application and choose to share their data with the application—so, for example, they share their photos so that they can adjust them and make them more interesting and fun, and they will share them back to Facebook. That is the normal behaviour of a Facebook application.

Ian C. Lucas

You want access to info from the developers, and you get access to that information from them. That is why Facebook has developed as fast as it has.

Richard Allan

No, the intention and the business model—it is a business—is a win-win-win. The developer gets to build a business much more easily than they could otherwise do, and lots of people have built great businesses on Facebook, including from the countries represented here. Instead of having to build their own social network of hundreds of millions of people, they can build their application and get it out there. That is great for the developer. It is great for the Facebook user, who gets additional features that they otherwise wouldn’t have. And yes, it is good for us because, as in my example, if someone has created a new fun photo and they share it back to Facebook, more people will engage with that photo, and we get more activity on the platform.

Ian C. Lucas

Lord Allan, have you seen “Casablanca”?

Richard Allan

I have seen “Casablanca”.

Ian C. Lucas

You know what this reminds me of? There is a wonderful scene involving Claude Rains, when the police are called to Rick’s café because gambling is taking place; he closes the café because gambling is taking place, and he is then delivered his winnings. I think Facebook has known throughout this exactly what was going on in terms of passing information. I think Facebook has told us again and again a tissue of lies about the way your company operates.

Richard Allan

I would contest that.

Ian C. Lucas

Give me one example of a business that you have banned because they have shared information.

Richard Allan

Beyond GSR?

Ian C. Lucas

Beyond GSR.

Richard Allan

I will come back to you. I don’t want to mention the name of a business that then turns out to be inaccurate. I will come back to you.

Chair

This Committee and colleagues have asked repeated questions about Russian activity on Facebook, and in particular about knowledge of the Russian ads that ran during the presidential election in America in 2016. When we asked those questions, why didn’t Facebook disclose that as a company it knew those ads were being placed and run before it was reported to the US Senate?

Richard Allan

I am trying to understand—

Chair

When we took evidence in February from Simon Milner, we asked him why they didn’t look for activity of Russian ads and why they didn’t report it, and he said it was something the company didn’t know it had to look for. But we know from a recent investigation by The New York Times that Facebook as a company was aware much, much earlier that these ads were being placed and run. They didn’t report it to anyone at the time, and during the period when we were asking questions about it, no one disclosed that the company was aware of this information earlier. The impression given was that it wasn’t until the request was made by the US Senate Intelligence Committee, and Facebook was then asked to look for this activity, that they knew it existed. The company had known a long time before that it existed, but never disclosed that fact. Why was that?

Richard Allan

Again, the sequence of events, as I understand it, is that we were aware there was a group, commonly known as APT28, that had been targeting people on the Facebook platform—actually, some time ago. They have also targeted people in other countries—in France, there was an incident. This is a group based in Russia—

Chair

I don’t want to get too much into the history of it. This is a simple question. Can you confirm that Facebook as a company knew about this Russian activity in terms of ad buying before it was reported by the US Senate?

Richard Allan

Again, there are two different pieces here. One is this group trying to target political accounts: classic hacking mode. The second part of it is information that we received to say that people thought that some operatives from this group were involved in some American political pages, and that those pages were buying ads. That is what subsequently came out. So there were two different activities carried out by the same group. The one that we were aware of earliest was attempts to hack accounts, so we became aware of this group; we understood something about their operations. We subsequently received information to suggest that the same group had created some of these pages and were using the pages and ads to sow civil discord.

Chair

We see a consistent pattern of Facebook failing to disclose relevant information of considerable public interest when you are asked questions about things like Russian activity. This information about the company’s knowledge came into the public domain because of a separate investigation, not in the multiple hearings that the company has attended where it has been asked these questions. Can you not see that this has caused a massive breach of trust not just between Parliaments and the company, but with the many people who watch these deliberations as well? I’m not sure there is really an answer to that question. I think that that information should have been disclosed. Are there other incidents of Russian activity on Facebook in terms of accessing data that we should be aware of?

Richard Allan

Our policy at the moment is that once we have confirmed information about any attempts at interference, whoever that should be from, and once we have investigated and understand accurately what has occurred, we will publish it. You will know, if you have been following the activities of our security team, that over the last few months we have published several quite extensive reports describing attempts to create false properties on Facebook from both Russians and, more recently, from Iranian sources. In the United Kingdom, for example, there was an attempt by a group of Iranian operatives, we believe, to create false information on Facebook. We researched that, we found the evidence, we published it. So our position right now is that where we have information, we will make sure we verify it, but we will put it into the full public domain, obviously withholding any details that we need in order to be able to prevent further attacks.

Chair

You will be aware that the DCMS Committee has received substantial documents from Six4Three, an app developer company in California. We don’t intend to publish those documents today—we are not in a position to do that—but there is one item within those documents that I think is of considerable public interest and I think relates to the point you have made. I want to put this to you. An engineer at Facebook notified the company in October 2014 that entities with Russian IP addresses had been using a Pinterest API key to pull over 3 billion data points a day through the ordered friends API. Was that reported to any external body at the time?

Richard Allan

Again, to set expectations around the emails, which I understand you have and we have exchanged correspondence over, there is, as I understand it, a partial set of information that was obtained by a hostile litigant who is repeatedly seeking to overturn the very changes to restrict access to data that I think you as a Committee and others would want to see.

Chair

I don’t want you to use this opportunity just to attack the litigant, who is not in a position to speak for themselves because they have been told they cannot speak publicly about these matters. I want you to address the question, and if you do not have the answer to it, I would like Facebook to report back to the Committee to say what internal process it ran when this was reported to the company by an engineer, and whether it notified external agencies of this activity. If Russian IP addresses were pulling down a huge amount of data from the platform, was that reported or was that, as so often seems to be the case, just kept within the family and not talked about?

Richard Allan

The context I am giving is really to say that any information you have seen that is contained within that cache of emails is at best partial and at worst potentially misleading. On the specific question whether we believe, based on our subsequent investigations, there was activity by Russians at that time, I will come back to you, but I do want to set that context. Those emails are unverified, partial accounts from a source who has a particular angle.

Chair

Okay, we will move on. The document I referred to is an email from a Facebook engineer. It is an internal company document, not just someone’s interpretation of those events, but we will move on. When Facebook changed its criteria for working with app developers in 2014-15, did it create a white list of developers that had privileged access to data and a list of other developers that did not?

Richard Allan

We continued, through those changes, to ensure that developers who had a particular requirement could have a soft landing. The intention of the change was to restrict access to data through the API. From a technical point of view, there was one version a developer could use to access data—one version of the code that allowed this broader access, and that is the problem that we found with the GSR application. There was a new version of the code, which narrowed the forms of access you could have, and we moved people from version 1 to version 2. There were some developers who needed additional time to move from version 1 to version 2, and we gave them that time where we thought that was justified. They are all now on version 2.

Chair

So am I right in saying that there were certain developers that continued to have full access to Facebook data after the platform policy changes came into place?

Richard Allan

Again, I want to be very precise about “full access to Facebook data”. What that meant was that when somebody chose to install the application under version 1, they could choose to give the developer access to a broader range of information, including information from their friends. They continued to have—

Chair

So are you contesting that the user knew? What you are saying is there were some categories of apps that had full access to data and others that did not. Yes or no?

Richard Allan

Well, I just want to qualify “full access to data”. That sounds like there is a fire hose of data you can access. The API was never like that. [Interruption.] No, no, developers never had that. What developers had under the first version was the ability to ask you to install their application, and if you agreed to it and agreed to certain permissions, they could also access some of the information that your friends shared with you. Version 2 stopped that. In neither version was it full access to data. In version 1 it included some access to friends’ data where they had given permission. In version 2 that access was removed.

Chair

This is the last question from me. Did Facebook have a policy of reciprocity with developers—“You give us all your data and we’ll give you all ours”—for the actions on the platform?

Richard Allan

No, again, to be clear—

Chair

No?

Richard Allan

That’s not the policy. Again, to understand—

Chair

At that time—before 2014-15—did you have a policy of full reciprocity with developers for data?

Richard Allan

Again, part of our developer policy said that we had an expectation that the developer would allow people to share their content back to Facebook. To try to use an example to make it concrete, I could develop an application that said, “Christmas photo application. Take your Facebook photos; I will put Christmas decorations on them. That’s what my application does.” What reciprocity meant for us was that that developer should offer the user the ability to share the photo back to Facebook; otherwise, it is simply taking data out—extractive—and there is no value back to the Facebook community. In practice, we found that developers generally do that anyway, so there isn’t an issue. There was a period of time when our developer policy made it clear to developers that our expectation was that they would allow people to share the data back to the platform.

Chair

Fine. I think we will bring in some other people at this point.

Catherine Morin-Desailly

Facebook is accountable for what has happened, which is a huge scandal. I wanted to say that to start with. Fortunately, world public opinion is increasingly aware of what is happening with platforms in general and social media platforms in particular—especially Facebook. I want you to repeat what Facebook’s decision on data and privacy controls, which led to the Cambridge Analytica scandal, was.

Richard Allan

Again, we have a Facebook platform that dates back to 2007. It allowed a developer to ask a user to install their application, and then they would get access to certain data. In the first version, that could include access to data that friends had shared with the installing user. The Cambridge Analytica scandal comes from the fact that a developer built an application called “This Is Your Digital Life”. The developer was Aleksandr Kogan with the firm GSR in Cambridge. They used that install method to collect the data of a large number of people. They did that, according to evidence heard by that committee, at the request of Cambridge Analytica, and they shared that data.

Catherine Morin-Desailly

Had Facebook users been warned that their data would be harvested like that?

Richard Allan

Yes. This is a matter—I think you are hearing from the Information Commissioner’s Office later—of legal discussion around whether or not the guidance we gave was sufficient. We believe that it was. When you sign up for Facebook, it said, “You may install applications.” There were controls where users could say—

Catherine Morin-Desailly

Do you think it is quite normal to target political accounts or users like that?

Richard Allan

To separate the issues, the activity that took place was abusive according to our terms. It shouldn’t have happened. I want to be very clear on that. The specific use of the data by Cambridge Analytica was abusive. We don’t believe that the fact that an application may get your data was either illegal or improper. We believe people were aware of it at the time.

Catherine Morin-Desailly

How can you account for the fact that shadow profiles were created? That meant that the data of people who were not Facebook users were harvested as well. Do you think it is quite normal to do that?

Richard Allan

We don’t do it. We don’t create shadow profiles.

Catherine Morin-Desailly

But it appears that there were shadow profiles, including medical data.

Richard Allan

That’s not true. From our point of view, we don’t create shadow profiles. People talk about it. If it is helpful, I want to be clear about what data we do have from non-users.

Catherine Morin-Desailly

But Mark Zuckerberg confirmed in front of Congress that there were shadow profiles.

Richard Allan

No, there are not shadow profiles. There is a certain amount of non-user data that sits on Facebook servers. It can come from two main sources. One is that if you upload your contacts, they sit on Facebook servers. We also collect data based on the IP addresses of people who visit sites with Facebook plug-ins. We don’t use that data to create shadow profiles or to target advertising but, yes, non-user data is sitting on Facebook servers because of the way our technology works.

Chair

Eamon Ryan.

Eamon Ryan

I apologise; my computer went off. We are all online all the time, and it is important that we get the rules right. I was just going back to some of our joint Oireachtas hearings, when Mr Joel Kaplan from Facebook came over to answer some similar questions. I want to go back to this question. In 2011 and 2012, the Irish data protection commissioner looked, in an audit of Facebook, for an end to the possibility for a developer to access other people’s data. They said in their presentation that they were persisting in that and that they had considered taking a legal challenge, but had decided to continue with the iterative process for fear that a legal challenge would take too long to close the loophole. We didn’t get a really clear answer to why Facebook ignored and fought back against the data commissioner’s recommendation. I want to know—if you cannot tell us now, provide details afterwards—where was that policy decision made, at what level in the company and by whom? The same would apply for when you found out in 2015 about this huge and not insignificant problem—again, at what level in the company was it decided not to inform the Irish Data Protection Commission, and by whom?

Richard Allan

I was personally involved in a lot of those conversations, having been at the company back when the original complaints were made. The view at the time was that the Irish Data Protection Commission was giving us strong advice, but was not declaring the activity illegal. That allowed us to make a determination about whether we wanted to contest that, or whether we wanted to accept its strong advice—again, the advice is repeated and on the public record. There was a view that the platform was working well at the time, that people were getting benefit from it. Remember that at the time we had not had some of the scandals that we are talking about now, with abuse of platform data. The decision was taken, with the data protection team in Facebook Ireland and the broader company, to say, “Look, if we’re not compelled to make this change, we will choose not to make it at this stage.”

Eamon Ryan

I do not know what possible benefit can accrue to anyone having that access to other people’s information or data. No matter who the individual user is, there is a fundamental injustice in allowing such access to data. I simplify it down to this question, which you could say is how it should be looked at: was the decision made in Europe or in California?

Richard Allan

The decision was made ultimately by Facebook Ireland. They are the team responsible for our compliance with Irish data protection law and the Irish Data Protection Commission, so they ultimately have the decision-making power over anything that relates to the processing of data within that legal framework. Obviously, a wide range of people in the company are consulted about any of those decisions.

Eamon Ryan

You have now started to roll out in America and the UK, as I understand it, that there will be transparency around political online advertising. You have also agreed that you will provide something similar for the next European elections, although the conditions and timelines are not yet clear. I am interested in what happens if we have an election before then in any country outside the US or the UK, where these provisions are already in place. Why can we not have such transparency immediately? This has been the biggest burning political issue in the regulation of the internet in the last two years. Why is it that you have only started to provide such transparency in a limited number of jurisdictions? I would like to see it introduced in Ireland before Christmas.

Richard Allan

We have a team working on the deployment now. Again, the faster we can do it, the happier we will be, but I want to share some of the challenges around it. To those who are not as aware of the system, there are two key elements—three elements—to it. First, you can now go to any Facebook page and see the ads that are being run. That helps watchdogs. If you think a political party is running ads inappropriately, you can go to look and flag that. The second element is authorisation, which is where we check that, if you are an advertiser, you live in the country, and we ask you for some identity documents to check that you are who you say you are—know your customer. The third element is an ads archive. Now, if you run ads as an authorised advertiser, they go into the archive. That is the system we are building. It is actually quite challenging, and doing the authorisations is difficult—understanding what constitutes the right kind of legal documentation in every country in the world, and doing that reliably. We have a roll-out plan and we are going as fast as we can. On the archives piece, for example, we found that one of the things that you need is to allow for who people are and who they are campaigning for, but there are no central databases. There is nothing for us to consult, so we built a team who are sitting there now—we are working on the UK implementation. We found that people try to game the system and put false information in, so we built up a team who are sitting there checking when someone puts information in whether they are really that political entity. This is hard, but we are doing it—we are committed to doing it but it is taking us some time.

Eamon Ryan

Mr Zuckerberg, in his presentations to I think the European Parliament and to Congress, indicated that the company Facebook would be applying the GDPR standards in its global business on the platform across the world. Is that the case?

Richard Allan

Yes. The system that we built we believe is GDPR compliant, and it is the system available everywhere.

Jo Stevens

Lord Allan, can I take you back to November 2009, which I think is the date when Facebook users had what is called a central privacy page, and the Facebook text on that page says, “Control who can see your profile and personal information”. In November 2011, the US Federal Trade Commission, or FTC, made a complaint against Facebook on the basis that you allowed external app developers to access information about Facebook users’ personal profile and related information. Can you tell us when Facebook made changes to its own architecture to prevent developers from receiving that information, which actually circumvented Facebook users’ own privacy settings?

Richard Allan

The change in the OPI, as we have discussed, was 2014. I just want to be clear that my understanding of the FTC settlement—I was with the company through that period—is that the FTC objected to the idea that data may have been accessed from Facebook without consent and without permission. We were confident that the controls we implemented constituted consent and permission—others would contest that, but we believed we had controls in place that did that and that covered us for that period up to 2014. Again, Mr Ryan mentioned this—why would anyone want this information? I just want to explain, and again you can disagree. The notion at the time was that something like a calendar with your friends’ birthdays on would be useful to you as a third party application. That required accessing the birthdays of your friends. The notion was that being able to have photo montages and collages and things with photos that your friends had shared with you and agreed to share with you would be helpful. Customs have changed over time, but I want to be clear that the idea behind this was not malicious; it was intended to add value.

Jo Stevens

Am I right that if I had gone on Facebook and set my own bespoke and customised privacy settings, it didn’t really matter, because Facebook just overrode them?

Richard Allan

No, you had a setting that said, “I do not want my data to be accessed by applications that have been installed by my friends”. That setting was there and you had the choice to say no if you didn’t want your data to be accessed—

Jo Stevens

How did that work? How was I told, or how was somebody using Facebook actually told that?

Richard Allan

It was within the privacy settings and there were a series of check-boxes you could check.

Jo Stevens

Okay. You said just a few minutes ago that there is non-Facebook user data sitting on Facebook’s servers.

Richard Allan

Yes.

Jo Stevens

What do you use it for?

Richard Allan

There are two main purposes. One is that if an individual has uploaded their contact list, it sits in their accounts; I have a list of the emails of my friends. When one of my friends joins the platform, the fact that we know that allows us to make the connection. And again, that is not unique to Facebook and is quite common practice across all services. The second element is that our logs of IP addresses—internet addresses—are used mainly for security purposes. Mr Collins referred earlier to the idea of people pinging us from different IP addresses. Having a log, and understanding where people are coming to our service and trying to access data, helps us from a security point of view. That is the primary use of it.

Jo Stevens

Do you make any money out of the non-Facebook user data that you hold?

Richard Allan

No. There’s no advertising; Facebook advertising is served to Facebook users.

Jo Stevens

Okay. Can I go back to my starting questions again? After the FTC consent decree, which I think was in 2011, did Mark Zuckerberg know that Facebook continued to allow developers access to that information—after the agreement of the decree?

Richard Allan

Yes. He knew and all of us knew that the platform continued but, as I say, we did not see that decree as a prohibiting platform—platform is the technical word for this ability of developers to connect. As long as we had the correct controls in place, that was not seen as being anything that was inconsistent with the FTC consent order.

Jo Stevens

And did you have correct controls in place?

Richard Allan

We believed we did, and again I think the FTC is investigating these issues and I am sure they will form their own view on whether or not that was correct. But we believed that our platform was entirely legal and proper, and consistent both with European data protection law, as exercised by the Irish Data Protection Commission, and with the FTC consent order.

Jo Stevens

So you believed that it was subject to those laws? Was there any other regulation, or was that self-regulation you were applying in those circumstances?

Richard Allan

Those are the primary legal structures that govern us as a US company and as a company that is established in Europe—in Ireland. Unlike many other services, we accepted—again, I do not expect huge credit for this—that we had a duty to comply with European data protection law through that establishment in Ireland.

Jo Stevens

That is very good of you.

Richard Allan

I do not expect credit; it is just a technical point.

Jo Stevens

I go back to my original point about people not understanding—or not knowing—that when they set their privacy settings, they were being overridden. How many of the 2.2 billion global users of Facebook have been affected by those privacy violations? I feel that it is a privacy violation—I did not know that my customised settings could be overridden.

Richard Allan

I do not believe that that is the case. The settings and the controls that you had would have governed the way that your data was used. You had controls on a whole range of things, from sharing with just third-party apps to a control for, “Hey, I don’t want any apps to be installed or to have access to any of my data”. So those controls were there. There are very valid questions about how well people understand the controls and whether they are too complex. One of the things that we have focused on recently is trying to simplify the controls.

Jo Stevens

We are talking about 2009. We are nearly 10 years on. Now you are starting to simplify?

Richard Allan

There have been repeated attempts. The way that this tends to happen is, as the system becomes more complex, we add more and more controls. People feel it has got too complex, we simplify it, and then repeat. Over the years we have had various attempts to simplify the controls and make them really straightforward but, either because a regulator asked us to add an extra control or because the system needs an extra control, they become more complex over time, and we go through that cycle again. Our intention is that you should not be surprised by the way your data is used. Our intention is that it is clear and that you are not surprised. It is not a good outcome for us if you are.

Clive Efford

Richard, you are a Member of the House of Lords and you said earlier on that you apologise for Mark Zuckerberg’s decision not to appear here. You took responsibility for that. How do you think that looks as a Member of Parliament?

Richard Allan

Not great. In my job, I have two roles. One role is as somebody who is very involved in the UK political scene and I respect Parliament and the people who have travelled here today for this hearing—I think it is important that we have this kind of engagement. I also have a role supporting my company as it tries to grapple with the issues we are talking about today and I understand, as we try to work out where senior officers of the company should be, that we need to balance this up. I am proud of the fact that we have answered thousands of questions—if not always to your satisfaction—and appeared as a team in front of many Committees around the world.

Clive Efford

Let us move on. Can you give us an overview of your understanding of the founding philosophy of the Facebook platform?

Richard Allan

The core philosophy of the Facebook platform, and I hope I touched on this earlier, is that we have a very useful tool in this connectivity between over 2.2 billion people around the world—historically that was several hundred million—and that there are people who wish to build applications that add value for the users of that network with things that we are not going to do that they can. If the developers do those things, everybody wins out of that equation. That is really the core philosophy. We get more engagement on the platform—we are a business and we want engagement. We are not going to shy away from that. We provide a useful service but one where engagement matters. The developer does not have to build their own social graph, so they can get up and running much more quickly, and the user gets additional features.

Clive Efford

What was the purpose of platform simplification PS12N?

Richard Allan

I do not recognise the term “PS12N”.

Clive Efford

We were told that you are here to answer questions for Mark Zuckerberg, so how come you cannot answer that one?

Richard Allan

I do not recognise the term.

Clive Efford

Platform simplification seems to have been a way of selecting which apps can access APIs on the Facebook platform. Can you tell me what a whitelisting agreement is?

Richard Allan

The way that the platform has evolved is that generally speaking, it is an open platform. People can build applications. As long as they meet the terms, they can access it. Some services are particularly valuable, and you can think of them—the other major name brands in internet services that might want to integrate with ours that provide music or video. I think it is right that we be more open to access from services that are significant name brands, adding a lot of value to our platform. Whitelisting, as I understand it, means that there are services that add particular value and have particular status.

Clive Efford

Do you have any in-depth understanding of the criteria by which apps are given access to APIs under a whitelisting agreement?

Richard Allan

Again, I want to be clear: this is normal commercial activity that would take place on any internet service. People show up, meet your terms and conditions, sign up and access your platform. Then there are large entities, which are typically other large, reputable companies—the kinds of companies you might use yourselves. When they come to you, you have a conversation, and there may be particular terms for your arrangement with those companies. This is not unique to Facebook and not unusual, and the intent is to add value for the users. These companies provide services that are more valuable to our users than the run-of-the-mill services, and also have more infrastructure. For example, on issues such as data protection, they are companies that have significant data protection operations themselves and can be trusted to be more reliable with the data they hold.

Clive Efford

Is one of the criteria for that sort of whitelisting agreement the ability to buy large quantities of mobile advertising through Facebook?

Richard Allan

No.

Clive Efford

We have seen evidence that suggests that is the case, but as far as you are concerned it is not the case?

Richard Allan

No.

Clive Efford

So when PS12N came into operation on 30 April 2015, no apps were shut down on the basis that they could not pay a large sum of money for mobile advertising?

Richard Allan

No. I will make sure we come back to you on that, but my understanding is that the platform continues exactly as it always has. Developers should be adding value to the platform—that is the primary criterion—and meeting all of our terms, including those around data. They may choose to buy advertising; they may choose not to buy advertising. That is their decision.

Clive Efford

Has Facebook ever targeted a tech developer on its platform to close down its operations so that Facebook itself can move into that area and make money?

Richard Allan

No, not that I am aware of.

Clive Efford

These decisions are made at a level within Facebook that it appears you do not operate at, which is why we need to speak to Mr Zuckerberg to get the answers to these questions. He seems to be the source of these decisions within Facebook. Do you know what the effect of privatising APIs in 2015 was?

Richard Allan

I want to be clear about what was happening at that stage. A transition from desktop to mobile was going on. I believe you are referring to documents that were obtained, as Mr Collins described earlier, which are partial documents selected deliberately to be hostile to us.

Clive Efford

So you know what is in those documents?

Richard Allan

I am aware of the documents, yes. Again, I want to hopefully help the Committee by setting some context. In 2014 and 2015, there was a transition from desktop to mobile. That meant that every business—ours and everyone else’s—had to think about what the new business models were for this mobile environment. In the old desktop environment, if people remember it, there were games like “FarmVille” that could be installed in your web browser on Facebook, and we had a business model for working with those kinds of developers—Zynga was the name of the “FarmVille” developer. In 2014-15, people started using mobile, and now the control of a lot of the monetisation was in the hands of the app stores, which decided how you could or could not interact with them. All companies, including Facebook, discussed at that time what the new business models would look like. I suspect you may have some partial records of some discussions of business models, but I do not think it is fair to draw definitive conclusions about what we did. What we did was carry on a model within which developers could access Facebook if they met all of our terms and conditions, and they were free to choose whether or not to buy our ads.

Paul Farrelly

Before we move on and I follow up with a few questions along Clive’s lines, regarding Damian’s earlier question about the email from the engineer and the Russians and the 3 billion data points, did you undertake to provide us with an answer?

Richard Allan

I will provide an answer.

Paul Farrelly

As to whether that was reported to any external agency or authority?

Richard Allan

I will look into the claim that was made and provide you with information about what we believe around that claim.

Paul Farrelly

It has been a bit busy here with Brexit, so I have not been through all these documents either, by this so-called hostile litigant. Just so that I can understand, this firm—Six4Three—what is their beef with you? What were they doing and why did you shut them out?

Richard Allan

The irony in the context of the current discussion is that their beef originated from us precisely making the change that I think you all want us to make. Their application, as I understand it, depended on access to friends’ data. When we changed the API—the method of access—they lost access to the friends’ data so therefore their application no longer worked as they had intended and they began a succession of law suits against us. In trying to restore the access, they want us to reverse this, so that people can access friends’ data again.

Paul Farrelly

What was their app doing?

Richard Allan

I was not a user. I understood it was installed 4,500 times and it promised to help you find photos of your friends wearing bikinis.

Paul Farrelly

I saw that someone from Facebook called that “sleazy”.

Richard Allan

No, that was descriptions that were in the press at the time.

Paul Farrelly

I find the descriptions ironic because of the way Facebook started at university.

Richard Allan

I don’t think it involved bikini photos, but I get your point.

Paul Farrelly

I understand why you might want to pursue anti-SLAPP orders and protective orders in court so I am not going into the whys and wherefores, but it begs the question of what Facebook has to hide.

Richard Allan

If you want to have a discussion with us, as I have tried to do today, about the way in which decisions were made around platform, I think we can have that discussion without leaking all the internal conversations we have going backwards and forwards. In the same way in your businesses you will come up with a new political policy, there will be a lot of heated debate behind that and people will say things.

Paul Farrelly

It is a relevant question to ask what Facebook has to hide.

Richard Allan

My answer is I don’t think that we have a duty to put into the public domain all our internal discussions around an issue. It is appropriate for us to respond on how we settle that issue—the decision we came to—but I don’t think it is reasonable that we should share, any more than you should, internal discussions that can be quite robust.

Paul Farrelly

So you have nothing to hide?

Richard Allan

In terms of what we did, no. In terms of are we comfortable airing all those internal conversations, all the robust comments that people may have made in those conversations and have those treated as the company’s official position, I don’t think that is fair.

Paul Farrelly

I have read a summary document that has been circulated and which is public information because it has been filed in court. It refers to the background to the FTC consent order in 2012. To what extent has Facebook complied with that order?

Richard Allan

We believe we have complied with it. We had to take a whole series of actions but, as you may be aware, the FTC has indicated that it wants to have another look on the back of the same issues that we have been talking about here.

Paul Farrelly

As far as you are concerned, you fully complied with it?

Richard Allan

As far as I am concerned, we believe we fully complied with it.

Paul Farrelly

From something I have read—you may call this partial, from a hostile litigant—the allegations against Facebook go beyond tough and sharp business practice to maximise revenues, cherry-pick purchases—Onavo, WhatsApp, Instagram—beyond interstellar data gathering, but really extend to crushing competition. At every point in this summary, I wrote down four letters in the margin—RICO, which you will be aware of: the Racketeer Influenced and Corrupt Organisations Act. Is that a fair thought to have in my mind?

Richard Allan

Not at all. There are two ways you can characterise our company. The litigant is clearly characterising it one way and you have reacted similarly. The other way to characterise the company is as a group of people who I have worked with closely over many years who want to build a successful business. They want the business to do good in the world. At the same time, they want it to be successful and grow. I don’t think there is anything fundamentally conspiratorial about that. They make the same kind of decisions that any business would make in order to be successful in what is a highly competitive space. You know the internet space—

Paul Farrelly

I didn’t use the word conspiratorial. I was just going to use the word conspiracy because RICO covers that—conspiracy to damage someone’s business or property. Has anyone approached Facebook, to your knowledge, about filing a RICO suit against it?

Richard Allan

Not that I am aware.

Paul Farrelly

Has Facebook ever prepared the ground and taken advice on how it would defend a RICO lawsuit?

Richard Allan

Not that I am aware.

Paul Farrelly

Perhaps if it has, you could let us know. I shall follow up with one final set of questions on the Mainstream Network. You must have seen the evidence that was given to us about ads being run by the anonymous Mainstream Network. I have just tried to see whether they have any ads running now, and it does not appear that they have, so what have you done?

Richard Allan

Again, for those who are not so close to it, this is an entity that created a page on Facebook and ran ads described as, “Chuck Chequers”, which in our British parlance means, “Reject the Prime Minister’s Brexit deal”. As soon as there was press attention on that organisation, precisely because it is now transparent where the ads are being sourced from, they stopped running ads. Our understanding, unless anyone here wants to correct me, is that there is nothing today illegal in the United Kingdom about an organisation running those kinds of ads. It would be very interesting—I know the Committee’s recommendations touch on this—to understand whether or not that should change in the future. As of this week, any organisation that wants to run ads like that will have to authorise. We will collect their identifying information. They will have to put on an accurate disclaimer. Their ads will go in the archive. The deterrent effect seems to be working, in that this organisation, once there was press attention and once we brought the new tools in, have stopped their advertising activity.

Paul Farrelly

To have a page like that, what details do they have to file with you?

Richard Allan

To set up a basic Facebook page, they need to have a valid Facebook account. If we believe it is a fake account, we will shut it down and shut the page down. But if it is you, and it is your legitimate Facebook account—

Paul Farrelly

Do you know who is behind the account?

Richard Allan

I don’t personally know who is behind it.

Paul Farrelly

No—does Facebook know who is behind it?

Richard Allan

We would know whose Facebook account it was, and if there were an investigation by an entity that can legally require information, we would provide information in line with the normal procedures.

Paul Farrelly

My final question: in the interests of transparency, because an election could happen at any time here in the UK, when you go away, could you tell us who is behind that account, and if you cannot tell us, write to us and tell us why?

Richard Allan

Yes; I will write to you either way.

Chair

Hildegarde Naughton.

Hildegarde Naughton

Earlier this year, we held a referendum on abortion in Ireland. Both Facebook and Google stopped all advertising in relation to that referendum. That action was very much welcomed by the Irish Government at the time. My question is, is not that action an admission by your platform that it is used to disseminate fake news and to influence elections?

Richard Allan

That was a very specific response. Again, I was part of the decision-making process and I am glad that you welcome the ultimate decision. What we saw was that there is a very good non-governmental organisation, the Transparent Referendum Initiative, who were flagging to us clear evidence that there were significant amounts of money being spent by organisations on both sides of that debate from people outside of Ireland. We then needed to make a decision. Irish law, as I understand it, is silent on the matter. It says that foreigners must not fund Irish political parties, but it doesn’t say anything about them spending their own money projecting stuff in—I assume, reasonably, because when the law was written there was local TV and radio, so it was all controllable and our systems did not exist. Because of that silence, we needed to interpret what we thought the intent or spirit of Irish law was, and we took the decision that projecting material in from outside Ireland was something we would not allow. We are now very interested in the debate on C-76, the new law proposal in Canada, which has this explicit provision on preventing outside interference, and I think you also have legislation in front of you. That was the rationale for the decision. We tried to understand what the spirit of Irish law was, having to make a pretty binary yes/no decision. We are not comfortable; we would much rather that there is a legal framework that we can stick to where you have made those decisions.

Hildegarde Naughton

The threat was there. I know you cannot speak for Google, but it was Google and Facebook that made that decision during the referendum campaign to stop all advertising. Would it be fair to say that there was a threat that there would be fake news disseminated through your platform, and that there would be interference in the electoral process?

Richard Allan

For us, this was not a fake news question, as much as a straightforward political campaigning—

Hildegarde Naughton

There was potential for that to happen.

Richard Allan

It was election interference, as in someone was spending that—

Hildegarde Naughton

Yes—election interference. That is why the ads—

Richard Allan

A lot of the ads were “Vote yes” or “Vote no”. They were not fake news as such; they were just a straightforward political view.

Hildegarde Naughton

But the concern was that there was political interference.

Richard Allan

Yes.

Hildegarde Naughton

As I say, the Irish Government very much welcomed that. You made reference to legislation. We have two private Members’ Bills going through the Irish Parliament at the moment, and both Facebook and Google have come before our communications Committee in the Oireachtas and engaged constructively with our Committee in relation to that. One is a private Member’s Bill, the Digital Safety Commissioner Bill 2017, which would provide a take-down power to a regulator. The second Bill that we are looking at is the Online Advertising and Social Media (Transparency) Bill 2017, which would ensure that when you were viewing an ad, you would know who was paying for it. In light of the fake news and the data breaches that your company has been involved in over the past two years, do you accept that Facebook needs to be regulated through legislation like this?

Richard Allan

Yes. We very much welcome the updating of election law. Again, it is not to be critical, but many of the laws governing political communication were drafted pre-internet. They have things like bans or restrictions on certain forms of campaigning, but they are behind the times. We have seen some very interesting developments. In Brazil, I understand that the responsibility is put on the political actor. They can only use a service if it has the transparency tools. If they don’t do that, the political actor is in trouble. I understand that Canada is doing something similar around disclaimers and is also putting responsibility on the platform. You set the rules for your elections—it is not us—but to the extent that this is all clarified and we have a simple playbook to work to, that would be extraordinarily helpful.

Hildegarde Naughton

Thank you for that. The root of this—this is our concern—is that there is a lack of regulation of social media right across the board. It is not just Facebook, just to put that on the record. Our colleague is not here today, but Australia has its own Digital Safety Commissioner, and my understanding is that that process is working very well because of the engagement with social media platforms. I think I am correct in saying that the Digital Safety Commissioner in Australia has not needed to actually fine social media platforms because of the engagement process. I think people are listening and watching and citizens across the world, who we all represent, want to hear Facebook’s view on regulation. Are you serious about regulation on a global level? We are all here internationally representing countries across the globe. We need to regulate on a global level. What is your view on that?

Richard Allan

Absolutely. Again, to be very clear, my view is that the best outcome that we get for people—our users and your constituents, who are the same people—is where we are working together on this. I have tens of thousands of colleagues who are deeply committed to trying to protect the safety of our users. These are people who get up every morning and worry about what is happening on the platform and try to prevent harm. It is now tens of thousands. It used to be too few, and we accept that. The best way that we can ensure safety is where we are able to be very open with Government about the problems we are seeing and have a very informed debate, and where we can work together on what the solutions are. Some of the solutions are on our platform. We can throw people off and we can collect information—there are certain things that we can do. Some of them absolutely need regulation. If somebody is a threat to children, us throwing them off Facebook is not enough; they will go somewhere else. We need then to work with the authorities to prosecute them. The UK Government has an intended White Paper for next year that we will work with them on. As you say, we are working with you and with other Governments. The team I run does a lot of this work. We have recently announced that we will work with the French Government and bring regulators in and try to develop new regulatory models, whereas ideally we get experts in areas such as child safety, we get experts in technology, like us, and we get experts in the law and people who represent the users from the political world working together. That is where we think we will get the best outcomes.

Hildegarde Naughton

I think it is human nature where there is no regulation, no oversight and no watchdog, be it in business or an organisation, you need to have that oversight. Would you agree, in the case of Facebook and other social media platforms, that you also need that regulation on a global level?

Richard Allan

Absolutely, and that is our expectation: that we should be accountable for you, we should tell you what we’ve done, and if you’re unhappy you should have the power to take sanctions against us. I completely accept that principle.

Hildegarde Naughton

We have agreed here maybe to look at consulting how we would set out a set of rules at an international level, be it through the United Nations or at OECD level, and that would be very positive. I hope we can continue this work, Chair; I will take this opportunity to thank both Canada and the UK for coming together to co-chair this meeting. I think this is the start of an important process, and that we can all work together to ensure that there is momentum now for regulating social media and work together on that.

Chair

Thank you; that is a perfect segue to Nathaniel Erskine-Smith.

Nathaniel Erskine-Smith

Thank you very much. The chair beside you is noticeably empty, Mr Allan, so I want to start with a statement from Mark Zuckerberg. He says, “We didn’t take a broad enough view of our responsibility, and that was a big mistake. It was my mistake, and I’m sorry.” Do you agree with that statement? Do you think Mark Zuckerberg was genuine in making it?

Richard Allan

Yes.

Nathaniel Erskine-Smith

So just not sorry enough to appear himself before nine Parliaments. Taking a broader view of responsibility, does that include the failure to sufficiently prevent election interference, including in 2016? If you were to take a broader view of responsibility, that would have meant taking more steps to prevent election interference. Is that fair?

Richard Allan

Yes.

Nathaniel Erskine-Smith

Okay. On the failure to sufficiently prevent the spread of hate, including in the Rohingya genocide in Myanmar, if you are to take a broader view of responsibility, Facebook would have taken greater action to prevent hateful content on its platform. Is that fair?

Richard Allan

Yes, and I think we have acknowledged those issues publicly.

Nathaniel Erskine-Smith

So on the failure to prevent the creation and approval of problematic targeting audiences—for example, 168,000 people under the category of white genocide conspiracy theories—if you were to take a broader view of responsibility, you would prevent the creation of such audiences. Is that fair?

Richard Allan

Yes, and we do today.

Nathaniel Erskine-Smith

Okay, so was Facebook malicious in any of this conduct?

Richard Allan

Again, that is not my experience. The people I work with are sincere about building a service that they believe offers value to people, and we believe that in most cases we do that. We have recognised that we are doing something new, so we hit new problems.

Nathaniel Erskine-Smith

So the failure to take that broader view of responsibility was not malicious, is my point—it was negligent.

Richard Allan

Again, there were things that we missed, that we were either not sufficiently focused on or too slow to react to. On the examples you have cited, we have said that. Take the specific example of the Rohingya and the situation in Myanmar: we should have hired more Burmese speakers to review Burmese-language content earlier. We have now done that.

Nathaniel Erskine-Smith

It sounds like you would agree that it is not malicious and it is negligent. I want to briefly touch on reciprocity; this is new information for me, but I reviewed it recently. Did Facebook ever make the purchase of mobile ads a condition for developers’ continued access to friend data?

Richard Allan

No.

Nathaniel Erskine-Smith

Okay. Did Facebook treat developers’ APIs differently if they had purchased mobile ad product?

Richard Allan

I am not aware of that; again, that is a very specific question that I would need to look into.

Nathaniel Erskine-Smith

Would Mark Zuckerberg have an answer to that question?

Richard Allan

I am not sure he would; I am not sure anyone would. I need to understand the very specific—

Ian C. Lucas

I think he would.

Nathaniel Erskine-Smith

You probably should answer that question to this Committee at a future date. Perhaps Mark Zuckerberg could. Did Facebook ever tell app developers that they needed to start buying Facebook’s mobile ad products or their access to friend data would be cut off?

Richard Allan

Again, taking a step back, you are quoting, I know, from the emails that have been circulated—

Nathaniel Erskine-Smith

I am not. Richard Allan—or you are discussing information that was shared within those emails.

Nathaniel Erskine-Smith

I am not.

Chair

There has been no disclosure. To be really clear, for the record, there has been no disclosure outside the DCMS Committee of any of the information contained in the emails.

Nathaniel Erskine-Smith

I will again ask: did Facebook ever tell app developers they needed to start buying Facebook’s mobile ad products or their access to friend data would be cut off?

Richard Allan

No.

Nathaniel Erskine-Smith

Did Mark Zuckerberg ever cancel an announcement to implement API restrictions, including friend data being publicly removed? Is that something that Mark Zuckerberg ever did?

Richard Allan

I am not aware; I would need to check.

Nathaniel Erskine-Smith

Mark Zuckerberg would be able to answer that question, though.

Richard Allan

The announcement of a cancellation of a development—do you have a timeframe?

Nathaniel Erskine-Smith

Well, it would presumably have been before 2014, I would expect. I don’t know that answer; you don’t know that answer. Mark Zuckerberg would know that answer.

Richard Allan

Not if it was before 2014. I think he, like me, would have to check.

Nathaniel Erskine-Smith

I want to get this into a Canadian context. In 2009, the Office of the Privacy Commissioner was part of an investigation and a settlement. They flagged for Facebook the question of unrestricted sharing of friend data with app developers. Are you aware of that?

Richard Allan

Yes.

Nathaniel Erskine-Smith

Okay. So in 2009 it was flagged as an issue, but it was not addressed until 2014. Why the five-year gap?

Richard Allan

Again, I hope I was clear in response to an earlier question that our understanding was that this was not illegal—

Nathaniel Erskine-Smith

Okay, great—I am glad you have said that, because the Canadian law requires meaningful consent. We don’t know each other, Mr Allan, but let’s assume that we are friends on Facebook. Is it your view that when you agree to use an application, the fact that I have failed to go into my privacy settings and check a box means that I have given meaningful consent to Facebook to allow you to share that information? Is it your view of the law that that is meaningful consent?

Richard Allan

Yes. Again, just to clarify, when you signed up for Facebook—

Nathaniel Erskine-Smith

Not in Canada!

Richard Allan

Again, to be clear, these issues have been contested. They were contested then and they will be contested now. Our view is that when you signed up for Facebook, we were sufficiently clear that part of the package of signing up for Facebook was that it is a social experience—the clue is in the title, “social network”. As part of the social experience, when you share information with your friends, your friends may share it on. Remember, as soon as I share a photo with you—we are friends now—you can take that photo and do what you like with it.

Nathaniel Erskine-Smith

And why would I object to your using Farmville and all my information being shared with the Farmville app developer? Why would I object to that?

Richard Allan

It’s not all information.

Nathaniel Erskine-Smith

Let’s talk about Cambridge Analytica. In the Canadian context, 270 people used the “This Is Your Digital Life” app.

Richard Allan

270,000?

Nathaniel Erskine-Smith

No, 270 people.

Richard Allan

In Canada?

Nathaniel Erskine-Smith

In Canada.

Richard Allan

Right.

Nathaniel Erskine-Smith

And 620,000 had their information shared with the developer. Is that acceptable to you?

Richard Allan

The sharing on—the use of that data—was wrong. A benign application like the one I have described, where I sign up for it and pull in all my friends’ birthdays into my birthday calendar, would be okay. That was the intended use.

Nathaniel Erskine-Smith

Okay, but it was every app developer. It wasn’t this specific birthday app or that specific calendar app; it was every application. It was a rudimentary application to make a cow jump, it was a Farmville application—it was Cambridge Analytica. The idea that you can point to a calendar app and say, “Therefore we share all information and all friend data with every app developer”—how is that acceptable to you?

Richard Allan

Not all data.

Nathaniel Erskine-Smith

I said “all friend data”.

Richard Allan

Not all data of all friends. Applications needed to ask for permission. You can argue that this was not sufficiently well enforced, and we can have that discussion, but we said very clearly in our terms, “If you are an app that is running a birthday calendar, you can ask for birthdays. You can’t ask for photos and all this irrelevant material if that is not the intent of your app.” GSR went outside that framework.

Nathaniel Erskine-Smith

“This has been a tough time at Facebook…While these are hard problems we are working hard to ensure that people find our products useful and that we protect our community from bad actors.” That is a recent statement from Facebook. Has it occurred to you that in relation to privacy, Facebook might be becoming one of these bad actors?

Richard Allan

I don’t believe we are.

Nathaniel Erskine-Smith

Okay. With respect to accountability and legal liability, you have supported the Stop Enabling Sex Traffickers Act. Should Facebook be accountable for all illegal content that is produced on their platform and not taken down within a reasonable period of time?

Richard Allan

I don’t think that the internet will be well served by removing all intermediary liability protections, but I do accept, as you saw with SESTA, that the idea that we are exempt from everything is also out of date. To go back to Ms Naughton’s question, we need to get to the right balance on where our responsibilities lie.

Nathaniel Erskine-Smith

The last thing I will say goes back to the idea of trust. We don’t have Mr Zuckerberg here today, which is incredibly unfortunate. I think it speaks to a failure to account for the loss of trust across the globe with respect to Facebook and its users. It was not until recently that you started to notify Canadian users that their information was shared in a Cambridge Analytica context. A sense of corporate social responsibility, particularly in the light of the immense power and profit of Facebook, has been as empty as the chair beside you. Thanks very much, Mr Allan.

Rebecca Pow

You are welcome to our Committee, Lord Allan. I want to pick up on some quite general points. A recent article in The New York Times said that Facebook “ignored warning signs and then sought to conceal them from public view” and mentioned allegations that Facebook had had power to exploit and disrupt elections, broadcast propaganda and inspire hate campaigns. What is your view about that? Do you agree with those allegations? They are quite outspoken.

Richard Allan

My own view is that I thought the article, which obviously I read, mischaracterised discussions and people that I have engaged with over the last two years. We are careful about when we release public information. We try and understand how it is going to land. In particular, in the context of some of the issues that they referred to in that article, there is no point in publishing a piece of security information if everyone is going to allege that it is partisan and dismiss it. We do have robust internal discussions about the release of information, but actually I think we are ahead of the game in terms of the amount of information that Facebook publishes, which I think is actually significant compared to what you know about what is going on on the internet generally.

Rebecca Pow

So regarding the fact that personal data from 87 million people was harvested and then potentially used in the Trump campaign, you are saying that you didn’t act on that, you didn’t react—you think none of that is relevant.

Richard Allan

No, and we have acted on it. They were the original set of accusations, which I think we discussed earlier and were reported in the Guardian, whether actually the Ted Cruz campaign, I believe it was, had contracted with Cambridge Analytica, who had contracted with the company GSR. That was the original set of allegations. It was in the public domain. We took steps, as we have explained to this Committee, to try to ensure that any data that had been obtained had been destroyed. We received those assurances. I understand that people are not satisfied with the fact that we only got written assurances, but we thought we had done the right thing around that incident.

Rebecca Pow

I know that members of the public, when they are watching or listening to this very complicated saga that is ensuing, would be forgiven for thinking that Facebook’s main aim was really all about expanding its business and the value of its shares, and that potentially that has been put above public safety.

Richard Allan

I would contest that characterisation. I do not want to hide the fact that we are a business. We offer an amazing service to millions of people around the world, which we are able to do for free because we have this ad-funded model. We are doing that with a mission. We have a purpose. We want our service to be good, we want it to be useful and we want it to be safe. As we have discussed repeatedly today, we don’t always get that right, but our objectives are very clear. We want a service that is useful and engaging, and that lots of people want to take up, and we want it to be successful.

Rebecca Pow

I was interested to hear you say earlier, Lord Allan, that you said it was a win-win-win all round for everybody. I put it to you that lots of people might think now, hearing all the evidence that is coming out, that in many cases it is a lose-lose-lose.

Richard Allan

I would not characterise it that way. We are talking about some very specific, very important things that have gone wrong. I think that is right. We are not focused, because it is not so interesting for the purposes of this hearing, on the things that go right. The things that go right are millions of people connecting with you as politicians, with small businesses in their area, with brands that they love or with content that they love. They do that every day, day in and day out, and I think the value is there. I think the win-win-win is largely there. There are some specific issues we need to deal with. Some we need to deal with ourselves, and some will require regulation.

Rebecca Pow

It is a great pity that Mr Zuckerberg didn’t turn up, but on that note that you are making there, I believe that in a video conference to all his staff recently Mr Zuckerberg said that much of the criticism of Facebook over the last 18 months, relating to election security, content moderation and disinformation, had in fact been fair and important. Would you agree with that?

Richard Allan

Absolutely, yes.

Rebecca Pow

Perfect. He sounds quite confused, because in the next part of an article in The Times he said that a lot of the criticism had been unfair and untrue.