Thread by @jason_kint

This is absolutely insane. Including that we haven’t heard from Congress today. If Facebook’s breach is seen as old news then certainly 500 million people’s personal data now being posted for free and everything the company failed to do to avoid this outcome is damn important.

https://twitter.com/carolecadwalla/status/1378979052116185089

It’s also worth noting that Facebook has argued to Canada, UK, even local US regulators that they have no jurisdiction over Facebook’s failures to protect its user data. So who the F is in charge here? ⬆️ so far America is allowing Facebook to wreck the world.

Here is the spin by Facebook comms shared across their team and pushed out aggressively to press over the weekend to gaslight whether this is news or not.

https://twitter.com/jason_kint/status/1379204670120464385

And the press, even those involved in prior reports, can’t keep up with Facebook’s data abuses. Old problem but resurfaced when your FTC relies on monetary solutions rather than fixing leadership and cover-up.

https://twitter.com/joetidy/status/1379142610946777094

good point, @ashk4n. Press, Congress should be leaning in hard on timing here. FTC's $5B settlement was announced 7/24/19. I want to know whether FB knew about this security lapse let alone breach when it signed the settlement? Did FTC Chair know about it?

https://twitter.com/ashk4n/status/1379109029327171584?s=20

Remarkable as Facebook was negotiating a $5B settlement for a breach of 87 million records covered up from PWC audit and public, they were in middle of an even larger 500 million record breach. State of R.I., now suing why FB was willing to overpay to settle, may have its answer.

Let's take a tour to see some accounts that were in the breach. Not sure the Pope will answer his phone number but go for it.

https://twitter.com/jason_kint/status/1379282931651334151?s=20

Adding here. If you want to check the breach, highly recommend @haveibeenpwned. As operator @troyhunt notes and @ashk4n, thanks to Facebook we now have a first global phone book. I’ll add it also set a 💣 to phone # isn’t personal data which was being made just a few years ago.

https://twitter.com/troyhunt/status/1379363990946521091

In related news, Facebook - and its friendlies - appear to still publicly be going with this message and spreading it. This won’t last.

Adding this here to keep in single thread. Appears Ireland DPC (lead data regulator in Europe for Facebook) is hearing something different. I don’t see how FTC settlement and this can co-exist without a cover-up.

https://twitter.com/jason_kint/status/1379425505108180992

For those who have noted your phone number was never included in your profile, reminder FTC complaint did include allegation that the 2-factor security process was abused by Facebook to microtarget ads at you.

If Ireland DPC was 1) informed the breach was prior to GDPR (May 25, 2018) then 2) FTC should have known when they settled all incidents prior to June 12, 2019 for $5B or 3) FTC signed the deal without Facebook telling them about this? 🤦🏽‍♀️

I point to the timeline because if Facebook told its EU regulator it fixed the issue April 4 2018, Zuckerberg also testified this six days later to @SenCoryGardner on April 10, 2018 so he may have wanted to mention the vulnerability even if it hadn’t been knowingly abused.

And they certainly would have had a duty to inform their users according to his testimony to @SenatorBaldwin on same date April 10, 2018 which is sort of core to the entire hearing and Facebook’s cover-up.

But now Facebook is feeding to the press they fixed the issue August 2019 which happens to be:
-15 months after GDPR enforcement rolled out
-one month after $5B FTC settlement absolving them of pre-June 12th harms
-two months before Zuckerberg testified this to @RepDean - watch.

I should add the April 26th, 2018 testimony by the CTO of Facebook. Listen careful to how he responds to @JoStevensLabour regarding a different data breach. Again, Facebook’s EU data regulator says they claimed to have fixed this other vulnerability ⬆️ a few weeks earlier.

Wow, this is some next-level BS even for Facebook. Their excuse is the equivalent to arguing that if I provide social security numbers to a bank and the bank gives me names for each of them then the bank didn’t actually reveal any social security #s. 🤦🏽‍♀️
wired.com/story/facebook…

I mean this is the crazy nonsense that Facebook vomited out in 2018 during testimony to @DamianCollins @CommonsDCMS in order to suggest Cambridge Analytica didn’t have Facebook’s data, FB data wasn’t sold and there wasn’t a “breach.”

https://twitter.com/jason_kint/status/1372265829425897477

Jackpot, though. This line confirms the issue was present in 2019 AFTER the June 12th get of jail free card that Facebook purchased for $5 BILLION and AFTER EU GDPR enforcement began on May 25, 2018. Time to start calling for investigations. Their word is garbage.

It’s important to realize Facebook is posting the above on its blog 4 days later and feeding “off record” language to press. The language is coming from people with zero credibility at this point due to their blindly protecting the company for years. Press should be digging in.

“It’s an audacious move for a company worth over $300 billion, with $61 billion cash on hand, to ask its users to secure their own information, especially considering how byzantine and complex the company’s settings menus can be.” vice.com/en/article/88a…