The Independent View: Facebook Reveals Breach

Facebook on Friday Disclosed that close to 50 Million Users had Account Data Compromised through a Security Vulnerability. The Social Media giant discovered the Issue on Tuesday afternoon and is still in the Early Stages of Investigating, according to a Company Blog post. The Vulnerability is Resolved and Facebook has Informed Law Enforcement, the Company said.

“The reality here is we face constant attacks,” Facebook CEO Mark Zuckerberg told Reporters during a Press Call this afternoon. “We need to do more to prevent this from happening in the first place. … We’re going to keep investing very heavily in security going forward.” He insisted Security has become "an arms race" for Social Media giants. "This is going to be an ongoing effort," He said.

This latest Revelation comes amid a year of brutal Public Relations battles for Facebook, which included Zuckerberg testifying for the First time before Congress. The Executive's Two-day Appearance before Senate and House Panels came in the wake of News that Trump-linked Data Firm Cambridge Analytica had Improperly obtained Data on as many as 87 Million Facebook Users.

That Incident already triggered a Federal Trade Commission (FTC) Probe that remains Ongoing. The Company in 2011 Signed a Consent Decree with the FTC that included Commitments around Keeping User Data Secure. Democratic FTC Commissioner, Rohit Chopra, signaled his Discontent with the latest Friday Revelation, writing on Twitter, “I want answers.”

The Irish Data Protection Commission is likewise “concerned." In a Tweet Friday, the Agency said, “At present Facebook is unable to clarify the nature of the breach & risk to users. We are pressing Facebook to urgently clarify these matters.”

Guy Rosen, the Facebook Vice President of Product Management who Authored the Blog post, said on the Call with Zuckerberg that the Company had already Contacted the Irish Data Protection Commission as well as the FBI about the incident.

Europe’s sweeping Privacy Rules, the General Data Protection Regulation (GDPR) that went into effect in May, require Companies to Notify the Irish Commission within 72 hours of becoming Aware of a Data Breach.

Of the latest Breach, Facebook on Friday said Attackers Exploited a Vulnerability involving a Feature known as “View As,” allowing Users to see what a Profile looks like to other Users. A "complex interaction of multiple issues" involving that Feature and Facebook's Video Upload Function allowed Hackers to Break into Accounts by effectively Stealing the Digital Keys that let Users stay Logged into Facebook without Reentering their Credentials, the Company said in its Blog post. The Vulnerability stemmed from Changes to Video Uploading that Facebook made in July 2017.

Since Discovering the Data Breach, the Company Reset the Digital Access Codes of the nearly 50 Million Accounts affected. It's also, as a Precaution, Resetting that Information for another 40 Million Accounts, meaning about 90 Million People will need to go through a Formal Log-In Process with Facebook now. They will get a Notification in their News Feed explaining the Incident. Facebook says No One should have to change Account Passwords.
“We patched the issue last night and are taking precautionary measures for those who might have been affected,” Zuckerberg said on the Press Ccall. “In the interest of transparency, we want to share everything we know now.”

He added that the Company doesn't know if any Accounts were Misused and said there’s No Evidence of any Users’ Private Messages being Accessed or anything Posted on Others’ Accounts but did Not Rule Out the Possibility. Rosen added on the Call that No Credit Card Information was Taken. He said the Company doesn't know the Attackers’ Identities or where they might be based.

Sen. Mark Warner (D-VA), top Democrat on the Senate Intelligence Committee, called the News "deeply concerning" in a Statement and Called for a Full Investigation. "This is another sobering indicator that Congress needs to step up and take action to protect the privacy and security of social media users. As I’ve said before — the era of the Wild West in social media is over," Warner said.

Rep. Frank Pallone (D-NJ 6th District), Ranking Member of the House Energy and Commerce Committee, made an even more Overt call for Legislation. "Enough is enough," He Tweeted. "It is time for Congress to pass comprehensive consumer privacy protections."

The Lawmakers' Comments come as Members of both Parties have called for Comprehensive Federal Privacy Legislation. The EU and California have already Passed their Own Wide-Ranging Data Privacy Laws.

Absent such Legislation, the Tech Industry at present still enjoys a broad Grant to Self-Regulate. Zuckerberg told the Senate Commerce and Judiciary Committees in April that he hoped to lead Company Efforts to make Facebook a Better Steward of User Data. “We didn’t take a broad enough view of our responsibility, and that was a big mistake,” He said. “It will take some time to work through all of the changes we need to make,” Zuckerberg added. “But I’m committed to getting it right.”