Facebook Says Cambridge Analytica Data Grab May Be Much Bigger Than First Reported

Updated at 6:40 p.m. ET

Personal information of up to 87 million people — mostly in the United States — may have been "improperly shared" with Cambridge Analytica, a data analytics firm used by the Trump campaign that has recently come under fire.

Facebook's Chief Technology Officer Mike Schroepfer gave the figure Wednesday at the end of a lengthy blog post outlining ways the social media giant is working to better protect user data.

Christopher Wylie, Cambridge Analytica's former director of research turned whistleblower, had previously said the firm accessed personal information of more than 50 million users.

The sharp uptick of users potentially affected comes as Facebook is undergoing intense scrutiny over how it protects — or fails to protect — the data of its more than two billion users.

Also Wednesday Facebook Mark CEO Zuckerberg confirmed he will testify before the House Energy and Commerce Committee about data privacy issues.

Facebook is urgently trying to convey that it is working to protect user information, even if it has been negligent in that regard before.

"It's clear now that we didn't do enough," Zuckerberg said to reporters in a call on Wednesday. "We didn't focus enough on preventing abuse and thinking through about how people could use these tools to do harm."

Zuckerberg says that harm includes "fake news, foreign interference in elections, hate speech, in addition to developers and data privacy."

He went on, "We didn't take a broad enough view of what our responsibility is and that was a huge mistake." Zuckerberg specified it was his mistake, but denied he had any plans to step down as Facebook's CEO.

As to why Facebook is only now saying 87 million people may have been affected after the 50 million figure has been widely reported for weeks, "We only just finalized our understanding of this situation in the last couple of days," Zuckerberg said.

Last month, Wylie spoke to multiple media outlets and portrayed Cambridge Analytica, his former employer, as excavating a massive trove of Facebook user data to try to steer voters on behalf of its political clients.

"They want to fight a culture war in America," Wylie told The New York Times of the company's leaders. "Cambridge Analytica was supposed to be the arsenal of weapons to fight that culture war."

Facebook conceded last month that Cambridge Analytica improperly accessed user information from some 270,000 users who downloaded an app developed by Alexander Kogan, a Cambridge University psychology professor, as well as the information of the users' unwitting friends. The social media company did not say at the time how many people were affected, but noted it was against platform policy for third parties to access user information.

Facebook said it learned of the violation in 2015 and was told by all parties the data was deleted but that it later learned that those assurances may have been false.

Zuckerberg told reporters Wednesday that it is no longer enough for Facebook to require and believe that developers are protecting information, "we actually have to ensure that everyone in our ecosystem protects people's information."

Among the changes Facebook says it is taking is to be more transparent about what apps people are interacting with, make it easier for users to see what information they have shared with those apps and make it easier for users to delete the apps if they wish.

Another step Facebook is taking: removing a feature that allowed users to search for a profile by entering a person's phone number or email address because "malicious actors have also abused these features to scrape public profile information," Schroepfer said in his post.

"Given the scale and sophistication of the activity we've seen, we believe most people on Facebook could have had their public profile scraped in this way," he said.

Schroepfer says more changes are coming "over the coming months" to better protect users' Facebook information.

"This is a big shift for us to take a lot more responsibility for how each of the tools are used," Zuckerberg said. "It's going to take some time and we're committed to getting that right."

For its part, Cambridge Analytica says it deleted all of the information it received from the company led by Kogan when it learned that its retrieval violated Facebook's terms of service.

Cambridge Analytica denies that any of the data "was used by Cambridge Analytica as part of the services it provided to the Donald Trump 2016 presidential campaign."

Copyright 2018 NPR. To see more, visit http://www.npr.org/.