The upshot of Facebook’s grievous exposure of “product information” to the Russian’s Cambridge Analytica is that Zuck pulled out the loose change in the couch and they set aside some cash to pay whatever fine the Federal Trade Commission decides to impose.
On Wednesday, The Washington Post reported that the social network was in negotiations with the Federal Trade Commission over fines relating to the company’s misuse of user data in the Cambridge Analytica scandal. Around the same time, Facebook made it public that it was setting aside between $3 billion and $5 billion for the fine.
Let’s assume the fine is at the top of the range, $5 billion. It’s chump change to Facebook, which brings in around $15 billion in revenue per quarter. And that’s bugging the crap out of some people because they want Facebook to feel the sting, to hurt, to suffer, and while even $3 billion would probably be hard on most of us, not Zuck.
What does a good, meaningful fine actually look like? Would it need to wipe out one quarter’s revenue (roughly $15 billion)? Is a fine meaningless unless it’s recurring (penalties for every quarter or year since Facebook last settled with the F.T.C. for violating user privacy in 2011)?
What’s missing here is some minimal recognition of why companies are punished by fines in the first instance. What purpose is served? What are the legitimate reasons to impose a fine, and what reasons justify a greater (or lesser) fine? This is what questions look like in the hands of the people who take for granted that wrongs inherently demand punishment. And that’s long before reaching the problem of proportionality.
At the core of these hypothetical arguments is the large question of not only how to regulate Facebook but of how to conceptualize an entity that operates largely without meaningful competitors and collects troves of information on more than two billion human beings. Facebook — alongside Big Tech counterparts of Google and Amazon — is operating at a vast scale. As such, any meaningful attempts to hold the company accountable should be equally disruptive, to borrow a Silicon Valley term of art. That the F.T.C. is negotiating what appears to be a trivial fine, suggests that the organization isn’t just deferential to Facebook, but that it doesn’t truly understand the company’s power.
What Charlie Warzel means when he calls $5 billion a “trivial fine” isn’t that it’s a trivial amount of money, given that it’s enough to bankrupt most businesses and individuals in America, likely Warzel included. But that tech giants, being tech giants, need to be tamed by the government to comply with its dictates, and so he reaches out to renowned legal theorist code monkey Anil Dash for answers.
“We don’t have a good regulatory framework [for Facebook] because this kind of scale and impact is unprecedented. And our ideas for remedies, things like fines, are based on an outdated view of how markets work,” the Glitch C.E.O. and longtime developer, Anil Dash, told me.
I’ve engaged with Dash in the past, something about either extra whip in my latte or his outrage that J.K. Rowling didn’t write Harry Potter to look like him.
“The F.T.C. is based on the premise of markets where consumers have choice,” Mr. Dash continued. “As long as their remedies are conceived of within that outdated framework, it will remain structurally impossible for them to hold any major platform accountable in any meaningful way.”
If Dash had any grasp of the subject matter, he might have used the word “deterrence” instead of “markets,” if only because he’s talking about fines rather than some jealous view of market share.
Don’t believe the critics? Then just ask the market. As BuzzFeed News pointed out on Wednesday, in just one hour of after-hours trading after signaling its impending $3 billion to $5 billion fine, Facebook’s market capitalization increased by $40 billion.
Which means that most fines likely to be considered by the F.T.C. might amount to what Matt Stoller, a fellow at the Open Markets Institute, described to me as “a parking ticket and a news release.”
Facebook has to sell a lot of click ads to earn $5 billion, but what it told the markets is that the fine won’t bankrupt the Zuck or its other shareholders. Was it supposed to? Was the point of the fine to cripple the company, bring it down?
David Carroll, a professor at the New School, who took legal action against Cambridge Analytica in the United Kingdom, agreed that, “no fine would be adequate for a monopoly. Advertisers, users, and investors do not register the fines in their economic activity. [They’re] still buying, using investing. It causes no material harm to Facebook. It’s just bad PR.”
What does he have in mind? “Seizure of servers, criminal penalties against corporate directors and Stop Data Processing orders would actually be painful penalties,” he argued. Or, even more intense, “force Facebook to delete its user data and models and start from scratch under rigorous collection restrictions.”
Seize its servers? Imprison corporate directors? Destroy Facebook? The problem isn’t that the FTC doesn’t grasp its inadequacy to punish Facebook by mere financial punishment, or that the issue of data security isn’t real and huge. The problem is that these marketeers want to use criminal and quasi-criminal sanctions for all the wrong reasons, and in all the wrong ways. The disappointment of the tech privacy contingent is that they want their slingshot to bring down Goliath. Hard.
But they also acknowledged that a ruling most likely won’t satisfy the harshest critics. “They’re not going to be vengeful. People who are angry and hurt may be disappointed. People who want to see change while still using these services — they may be better served.”
The FTC isn’t there to exact vengeance for the angry and hurt, but to deter corporations from violating the law, whether intentionally or negligently. The question of how to compel Facebook to protect user data is a good one, but not the question at hand despite the cries that something must be done.
Fines aren’t levied to compensate for the sad tears of the disaffected when it comes to corporations anymore than when it comes to sentencing individuals. No matter how badly a victim cries of his trauma and pain after a mugging, the defendant still doesn’t get life plus cancer for it.
The idea of using criminal and quasi-criminal sanctions to cut corporations down to manageable size because they’ve been far more successful than you is an abuse of government power.
The only potential crisis then seems reserved for us, the users. If the regulators fail to meet the moment they’ll have wasted a rare opportunity for real accountability. Worse yet, quietly prompting Facebook to write a check for an amount it’s already safely ferreted away will be an admission that regulators are out of ideas when it comes to the company’s unprecedented power and reach.
It’s not that Facebook is too big to punish, but that the use of punishment isn’t to re-engineer corporations to do what baristas want them to do. Nobody forces you to use Facebook, to give them an iota of your data. Maybe half the problem isn’t their accountability at all, but users’ responsibility for handing them all their personal information on a silver platter in exchange for a few “likes” from people they’ve never met. Don’t blame Facebook or the FTC for your lousy bargain.
You look different with a full head of hair.
…and the Buddy Holly glasses…guess it didn’t work..
Great pick Dave. “All I ask, don’t tell anybody the secret, don’t tell anybody the secret I told you”.
I just sent that to a friend because I was certain the lead guitarist was a former band mate of his, but he tells me that’s Kenny Vaughn who plays in Marty Stuart’s band.
OK…the only thing i got in common with Kenny is were both big dorky white guys with a guitar… i got some good licks, but that guy is a true master. Imagine saying you play lead guitar for Marty Stuart?!?…. its like saying “yeah, i do sketches for DaVinci”…
You got good licks and can sing. Ever think of starting a band? I hear Scott is good on drums. Chris Seaton could write some great lyrics, and the honourable Richard Kopf could bring the cowbell. Too bad you can’t get a MySpace page anymore. Just stay away from Facebook.
Did you intend to say that Charlie Warzel reached into the nether reaches of Anil Dash, or did you get lost in the middle of that sentence?
I got lost, but is it really that wrong where I ended up?
Yes! I was eating breakfast.
What is this Facebook about which you write?
It’s a sad copy of MySpace.
Prick.
Some things are better left as a tort matter. If someone was harmed, let them sue. If a whole lot of people were harmed by the same thing, they can form a class and sue. If plaintiffs prevail then, those who felt harmed are compensated. No FTC required. The problem with the Facebook thing is that there is probably not a single Facebook user who feels harmed, much less that they were harmed because Facebook was behaving in a manner that violated a duty to the users.
It would make for an interesting class action, which might well be a far better means of redress since it results in compensation to those harmed than the govt. How to quantify damages would be an interesting problem, but given that this is a something that will persist in the future, it might be time to figure it out.
The challenge, from my limited insurance man’s perspective, is that plaintiff has to show he suffered a demonstrable harm. The next step is to show that the tortfeasor should have known about it and could have done something about it. I think those two elements are missing here. The FTC doesn’t have to do those things. They do some hand waving about economics/anti-trust and then keep hitting Zuckerberg, with a phone book, until he screams uncle.
Or a fly swatter. Phone books are heavy and can hurt your arm when lifting.
The only truly effective punishment would be for Zuckerberg and similar corporate leaders to be convicted of a crime and imprisoned, but that apparently can’t happen under current laws that apply to corporations. Until corporate executives have their own skin in the game with respect to punishment, cash penalties against the companies, or the popular consent decrees, are all we have.
Weirdly, in America we only convict people of crimes for the conduct they committed, not vicariously for the conduct of others, including corporations. What are you thinking?
Unless we’re really pissed because the corporation they managed helped ruin middle America by selling too much Oxycontin.
I was thinking that corporate executives make decisions that result in the corporation violating laws. If Facebook misuses data, someone made a decision to do so. At present, there is no personal liability for those decisions, it’s all on the corporation. If there were personal liability, executives would be less likely to make decisions that result in corporate crimes, or would be more likely to think through the potential results of their decisions.
On the contrary, if someone within a corp commits a crime, they are regularly prosecuted. Happens all the time. But as with many things, it’s not nearly as simple as one guy did something bad.
“force Facebook to delete its user data and models and start from scratch under rigorous collection restrictions.”
That’s entirely nonsensical. Facebook’s data is YOUR data, so deleting it is not exactly possible (I mean it’s possible, but “we’re deleting the pictures of your kids you share with family and friends” isn’t exactly going to play well in Peoria).
This also ignores that “starting from scratch” just allows them to build profiles of their users with their latest models, likely resulting in even more accurate profiles when all is said and done.
Ignorant people proposing simple solutions to complex problems rarely results in a positive outcome.
A truism.
There you go bashing politicians again.
I am not saying to bankrupt the company or pursue criminal type sanctions against any individuals in it, but if the intent of a penalty is to be a deterrent and the fine imposed is to them the equivalent of looking under the couch cushions for spare change as you say shouldn’t the fine imposed be sufficient to sting enough to actually function as a deterrent? All the board understands is profit so wouldn’t you structure a penalty to hit that sufficiently so that they take notice and change their (corporate) actions to avoid that in the future? A press statement to the effect that the fine didn’t even blip the quarterly (much less the annual) profit indicates to me that it wasn’t a sufficient deterrent. A spanking is not the same as a slap on the wrist.
If I have a habit of getting traffic tickets, at some point the traffic judge is going to take notice of me continually appearing in his court and impose some penalty serious enough to make me not want to appear or be incapable of appearing before him again.
A month’s revenue is not a trivial fine for any business.
Maybe a different sort of fine would be appropriate. Something along the line that, say 2-5% of the company, in terms of shares/voting rights, is forfeited to the government for grievous crimes by the company. IF they do bad things often enough, the govt ends up with the right to make the rules, and eventually it owns the company. I understand the temptation by the govt to overcharge and otherwise take over everything, but maybe something like would make the owners and the managers sit up and do the right thing.
The problem with non-lawyer making up their own ideas of effective punishment is that it’s no different than believing in unicorns prancing on rainbows and utterly worthless to discuss. It ain’t real, and I’m disinclined to go through the effort of explaining why it’s nonsensical.
the govt ends up with the right to make the rules, and eventually it owns the company
How’s that working out for Venezuela?
“The FTC isn’t there to exact vengeance for the angry and hurt, but to deter corporations from violating the law, whether intentionally or negligently. ”
The government does this already, in all sorts of activities. The entire regulatory system for the safety of transportation facilities, for banking, for automobile design and construction, for food processing safety, makes rules that impact companies. Banks that are about to fail and leave depositors holding the bag are forced to merge with stronger companies. Banks that are too-big-to-fail can be saved, but suffer hears of government supervision.
I happened to be involved in reviewing a product produced by a Very Large Company, which had already sold the product to several other Very Large Companies, but just before we signed off on it, we discovered that the first VLC had not told us the whole truth about how it was to be used. I, personally, said no, and I made it stick, even though I was a relatively low-level bureaucrat. My refusal to accept it probably cost the various VLCs several hundred million $.
This is the administrative state. It is working like this right now, and has been growing for over a hundred years. I can think of one other VLC that actually went bankrupt and disappeared because of actions and failures to act, by my agency, by the local governments, and by officials of the state of NY. This is the corporate death penalty.
I don’t necessarily agree that Facebook should be made to suffer like this for its failings. I don’t know enough about it to say. Certainly, anyone who gives away lots of personal information should not be shocked, shocked, when that personal information becomes less than privately available. But this genie got out of the bottle a long time ago, and it will never be put back.
But if you really want to “deter corporations from violating the law”, then you have to change their behavior, and taking away some of the seats on their board of directors, even if for only a short period of time, will have a very strong influence on the corporate culture.
They could also neuter top management. I mean, with a knife. That would be an effective deterrence. Why don’t they do that?