When St. Johns County sheriff’s deputies arrived at the St. Augustine, Florida, home of Jeremy Banks on Sept. 2, 2010, they found his 24-year-old girlfriend Michelle O’Connell lying on the floor with a gunshot wound to the head and dozens of prescription painkillers in her pocket.
“Please get someone to my house!” Banks had told the 911 operator. “Please. Send — my girlfriend, I think she just shot herself. There’s blood everywhere!”
Deputies found Banks, a fellow St. John County sheriff’s deputy, crouched at the bathroom door, clutching his phone.
The gun was found on O’Connell’s left with the Tac light on the gun switched on. Later, pictures taken at the scene revealed a shot fired into the carpet.
Despite the efforts of the first responders, O’Connell was pronounced dead close to 11:48 p.m. that night.
Outside the home, some deputies and detectives started to conclude that O’Connell’s death was a suicide. Some of them were later interviewed as part of the investigation.
“I didn’t have any suspicions that it was anything other than suicide. I think that’s what we were all kind of discussing, but just making sure that we covered our bases,” St. Johns County Det. Jessica Hines is heard saying in a recording of the interview for the investigation.
“It appeared she had committed suicide,” St. Johns County Cpl. Mark Shand said in his interview.
OConnell Family Jeremy Banks is seen here with Michelle O’Connell in this undated photo.
In the hours that followed, some fellow deputies took time out to console their coworker and friend, Banks. A squad car was used as a makeshift interview room as Banks was briefly questioned by Hines in an interview that was recorded.
During that interview, Banks said that he was sitting on his motorcycle in the garage when he heard a pop and rushed inside.
“The bedroom door was locked and I screamed her name again. I heard it go off a second time,” he told Hines.
Shortly after, Banks went to his parents’ home and O’Connell’s body was taken to the morgue.
A family’s doubt about a woman’s death
When sheriff’s deputies notified O’Connell’s family of her death, her mother Patty O’Connell told “20/20,” “They just said that she committed suicide, ‘your daughter killed herself. She committed suicide.’”
The O’Connell family found it hard to believe that Michelle O’Connell, a single mom who worked multiple jobs to support Alexis, her 4-year-old daughter, would take her own life.
OConnell Family Michelle O’Connell broke up with her boyfriend, Jeremy Banks hours before she was found dead on Sept. 2, 2010.
In fact, Michelle O’Connell had just landed her dream job at a day care center.
“She said, ‘I’m going to the doctor and I’m not even sick, but I have insurance for once in my life,’” her boss Teresa Woodward remembered Michelle O’Connell excitedly saying when she gave her the job. Her death came as a total shock to her.
Michelle O’Connell’s brother Sean O’Connell and her sister Chrissy O’Connell were outraged when they realized that the sheriff’s office had spent only a few hours investigating before calling her death a suicide.
“The word suicide was thrown around right off the bat without any investigation,” Chrissy O’Connell told “20/20.”
Two days after her death, medical examiner, Dr. Frederick Hobin, officially ruled Michelle’s death a suicide and despite the family’s initial efforts to have local authorities enlist an outside agency to investigate her death, St. Johns County Sheriff David Shoar told them he would not be doing that.
Michelle O’Connell’s last hours
Through various interviews, authorities constructed a timeline of the last hours of Michelle O’Connell’s life.
Michelle O’Connell and Banks attended a Paramore concert that night in 2010 at the St. Augustine Amphitheater, and Banks told detectives the two argued before, during and after the show.
“We don’t get along. We fight all the time. I mean, it’s never, never bad fighting. It’s always just arguing,” Banks was recorded saying in an interview with St. Johns County sheriff’s office detectives.
According to Chrissy O’Connell, her sister wanted to break up with Banks, but decided to go to the show first since she already purchased the tickets in advance.
“She said, in true Michelle fashion, ‘I paid for the tickets. I’m going. I’m breaking up with him. I’m starting my life over,’” Chrissy O’Connell said. “She said, ‘I’ll be fine.’”
Anne Schindler Michelle O’Connell, 24, was found dead in the home of her boyfriend, Jeremy Banks in St. Augustine, Florida on Sept. 2, 2010.
Michelle O’Connell’s brother was also seated with her and Banks at the concert and said Banks was “kind of withdrawn” during the show.
“I was like [to Banks], ‘Hey, do you mind scooting over, if you’re not going to have fun at the concert with my sister, I’m definitely going to,’” Sean O’Connell recalled.
Hours before, Michelle and Chrissy O’Connell had lunch, where Chrissy O’Connell says her sister talked about looking for a new apartment and that she was breaking up with Banks.
“This was kind of a culmination. I was concerned with all the violence and how the relationship had turned,” Chrissy O’Connell said.
OConnell Family Jeremy Banks has denied hurting Michelle O’Connell the night of her death, and he has never been charged with a crime.
Her family says there had been whispers about verbal and physical abuse within their relationship from both sides.
“She said, ‘There’s going to be a fight because he’s going to want me to go out after the concert,’” Chrissy O’Connell said. “And I said, ‘Don’t even go to the concert.’ Because I knew Jeremy was rageful. I knew in my heart something was going to happen.”
Chrissy O’Connell was babysitting her sister’s daughter Alexis while they were at the concert. During the show, Chrissy O’Connell said her sister sent her text messages.
“Promise me one thing. Lexi will be happy and always have a good life,” Michelle O’Connell said in a text message to Chrissy O’Connell about her daughter.
“Promise you what?” Chrissy O’Connell wrote back.
“That no matter what, Lexi will always be safe and loved,” Michelle O’Connell responded to her sister.
By the end of the concert, Michelle O’Connell texted her sister, “I’ll be there soon.” But Michelle O’Connell never picked up Alexis.
Banks told detectives that on the way home from the amphitheater, “She said, ‘I’ll have my things out by this weekend.’ And I said, ‘Are we breaking up?’ She said yes. And I was like, ‘All right.’ I raised my voice. She raised her voice. We argued. But when we got to the house, we were fine,” Banks said in his interview with detectives.
OConnell Family Hours before her death, Michelle O’Connell had messaged her sister, Chrissy O’Connell to promise her that “Lexi will be happy.”
According to Banks, Michelle O’Connell was inside the house while he remained outside with two friends. At one point, Michelle O’Connell went outside to retrieve a makeup bag from the car and quickly returned inside.
After 10 to 20 minutes, Banks said his friends left and he sat alone in the garage when he heard the popping sound.
“I knew exactly what it was. Just instinct and I just said, ‘S—,’ and I ran inside. I started screaming her name. The bedroom door was locked, and I screamed her name again,” Banks told detectives. “I heard it go off again a second time. I ran into the living room. I grabbed the phone. I kicked the bedroom door in and I found her laying where she is.”
Inside the investigation into Michelle O’Connell’s death
Debra Maynard, a former St. Johns County sheriff’s deputy who was one of the first to arrive, questioned what she was hearing on the scene.
“Immediately, it was almost like they were taking Jeremy’s word that she shot herself at that point,” Maynard said. “We were told it was a suicide. They automatically said it was a suicide, though we are trained to every scene is a homicide until proven otherwise. But they did immediately start calling it a suicide.”
OConnell Family Michelle O’Connell worked multiple jobs to support her 4-year-old daughter, Alexis.
Maynard was later fired by the sheriff, reportedly for untruthfulness. She claims it was because the sheriff asked her to lie in an unrelated case and she refused.
A later police interview with Banks revealed he had gained access to a report about the investigation.
“I’ve already read the report. I know I probably shouldn’t have. I just wanted to know what went down on the other side,” Banks told a detective.
Some in the department later admitted to having doubts about what happened that night.
“When I first walked into that room, the first thought that went through my mind was, ‘This is not good for Jeremy,’” Sgt. Scott Beaver, who worked on the case, told investigators. “I was in the homicide unit for a few years, and it didn’t add up. But I didn’t do more investigation into this.”
Shoar, the St. Johns County Sheriff, would later acknowledge missteps were made by his department. Among them, deputies failed to canvas the neighborhood for witnesses, failed to interview the decedent’s family members and failed to isolate, interview and photograph Banks in a structured environment.
As for why Banks didn’t take Michelle O’Connell’s pulse or perform lifesaving measures, his attorney Mac McLeod told “20/20,” “I don’t think his frame of mind was as a deputy at the time as I was saying. I think his frame of mind was completely shocked and freaked out.”
ABC News St. Johns County Sheriff, David Shoar, acknowledged missteps were made by his department while investigating the death of Michelle O’Connell.
Michelle O’Connell’s family insists she wasn’t looking to take her own life.
In her appointment book, found in the car, Michelle O’Connell had signed up for CPR training for two days after her death. Michelle O’Connell also had plans to meet with her friend Mindy Fox the night she died.
In addition, the pills found in her pocket at the time of her death were from Banks’ prescription bottles, and none of the pills was found in her system. All the pills were accounted for.
While the sheriff’s department and Michelle’s family are at odds over how she died, it is undeniable that she was killed with Banks’ service weapon.
When asked how Banks secured his firearms in the home, McLeod said, “not well.”
“I think that the policy was to secure your firearm; which primarily for law enforcement officer means you put it in either a gun lock or in a secure place up higher so that children and things, and other people in the house can’t get to it. However, in practice, like other law enforcement officers, he came in, would take his gun belt off, and would place it on a chair or place it somewhere else,” McLeod said.
It took four months, but Shoar finally bowed to pressure from the family, knowing that his department’s investigation had fallen short. He asked state investigators to take a fresh look at the case.
A second look at the death of Michelle O’Connell
Florida Department of Law Enforcement (FDLE) investigator Rusty Rodgers was assigned to the case. In his investigation, he found something that the sheriff’s department had not: Two women who say they heard two screams for help from a woman and two gunshots the night Michelle O’Connell died.
“The two girls heard her scream for help. If she was suicidal, if she was killing herself, she’s not going to scream for help,” Patty O’Connell said.
As to the two gunshots, Sheriff Shoar says it is not uncommon for some suicide victims to fire off a test shot before firing the fatal shot.
Following his investigation, Rodgers presented his findings to the medical examiner, Dr. Hobin. According to a recording of an interview with Dr. Hobin by Jacksonville reporter Anne Schindler, Hobin came to believe that Michelle O’Connell’s death was “probably a homicide.”
ABC News Michelle O’Connell’s mother Patty O’Connell is seen here during an interview with “20/20.”
Hobin filled out an amended death certificate and listed homicide as the manner of death.
“And I said that, based on this, I would amend the autopsy and change the manner of death from suicide to homicide,” Hobin said in the recording of his interview with Schindler. “I did that, but just internally. I mean, I didn’t, I didn’t send it out, it wasn’t filed with anybody, wasn’t sent to the funeral director, wasn’t disclosed, anybody except the state attorney.”
Hobin didn’t officially file the amended death certificate, he told Schindler, because he was told to hold off by the state attorney while the investigation continued.
“So we had people almost, almost close to doing the right thing, and then we have people above them that said, “No, we’re gonna do it a little different.” Patty O’Connell said.
Hobin was later reprimanded by the state medical examiner’s office for keeping that document and others at his home rather than at the medical examiner’s office.
A new medical examiner, Dr. Predrag Bulic, was then consulted. Bulic believes Michelle O’Connell’s death was a suicide.
In his investigation, Rodgers also called in a crime scene reconstructionist with four decades of experience, who performed a field test outside to try to see if Michelle shot herself or was shot by someone else, based on where the shell casings landed in his test. His conclusion: This was a homicide.
Shoar and Banks fought back. Shoar penned a 152-page review of the case, which is mostly a positive assessment of his department. He ridiculed the field test over the fact it was done in an open field and didn’t take into account the variables at the scene, such as walls, a ceiling, furniture and Michelle O’Connell’s extremities.
ABC News Sean O’Connell and Chrissy O’Connell don’t believe their sister, Michelle O’Connell, could have taken her own life.
Banks fought back in the form of filing a lawsuit against the FDLE and Rodgers for allegedly violating his civil rights. The case dragged on for years.
“They did their own investigation,” Sean O’Connell said. “They investigated, their, themselves, and then later on they finally bring in FDLE, who paints this picture that it’s not jiving, it doesn’t look good, and they don’t like it. So they attack the FDLE agent and go after him hard, tooth and nail.”
In the absence of evidence that Michelle O’Connell’s death was not by suicide, special prosecutor Brad King broke the news to the O’Connells.
“He calls us in for a meeting and basically says, ‘There’s not enough evidence.’ So our family was just pushed aside and this meeting was very hostile,” Chrissy O’Connell said. “My mom was devastated, and I think I’ve said before it was like the second worst day of my life. You know the first losing Michelle.”
Michelle O’Connell’s body is exhumed
Five and a half years after Michelle O’Connell’s death, her family had her body exhumed and got in touch with Dr. William Anderson, a forensic pathologist and former deputy chief medical examiner for Orange County, Florida. He was asked to examine the original autopsy report and to do a second autopsy.
While examining the x-rays taken during Michelle O’Connell’s original autopsy, Anderson noticed there was another injury on her body.
“When we did the exhumation… the jawbone was in two pieces, so indicates there was a fracture,” Anderson told “20/20.”
After Shoar learned of the exhumation, he issued a statement about the family, saying in part, “Molesting Michelle from her place of rest using some freelance type approach is beyond unconventional. It was reprehensible.”
“Even if he doesn’t agree with it, or whatever, he should in no way shape or form ever speak, public release, whatever to a family using those words ever,” Sean O’Connell said of Shoar’s statement. “It really shows his character.”
“Despite rumors and statements to the contrary, we did this totally pro bono,” Anderson said.
News of the fracture brought into question the work of Hobin, the original medical examiner. Banks’ attorney Mac McLeod told “20/20″ that Hobin “noted mandibular separation. It’s not in the autopsy report. It’s in his field notes.”
But Anderson said the fact that was it was left out of the autopsy report was “very disturbing.”
“Because if everything else is very carefully described, and you leave out a major finding out of your report, it’s not good practice,” Anderson said of Hobin’s omission of the fracture from the autopsy report.
It’s significant because Anderson said the fracture reveals how Michelle O’Connell could have died.
“The only explanation that I can see that’s reasonable is that, uh, there was another force, a blow to the chin that broke the mandible prior to the time the gunshot wound was inflicted,” he said. “In my opinion, it was a homicide.”
Banks has always denied hurting Michelle the night of her death and he has never been charged with a crime. He remains a sheriff’s deputy with the St. Johns County office.
“What the family wants to believe or what the theory … being proposed was… that she must have been hit really hard,” Banks’ attorney McLeod said, adding that there “was a problem with that” because no medical examiner “worth his salt … will tell you that in an intraoral gunshot wound, such as this, with a high-powered weapon that more often than not you expect to see mandibular separation.”
Anderson said it is possible in some cases that a shot could split the jaw, but he doesn’t believe that’s case with Michelle O’Connell, based on the evidence he reviewed.
“There was a gunshot wound to the mouth that put a hole in the tongue but didn’t do any other damage to the teeth, to the gums, to the floor of the mouth, the very soft tissue that basically would’ve been destroyed if there had been enough force from that blast to break the jaw,” Anderson said.
McLeod argued against that, saying if O’Connell had been hit, “you would see bruising. You would see abrasion. You’d see something. There’s nothing.”
Anderson said he had conducted about 8,000 to 9,000 autopsies over his career and “if you die quickly enough, you will not have bruising.”
Having gotten the answers the family was looking for, Michelle O’Connell’s body was returned to her grave, but her death is still an open question for the family.
Where the case of Michelle O’Connell’s death stands today
Last year, the Florida Medical Examiners Commission reprimanded Hobin and Bulic after determining they had mishandled some of the components of the investigation.
“[Hobin] brought some material home and hadn’t kept it, you know, in the medical examiner’s office,” reporter Anne Schindler said. “Bulic, I think, had just showed autopsy photos that he wasn’t supposed to show to nonfamily members.”
Hobin was also called out for his poor recordkeeping in failing to document the jawbone fracture in his autopsy report.
The medical examiners and a states attorney declined to comment for this report.
The sheriff’s office told “20/20″ in a statement that “this case has been extensively reviewed by numerous investigations” who “have continually ruled the death a suicide.”
The latest development in the case is that just weeks ago, a judge found that FDLE agent Rusty Rodgers had probable cause to detain Banks for homicide and dismissed Banks’ civil lawsuit in Rodgers’ favor.
The dismissal of the civil lawsuit has reinvigorated the O’Connell family’s quest for justice. Michelle O’Connell’s mother hopes that Gov. Rick Scott assigns a new special prosecutor.
The governor’s office told “20/20” they will always listen to the O’Connell family’s concerns. The family is also crusading for a law that would prevent departments from investigating one of their own.
“Because they work together, and you know, they look out for each other. I just feel like something’s got to change,” Sean O’Connell said.
McLeod said the case has ruined Banks’ life.
“His neighbors that walk up and down the street at 2 [a.m.] at night and will scream at him, ‘murderer,’” McLeod said.
But Michelle O’Connell’s family said it’s her daughter Alexis, now 12, who feels the biggest void.
“You can’t grieve until you, um, get justice,’ Patty O’Connell said. “You have to have your justice. And it never goes away.”
Facebook chief executive Mark Zuckerberg took nearly 600 questions on Capitol Hill, giving a rare window into his views on some of the thorniest issues online.
What kinds of data does Facebook collect about its users? Who owns that data? What does Facebook do with it? And how does Facebook keep it safe and private?
Testifying about these issues in the Senate on April 10 and the House on April 11, Zuckerberg chose his words carefully, dodged or referred questions to his “team,” or gave only partial answers. The responses he did give were in some cases misleading because they lacked relevant information that could cast Facebook in an unflattering light.
We found some of the missing links. For this roundup, as is our custom, we won’t be awarding Pinocchios.
“We have a ‘download your information’ tool. We’ve had it for years. You can go to it in your settings and download all of the content that you have on Facebook.”
Lawmakers wanted to know how much data Facebook collects about its users, and whether users have a way to see all the data Facebook gathers about them.
We’re really talking about two kinds of data here. The first kind is “content” — the photos, videos, status updates, news articles and other baubles that Facebook users are posting for their friends, or the whole world, to see.
The second kind of data goes behind the curtain. It includes users’ location information, their Web browsing history, and the inferences that Facebook draws about them to tailor the kinds of ads they see. For example, Facebook might infer a user’s ethnicity and political affiliation and use those inferences to show more relevant ads.
Lawmakers often asked about this second kind of data, which Facebook keeps for ad-targeting and security purposes. Zuckerberg would often steer the conversation back to the first kind of data, user-generated content. He said users could download “all of the content” they had on Facebook with a special tool called “download your information.”
“Is there any other information that Facebook has obtained about me, whether Facebook collected it or obtained it from a third party, that would not be included in the download?” Rep. Jerry McNerney (D-Calif.) asked.
“Congressman, my understanding is that all of your information is included in your ‘download your information,’” Zuckerberg said.
One of our newsroom colleagues tried the “download your information” tool (DYI) and couldn’t find his detailed location data, Web-browsing history or the inferences Facebook drew about him to target ads. We asked Facebook about it and were told that the download tool currently “includes the personal data that people provide directly to Facebook” and that the company will be adding more items to the list.
“In the last year, we’ve started showing more information in DYI and regularly update the information it includes,” a Facebook representative said. “We also in late March announced new ways to view, access and manage information Facebook has about you. DYI will now include your comments, likes and reactions, as well as search history and location history. You can see these today in Activity Log, but they hadn’t been part of Download Your Information. We’ll add more information to this tool as we build new products and hear from people about what they’d find most useful.”
For the record, Facebook’s data policy says the company collects information about its users’ devices, such as “the operating system, hardware version, device settings, file and software names and types, battery and signal strength, and device identifiers.” None of that is mentioned on the list of data Facebook discloses to users.
Facebook also gathers data on “device locations, including specific geographic locations, such as through GPS, Bluetooth, or WiFi signals.” And it collects “connection information such as the name of your mobile operator or ISP, browser type, language and time zone, mobile phone number and IP address.” The list of data Facebook discloses to users mentions only a limited set of IP address information.
Facebook also gathers detailed data for advertisers, which isn’t mentioned on the list. “For example, we may … provide non-personally identifying demographic information (such as 25 year old female, in Madrid, who likes software engineering) to these partners to help them understand their audience or customers, but only after the advertiser has agreed to abide by our advertiser guidelines,” Facebook’s data policy says.
Describing what Facebook does with users’ browsing history, Zuckerberg said: “We only store them [Web logs] temporarily, and we convert the Web logs into a set of ad interests, that you might be interested in those ads, and we put that in the ‘download your information’ instead, and you have complete control over that. So I just wanted to clarify that one for the record.”
Translation: Users have a way to see and customize some of the products and interests that Facebook has associated with them for ad-targeting purposes. But if there’s a way to see the underlying data that allowed Facebook to form these inferences in the first place, we couldn’t find it, Zuckerberg did not say, and Facebook did not directly answer our question.
“The ‘download your data’ tool is not as comprehensive as Zuckerberg’s testimony implies,” said Gennie Gebhart, a researcher at the Electronic Frontier Foundation. She acknowledged that users can customize some of the ad-targeting assumptions Facebook keeps for them. But she added, “It is reasonable to expect that there are other inferences that Facebook might have that are not available to you.”
For example, for one week in January 2012, Facebook conducted an experiment on 689,003 randomly selected users that altered the quantity of positive or negative posts in their news feeds. Researchers then monitored those users’ Facebook activities to see how the change affected their moods. The only way they could have conducted this experiment was by collecting data on users’ moods, Gebhart said.
“All the data that you put in, all the content that you share on Facebook, is yours. You control how it’s used. You can remove it at any time. You can get rid of your account and get rid of all of it at once.”
Who owns all this data? Is it the user or Facebook, or both?
Zuckerberg was asked a few variations on this question and his answer was mostly consistent: the user. The user has all the control. Facebook is just along for the ride.
Some lawmakers weren’t buying this. “Your business model is to monetize user information to maximize profit over privacy,” Sen. Richard Blumenthal (D-Conn.) told Zuckerberg. (The Washington Post’s technology columnist, Geoffrey A. Fowler, wasn’t buying it, either.)
Others asked whether users should be able to reap the profit from their data instead of Facebook. “You talk about ‘the user owns the data,’ you know, there are a number — have been a number of proposals of having that data stay with the user and allow the user to monetize it themselves,” said Sen. Ron Johnson (R-Wis.).
This issue is wrapped in legalese. Users technically own the content they post online. “You own all of the content and information you post on Facebook,” the company’s user agreement says. However, this doesn’t appear to cover the separate set of ad-targeting data Facebook generates.
When it comes to user-generated content such as photos and videos, Facebook’s terms of service spell out conditions that effectively give the company joint ownership.
“For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.”
What happens when a user deletes something? “When you delete IP content, it is deleted in a manner similar to emptying the recycle bin on a computer,” Facebook’s user agreement says. “However, you understand that removed content may persist in backup copies for a reasonable period of time (but will not be available to others).” A Facebook representative added that “it may take up to 90 days to delete all of your account information from our backup systems.”
Zuckerberg later expanded on his answer: “You own it in the sense that you chose to put it there, you could take it down anytime, and you completely control the terms under which it’s used. When you put it on Facebook, you are granting us a license to be able to show it to other people. I mean, that’s necessary in order for the service to operate.”
“Two weeks ago, we found out that a feature that lets you look someone up by their phone number and email was abused. This feature is useful in cases where people have the same name, but it was abused to link people’s public Facebook information to a phone number they already had. When we found out about the abuse, we shut this feature down.”
We’re quoting from Zuckerberg’s written testimony, although this issue also came up in the hearings. Facebook announced on April 4 that it was restricting access to some kinds of user data. This included shutting down a tool that could search for people based on their phone number or email address.
“This has been especially useful for finding your friends in languages which take more effort to type out a full name, or where many people have the same name,” Facebook chief technology officer Mike Schroepfer wrote in a blog post. “In Bangladesh, for example, this feature makes up 7 percent of all searches. However, malicious actors have also abused these features to scrape public profile information by submitting phone numbers or email addresses they already have through search and account recovery.”
Zuckerberg said Facebook learned that this tool had been abused only two weeks before his testimony. But there is ample evidence that users and researchers had been calling Facebook’s attention to the system vulnerability at the root of the issue since at least 2013.
Brandon Copley, the chief executive of Giftnix, said he was threatened with legal action when he used this Facebook search tool to demonstrate how it could be used to scrape data, Wired reported. A group of researchers raised the issue again in 2015. Facebook reportedly told them it did not consider this a security vulnerability.
Rep. Ben Ray Luján (D-N.M.) asked Zuckerberg: “Yes or no: In 2013, Brandon Copley, the CEO of Giftnix, demonstrated that this feature could easily be used to gather information at scale. Well, the answer to that question is yes. Yes or no: This issue of scraping data was again raised in 2015 by a cybersecurity researcher, correct?”
Zuckerberg said, “Congressman, I’m not specifically familiar with that. The feature that we identified — I think it was a few weeks ago, or a couple weeks ago, at this point — was a search feature that allowed people to look up some information that people had publicly shared on their profiles.”
Asked about this issue, a Facebook representative said: “Mark was referring to specific incidents that we identified two weeks ago. In the past, we have been aware of scraping as an industry issue, and have dealt with specific bad actors in the past.”
“In the Kogan case, people signed into that app expecting to share the data with Kogan, and then he turned around and, in violation of our policies and in violation of people’s expectations, sold it to a third-party firm.”
A Cambridge University researcher named Aleksandr Kogan created a personality-quiz app for Facebook in 2014. He was able to collect data on up to 87 million Facebook users through that app, according to Facebook’s most recent estimate, and then sold the data to Cambridge Analytica, a political data firm hired by Donald Trump’s presidential campaign in 2016.
The vast majority of these 87 million users had not even downloaded Kogan’s app; their data was exposed merely because they were friends with 270,000 or so Facebook users who did download the app.
Zuckerberg said Kogan sold the data “in violation of our policies.” But it’s not as clear-cut as he says. Facebook had two conflicting sets of rules in play.
Facebook’s terms of service for developers prohibited what Kogan did: “Only use friend data (including friends list) in the person’s experience in your app. Don’t sell, license, or purchase any data obtained from us or our services. Don’t transfer any data that you receive from us (including anonymous, aggregate, or derived data) to any ad network, data broker or other advertising or monetization-related service.”
But Facebook’s terms of service for users said another thing, stipulating that when a user granted access to a third-party app, “your agreement with that application will control how the application can use, store and transfer that content and information.” In turn, the terms of service for Kogan’s personality-quiz app asked users for the right to sell, transfer, store and license their data in perpetuity and for any use.
“I want to show you the terms of service that Aleksandr Kogan provided to Facebook and note for you that, in fact, Facebook was on notice that he could sell that user information,” Blumenthal told Zuckerberg. The Facebook chief said “it certainly appears that we should have been aware that this app developer submitted a term that was in conflict with the rules of the platform” but added that no one was fired over this lapse.
A Facebook representative said third-party app developers could not “override, modify or supersede” Facebook’s policies through their own privacy disclosures.
“Anyone can turn off and opt out of any data collection for ads, whether they use our services or not.”
In some cases, Facebook collects data about its users even when they’re not on Facebook’s website or apps. For example, third-party websites that feature Facebook’s “Like” button send some user data back to Facebook. Although the process is slightly different, “Share” buttons on websites and other tools essentially do the same thing.
“We receive information about you and your activities on and off Facebook from third-party partners, such as information from a partner when we jointly offer services or from an advertiser about your experiences or interactions with them,” Facebook’s data policy says.
The upshot here is that Facebook hoovers up a bunch of data about people who aren’t Facebook users, creating what are known as “shadow profiles.”
Zuckerberg said these Facebook-abnegators may “turn off and opt out of any data collection for ads.” But how would that even work, since they’re not Facebook users? Do they send postcards?
One option: “You turn it off by making a Facebook account,” said Gebhart, of the Electronic Frontier Foundation. (This, of course, is counterintuitive and defeats the purpose for those who want to avoid Facebook.)
Facebook’s website gives an email address for non-users to request their data, and there’s also an online form and a separate page with instructions on how to use third-party tools to turn off online ads or tracking. This isn’t really “opting out” in the sense that Facebook provides the option itself, and it’s not clear how these “shadow profile” individuals could have Facebook delete their data without first creating an account.
An ACLU technologist, Daniel Kahn Gillmor, wrote that Facebook compiled a lot of data about him – including “which news articles I was reading, my dietary preferences, and my hobbies” — even though he never signed up for a Facebook account.
