Get Ready for the Next Wave of Facebook Data Breaches, Sheryl Sandberg Warns

Facebook COO Sheryl Sandberg appeared on the “Today” show Friday to answer questions about recent scandals the social media giant has been embroiled in, including a security breach that may have violated the privacy of 87 million users. While CEO Mark Zuckerberg prepares to appear before Congress next week, Sandberg was grilled by NBC’s Savannah Guthrie. In the interview, Sandberg warned that there could be more breaches revealed in the days to come.

Guthrie asked Sandberg why it took so long for the company to own up to the Cambridge Analytica data breach, in which a third-party data firm improperly received private user information.

“This first came to Facebook’s attention in December 2015. That’s two and a half years ago,” Guthrie said, “and only now is Facebook taking these serious steps that you’ve announced this week. What is the reason it took so long? You could’ve done all of this two and a half years ago.”

“Because we thought the data had been deleted and we should have checked. You are right about that,” Sandberg explained. “We thought [the data] had been deleted because they gave us assurances and it wasn’t until other people told us it wasn’t true but…”

“But why go on faith with someone who’s already violated you in spirit if not in the letter of Facebook’s principles?” Guthrie interrupted.

Sandberg said that Facebook had legal assurances that the data had been deleted, but admitted that the company didn’t take the additional step of auditing the company to verify the claims. “We’re trying to do that now,” she said.

According to recent reports, Cambridge Analytica, a data mining firm that worked with President Trump’s campaign as well as the Brexit campaign in Europe, held onto data that had been harvested through a personality test app, in violation of Facebook’s terms of service. Facebook eventually admitted that 87 users may have had their privacy violated.

Guthrie blasted the Facebook COO for failing to inform users that their data had been handed over to a third party.

“But that doesn’t mean you don’t tell the users, ‘hey this was stolen from you,'” she said.

“Yes, you’re right,” Sandberg admitted, “and we should’ve done that. We should’ve done that as well.”

Asked if there are other breaches looming on the horizon, similar to this most recent one where tens of millions of users were affected, Sandberg said, “We’re doing an investigation, we’re going to do audits and yes, we think it’s possible. That’s why we’re doing the audit.”

“I’m not going to sit here and say that we’re not going to find more because we are,” she warned later in the interview, adding, “Were making a big shift here and it’s a shift we’re making to be more protective.”

Sandberg pushed back against Guthrie’s allegation that Facebook users—and their data— are the company’s “product.”

“And that’s not true,” Sandberg said, explaining that the company never sells user data, nor does it give personal data to advertisers. “People come onto Facebook, they want to do targeted ads and that’s really important for small business. But people want to show ads. We take those ads, we show them, and then we don’t pass any individual information back to the advertiser.”

Guthrie continued to press the issue: “You don’t have to pass it because you collect all the information and then you target the ads for the advertisers. That’s the service that you charge the advertisers for.”

Sandberg admitted that Guthrie’s allegations were true. “That’s right. That’s a very good service. That’s a privacy-protective good service,” she said.

Guthrie accused Facebook of waiting “until its stock started tanking” to begin caring about user privacy.

Sandberg reiterated that Facebook has “cared about privacy all along, but I think we got the balance wrong. ”

She said Mark Zuckerberg’s message Congress next week will be that “he wants to be there to answer all of their questions and he wants to tell them the steps we’re taking” to fix the company’s problems.

Follow me on Facebook @pbolyard