Facebook fails to kill class

Judge William Alsup warned Facebook he would authorize a “bone-crushing” discovery process on behalf of affected users.

A proposed class action lawsuit against Facebook will move forward after a judge disagreed with the company’s contention it should not be held liable for failing to protect users’ information.

Facebook last year announced that a data breach allowed hackers to make off with information about some 30 million people. A vulnerability in Facebook’s code enabled outsiders to access to users’ digital access tokens, which make it possible to visit the site without logging in each time.

The company had previously claimed that some of the plaintiffs’ information was not “sensitive” because it was accessible on a public Facebook profile and no real harm had been done because attackers had failed to steal users’ financial information and passwords. Additionally, the company said it should be absolved from responsibility due to the sophistication of the hack.

U.S. District Judge William Alsup disagreed, ruling on June 21 that the evidence-gathering phase of the case should proceed “with alacrity.”

“The lack of reasonable care in the handling of personal information can foreseeably harm the individuals providing the information,” Alsup ruled. “Further, some of the information here was private, and plaintiff plausibly placed trust in Facebook to employ appropriate data security. From a policy standpoint, to hold that Facebook has no duty of care here ‘would create perverse incentives for businesses who profit off the use of consumers’ personal data to turn a blind eye and ignore known security risks.’”

Facebook learned of the data breach on September 14, 2018 and its security team isolated the engineering flaws on September 25. The company told users who might have been affected on September 28, forcing them to log-out and re-enter their credentials. The incident sparked eleven class action lawsuits, which were consolidated into this case, and distilled to include ten complaints including breach of contract, negligence and violations of unfair competition law.

Judge Alsup previously warned Facebook’s legal team he would authorize a “bone-crushing” discovery process on behalf of affected users, according to Law360. Alsup also said user concerns are worth “real money,” rather than “some cosmetic injunctive relief.”

This is one of the many legal matters besieging Facebook. The Silicon Valley giant’s data-sharing deals with technology companies are under criminal investigation, according to the New York Times. Meanwhile, the company is preparing to pay a reported $5 billion to settle a Federal Trade Commission probe into whether it improperly shared information about tens of millions of users with Cambridge Analytica.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure