Facebook CEO Mark Zuckerberg proved that one strength he doesn’t possess is handling a crisis before it gets out of control. The latest Cambridge Analytica data breach controversy spilled over creating such a backlash that the company’s stock took quite a hit before Zuckerberg finally went on a media apology tour Wednesday.
Anyone who deals with scandals like this will tell the crisis-management playbook is pretty simple: Get ahead of the story, update authorities and the public regularly, accept responsibility and take decisive action. Crisis-management experts say that until Wednesday, Facebook was 0-for-4.
Facebook’s two top executives, CEO Mark Zuckerberg and chief operating officer Sheryl Sandberg, went radio silent after news broke last Friday that political consulting firm Cambridge Analytica may have used data improperly obtained from roughly 50 million Facebook users to try to sway elections, including the 2016 White House race.
It was not until five days after the scandal erupted that Zuckerberg spoke up.
Meanwhile, some Facebook users have been leaving the social network or mulling the possibility, and Facebook’s stock is down 9 percent since Friday.
Facebook’s handling of the growing public-relations crisis is remarkable in that one of the world’s biggest companies seems not to be playing by well-established crisis-management rules.
“This will go down as the textbook case study as how not to handle a crisis,” said Scott Galloway, a New York University professor of marketing. “The only thing we know about this and are comfortable predicting is that it’s going to get worse.”
In his statement Wednesday — posted, of course, on Facebook — Zuckerberg acknowledged that mistakes were made, outlined changes the company has undertaken, and accepted responsibility for the problem.
Experts said acknowledging accountability was a positive but the fact that Zuckerberg didn’t outright apologize is a negative.
“My biggest skepticism is that we’ve seen this play before,” said Helio Fred Garcia, a professor of crisis management at NYU and Columbia University in New York. “They’re caught coming short of customers’ privacy expectations. They tweak procedures. But they don’t seem to learn from mistakes, don’t really seem to care.”
Most Fortune 500 companies adhere to well-established crisis-management rules. When video surfaced of a passenger being dragged from an overbooked United Airlines flight last April, for example, CEO Oscar Munoz at first hedged but then apologized. When Pepsi ran an ad last spring featuring Kendall Jenner that appeared to trivialize the “Black Lives Matter” movement, the company pulled the ad, saying, “Clearly we missed the mark, and we apologize.”
The point is to at least make an effort to seem remorseful to win back public trust, experts say. But despite user outcry on its own Facebook page and a call from Congress for Zuckerberg to testify about Facebook’s role in election-meddling, Facebook seems to be charting its own course.
“At this point, ‘Why did you wait so long to make a statement?’ is now news in itself,” Paul Argenti, a business professor at Dartmouth, said before Zuckerberg spoke up.
It’s a pattern Facebook has long followed, according to Garcia. Facebook hedged during its early days in 2007 over a controversial advertising program called Beacon that did not alert users it was sharing their activity, and it did so again in its response to Russian bots hijacking Facebook ad software during the Trump campaign in 2016.
“Facebook has been too late. Facebook has done too little and has been too legalistic” each time, Garcia said. “I have yet to find a crisis Facebook handled that I could stand in front of crisis management classes and say, ‘Here’s an example of how to handle a crisis.’ They’ve never been able to handle a crisis.”
Now that Zuckerberg has addressed the public, the PR flap may eventually be forgotten. But it will take a lot longer than if the company had addressed public concerns immediately, Garcia said.
“It’s much harder to restore trust once it has been lost than to preserve trust before it has been lost,” he said.
In the wake of a privacy scandal involving a Trump-connected data-mining firm, Facebook CEO Mark Zuckerberg embarked on a rare media mini-blitz in an attempt to take some of the public and political pressure off the social network.
But it’s far from clear whether he’s won over U.S. and European authorities, much less the broader public whose status updates provide Facebook with an endless stream of data it uses to sell targeted ads.
On Wednesday, the generally reclusive Zuckerberg sat for an interview on CNN and gave another to the publication Wired, addressing reports that Cambridge Analytica purloined the data of more than 50 million Facebook users in order to sway elections. The Trump campaign paid the firm $6 million during the 2016 election, although it has since distanced itself from Cambridge.
Zuckerberg apologized for a “major breach of trust,” admitted mistakes and outlined steps to protect users following Cambridge’s data grab.
“I am really sorry that happened,” Zuckerberg said on CNN. Facebook has a “responsibility” to protect its users’ data, he added, noting that if it fails, “we don’t deserve to have the opportunity to serve people.”
His mea culpa on cable television came a few hours after he acknowledged his company’s mistakes in a Facebook post, but without saying he was sorry.
Zuckerberg and Facebook’s No. 2 executive, Sheryl Sandberg, had been quiet since news broke Friday that Cambridge may have used data improperly obtained from roughly 50 million Facebook users to try to sway elections. Cambridge’s clients included Donald Trump’s general-election campaign.
Facebook shares have dropped some 8 percent, lopping about $46 billion off the company’s market value, since the revelations were first published.
While several experts said Zuckerberg took an important step with the CNN interview, few were convinced that he put the Cambridge issue behind him. Zuckerberg’s apology, for instance, seemed rushed and pro forma to Helio Fred Garcia, a crisis-management professor at NYU and Columbia University.
“He didn’t acknowledge the harm or potential harm to the affected users,” Garcia said. “I doubt most people realized he was apologizing.”
Instead, the Facebook chief pointed to steps the company has already taken, such as a 2014 move to restrict the access outside apps had to user data. (That move came too late to stop Cambridge.) And he laid out a series of technical changes that will further limit the data such apps can collect, pledged to notify users when outsiders misuse their information and said Facebook will “audit” apps that exhibit troubling behavior.
That audit will be a giant undertaking, said David Carroll, a media researcher at the Parsons School of Design in New York — one that he said will likely turn up a vast number of apps that did “troubling, distressing things.”
But on other fronts, Zuckerberg carefully hedged otherwise striking remarks.
In the CNN interview, for instance, he said he would be “happy” to testify before Congress — but only if it was “the right thing to do.” Zuckerberg went on to note that many other Facebook officials might be more appropriate witnesses depending on what Congress wanted to know.
At another point, the Facebook chief seemed to favor regulation for Facebook and other internet giants. At least, that is, the “right” kind of rules, such as ones requiring online political ads to disclose who paid for them. In almost the next breath, however, Zuckerberg steered clear of endorsing a bill that would write such rules into federal law, and instead talked up Facebook’s own voluntary efforts on that front.
“They’ll fight tooth and nail to fight being regulated,” said Timothy Carone, a Notre Dame business professor. “In six months we’ll be having the same conversations, and it’s just going to get worse going into the election.”
Even Facebook’s plan to let users know about data leaks may put the onus on users to educate themselves. Zuckerberg said Facebook will “build a tool” that lets users see if their information had been impacted by the Cambridge leak, suggesting that the company won’t be notifying people automatically. Facebook took this kind of do-it-yourself approach in the case of Russian election meddling, in contrast to Twitter, which notified users who had been exposed to Russian propaganda on its network.
In what has become one of the worst backlashes Facebook has ever seen, politicians in the U.S. and Britain have called for Zuckerberg to explain its data practices in detail. State attorneys general in Massachusetts, New York, and New Jersey have opened investigations into the Cambridge mess. And some have rallied to a movement that urges people to delete their Facebook accounts entirely.
Sandy Parakilas, who worked in data protection for Facebook in 2011 and 2012, told a U.K. parliamentary committee Wednesday that the company was vigilant about its network security but lax when it came to protecting users’ data.
He said personal data including email addresses, and in some cases, private messages were allowed to leave Facebook servers with no real controls on how the data was used after that.
Paul Argenti, a business professor at Dartmouth, said that while Zuckerberg’s comments hit the right notes, they still probably aren’t enough. “The question is, can you really trust Facebook,” he said. “I don’t think that question has been answered.”