API9:2023 — Improper Inventory Management

Slide 11 · Real Incident

Facebook Graph API v1 — the friends permission that harvested 87 million profiles.

The feature was removed in v2 in 2014. v1 remained live. Cambridge Analytica used it in 2015.

📄 U.S. FTC · U.S. Senate · UK ICO · New York Times · 2018

TIMELINE

Facebook / Cambridge Analytica — 2013–2018

2013: Aleksandr Kogan, a Cambridge University researcher, creates the “This Is Your Digital Life” personality quiz app on Facebook. The app registers with Facebook Graph API v1 and requests the friends permission.

April 2014: Facebook launches Graph API v2 and removes the friends permission. All newly registered apps must use v2. Apps registered before April 30, 2014 — including Kogan’s — retain v1 access.

2014–2015: 270,000 users install Kogan’s app and grant it data access. Through Graph API v1’s friends permission, the app harvests data from each user’s Facebook friends — without those friends consenting or being notified. Total profiles harvested: approximately 87 million.

2015: Kogan sells the data to Cambridge Analytica, violating Facebook’s platform policies. Cambridge Analytica uses the data to build psychographic profiles for political advertising.

March 2018: The Guardian and New York Times publish the Cambridge Analytica story. Facebook’s share price falls 20% in two weeks. Mark Zuckerberg testifies before the U.S. Senate. Facebook is fined $5 billion by the FTC (the largest privacy fine in U.S. history at the time) and £500,000 by the UK ICO. The core API9 failure: a permission model that violated privacy principles was removed from v2 — but v1 remained live and exploitable for a year after the fix.

← Back Pattern 2: Environment pivot →