What should Mark Zuckerberg do?

Mark Zuckerberg, founder and CEO of Facebook, one of the most dominant firms on the internet with 2.2 billion users, has come to you, a trusted adviser, for advice. The company is facing its largest crisis since its inception in 2004. What should it do next?

The genius of the Facebook business model, similar to strategy used by other internet giants, was that it was free, paid for by advertising based on access to user information. Free and open access contributed to the rapid growth of the network. The addition of each user increased the value of the network to everyone: users, the developers of apps made available to users, and advertisers utilizing user information. Although users could fine tune who received access to their data, the vast majority opted for only minimal control in order to create larger personal networks. Further, there was little governmental regulation of social networking companies protecting those users.

In the past two weeks, Facebook’s world had changed with New York Times and London Observer reports that a “psychographic researcher and consultant” identified as Cambridge Analytica used a quiz app on the platform to access personal information of approximately 300,000 Facebook users and, by extension, 49.7 million of their “friends.” The consultant allegedly used the information to influence voters, creating an outcry from users, legislators, and the general public, to force the company to do a better job of protecting private information.

In an initial response, Facebook informed its blog readers that it had suspended the consultancy from the site and suspended such data sharing by app creators. On March 20, Zuckerberg and Sheryl Sandberg, chief operating officer, sent the company’s deputy general counsel to the company cafeteria to meet with employees, sharing with them that Facebook had been deceived by the consultant into thinking that the information it had obtained had been discarded at Facebook’s request. The following day, Zuckerberg personally met with employees and posted a promise to audit and restrict access to user information by the developers of apps. He also agreed to testify before a United States congressional committee in coming days.

Short-term issues remained, among them engineering fixes to allow users easier control over sharing information on their Facebook pages. In fact, Zuckerberg reportedly was working with engineers for several days doing just that while the world awaited follow-up to the initial disclosures.

Dangers of an open platform
The changes were announced March 28, just days before the congressional hearing. The new choices were constrained, however, by knowledge that every new option offered potential for a less open site. This was something that was generally feared within the organization. Since its basic strategy decision in 2007 to open its platform to outside developers, Facebook’s success had been based on an open exchange between users, designers of apps posted on the site, and particularly advertisers making use of user information to design messages, access potential customers, and provide the revenue that had made Facebook one of the world’s most profitable and valuable companies. Further, the open policy had encouraged the production of more than a million apps, many of which were thought to increase the amount of time that Facebook users spent on the site, thus making them more valuable to advertisers and to Facebook.

Security was another issue to be addressed. Up to now, Facebook had little control over the information gathered by app designers, which they could in turn sell to third-party organizations largely unknown to the company. Facebook had, indeed, employed a chief information security officer with a sizeable staff. He had repeatedly argued for greater security of users’ information. But his proposed solutions often were outweighed by the desire to serve the company’s mission of “bringing the world closer together.” Some objected to the security chief’s outspoken and somewhat combative manner. For whatever reason, his staff had been reduced, he had been refused a request to report directly to Zuckerberg, and he had announced that he would be leaving Facebook in August.

Making the company’s privacy policy part of its terms of service contract with users was another possibility. According to one authority, “The privacy policy … is usually offered gratuitously. It’s not part of the contract and therefore, not enforceable like a contract.”

Some had proposed that Facebook change its business model from an advertising to a subscription model, with revenue coming from user fees rather than advertising. This had been rejected, largely because it would probably drive millions of users from the site, particularly those in the developing world with little income to spare.

Whatever Zuckerberg were to do, he would have to proceed very carefully, both in public and behind the scenes, to preserve the company’s user base, developer incentives, the value of information to advertisers, and the ability of the organization to continue to hold and recruit outstanding talent.

The US stock market had already begun to weigh in on the company’s prospects for doing so: Facebook’s stock value plummeted by $90 billion in seven trading days. One business columnist had proposed the creation of a federal Digital Protection Agency, whose job would be to “clean up toxic data spills, educate the public, and calibrate and levy fines.” Social media had even turned against Facebook through a #DeleteFacebook address. Employees watched closely the numbers of users who might elect the “DeleteMyAccount” button on Facebook.

What would you do?
Mark Zuckerberg has come to you today to help formulate a plan of action for the company and for his testimony, just three days after a US Federal Trade Commission announcement that it is investigating  “how Facebook handles information about its users.” Given the pace of events, you have little time.

What advice would you give him? What should Mark Zuckerberg do? What do you think?

This article was provided with permission from Harvard Business School Working Knowledge.