ONE BILLION DOLLARS OR MORE! The fine a former FTC consumer protection chief says facebook is facing

“We’ve worked hard to make sure that we comply” with the consent decree, Chief Executive Mark Zuckerberg said in a call with reporters on Wednesday. “I think the reality here is that we need to take a broader view of our responsibility, rather than just the legal responsibility.”The FTC last month announced that it was investigating the Cambridge Analytica incident, but it declined to comment on Wednesday’s revelation about unauthorized scraping of user data.

Complied with the consent decree? Really? You sold people’s personal information. That is not a violation of the consent decree?

Facebook disclosed the latest mishap in a blog post saying that it was disabling two search tools because they had been so widely abused. “Given the scale and sophistication of the activity we’ve seen, we believe most people on Facebook could have had their public profile scraped in this way,” the post said.

Company officials later explained that “malicious actors” were collecting fragments of personal information on the so-called “Dark Web” – typically phone numbers and email addresses posted after large-scale data breaches – then using the Facebook search tools to match this information with users of the social media platform.

In this way, criminals could expand their fragmentary information to include the full names of people, along with whatever information was public as part of their profiles, such as their profile photos, home towns and educational and work experience. Users could block such access by changing their privacy settings to prevent searches based on phone numbers and email addresses. But research has consistently shown that most people stick with default privacy settings and have little understanding of what kinds of data can be collected by outsiders.

The collecting of user information was not a data breach in the traditional sense because Facebook’s systems were not improperly penetrated, and data that users designated as private – such as family pictures or personal notes – were not accessed, according to the company.

But the abuse of Facebook’s search tools enabled the discovery of personal information that otherwise would have remained private. Gaining access to such data is important for criminals looking to steal identities or commit other types of fraud.

Security researchers had warned about such risks for years. One Britain-based researcher, Reza Moaiandin, warned about the problem in an April 2015 blog post titled, “Facebook: Please fix this security loophole before it’s too late.”

In the post, Moaiandin published evidence of exchanges with Facebook in which company representatives appeared to downplay the problem even after he raised it directly with them.

Wired reported Thursday that another researcher, Brandon Copley, the CEO of Giftnix, raised the same issue with Facebook in 2013 and was told that the company did not consider it a security problem.

Such prior warnings about the ease of scraping Facebook information could complicate its dealings with the FTC, given that the consent decree focuses on whether a data privacy problem is “reasonably foreseeable” and preventable, said Vladeck and the other two former FTC officials.

“Whether or not this violates the order will turn on the reasonableness of Facebook’s actions,” said Jessica Rich, who led the FTC’s investigation into Facebook before the 2011 consent decree and now is vice president for advocacy at Consumer Reports. “Did Facebook know about this at some point and fail to address it?”

Told of the previous warnings by researchers, Rich said, “These would be loud facts for them and may show complete lack of commitment (to making sure) that this data wasn’t vulnerable.”

Violations of the FTC consent decree also carry the possibility of fines that could top $40,000 per “violation.” With more than 200 million Americans using Facebook, the fines could – at least in theory – reach into the trillions of dollars if the FTC found violations. (Facebook last year earned profit of $15.9 billion on $40.7 billion in revenue.) The former FTC officials said the actual fines would be far smaller but still could easily top the previous record of the $168 million civil penalty by the FTC against the DISH Network for violating telemarketing rules.

After the FTC announced in 2011 that it would punish Facebook for mishandling its users’ data, it heralded the consent decree as the best way to advance “the privacy interests of the nearly one billion Facebook users around the world.” Officials wrote at the time, “We intend to monitor closely Facebook’s compliance with the order and will not hesitate to seek civil penalties for any violations.”

More than six years later, Facebook serves twice as many users. In the eyes of the FTC’s experts and veterans, the credibility of the agency and its enforcement powers are at stake as it decides what to do about Facebook’s latest privacy problem.