[roywiggins]

1. It wasn't a bug, it was a feature. The API explicitly allowed apps access to friends' information. They weren't exploiting the API.

2. The article describes the Cambridge Analytica database in particular being available "to verified researchers" but someone threw credentials onto GitHub where anyone could have borrowed them

[anonetal]

Regarding 2: note that this is not the Cambridge Analytica data, rather similar data collected by researchers at Cambridge.

[roywiggins]

You're right. It's confusing, because the data that was supplied to CA was supplied by another Cambridge researcher.

[minton]

According to the article they didn’t access friends’ data.

>Like other quiz apps, it requested consent to access the user’s profile (friends’ data was not collected)