Facebook took most of the blame for Cambridge Analytica, but the deeper failure belongs to lawmakers who never built the digital identity infrastructure that would have made this kind of abuse far harder in the first place. Blaming the platform alone misses where the real fix has to happen.

A Hearing, Not a Solution

Many people are angry about Cambridge Analytica, and they're looking to blame Facebook for privacy and security issues that are common across nearly every business operating online. It's understandable that politicians would be quick to jump on this bandwagon. Mark Zuckerberg's April 2018 testimony before Congress put some of the most powerful elected officials in the country in a public forum against one of the most powerful tech leaders in the world.

But when we ask who's truly responsible, for most of us, the answer starts closer to home. Most people placed blind faith in Facebook and other tech companies without fully understanding the privacy, security, or social implications, some of which genuinely couldn't have been anticipated early in these companies' history. That's understandable. Most people aren't equipped to fully grasp the implications of their day-to-day actions on a platform like Facebook, and that's exactly why the responsibility for protecting people from themselves falls, at least in part, on the elected officials so quick to throw stones. For as much as these officials want to use Facebook as a scapegoat and prop themselves up by tearing the company down, they're partly to blame too.

What Lawmakers Never Built

Lawmakers have been painfully slow to equip their constituents with a form of digital identity that platforms like Facebook could use to reliably tell real users from fake ones, or to adopt the kind of privacy protections found in regulations like the European Union's GDPR.

While lawmakers consistently take a reactive posture toward incidents like the Equifax breach or the Cambridge Analytica misuse of Facebook data, very few take a proactive posture toward replacing obsolete identity systems like Social Security numbers, driver's license numbers, and other human-readable credentials.

In a country where consumers regularly lose billions of dollars a year to identity theft tied directly to government-issued PII, which lawmakers are actually doing something about it? In a country where the economy loses hundreds of billions annually to industrial espionage, much of it carried out digitally through data breaches and mass IP theft, which lawmakers are actually doing something about that?

The Uneven Burden on Tech Companies

Facebook committed to doubling its safety and security staff to 20,000 people, including contractors, by the end of 2018, an effort that spans election interference, extremist content, and fake account detection together. That burden exists in large part because government has never equipped citizens with a digital identity suitable for proving who they actually are online.

Should every tech company be expected to carry that same burden? If so, is it fair to call Facebook a monopoly while also, through the government's own negligence in failing to provide digital identities, effectively forcing every tech company to build the same costly workaround? Smaller companies can't afford to hire extra staff just to sort through the identity problem government created, which hands better-funded organizations an even bigger competitive advantage.

Nobody Asked the Obvious Question

Most people watching the hearing were probably rooting for one side or the other, government or Facebook, the way fans root for a team at the Super Bowl. But it's worth remembering that both sides, the people we elected and the platforms we entrust with our data, are letting us down in the same way. Not once during that lengthy exchange did anyone raise the possibility of giving citizens a real digital identity, one that would actually protect people from the cyber and identity-related crimes driving this entire conversation in the first place.

Technology that replaces human-readable