Best practices for crisis management:

A major story this past week has focused on Facebook’s involvement in a controversy surrounding the misuse of data by Cambridge Analytica. Charges involve improperly gathering and using personal information from 50 million Facebook users and, in the process, potentially violating Facebook’s privacy standards. The news coverage exploded, magnifying the seriousness of the situation throughout the week. Yet, there was no word from Facebook’s leadership team. This silence was deafening especially with the calls from the U.S. Congress for Zuckerberg to testify, along with similar demands from the British Parliament. The Today Show hosted a segment about how to delete a Facebook account, with a similar step-by-step guide appearing in The New York Times. #DeleteFacebook was trending. Where was Facebook?

Five days after the story broke, Mark Zuckerberg broke his silence by issuing a post, giving an exclusive to CNN and talking to The New York Times. Facebook’s COO Cheryl Sandberg responded to the news after Mr. Zuckerberg, who’s call to action included a thoughtful apology and plans for a  “full forensic audit” of Cambridge Analytica’s use and access of data, along with any other apps hoping to capitalize on users’ personal information. In a post on her Facebook page, Sandberg considered the incident a “breach of trust” stating: “I deeply regret that we didn’t do enough to deal with it.”

Facebook, a leading global presence, went MIA, hiding in the bunker during a crisis they helped to create. In The New York Times interviewZuckerberg defended his silence by saying that, before making a statement he wanted to have “a full and accurate understanding of everything that happened.” While this may be his intent, it didn’t satisfy the immediate need for clarity. Facebook’s lack of response enabled those impacted by the events or those with strong opinions to hijack the headlines. Facebook quickly lost control of the story, failed to get ahead of it, and missed the opportunity to shape it.

Now, 10 days after the scandal broke, Zuckerberg’s efforts to calm the fury have done little to mitigate the growing backlash against Facebook. It is no longer restricted to public opinion, it is now regulatory. The Federal Trade Commission announced Monday it was investigating whether Facebook violated a 2011 consent decree to protect user data, the attorney general for 37 U.S. states is seeking details on how Facebook monitored app developers who were using the data generated by users and whether or not Facebook implemented safeguards to protect users during this process, and lawmakers on The Hill have increased their demands for Zuckerberg to testify.

While Cheryl Sanberg said the company would be “open to regulation” there is no specificity from Facebook about what that regulation would look like. As public, investor, and regulatory trust deteriorates, the road to recovery for Facebook becomes far longer and increasingly taxing for a company that has been able to curb more serious consequences on questionable data usage in the past.

Time has run out and options are limited. The initial response from Facebook’s leadership demonstrates the consequences of poor crisis management and resulting investigations will bring new regulations and actions against data usage by large tech companies. All of this sheds light on users’ naivety to how their personal information is collected and misused by companies who act on the foundation of trust.

In the midst of all of this, enough is enough, It’s time for Zuckerberg and Sandberg to “Lean In.”