Who could have imagined that a creepy little app that scoured Facebook for pictures of women in bikinis might be the instrument that skewers the behemoth social network? Who, that is, besides Facebook executives and their lawyers? Until a little over a week ago, the company had successfully sequestered internal e-mails, which were obtained by the legal team of Ted Kramer, the founder of the app company Six4Three, during the discovery process in a 2015 lawsuit. At issue was Facebook’s policy of allowing third-party app developers to access the data of Facebook users’ friends—the very policy that enabled Cambridge Analytica to buy the data of eighty-seven million unwitting users on behalf of the Trump campaign. In Kramer’s case, his Pikinis app relied on that access; once Facebook changed its policy, in 2014, the app no longer worked. Kramer cried foul and sued Facebook for breach of contract. At the company’s request, the judge in the case ordered the records sealed to keep them, ironically, private.

That changed on November 20th, when a parliamentary sergeant-at-arms showed up at Kramer’s London hotel room and escorted him to the halls of Westminster, where the Tory M.P. Damian Collins, the chairman of the Digital, Culture, Media and Sport Committee, demanded that Kramer turn over all his files in the case under threat of arrest. Kramer, who was in London on unrelated business, said that he panicked and moved a number of files from a Dropbox account to a USB drive, which he turned over to the M.P. How Collins knew that Kramer was in London has been traced to the tireless Guardian reporter Carole Cadwalladr, who has spent more than two years unravelling the connections between Cambridge Analytica, Facebook, Donald Trump, Steve Bannon, Robert Mercer, and Brexit. After arranging to meet with Kramer, she appears to have tipped off Collins to Kramer’s whereabouts. But how Collins knew that Kramer was in possession of the documents—which were not his to have—remains a mystery. There are reports that the two men had been in communication for the past few months, at Cadwalladr’s prompting, which suggests that the frog march to Parliament was just for show. (When Kramer’s lawyers found out that he was in possession of the discovery documents and that he had given them to Collins, they attempted to drop him, but, over the weekend, a California judge demanded that they continue to represent Kramer until the matter of the purloined files is adjudicated.)

Collins, for his part, claimed that whatever seal was in force in California was irrelevant in the U.K. On November 27th, he used the snatched e-mails to grill Richard Allan, the Facebook executive who was sent to speak for the company at an unprecedented international hearing on fake news and disinformation that Collins convened in Parliament. Mark Zuckerberg, who said he was too busy to appear—making this the fourth time that he has refused a request from Parliament—was represented by a nameplate positioned in front of an empty chair; every time the television cameras panned to Allan, they also showed his absent boss. Allan admitted that the optics were “not great,” and then went on to do his best Zuckerberg imitation, dodging and feinting as the lawmakers sought to put him on the spot. The most damning claim to emerge was that Facebook either gave, or considered giving, favored access to its users’ data to companies that spent at least two hundred and fifty thousand dollars in advertising on the platform. There also seemed to be evidence that Facebook had been informed, in 2014, that computers with Russian I.P. addresses were siphoning three billion data points a day from Facebook accounts, a claim that Allan refused to address in the hearing.

On Wednesday, Collins published the full cache that he seized from Kramer. The two hundred and fifty pages of internal Facebook documents show, irrefutably, that the company did indeed whitelist a number of lucrative business partners, including Netflix, Lyft, and Airbnb, allowing them continued and unfettered access to the accounts of Facebook users and their friends after the company claimed that it had stopped the practice. The documents also reveal that, in 2015, a permissions update for Android devices, which users were required to accept, included a feature that continuously uploaded text messages and call logs to Facebook.

The fallout from Ted Kramer’s London misadventure was just one debacle of many during Facebook’s terrible, horrible, no good, very bad month. Back at Facebook headquarters, in Menlo Park, Zuckerberg was quite busy after all, doing damage control after a scathing New York Times exposé. “Delay, Deny and Deflect: How Facebook’s Leaders Fought Through Crisis,” which was published on November 14th, created one of the biggest crises in the company’s history. As if to prove the reporters’ claims, Zuckerberg publicly denied their veracity. But the Times piece was deeply sourced and contained the disturbing revelation that the company had enlisted a right-wing opposition-research group, Definers Public Affairs, to dig up dirt on George Soros after Soros gave a blistering speech at the World Economic Forum, in Davos, decrying the power of social media, especially Facebook and Google, for their “far-reaching adverse consequences on the functioning of democracy, particularly on the integrity of elections.”

Definers Public Affairs had previously pushed out misinformation about the Apple C.E.O., Tim Cook, on behalf of the tech company Qualcomm, which wanted to undermine Cook’s relationship with the Trump Administration. For Facebook, Definers launched a P.R. campaign—propagated through the conservative and alt-right media ecospheres—that traded on anti-Semitic innuendo to suggest that Soros was the deep pockets behind a grassroots anti-Facebook group. News of Facebook’s campaign against Soros came out three weeks after Cesar Sayoc, a fervent Trump supporter, sent a pipe bomb to Soros—and also to the Clintons, the billionaire Tom Steyer, and other prominent Democrats.

And then it got worse. On November 15th, shortly after the Times exposé was published, Facebook claimed, “The New York Times is wrong to suggest that we ever asked Definers to pay for or write articles on Facebook’s behalf or to spread misinformation.” The next day, Facebook’s chief operating officer, Sheryl Sandberg, who is in charge of the company’s communications team, said, somewhat intricately, “I did not know about or hire Definers or any firm. . . . Definers was hired, we have lots of firms. They were hired not to smear anyone.” But then, the night before Thanksgiving, in a Facebook blog post that the company perhaps thought would be lost in the holiday shuffle, Sandberg allowed that “I did receive a small number of e-mails where Definers was referenced.” A week later, after another damning piece in the Times, a company spokesperson admitted that it was Sandberg herself who had initiated an investigation into whether Soros had a financial interest in criticizing Facebook—that is, if the veteran financier had engaged in what is called “short and distort,” trash-talking a company after betting that its stock will lose value. Not surprisingly, he hadn’t.