A Canadian whistle-blower’s revelations have revealed a complicated tale of how Facebook users’ data was illicitly collected by companies who told their clients they could use it to shape political events around the world. As a result of the backlash that followed the revelations the political consulting company at the centre of the scandal, Cambridge Analytica, has been shut down, as has its parent company SCL Group. Here’s an overview of the companies and people involved, and what they’re alleged to have done.
Which company is which
Canadian data analyst Chris Wylie has worked for or co-founded several firms whose clients included major players in the 2016 U.S. election, the Brexit referendum and Canadian politics. Then, Mr. Wylie became a whistle-blower alleging impropriety in how some of those companies handled data gathered from Facebook.
Cambridge Analytica: A political data analytics firm co-founded by Mr. Wylie, who left the company four years ago. It specializes in mining large amounts of consumer data for behavioural trends that political organizations can use for targeted marketing. Cambridge Analytica harvested millions of people’s Facebook data without authorization in 2014, according to reports earlier this month in The New York Times and Britain’s Observer, a sister paper to the Guardian newspaper. Mr. Wylie’s initial estimate was that 50 million people’s data had been collected, but later, Facebook’s own figures showed an even higher number: 87 million Facebook users worldwide (including, as it turned out, Facebook CEO Mark Zuckerberg), including some 622,000 Canadians. Cambridge Analytica’s partners and patrons included Leave.EU, a pro-Brexit campaign organization. In 2016, Cambridge Analytica would also end up doing political work for future U.S. President Donald Trump’s general election campaign. On May 2, news broke that Cambridge Analytica is shutting down, a decision that was reportedly taken because the company was losing clients and faced rising legal fees over the Facebook investigation.
AggregateIQ: A B.C.-based consultancy firm that Mr. Wylie helped to create, and which he says created Ripon, the program used by Cambridge Analytica to target Republican voters in the United States. AIQ is under official scrutiny in Britain for its role in the 2016 Brexit referendum. Mr. Wylie and another whistle-blower, former Vote Leave volunteer Shahmir Sanni, allege that AIQ wrongfully received campaign funds from the anti-EU side in the referendum, while a group of British lawyers released documents purporting to show that AIQ participated in a plan to break election laws. AIQ has denied any wrongdoing.
SCL Elections: The parent company of Cambridge Analytica. In 2013, SCL was forging ties with U.S. hedge-fund tycoon Robert Mercer and his daughter, Rebekah. This also brought them into a relationship with Steve Bannon, then a political adviser to the Mercers. Mr. Bannon and the Mercers were instrumental in bringing Mr. Trump to the presidency, the former as his campaign adviser and the latter as major donors. SCL Elections’ CEO, Alexander Nix, was also in charge of Cambridge Analytica, until the company suspended him. An undercover investigation by Britain’s Channel 4 appeared to show Mr. Nix and other Cambridge Analytica executives suggesting they could use bribes to help clients achieve their ends, or hire sex workers to put political opponents in compromising positions.
SCL Group: The British-based parent company of SCL Elections bills itself as an expert in helping businesses, intelligence services and the military use data to shape public behaviour. On May 2, SCL Group founder Nigel Oakes confirmed that it and its subsidiary, Cambridge Analytica, would be shuttered.
Eunoia Technologies: A data-analytics company founded by Mr. Wylie after he left Cambridge Analytica. In 2016, the firm had a $100,000 contract with the Liberal Research Bureau, a taxpayer-funded parliamentary office that supports Liberal MPs, for a pilot project having to do with social-media monitoring. This was one of many interactions between Parliament Hill and Mr. Wylie, who once worked for the Liberals.
What did Cambridge Analytica do?
How they got the data: Mr. Wylie and Cambridge Analytica formed a partnership in 2013 with Aleksandr Kogan, a Cambridge University academic. Dr. Kogan developed a Facebook app for personality testing, dubbed “thisisyourdigitallife,” which some 270,000 people downloaded and used. But the app’s licensing agreement required users to give over personal information not only from their own Facebook profiles, but from those of Facebook friends with low privacy settings. Here’s how Mr. Wylie described it to the Observer:
What did they do with the data? Using algorithms derived from the Facebook information, AggregateIQ developed a program called Ripon, Mr. Wylie told a British parliamentary committee on March 27. Ripon, named after the Wisconsin town credited as the birthplace of the Republican Party, was designed to manage fundraising and voter databases, target specific voters and use surveys to gather more political data.
Was that legal? Facebook’s rules at the time allowed for research techniques like Mr. Kogan’s app, but didn’t allow data collected by such methods to be passed along to third parties, especially not for commercial purposes. Facebook says it learned in 2015 that the collected personal data was still out there, but instead of disclosing that, Facebook discreetly asked the parties to destroy the data, and believed them when they said they had done so. Cambridge Analytica, for its part, said it never collected the Facebook data itself, blaming Dr. Kogan for gathering the data improperly. Dr. Kogan has portrayed himself as a scapegoat in the affair, telling the BBC that Cambridge Analytica were the ones who drafted his app’s terms of service and that, as far as he knew, the data-collection methods were legitimate.
Had they tried anything like this before? The SCL-AIQ partnership wanted to try out their data-gathering tactics in Trinidad and Tobago in 2013, according to records obtained by The Globe. There, they planned to gather data in bulk from an internet service provider, hoping to create voters that would benefit a local political party. But it was unclear if AIQ or SCL actually collected the data.
Mr. Wylie, the 28-year-old British Columbian who helped found Cambridge Analytica, has portrayed himself as an unlikely accomplice to the conservative schemes of Mr. Bannon and the Mercers. A gay vegan of liberal persuasion, he got interested in data’s potential to explain or predict elections when he was a student in London who worked for the Liberal Democrat party, according to the Observer’s profile of him. A party connection introduced Mr. Wylie to SCL, whose founder, Mr. Nix, gave him total freedom to pursue his ideas. But Mr. Wylie’s relationship with his employers soured as they got deeper into U.S. conservative politics: “Rules don’t matter for them,” he told the Times. “For them, this is a war, and it’s all fair. They want to fight a culture war in America.”
Mr. Wylie’s interest in politics and fighting injustice began at a young age, The Globe and Mail’s Patrick White reports. Growing up in Victoria, the six-year-old Mr. Wylie was attacked at elementary school by a fellow student, leading to a court battle and a settlement of $290,000. The young Mr. Wylie got involved in Victoria city hall, became a Liberal Party supporter and, in 2008, he went to work for a Liberal MP who knew his parents, Keith Martin. At 17, he worked for the federal Liberals under then-leader Stéphane Dion. A Liberal staffer told The Globe that he pressed the party to microtarget voters using data, but like the Liberal Democrats, they ignored him.
Speaking at a London journalism event on March 20, Mr. Wylie accused Facebook of ignoring him too when, after he left Cambridge Analytica in 2014, he tried to raise concerns with the California company about the harvested data. Facebook deleted him from the platform and associated sites, and he says Facebook is more concerned with blaming him than with fixing their own privacy issues:
The big political questions
Did Cambridge Analytica influence the U.S. election? That’s unclear. Mr. Wylie has said he’s unsure how much the Trump campaign relied on Cambridge Analytica’s data. Mr. Trump’s campaign has denied using their data, saying it relied on the Republican National Committee‘s information instead. Behind the scenes, Cambridge Analytica’s Mr. Nix has been much more confident of the firm’s impact on American politics: In the undercover Channel 4 investigation, he said the firm’s work played a decisive role in the 2016 election. But those comments could not be verified.
Did it influence the Brexit referendum in 2016? It’s unclear whether the data itself had a real impact, though Mr. Wylie and others allege that Cambridge Analytica and AggregateIQ served as proxies that helped the Leave campaign skirt financing rules. AggregateIQ co-founder Jeff Silvester denied that the company had “knowingly been involved in any illegal activity.”
Did it ever influence Canadian politics? Mr. Wylie’s ties to the federal Liberals have raised questions about what the party knew about his or SCL’s activities, but there has been no suggestion of impropriety or influence on the Canadian political process.
For the most part, it seems Liberal officials ignored (or at least didn’t adopt) Mr. Wylie’s ideas about Big Data. One exception was Ray Larson, an associate of Mr. Wylie’s and federal Liberal strategist in Victoria, who once described himself on his website as “head of operations for the SCL Group.” Then in 2016, Prime Minister Justin Trudeau’s Liberal Research Bureau awarded a $100,000 contract to Eunoia Technologies. In a statement, the bureau said the contract was for a pilot project that involved “acquiring and setting up social-media monitoring tools.”
Did it influence other elections? Cambridge Analytica executives told an undercover Channel 4 journalist that they had worked in more than 200 elections worldwide. AIQ’s involvement in the 2015 Nigerian election included the dissemination of graphic video content and “incredibly anti-Islamic and threatening messages," Mr. Wylie told British parliamentarians, adding that this was one of many dirty-tricks campaigns AIQ was involved in. SCL Group boasted about its success in using religious leaders to suppress voters in Nigeria, according to promotional brochures given by Mr. Wylie to the parliamentary committee.
What governments are doing
United States: Facebook has faced new calls for regulation from Congress and was hit with questions about personal data safeguards, but it is unclear whether or how the Republican-controlled legislature will act. Mr. Zuckerberg is testifying on April 10-11 before the Senate commerce and judiciary committees.
Britain: The U.K.’s Information Commissioner is investigating whether Facebook data was illegally acquired and used. “This is a complex and far reaching investigation for my office and any criminal or civil enforcement actions arising from it will be pursued vigorously,” commissioner Elizabeth Denham said, days before investigators from her office executed a warrant to search Cambridge Analytica’s London offices. Mr. Wylie and Mr. Nix have also testified before Parliament’s Digital, Culture, Media and Sport Committee.
Canada: Privacy Commissioner Daniel Therrien’s office is formally investigating Facebook over the Cambridge Analytica data, and Mr. Therrien said he would like to investigate AggregateIQ’s role as well. The House ethics committee voted to investigate the data leak and call on Mr. Wylie to testify, as well as executives from Facebook and other tech companies.
Europe: EU lawmakers will investigate whether the Facebook users’ data was misused, said Antonio Tajani, head of European Parliament.
What Facebook is doing
Cleaning house: Facebook has suspended SCL and Cambridge Analytica from the platform, and hired digital forensics firm Stroz Friedberg to look into Cambridge Analytica. In a statement, vice-president Paul Grewal played down the idea that this was a privacy breach: “People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.” Mr. Grewal also accused Dr. Kogan of having lied to Facebook and breached its privacy rules in his research activities.
Appealing to Congress: On April 10, Mr. Zuckerberg faced a nearly five-hour-long congressional hearing where U.S. lawmakers questioned him about his company’s data-collection practices. But while some politicians in the Republican-controlled legislature said they might pursue regulations against Facebook, there were few indications about how. Ahead of the hearing in Washington, Mr. Zuckerberg announced Facebook would set up an independent election research commission to look at the effects of social media on elections and democracy.
Improving privacy: On March 21, in his first public remarks on the scandal, Mr. Zuckerberg apologized for a “major breach of trust” at the social network, which spent the ensuing weeks rolling out new privacy measures, both to combat measures like those used by Cambridge Analytica and to comply with sweeping European Union privacy laws being introduced in May. These measures include:
- Barring apps from collecting many personal details about users, including their political and religious views, relationship status, education and video-watching activity.
- Requiring developers to get Facebook’s permission before accessing information about events, groups and pages posted on the platform.
- Barring advertisers from targeting users based on information purchased from data brokers.
- Notifying users whose data Facebook believes was compromised by Cambridge Analytica, starting April 16.
- Shutting down a feature that made Facebook users searchable by phone numbers or e-mail addresses.
- Adding a “Privacy Shortcuts” menu to help users review what they’ve posted, delete it more easily and download their data.
What’s next for Silicon Valley?
The Cambridge Analytica affair is only the latest scandal to put social-media tech companies under pressure for their political influence, especially in the 2016 U.S. election. U.S. authorities have uncovered evidence over the past year and a half that a St. Petersburg troll factory, the Internet Research Agency, tried to meddle in the election by creating political agitation groups and fake ads to inflame political tensions through social media. Thirteen Russians have been charged in the alleged plot by special counsel Robert Mueller’s investigation into ties between Russian nationals and the Trump campaign. The Russian meddling exposed major vulnerabilities in how Facebook’s algorithms can be exploited by foreign powers, and renewed calls for tighter regulation of the social-media giant. Mr. Zuckerberg made it his goal for 2018 to fix these problems and prevent future abuse.
Mr. Zuckerberg’s fellow tech gurus, facing blowback from their own users about how their personal information is used, have begun to openly support the idea of regulation. Speaking at a business forum in Beijing, Apple CEO Tim Cook said he was “personally not a big fan of regulation,” but “well crafted” rules could be necessary to address the bigger problems.
What can I do?
For some Facebook users, Cambridge Analytica has been a wake-up call to curb or completely stop using the social-media service: The mayor of Mr. Wylie’s hometown, for instance, says she deleted her account. But issues of data privacy go far beyond Facebook, and short of complete abstinence from the internet, there’s no way to remove it from your life completely. But here are some useful steps:
- Audit your Facebook apps: Go to the setting page and click on the Apps tab to see which services are connected to your account, and which permissions you granted them.
- Check your privacy settings: If you're concerned about what your Facebook friends (and the apps they use) can know about you, review your settings and change them accordingly.
- Install tracker blockers: Browser add-ons like Privacy Badger and Disconnect let you deactivate trackers installed on the website you visit.
- Read terms of service carefully: Whenever you sign up for a new app or service, check to see what data it collects before you download or install it. If you do install it anyway, familiarize yourself with the privacy controls so you know where to go later in case you want to change them.
Associated Press, The Canadian Press and Reuters, with reports from The New York Times, Tamsin McMahon, Patrick White, Paul Waldie, Mark MacKinnon, Colin Freeze, Adrian Morrow and Evan Annett