Cambridge Analytica sought to influence the Nigerian presidential election in 2015 by using graphically violent imagery to portray a candidate as a supporter of sharia law who would brutally suppress dissenters and negotiate with militant Islamists, a video passed to British MPs reveals.
The Guardian has obtained the video, which has graphic scenes of violence from Nigeria’s past. In testimony to the digital, culture, media and sport (DCMS) select committee last week, the whistleblower Christopher Wylie told MPs: “[The video was distributed] in Nigeria with the sole intent of intimidating voters. It included content where people were being dismembered, where people were having their throats cut and bled to death in a ditch. They were being burned alive. There was incredibly anti-Islamic, threatening messages portraying Muslims as violent.”
Wylie also said Cambridge Analytica directed AggregateIQ (AIQ), the Canadian digital services firm that worked for Vote Leave during Britain’s EU referendum, to target voters with the video during the Nigerian presidential campaign.
Wylie, a former Cambridge Analytica employee, has now handed the material to MPs. Giving testimony last week, he said: “Cambridge Analytica sent AggregateIQ the video after they [CA] got banned from several online ad networks because the graphic nature of the content violated the terms of service. AIQ was quite freaked out about it. It’s a very disturbing video. They told Cambridge Analytica that. They called it ‘the murder video’.”
In his testimony Wylie said: “AIQ is the firm that’s right at the heart of the official Vote Leave campaign – one-third of all leave spending went through it – and this shows them working closely with Cambridge Analytica to distribute violent, divisive Islamophobic material that should be nowhere near an election campaign.” There is no suggestion that AIQ was involved in the production of the video.
Cambridge Analytica was hired by a Nigerian billionaire to run a campaign in support of Goodluck Jonathan, a Christian, and the video was targeted at his Muslim opponent, Muhammadu Buhari, who went on to win the election. There is no suggestion that Jonathan was aware of the campaign.
The anti-Buhari video imagines a future in which he is president and sharia law has been imposed. “Coming to Nigeria on February 15th 2015,” the voiceover says in the manner of a trailer for a Hollywood movie. “Dark. Scary. And very uncertain. Sharia for all.” It poses the question: “What would Nigeria look like if sharia were imposed by Buhari?” It suggests he would strike a deal with the Islamist militant group Boko Haram that would be “a pact with the devil”. The video also suggests “Buhari will punish all who speak against the regime” and that “women will be veiled”. It ends by saying: “You can stop this movie becoming real.”
Another former Cambridge Analytica employee who worked on the campaign said: “It was voter suppression of the most crude and basic kind. It was targeted at Buhari voters in Buhari regions to basically scare the shit out of them and stop them from voting. People were working on it in Cambridge Analytica’s office. They’d be sitting there eating their lunch and editing this incredibly graphic and disturbing material.”The video will be seen as further evidence of dirty tricks that Cambridge Analytica employed in the campaign. Last month the Guardian revealed that during the Nigerian election campaign Cambridge Analytica was offered material from Israeli hackers who had accessed private email accounts of two politicians there.
Former Cambridge Analytica employees described how the hackers passed a thumb drive of hacked material relating to Buhari to them in Cambridge Analytica’s offices and they were directed by Alexander Nix, its chief executive, and Brittany Kaiser, a senior director, to search Buhari’s personal emails for compromising material that could be used to smear him. The material included private medical information that employees say was leaked to the press.
The video separately demonstrates the ties between Cambridge Analytica and AggregateIQ, the firm that its parent company SCL Elections employed. Last week the DCMS committee published documents that link Cambridge Analytica and SCL Elections with AIQ, including a contract, a service agreement and an intellectual property agreement that was first revealed in the Observer a year ago.
AggregateIQ is part of a current Electoral Commission investigation into a donation of £625,000 that Vote Leave made to a youth outreach group, BeLeave, which was paid directly to the Canadian firm and it is the focus of allegations made by a second whistleblower, Shahmir Sanni.
AggregateIQ did not respond to previous Guardian inquiries about the video, but said: “AIQ provides digital advertising, web and software development services to third parties. It is completely independent of Mr Wylie, CA and SCL.”
It added: “AIQ is and has always been 100% Canadian owned and operated … the services it provided to Vote Leave were in accordance with instructions given by Vote Leave.” There is no suggestion that AggregateIQ unethically coordinated with Cambridge Analytica on the EU referendum campaign.
A Cambridge Analytica spokesman said: “You are referring to Chris Wylie’s comments before a select committee which included speculation and a serious misrepresentation of the facts. We are, however, taking all allegations about possible unethical practices in the past very seriously and will investigate.”
SCL, Cambridge Analytica’s parent company, had access to secret UK information and was singled out for praise by the UK Ministry of Defence for the training it provided to a psychological operations warfare group, according to documents released by MPs.
An endorsement from an official at the 15 UK Psychological Operations Group dated January 2012 concluded that they would “have no hesitation in inviting SCL to tender for further contracts of this nature”.
The official British note of approval was one of more than 100 pages of documents handed over to the digital, media, culture and sport select committee by Cambridge Analytica whistleblower Christopher Wylie earlier this week, following an oral hearing that lasted nearly four hours.
Another of the documents released by the MPs is a confidential legal memo dated July 2014, which says it was sent to Steve Bannon, the former Trump adviser and Breitbart CEO, and Rebekah Mercer, the daughter of Trump backer and hedge fund billionaire Robert Mercer. It was also sent to Alexander Nix, the CEO of Cambridge Analytica.
The author’s name and firm is redacted, but the memo discusses how far Cambridge Analytica and its executives could participate in US elections, given that donations and contributions by foreign nationals are banned.
Cambridge Analytica hit the headlines after it was revealed that data had been harvested for it from 50m Facebook profiles without the users’ permission.
The document notes that the company, formed in June 2014, could participate as a vendor of technology as long as Nix, a Briton, was “recused from the substantive management of any such clients involved in US elections”.
At the parliamentary hearing on Tuesday, Wylie noted that Vote Leave had spent £2.7m with a digital marketing firm called AggregateIQ, and said it had previously undisclosed links to Cambridge Analytica/SCL.
The documents released include:
- A brochure promising to create US election campaign tools in 2014 that was “prepared for SCL elections by AggregateIQ Data Services” at a cost of more than $500,000 using “modelling data” from SCL to target 100 million or more Americans.
- A services agreement between AggregateIQ and SCL to support that work, listing a schedule of monthly payments.
- A separate contract for work dated November 2013, in which AggregateIQ agrees to work for SCL Elections UK, and which is signed by company AggregateIQ’s chief executive, Zack Massingham, and its chief technology officer, Jeff Silvester, to work on a political campaign in Trinidad and Tobago.
- Wylie had told MPs it was striking that Vote Leave and three other pro-Brexit groups – BeLeave, which targeted students; Veterans for Britain, and Northern Ireland’s Democratic Unionist party – all used the services of AggregateIQ to help target voters online. He accused the leave campaign of “cheating” to win the referendum because Vote Leave donated £625,000 to BeLeave, which in turn spent the money on AggregateIQ. The donation allowed Vote Leave to stay within its £7m legal limit.
AggregateIQ has denied it is linked to Cambridge Analytica. Silvester told the Times Colonist: “AggregateIQ has never been, and is not a part of, Cambridge Analytica or [its parent firm] SCL. AggregateIQ has never entered into a contract with Cambridge Analytica.” However, Wylie told MPs on Tuesday that the corporate structures were designed to be confusing and ensure that regulators could not always keep up with what was going on.
The EU referendum was won through fraud, the whistleblower Christopher Wylie has told MPs, accusing Vote Leave of improperly channelling money through a tech firm with links to Cambridge Analytica.
Wylie told a select committee that the pro-Brexit campaign had a “common plan” to use the network of companies to get around election spending laws and said he thought there “could have been a different outcome had there not been, in my view, cheating”.
“It makes me so angry, because a lot of people supported leave because they believe in the application of British law and British sovereignty. And to irrevocably alter the constitutional settlement of this country on fraud is a mutilation of the constitutional settlement of this country.”
Wylie, who used to work for Cambridge Analytica, gave evidence in a nearly four-hour session before the digital, culture, media and sport select committee. He made a string of remarkable claims about Brexit and Cambridge Analytica, including that his predecessor, Dan Mursean, died mysteriously in a Kenyan hotel room in 2012 after a contract in the company turned sour.
Wylie said it was striking that Vote Leave and three other pro-Brexit groups – BeLeave, which targeted students; Veterans for Britain, and Northern Ireland’s Democratic Unionist party – all used the services of the little-known firm Aggregate IQ (AIQ) to help target voters online.
He told MPs that AIQ was effectively the Canadian arm of Cambridge Analytica/SCL, deriving the majority of its income by acting as a sub-contractor. He said AIQ had also worked with Cambridge Analytica on a failed campaign to discredit Muhammadu Buhari in the Nigerian presidential election, which included hacking into his emails and spreading disinformation via Islamophobic videos that showed people “with their throats being cut”.
“So, the first question that I have is: why?,” Wylie said. “Why is it that all of a sudden this company, that has never worked on anything but Cambridge Analytica projects, that had no public presence, somehow became the primary service provider to all of these supposedly independent and different campaign groups.
“When you look at the accumulation of evidence, I think it would be completely unreasonable to come to any other conclusion: this must be coordination, this must be a common purpose plan.”
The allegations of collusion and overspending were also discussed by MPs in the Commons during an emergency debate attended by only a few Conservative MPs. Having secured the debate, the Liberal Democrat MP Tom Brake asked in his opening speech whether the government could be confident that nobody from Vote Leave who now worked for the Conservatives was going to be charged with electoral offences. Tory MPs interjected to ask him whether he could be sure the remain campaign had not overspent.
Jon Trickett, the shadow cabinet office minister, said the Electoral Commission needed to have all the resources and power available to complete its inquiry into spending by Vote Leave, and referenced the roles of Johnson and Michael Gove in its campaign.
“It’s because the government is in it up to its neck,” he said. “Two cabinet ministers fronted the organisation. There they sit, week after week, the Bonnie and Clyde of Brexit.”
Trickett said that, if necessary, the police should also investigate the allegations.
Chloe Smith, the minister with responsibility for electoral law, said she would not comment on the allegations while they were under investigation. She said, however, that the Electoral Commission had the resources it needed, and was set to underspend on its budget this year.
However, Wylie told MPs that, while technically true, the corporate structures were designed to be confusing and ensure that regulators could not always keep up with what was going on.
Wylie said he was surprised that Dominic Cummings, Vote Leave’s campaign director, had discovered AIQ, which did not have its own website. He said he had one meeting with Cummings in late 2015, when he made an unsuccesful pitch for work.
“Data was really important for Dom,” Wylie said, noting that Cummings was aware of both Cambridge Analytica and its principal backer, Robert Mercer, a rightwing US hedge fund billionaire and Donald Trump supporter.
Cummings responded during the hearing by writing in a blogpost that Wylie was a “fantasist-charlatan”. When put to Wylie by a member of the committee, Chris Matheson, Wylie said his evidence had been “fact checked by the Guardian, the Observer, the New York Times, Channel 4 News and the ICO [the Information Commissioner’s Office]”.
**
Excerpt
Cambridge Analytica and its parent company have been accused of potentially violating US election law by allowing its chief executive and other British citizens to play a significant role in US campaigns, according to legal complaints filed on Monday with the Department of Justice and the Federal Election Commission.
The pair of complaints, brought by the nonpartisan government watchdog Common Cause, call on federal prosecutors and regulators to investigate whether the UK-based data analytics group violated a US law barring foreign nationals from participating in certain election-related activities through its work for Donald Trump’s campaign.
The complaints allege that several Cambridge Analytica employees, including Alexander Nix, the company’s CEO who was recently suspended, performed significant work that constituted being part of the “decision-making process” in campaigns during the 2014 and 2016 US election cycles.
Employees who worked for Cambridge Analytica in the US in recent years have told the Guardian that rather than addressing the challenges imposed by US election law, management appeared to ignore the issue.
The filing comes as Cambridge Analytica faces intense scrutiny after the Observer revealed that it acquired the data of as many as 50 million Facebook users, harvested by another company without users’s express consent, to create a system that could target US voters with political ads and other personalized posts based on their psychological profile.
The legal complaints both state that during the 2014 and 2016 election cycles: “Cambridge Analytica LTD and its sister company, SCL Group Limited, and numerous employees of the London-based companies repeatedly violated the prohibition on foreign nationals performing certain election-related activities.”
The complaints also name Nigel Oakes, the founder of Strategic Communications Laboratories (SCL), the parent company of Cambridge Analytica, and Christopher Wylie, a former Cambridge Analytica contractor-turned whistleblower who helped build the algorithm using Facebook user data.
“We are a nation of laws and our campaign finance laws must be enforced by the FEC and the justice department in order to safeguard the integrity of our elections from foreign interference,” Karen Hobert Flynn, the president of Common Cause, said in a statement.
The complaint cites reports that Cambridge Analytica had been advised in 2014 by an American election lawyer that the arrangement of its contracts could violate the US laws limiting the role of foreign nationals in the country’s elections. The lawyer’s memo was addressed to Nix, Steve Bannon, the former Trump adviser who at the time held a position on Cambridge Analytica’s board, and Rebekah Mercer, a Republican mega-donor and key investor in the firm.
The complaint filed with the justice department also cites more than $800,000 in services by Cambridge Analytica in 2016 to a political action committee headed by John Bolton, who was tapped as Trump’s new national security adviser last week. According to documents obtained by the Guardian, Bolton’s work with Cambridge Analytica included a project in 2014 to target YouTube videos to US voters based on different psychographic data. A spokesperson for Bolton, who was recently appointed by Donald Trump as the new White House national security adviser, said he was “completely unaware” of the allegations.
“Based on published reports, there is reason to believe that certain US nationals operating and/or working for Cambridge Analytica, SCL Group, and political committee clients of Cambridge Analytica and SCL Group, may have aided and abetted offenses against the United States, conspired to commit offenses against the United States, and/or attempted to conspire to commit offenses against the United States in violation of the US criminal code,” the Common Cause complaint states.
A justice department spokeswoman declined to comment. Cambridge Analytica did not immediately respond when contacted by the Guardian about the latest allegations.
The company has repeatedly denied wrongdoing and pushed back against allegations that the company obtained or misused data from Facebook during the 2016 campaign. Last week, Cambridge Analytica’s acting chief executive, Alexander Tayler, apologised in a statement that its affiliate, SCL Elections, had licensed Facebook data and derivatives in 2014 from the research company GSR, which he said “had not received consent from most respondents”.
But Tayler maintained that Cambridge Analytica “believed that the data had been obtained in line with Facebook’s terms of service and data protection laws”. He added: “As anyone who is familiar with our staff and work can testify, we in no way resemble the politically motivated and unethical company that some have sought to portray.”
Tayler’s apology came shortly after the company’s board suspended Nix in the wake of secret recordings broadcast on Channel 4, in which the former CEO bragged about Cambridge Analytica’s role in Trump’s victory.
“We did all the research, all the data, all the analytics, all the targeting,” Nix told an undercover reporter. “We ran all the digital campaign, the television campaign and our data informed all the strategy.”
The firm’s other clients in 2016 included Ben Carson, who also for Republican presidential nomination and now serves as Trump’s secretary for the Department of Housing and Urban Development, and Make America Number 1, a Super Pac that supported Trump’s and Cruz’s campaigns.
Last week, an internal company document obtained by the Guardian revealed how Cambridge Analytica used intensive survey research, data modeling and performance-optimising algorithms to micro-target US voters in the months leading up to the November election. The presentation was produced by the Cambridge Analytica employees who worked most closely on Trump’s campaign.
Brexit
AggregateIQ: the obscure Canadian tech firm and the Brexit data riddle
Documents released last week shed more light on the puzzle of the company’s links to Cambridge Analytica
‘Find Christopher Wylie.” That instruction – 13 months ago – came from the very first ex-Cambridge Analytica employee I met. He was unequivocal. Wylie would have answers to the two questions that were troubling me most. He could tell me about Facebook. And he would know about Canada.
What Christopher Wylie knows about Facebook, the world now knows. Facebook certainly knows – its market value is down $100bn. But the Canadian connection remains more elusive. What it is. Why it matters. And why it triggered my search for Wylie.
We heard from him at a session of the digital, culture, media and sport (DCMS) select committee that the BBC parliamentary correspondent Mark D’Arcy described as “by a distance, the most astounding thing I’ve seen in parliament”. Perhaps not because of Wylie’s arresting appearance – though there was that too, his pink hair offset with a suit for the occasion – but because of what he said: a four-hour account of his involvement with Cambridge Analytica that he backed up with documents, a selection of which the committee published two days later.
Seven fraught hours later, we published an article headlined “Follow the data” . It was centred on one particular document. A document that linked Cambridge Analytica to a small, seemingly inconsequential firm based above an optician’s shop in Victoria, Canada. A document that was among the stash of those released by the DCMS committee on Thursday.
The firm – AggregateIQ – didn’t appear inconsequential. In the words of Vote Leave’s campaign manager, Dominic Cummings, it played a crucial role in the Brexit campaign. For more than a year, a quote from Cummings – “we couldn’t have done it without them” – was emblazoned across AIQ’s website. Words that disappeared from the website a week ago, removed after we submitted our questions to the firm.
The first major article I wrote about Cambridge Analytica last February outlined a relationship between Nigel Farage’s Leave.EU campaign and Cambridge Analytica and the relationships with Robert Mercer, the firm’s main investor, and its shareholder and vice-president Steve Bannon. It kicked off an investigation by the Electoral Commission and the Information Commissioner’s Office. Then, a few days later, a reader from Canada got in touch. Did I know that the telephone number and address listed on Cambridge Analytica’s website as its Canadian office – SCL Canada – belonged to Zackary Massingham? Did I know that he was the chief executive of a company called AggregateIQ? A firm that had worked for Vote Leave? I didn’t.
Because Vote Leave was the official campaign. It was of a different order of importance to Farage’s Leave.EU. Vote Leave had been recognised by the Electoral Commission. It had been entrusted with taxpayers’ money. It was headed by Boris Johnson and Michael Gove – now both ministers in Theresa May’s government. And who are now seeing the scandal currently engulfing Cambridge Analytica arriving at their doorstep.
Last week we published the account of another whistleblower, Shahmir Sanni, and how he believed that Vote Leave senior officials took advantage of him and his friend, Darren Grimes, to ramp up their own spending. Vote Leave gave their campaign, BeLeave, £625,000 – but in November the Electoral Commission opened an investigation into it. The donation was legal only if BeLeave really was an independent organisation, operating separately. And Sanni had startling new evidence: he said it wasn’t. Sanni – the treasurer – wasn’t even allowed to get his train tickets refunded. Instead, the money was paid directly to AggregateIQ – the company that a year earlier I had found listed on Cambridge Analytica’s website as SCL Canada.
The documents published last week finally make the legal connection between AggregateIQ and Cambridge Analytica public. The committee has published an intellectual property agreement between AIQ and SCL Elections – Cambridge Analytica’s parent company. There’s also a service agreement between the two firms that set out revenue-sharing clauses and payment details, an internal Cambridge Analytica staff list that names Massingham, and emails about work the two firms did together for John Bolton, the newly appointed national security adviser to Donald Trump. On 21 August 2014, Alex Tayler, the acting managing director for Cambridge Analytica, wrote to Jeff Silvester, co-founder of AggregateIQ, and said: “Personality Cluster information for the target voter segments for all 3 states (modelled for all voters of interest, not just Kogan sample/seeders).”
“Kogan” is Aleksandr Kogan, the Cambridge University psychologist that Cambridge Analytica contracted to harvest Facebook data. And the “sample/seeders” are the individuals who Kogan’s company, GSR, paid to fill in personality surveys and allow access to their friends’ data.
Last week, AIQ sent us a legal letter. It said that AggregateIQ is not a direct part and/or the Canadian branch of Cambridge Analytica and that it has not been involved in the exploitation of Facebook data or otherwise been involved in any of the allegations of wrongdoing made against Cambridge Analytica. It did not secretly and unethically coordinate with Cambridge Analytica on the EU referendum. It did not share technology with Cambridge Analytica. It never represented itself as SCL Canada. The first it knew of its phone number being on the website was when the Observer reported it. And it is 100% Canadian-owned.
But Wylie told MPs that he had helped set up both Cambridge Analytica and AggregateIQ and that it was based in Canada, in his hometown of Victoria, because Silvester and Massingham, the directors, were friends. From Hansard: “They had new families, had just got a house, and it is not easy to just get up and move to a different country when you have young kids.
“The compromise was that a Canadian company would be set up … But the deal was that they would sign an intellectual property licence whereby all of the work that they were doing for the company would be assigned to SCL Group and they would trade as SCL Canada, but they set up a Canadian entity, and the legal name was AggregateIQ.”
The same week, Gizmodo, a specialist tech site, published an article headlined “AggregateIQ created Cambridge Analytica’s Election Software and Here’s the Proof” based on research that a cybersecurity firm, UpGuard, had produced. Chris Vickery, the director of cyber-risk research at UpGuard, claimed they had found a repository of code that AggregateIQ left exposed online. The code suggested that it was AggregateIQ that had developed the Ripon platform – the software product that is the foundation of Cambridge Analytica’s technology.
This was part one of the AggregateIQ Files. The second part, which UpGuard published on Thursday, revealed code that suggested that AIQ had built websites and landing pages for Vote Leave, Veterans for Britain, the DUP, Change Britain and Gove 2016. These were all new claims. Last May, David Banks of Veterans for Britain told me it had engaged AIQ in the last weeks of the campaign after it had received a donation from Vote Leave, which it used for digital marketing. For Facebook ads. There was no mention of a website and the AIQ invoice for £100,000 it submitted to the Electoral Commission is for a “digital ad campaign”. The Observer could not reach Banks for comment.
The repository also appears to include code for landing pages for the DUP’s website. The AIQ invoice it submitted to the Electoral Commission, for £32,750.73, is for digital advertising, and a spokesman for Jeffrey Donaldson MP, whose name is on it, told the Observer: “AIQ did not build any pages for the DUP website at any point.”
Another of the sites in the repository appears to be for a campaign not previously associated with AIQ. Change Britain was a “grassroots campaign” with “1000s of volunteers who want to help make Brexit happen” led by Gisela Stuart, formerly Labour MP for Birmingham Edgbaston and the chair of Vote Leave. Its code appears to contain details of a Vote Leave staff member’s email address. Stuart did not respond to questions about who had paid for or commissioned this site.
The final discovery in UpGuard’s AIQ find is code for a website for Gove 2016. This was the campaign Gove launched on 30 June, six days after the referendum result, to be leader of the Tory party. AIQ gained administrator access to the site the same day Gove turned on leadership candidate Boris Johnson and announced his own intention to run. When asked about the work AIQ did for Gove, a spokesman said: “The Gove 2016 campaign paid AIQ £2,720.46 in July to set up its website. The payment was authorised by the campaign manager and paid for from funds donated to the campaign. All campaign spending was fully declared to CCHQ as required under Conservative party leadership election rules.”
AIQ did not respond to inquiries about its work on the Gove 2016, Change Britain, DUP and Veterans for Britain websites, or the UpGuard report. Gove 2016 never went live – according to reports, the campaign failed to secure the domain, www.gove2016.co.uk. And a week later, Gove’s leadership bid was over.
Gove’s statement above wasn’t just given to the Observer, however. It found its way to the rightwing gossip site Guido Fawkes two days ago, in an apparent spoiler for this story.
It’s not a good look. But then, of the many questions being asked by the British authorities investigating Vote Leave – the Electoral Commission and the Information Commissioner’s Office – one must be: what did Gove know?
Sanni, the whistleblower who came forward last week to tell his story about the BeLeave donation, claims Gove knew everything. “Everyone associated with the campaign knew who Darren was,” he says. “Everybody congratulated us and knew what role we’d played. Michael Gove knew exactly how important we’d been. He’s a close friend of Dom Cummings. Of course he knew. Boris Johnson knew. Everybody knew.”
Cummings, the campaign mastermind behind Vote Leave, had worked as a special adviser to Gove when he was in the Department for Education. His fellow adviser was Henry de Zoete, the head of Vote Leave’s digital operations. This is a tight-knit group who have known each other for years. “The thing about Gove and Cummings is that they are friends,” says Sanni. “They hang out at each other’s houses. It’s a relationship that goes well beyond being colleagues.”
It was Cummings’s name – along with de Zoete’s – that was deleted from 140 files on a Google shared drive two weeks after the Electoral Commission opened an investigation last March. A drive that was set up by Vote Leave to share content with BeLeave and AIQ. Vote Leave says it acted “ethically, responsibly and legally in deleting any data”. Last week Cummings said of Sanni and Wylie: “I think they have lied to the Observer and its lawyers”.
But it is Gove, the co-convener of the campaign, along with Stuart, its chair, and Johnson, its figurehead, who need now to answer questions. It’s the proximity of Vote Leave’s activities to the heart of government that is the most troubling aspect of this. Gove and Johnson are Theresa May’s ministers. Two other Vote Leave directors implicated, Stephen Parkinson and Cleo Watson, are advisers to May. Watson said: “I absolutely deny the claims being levelled against me.” Parkinson said the allegations were “factually incorrect and misleading”.
Campaigns are forbidden by law from coordinating. Unless they declare spending jointly. None of these campaigns did. They were all separate. They were all separate – and all connected to AggregateIQ. Facebook would know, of course, if there was a common plan. But Facebook is a black unknowable box. And Mark Zuckerberg has, for the third time, turned down parliament’s request to answer questions on that and other issues.
A year ago, I was told that Christopher Wylie was the key to understanding AggregateIQ. To unravelling Cambridge Analytica’s Canadian connection. Last week, the week that marked the one-year countdown to Britain exiting the EU he told parliament about it in explicit detail. Now it is up to parliament. It is in possession of Cambridge Analytica’s and AIQ’s corporate documents. It supports a government that is intimately entwined in this. And how it negotiates those two irreconcilable facts may be a yardstick that future generations will come to measure it by.
Revealed: the ties that bound Vote Leave’s data firm to controversial Cambridge Analytica: Role of remote data affiliate raises questions over relationship between Brexit groups
Cambridge Analytica has undisclosed links to the Canadian digital firm AggregateIQ that played a pivotal role in the official Vote Leave campaign in 2016, which was headed by the environment secretary Michael Gove and the foreign secretary Boris Johnson, the Observer has learned.
Christopher Wylie, the former Cambridge Analytica employee turned whistleblower, has revealed that as well as playing a part in setting up the firm – which is now facing increasing scrutiny from investigators on both sides of the Atlantic over its role in harvesting Facebook data – he was also a central figure in setting up AIQ, which accounted for 40% of Vote Leave’s campaign budget.
The Observer first disclosed connections between the firms a year ago when it published details of an intellectual property licence that linked AIQ and SCL Elections, the parent company of Cambridge Analytica.
In public, the official Leave campaign and Nigel Farage’s Leave.EU campaign were quite separate and appeared hostile to each other. But the connections between the two data firms raise fresh questions about possible overlaps between the two campaigns.
Wylie said that, in 2016, the relationship went far beyond that. Although AIQ and Cambridge Analytica appeared separate, the two were bound by a skein of threads so intimate that some Cambridge Analytica staff referred to the Canadian data firm as a “department” within the company. Wylie said that the two businesses shared the same underlying technology.
“AIQ wouldn’t exist without me,” he said. “When I became research director for SCL [the parent company of Cambridge Analytica] we needed to rapidly expand our technical capacity and I reached out to a lot of people I had worked with in the past.” That included Jeff Silvester, his former boss, who lived in Wylie’s home town – Victoria, capital of the province of British Columbia. Wylie suggested Silvester should work for the firm in London. “But he had just had a family and wasn’t keen to go to London,” he said.
The Observer has seen an email from 11 August 2013 that Wylie sent to Silvester about SCL. “We mostly do psychological warfare work for NATO,” he said. “But a lot of projects involve a socio-political element.”
Silvester replied: “You need a Canadian office.”
He then set up AIQ with his business partner, Zack Massingham, to work on SCL and later Cambridge Analytica projects. “Essentially it was set up as a Canadian entity for people who wanted to work on SCL projects who didn’t want to move to London. That’s how AIQ got started: originally to service SCL and Cambridge Analytica projects,” said Wylie.
Last March, when the Observer started asking questions about the connection between Cambridge Analytica and AIQ, the former removed “SCL Canada” and Massingham’s phone number from its website and said that AIQ was a “former IT contractor”.
Cambridge Analytica is already under scrutiny for its work for Farage’s Leave.EU campaign, and AIQ is also involved in an investigation by the Electoral Commission into Vote Leave.
On Saturday the Information Commissioner, Elizabeth Denham said that “AggregateIQ has not been especially co-operative with our investigation. We are taking further steps in that matter.”
The mystery of how Vote Leave even found AIQ, a firm with just 20 staff that operated 4,760 miles away out of a cramped office above an opticians in the Canadian city of Victoria, was raised by the Observer last May.
Dom Cummings, the chief strategist for Vote Leave, told this newspaper that he found the firm “on the internet”. But cached searches show that AIQ had no internet presence at that time and a new source within Vote Leave has come forward to say that Cummings had full knowledge of the connections between the two firms.a former Cambridge Analytica employee who made the introduction. He knew exactly how the two companies operated together. He knew they’d worked together on the [former candidate for the Republican nomination for president] Ted Cruz campaign and that they shared the same underlying technology,” said the source.
But Cummings told this newspaper: “Vote Leave data never went anywhere near Cambridge Analytica and your repeated attempts to show that Vote Leave and Cambridge Analytica were somehow secretly coordinating is not just without foundation but the opposite of the truth.”
Until 2016, AIQ had no clients other than Cambridge Analytica. The lack of a website, Wylie claims, was because at the time of the referendum it was operating almost as “an internal department of Cambridge Analytica. It didn’t have a website and no contact number. The only public contact number was SCL’s website.” However, AIQ says it has had a website since it was founded in 2013.
Wylie said that AIQ managed Cambridge Analytica’s technology platform – Ripon – and its databases. “Because AIQ was operating internally, almost as a department of Cambridge Analytica, it didn’t have a website and no contact number. The only public contact number was SCL’s website,” said Wylie.
He said AIQ also had its intellectual property owned by Cambridge Analytica. “AIQ often traded as SCL Canada for ages and although a technically separate company, the IP [intellectual property] was retained by Cambridge Analytica and SCL.
“They were the ones that took a lot of data that Cambridge Analytica would acquire and the algorithms they build and translated that into the actual physical targeting online, they [AIQ] were the bit that actually disseminated stuff. AIQ managed the Ripon platform, which is Cambridge Analytica’s platform, and built a lot of the tech that would connect the algorithms to social and online advertising networks.”
Wylie claims that the two entities, certainly during the time of the referendum campaign, were operating closely. “Among internal CA staff AIQ was referred to as ‘our Canadian office’. They were treated as a department within the company,” he said.
Cummings would later say: “Without a doubt, the Vote Leave campaign owes a great deal of its success to the work of AggregateIQ. We couldn’t have done it without them.” His quote, emblazoned on the AIQ website for more than a year, disappeared on Thursday.
Silvester said that Cambridge Analytica was not in contact with AIQ during the referendum campaign. “AIQ never worked or even communicated in any way with Cambridge Analytica or any other parties related to Cambridge Analytica with respect to the Brexit campaign. Any claim that we shared Vote Leave data with Cambridge Analytica or anyone else in any way is entirely false.”
He added: “AggregateIQ has always been 100% Canadian owned and operated.”
• This article was updated on 27 March 2018 to clarify which SCL Group company AIQ’s intellectual property was licensed to; and on 29 March to clarify that Victoria, on Vancouver Island, is the capital of the province of British Columbia and is 4,760 miles, not 2,300 miles, from London.
• Addendum, 29 March 2018: we are happy to clarify that we did not intend to suggest that AggregateIQ is a direct part and/or the Canadian branch of Cambridge Analytica or that it has been involved in the exploitation of Facebook data or otherwise in any of the alleged wrongdoing made against Cambridge Analytica. Further we did not intend to suggest that AIQ secretly and unethically coordinated with Cambridge Analytica on the EU Referendum.
A whistleblower who worked for the official Vote Leave campaign has broken cover to raise concerns that the masterminds behind the 2016 vote – including key figures now working for Theresa May in Downing Street – may have flouted referendum spending rules and then attempted to destroy evidence. The allegations, from former volunteer Shahmir Sanni, are detailed in an interview in the Observer and supported by a mass of documents and files that he has passed to the Electoral Commission and the police.
Sanni’s central claim concerns a donation of £625,000 that Vote Leave ostensibly made to an independent referendum campaign organisation called BeLeave. He claims the money, channelled to a digital services firm linked to the controversial Cambridge Analytica firm, violated election rules because it was not a genuine donation.
The money was registered by BeLeave with election authorities as a donation from Vote Leave to an independent youth operation. Sanni says BeLeave shared offices with Vote Leave – fronted by Boris Johnson and Michael Gove – which in practice offered advice and assistance to the group and helped them to decide where their cash would be spent.
British electoral law prohibits co-ordination between different campaign organisations, which must all comply with spending limits. If they plan tactics or co-ordinate together, they must have a shared cap on spending. Vote Leave strongly denies any such co-ordination.
Sanni says that after the commission opened an investigation last March, Victoria Woodcock, the operations director for Vote Leave, deleted herself, campaign director Dominic Cummings and Vote Leave’s digital director, Henry de Zoete, from dozens of files on the drive Vote Leave shared with BeLeave to hide the fact of co-ordination. On a blog post on Friday, Cummings said this was “factually wrong and libellous”. Vote Leave say staff acted “ethically, responsibly and legally in deleting any data”. It is not known whether she was acting under instruction.
Most of the £625,000 donation went to a Canadian data company called AggregateIQ, which has links to Cambridge Analytica, the firm that used harvested Facebook data to build a political targeting system in the US. Christopher Wylie, the former CA employee turned whistleblower, said that at the time of the referendum, the Canadian firm was operating “almost as an internal department of Cambridge Analytica”.
AIQ would eventually soak up about a third of all Vote Leave’s official spending, receiving £2.7m from the group in addition to the money that came via BeLeave. The firm also received £100,000 from Veterans for Britain and £32,750 from the DUP. After the referendum, Cummings stated on AIQ’s website: “Without a doubt, the Vote Leave campaign owes a great deal of its success to the work of Aggregate IQ. We couldn’t have done it without them.”
Other senior figures in Vote Leave included Stephen Parkinson, now Theresa May’s chief adviser. Parkinson said in a statement: “I am clear that I did not direct the activities of any separate campaign groups. I had no responsibility for digital campaigning or donations during the referendum and am confident that Vote Leave acted entirely within the law and strict spending rules at all times.”
Sanni, who was treasurer and secretary of BeLeave at 22, is still a committed Eurosceptic and works at the TaxPayers’ Alliance campaign group. He says he decided to go public because he did not want Brexit to be tainted by possibly illegal activities. He was also alarmed by the fact that his friend, Darren Grimes, the former head of the BeLeave youth group, is a focus of an Electoral Commission investigation into breaches of spending limits.
Sanni said Vote Leave “didn’t really give us that money. They just pretended to. We had no control over it”.
He believes Vote Leave’s senior officials may have taken advantage of the group’s youth and the political inexperience of Grimes to ramp up their own spending. He emphasises BeLeave was a small Brexit-supporting outreach group run by twentysomethings with no real experience or background in campaigning or finance.
He says that it was helped by Vote Leave staff to set up its own constitution and bank account so that it could accept donations of its own. Vote Leave’s lawyers did the legal documentation, he said.
“We were advised every step of the way by Vote Leave’s lawyers. They told us what to do and where to sign.”
The payment to AIQ was ostensibly made by BeLeave as the referendum campaign drew to a close. But Sanni claims BeLeave didn’t have any choice about where the cash would be spent, didn’t sign a contract with AIQ, and did not direct what the data firm did with the funds. The money never even passed through the group’s own bank account.
“There was no contract in front of me, as treasurer and secretary,” Sanni said. “I didn’t see any contract.” This process was repeated with a further £50,000, from an outside donor.
Vote Leave said: “It was Darren’s decision to hire AIQ, agreed with and confirmed by Shahmir Sanni.”
Venner Shipley, Vote Leave’s lawyers, said: “We have never been instructed by, nor have we ever provided advice to BeLeave.”
Sanni has shared emails with the Observer and the authorities which appear to show the young campaigners seeking advice from top Vote Leave figures, an invoice to VoteLeave covering work on the BeLeave campaign and messages from Vote Leave lawyers and accountants about the practicalities of establishing it as an independent group.
Sanni explained that Vote Leave also set up and managed a shared BeLeave computer drive with the youth campaign’s messaging, information and other documents.
The emails reveal other senior figures were in regular contact with BeLeave. Cleo Watson, who was head of outreach for Vote Leave and is now a political adviser alongside Parkinson in Downing Street, was in touch with the organisation and was a member of a closed Facebook group for BeLeave contributors. In a statement to the Observer, Watson said: “I absolutely deny the claims being levelled against me.”
This weekend Parkinson was at the centre of a political storm after revealing in a statement delivered without Sanni’s consent that they dated each other for a year and a half, including the period when Parkinson was at Vote Leave and Sanni worked as a volunteer.
Parkinson said he only gave Sanni advice and guidance in the context of that relationship. In a statement released on Friday night, lawyers for Sanni said: “We believe this is the first time a Downing Street official statement has been used to out someone. My client is now having to come out to his mother and family … and members of his family are being forced to take urgent protective measures to ensure their safety.”
In one email to Vote Leave’s lawyer, Watson acknowledged that BeLeave did not have the experience needed to handle the funds that would be spent in their name, stating: “Darren and the rest of the group (all between 18 & 22) don’t feel comfortable handling the money side of things, having no experience beyond their student loans.”
In a statement to the Observer, Watson said: “To imply that being supportive of their work was to have any kind of control over their activities is absolutely untrue.”
Woodcock, the operations director for Vote Leave, has been described by Cummings as “the most indispensable person in the campaign”. The documents provided by Sanni suggest that after the Information Commissioner’s Office last year announced an inquiry into how the campaigns used personal data, she deleted key Vote Leave names, including her own, from dozens of files on the shared BeLeave drive.
Woodcock told the Observer: ‘The gist of those allegations is that I knowingly and deliberately deleted evidence which would be relevant to an investigation in an attempt to frustrate it. I believe that is untrue and completely unsupported by the evidence.”
Cummings said: “The allegations about illegal donations to BeLeave are false and are part of a campaign to cancel the referendum result.”
Further evidence of contact between senior figures at Vote Leave and BeLeave during the referendum came in a witness statement from Matthew Elliott, the campaign chief, which was submitted to the High Court on March 13, 2018 as part of a judicial review. “I can confirm distinct campaigns were run,” Elliott says, who added that he was including some examples of BeLeave publicity work to help clarify details. “I thought it may assist the Court in having examples of the campaign material used by the different campaigns and I attach those.”
A photograph attached shows a group of young people – including Grimes – beneath the BeLeave logo. But emails detail how on 18 March 2016, it was Cleo Watson who organised that photoshoot. In another email from 22 March, it was Stephen Parkinson who signed off on the logo.
In February 2016, a leaked email from prominent Brexit supporter, Steve Baker, now a junior minister in the Department for Exiting the European Union, floated the idea of creating “separate legal entities each of which could spend £700,000”.
Sanni believes this is exactly what happened with BeLeave. “Throughout this whole process Darren and I were victims to very intelligent people trying to find ways to overspend.” Sanni said. He described Grimes as a ‘fall guy’.
Grimes denied to the Observer that there was any collaboration with Vote Leave on campaign material or spending, and threatened legal action.
Why young, inexperienced BeLeavers were perfect for the Brexit campaign: Vote Leave didn’t know how to reach liberal Eurosceptics. But Darren Grimes and his friends, with their witty internet adverts, could do just that
By Carole Cadwalladr and Emma Graham-Harrison, The Guardian, Sat 24 Mar 2018
The handful of teens and twenty-somethings who made up BeLeave seemed an unlikely group to attract the attention of Britain’s most powerful Brexiters, but long before they got a large, controversial donation from Vote Leave they had made their way to the heart of the official campaign.
All politically inexperienced volunteers, they were welcomed into the team backed by Michael Gove and Boris Johnson, mostly because of the demographic they promised to reach.
It was Darren Grimes, then a 23-year-old fashion student from County Durham, who set up the youth group. A Liberal Democrat member with a talent for graphic design and social media marketing, he had an approach that was rare among the groups campaigning for Brexit.
BeLeave messages targeted a group generally inclined towards Remain – young, diverse and progressive voters – who the senior campaigners at the official Vote Leave campaign thought would be both hard to win over and critical to any victory. “Vote Leave understood that they couldn’t win the referendum if they specifically targeted angry Ukippers. They knew that they needed to target young liberals,” said the group’s treasurer turned whistleblower Shahmir Sanni.
“They needed to target Green party members that didn’t like the EU’s environmental laws, or liberal Eurosceptics like me that did hold fiscally conservative values but were socially liberal and understood the EU didn’t support everyone, that it only benefited Europeans.”
When Sanni joined the BeLeave team, it had already become extraordinarily successful in appealing to liberal and leftwing supporters on Facebook and other social media, using videos and other messaging that often appeared to be the exact opposite of the largest Vote Leave and LeaveEU campaigns.
Their positions stood out, even amid the patchwork of pro-Brexit groups, and Vote Leave realised BeLeave could prove useful as it battled for designation as the official campaign against the Arron Banks- and Farage-backed Leave.EU. Needing to show a broad spectrum of support, it listed the youth group in its application, among a range of independent “outreach groups” claimed to be backing Vote Leave.
Yet at the time BeLeave worked out of Vote Leave headquarters, under its guidance and support. Although it had its own website, it appears to have been co-ordinated and paid for by the Vote Leave head of outreach Cleo Watson. “You deserve a brilliant site and this is so annoying,” Watson, now a political adviser to the prime minister, wrote to Grimes when development of the group’s site hit a glitch. “Will troubleshoot this asap.”
Watson said: “I absolutely deny the claims being levelled against me, including the allegation that I co-ordinated and paid for the BeLeave website”. She added: “To imply being supportive of their work was to have any kind of control over their activities is absolutely untrue and deliberately misleading.”
But in the final weeks before the referendum, as Vote Leave neared its spending limit of £7m, senior directors suggested to BeLeave that, if they set up as a separate campaign, they would receive a donation to spend on their own advertisements.
Preparing for meetings with prospective donors – and unaware that they were working beside the people who were planning to support them – the team drew up a pitch for funds. Even their highest hopes were well below the eventual donation. “On our proposal we wrote £10,000 would get you this much engagement on Facebook, and if you gave us £100,000 this is how much engagement we’d get,” Sanni said. “We were putting it there just in case.”
They pointed out that their Facebook posts were engaging more people – to share, comment or like – than most paid advertisements by political campaigns. One video reached 41,000 people in one day without any paid promotion. “With funding, we could triple this amount,” their pitch said.
Shortly afterwards Vote Leave drew up legal documents allowing BeLeave to create a bank account so that it could accept donations of its own. “Following our discussion I attach a typed-up first draft of the constitution,” Vote Leave’s legal director said in an email to Grimes in May, with Watson copied in.
He told Sanni, BeLeave’s secretary and treasurer, to set up a bank account. Then Vote Leave revealed to the astonished young team that they would be getting a donation of more than £600,000. “To be at that age and to find out that my organisation, that the work that I’ve done, has received funding of almost £1m, I was elated,” Sanni said. “It was amazing.”
The donation never made it into the bank account. The money would be passed directly to AggregateIQ – Vote Leave’s data analytics firm – in its name, without ever coming under even nominal control of BeLeave.
“The first thing I said to Darren was, ‘Well, OK, can I get my train tickets paid for?’,” remembers Sanni. But Grimes made clear that he had no control over even small amounts.
The BeLeave team were allegedly not warned of potential implications. “If I am being advised by … a compliance lawyer for Vote Leave, I have no reason to think anything is wrong,” Sanni said. Vote Leave has denied any suggestion it co-ordinated with BeLeave.
When the size of the donation drew scrutiny from the Electoral Commission, Grimes said he found AIQ on the internet and was so impressed he decided to blow his budget on its marketing. But cached data shows that, at the time, AIQ did not have a website. AIQ says it had a website since it was founded in 2013.
Grimes knew about the firm because of its work with Vote Leave, whose director and other employees sat at desks near his own in the campaign HQ, where BeLeave’s work, whether in messaging or as a conduit for funds, was highly appreciated. “Everyone knew who Darren was,” Sanni says. “Everybody congratulated us and knew what role we’d played. He knew exactly how important we’d been. He’s a close friend of Dom Cummings [the Vote Leave strategist]. Of course he knew. Boris Johnson knew. Everybody knew.”
Grimes denied to the Observer that there was any collaboration with Vote Leave on campaign material or spending.
**
He said one Facebook executive advised him against looking too deeply at how the data was being used, warning him: “Do you really want to see what you’ll find?” Parakilas said he interpreted the comment to mean that “Facebook was in a stronger legal position if it didn’t know about the abuse that was happening”.
‘Utterly horrifying’: ex-Facebook insider says covert data harvesting was routine
Hundreds of millions of Facebook users are likely to have had their private information harvested by companies that exploited the same terms as the firm that collected data and passed it on to Cambridge Analytica, according to a new whistleblower.
Sandy Parakilas, the platform operations manager at Facebook responsible for policing data breaches by third-party software developers between 2011 and 2012, told the Guardian he warned senior executives at the company that its lax approach to data protection risked a major breach.
“My concerns were that all of the data that left Facebook servers to developers could not be monitored by Facebook, so we had no idea what developers were doing with the data,” he said.
Parakilas said Facebook had terms of service and settings that “people didn’t read or understand” and the company did not use its enforcement mechanisms, including audits of external developers, to ensure data was not being misused.
Parakilas, whose job was to investigate data breaches by developers similar to the one later suspected of Global Science Research, which harvested tens of millions of Facebook profiles and provided the data to Cambridge Analytica, said the slew of recent disclosures had left him disappointed with his superiors for not heeding his warnings.
“It has been painful watching,” he said, “because I know that they could have prevented it.”
Asked what kind of control Facebook had over the data given to outside developers, he replied: “Zero. Absolutely none. Once the data left Facebook servers there was not any control, and there was no insight into what was going on.”
Parakilas said he “always assumed there was something of a black market” for Facebook data that had been passed to external developers. However, he said that when he told other executives the company should proactively “audit developers directly and see what’s going on with the data” he was discouraged from the approach.
He said one Facebook executive advised him against looking too deeply at how the data was being used, warning him: “Do you really want to see what you’ll find?” Parakilas said he interpreted the comment to mean that “Facebook was in a stronger legal position if it didn’t know about the abuse that was happening”.
He added: “They felt that it was better not to know. I found that utterly shocking and horrifying.”
Parakilas first went public with his concerns about privacy at Facebook four months ago, but his direct experience policing Facebook data given to third parties throws new light on revelations over how such data was obtained by Cambridge Analytica.
Facebook did not respond to a request for comment on the information supplied by Parakilas, but directed the Guardian to a November 2017 blogpost in which the company defended its data sharing practices, which it said had “significantly improved” over the last five years.
“While it’s fair to criticise how we enforced our developer policies more than five years ago, it’s untrue to suggest we didn’t or don’t care about privacy,” that statement said. “The facts tell a different story.”
‘A majority of Facebook users’
Parakilas, 38, who now works as a product manager for Uber, is particularly critical of Facebook’s previous policy of allowing developers to access the personal data of friends of people who used apps on the platform, without the knowledge or express consent of those friends.
That feature, called friends permission, was a boon to outside software developers who, from 2007 onwards, were given permission by Facebook to build quizzes and games – like the widely popular FarmVille – that were hosted on the platform.
The apps proliferated on Facebook in the years leading up to the company’s 2012 initial public offering, an era when most users were still accessing the platform via laptops and computers rather than smartphones.
Facebook took a 30% cut of payments made through apps, but in return enabled their creators to have access to Facebook user data.
Parakilas does not know how many companies sought friends permission data before such access was terminated around mid-2014. However, he said he believes tens or maybe even hundreds of thousands of developers may have done so.
Parakilas estimates that “a majority of Facebook users” could have had their data harvested by app developers without their knowledge. The company now has stricter protocols around the degree of access third parties have to data.
Parakilas said that when he worked at Facebook it failed to take full advantage of its enforcement mechanisms, such as a clause that enables the social media giant to audit external developers who misuse its data.
Legal action against rogue developers or moves to ban them from Facebook were “extremely rare”, he said, adding: “In the time I was there, I didn’t see them conduct a single audit of a developer’s systems.”
Facebook announced on Monday that it had hired a digital forensics firm to conduct an audit of Cambridge Analytica. The decision comes more than two years after Facebook was made aware of the reported data breach.
During the time he was at Facebook, Parakilas said the company was keen to encourage more developers to build apps for its platform and “one of the main ways to get developers interested in building apps was through offering them access to this data”. Shortly after arriving at the company’s Silicon Valleyheadquarters he was told that any decision to ban an app required the personal approval of the chief executive, Mark Zuckerberg, although the policy was later relaxed to make it easier to deal with rogue developers.
While the previous policy of giving developers access to Facebook users’ friends’ data was sanctioned in the small print in Facebook’s terms and conditions, and users could block such data sharing by changing their settings, Parakilas said he believed the policy was problematic.
“It was well understood in the company that that presented a risk,” he said. “Facebook was giving data of people who had not authorised the app themselves, and was relying on terms of service and settings that people didn’t read or understand.”
It was this feature that was exploited by Global Science Research, and the data provided to Cambridge Analytica in 2014. GSR was run by the Cambridge University psychologist Aleksandr Kogan, who built an app that was a personality test for Facebook users.
The test automatically downloaded the data of friends of people who took the quiz, ostensibly for academic purposes. Cambridge Analytica has denied knowing the data was obtained improperly, and Kogan maintains he did nothing illegal and had a “close working relationship” with Facebook.
While Kogan’s app only attracted around 270,000 users (most of whom were paid to take the quiz), the company was then able to exploit the friends permission feature to quickly amass data pertaining to more than 50 million Facebook users.
“Kogan’s app was one of the very last to have access to friend permissions,” Parakilas said, adding that many other similar apps had been harvesting similar quantities of data for years for commercial purposes. Academic research from 2010, based on an analysis of 1,800 Facebooks apps, concluded that around 11% of third-party developers requested data belonging to friends of users.
If those figures were extrapolated, tens of thousands of apps, if not more, were likely to have systematically culled “private and personally identifiable” data belonging to hundreds of millions of users, Parakilas said.
The ease with which it was possible for anyone with relatively basic coding skills to create apps and start trawling for data was a particular concern, he added.
Parakilas said he was unsure why Facebook stopped allowing developers to access friends data around mid-2014, roughly two years after he left the company. However, he said he believed one reason may have been that Facebook executives were becoming aware that some of the largest apps were acquiring enormous troves of valuable data.
He recalled conversations with executives who were nervous about the commercial value of data being passed to other companies.
“They were worried that the large app developers were building their own social graphs, meaning they could see all the connections between these people,” he said. “They were worried that they were going to build their own social networks.”
‘They treated it like a PR exercise’
Parakilas said he lobbied internally at Facebook for “a more rigorous approach” to enforcing data protection, but was offered little support. His warnings included a PowerPoint presentation he said he delivered to senior executives in mid-2012 “that included a map of the vulnerabilities for user data on Facebook’s platform”.
“I included the protective measures that we had tried to put in place, where we were exposed, and the kinds of bad actors who might do malicious things with the data,” he said. “On the list of bad actors I included foreign state actors and data brokers.”
Frustrated at the lack of action, Parakilas left Facebook in late 2012. “I didn’t feel that the company treated my concerns seriously. I didn’t speak out publicly for years out of self-interest, to be frank.”
That changed, Parakilas said, when he heard the congressional testimony given by Facebook lawyers to Senate and House investigators in late 2017 about Russia’s attempt to sway the presidential election. “They treated it like a PR exercise,” he said. “They seemed to be entirely focused on limiting their liability and exposure rather than helping the country address a national security issue.”
It was at that point that Parakilas decided to go public with his concerns, writing an opinion article in the New York Times that said Facebook could not be trusted to regulate itself. Since then, Parakilas has become an adviser to the Center for Humane Technology, which is run by Tristan Harris, a former Google employee turned whistleblower on the industry.
- Contact the author: paul.lewis@theguardian.com
• Addendum, 29 March 2018: we are happy to clarify that we did not intend to suggest that AggregateIQ is a direct part and/or the Canadian branch of Cambridge Analytica or that it has been involved in the exploitation of Facebook data or otherwise in any of the alleged wrongdoing made against Cambridge Analytica. Further we did not intend to suggest that AIQ secretly and unethically coordinated with Cambridge Analytica on the EU Referendum. We are happy to make clear that AggregateIQ is and has always been 100% Canadian owned and operated/
“The idea that Dom had no idea of AIQ’s connection to Cambridge Analytica is complete bullshit,” said the source. “It was
