Cambridge Analytica alongside social media giant Facebook were in the midst of a media firestorm in early 2018 after an undercover sting operation revealed that the London-based elections consultancy had harvested the personal data of millions of people’s Facebook profiles without their consent and used it for political purposes.
The scandal came to light in March 2018 after articles were published by the New York Times and U.K. newspaper The Observer. A whistleblower, an ex-Cambridge Analytica employee Christopher Wylie revealed to the Observer how Cambridge Analytica – a company owned by the hedge fund billionaire Robert Mercer, and headed at the time by Trump’s key adviser Steve Bannon – used personal information taken without authorisation in early 2014 to build a system that could profile individual US voters, in order to target them with personalised political advertisements.
“We exploited Facebook to harvest millions of people’s profiles. And built models to exploit what we knew about them and target their inner demons. That was the basis the entire company was built on,” Christopher Wylie told the Observer.
Documents seen by the Observer, and confirmed by a Facebook statement, show that by late 2015 the company had found out that information had been harvested on an unprecedented scale. However, at the time it failed to alert users and took only limited steps to recover and secure the private information of more than 50 million individuals.
According to Facebook, this data was provided to Cambridge Analytica by a Cambridge University researcher called Aleksandr Kogan, who started a firm called Global Science Research (or GSR). GSR created a personality quiz on Facebook called “this is your digital life” which was labeled as a research experiment to be used by scientists to build psychological profiles.
Cambridge Analytica in turn arranged an informed consent process for research in which several hundred thousand Facebook users would agree to complete a survey only for academic use. However, Facebook’s design allowed this app not only to collect the personal information of people who agreed to take the survey, but also the personal information of all the people in those users’ Facebook social network. In this way Cambridge Analytica acquired data from millions of Facebook users.
The Observer and the New York Times reported that dataset has included information on 50 million Facebook users. Facebook later confirmed that it actually had data on up to 87 million users, with 70.6 million of those people from the United States.
Facebook sent a message to those users believed to be affected, saying the information likely included one’s “public profile, page likes, birthday and current city”. Some of the app’s users gave the app permission to access their News Feed, timeline, and messages. The data was detailed enough for Cambridge Analytica to create psychographic profiles of the subjects of the data. The data also included the locations of each person.
As well as general demographic data (location, age, gender and so on) which can be used to predict voting intention, there are other interesting, and often ambiguous, parallels. For example, as The Guardian explains, people who liked the page “I hate Israel” on Facebook were more likely to also digitally show their appreciation of Kit Kats and Nike shoes.
“I came across a paper about how personality traits could be a precursor to political behaviour, and it suddenly made sense. Liberalism is correlated with high openness and low conscientiousness, and when you think of Lib Dems they’re absent-minded professors and hippies. They’re the early adopters… they’re highly open to new ideas. And it just clicked all of a sudden,” explains Wylie.
If you know and can talk directly to voters who are more responsive to your message, and where they live, the theory goes, you can have a serious impact on the election: you can prompt likely supporters into voting, and try to depress the turnout amongst those less likely to vote for your candidate.
Facebook had said that while the data was obtained by Cambridge Analytica legitimately, it claimed that Kogan “lied” to the social media platform and violated its policies in transferring the data.
“The entire company is outraged we were deceived. We are committed to vigorously enforcing our policies to protect people’s information and will take whatever steps are required to see that this happens,” Facebook said in a statement.
During a week of inquiries from The Times, Facebook downplayed the scope of the leak and questioned whether any of the data still remained out of its control. But later, the company posted a statement expressing alarm and promising to take action.
“This was a scam — and a fraud,” Paul Grewal, a vice president and deputy general counsel at the social network, said in a statement to The Times. He added that the company was suspending Cambridge Analytica, Christopher Wylie and the researcher, Aleksandr Kogan, a Russian-American academic, from Facebook.
“We will take whatever steps are required to see that the data in question is deleted once and for all — and take action against all offending parties,” added Grewal. Later reports surfaced suggesting that this data was not destroyed. Nonetheless, Cambridge Analytica argued that they deleted the data when it was told to.
A data breach suggests the information was hacked, leaked or stolen. What actually happened was that the data was taken in a manner that was entirely within the rules that Facebook created.
The data was accessible to researchers, and they took it on the understanding that it was only to be used for that express purpose. It was only after it was extracted that it was allegedly passed onto Cambridge Analytica.
Paul-Olivier Dehaye, a data protection specialist, who spearheaded the investigative efforts into the tech giant, said: “Facebook has denied and denied and denied this. It has misled MPs and congressional investigators and it’s failed in its duties to respect the law.”
“It has a legal obligation to inform regulators and individuals about this data breach, and it hasn’t. It’s failed time and time again to be open and transparent.”
A majority of American states have laws requiring notification in some cases of data breach, including California, where Facebook is based. Facebook denied that the harvesting of tens of millions of profiles by GSR and Cambridge Analytica was a data breach.
Facebook founder and CEO Mark Zuckerberg wrote in a response to this scandal, “I’ve been working to understand exactly what happened and how to make sure this doesn’t happen again. The good news is that the most important actions to prevent this from happening again today we have already taken years ago. But we also made mistakes, there’s more to do, and we need to step up and do it.”
In April 2018, for over two days, nearly 100 lawmakers in the House and Senate interrogated Mark Zuckerberg about the company’s handling of user information. He faced almost 600 questions, including whether the company should be more heavily regulated, whether it intentionally censors conservative content and how much Russians may have meddled with America’s democratic process through the social network.
Cambridge Analytica closed its doors weeks after the data analytics firm that worked with the Trump campaign was hit by revelations it benefited from a massive leak of Facebook data. The UK-based company lost many of its largest clients after it became mired in allegations it misused the Facebook data in political campaigns. The firm’s chief executive, Alexander Nix, already departed in an effort to contain the crisis.
The company, whose parent SCL Elections was also shut down, said it had been “vilified for activities that are not only legal, but also widely accepted as a standard component of online advertising in both the political and commercial arenas”. It decided to close because of a “media siege”, it added.
Recently, U.S. regulators have met to discuss imposing a record-setting fine against Facebook for violating a legally binding agreement with the government to protect the privacy of its users’ personal data, reported The Washington Post.
The fine under consideration at the Federal Trade Commission, a privacy and security watchdog that began probing Facebook last year, would mark the first major punishment levied against Facebook in the United States since reports emerged in March that Cambridge Analytica, a political consultancy, accessed personal information on about 87 million Facebook users without their knowledge.
The penalty is expected to be in excess of the $22.5 million fine the FTC imposed on Google in 2012 for allegedly violating an agreement to improve privacy practices, the Post reported. Sources told the Post Facebook has talked with FTC staffers about the investigation.
Facebook signed a consent decree with the FTC in 2011 that required the company to receive explicit permission from users before sharing their personal data. FTC’s probe would look into whether Facebook violated the agreement.
That agreement with the FTC, known as a consent decree, has multiple parts, including a requirement that Facebook receive “affirmative express consent” from users before making any changes to its privacy policies. The part of the agreement that seems to be up for interpretation is Facebook’s promise that it wouldn’t make any “misrepresentations about the privacy or security of consumers’ personal information.”
It seems possible that allowing third-party developers to access a user’s personal information without their knowledge could be seen as a “misrepresentation” on Facebook’s part.
The key question for the FTC is whether Facebook’s business practices — and the protections and privacy controls it afforded consumers — violated requirements spelled out in a consent decree brokered by the agency the last time it accused the tech giant of deceiving its users. Only through such a finding could the FTC levy a fine.
The penalty would mark the toughest punishment to date levied on Facebook for mishandling its users’ data. Regulators in the United Kingdom assessed a roughly $640,000 fine that Facebook is appealing. The attorney general of the District of Columbia has mounted a lawsuit against the tech giant for its missteps.