Editorial comment:  We have picked up this story from our partner firm Cyber Security Intelligence.  We also were aware that during the 2012 election campaign the Obama camp used Facebook data.  We felt it important to look at the differences of data used in the 2012 and 2016 campaigns.  See the separate article following this commentary.

The data analytics firm that worked with Donald Trump’s election team and the winning Brexit campaign harvested millions of Facebook profiles of US voters, in one of the tech giant’s biggest ever data breaches, and used them to build a powerful software program to predict and influence choices at the ballot box.

A whistleblower has revealed to the Observer how Cambridge Analytica, a company owned by the hedge fund billionaire Robert Mercer, and headed at the time by Trump’s key adviser Steve Bannon, used personal information taken without authorisation in early 2014 to build a system that could profile individual US voters, in order to target them with personalised political advertisements.

Christopher Wylie, who worked with a Cambridge University academic to obtain the data, told the Observer: “We exploited Facebook to harvest millions of people’s profiles. And built models to exploit what we knew about them and target their inner demons. That was the basis the entire company was built on.”

Documents seen by the Observer, and confirmed by a Facebook statement, show that by late 2015 the company had found out that information had been harvested on an unprecedented scale. However, at the time it failed to alert users and took only limited steps to recover and secure the private information of more than 50 million individuals.

The New York Times is reporting that copies of the data harvested for Cambridge Analytica could still be found online; its reporting team had viewed some of the raw data.

The data was collected through an app called thisisyourdigitallife, built by academic Aleksandr Kogan, separately from his work at Cambridge University. Through his company Global Science Research (GSR), in collaboration with Cambridge Analytica, hundreds of thousands of users were paid to take a personality test and agreed to have their data collected for academic use. However, the app also collected the information of the test-takers’ Facebook friends, leading to the accumulation of a data pool tens of millions-strong. Facebook’s “platform policy” allowed only collection of friends’ data to improve user experience in the app and barred it being sold on or used for advertising.

The discovery of the unprecedented data harvesting, and the use to which it was put, raises urgent new questions about Facebook’s role in targeting voters in the US presidential election. It comes only weeks after indictments of 13 Russians by special counsel Robert Mueller which stated they had used the platform to perpetrate “information warfare” against the US.
Cambridge Analytica and Facebook are one focus of an inquiry into data and politics by the British Information Commissioner’s Office. Separately, the Electoral Commission is also investigating what role Cambridge Analytica played in the EU referendum.

In February both Facebook and the CEO of Cambridge Analytica, Alexander Nix, told a parliamentary inquiry on fake news: that the company did not have or use private Facebook data.

Simon Milner, Facebook’s UK policy director, when asked if Cambridge Analytica had Facebook data, told MPs: “They may have lots of data but it will not be Facebook user data. It may be data about people who are on Facebook that they have gathered themselves, but it is not data that we have provided.”

Cambridge Analytica’s chief executive, Alexander Nix, told the inquiry: “We do not work with Facebook data and we do not have Facebook data.”

Wylie, a Canadian data analytics expert, who worked with Cambridge Analytica and Kogan to devise and implement the scheme, showed a dossier of evidence about the data misuse to the Observer which appears to raise questions about their testimony. 

He has passed it to the National Crime Agency’s cybercrime unit and the Information Commissioner’s Office. It includes emails, invoices, contracts and bank transfers that reveal more than 50 million profiles, mostly belonging to registered US voters, were harvested from the site in one of the largest ever breaches of Facebook data.

Facebook said that it was also suspending Wylie from accessing the platform while it carried out its investigation, despite his role as a whistleblower.

At the time of the data breach, Wylie was a Cambridge Analytica employee, but Facebook described him as working for Eunoia Technologies, a firm he set up on his own after leaving his former employer in late 2014. The evidence Wylie supplied to UK and US authorities includes a letter from Facebook’s own lawyers sent to him in August 2016, asking him to destroy any data he held that had been collected by GSR, the company set up by Kogan to harvest the profiles.

Paul-Olivier Dehaye, a data protection specialist, who spearheaded the investigative efforts into the tech giant, said:

“Facebook has denied and denied and denied this. It has misled MPs and congressional investigators and it’s failed in its duties to respect the law.

“It has a legal obligation to inform regulators and individuals about this data breach, and it hasn’t. It’s failed time and time again to be open and transparent.”

A majority of American states have laws requiring notification in some cases of data breach, including California, where Facebook is based.

Facebook denies that the harvesting of tens of millions of profiles by GSR and Cambridge Analytica was a data breach. It said in a statement that Kogan “gained access to this information in a legitimate way and through the proper channels” but “did not subsequently abide by our rules” because he passed the information on to third parties.

Kogan, who has previously unreported links to a Russian university and took Russian grants for research, had a licence from Facebook to collect profile data, but it was for research purposes only. 

So when he hoovered up information for the commercial venture, he was violating the company’s terms. Kogan maintains everything he did was legal, and says he had a “close working relationship” with Facebook, which had granted him permission for his apps.

The Observer has seen a contract dated 4 June 2014, which confirms SCL, an affiliate of Cambridge Analytica, entered into a commercial arrangement with GSR, entirely premised on harvesting and processing of Facebook data.

Cambridge Analytica spent nearly $1m on data collection, which yielded more than 50 million individual profiles that could be matched to electoral rolls. It then used the test results and Facebook data to build an algorithm that could analyse individual Facebook profiles and determine personality traits linked to voting behaviour.

The algorithm and database together made a powerful political tool. It allowed a campaign to identify possible swing voters and craft messages more likely to resonate.

Source: Cyber Security Intelligence

Comparing Facebook data use by Obama, Cambridge Analytica

As news reports surfaced of Cambridge Analytica and the Donald Trump campaign, conservatives pointed to what seemed a double-standard.

On ABC’s The View, co-host Meghan McCain said former President Barack Obama was met with praise when he used similar Facebook data for his campaign, whereas Trump was met with outrage.

  • “It happened under Obama and it was lauded by the media as being genius,” McCain said. “And now under the Trump campaign — it’s the Cambridge Analytica scandal.”
  • “Was it the same thing?” co-host Joy Behar asked.
  • “Yeah,” McCain said. “It was micro-targeting and data mining.”
  • “I think it’s different, though,” said co-host Sunny Hostin.
  • “It’s not different, though!” McCain exclaimed.

So, was it the same thing?

While the data the two campaigns had access to was largely the same, the way they accessed it, and for what purpose, was very different.

“She was making the point that the Obama re-election campaign used a similar tactic through Facebook to gain access to the personal information of millions of voters,” ABC spokeswoman Lauri Hogan clarified.

The data: Sponsored Content: Under the way Facebook allowed its apps to operate between 2010 and 2015, Obama’s 2012 re-election app and the survey app used by Cambridge Analytica had access not only to their users’ profiles but their friends’ list and their biographical information.  When the user approved it, these apps could access details such as users’ and their friends’ tags, likes and demographics.

Over a million people downloaded the Obama for America app. Around 300,000 people downloaded the personality survey app that ended up sending their data to Cambridge Analytica. The number of users’ data the firm reportedly gained access to (50 million) is much higher because it includes the users’ friends. The number of user data, it follows, was much higher for the Obama campaign, too.

How it was accessed:  The real divergence is in the way each campaign accessed the data.  The Obama campaign created a Facebook app for supporters to donate, learn of voting requirements, and find nearby houses to canvass. The app asked users’ permission to scan their photos, friends lists, and news feeds.  Most users complied.

The people signing up knew the data they were handing over would be used to support a political campaign. Their friends, however, did not.

The people who downloaded the app used by Cambridge Analytica did not know their data would be used to aid any political campaigns. The app was billed as a personality quiz that would be used by Cambridge University researchers.

Aleksandr Kogan, one of the Cambridge researchers involved in the project, sold the data to the upstart political consulting firm Cambridge Analytica. The company then sold its services not only to the Trump campaign, but to the presidential campaign of Sen. Ted Cruz and the senatorial campaign of Sen. Thom Tillis, R-N.C., among others.  When Facebook discovered a developer had shared users’ data without their consent in 2015, it asked both the original app and the consultancy to delete the data. That didn’t happen.

“The thing that is true is that every Facebook app you downloaded back then was getting access to your entire friends list,” said David Karpf, an associate professor of media and public affairs at George Washington University. “When tech people were trying to raise outrage about it they were being ignored. Now, everyone is outraged. But what (McCain) is wrong about this is that Kogan then sold it, and for a much creepier purpose.”

How it was used:  Obama operatives used Facebook data to get users to send their messaging for them, according to Eitan Hersh, a Tufts professor who wrote Hacking the Electorate, a book on Obama’s microtargeting strategies.

Facebook friends lists, tags and photos allowed Obama operatives to identify a person’s close friends, which they then matched with offline public records. (Was this person likely to vote for Obama, but unlikely to get out to vote?) They then told the app users which of their friends they should send campaign messages to.

Cambridge Analytica dialed up what Karpf called the creepiness factor. They combined the survey results with the Facebook data to create psychological profiles they then sold to campaigns. The idea was, if the firm could discover how these people thought, they could target ads toward them.

They then sent targeted ads to the users on the database. The friends of the app users weren’t being targeted by their friends, but by the campaign itself. In other words, the consenting middle man was gone.  In his research, Hersh found that neither tactic was greatly effective at persuading people to vote.

PolitiFact.com’s Ruling:

McCain said that there was a strong equivalence between how the Obama and Trump campaigns accessed user data on Facebook.  The Obama campaign and Cambridge Analytica both gained access to huge amounts of information about Facebook users and their friends, and in neither case did the friends of app users consent.  But in Obama’s case, direct users knew they were handing over their data to a political campaign. In the Cambridge Analytica case, users only knew were taking a personality quiz for academic purposes.

The Obama campaign used the data to have their supporters contact their most persuadable friends. Cambridge Analytica targeted users and their friends directly with digital ads.  Whereas the data gathering and the uses were very different, the data each campaign gained access to was similar. We rate the McCain statement Half True.

Source: PolitiFact.com