Digital, Culture, Media and Sport Committee
Oral evidence: Fake News, HC 363
Tuesday 27 March 2018
Ordered by the House of Commons to be published on 27 March 2018.
Watch the meeting
Members present: Damian Collins (Chair); Julie Elliott; Paul Farrelly; Simon Hart; Ian C. Lucas; Julian Knight; Christian Matheson; Rebecca Pow; Brendan O’Hara; Jo Stevens; Giles Watling.
Questions 1271-1461
Witnesses
I: Paul-Olivier Dehaye and Christopher Wylie.
Written evidence from witnesses:
– Christopher Wylie background papers
Witnesses: Paul-Olivier Dehaye and Christopher Wylie.
Q1271 Chair: Welcome to this further evidence session of the Digital, Culture, Media and Sport Select Committee, as part of our inquiry into disinformation and fake news. I welcome Christopher Wylie and Paul-Olivier Dehaye to the Committee to give evidence this morning.
Before we start the Committee session, I would like to give an update on the invitation of the Select Committee to Mark Zuckerberg to give evidence before us. We believe, given the serious nature of the allegations that have been made about the access and use of Facebook user data, that it is appropriate that Mark Zuckerberg should give evidence to the Committee. He has suggested that Chris Cox, the chief product officer at Facebook, could come to London to give evidence to the Committee in the first week after the Easter recess. We would be very happy to invite Mr Cox to give evidence. However, we would still like to hear from Mr Zuckerberg as well. We will seek to clarify with Facebook whether he is available to give evidence or not, because that was not clear from our correspondence. If he is available to give evidence we will be happy to do that, either in person or by videolink if that would be more convenient for him. I am happy to answer any further questions about that after the hearing but that is all we would like to say on that at this time.
We turn now to the evidence session this morning, and I will ask Chris Wylie first. A lot of the Committee’s work over the last few weeks has been looking at the role of Cambridge Analytica in the data analytics business and their campaigns. We heard evidence from Alexander Nix a few weeks ago. Could you explain how you first became involved with Alexander Nix and Cambridge Analytica?
Christopher Wylie: I first joined SCL Group, which is the parent company of Cambridge Analytica, before Cambridge Analytica existed, in June 2013. I was introduced to him through a mutual contact that I had worked with previously in UK politics. SCL had an opening for a research director in part because the past research director died in his hotel room in Kenya when he was working for Uhuru Kenyatta. I did not know that at the time.
Part of the reason why I was chosen to become research director is because the firm was looking to expand its digital capacity and keep up with the developments that were happening, particularly on the military side, looking at how information spreads online and developing new IP that they could then pass on to clients, whether that is political or military. Does that answer your question?
Q1272 Chair: Yes. Can you explain how long you worked at and with Cambridge Analytica and what caused you to leave the company?
Christopher Wylie: When I started in June 2013, Cambridge Analytica did not exist yet. It is important for people to understand that Cambridge Analytica is more of a concept or a brand than anything else because it does not have employees. It is all SCL, it is just the front-facing company for the United States. I started at SCL Group in June 2013. In July 2014, I told Alexander Nix that I did not want to continue working at—then at the time—Cambridge Analytica, although I scaled down my work until the 2014 midterms; a year and a half.
To be clear, Cambridge Analytica was set up in large part because of the research I was doing at SCL Group. The IP that we were creating was acquired by Robert Mercer and Cambridge Analytica became the vehicle to acquire the IP.
Q1273 Chair: You said that Cambridge Analytica does not have any employees, that effectively they were all employed by SCL.
Christopher Wylie: Yes.
Chair: How would you characterise the relationship between these different companies? Is it one organisation that exists behind different facades?
Christopher Wylie: Cambridge Analytica was set up in part because, first, there was— the way it works is Cambridge Analytica was set up and SCL Elections, which is part of SCL Group, the group company, became a minority shareholder and then Robert Mercer became the majority shareholder of Cambridge Analytica. SCL assigned its intellectual property to Cambridge Analytica and Cambridge Analytica licensed back the IP to SCL Elections, and also granted SCL Elections an exclusivity contract whereby all projects from Cambridge Analytica would be given to SCL to work on, although the actual contracting on the client-facing side would be with Cambridge Analytica.
Partly that was because in the United States there are particular rules against foreign actors in elections, so having an American company was beneficial for that purpose. Also Robert Mercer’s lawyers were concerned about two things. The first was the optics of acquiring a UK military contractor to work in American elections; optically that would not necessarily play well. Secondly, they were concerned about some of the history of the shareholders in the company, as well as some of the past projects they had worked on.
Q1274 Chair: The company being SCL?
Christopher Wylie: SCL.
Q1275 Chair: Cambridge Analytica was a company set up with the purpose of doing political work in America?
Christopher Wylie: In the United States with a new brand that was untainted by any history or legacy of past projects or shareholders.
Q1276 Chair: A lot of people will ask—and I will ask—that given you are someone who worked very closely with these people for a period of time and understand this world very well, through your career working in it, why have you decided to speak out against it and give evidence against people who used to be your colleagues?
Christopher Wylie: As a citizen, one is expected and has a duty to report unlawful activity. If you are asking about my journey to this moment, a lot of people have asked me, “Why has it taken you so long?” What they do not see is that I have been working on this with The Guardian, and then later The New York Times and Channel 4, for a year. What you are seeing is the climax of that. This is a year-long coming-out process. Before going public I started working with the ICO and UK authorities to start their investigation.
Also, very shortly after I left Cambridge Analytica I was threatened with legal action and had a very aggressive team of lawyers coming after me, so I signed an undertaking of confidentiality, which meant that if I broke that, I could be sued into oblivion by Robert Mercer. Frankly, that is intimidating. When I was working at Cambridge Analytica and setting it up, you do not appreciate the future impact of what your work is until it starts to happen. In 2016, I started looking at what this company was doing in the United States and coming to appreciate that the projects that I was working on may have had a much wider impact than I initially anticipated they would.
Very shortly after Donald Trump was inaugurated is when I started working with Carole Cadwalladr at The Guardian on reporting some of the things that the company is doing. In the spring I was one of her key sources anonymously until we could figure out a legal position that would then allow me to come forward.
Q1277 Chair: Would it be fair to say that, for you, Donald Trump’s election crossed a line? You felt the techniques that you were aware had been used should not have been used in the way they were during the campaign and you felt you had to speak out about it. Would that be a way of characterising it?
Christopher Wylie: I would not say it is just because of Donald Trump, but Donald Trump makes it click in your head that this has a much wider impact. I do not think that military-style information operations is conducive for any democratic process, whether it is the US presidential or a local council race.
Q1278 Chair: When Cambridge Analytica was founded, was the algorithm, the database, inherited from SCL or was that something that you developed or was it developed by other people?
Christopher Wylie: This is partly why I was brought on as research director, because SCL was falling behind in its technical capacity, in its quantitative skillset. Before I joined, SCL did not have any data assets, so that was in large part why I was hired. It was the Ripon projects that acquired data and scaled it. It was at that moment that they started becoming more focused on data science.
Q1279 Chair: I have seen a report that the idea of the name Cambridge Analytica was Steve Bannon’s. Is that correct?
Christopher Wylie: Yes, it is a bizarre story. Alexander Nix has his standard pitch, and it often relies heavily on, “We have offices in Mayfair,” and, “I went to Eton,” presenting a very posh veneer of the company. A lot of their clients are developing countries in the Commonwealth and that sort of image plays well with certain types of clients he had worked with in the past. The problem was that Steve Bannon did not care about that. He was much more interested in going and speaking at student events at Cambridge than sitting in a posh office in Mayfair.
Alexander realised that, and he decided to set up a fake office in Cambridge so that whenever Steve Bannon— this is before Steve Bannon came on board to set up a project, which eventually became CA. Whenever Bannon came, we set up this fake office to present a more academic side of the company. It was from that that Steve Bannon decided we should call it Cambridge Analytica, because of how closely associated it was with the university. In his head it was a very academic company.
Q1280 Chair: Other than that geographical proximity, did the company have any particular relationship with Cambridge University?
Christopher Wylie: It did not have a formal relationship, but we did work with a lot of professors at the University of Cambridge, in particular the psychology department and the psychometric centre.
Q1281 Chair: They would deal with such projects and assist with developing techniques and ideas?
Christopher Wylie: Yes. Cambridge has an amazing psychology department. It is one of the top—if not the top—in the world for psychology, so it was a real resource to have that very close to us. We did work with several professors at the psychology department on developing psychometric inventories and also looking more broadly at the research that was coming out of the university in psychological profiling using online data exhausts. A lot of the papers that eventually became the foundation of the methods that were used on the Ripon project came out of research that was being done at the University of Cambridge, some of which was funded in part by DARPA, which is the US military’s research agency.
Q1282 Chair: Did you approach academics on an ad hoc basis or was there any engagement with university authorities or any of the departments?
Christopher Wylie: We definitely talked to some of the more senior professors, but there was nothing formalised with the university itself. It was all done professor to professor to professor, but it sat in a grey area. When Ripon was happening we were engaging with a lot of people at Cambridge who played a pivotal role in getting that project going.
Q1283 Paul Farrelly: Essentially your central motivation has been that you are rather aghast that techniques in the social media world that have been used for military PSYOPs purposes are being used in the political domain?
Christopher Wylie: That is a part of it. Also, more broadly, when you look at how Cambridge Analytica operates or how SCL operates, they do not care whether or not what they do is legal, as long as it gets the job done. There has been a lot of focus on the data side of things and there has been a lot of focus on targeting, but this is a company that goes around the world and undermines the big institutions of countries that are struggling to develop those institutions.
There are a lot of reasons why I find the company problematic. It is not just the data. It is also more broadly that they are an example of what modern-day colonialism looks like. You have a wealthy company from a developed nation going into an economy or a democracy that is still struggling to get its feet on the ground and taking advantage of that to profit from that. There are several reasons why I find the company problematic.
Q1284 Paul Farrelly: Do they like to have an aura of being the SMERSH of the modern digital age?
Christopher Wylie: The “smash”?
Chair: SMERSH. It is from James Bond, the evil organisation that manipulates things here, there and everywhere across the world.
Christopher Wylie: If you watch the Channel 4 undercover, you can see for yourself that they know that is the brand that it presents and they cultivate that. I think they find it amusing.
Q1285 Paul Farrelly: I sort of get it. I did not quite know what to make of Mr Nix when he came to us, apart from he was a corporate financier who sought a higher calling, as he almost said it to us. I remember on Channel 4 one of the most hilarious bits was a chap called Mark Turnbull who had a big plaster on this nose saying that he was a master of disguise.
Christopher Wylie: He does not always have the plaster on his nose.
Q1286 Paul Farrelly: We want to get on to some of the things that happened in different parts of the world, but just before we do, I wanted to probe into your predecessor who died in Kenya. I have not heard of that. He was working for the Kenyatta campaign.
Christopher Wylie: Yes.
Paul Farrelly: Were there any suspicious circumstances?
Christopher Wylie: I have heard several different stories as to what happened, so I do not know which story is accurate. But when you work in Kenyan politics, or politics in a lot of African countries, if a deal goes wrong, you can pay for it.
Q1287 Paul Farrelly: Is this a matter of public record or is this new now?
Christopher Wylie: Dan was my predecessor and his death did cause some news coverage in Romania because he was the son of a Cabinet Minister in Romania, who is now in jail for corruption charges, I think. He came from a political family in Romania and the fact that he died was news. I have heard different stories of the circumstances of his death, so I am not sure which is—
Paul Farrelly: His name was Dan?
Christopher Wylie: His surname starts with a M.
Paul-Olivier Dehaye: Muresan. He was working simultaneously in India, I think, and there is also some—
Paul Farrelly: Simultaneously in India?
Paul-Olivier Dehaye: Yes.
Q1288 Paul Farrelly: When you look at Facebook’s biggest market—I mentioned this in the States as well—India is the top in numbers of users and that is a country that is rife with political discord and opportunities for destabilisation.
Christopher Wylie: They have worked extensively in India. They have an office in India.
Q1289 Paul Farrelly: This might be something we want to pursue later. When you were told that there was a vacancy because your predecessor died in Kenya, what explanation did the company give to you of that death?
Christopher Wylie: When I was hired I was not told that my predecessor had died in Kenya in his hotel room. That was several months, after when I asked about who I was replacing, because I was looking for some old files that I could not find. I did realise, but I did not know the name of the person who I replaced, so I asked about—looking through old files. That is where it came out that he died.
Paul Farrelly: Same question two months on: what explanation were you given of the— how old was he, do you know?
Christopher Wylie: He was in his 30s.
Paul Farrelly: Did they give you an explanation?
Christopher Wylie: They did. If I explain it, if you understand that it is pure speculation, so I am not stating this as a matter of fact. I am repeating what I heard.
What I heard was that he was working on a deal of some sort. I am not sure exactly what kind of deal it was, but when you work for senior politicians in a lot of these countries, you do not make money in the electoral work, you make money in the influence brokering after the fact. A deal went sour and—again this is what I have been told, so I am not saying this is a matter of fact—and people suspected that he was poisoned in his hotel room. I also heard that the police were bribed to not enter the hotel room for 24 hours. But that is what I was told. I was not there, so I cannot speak to the veracity of that account, but that is what I was told.
Q1290 Paul Farrelly: We will leave that there for the moment, because there are plenty of journalists who might want to follow some of those interesting leads. One of the things Mr Nix was at pains to stress when he was in front of us was that there were different companies, different entities—data could go one way but not another way, because of government contracting. But there was one name that came up as the data controller that was common between Cambridge Analytica and SCL, almost demonstrating that there were common personnel, notwithstanding the denials, which was a lady called Jordanna Zetter. Do you know her?
Christopher Wylie: I do not
Paul Farrelly: She is just a name?
Christopher Wylie: It is just a name, but they do put lots of random names on all kinds of things.
Q1291 Paul Farrelly: I do not know if you have seen this pictogram of the SCL structure. It has been done by an independent journalist. It is just from filings at Companies House, so it is fairly standard. It is fairly complicated for a relatively small company.
Christopher Wylie: I’d wager that there are probably more companies than even what is on that piece of paper.
Q1292 Paul Farrelly: There are some interesting names that crop up. Mr Nix we know about—the Etonian salesman I think you almost described him as.
Christopher Wylie: My understanding is that the reason why Alexander Nix was involved in SCL was because his father had shares in the company and his father died. He inherited shares or there was some deal that was done, because he has no background in psychology, tech, politics, any of the things that they operate in. He is a salesman; he likes to sell stuff.
Q1293 Paul Farrelly: While I was cooking Sunday lunch this weekend I listened to a BBC profile of Nigel Oakes. Did you come across him?
Christopher Wylie: Yes, although not day to day. When we were setting up Cambridge Analytica, one of the reasons why SCL Elections rather than either the group company or another entity was the minority shareholder was because Alexander Nix wanted to keep more control for himself. He was quite paranoid about some of the other shareholders and directors in the group company, so he made a concerted effort to keep this project away from the others as long as possible. I did come across him several times, but it was not day to day. I did not work with him day to day.
Q1294 Paul Farrelly: From his profile, Mr Oakes came across as the founding éminence grise behind the whole project.
Christopher Wylie: No, not for Cambridge Analytica. For SCL, yes, but not for Cambridge Analytica. Cambridge Analytica was Steve Bannon, Robert Mercer and Alexander Nix. Most of those negotiations happened in America. They kept it pretty separate from the legacy shareholders and directors of SCL. He played a pivotal role in setting up SCL Group.
Q1295 Paul Farrelly: Can I just throw the role of a couple of other people: the role of the chairman, Julian Wheatland, and Victor Tchenguiz?
Christopher Wylie: They got rid of Tchenguiz when they were finalising the Cambridge Analytica deal. The Mercer lawyers did not like Tchenguiz’s involvement because apparently he had fairly sketchy business dealings that they did not want to be associated with.
Q1296 Paul Farrelly: What was Julian Wheatland’s role?
Christopher Wylie: I believe he was the chairman, so he did not do much. He was like the Queen of the company—not to say the Queen does not do a lot. Sorry, do not interpret that as a slight on the Queen.
Paul Farrelly: I am putting these other names up because there is a danger that one focus is just on Mr Nix, who has a very sinister surname.
Christopher Wylie: For a lot of these guys, their role is not to do work, it is to do deals. They do not do anything day to day. They are the ones who, because of their family or because of their businesses or what-have-you, have a very wide network of people—not just here in the UK but, in particular, in Africa and various developing countries—that enables the company to go and get working contracts. Their roles were usually like as the introducer, as the dealmaker, not managing the day-to-day operations of the company.
Q1297 Paul Farrelly: Would you characterise them as people who wanted to make a fortune out of this, or people who are genuinely curious about the ability, through social media in the digital age, for them to be able to manipulate outcomes in politics?
Christopher Wylie: You have to remember that a lot of these people are very wealthy already, so it is not Alexander Nix in particular. There is one time where he had to go and we were running late because he had to pick up a £200,000 chandelier. These are people who do not need to make a lot of money, but the thing that I learned is that for certain wealthy people they need something to keep them occupied and they need projects. Going into the developing world and running a country is something that appeals to them. I did not mean that in a flippant way, if that came across as flippant.
Q1298 Paul Farrelly: This charter has no mention of Aggregate IQ or SCL Canada, as it styled itself. What is the relationship between that Canadian company and the rest of this group?
Christopher Wylie: Very shortly after I became research director at SCL, I was given the directive or the mandate to expand the company’s software capacity and technological infrastructure and we obviously needed people to do that. I reached out to people I had worked with on previous projects who I respected. One of those people was Jeff Silvester, who is now the CTO of Aggregate IQ.
In the first email that I sent, which I have also passed on to the Committee—I passed on several folders of documents—where I tell Jeff that I have just become a research director, “This is what we do”, his immediate reaction is, “You need a Canadian office”. He replied, “You need a Canadian office”. When I went to Alexander Nix and I said, “There are a couple of Canadians that I want to hire,” he said, “Fine, but they have to come here and work in London.” When I talked with Jeff and several other people, who later became AIQ, they had new families, had just got a house, and it is not easy to just get up and move to a different country when you have young kids. I went back to Alexander and said, “Look, they’re not mobile, but I think they would be helpful because they’re good at what they do.” The compromise was that a Canadian company would be set up. That would enable the Canadians who wanted to work on the projects— and keep in mind at the time this is SCL, this is before Cambridge Analytica was set up, so primarily we were focused on projects in the developing world.
But the deal was that they would sign an intellectual property licence whereby all of the work that they were doing for the company would be assigned to SCL Group and they would trade as SCL Canada, but they set up a Canadian entity, and the legal name was Aggregate IQ. That was also in part because when you work in a lot of countries, sometimes it is beneficial to have different billing names on invoices. If you are working in a country that has declarable expenses and all that, you can—particularly if you are trying to get around co-ordination rules, like in the United States, which has very strict non-co-ordination rules. If you can bill as several different companies but it is the same team working on it, the paperwork looks compliant even if the project is not.
Q1299 Paul Farrelly: It is a Canadian-based shell company, effectively?
Christopher Wylie: Yes. I would call it like a franchise. On internal staff documents, for example this internal staff list—which I have also passed on to the Committee—AIQ staff are listed under SCL Canada. The internal documents of the company refer to this entity, AIQ, as SCL Canada, as I have been saying for months, but has now been validated yesterday by Gizmodo, which is a website that has found the code base that AIQ built that shows that AIQ built the Ripon platform for Cambridge Analytica. There is now tangible proof in the public domain that AIQ built Ripon, which is the software that utilised the algorithms from the Facebook data. I could talk more about some of the other projects that AIQ has worked on.
In the Nigerian project in 2015, which Carole Cadwalladr at The Guardian has touched on in her reporting, the company utilises services of an Israeli private intelligence firm, and that firm is Black Cube. That has not been reported, although Channel 4 has undercover footage, that they have not been able to put into the public domain, of Alexander Nix talking about the relationship with Black Cube. On the Nigeria project, Black Cube was engaged to hack the now President of Nigeria, Buhari, to get access to his medical records and private emails. AIQ worked on that project. AIQ was handed material in Nigeria from Cambridge Analytica to distribute online. That is distribution of kompromat, and that is also distribution of incredibly threatening and violent video content, which I have also passed on to the Committee. The videos that AIQ distributed in Nigeria with the sole intent of intimidating voters included content where people were being dismembered, were having their throats cut and bleeding to death in a ditch, being burned alive. There are incredibly anti-Islamic and threatening messages portraying Muslims as violent.
You have Aggregate IQ, which received 40% of Vote Leave’s funding, also working on projects that involved hacked material and kompromat and distributing violent videos of people being bled to death to intimidate voters. This is the company that played an incredibly pivotal role in politics here. Something that I would strongly recommend to the Committee is that they not only push the authorities here, but give them the support that they need in order to investigate this company and what they were doing in Brexit.
Q1300 Paul Farrelly: Most of the reporting here has been focused on the Cambridge Analytica link, or lack of link, with Leave.EU, rather than iterate entities, links with Vote Leave, both from a Vote Leave campaign, and also the money that has been diverted off to BeLeave. The other focus of the recording has been the amount of Facebook data that has been collected through Aleksandr Kogan’s activities, which mostly seems to relate to the States. Clearly, the question underlying all this is that if you are going to spend such a lot of money trying to influence the UK referendum, to be able to do that you have to have a set of data on lots of UK individuals to make it worth people’s while spending the money with you. I hope the extent of the UK data that are held by Cambridge Analytica and its affiliates and associates might come out in this session.
Christopher Wylie: One of the things I have also passed on to the Committee is some of the contractual documentation and emails from some of AIQ’s past projects. One of them was at the time the Minister of national security of Trinidad. In the contractual documents, and then also email chains of AIQ, part of the project was to go out and find a way of accessing raw internet service provider data for the entire country, to monitor what people were browsing in that country. As I understand it, that is not legal in Trinidad. It certainly would not be legal here.
But the thing that I would say is that Aggregate IQ, in part because it was set up and works within the auspices of Cambridge Analytica, inherited a lot of the company culture of total disregard for the law. I would again try to encourage looking at this question of where did they get the data. When I met with Dom Cummings in November 2015, one of the things that was apparent is that Vote Leave at the time did not have any data. That is November 2015. Dom Cummings in part wanted to meet with me because he was interested in Cambridge Analytica. He also said that he wanted to have the “Palantir for politics”, but it became apparent that if you do not even have the electoral register, let alone a social database, you cannot do this, or you cannot do this legally. Very shortly after that meeting they then engaged AIQ, I think in part—although this bit is me speculating—because it would look odd if Leave.EU is working with Cambridge Analytica and Vote Leave was working with Cambridge Analytica. But you could get the next best thing, which is a company that can do virtually everything that CA can do but with a different billing name for your invoices.
But my question is: where did you get the data? How do you create a massive targeting operation in a country that AIQ had not previously worked in in two months? It baffles me as to how that could happen in such a short amount of time. That is a good question. It is unfortunate that AIQ hides behind jurisdictional barriers and does not come here and answer those questions. But it is something that hopefully can be looked at as to how did it actually work.
This is a company that has worked with hacked material. This is a company that will send out videos of people being murdered to intimidate voters. This is a company that goes out and tries to illicitly acquire live internet browsing data of everyone in an entire country. A lot of questions should be asked about the role of Aggregate IQ in this election, and whether they were compliant with the law here, beyond just spending infractions.
Q1301 Chair: Thank you. We have quite a few colleagues who want to come in on this particular point. If I could say for the record and people following the proceedings that Chris Wylie has given the Committee access to a large number of documents that he has. We received those this morning and we will be looking to go through those and discuss those with him, with a view to publishing some of those documents probably tomorrow, but certainly as soon as we can practically go through them and look through them. The allegation you make about AIQ and Nigeria is very serious. Do the documents in the folders you have given us provide evidence to support that allegation?
Christopher Wylie: You have one of the videos that I am referring to and I would recommend following Carole Cadwalladr’s reporting on the matter because she has done a ton of work on researching it. She has published some articles on the Nigeria hacking scheme also. But AIQ was involved in the Nigeria project, both as the company and then several people also individually who also frequently work at AIQ.
Q1302 Ian C. Lucas: I want to put to Mr Wylie a statement that was made by Aggregate IQ on their website on Saturday, 24 March 2018. They said, “Aggregate IQ is a digital advertising web and software development company based in Canada. It is and has always been 100% Canadian owned and operated. Aggregate IQ has never been and is not a part of Cambridge Analytica or SCL”. What is your reaction to that statement?
Christopher Wylie: They are using weasel words. That is all technically true but let me be super clear. They are based in Canada; that is true. They are a Canadian company; that is true. They are not owned but they have licensed their intellectual property. Secondly, the basis of the software of Cambridge Analytica— for example, they built the Ripon project. They operate as an internal entity. They are kept at arm’s length, in part because that was useful, particularly for American projects, where you need different entities to work on campaigns and pacts and various other entities where you cannot necessarily co-ordinate. But if you have different companies, the paperwork looks appropriate and the paperwork looks compliant, even if behind the scenes you are talking back and forth and using the same underlying technology. They built Ripon. Ripon was the software that these algorithms went into that then deployed the data to target—the actual advertising deployment was on them. That is what they did.
It is fine and dandy for them to say, “We are a Canadian company.” That is true, but if you unmask what they do and look at how they operate and the projects they have worked on, the overwhelming majority of those projects and the overwhelming majority of their income comes from, and came from, Cambridge Analytica and SCL.
Q1303 Ian C. Lucas: Are you in a position to say definitively today that Cambridge Analytica shared its data with AIQ?
Christopher Wylie: It depends on what you mean by “its data”.
Ian C. Lucas: Shared any data.
Christopher Wylie: Yes, absolutely. You cannot create software that deploys adverts or targets people online or has a front-end interface for you to query data without accessing the data itself. You cannot have targeting software that does not access the database. CA would have a database and AIQ would be able to access that, because otherwise the software does not work, if you see what I am saying.
Q1304 Ian C. Lucas: Yes, I see what you are saying. We have evidence now that Facebook data was used by Cambridge Analytica and it is accepted, even by Facebook, that that information was unlawfully transferred to Cambridge Analytica. Can you say that AIQ had access to that data?
Christopher Wylie: Yes, because the Ripon software and the Ripon project was the modelling of that Facebook data, among other datasets, and then the deployment of that data in online targeting and various other political projects. It was AIQ that provided documents in terms of the contract. What I provided to the Committee is the contractual documents and the IP licensing for that. Yesterday, the website Gizmodo found a lot of the actual underlying code with the software development comments between AIQ and SCL developers. Not only do you have access to the contractual documents, which are provided to the Committee, but also if you look at what Gizmodo is reporting you can see the code.
Q1305 Rebecca Pow: I was interested in you saying early where did they get the data from and I just wanted to get this on the record. We had Alexander Nix here and I asked him about whether they had used Facebook data. He categorically said, “We do not work with Facebook. We do not have Facebook data but we do use it as a platform to advertise. We do gather data from Facebook and we do surveys”.
Christopher Wylie: We do not have Facebook data but we gather Facebook data.
Rebecca Pow: Exactly. What would you say to that? Do you think that was absolutely a lie that they did have Facebook data—they were gathering it, they were using it? On the back of that, if we have this link between Cambridge Analytica and Aggregate IQ, a company that Robert Mercer owns, surely they must be using the data.
Christopher Wylie: To address your first point, it is categorically untrue that Cambridge Analytica has never used Facebook data. Facebook data and the acquisition, using Aleksandr Kogan’s app, was the foundational dataset of the company. That is how the algorithms were developed. They spent $1 million at least on that acquisition project. What I have provided to the Committee is the signed contracts with Aleksandr Kogan’s signature and Alexander Nix’s signature on a contract that references using an app that harvests Facebook data and friend network data also.
Q1306 Rebecca Pow: They have led us up the garden path for a long time and now we are getting to the bottom of it.
Christopher Wylie: Alexander Nix’s comments to your Committee were exceptionally misleading. I would say not only misleading but I think they were dishonest.
Paul-Olivier Dehaye: There has also been on YouTube on the public record for a long time two videos from 2015 where you see interns— at least in one of the videos you see an intern who was working at Cambridge Analytica describing his work in a public forum, his work using Facebook likes to model psychographics and he is describing his work at Cambridge Analytica. When The Guardian contacted Cambridge Analytica the video was removed, even though it was controlled by a different entity called ASI Data Science. I had managed to download that video so I have it and I put it on the record.
Christopher Wylie: ASI Data Science also worked for Vote Leave. ASI was one of the subcontractors to Cambridge Analytica and they provided a lot of the data scientists that Cambridge Analytica used to do their modelling work. Vote Leave used Aggregate IQ and they also used ASI. Their chief technology officer, Tom Borwick, also worked on projects for SCL Group in Trinidad and Antigua. More broadly a question that should be asked is: why is it that all these entities were being used? Given that Dom Cummings was very interested in Cambridge Analytica, and not only Cambridge Analytica but more broadly Robert Mercer’s work in Renaissance Technologies—which is his hedge fund—what did Dom Cummings know and why is it that he was using Aggregate IQ and ASI Data Science? Why is it that their CTO was also somebody who ran projects for SCL Group around the world? To her credit, Carole Cadwalladr at The Guardian has been raising these questions for a year now. It would be appropriate for your Committee and other Committees to start raising those questions also. What was happening inside of Vote Leave and why were these companies chosen?
Q1307 Julie Elliott: This is fascinating. Quite a lot of the things that I was wanting to ask have come out in evidence. It sounds to me as if all of these different names of things are to just try to confuse what on earth is going on here—not by you but by the companies in the way they have been set up. If AIQ were being paid for work for the Vote Leave campaign and others, do you think they were working to a common plan for paid work to get a common result or do you think they have all been working separately?
Christopher Wylie: Which common plan are you referring to?
Julie Elliott: For the various leave campaigns, which was to get a leave vote in the referendum.
Christopher Wylie: I supported leave, despite having pink hair and a nose ring. I am one of the rare breeds of progressive eurosceptics. I do not believe in the current Brexit plan, but I do speak as somebody who— for me, this is not about remain or leave. This is about the integrity of the democratic process, which is more important than anything else. I just want to preface what I say. I am absolutely convinced that there was a common plan and common purpose with Vote Leave, BeLeave, the DUP, and Veterans for Britain. All of these companies somehow, for some reason, decided to use Aggregate IQ as their primary service provider when Aggregate IQ did not have any public presence, no media, no website. The only way you could find them on the internet is if you went to SCL’s website and called them SCL Canada.
The first question I have is: why is it that all of a sudden this company that has never worked on anything but Cambridge Analytica projects, that had no public presence, somehow became the primary service provider to all of these supposedly independent and different campaign groups? Secondly, what I have provided to the Electoral Commission is three binders of evidence—about this high—of emails, documents, invoices, chat logs, activity logs, system logs, screen caps, of conversations that were happening inside of Vote Leave, in particular with reference to the BeLeave project, which was the single largest expenditure of Vote Leave went to BeLeave. When you look at the accumulation of evidence, I think it would be completely unreasonable to come to any other conclusion that this must be co-ordination; this must be a common-purpose plan.
After BuzzFeed released their first article on, “Isn’t it bizarre that a fashion student who is 22 receives £625,000 in the last two weeks of the referendum? Isn’t it weird that this Canadian company that no one has ever heard of received 40% of Leave’s spending?”, having introduced Darren and Shamir to Vote Leave and having set up this company, I was genuinely concerned that something unlawful happened. It does not pass the smell test. When I went and spoke to Aggregate IQ, they were very pleased with themselves as to how that project went—understandably, they won. But I asked them, “Can you show me what it is you are doing? What was your secret? How did you win? What did you do?” They conceded to me, and this is a verbatim quote—and I stand by; I remember Jeff Silvester telling me this—it was “totally illegal”. But they found it amusing, because you have to remember that this is a company that has gone around the world and undermined democratic institutions in all kinds of countries. They could not care less as to whether or not their work is compliant because they like to win.
I asked them, “Okay, show me some of the work that you have done.” I asked them, “Did you silo the data? Did you silo your advertising?” If you are doing problematic advertising, if you do not silo your programmes into different campaigns, the results of one campaign will influence the results of the other campaign. They said absolutely not, it was all just one common ad programme, which means that Aggregate IQ was just used as a proxy money-laundering vehicle. What Dom Cummings did is he went around and found places that he could just launder money through to give it to AIQ so that they could overspend. That is my genuinely held belief.
It makes me so angry because a lot of people supported leave because they believe in the application of British law and British sovereignty, and to irrevocably alter the constitutional settlement of this country on fraud is a mutilation of the constitutional settlement of this country. You cannot call yourself a leaver, you cannot call yourself somebody who believes in British law and win by breaking British law in order to achieve that goal.
Q1308 Julie Elliott: Is it your belief as well that the law was broken?
Christopher Wylie: Absolutely. I am so angry that two people that I introduced in good faith— it is hard for a lot of young people to get involved in politics, and I introduced these two young people to volunteer on a campaign to Stephen Parkinson in good faith that they would not be manipulated and they would not be used to break the law. What is so egregious about this is that Darren was made to be personally liable for a criminal conspiracy, in my view. It is absolutely outrageous that the amount of emotional trauma that Darren has been put through, watching his mental health deteriorate, watching—Dom Cummings and Matthew Elliott encouraged him and eventually convinced him to quit university so that he could stay at BrexitCentral.
I talked to Darren and said, “You should get out of this because you are losing your perspective as to what is happening,” and I told him I thought he was being manipulated, particularly after all of this stuff came out. He said, “Well, I have already quit university because they told me to quit university, and what am I going to do? I have no options. Everyone hates me.” He told me that he felt trapped. Part of the reason why I am speaking out, and part of the reason why Shamir is speaking out, is in large part, irrespective of what you think about Darren’s political stance on things, he was a young person who was manipulated and continues to be manipulated.
What is so outrageous is that he is the one who is legally liable. He is the one being investigated. It is not Dom Cummings being investigated. It is not Stephen Parkinson being investigated. It is not Cleo Watson, also at Downing Street, being investigated. She was head of Outreach and was in charge of this programme. It is not Victoria Woodcock, who, two weeks after being notified that she was under investigation, goes on to the shared drive where they were putting all of their advertising, putting all of their materials, and attempts to delete Dom Cummings, herself and Henry de Zoete, the head of Digital Vote Leave, after they were notified that they were under investigation. It is not them that is being investigated. It is Darren, the 22 year-old intern who had no control over that spending and was just told, “Sign here, sign here”.
Q1309 Julie Elliott: Do you think these people that you have mentioned—not Darren; the other people that you have mentioned there—knew that what they were doing was in breach of the law?
Christopher Wylie: Vote Leave’s lawyers, William Norton, wrote the constitution for BeLeave. The entire process was managed by Vote Leave’s lawyers, so BeLeave was set up by Vote Leave’s lawyers and the entire process was managed by Vote Leave’s lawyers. As Shahmir has commented on before, that created a veneer or a sense that what BeLeave was doing or what these two young people were doing felt legal because they kept talking to the lawyers, who kept telling them to do this and that. They just assumed that, “If the Vote Leave lawyers are telling us to do this, this must be the proper way to do it.” This was their first campaign. They were volunteers. Although Darren is technically legally liable for what happened, morally I don’t fault him.
Q1310 Julie Elliott: If we put Darren to one side, do you think that Dominic Cummings and all of these other people that you are talking about knew that what was being done was not on the right side of the law?
Christopher Wylie: Why did Victoria Woodcock, two weeks after being notified that they were under investigation, go on to a shared drive that Vote Leave set up and try to delete herself, Dom Cummings and Henry de Zoete? Why did that happen after being notified that they were under investigation?
Chair: We can speculate on that now. Ultimately, this is a matter for the Electoral Commission, and if an offence has been committed, they will recommend action is taken against the individuals concerned.
Q1311 Simon Hart: It is almost irrelevant to what you were just saying, but let’s assume for a minute that the assertions you make are right. Have you or anybody else made any assessment of whether any of this made much difference to the final outcome of the EU referendum?
Christopher Wylie: Okay, two points on that. The first point is when you are caught in the Olympics doping, there is not a debate about how much illegal drug you took or, “Well, he probably would have come in first anyway,” or, “He only took half of the amount.” It does not matter. If you are caught cheating, you lose your medal, because if we allow cheating in our democratic process and we allow this amount, what about next time? What about the time after that? This is a breach of the law. This is cheating. The thing that is important to understand here is that this is not some council race or a by-election; this is an irreversible change to the constitutional settlement of this country. First of all, that is why it matters. If you cheat on an exam, you get a fail. If you cheat on the Olympics, you lose your medal. You should not win by cheating, first point.
The second point, to the actual substance of your question, Dom Cummings himself says that this is what won Brexit for them. He says, “AIQ. They could not have won without AIQ,” and it speaks volumes to the fact that they spent 40% of their budget on AIQ. Having seen the effectiveness of the conversion rates on the online ads that AIQ puts out, they are incredibly effective. They are incredibly effective. When you look at online adverts, you can get programmes with a conversion rate of 1% or 2%. A conversion, just so that people are aware, is not just somebody seeing an ad and not only just seeing an ad and then clicking on the ad; it is clicking on the ad and then performing an action. That is what the definition of a conversion is: filling out a form; giving an email.
Q1312 Simon Hart: Are you going as far as saying that had these institutions not cheated, in your words, the outcome of the referendum might have been different? Is that what you are saying, or is that what Dom Cummings was saying?
Christopher Wylie: I think it is completely reasonable to say that there could have been a different outcome in the referendum had there not been, in my view, cheating.
Q1313 Chair: I want to clarify a few things we have been discussing in this section. You have used the term “franchise operation”. It seems like a kind of mafia-style franchise operation of these different entities—we have focused on three; there could be many more—that are technically independent of each other but they are totally reliant on each other as well; their businesses are reliant on each other. If there is one entity, do you think there is one person who is responsible for that entity?
Christopher Wylie: As in who is responsible for the whole web of things?
Chair: Yes. If it is a franchise, ultimately there is a co-ordinator of that franchise. There is someone whose IP that franchise is.
Christopher Wylie: When I was there that was Alexander Nix and Steve Bannon, but that is a question you should be asking AIQ.
Q1314 Chair: In regards to AIQ and the data in GSR, the Aleksandr Kogan data, do you believe that all the companies would have had access to that data that was gathered as well? Would that have been accessible to AIQ, to Cambridge Analytica, to anyone who was working as part of this franchise?
Christopher Wylie: Yes, absolutely. It is farcical to say that AIQ did not have access to the Facebook data when they were building the software that deployed it. You can’t do online targeting if you do not have access to the database. You can’t.
Q1315 Brendan O’Hara: One question, looking back slightly, you talked about the AIQ conversion rates: what were those conversion rates? You said they were significant or more than significant. What were they? Can you quantify them?
Christopher Wylie: Obviously it depends on the programme and the advert, so there is not one hard and fast rule. I have seen conversion rates at 5%, 7%, which does not sounds like a lot, but in online advertising that is a very effective programme because, again, the conversion is not just somebody seeing the ad or even clicking on it. It is them going and performing an action and signing up, donating, performing a substantive action or coming and attending an event—so, performing a substantive action. On online ads, a lot of programmes that I have seen will get conversions of 1% or 2%. I saw one programme that they had, which had 10%—that was insane—but they had substantially higher conversion rates, at least on the American projects that I worked on.
I have not seen the work intimately that they did on Brexit, but they focused their effort. AIQ did not just advertise to everybody in the country. They focused their effort on 5 million to 7 million people who were the core universe that, if you could turn out these people, then you can win. What they told me is that they did not advertise to everyone in the country. They took a very specific sliver of the country in a very calculated way that they needed in order to win and they just blasted them with ads. You could find out because Facebook would have that information, Google would have that information.
Q1316 Brendan O’Hara: You say that 5%, 7%, up to 10% is absolutely unprecedented in terms of—
Christopher Wylie: Again, for substantive actions like giving £20, signing up and going to an event, becoming a member, whatever that substantive action is, that is a really good conversion rate for people that you have never spoken to before. I am not talking about retargeting. I am talking about fresh people that you have never spoken to before but if you target it in an effective way— if you think about it, if you get a 5% to 7% conversion rate and you target several hundred thousand people and each of those people gives £10, if you count that as the substantive action, or joins and becomes a member or attends an event, that action, when you scale it, becomes quite impactful.
Q1317 Brendan O’Hara: Can I ask you about the relationship between Cambridge Analytica and Global Science Research? What was that relationship, as you understand it? What did they do?
Christopher Wylie: GSR is Kogan’s company. There were several iterations of the Facebook harvesting project. It first started as a very small pilot, firstly to see, most simply, is this data matchable to an electoral register? One of the concerns was if you just collect somebody named John Smith, that could be anybody, so can you match that to this John Smith, on this street, in this city. We then scaled out slightly to make sure that he could acquire data in the speed that he said that he could. The first real pilot of it was a sample of 10,000 people who joined the app. That was in late May 2014. That project went really well, and that is when we signed a much larger contract with GSR in the first week of June—I cannot remember the specific date but the first week of June 2014—where the app went out and collected surveys and people joining apps throughout the summer of 2014. That ended up leading to the 50—the 50 million number is what the media has felt safest to report, because of the documentation that they can rely on, but my recollection is that it is substantially higher than that. My own view is that it was much more than 50 million, but in terms of the relationship, there was a contractual relationship between the companies. Is that the—
Q1318 Brendan O’Hara: Yes. I just wanted to follow on. Now that we have established that there was this contractual relationship, from Cambridge Analytica’s perspective, was that a useful relationship with GSR?
Christopher Wylie: From Cambridge Analytica’s perspective?
Brendan O’Hara: Yes.
Christopher Wylie: Incredibly. This is what built the company. This was the foundational dataset that then was modelled to create the algorithms. That was a very important relationship.
Q1319 Brendan O’Hara: The reason I ask that is because on 27 February, when Alexander Nix was here, he was asked, “Does any of your data come from Global Science Research?” to which he replied, “We had a relationship with GSR. They did some research for us back in 2014. That research proved to be fruitless so the answer is no”. The Chair then said, “They have not supplied you with any data or information?” Mr Nix replied, “No”. The Chair said, “Your datasets are not based with information you have received from them?” He said, “No, not at all”.
Christopher Wylie: Million-dollar contracts. All I would say to that is, “Well, why did you spend the better part of $1 million on GSR? Why are there copious amounts of emails?” I have passed on to the Committee the contractual documents, the invoicing, the match rates of that data, emails about that data. That is just not true. It is just not true. Sorry, it is not true.
Q1320 Brendan O’Hara: You described or you have been quoted as saying that Cambridge Analytica, “We exploited Facebook to harvest millions of people’s profiles and built models to exploit what we knew about them and target their inner demons”. Could you explain a little bit further what that means and even give a practical example of what that would have meant?
Christopher Wylie: When you are looking at psychological disposition—no one is a perfectly rational agent. What in part makes us human is our irrationality, otherwise we would all be just robots. Different people have different dispositional attributes—so, different personality traits, different degrees of mental heuristics or biases. For example, if you are able to create profiling algorithms that can predict certain traits—let’s say a high degree of openness and a high degree of neuroticism—and when you look at that profile, it is the profile of a person who is more prone to conspiratorial thinking, for example. They are open enough to connect to things that may not seem reasonable to your average person and they are anxious enough or impulsive enough to start clicking and reading and looking at things.
If you can create a psychological profile of a type of person who is more prone to adopting certain forms of ideas, conspiracies for example, and you can identify what that person looks like in data terms, you can then go out and predict how likely somebody is going to be to adopt more conspiratorial messaging and then advertise or target them with blogs or websites or what everyone now calls fake news, so that they start seeing all of these ideas or all of these stories around them in their digital environment. They do not see it when they watch CNN or NBC or BBC, and they start to go, “Well, why is it that everyone is talking about this online? Why is it that I’m seeing everything here but the mainstream media isn’t talking about how Obama has moved a battalion into Texas because he’s planning on staying for a third term? I keep seeing that everywhere, but why isn’t the mainstream media talking about that?”
Not everyone is going to adopt that, so the advantage of using profiling is that you can find the specific group of people who are more prone to adopting that idea as your early adopters. If you think about it in terms of trends, all trends start with a group of people who adopt something early. If you can find those people in your datasets, because you know what they look like in terms of data, you can catalyse a trend over time, but you first need to find what those people look like. Does that—
Q1321 Brendan O’Hara: Yes. Was that tactic routinely used by SCL or Cambridge Analytica? Was that one of the tools in the armoury that was routinely used?
Christopher Wylie: Yes. The basis of a lot of our research was: how far can we go with certain types of people, and who is it that we would need to target with what types of messaging?
Q1322 Brendan O’Hara: In accessing that data or getting your hands on that data, did Cambridge Analytica or SCL approach GSR or was it the other way round? Were they approached by GSR?
Christopher Wylie: Yes. I have had this question quite a bit. It is sort of a bit of both, because we were already working with several professors at Cambridge. The first point that I would say is that GSR became a company simply to service Cambridge Analytica. GSR did not pre-exist. We were already working with a lot of professors—just ad hoc consulting and that sort of thing—at Cambridge, which is how we got introduced to Kogan. It was not as direct as, “I sought out Kogan,” or, “CA sought out Kogan,” and it was not that Kogan sought out us. It was just the fact that we were engaging a lot of the same people and it was just through that interaction that we started talking.
The first profs that we started working with were David Stillwell and Michal Kosinski, but the reason we stopped working with them was because Michal Kosinski at the time was the deputy director of the psychometric centre, and once he found out how much money we had, he asked for $500,000 and 50% royalties, which he sent in an email. I have also provided that to the Committee. It was not feasible on an experimental project to make that kind of commitment. It was Kogan who then came and said, “Well, I could do it. As long as you pay for the data and pay for costs, we can do it and figure out some kind of commercial deal after so let’s just see if this works.” That is why Kogan ultimately was selected to be the person to provide those services, because Dr Kosinski wanted $500,000 and 50% royalties.
Q1323 Brendan O’Hara: Do you know how much Cambridge Analytica paid GSR for the data?
Christopher Wylie: It depends on what you mean by “paid for”. The way the project ran for the most part was SCL—because remember all the accounts are SCL, so when I say CA and SCL I am talking about is effectively the same thing. It was technically SCL accounts that were paying for it. SCL would pay for the invoicing to Qualtrics or MTurk, which were survey responder recruitment platforms. SCL would pay for that directly. Not that much money was passed through GSR. It was just paid directly to Qualtrics or Amazon MTurk and so on.
GSR was paid money, because in order to make a valid contract you need consideration. They did receive £3.14 or pi pounds as the contract fee, but most of the money that was spent went directly to pay for costs rather than pay Kogan when I was there. I know that Kogan stayed around longer with SCL after I left, so I am not sure at that point if he made a commercial deal or not with SCL, but when I was there it was predominantly just a research project.
The deal was that he could keep all the data and do research or whatever he wanted to do with it. For him it was appealing because you had a company that was the equivalent of— no academic grant could compete with the amount of money that we could spend on it, and also we did not have to go through all the compliance stuff that you have to do with academic grants and all the reporting and all of that, so we could literally just start next week and pay for whatever you want. My impression at the time was that for an academic that would have been quite appealing.
Q1324 Brendan O’Hara: Much of the attention, quite rightly, is on Cambridge Analytica at the moment. Do you know if there are other data analytics companies out there who are operating in the same way?
Christopher Wylie: When I first joined SCL, one of the very first emails I got was asking me about a company called Palantir. I am not sure if people are familiar with Palantir, but it is a private contractor. Its largest client is the NSA. It also works for GCHQ. Alexander Nix was very interested in the work that Palantir did, in part because Sophie Schmidt, who is the daughter of Eric Schmidt, the chairman of Google, worked for Alexander Nix before I came on board and introduced him to Palantir. When I came on, one of the very first questions was, “Can we do something with Palantir? Can we do something with Palantir? What do you think about Palantir?” We had several meetings with Palantir while I was there, and some of the documentation I have also provided to the Committee— and there is more documentation that I still need to provide you on this. There were senior Palantir employees who were also working on the Facebook data.
Can I clarify one point? That was not an official contract between Palantir and Cambridge Analytica, but there were Palantir staff who would come into the office and work on the data, and we would go and meet with Palantir staff at Palantir. Just to clarify, Palantir did not officially contract with Cambridge Analytica, but there were Palantir staff who helped build the models that we were working on.
Q1325 Rebecca Pow: It was something you mentioned earlier, Christopher, and I wondered if it is related to some of the things my colleague has just referred to. You mentioned that in the elections around the world that these various companies, AIQ in particular, had been involved with, one of the main influences and the main way they made money was through “influence brokering”. Could you explain what that is? I am asking whether there is a more sinister side to this. This is not just about influence in affecting elections and the kick of the academic side. Is there a more sinister moneymaking side linked to all of this that we have not yet uncovered?
Christopher Wylie: Yes. You don’t make a ton of money working on politics, particularly in a small island nation, for example, but that island nation may have oil reserves or minerals or lax labour laws that can be exploited by companies, or could have lax labour laws if those laws were passed. Part of the business model of SCL is to capture a Government—so, win an election. You get paid for that, but you do not make a ton of money; where you make money is then going to the Minister and introducing the Minister to a company and then making deals. There were different companies that were interested in building new ports or things like that, and in order to get a competitive advantage, if some money goes here and some money goes here and you can introduce the Minister and if the minister then approves the project, you get a cut of that deal.
When I was there, it was not just selling influence from a company to a Government. Often they would use fake Government projects to also help support the political aims of the Minister. For example, Alexander Nix met with the Minister for health of Ghana and offered essentially to provide her with a large degree of political and campaign services, but they would bill it through the Ministry of Health as a health research programme, and so they approved that. I have also sent documentation to the Committee on this.
Q1326 Rebecca Pow: Can I just stop you? Earlier you referred to some of these very wealthy people involved in these companies. Do you think this is what their driving force is—that they can be big power players on the world stage?
Christopher Wylie: Yes. You can be like a colonial master in a country. Sorry, not to sound flippant about it, but it felt very much like a privatised colonising operation. You would go into a country that has underdeveloped civic institutions, exploit that and make money off it. They make a lot of their money through exploiting relationships and, because there is not a lot of oversight and Government accountability in a lot of these countries, it is very easy to make money off that. The key thing is you have to have your guy in power first.
Q1327 Giles Watling: You have told us some pretty horrendous stories, particularly about the political situation in Nigeria, working on things there, and you have told us that Cambridge Analytica does not have staff, yet you worked for Cambridge Analytica. Were you employed by SCL?
Christopher Wylie: I was paid for by SCL. Yes, I worked for Cambridge Analytica, as does everybody. Everybody works for Cambridge Analytica but they are paid for by SOCIAL, and I started before Cambridge Analytica even existed.
Q1328 Giles Watling: Cambridge Analytica came along and that relationship, which you have so eloquently described, started and, in effect, you were working for Cambridge Analytica.
You have talked about all those malevolent influences that have been exposed in Nigeria and so on, and you are working for these people. You signed, as you said, a non-disclosure agreement with Cambridge Analytica; is that right?
Christopher Wylie: With SCL.
Q1329 Giles Watling: With SCL. Now you have decided to go whistleblower on all this, are you under any threats? Is anything happening? What is happening in your world?
Christopher Wylie: Do you know what is interesting? The most legal pushback that I got was not from Cambridge Analytica; it was from Facebook. It is Facebook who is most upset about this story.
Q1330 Giles Watling: How does that materialise? Are they threatening legal action or—
Christopher Wylie: They have sent some fairly intimidating legal correspondence. They have not taken action on that, I think. I am not sure exactly what they are planning. They just have gone silent. They will not talk to me anymore.
Q1331 Giles Watling: You are just left out in the cold now, is it?
Christopher Wylie: Yes. But I do anticipate at some point some robust pushback from Cambridge Analytica, because this is an existential crisis for them. I think that I have a fairly robust public interest defence to breaking that NDA and that undertaking of confidentiality.
Q1332 Giles Watling: You say that the Donald Trump thing was not the actual crossing of the line, but it was the final straw on the camel’s back when you decided to turn whistleblower?
Christopher Wylie: It made it the most salient in my mind, as in, it was no longer this niche shady firm. It was a firm that was making a massive impact on the world, so it made it much more salient in my mind.
Q1333 Giles Watling: Was your move dictated by morality, questions of morality, or illegality?
Christopher Wylie: It is a process of coming to terms with what you have created and the impact that that has had. I am incredibly remorseful for my role in setting it up, and I am the first person to say that I should have known better, but what is done is done.
Q1334 Giles Watling: It was not a road to Damascus thing. It was a gradual realisation that, “What I am doing here is amoral.” Is that how you felt?
Christopher Wylie: Yes. It was not a sudden “Aha!” moment. I knew that I was growing really uncomfortable with working at the firm for a whole slew of reasons, but I did not report the firm because they kept threatening to sue me and I had signed not just an NDA, but there was the additional undertaking of confidence. It is very intimidating to go up against an American billionaire who is threatening to sue you into oblivion.
When you look at, for example, Carole Cadwalladr’s reporting in The Guardian, there has been a lot of attention on me because I have become the face of it, because I am the one who has come forward and put my name to it, but she has 12 or 15 other sources that she has talked to. Even now, with CA being exposed and the future of the company is in question as to whether it will still be a company in a couple of months, people do not want to come forward because that is how intimidating Alexander Nix is. That is how intimidating Steve Bannon is. That is how intimidating Robert Mercer is. Also, when you look at—
Q1335 Giles Watling: You find yourself in the vanguard of it. I put it to you: do you want to bring these companies down? Is that how you feel about it? You are angry; I have seen your emotion.
Christopher Wylie: Frankly, yes, because nothing good has come from Cambridge Analytica. It is not a legitimate business. SCL is not a legitimate business. Yes, I don’t think that they should remain in business.
Q1336 Giles Watling: That clears up your motivation. Can I move on to Cambridge Analytica? Do you know when Facebook first knew that its data had been passed to Cambridge Analytica? Do you have any idea when that happened?
Christopher Wylie: I know it sounds like a simple question, but it is a hard one to answer because I have heard different things from different people and all of them are plausible. I remember when—and I think this was around July 2014—Kogan was delayed for a couple of days because Facebook had throttled the app, so that it could not pull as much data. There was some problem with pulling as much data at the same speed as before. He told me that he had a conversation with some engineers at Facebook. I was not in those conversations. This is what he told me at the time. Facebook would have known from that moment about the project, because he had a conversation with Facebook’s engineers, or at least that is what he told me. I do not know if that is entirely true or not, but that is what he told me.
Facebook’s account of it is that they had no idea until The Guardian first reported it at the end of 2015 and then they sent letters to me in August 2016 asking, “Do you know where this data might be or was it deleted?” The date of the letter is the same month that Cambridge Analytica officially joined the Trump campaign, so I am not sure if Facebook was genuinely concerned about the data or just the optics of, “Okay, now this firm is not just some random firm in Britain. It is now working for a presidential campaign.”
Q1337 Giles Watling: You said an interesting thing there. You said, “where this data might be”. Data is not stuff that you pick up and move. It spreads but it remains in its source position.
Christopher Wylie: Yes. It is completely fungible in the sense that you can copy it a million times, it can go anywhere and—
Q1338 Giles Watling: It is how far it has spread.
Christopher Wylie: It is often impossible to ascertain where did the data go or where is it or how much of it is—
Q1339 Giles Watling: Do you know if Facebook ever made any efforts to retrieve data, to delete data?
Christopher Wylie: No, they did not. That is my knowledge. They certainly didn’t with me until after I went public and then they made me suspect number one, despite the fact that the ICO wrote to me and to Facebook saying that I have given over everything to the authorities. I suspect that when Facebook looked at what happened in 2016, they went, “Well, if we make a big deal of this, this might be optically not the best thing to make a big fuss about.”
Giles Watling: A PR thing.
Christopher Wylie: Yes. If you saw what happened last week, it was a big deal. I do not think they pushed it in part because if you want to investigate a large data breach, that is going to get out and that might cause problems. My impression is they have sort of wanted to push it under the rug.
Q1340 Giles Watling: To put it in a nutshell, it was not in Facebook’s interest to pursue the large data breach?
Christopher Wylie: No, because when you look at what this firm was also doing, you had Professor Kogan, who was managing the acquisition of this data, going back and forth to Russia, working on Russian-funded projects—which, by the way, CA pitched to other clients. They knew what he was doing in Russia.
Q1341 Giles Watling: Was that you pitching?
Christopher Wylie: No, it was not me pitching it. I have sent you copies of emails where other people at the company are deciding to put it into a pitch for other clients. You had all kinds of people having access to the data. Staff at Palantir had access to the data; all kinds of people had access to the data.
Q1342 Giles Watling: It was not locked down. It was everywhere.
Christopher Wylie: It was everywhere, yes.
Paul-Olivier Dehaye: If I may add something, when Harry Davies, the journalist at The Guardian, published an article in December 2015, that is the moment where the story became a public story or started becoming a public story. That is also my entry point into this. He has just published an article in The Guardian, yesterday or the day, before explaining the genesis of that article for him. Apparently he knew of improprieties around data flows outside of Facebook a few months after it happened—something like, I am guessing, around October 2014, let’s say. He started investigating, but he did not know where the data was going—he did not know what the use was and so on. It was only later, because he got a tip that Cruz was working with Cambridge Analytica, that he connected the dots and later published his article in December 2015, much later.
My point is that at the time—you will have to ask him, but somewhere between October 2014 and a few months later maybe—he started talking to Facebook and asking Facebook questions about this data. At that time, essentially Facebook was the only entity that could trace the data because of contractual—
Q1343 Giles Watling: As far as you are aware, they made no effort to do so?
Paul-Olivier Dehaye: You will have to ask him, but that is much earlier than I thought for a long time. It is only a couple of days ago that I changed my mind on this question.
Giles Watling: That is interesting. Thank you.
Q1344 Chair: Just so I can be clear on the use of the data that came from Aleksandr Kogan, from what you said, Chris Wylie, the data was used to build the algorithms that ran Cambridge Analytica. Once you have used the core data, once you have extracted the value you need from it, you have your own systems then. Cambridge Analytica say, “When we were asked by Facebook to give that data back we did,” but even if they did do that, they have already used the data to build other systems.
Christopher Wylie: Yes. It created what is called a derivative product. The easiest way to think about it is, let’s say you have a book and it is written in French and then you translate it into English, it is the same information being conveyed; it just looks very different or it could look completely different. It could be translated into Chinese, for example. It looks completely different, different semantic structure, grammatical structure, tenses and so on, but the same information is conveyed. The data itself may look different but the underlying information is what matters.
Q1345 Chair: In this case, even if Cambridge Analytica are correct in what they are saying in response, what you said today, “Well, we gave this data back,” they may well have done, but the value they extracted from that data they have kept, because they created something new with it.
Christopher Wylie: The information.
Chair: Information.
Christopher Wylie: Yes, because the data is like— whether it is expressed in English or French, the information is what it is conveying.
Q1346 Chair: Have you been able to benefit from that dataset in other projects you have done outside of Cambridge Analytica, or does that data and the value that is extracted from it remain within that company?
Christopher Wylie: Sorry, as in did I personally benefit from the data?
Chair: You were working on that data at the time when you were there and whatever was done with that. When you left Cambridge Analytica, were you able to benefit from the acquisition of that original data on things you have done outside of Cambridge Analytica or did that stay very much as tools developed in that company?
Christopher Wylie: I did not do any contracts or any work with that data.
Q1347 Chair: After you left?
Christopher Wylie: No. I have not worked with any clients that that data was used for. As I recall, that data got deleted, I believe, in 2015, on my end.
Q1348 Jo Stevens: Going back to 2013, when you said you started out and you were introduced by a mutual political contact to SCL Group— I was interested in the initial article that Carole Cadwalladr wrote in The Observer on 18 March, when you said, “I wanted to know why the Lib Dems sucked at winning elections,” and that is how you got into it and started looking at the issue. The introduction, through a mutual friend, in June 2013 to SCL Group, was that by a Lib Dem politician?
Christopher Wylie: It was not a politician, no.
Q1349 Jo Stevens: Okay. You do not want to say to the Committee who the introductory contact was?
Christopher Wylie: I do not think it is relevant. Any time I bring up somebody’s name, the whole world comes down on them and there are conspiracies about all kinds of people, so I do not think it is fair on that person, because it was genuinely just an innocent introduction.
Q1350 Jo Stevens: Okay, fine. Then I want to go back to what you were saying about the Vote Leave campaign and AIQ. We know, because it is in the public domain, that Vote Leave spent 40% of its declared expense through AIQ or on AIQ, £2.7 million. In your evidence you said—and I wanted to clarify whether you were talking about the referendum campaign or a different campaign—that 5 million to 7 million people were targeted by AIQ, a sliver of the population.
Christopher Wylie: Yes, that is what they told me. You have different targeting universes. To clarify that slightly, they probably had a wider peripheral universe and a core universe. You often have, most fundamentally, a persuasion universe and then a turnout universe. My understanding from those conversations was that they were targeting a very specific cohort of people. They posited, “If x% of these people turn out, then you can win.”
Q1351 Jo Stevens: Yes. You also said that the conversion rate for AIQ was around 5% to 7%, for some projects.
Christopher Wylie: For some projects. Every project will have different conversion rates. There are some candidates who are just not sellable. It is not magic. If your candidate makes a habit of eating puppies in some sadomasochistic ritual, it is hard to sell that, even with really good targeting.
Q1352 Jo Stevens: We have not had one of those yet. I am just trying to work through in my mind: we have the targeted group of people, we have a conversion rate, which you say for AIQ they did quite well on on contracts.
Christopher Wylie: Yes. Also remember that a conversion rate does not necessarily mean there is not a turnout; that is people who are performing a substantive action for your campaign itself.
Q1353 Jo Stevens: Yes. We know that the Vote Leave online adverts received nearly 1 billion impressions, because Dominic Cummings has told us that in his blog.
Christopher Wylie: Yes. That is how many views the drive—
Q1354 Jo Stevens: In the end, the referendum result comes down to just 600,000 people, or just over 1% of registered voters. He says, “A small enough margin, a few specific events and decisions made all the difference”. Going back to what you said in response to my colleague Simon Hart about this spend and targeting and the outcome of the referendum, do you think that it is perfectly reasonable to say that this could have made a difference or did make a difference?
Christopher Wylie: It is incredibly reasonable to say that AIQ played a very significant role in leave winning, yes.
Q1355 Jo Stevens: That is the Vote Leave expenditure. What about Leave.EU, which is Nigel Farage and Arron Banks’s campaign group? Did Cambridge Analytica work with them?
Christopher Wylie: Just to be clear, I did not work at CA when that happened but I have seen documents. Some of the documents may have been passed to the Committee. There are also tape-recordings of Andy Wigmore, for example, talking about how they used Cambridge Analytica. Gerry Gunster is also on tape saying that they played a role early on in the campaign. One of the things that you have to remember about CA is that they are very good at using these weasel words. I have also seen invoices that said UKIP on them, not necessarily Leave.EU. They might go, “We started working for Leave.EU and then we didn’t. All of that, we were over-exaggerating,” but then they may have also been working for other entities.
One of the other things that I have seen—which I believe Emma Briant, the academic, may have passed on—are documents from Eldon Insurance, which is Andy Wigmore’s insurance company. Those are Eldon Insurance documents, so they say “Eldon Insurance” on the letterheads, or their presentation says “Eldon” at the top, but then it is all about the response rates that Leave.EU messaging was getting online.
One of the other questions that you should be asking to Eldon Insurance is, “Did you use your insurance data, or your customer data, to the benefit of Leave.EU?” Following that, “Was that data processed, or did Cambridge Analytica also have access to that data?” What we do know is that Cambridge Analytica absolutely had a relationship with Leave.EU. Some of the things that I have seen—which I believe have been passed on to the Committee, although you would have to check with Emma Briant about that—are documents that also have Eldon Insurance, which would have a huge amount of data, because it is an insurance company, talking about the performance and conversion rates of Leave.EU advertising.
I am much less familiar with what happened there than I am with Vote Leave, but some questions I would encourage you to ask are, “Why is it that Eldon Insurance knew about and was reporting on the conversion and response rates of Leave.EU messaging? Did Eldon Insurance use customer data in any way for Leave.EU? Did Cambridge Analytica have access to that data?”
Q1356 Jo Stevens: As well as the Eldon Insurance documents, are there any other documents or evidence that you have seen that links Leave.EU to Cambridge Analytica activity during the referendum campaign?
Christopher Wylie: From something else I have seen, again UKIP invoices. I also know that Bannon was really interested generally in UKIP. He saw it as really important for America because if you are fighting a culture war, Britain plays a key role in that, if you look at the way Americans imagine Britain as still Downton Abbey, everyone is very posh, educated, refined. If you can instil a populist movement in Britain, in the American psyche it is validating—“If Britain is doing it, if Britain is Brexiting, then we can elect Trump”. For example, Matthew Richardson, who I believe is on the board of UKIP—do not quote me on that; he is involved in UKIP—is also Robert Mercer’s lawyer. There are significant links, but I would ask Andy Wigmore, “Did you meet with Robert Mercer? Did you meet with Steve Bannon?”
Q1357 Jo Stevens: Thank you. You have also said this morning you believe that there was unlawful activity during the referendum by Vote Leave, when asked by my colleague. We are seeing the ICO’s investigation unfold here quite slowly.
Christopher Wylie: Just a point on this. I have provided them with as much information as I can, but the ICO does not have a lot of powers. The other thing is they do not have that many people. One of the things that I witnessed is how many people and how much money can be spent at Cambridge Analytica or at Facebook and then looking at the small team and the very limited resources and powers that the ICO has. It is not the ICO’s fault that it has been slow.
Q1358 Jo Stevens: No. I was not phrasing that question as a criticism at all, and I am glad you have said what you have said, because what I was going to go on to say—
Christopher Wylie: It has been very difficult for them because they struggled to get evidence and to deal with giving them the evidence. They do not have that many resources.
Q1359 Jo Stevens: No. If you think about what they are there to enforce compared to, say, a police force somewhere in the UK, their funding and resources are tiny. With the referendum, if somebody breaks the law, if the allegations that we have heard about are proven, it is £20,000 to fix a referendum. That is not a disincentive to behave unlawfully. Would you agree with that?
Christopher Wylie: Also, because these investigations take so long, even if it is found out, Brexit will already have happened.
Jo Stevens: Brexit has happened, the companies that ran the campaigns have been dissolved, people have disappeared.
Christopher Wylie: Yes. What a shame it would be if that were found out—that there was pervasive cheating in the referendum and Brexit has already happened and we cannot go back.
Jo Stevens: Absolutely.
Christopher Wylie: That is why some of these regulators, in my view, really do need to be properly resourced—not just the ICO, but the Electoral Commission also.
Q1360 Jo Stevens: Can I turn to something completely different now? You have talked about different countries where AIQ have played a part, and I wanted to ask you about the Czech Republic. In the Channel 4 undercover investigation, executives said on screen that Cambridge Analytica and SCL had worked in more than 200 elections across the world, including in the Czech Republic. I am quoting from Mark Turnbull, the man with the plaster on his nose: “We have just used a different organisation to run a very, very successful project in an eastern European country where no one even knew they were there”. Did you know anything about the work in the Czech Republic?
Christopher Wylie: I have heard about the work in the Czech Republic, but I do not have any direct experience on it. This is what I am saying about the role of AIQ, and other companies like it: that if you want a company to fly under the radar or not be noticed until after an election, after you have gone out of the country, it is very beneficial to have this web of companies that are registered in different countries. They have seemingly independent operations that you can then use to operate under the radar.
Q1361 Jo Stevens: You also mentioned in your evidence about Russian companies working with Alexander Nix. In the evidence that you have made public you talked about Alexander Nix doing a presentation to Lukoil; is that correct?
Christopher Wylie: Lukoil. I have passed this on to the Committee.
Q1362 Jo Stevens: You said, “It does not make any sense to me. If this was a presentation about a commercial deal, why were Lukoil so interested in our political targeting?” There is a connection between Lukoil and the Czech Republic, because one of the former Lukoil executives advises the new President of the Czech Republic.
Christopher Wylie: Yes, because they paid for all the legal fees.
Q1363 Jo Stevens: Did the companies that were pitched in Russia have access to data? What were they able to see and get hold of?
Christopher Wylie: What I am a direct witness to is meetings, presentations, discussions and conference calls with Lukoil, so I cannot say one way or the other whether data ended up going to Lukoil. The conversations with Lukoil surrounded two things. First, Alexander sent them white papers that I had written, or project write-ups that I had written about the Ripon project—what kind of data were we collecting, what was our internal capacity like and how effective was it, a paper that explains, “We are profiling the American electorate. We can target them online. This is how we influence them”. Secondly, presentations from Alexander Nix, which I have also provided to the Committee. The very first slide is rumour campaigns, disinformation, attitudinal inoculation and undermining confidence in civic institutions in Nigeria. Those were the first couple of slides that he gave to Lukoil, this Russian oil company.
The thing that I found bizarre at the time, and my feeling at the time was suspicion but not in a concerning way, just in, “What are you doing, Alexander?” something naughty, not nefarious, because to me it did not make sense. He would refuse to tell me what this actual project was. It did not make sense to me that this Russian oil company wants to know about all of this data that we are collecting, despite the fact that we do not operate anywhere where it has an interest. It is a Russian oil company; why do you need a massive profiling project in America? That did not make sense to me, neither did the fact that Alexander made such a concerted effort to show this company its experience with disinformation and rumour campaigns. At the time I just thought, “Okay, well, there is something else up here,” but I did not think it was some kind of grand conspiracy. I just thought maybe Alexander is cutting some deal, or some money thing.
It was in the 2016 cycle, this narrative and evidence about Russian interference—particularly using Facebook as a vehicle for propaganda—where I started to think, “Right, well.” We were talking to a company that works hand in hand with the FSB. Alexander had put in the email that he was sending my white paper and documents to the CEO of the company. It was not some random person; it was the person at the very top of this company. We also made it known that the lead professor who had access to the harvesting applications was going back and forth to Russia and working on the project partly out of Russia, and also working on other psychological profiling projects in Russia.
For me, that was concerning. What I am not saying—and I will be super-clear—is that Alexander Nix or Aleksandr Kogan, or anybody involved in that, knowingly colluded with Russia to undermine America in an American election. What I am saying is that there was a very significant risk that was created in notifying this company not only of the existence of this data but the fact that, in telling them that the person in charge of this data is operating, in part, out of Russia, that would make it incredibly easy for them to get access to that data. For me, that is concerning, and should be looked into.
My own view is that Alexander was being really stupid; they should have known better. You have to remember SCL Group runs projects in the Baltics and eastern Europe for various NATO countries on counter-Russian propaganda, and they also work on the NATO StratCom training centre in Latvia. Alexander would have known, given how closely we work on the border of Russia on projects that were funded by NATO members—in large part for counter-propaganda and the StratCom centre and all that kind of work in Latvia—that the company would have logically been an intelligence target for Russia.
If you are meeting with Lukoil—which very openly has a relationship with the FSB and operates in Europe where the FSB cannot—and you are already likely an intelligence target because of the military and defence project work that you are doing in eastern Europe and the Baltics, and then you tell them, “By the way, you do not even need to hack into our data systems; just put a key logger on Kogan’s computer in Russia and you have everything,” it is as simple as that.
Q1364 Jo Stevens: You mentioned a professor in relation to that evidence you just gave. Who was the professor?
Christopher Wylie: Kogan.
Jo Stevens: That was Kogan, right.
Christopher Wylie: Although Kosinski did not work on this project, he was also going to Russia. He posted that he was going to do a presentation to the Russian Prime Minister.
Q1365 Jo Stevens: My very last point is just to go back to that Eldon Insurance issue that we discussed. Eldon Insurance deals with substantial numbers of personal injury cases, and the data that they hold would be classed as sensitive data under UK law.
Christopher Wylie: Absolutely.
Jo Stevens: Are you saying that you think there would have been a breach of that sensitive data in the relationship between Cambridge Analytica and Eldon Insurance?
Christopher Wylie: I will be super clear: I do not know one way or the other what the relationship between Eldon Insurance and Cambridge Analytica is, but what I have seen—and I think has been passed to the Committee—
Jo Stevens: Is the UKIP/Eldon Insurance—
Christopher Wylie: Is Eldon Insurance-branded documents talking about the response rates and performance figures of Leave.EU messaging and online advertising. The thing that I find bizarre about that is, first of all, why is Eldon Insurance making this report and, secondly, why do they have access to that data? We know that Cambridge Analytica has had a relationship with Leave.EU; they dispute the details, but what is not in dispute is that they had a relationship with Leave.EU. I am not saying one way or the other that Cambridge Analytica had access to that data, but it is something that is worth asking Eldon and Cambridge Analytica about, or Andy Wigmore: “Why was your insurance company making performance reports on Leave.EU messaging?” That was not declared, first of all, and, secondly, “Were you using your insurance company’s data to target people in Brexit?” I think that is a fair question to ask.
Jo Stevens: So do I. Fine. Thank you very much, Mr Wylie.
Q1366 Chair: While we are on Russia, did Cambridge Analytica or SCL use any Yandex tools or cookies as part of their analytics work?
Christopher Wylie: I am not sure. I cannot say one way or the other.
Q1367 Chair: This was a blog report saying that a Yandex verification meta tag was found on the Breitbart website. Given that, was that something you have come across?
Christopher Wylie: I know that CA has had a fairly close relationship with Breitbart, and I believe Breitbart was a client of theirs. I do not know if it is a current client, but I believe it was a client. To the specifics of that, I do not have an answer for you.
Q1368 Paul Farrelly: Covering the foreign countries, you have mentioned Nigeria. Can you say a few words about what work you were aware that the company did in Trinidad and Tobago?
Christopher Wylie: The Trinidadian project was for several politicians. It was mostly a data harvest. We used it as a precursor to the Ripon project, to see how much data could be pulled and if we could profile different attributes in people.
Q1369 Paul Farrelly: Pulling it from where?
Christopher Wylie: Online data sources, the contractual documents with AIQ whose role it was to go and find data. The contracting is pulling ISP data, and there are also emails that I have passed on to the Committee, where Aggregate IQ is working with SCL to find a way to pull, and then de-anonymise ISP data—so, raw browsing data.
One of the other things that was pitched to the Minister of National Security there was related to some of Kogan’s Russian research—which I have also provided emails on—about whether you could create a dispositional profile, and then quantify that in data, of people who are more likely to commit crime. I did not continue working on that project because I got switched over mostly to the United States. I have provided documentation on Trinidad to the Committee, in particular with reference to Aggregate IQ trying to acquire raw de-anonymised ISP data.
Q1370 Paul Farrelly: You have mentioned Latvia, but I defy anyone to go to Riga and visit the National Museum of Liberation there and not come out in tears with a broken heart about what that country, like other Baltic republics, has been through, particularly with the legacy of the break-up of the Soviet Union. That country, like the other Baltic countries, does not need any more tensions inflamed. Could you explain a little bit more about what analytical work was done in Latvia?
Christopher Wylie: Just to be clear, that is not Cambridge Analytica; that is SCL Defense, or some iteration of SCL, that was doing that.
Q1371 Paul Farrelly: It is not political work.
Christopher Wylie: It is not political work. I believe the Department of Defence in Canada is the main funder of that.
Q1372 Paul Farrelly: This is the military side. Can you—
Christopher Wylie: It is focused on information operations training and capacity building, but also my understanding was that they were doing counter-propaganda work in the Baltics, at least from my impression of it, nothing nefarious.
Q1373 Paul Farrelly: There should be no suggestion that, as far as you are aware, they have piggybacked on the back of that to do political work?
Christopher Wylie: No, not necessarily, because I believe they used some of their connections to do some political work in Lithuania. My recollection on that is fuzzy, but I believe they have done some political work in addition in Latvia. I think I passed to you a document that references that.
Q1374 Paul Farrelly: Perhaps Latvian journalists can follow that up with their Government. Going back to Facebook’s biggest user markets, if you make a speciality out of using Facebook and surveys—I do not know how many Aleksandr Kogans there are who have worked with Cambridge Analytica—you focus on the world’s biggest democracy with lots of elections all the time, India, as being a prime source of business. You mentioned that they have done quite a bit of work in India. Could you describe what you are aware of?
Christopher Wylie: I believe their client was Congress, but I know that they have done all kinds of projects. I do not remember a national project, but I know regionally. India is—
Paul Farrelly: Different states.
Christopher Wylie: Yes. India is so big that one state can be as big as Britain. They do have offices and staff there. I believe I have some documentation on India, which I can also provide to the Committee if that is something that is of interest.
Paul Farrelly: That would be very welcome. Yes, great. Another country that does not need any tensions being inflamed.
Paul-Olivier Dehaye: My understanding, relating back to the Romanian—your predecessor, Dan Muresan—is there are stories that are starting to come out, one in India, of his involvement when he died in Kenya. He was working for Congress, according to reports from India, but he was really paid for by an Indian billionaire who wanted Congress to lose. He was pretending to work for one party but was really paid underhand by someone else. Those seem to be the reports that are coming out now from India. Definitely on all of this there needs to be some collaboration between Romanian, Kenyan and Indian journalists to piece out what happened.
Q1375 Simon Hart: I am very conscious that you have covered a huge amount of ground in the last few hours, so I am going to ask you to confirm one or two things, by way of a recap, to make sure that I have understood you correctly, particularly around the area of the EU referendum. I think I am right in saying that you have argued this morning, and submitted by way of written evidence, that you are convinced that AIQ played a significant role, not only with Vote Leave but also other protagonists of the leave campaign and—I hope I am not putting words in your mouth—that you felt those groups were somehow loosely or informally linked with one another. Would that be a correct analysis of what you have said so far?
Christopher Wylie: Yes. What I have submitted to the Electoral Commission is evidence that shows that there was a clear reporting structure. BeLeave was based inside of Vote Leave’s headquarters and they reported to Vote Leave staff. That is included in the evidence. Yes, not just a loose or informal relationship. It was not formal in terms of documentation or, “This is the reporting structure of BeLeave,” but the fact that they asked permission and were working out of Vote Leave’s offices leads me to conclude that there was co-ordination that was not declared.
Q1376 Simon Hart: You went on to say that Facebook became aware that data may have been used by Cambridge Analytica for electoral purposes. Would it necessarily be the case that Facebook knew that AIQ may have also been benefiting from that same data, or would that be stretching the connections a bit too far?
Christopher Wylie: I do not know; you would have to ask Facebook that. I do not know exactly what Facebook has and has not done in terms of their investigation.
Q1377 Simon Hart: I think you said that they were aware—clearly they were aware, we know they were—that there was a data breach involved with Cambridge Analytica, which has led, arguably, to us having this conversation today. I am asking you whether you felt that Facebook was aware of that close connection between Cambridge Analytica and AIQ or whether that is purely coincidental.
Christopher Wylie: I do not know if Facebook is aware of the relationships between AIQ and Cambridge Analytica. Again, part of the intent of having a lot of companies around the world with different names is that it does make it confusing and opaque as to who does what. It may also be that, when Facebook went and asked questions to CA, they simply were not told, “A lot of the software development happens at AIQ, not here,” which is entirely possible.
Q1378 Simon Hart: We will have further opportunity to question Facebook, so we will be doing that. The third point is, right at the beginning of your evidence you made it perfectly clear you felt that CA and SCL, and I would add—but I am asking a question about that—that includes AIQ, were involved in straightforward illegal activity, which you have submitted by way of evidence to the Electoral Commission. Would it be right to include AIQ in that?
Christopher Wylie: AIQ played an absolutely pivotal role in the overspending scheme that was set up at Vote Leave.
Q1379 Simon Hart: Does that not make the role of Mr Mercer—who you have described as quite intimidating—doubly serious? You have what you are submitting are very clear breaches of electoral legislation by some fairly substantial players and, coupled with that, intimidation by the guy whose name appears on this complicated graph in various significant places. Do you think that Mr Mercer should be subject to investigation himself with regard to intimidation?
Christopher Wylie: Absolutely. It is not just legal intimidation. This company uses firms like Black Cube, and I would encourage you to talk to Channel 4 to watch the footage of Alexander Nix talking about Black Cube because they were not, unfortunately, able to air it. If you work with Black Cube—that is an intimidating firm.
Q1380 Simon Hart: My final question is about the undercover film taken of Alexander Nix, in which he was referring to the various different means of coercion that may take place, including Ukrainian sex workers—subsequently denied. How much significance should we attach, as a Committee, to the denial?
Christopher Wylie: To the denial?
Simon Hart: His denial that they were quite happy to use coercion in attempting to achieve their electoral results on behalf of their clients.
Christopher Wylie: My understanding is that that was common practice. There is a bunch of projects that they have worked on. It is not just Nigeria; as Carole Cadwalladr in The Guardian has also reported, there was a hacking scheme in St Kitts, for example. Someone else that you should be calling to the Committee is Brittany Kaiser, because she played a pivotal role in that relationship between Cambridge Analytica and Black Cube. She has touched on it in one of her interviews with The Guardian, but I would encourage you to talk to her about some of that work also.
Something to say about the Nigeria project is that I got incredibly panicked phone calls from people, because the relationship with one of the funders turned sour, several people were threatened with their lives and they had to immediately leave the country. My predecessor was found dead; one of my other co-workers had a massive head injury and is missing part of his skull. People do get hurt at this firm. Given that they work with Israeli private intelligence firms, who are willing to do whatever it is you want them to do if you pay them, this is why so many people—about whom, for example, Carole has talked to you—are genuinely afraid to come forward to talk about the firm, because it is that intimidating.
Simon Hart: Thank you very much. I sadly have to go now. It is not a reflection of the evidence you have just given, but I have to be somewhere else.
Q1381 Chair: From what you have said about Brittany Kaiser, she was the Cambridge Analytica liaison with Leave.EU.
Christopher Wylie: Yes. You have Brittany Kaiser, who sat at the launch event of Leave.EU, who worked on a project that involved hacking the now President of Nigeria, creating kompromat, distributing videos of people being murdered. It would be a fair thing for your Committee to do to call her and ask, “What were you doing in Nigeria? Who were you working for? Why is it that you engaged the use of hackers to hack the now President of Nigeria?”
Something that I know Carole Cadwalladr will be reporting on shortly is that some of these people who worked on this project also work in the British Government now. That causes me grave concern as to the relationship between this country and Nigeria. I have notified the authorities about this. Unfortunately, because the ICO—and also the police, in fairness—have such constraints on their resources, they have not been able to fully investigate it. I would strongly encourage you to ask Brittany Kaiser about that programme, because you have somebody who worked on Leave.EU and worked on this Nigeria project. You have AIQ who worked on this Nigeria project. This shows what these people and these companies are willing to do in order to win. They all played an absolutely pivotal role in Brexit; that is really important for people to understand.
Q1382 Christian Matheson: As far as you know, what is the work that Cambridge Analytica is currently undertaking on behalf of the UK Government, or one of the associated companies?
Christopher Wylie: I know the SCL Group, or SCL Defense, has done work for the Ministry of Defence and also, I believe, for DSTL, which is the defence research agency for the UK.
Christian Matheson: The UK version of DARPA.
Christopher Wylie: Yes. The work that they have done for the UK Government centred around research on mostly middle eastern countries, to understand attitudes and behaviours of groups that could pose a risk to British society.
Q1383 Christian Matheson: Has any data been collected on British citizens?
Christopher Wylie: The company has data on British citizens, but it is not necessarily that the Ministry of Defence is paying for data on UK citizens. Sorry, are you—
Q1384 Christian Matheson: In terms of the work that Cambridge Analytica/SCL group of companies are undertaking for the British Government, does that include data being collected on British citizens?
Christopher Wylie: Not from what I have seen, but I do know, for example, that in one of the documents that I have passed to the Committee there is a quote from somebody who, until very recently, ran the Prevent programme. That does not mean that they worked on Prevent, but I know that people who have worked on Prevent also have worked with SCL on projects. It is a question to perhaps ask the Home Office.
Q1385 Christian Matheson: Is any of this what we would consider sensitive data?
Christopher Wylie: By “sensitive data”, are you referring to the Government classification of “sensitive” or are you referring to the DPA’s definition of “sensitive”?
Christian Matheson: The DPA.
Christopher Wylie: Yes. It would all be sensitive data.
Christian Matheson: I have some more, but I will come back later, then. Thank you.
Q1386 Brendan O’Hara: Do you know, or are you aware of any involvement of Cambridge Analytica or SCL or any of the associated companies in the Scottish referendum of 2014?
Christopher Wylie: I know that Alexander pitched work in relation to the Scottish referendum, but I am very fuzzy on the details of which side that was for and what the actual pitch was. I was not immediately involved in that. I was there when the referendum was had; I do not recall the company—just to be clear—working on the Scottish referendum.
Q1387 Brendan O’Hara: Was there any work undertaken for either side by Cambridge Analytica or one of the SCL offshoots in 2014, do you know?
Christopher Wylie: I know that meetings took place, but I do not think anything came from that.
Q1388 Brendan O’Hara: Thank you. Can I just ask Mr Dehaye about Facebook? Could you give us a bit of background on your involvement with Facebook? I think you sought to try to get your personal data released. Why have you decided to approach Facebook for your personal data and, to describe it, the challenges and the process that you had to go through in order to get it?
Paul-Olivier Dehaye: The easiest way to explain it was the question of Simon Hart earlier. If you know your data has been obtained from one company and you are trying to trace where it might be used again, then it would be a very effective tool if you could go to Facebook and ask, “Who has my data? Who has told you they had my consent to be targeted on Facebook?” Facebook might help you; it might snitch on all this nexus of companies that are exchanging data around.
It turns out that the law gives you that right. You can go to Facebook and ask for right of access for all your information held by Facebook. That was my thinking at the time, and that is what I have tried to do. I approached Facebook, I asked them for all my data precisely, for instance custom audiences data and Facebook pixel data, which tracks which pages I have seen. It was a very long process indeed. I am simplifying, but I tried to go through a privacy shield, which is the agreement that governs transatlantic flows of data, because that data would have flown sometimes from Facebook Ireland to Facebook US. I also asked the Data Protection Commissioner in Ireland for assistance with all this. It is a very painful process that took over a year to get all the recourse mechanisms through and so on.
The situation now is that I have a response. Facebook partially agreed to some release of information, and the result was that the data export tool was changed for everyone on Facebook. Now you can download the list of advertisers that have uploaded your contact information, which of course could be advertisers coming from anywhere. I do not think that release is sufficient, because Facebook still holds that data, and I would like to be able to go back in time to trace— throughout 2017, I have worked with journalists in five to 10 countries where there were elections, there were lots of elections in 2017, telling them, “Register to this mailing list because your data, if you register in this way, is likely to be reused elsewhere and you might be able to use partial disclosures by Facebook to get more information.” For instance, to be concrete on the communication between insurance companies and Leave.EU, the line of questioning was often, “Did insurance data go to the Leave.EU campaign?” I know that the converse is true. When you get Leave.EU mailings, at the bottom there is an insurance ad for one of Arron Banks’ companies.
They are definitely using the dataset for other purposes. If you make it a method of inquiry, you can register to some specific mailing list and see how that information travels around. Journalists would love to use those techniques, but in practice it is really hard because no one seems to see the interest of it at this stage.
Q1389 Brendan O’Hara: What did you discover about yourself that they had?
Paul-Olivier Dehaye: Facebook discloses the list of advertisers over a span of eight weeks on a rolling basis. I personally had 200 advertisers that had declared to Facebook that they had my consent to advertise. One of them is Booz Allen Hamilton, which is an information company. I don’t know why they think they have my consent on this, where that information comes from. You could theoretically change those requests. You could go and ask Facebook. Facebook gives you a list of 200 companies and you could go to each of them and ask again, “Where did you get that consent? What other information do you have about me?”
Q1390 Brendan O’Hara: I tried to do what you suggested this morning and could not, so I may ask you to show us. You can only look back eight weeks at a time?
Paul-Olivier Dehaye: That is correct.
Q1391 Brendan O’Hara: For anything that happened three months ago, I could not find out who had my data?
Paul-Olivier Dehaye: Not directly through the tool, but Facebook has decided to implement that following my requests.
Q1392 Brendan O’Hara: Were you surprised with what you found out—both what they held on you and also their reluctance to share what they had—or did you expect them to be quite so immovable?
Paul-Olivier Dehaye: No, I was surprised that they implemented something because it is a regulation. I was right, this data should be made available to me, but in a way it opens up a gap. They implicitly acknowledge that, yes, they should disclose that information. You have to think that these databases are probably trawled through by a ton of intelligence services to now figure out what happened in all those different circumstances and also by Facebook itself to assess what happened. I would not have been able to do that organically by convincing journalists to investigate in this way years ago—literally years ago—when I started looking at this.
Q1393 Brendan O’Hara: What excuse did Facebook give you at the time that they did not have to tell you what data they held on you?
Paul-Olivier Dehaye: This is a long process. “At the time” means only at the beginning of this month, when things started to blow up. They are invoking exceptions in Irish law, in the data protection law, involving “disproportionate effort”. They are saying it is too much of an effort to give me access to this data. I find that quite intriguing, because they are making essentially a technical and business argument for why I should not be given access to this data. In the technical argument, they are, in a way, shooting themselves in the foot, because what they are saying is they are so big that there is no way they could provide me with this information; the cost would be too large. That is the way they argue it, and it is not just about their user base being so large; it is about—if you parse their argument—the number of communications that are exchanged. That is taken as a measure of the dominance of a communication medium. They are really arguing, “We are too big to comply with the data protection law, the cost would be too high for us.” It is mindboggling that they would not see the direction they are going there. Do they really want to make that argument?
Q1394 Brendan O’Hara: Essentially, what Facebook are saying is that they are too big to be managed and controlled by existing laws and, therefore, they almost should be exempt from them?
Paul-Olivier Dehaye: Yes. I am sure that if you dig there and you ask a Facebook executive, they would say, “But we would not be able to have the same business model if we had to enforce the data protection law.” I disagree, because they implemented the tool as a consequence of my requests. They made architecture choices in the way they built that tool. That is the first step. In answering my request, they built a straw man, saying, “What if everyone asked for their data? This would be impossible to manage for the whole history.” They build a straw man and they say, “The cost would be too high.” Notice that they do not say, “It will cost us this much.” If they were starting to put a cost on getting all the data out of Facebook—every tiny point of data—that would be very interesting to have, to compare with some other companies, other social networks.
If you think about how anti-trust laws work, that is the starting point for those laws. It is kind of mindboggling, but they do not see their argument and how it is going to hurt them at some point.
Christopher Wylie: The funny thing about that is that the argument is, “We are too big to be able to give you your data—but our entire business model is on exploiting your data to make money.” It is a bizarre argument to make, because they are able to use your data to target you for advertising purposes, and that is fine, but if you want it, they cannot give it to you because it is too complicated.
Paul-Olivier Dehaye: Yes, to be very precise on this, an advertiser can add my email address, my phone number, my Facebook ID—all those things—to what is called a custom audience. I think Sandy talked to you about all these tools.
My understanding is that I would remain in a custom audience built by an advertiser for a full year, but Facebook only feels an obligation to disclose this on an eight-week basis. I have built a whole document, a whole methodology for journalists to investigate those questions—I think it was in early 2017—knowing there would be 15 elections across Europe in 2017. I proactively approached a lot of journalists before the elections happened to offer these as a tool. They were enthusiastic, but at the same time they know that those access laws for personal data are very difficult to get enforced.
Q1395 Chair: Could I ask, Mr Dehaye—perhaps Chris Wylie has a view on this as well—we have talked a lot about Facebook data; it has been a central part of the discussion today and the inquiry as well as it goes forward. There has been speculation about the fact that Facebook—through the Facebook app on your smart phone—can listen in to what people are talking about, discussing, and use that to prioritise advertising as well. Other people have said they do not think that is possible; it is just that the Facebook system is so good at predicting what you are interested in and it can guess. Do you have a view on that at all?
Paul-Olivier Dehaye: I am not convinced it would be so hard to implement. I just have a general comment that Facebook is so opaque that people start guessing, or clutching at straws as to what explains all this targeting. It has been documented that Facebook is—I think I cited the evidence in my submission—purposefully hiding the targeting information that they would have to disclose by law. If you were targeted based on five criteria, they would take the two least bothersome ones and disclose that to you, but not the other criteria.
Christopher Wylie: My understanding is that that is probably a question for Facebook, but just a comment about using audio and processing audio, my understanding about how generally companies use it, not just Facebook—there are generally other apps for audio—is for environmental context. For example, if you have a television playing, versus if you are in a place with lots of people talking, versus something that sounds like a work environment, that adds— It’s not to say that they’re listening to what you are saying, so it is not natural language processing—that would be quite hard to scale—but it is to understand the environmental context of where you are to improve the contextual value of the advertising itself. It is probably a question for Facebook, but it is not to say all audio has to be somebody speaking. There is audio that could be useful for: are you in an office environment; are you outside; are you watching TV; what are you doing right now?
Paul-Olivier Dehaye: Along this line, there is a technique that has been documented that involves microphones in the phones and ultrasound on TV ads or TV content, so they can link what you have seen on TV with a mobile device. Some of this surveillance can be very unexpected and happen in very unexpected ways.
Q1396 Chair: The Facebook app on your smart phone can gather data from other things you use on the phone, not just your direct interaction with Facebook.
Paul-Olivier Dehaye: Sure, yes.
Christopher Wylie: Your phone lists, your contacts and all kinds of things.
Paul-Olivier Dehaye: Your call logs.
Christopher Wylie: Who you are calling, when you are calling.
Paul-Olivier Dehaye: But it depends on the operating system of the phone and the permissions. The same questions a lot of you had with Kogan and how data could flow about friends’ profiles to Kogan are tied to the way the permission system is structured and is architectured. On IOS it might be different from Android, more permissive in one than the other, and that would enable Facebook to collect more data on one operating system than on another.
Christopher Wylie: My recollection is Android is more permissive than IOS.
Q1397 Chair: Android is more permissive?
Christopher Wylie: Permissive in terms of what you are allowed to do with an app, in terms of the out of app collection.
Chair: I must say, given the extraordinary evidence we have heard so far today and the things we have heard in our other inquiry, it is absolutely astonishing that Mark Zuckerberg is not prepared to submit himself to questioning in front of a parliamentary or congressional hearing. These are questions of a fundamental importance and concern to Facebook users as well as to our inquiry. We would certainly urge him to think again if he has any care for people who use his company’s services.
Q1398 Julian Knight: Mr Dehaye, I have a technical question. I notice in your bio it says you enjoy working with journalists. I have to say not even journalists enjoy working with journalists, in my experience. What do you think would be the legal implications—and we touched on this with my colleague’s question before—of an EU company processing raw data on a population at an ISP level?
Paul-Olivier Dehaye: I think it would be in breach of data protection and privacy laws. From my end, the start of this whole thing is that when I read this article by Harry Davies in December 2015, I was very intrigued by the fact that Cambridge Analytica, the trade name for a British company, was doing all this in the UK and I saw an opportunity, in a way, to shed light on the whole thing. You have 200 million-plus Americans whose data has been processed openly by this company and they think that because they have this shell company, Cambridge Analytica, established in Delaware, UK data protection law does not apply. That is not the way it works.
Helping David Carroll, who you heard testify, is a way to shed more light on this, but the same could be done from Kenya, from all those different companies. Data protection is seen as a fundamental right in Europe, it is in the Charter of Fundamental Rights, and so it applies, as Elizabeth Denham explained here to this Committee, regardless of nationality or residence as long as your data is processed in Europe.
Q1399 Julian Knight: The likes of Facebook, for example, could not even start up in the EU effectively.
Paul-Olivier Dehaye: It could but it would have to be much slower and more careful in how it implements—
Q1400 Julian Knight: And more transparent presumably.
Paul-Olivier Dehaye: Yes, more transparent and all those things. If it is a global playing field with companies that play fast and loose with regulations, that is definitely a disadvantage for European companies to try to respect European laws.
Christopher Wylie: The way I think about it is that data is like the electricity of our new economy and electricity can be quite dangerous if proper safety protocols are not put into place, but at the same time we all enjoy the benefits of electricity despite the fact that it could literally kill you. We enjoy it because there are proper safety protocols put in place, architectural requirements, engineering requirements and all kinds of specifications on how the electrical grid is set up, what kind of wiring you can have in your house and so on. I look at data in the same way. If we started to look at it like electricity or like a utility of some kind, we could regulate safety standards for data architecture and engineering in the same way that we do for electricity or road standards, automotive standards—we do this in every other industry. It does not inhibit development—we still have new cars, we have better planes, we have all kinds of things—it just means that development has to happen in the context of safety. That is how I think about it.
Paul-Olivier Dehaye: There is a big difference, though. If I stick my fingers in the plug I will die and everyone will see it. If some accident happens I will die and everyone will know and there will be a lawsuit and so on. The harm will be directly assessed very quickly and standards changed and so on. With data it is different. It is really hard to evaluate the harm. Even now, in the US, Obama did not know the harm that would be done by hacking into a database; that is the nature of information warfare. It becomes very hard to evaluate the harm relating to data. Even if you go at a much lower level, an individual level, what is the effect of a small data breach affecting me, what is the harm done to me? It is very hard to prove or very hard to evaluate. As a consequence, the public understanding of data issues—the public understanding of the harm—will be tremendously delayed compared to the actual source of the harm.
Q1401 Julian Knight: In effect what you are saying is that a lot of these big technology companies think that the law should bend to them rather than they bending to the law, so to speak? That seems to be the mindset that their answer to everything is, “That will mean a change to our business model”.
Paul-Olivier Dehaye: Yes, they are effectively bending the law. With Facebook and my efforts, it is basically: I am making those efforts to show quickly the harm that relates to data harvesting, let us say, in different circumstances. I know that this will have an impact further down the road. They are effectively already bending the existing laws in refusing to answer some of my requests. Certainly I am pushing buttons that are really annoying to Facebook and other companies, and there is a reason why they are fighting me back.
Q1402 Julian Knight: Mr Wylie, I just want to turn to a couple of points that you have made in your evidence. Something that intrigued me before—you mentioned this almost as an aside—is that you had seen one invoice or more than one invoice with the word UKIP on it, is that right?
Christopher Wylie: Yes, I do not have it but I have been shown it.
Q1403 Julian Knight: You do not have? How did you come into contact with this and when did you come into contact with it? What are the circumstances?
Christopher Wylie: Someone came and showed it to me. I can follow up and I can introduce you to the person who has it.
Q1404 Julian Knight: This is not while you were at work effectively, this is since, is that right?
Christopher Wylie: This is since. There are lots of people who came to me or to see Carole Cadwalladr both before the stories came out and then after the stories came out with more information in relation to the company. So I am happy to—
Q1405 Julian Knight: A UKIP named invoice from Cambridge Analytica is what you are saying?
Christopher Wylie: Yes. To me that makes sense given how there were UKIP members involved from the very beginning of the company, that they would go on and work for UKIP.
Q1406 Julian Knight: It is interesting because UKIP, quite famously, as colleagues will know, have absolutely no money whatsoever, so I just wonder what they were doing to pay for this particular work.
Christopher Wylie: You have to remember that part of the brilliance of Cambridge Analytica is that it does not need to make money because it is Robert Mercer’s project. Robert Mercer is a billionaire, he does not need to make money. Further, if you as an investor of a company put money as a shareholder into that company, that is not classed as a political donation. That is an investment in a company that you are the owner of: I am improving R&D, I am expanding our teams. You can do that more pointedly and continue to invest purposely into your company so that it can also work for particular entities at a subsidised rate or indeed, in some cases, for free.
One of the things I would also point out is that just because there is a bill with a particular number on it, it does not mean that is the genuine body of the work that was produced. Part of the brilliance that Robert Mercer created was that it becomes very easy to get around campaign finance laws in terms of declarations because it is an investment. He is a shareholder, he can invest.
Q1407 Julian Knight: What you are alleging there, though, is fraud. If an invoice is not—
Christopher Wylie: I do not know if I should use the word fraud or not, what I am saying—
Q1408 Julian Knight: That is what the allegation is; basically you are saying UKIP is receiving work from Cambridge Analytica and we are being falsely invoiced for it.
Christopher Wylie: Let me just back up there for a second. I am talking about generally how the company operates, particularly at the time. I did not work for UKIP, let me be super clear on that. I did not work for UKIP.
I was there at the creation of the company, so I worked with the lawyers, Robert Mercer’s lawyers, on the actual setting up of the company. I have sent you the incorporation documents and all of the company details of it. One of the things that emerged about that set up, which was beneficial to Robert Mercer, is that the more money he puts into that company, the less money he has to declare in campaigns. If you have $10 million, you can give it to a bunch of PACs, and you then declare that. If you just put $10 million into a company that then services those clients, you can charge a reduced rate and you do not have to declare what money is going where. Do you see what I am saying?
It is very opaque because he is an investor. It is like what happened with Leave.EU. There was no billing that happened with Leave.EU and so something to ask is if you did work as Brittany Kaiser has admitted to, and as the company for an entire year bragged about, there were some kind of incurred costs. You cannot do work as a company and not incur costs, not incur staff time, not incur data costs, not incur what have you. So where did that money come from?
Paul-Olivier Dehaye: On top of everything you have said, there is also the idea that there are other donors—not just Mercer and others—that give money to pay for ads that end up collecting data. Some of it at least flows back to Cambridge Analytica and all this database they are building. The data protection laws are more lax, at least in some countries—if they were to respect them—in a political context. You can do more profiling in a political context. That is a way to get around some data protection laws sometimes. This data then becomes an asset that can be commercialised outside of the political context.
Christopher Wylie: That is an incredibly good point and it is an important point. There are lots of countries that give exemptions to certain data protection restrictions or privacy restrictions if what you are doing is for political speech or political campaigning. There is a rationale for that, which is that if you have to seek out consent to communicate as a political campaign, that might eventually interfere in some way with political discourse and being able to campaign and get your idea out. If you work in politics in countries that have much looser profiling restrictions and data protection restrictions because you are doing a campaign, you build algorithms that are then repurposable in the commercial sector where those algorithms now exist. Those profiles now exist. You are able to capitalise and benefit from the more lax laws and then exploit it commercially. It is a very salient point.
Paul-Olivier Dehaye: Even more complexly the electoral register in this country is only accessible for political campaigns. Politicians would get this electoral register, pass it on to Cambridge Analytica or other entities like it. That dataset would be used to align different profiles from different sources and this would even be legal because of the data protection law being more lax for electoral purposes. Then the value of this alignment itself, which is part of what is difficult, would remain an asset of Cambridge Analytica, but they are free to commercialise it in other countries.
Just for the record, I think this is what happened partly in France during the presidential election.
Q1409 Julian Knight: Are you suggesting basically this—
Paul-Olivier Dehaye: Not Cambridge Analytica but this workflow that I am describing happened in France in the presidential election.
Q1410 Julian Knight: Just to drill down, what you outlined right at the start effectively is extremely serious, an extremely serious allegation. That is that effectively, let’s say, Cambridge Analytica were carrying out £50,000-worth of work and were only invoicing £5,000. What evidence do you have to support that allegation, that there was systematic false invoicing at Cambridge Analytica? Is there any evidence?
Christopher Wylie: In terms of documentation, no. I do not have documentation from Robert Mercer saying, “I am going to set up this scheme”. It was from my discussions with the lawyers and from my observations when we were setting up Cambridge Analytica itself. One of the points that emerged from that is that he was putting in $10 million to $15 million to create an asset that then we were licensing for $50,000 in some cases.
My point about the subsidy is that he can put in $15 million to create something and then only charge $50,000 for it. It would have been physically impossible to get the same value and level of service and data for that amount of money in any other way.
Q1411 Julian Knight: You would have to build it yourself effectively.
Christopher Wylie: What I am saying is that in creating CA and continuously putting in investment he is subsidising the work of CA to the benefit of parties and candidates that he supports because they do not pay for the full value of what they receive, if you see what I am saying. He does not have to declare the full value of things because he is putting in money as an investor.
Q1412 Julian Knight: You mentioned an invoice and you said that someone had come to you after you had left CA and was showing you an invoice with UKIP mentioned—
Christopher Wylie: I can introduce you to the person that showed it to me. I do not have it, I know the person who has it.
Q1413 Julian Knight: I know what you are saying. Thank you.
You said earlier in your evidence that you became incredibly remorseful about your role in this particular industry. Was this before or after you offered your data harvesting techniques to Vote Leave in January 2016?
Christopher Wylie: In terms of what I offered, I did not offer anything that was illegal.
Julian Knight: No, I know.
Christopher Wylie: Let me be clear, I do not have a fundamental problem with using data for targeting. I have spent a lot of time working on it and there are ways that you can use data in a way that respects the consent of people, that is transparent so that people are aware that you are sending them a political message or a commercial message, and why it is that they are being sent it. You can do targeting in an ethical way. To your point, at that time Trump had not been elected and I had not seen the full scale of what CA was to become because that conversation happened at the end of 2015, or I think the document you were referring to was given at the beginning of 2016, but that was unrelated to Cambridge Analytica.
Q1414 Julian Knight: Your pitch to Vote Leave?
Christopher Wylie: Yes.
Q1415 Julian Knight: When you say it was unrelated, it was your own company that approached Vote Leave and said, “I want to help you”. It was your own company not CA. For example, did your company ever have access to the Facebook data that Cambridge Analytica and SCL is alleged to have acquired? Did you ever have that evidence?
Christopher Wylie: Yes, I did have access to it but I deleted it.
Q1416 Julian Knight: You deleted it?
Christopher Wylie: Yes, I deleted it.
Q1417 Julian Knight: When was that deleted? Was that January 2016?
Christopher Wylie: No, I deleted it before, in 2015, early on in 2015. I didn’t have that data in 2016 and the specific dataset that you are referring to was on predominantly US citizens.
Q1418 Julian Knight: Yes, 30 million to 80 million adults, I believe.
Christopher Wylie: Sorry, say that again.
Julian Knight: The data contained approximately 30 million to 80 million or more unique records with information or online sources about named individuals and the data includes forename, surname, date of birth, gender, location, online sources, system-generated unique ID numbers, all social network information and all interest categories. Effectively, was this the information you were going to Vote Leave with in January 2016?
Christopher Wylie: No, because I did not have any UK data. I could not physically offer it. If you look at the proposal, it is a pilot project to see if they could even collect data. To be super clear, what was sent to Dom was a proposal to see if they could do a pilot programme where they could—the thing I said to him was, “I don’t know if you can recreate”, and I was very sceptical that they could recreate some kind of equivalent of Cambridge Analytica in the amount of time that they had, just practically.
For argument’s sake, so that I am just being super clear, and this was not proposed to Dom Cummings, even if you used the Kogan app, even if it still existed and even if I had access to it, to collect those 50 million records—we started using the app at the end of May and that full collection did not complete until September. If you were doing that during the period of the referendum, let’s say for argument’s sake that you were to use it—
Q1419 Julian Knight: But, Mr Wylie, you proposed this before the referendum had been called. You proposed it in January and in fact Dominic Cummings’s response to you was, “Let’s talk again if it is going to be 2017”. I put to you that you were basically saying to the Vote Leave campaign, “I can do what has been going on in the United States with all this collection of data in the UK. Let’s have a conversation about it”. Is that a fair estimation of what went on?
Christopher Wylie: Yes, that is fair. I have not obscured the fact that I met Dom Cummings. This is also in part why I know what Dom Cummings wanted to do. Data was really important for Dom. But I did not end up working on Vote Leave. I was not even in the country when the referendum happened and the proposal that was sent, if you look at it, is a pilot proposal that talks about collecting I can’t even remember how many records but it would not have amounted to anything near even a million records. I said to him, “We can try doing some data collection”, but again I was sceptical, given the time constraints that they had or likely would have. I know that the referendum had not been called but everyone suspected that it would be some time in the spring and that did not strike me as a feasible timeline, given that they did not even have the electoral register. Nothing came of that.
Q1420 Julian Knight: Why were you trying to pitch if that was going to happen?
Christopher Wylie: He asked me to and I did it. I go and have a meeting. I knew Stephen and I have a meeting with Dom and they ask, “Can you send me your thoughts on what could be feasible?” and that is what I sent. Nothing came of it.
Q1421 Julian Knight: They rejected it. Dominic Cummings described you as a charlatan and that is very unfair. Clearly you are an incredibly knowledgeable man with huge experience and real insight into the industry. But is not a better description possibly a failed Alexander Nix, based on what you have tried to do, set up on your own and then it has not worked out? You pitched to Vote Leave and they said no to you and now you are here in front of the Committee.
Christopher Wylie: I do not take that personally. I did all kinds of other projects. I do not consider myself a failure and in fact, not to toot my own horn, I am here on a tier 1 exceptional talent visa that the British Government give to only 250 people a year, so I do not think I am a failure and I was not so—
Q1422 Julian Knight: Mr Wylie, you tried to set yourself up in business effectively as a type of Cambridge Analytica hawking your wares to Vote Leave. They said no to you and here you are in front of the Committee making many suggestions about Brexit and the vote on Brexit. I think it is a very legitimate question to wonder about your particular motivation.
Christopher Wylie: I was not so devastated by it. You have lots of meetings and it does not work out. Sorry, Dom, but I was not so devastated that I could not work with you that I have spent a year and a half on a vendetta to get back at you for a pilot project that did not work out. I did it as a favour. I gave him a write-up. Most of that was just stuff I already had prewritten. I sent it to him. He was not interested. I was back in Canada and I was already working on a different project, so I do not know if I could have done the project even if he had said yes. I do not know what else to tell you, but I do not think I am a failure and Dom rejecting me over a small pilot programme has not devastated me in any way.
Q1423 Ian C. Lucas: Just recently you said you had deleted some data. Where did you get that data from?
Christopher Wylie: Sorry?
Ian C. Lucas: You said in an answer a couple of minutes ago that you deleted the data that you had.
Christopher Wylie: Yes, because I had access to the data that was collected during the Ripon project.
Q1424 Ian C. Lucas: Was that the data that Cambridge Analytica had?
Christopher Wylie: I had access to the same data.
Q1425 Ian C. Lucas: This is the Facebook data essentially, so you had it and you deleted it.
Christopher Wylie: Yes.
Q1426 Ian C. Lucas: When did you delete it?
Christopher Wylie: Some time in 2015. I do not remember the specific—
Q1427 Ian C. Lucas: Why did you delete it?
Christopher Wylie: Because I was not going to do anything with it. Kogan sent me a message saying they did not want me to use it and I said, “Okay” and that was that.
Q1428 Ian C. Lucas: But that was incredibly valuable data.
Christopher Wylie: Yes, but at the time I was not even working on American projects.
Q1429 Ian C. Lucas: Just so I am clear, is this the same data that Cambridge Analytica had that Facebook now say that they wanted them to delete?
Christopher Wylie: Yes.
Q1430 Ian C. Lucas: It is the same data and you deleted it. Did Facebook ask you to delete it?
Christopher Wylie: They asked a year later, in 2016, to confirm that I did, so then I sent a confirmation that I had deleted it.
Q1431 Ian C. Lucas: Did Facebook contact you again about it or did they just accept your word for it?
Christopher Wylie: They accepted that and I followed up to make sure that they were satisfied with that. They were. They only started doing anything about it when they found out that The Guardian and The New York Times were going to be publishing on the scheme.
Q1432 Ian C. Lucas: Did they contact you again at that stage?
Christopher Wylie: Yes.
Q1433 Ian C. Lucas: Was that when they were getting heavy with you, as you said earlier on?
Christopher Wylie: Yes. They only started getting heavy with me, to use your words, when they found out that I had gone to The Guardian and The New York Times and the Information Commissioner’s Office about the scheme.
Q1434 Ian C. Lucas: When Facebook gave evidence to us, I think on 8 February—in the United States actually—they were aware at that time that you had, along with Cambridge Analytica, their data in 2015-16. They were aware of that.
Christopher Wylie: Sorry, can you repeat the question?
Ian C. Lucas: Just to be absolutely clear, they gave evidence to us on 8 February.
Christopher Wylie: We are talking this year?
Ian C. Lucas: This year, 8 February 2018. At that time they were aware that their data had gone to Cambridge Analytica and had gone to you. You had deleted yours.
Christopher Wylie: Lots of people had access to it. I am the only one who has owned up to it.
Q1435 Ian C. Lucas: The reason why I think this is important is because recently I saw an interview that Mark Zuckerberg gave to the BBC in 2009 and he said that the data I give as a Facebook user to Facebook is personal to me and unless I consent it would not be given to a third party. That is a fundamental rule of Facebook, isn’t it? That is what Mark Zuckerberg said.
Christopher Wylie: There are a lot of mental gymnastics that you have to go through in order to—
Q1436 Ian C. Lucas: That is what he said. I can show you the interview. If he says that he will only share it with a third party with consent, we come to what Mr Dehaye said.
Christopher Wylie: Yes, but their interpretation of consent is that you consented to be on the platform.
Q1437 Ian C. Lucas: It is not just about Facebook rules. It is also about the law, because the law in the UK says that you cannot share data with a third party without consent of the person involved.
Paul-Olivier Dehaye: To be more precise, they would argue that their privacy settings, those on the source and the friends, make this transfer clear. Pre-emptively as a friend of a potential source you have agreed for those people to share data with these parties on your behalf. You have delegated the consent mechanism. You have consented to delegating the consent mechanism to a friend, essentially, and that is their legal fiction of consent.
Q1438 Ian C. Lucas: But, Mr Dehaye, they are the only people who know who they delegated that consent to because Facebook have the records. No one else has them. They will not give them to you, for example.
Paul-Olivier Dehaye: Mr Zuckerberg checked in their databases that they did have the information to notify individually people whose data had been leaked through that scheme. I am not sure they are the only ones to have that information. This dataset has flowed around, has been used in different places. Others might be able to say—
Q1439 Ian C. Lucas: My point is that you cannot get that information at the moment because they say it is too much trouble, basically.
Paul-Olivier Dehaye: Yes. I was asking something slightly different but I am sure that if I had asked Facebook a year ago whether I was a friend of someone who decided to give my data to Cambridge Analytica, it would have been a really hard process to get that information out of them. I am basing this on the fact that I have made many such requests over time and that it is a really painful process.
Q1440 Ian C. Lucas: What I cannot understand in any of this is why it was that two years ago, when Facebook discovered there had been this catastrophic breach in the sharing of Facebook information with third parties, they did not act decisively the way that they did last Monday night when they sent one of their lawyers round.
Christopher Wylie: A week before publication they threatened to sue The Guardian over the use of the word “breach” and then they tried to spike the story for The Guardian and The New York Times by creating this press release and giving it to some other newspapers to try to get ahead of the story. They threatened The Guardian with a lawsuit over revealing it.
Paul-Olivier Dehaye: Unless Harry Davies was sitting on the information he had and not acting as a reporter asking for comments from Facebook, he would have had to sit on this for six months. Even then it would already have been three years that Facebook knew about this. I would locate it at the beginning of 2015, not December when his article came out. That is a long time.
Q1441 Ian C. Lucas: Talking of spiking stories, Mark Zuckerberg, according to the press today, appears to be saying he is not coming to this Committee, even though he did not say so in the letter that has been sent to the Committee today. He wants to send a junior. Do you think it would be right for Mark Zuckerberg to come here to explain why there are these deficiencies at Facebook?
Christopher Wylie: Is that a question for me?
Ian C. Lucas: For both of you.
Christopher Wylie: I am owning up to it.
Q1442 Ian C. Lucas: So it is about time Mark Zuckerberg owned up.
Christopher Wylie: I went to the authorities well before this was reported in the press. I have made my involvement known and taken my share of responsibility personally for the projects and tried to make amends in whatever ways that I can, working with the authorities or indeed working with The New York Times, The Guardian, The Observer and Channel 4 to make people aware of it. I have spent the better part of a year, almost a year, trying to work on this. Given the public reaction to the story, and looking at it from their share value, having a meeting is the least that you can do.
Paul-Olivier Dehaye: I will draw a parallel. At an individual level in data protection law there is the right of access that allows an individual to basically make sure that their information is treated fairly. That is the basic mechanism we have at an individual level. I think this whole story shows that there is a collective interest in protecting data, assessing how it is used and all those things. You would present the enforcement mechanism—it is not quite the enforcement—or the proactive mechanism here to make sure that that collective interest is defended. It would make sense to address direct questions to Mark Zuckerberg in whatever way is appropriate and to get direct answers from him as a representative of his company.
Q1443 Christian Matheson: We are running late so I will just do a few quick fire ones, given you have both been giving evidence for quite a while now. Did any data ever get leaked from Uber?
Christopher Wylie: Not to my knowledge.
Paul-Olivier Dehaye: There was a big data breach.
Christopher Wylie: Sorry, are you asking in reference to Cambridge Analytica or in general?
Q1444 Christian Matheson: Yes, there was a data breach but did Cambridge Analytica ever use the—
Christopher Wylie: Sorry, I was answering in relation to Cambridge Analytica. To my knowledge Cambridge Analytica has not used Uber data.
Paul-Olivier Dehaye: There was a leak of, I think, 57 million people’s data from Uber. You do understand that once that leak happens, for a while the data remains in a very small circle but progressively it expands and becomes commercialised, so basically any kind of advocate could get a hand on this data after a while.
Q1445 Christian Matheson: Can I go back to the questions that Ms Stevens was asking about your operations in the Czech Republic, Mr Wylie? Can you recall which candidate or party they were supporting?
Christopher Wylie: I did not work in the Czech Republic.
Q1446 Christian Matheson: Did you pick up or glean anything about who they might be supporting?
Christopher Wylie: You will have to ask Cambridge Analytica that, I am sorry.
Q1447 Christian Matheson: Did Cambridge Analytica or any of its associated companies ever use the targeting tactics that you have outlined today to spread Russian disinformation?
Christopher Wylie: I have not personally witnessed the actual deployment of Russian propaganda.
Q1448 Christian Matheson: Did you hear it discussed?
Christopher Wylie: What I have witnessed is the company very eagerly pitching its services to companies that have close connections to the Russian FSB.
Q1449 Christian Matheson: Such as Lukoil?
Christopher Wylie: Such as Lukoil.
Q1450 Christian Matheson: In the Lukoil instance, I do not think that went anywhere, did it?
Christopher Wylie: No, but you do not necessarily—I will not speculate so—
Q1451 Christian Matheson: Were there any other Russian contacts where the impacts went a little bit further?
Christopher Wylie: Not to my knowledge.
Q1452 Christian Matheson: Were Cambridge Analytica or SCL or any of the associated companies in contact with Russia during the United States presidential election?
Christopher Wylie: You will have to ask the company that because I stopped working there before the Trump campaign itself.
Q1453 Christian Matheson: Is it the case that on the Channel 4 programme Alexander Nix said that Cambridge Analytica replied on an encrypted email system that deleted messages two hours after they were read? That is correct, is it?
Christopher Wylie: Yes, Proton mail is common; it is not just unique to them. Lots of people use it but there is a lot of communications, technologies, that you can use to delete or obfuscate your contacts. A point about that is that a lot of people who care about privacy may use Proton mail or Signal—I use Signal, for example—that automatically deletes stuff after a certain amount of time.
Yes, the company has used various technologies that delete communications and what not, but just to point out more broadly, those technologies are not necessarily nefarious; often they are privacy-centric technologies also. You can use it to obfuscate what you are doing, but you can also use it for privacy reasons.
Q1454 Christian Matheson: Are you familiar with the phone app that was provided by uCampaign to Vote Leave, which I understand was also used by the Trump and Cruz campaign, which scrapes data from the user’s phone?
Christopher Wylie: Yes, I have heard about it. I know the app that you are referring to. I did not directly use or work on that particular app but I was introduced to somebody just the other day who said that they had more information on it, so I could pass on a contact if you would like to know.
Q1455 Christian Matheson: If you could pass it on to the Clerks, they may find it useful.
I understand that at the time of the referendum it would have had access to Facebook contacts. Is this the kind of data that you would have been working with through AIQ and Cambridge Analytica?
Christopher Wylie: Yes, Facebook data was absolutely a core part of what we operated on. If it pulls Facebook data, then quite possibly, yes. But if I could just comment that, I haven’t worked intimately with that app, so other people probably know more about the workings of it than I do.
Paul-Olivier Dehaye: As people investigate this, you have to understand that there are layers of data collection, data processing, and so on. There is a theoretical possibility that Cambridge Analytica uses existing tools or existing sources to source all this data, but that is not what is happening. When you go back, you realise that it is players that are intimately linked to them that are building the tools precisely to collect this data. In my mind it opens the possibility that Mercer or others are also behind the data collection tool. This data that was already collected earlier might go in different directions later. It is a difficult job tracing this data over time.
Q1456 Christian Matheson: I am just reading on The Guardian website that Dominic Cummings has posted an update to his blog, in which I think he is talking about you, Mr Wylie—apologies to you and him if he is not—where he says, “The Observer will look really silly for making a hero out of a fantasist charlatan”. I do not know whether you want to comment on that.
Christopher Wylie: Could I just put out that I have worked with the Information Commissioner’s Office to provide detailed information and documents, and I have worked with The Guardian and The Observer, The New York Times and Channel 4. There has been so much fact checking in what I am saying. He might call me a charlatan or a fantasist, but if he is doing that, he is also calling The Guardian, The Observer, Channel 4, The New York Times and the Information Commissioner’s Office fantasists.
Q1457 Chair: Do you think Dominic Cummings had any idea what sort of people he was getting involved with?
Christopher Wylie: All I can say from my conversations with him is that he was very familiar with Cambridge Analytica, he was very familiar with Robert Mercer; he even knew about Renaissance Technologies. I know that he was following and aware of these companies, but that is probably a question better placed to him.
Q1458 Paul Farrelly: I want to check whether I had misheard. When you were referring shorthand to SCL, Strategic Communication Laboratories, that is plain and simple, but I thought I heard when you were referring Cambridge Analytical in shorthand it was not just CA, but it was CIA. Is that what they call themselves inside?
Christopher Wylie: If I said that, I apologise; that was a slip of the tongue.
Q1459 Paul Farrelly: So it is CA?
Christopher Wylie: CA.
Paul Farrelly: Not CIA.
Christopher Wylie: Not CIA, no.
Paul Farrelly: I don’t want to take the Walter Mitty bit too far.
Christopher Wylie: Yes, so if I said that, I apologise; that was a slip of the tongue.
Q1460 Chair: Finally, I want to ask about the UK Data Protection Bill that is currently going through Parliament. The Committee has received evidence from the Information Commissioner herself that her powers should be tightened, so she has the ability to go straight into organisations where they have not complied with the data notice and their data needs to be served up, so that we avoid the problem we had last week where it takes days to get a warrant for the Information Commissioner to go in. Do you think, given the knowledge you both have of these issues, we do need to give the data monitors, the ICO, the power to go into companies that hold data to see what they are doing? Otherwise how can we possibly know that they are complying with the data protection laws?
Paul-Olivier Dehaye: I think the first place where there should be action is on the right of access and enforcement, and facilitate that increased budget and all those things. I sent a letter to the Information Commissioner in August 2016—so, a long time ago—asking them if they were investigating Cambridge Analytica, because of all the public information that was already there. It is my strongly held belief that if the right of access was made much more efficient, because of increased staffing at the ICO and so on, this right would be adopted by a lot more people—by educators, journalists, activists, academics—as a tool to connect civil society with the commercial world and to help document what is happening. It would be much more effective. That would be my first point of action.
Christopher Wylie: There needs to be a wider discussion just in general about what is data protection and how do we—I do not think there is an either/or in terms of total restrictions on data and a free for all of data. There is potentially a discussion to be had about understanding what we mean by data protection. From my own experience, having worked with the ICO over the past couple of months, one of the things is resources; they do not have that many people. In addition, not only do they not have a lot of people, they do not have a lot of technical people.
This is not a criticism of the ICO in what I am going to explain, because there are very understandable reasons why this happened, but I have had to explain and re-explain and re-explain how relational databases work. What is an eigenvector? What is a PCA? What is dimensionality reduction? These are things that are technical, so for a lay person it is totally understandable that they do not know about any of it, but a lot of the investigators do not have a robust technical background. If I were to make a recommendation, I think that having more technical people being part of, and in hand with, the enforcement of the law would be really helpful. That is likely a resource issue. They have put a ton of time and resources into this investigation, so to their credit they have been trying really hard with the limited resources and limited powers that they have.
Just as a point of observation, one of the weak points that I have seen in the ICO—again, this is an empathetic criticism, if I can call it that—is the lack of technical people; the fact that they have had to ask me a lot of questions that a database engineer would not ask. That was even right before going in to search an office, asking questions, fairly basic questions, about databases; even just asking, “What are the file names called?” It is more complicated than that. It is not like a sheet with the data on; it is not in the Facebook data file. Again, they have been trying really hard, and I think that they have been doing a decent job of investigating, but the thing that I have noticed is that they are in charge of regulating data, which means that they should have a lot of people who understand how databases work.
Q1461 Chair: Thank you, I think that concludes the questions from members of the Committee. We have covered a huge amount of ground in the best part of four hours of evidence. That is going to be a record for a single-panel evidence session. Are there any closing remarks you have for the Committee, or do you feel you have said all you needed to say?
Paul-Olivier Dehaye: I have one. The whole discussion so far around the effectiveness of Cambridge Analytica’s techniques and everything has really focused on the individual level. When you look at psychographics, the Kogan technique and so on, it is at the individual level: can you convince someone to change candidate based on their psychological profile? But when you hear all the techniques that Nix talks about, all of those things, it is much more about spreading a rumour, it is much more about a collective effect, which is probably easier to generate—you know, the impulse to share information with each other on a network. No one is in a position to investigate this except Facebook. No one is in a position to investigate how Cambridge Analytica might have sought to influence Facebook itself or the spread of information on Facebook itself rather than to influence individuals. I would encourage Facebook itself to look at this question—they seem to have a blind spot on that—but also of course the Committee and all the investigators to look at that.
Chair: Thank you.
Christopher Wylie: He said it perfectly. I do not have anything to add.
Chair: Thank you very much. In that case, I will bring the session to a close. The Committee just require the room for a short period of time for a short private meeting with Mr Wylie. Thank you very much for attending.