INTRODUCTORY BACKGROUND TO THE COMPANIES
Mr Wylie was the Director of Research for SCL and Cambridge Analytica from 2013 to the end of 2014. SCL Group is a UK-based military contractor that specialises in Information Operations (“IO”). SCL’s clients have included the UK Ministry of Defence, US Department of Defense and various NATO militaries. Information Operations is the area of military strategy that deploys, manipulates or weaponises information to support operational objectives. Within IO, there are related fields such as Psychological Operations and Cyber Operations.
It is important to highlight that as IO is a military strategy, which is often deployed in combat situations where the Data Protection Act would not apply, many IO approaches are not generally congruent with the Data Protection Principles. This is because there are two key objectives of IO. The first is the notion of “informational dominance”, which focuses on capturing, interfering or manipulating as many channels of information surrounding the target as possible. This is typically done, by necessity, without the knowledge of the target. The second is using information collected about the target to identify and then exploit mental vulnerabilities to provoke certain behaviours in the target that would be conducive to operational objectives.
Cambridge Analytica (“CA”) was created by SCL Group with funding from Robert Mercer, an American billionaire based in New York. Robert Mercer installed the alt-right political activist Stephen Bannon as CA’s Vice President with responsibilities to manage the company day-to-day. Mr Mercer wanted to use the IO tactics SCL had used on military projects for his political aims in the United States, and elsewhere, including the United Kingdom. CA’s focus was to adapt these strategies for politics, as well as research ways to modernise and deploy IO approaches in online social networks. CA does not have any staff, only an intellectual property licence and data assets. SCL licenced all its IP to CA and in return CA signed an exclusive service provision agreement whereby all CA clients would be handed to SCL staff to work on. Although there are technical legal distinctions between CA and SCL, this is largely to get around various electoral compliance and foreign agent restrictions in the USA. It should be noted that in practice CA and SCL operate day-to-day as the same company. The two companies share the same offices and many of the same directors.
Aggregate IQ (“AIQ”) is a Canadian company that was set up to service SCL and later CA projects and build database, CRM and online advertising technologies for SCL/CA. Prior to SCL, AIQ had no other clients. The reason AIQ was set up originally was because several key people, who later became the principle officers of AIQ, were not mobile to move to London for family reasons. The compromise was to establish a company in Canada and IP agreements would be reached so that SCL/CA would own the products of their work. To the best of Mr Wylie’s knowledge, AIQ had no independent clients outside of SCL/CA from 2013 to 2016. The IP licence and contracts between AIQ and CA/SCL are in the possession of the committee. AIQ was listed as “SCL Canada” on the SCL website and internal staff lists in the possession of the committee also lists Zack Massingham, the CEO of AIQ, as “Head of SCL Canada”. These staff lists also show that AIQ was responsible for hiring and managing a division of SCL/CA’s software engineers.
“Cambridge Analytica has not processed Facebook data.”
This has been the historic line used by Cambridge Analytica [“CA”]. Alexander Nix said to both the UK Parliament and US Congress that the firm did not possess or use Facebook data.
In 2014, the firm hired Global Science Research [“GSR”] Dr Kogan’s consulting company, to use an application to harvest millions of Facebook records for use in psychological profiling. This is evidenced by the GSR contract published by the DCMS Select Committee at the UK Parliament. The contract includes very specific language that the origin of the data would be from Facebook and that friend data would also be harvested in that process. In fact, harvesting friend data was presented as the core unique selling point for this approach. The CEO of CA Alexander Nix signed that contract. Extensive email correspondence given to the committee also shows the use of Facebook data, some of which has also been published.
There is also video recording of CA staff discussing modelling Facebook like data from November 2015 (https://youtu.be/IhvX9QCiZP0). The staff member describes the same process for modelling Facebook data as the original GSR project.
This is merely a semantic distinction. Derivatives simply mean that the origin source data has been processed or transformed in some way, but the underlying information is still preserved. Facebook terms and conditions are inclusive of derivatives in its definition of Facebook data. Global Science Research provided Cambridge Analytica with processed Facebook derivatives that were in a format that could be easily ingested into its modelling operation.
A simple way to think about derivatives is when you translate a French text into English. In that case, English would be a derivative, as the “data format” is now different, but the underlying information is preserved.
It is true that Cambridge Analytica exploited vulnerabilities in how Facebook was set up at the time. This does not mean, however, that this was permitted or compliant with the Data Protection Act.
The Obama campaign did not use a foreign military contractor to develop psychological profiling algorithms using misappropriated Facebook data on upwards of 87 million unsuspecting data subjects.
GSR did have a term in the app terms and conditions that said it may sell or transfer the data. However, no terms and conditions can override the law. This means that while the primary app user may have technically consented to their data being used, the law does not give a friend permission to consent on behalf of another person.
Yes, but this does not mean that it actually did. As data controllers, both Cambridge Analytica and GSR had a substantive duty to ensure that data it was acquiring was done so with consent and in compliance with the DPA.
Cambridge Analytica is the Data Controller, not Mr Wylie. Mr Wylie did not authorise and sign the GSR contract, the firm’s CEO Alexander Nix did. Mr Wylie did not fund, scale or expand the project, Cambridge Analytica did. Mr Wylie did not carry out the Facebook data harvesting, GSR and Dr Kogan did. When Mr Wylie left CA, the firm still continued with the GSR project.
However, Mr Wylie has been fully open and transparent about his role in setting up Cambridge Analytica and his role on the GSR project. By going public, he has gone out of his way, at much personal expense, to try to correct the mistakes that were made. He has accepted his share of responsibility. It is the case for most whistleblowers that they were involved in some way in the problems that they later choose to report. It was Mr Wylie, not Cambridge Analytica or GSR, who decided to come forward to report the project to the authorities or media.
The basis of all CA models, including political affiliation and turnout models, were originally trained using the Facebook derived GSR data. Even if Facebook data itself was not used directly on the Trump campaign, the algorithms were still built using Facebook derivatives.
However, it is public domain that Trump’s voter targeting operation, called Project Alamo, made extensive use of Facebook targeting and Facebook also had staff embedded with the Trump campaign. Cambridge Analytica also worked on Project Alamo, so it is difficult to believe that they did not come into contact or make use of Facebook data.
Cambridge Analytica has previously said that there was “no time” to “update” the psychographic models used on the Cruz campaign for Trump because they only officially joined in late summer 2016. However, this makes no sense because voter personality is an enduring characteristic (like gender) and so there would be no need to “update” the models. It would be like saying that because the firm was switching campaigns they would also have to “update” the gender of all records.
Further, the firm had been in contact with the Trump campaign for far longer than it cares to admit. Cambridge Analytica lawyers confirmed to Mr Wylie that Alexander Nix met with the soon-to-be Trump campaign manager Corey Lewendowski back in spring 2015, before Trump had even announced his campaign. Mr Nix discussed with Mr Lewendowski the use of Facebook derived data and psychographics at that meeting. Legal correspondence from CA referencing these meetings are in the possession of the committee.
This is difficult to believe because internal reports, which have been passed to the committee, show that the commercial data that the firm says they use do not have strong relationships with nuanced constructs. Also the commercial data the firm uses has a high degree of “matrix sparsity” which means that although there may be “4,000-5,000” features in the dataset, most records are actually blank for those features. Many features only have a coverage rate of only 2-5% which means that 95-98% of voters in the dataset do not have an observation for that feature. This is why the “4,000-5,000 data points” claim is misleading, as it refers to a feature set of possible observations, but it does not mean that the coverage is high. So the commercial data referred to in the internal reports would not have been useful for psychological targeting as it did not contain enough information to be effective.
The data security firm UpGuard revealed exposed code repositories that showed AIQ developers working on code for Cambridge Analytica’s Ripon software in August 2015. Ripon was the platform CA used to
deploy targeting derived from the misappropriated Facebook data. In fact, internal emails in the possession of the committee show senior AIQ staff discussing accessing the “Kogan data” from SCL/CA’s servers for the Bolton PAC.
The following studies highlight the efficacy of using social media, natural language or Internet clickstream data for psychological profiling or mass persuasion:
Psychological Science, 26, 159–169
Psychological Science in the Public Interest, 13(3), 106-131.
“Cambridge Analytica did not collude with Russia.”
To be clear, no specific allegation has been made that CA, AIQ, Mr Nix or Dr Kogan knowingly colluded with the FSB or other Russian agents. However, a clear risk of data breaches was created by CA’s apparent recklessness in the face of highly skilled foreign intelligence and cyber operations.
During the Facebook harvesting scheme, the lead psychologist on the project, Dr Aleksandr Kogan was also working on a Russian-funded research project at St Petersburg University on scaled psychological profiling of data subjects. Dr Kogan’s research focused on online trolls and Dark Triad personality traits (Machiavellianism, Narcissism and Psychopathy).
Contemporaneous to Dr Kogan’s psychological profiling and online troll research in Russia, CA was also in close contact with senior executives at Lukoil, one of Russia’s largest oil companies. After receiving a request for information from Lukoil about CA’s work in the spring of 2014, CA discussed with Lukoil its experience with foreign disinformation, rumour campaigns, microtargeting and its data assets from Ripon. This is documented in correspondence and slide decks in the committee’s possession. As a note, CA’s history of working in Nigeria is a focus of this presentation.
It should be noted that Lukoil has formal information sharing agreements with the Russian Federal Security Service (“FSB”) and is known to conduct intelligence gathering on behalf of the FSB with European companies it engages.
It should also be noted that CA’s parent company, SCL Group, manages NATO psychological operations projects in the Baltic region and would have likely already been an intelligence target for the FSB. This means that in addition to processing Facebook data in Russia, there are reasonable grounds to suspect that CA may have been an intelligence target of Russian security services at the time of Project Ripon, that the FSB may have been notified of the existence of CA’s Facebook data and that they could covertly access those same data assets inside Russia via accessing Dr Kogan’s work and computers. There are also reasonable grounds to investigate the extent of Dr Kogan’s knowledge of any such accessing.
As Data Controller, CA had a legal duty to ensure the data was protected from these threats. Cambridge Analytica’s behaviour was also reckless given its extensive experience working in counterterrorism and military projects for the British and American governments. However, the company has a documented history of reckless handling of sensitive data.
In 2014, SCL Group, the parent of CA, was criticised by the UK Defence Science and Technology Laboratory (a part of the UK Ministry of Defence) for mishandling sensitive Ministry of Defence information. The DSTL assessment was done in the same year as the GSR Facebook harvesting scheme.
On 15 March 2014, an email addressed to Mr Nix stated that SCL staff were pitching “the interesting work Alex Kogan has been doing for the Russians” to other SCL clients. This has been given to the committee.
What the project was or was not “officially” for is beside the point. Alexander Nix is on record in emails stating that he was sending whitepapers authored by Mr Wylie on the firm’s US-based data and targeting capacity to senior executives at Lukoil – including the CEO of Lukoil. This is with the committee. Further, the pitch deck created by Alexander Nix for Lukoil began with slides on “Rumour campaigns” and on voter
“inoculation” in Nigeria. This is also with the committee. It is difficult to understand how these slides related in any way to a small customer loyalty project in Turkey.
“Cambridge Analytica does not use misinformation, bribes, hackers, kompromat or voter intimidation.”
In early 2015, video content was prepared by Cambridge Analytica as part of their “viral ops” campaign in Nigeria. This video was intended to intimidate voters in certain regions of Nigeria and suppress voters who were more likely to support Major General Muhammadu Buhari, who was at the time a presidential candidate and who is now the current President of Nigeria. This video, which is in the committee’s possession, contains graphic and sadistic footage of the following:
This video was produced in line with the views of CA’s senior staff about what is acceptable campaign practice. In recordings given to the committee by Dr Emma Briant, the CEO of SCL Group said that: “Of course Hitler attacked the Jews. He didn't have a problem with the Jews at all, but the people didn't like the Jews. So if the people — he could just use them to say — so he just leveraged an artificial enemy. Well, that's exactly what Trump did. He leveraged a Muslim — I mean, you know, it's — it was a real enemy.” It should be noted that Trump was a client of CA.
Voter suppression operations did not just happen in Africa. Mr Wylie has stated previously that CA’s work for PACs in the United States had voter suppression as an objective, particularily for African Americans. The committee is also in possession of documents that reference “voter disengagement” as an objective on American projects.
Documents sent to Lukoil created by Alexander Nix includes sections on “Rumour campaigns” and on voter “inoculation” in Nigeria. These are references to disinformation. Mr Nix also said to a Channel 4 undercover reporter that, “these are things that don’t necessarily need to be true as long as they’re believed.” He added that, “it has to happen without anyone thinking it’s propaganda”.
In the Channel 4 undercover sting, Mr Turnbull described the covert and deceptive nature of CA’s online tactics by saying that “this stuff infiltrates the online community and expands but with no branding—so it’s unattributable, untrackable.”
Mr Nix makes reference to using Ukrainian sex workers to collect kompromat of an opposition candidate. Mr Nix proposed to make “an offer he can’t refuse” and to “send some girls around to the candidate’s house.” This is not just loose talk. The Times of London revealed video footage showing that SCL attempted to entrap an opposition candidate by posing as an international property developer offering $1 million to support his election campaign in return for land in St Kitts & Nevis.
CA’s parent company SCL Group has been reported to the police for potential bribery offences and international corruption. In late 2013, Alexander Nix met with the then Minister of Health of Ghana and proposed to her to use her position as Minister to grant SCL a publicly funded project. In exchange, SCL would divert the Ministry of Health (“MOH”) funds to her election expenses to give the party an unfair advantage in the upcoming parliamentary election. The Minister agreed on these terms and authorised MOH to fund the SCL project. Documents in the possession of the committee make clear that that the project instead “will act as a prelude to an election campaign”. It is clear from this scheme that Mr Nix
and SCL induced the Minister to abuse her position as a public official in order to divert and misuse public Ministry of Health funds for unlawful political purposes. SCL gained financially from this scheme.
CA has also been reported to the police for hacking and cybercrime related offences. In January 2015, CA procured the services of an Israeli private intelligence firm known for its technical sophistication. The relationship with this Israeli private intelligence firm was fostered by Brittney Kaiser, who was then the firm’s Director of Business Development. The firm was instructed by CA in their London office to hack the private e-mail account and computer of Major General Muhammadu Buhari, who was at the time a presidential candidate and who is now the current President of Nigeria.
CA staff managing the campaign were then handed the hacked material and used its content for strategic intelligence to assist their candidate, Goodluck Jonathan, in the election and as kompromat to launch rumour campaigns about Buhari’s health, wellbeing and fitness to become president. Some of this kompromat has been published in the Guardian.
When at the firm, Alexander Nix told Mr Wylie explicitly about CA’s “black ops” capacity, which included using hackers to break into computer systems to acquire kompromat. Mr Wylie also was told that whenever this was being offered to clients, CA/SCL would list and bill it as “special IT services”.
Mr Wylie and his lawyers have also personally spoken to several of ex-staff members recently, who have all re-confirmed the details of various hacking schemes, including another project involving the Prime Minister of St Kitts and Nevis. Some of them have now reported this to the authorities.
In 2014, SCL Group, the parent of CA, was criticised by the UK Defence Science and Technology Laboratory (a part of the UK Ministry of Defence) for mishandling sensitive Ministry of Defence information. The DSTL assessment was done in the same year as the GSR Facebook harvesting scheme. The committee is in possession of this assessment.
Mr Wylie has provided the committee of examples of both CA and GSR transferring highly sensitive personal data, including Facebook derived data, over unencrypted and insecure emails.
The data security firm UpGuard revealed significant misconfigurations in CA’s Ripon codebase which allowed the code to be publicly exposed. The firm stated that “Also exposed among these tools are numerous credentials, keys, hashes, usernames, and passwords to access other AIQ assets, including databases, social media accounts, and Amazon Web Services repositories, raising the possibility of attacks by any malicious actors encountering the exposure […] This configuration file, like all the others, contains an exposed Facebook app ID and secret key, as well as credentials accessing Twilio, an SMS messaging service.”
It should also be noted that CA’s parent company, SCL Group, manages NATO psychological operations projects in the Baltic region and would have likely already been an intelligence target for the FSB. This means that in addition to processing Facebook data in Russia, there are reasonable grounds to suspect that CA may have been an intelligence target of Russian security services at the time of Project Ripon.
“Cambridge Analytica and SCL Group are different companies.”
This is also dealt with above in the introduction to the companies section. To reiterate, Cambridge Analytica (“CA”) was created by SCL Group with funding from Robert Mercer, an American billionaire based in New York. Robert Mercer installed the alt-right political activist Stephen Bannon as CA’s Vice President with responsibilities to manage the company day-to-day. Mr Mercer wanted to use the IO tactics SCL had used on military projects for his political aims in the United States, and elsewhere, including the United Kingdom. CA’s focus was to adapt these strategies for politics, as well as research ways to modernise and deploy IO approaches in online social networks. CA does not have any staff, only an intellectual property licence and data assets. SCL licenced all its IP to CA and in return CA signed an exclusive service provision agreement whereby all CA clients would be handed to SCL staff to work on. Although there are technical legal distinctions between CA and SCL, this is largely to get around various electoral compliance and foreign agent restrictions in the USA. It should be noted that in practice CA and SCL operate day-to-day as the same company. The two companies share the same offices and many of the same directors.
Cambridge Analytica has a history of using a network of companies to obfuscate its precence in a given country. Mr Nix said in Channel 4’s undercover sting that CA is “used to operating through different vehicles, in the shadows”. Mark Turnbull, CA’s Managing Director also referenced using hidden companies, adding that “no one even knew they were there, they were just ghosted in, did the work, ghosted out”.
Aggregate IQ (“AIQ”) is a Canadian company that was set up to service SCL and later CA projects and build database, CRM and online advertising technologies for SCL/CA. Prior to SCL, AIQ had no other clients. The reason AIQ was set up originally was because several key people, who later became the principle officers of AIQ, were not mobile to move to London for family reasons. The compromise was to establish a company in Canada and IP agreements would be reached so that SCL/CA would own the products of their work. To the best of Mr Wylie’s knowledge, AIQ had no independent clients outside of SCL/CA from 2013 to 2016. The IP licence and contracts between AIQ and CA/SCL are in the possession of the committee. AIQ was listed as “SCL Canada” on the SCL website and internal staff lists in the possession of the committee also lists Zack Massingham, the CEO of AIQ, as “Head of SCL Canada”. These staff lists also show that AIQ was responsible for hiring and managing a division of SCL/CA’s software engineers.
Contemporaneous to the 2016 EU Referendum, AIQ was working for CA on several projects, including Ted Cruz’s presidential campaign. This would have necessitated a high degree of interaction between AIQ and CA, especially given that AIQ built the “Ripon” targeting platform for CA. The data security firm UpGuard reported an analysis of AIQ’s internal code repository that showed AIQ developers working on code for Cambridge Analytica’s Ripon software. The firm stated that, “While Cambridge Analytica may operate as an independent from, distinct from AggregateIQ, the working relationship appears to be much closer - as evidenced in the tale of an app, contained in the exposed repository.”
“Mr Wylie was only a part time contractor at CA for only a few months.”
Like the majority of the early team at Cambridge Analytica (“CA”), Mr Wylie was actually retained as consultant to CA and not an employee of CA. That is why he set up the company at around the same time that CA was being incorporated. He did not mine any CA dataset for his own ends. In common with many in the industry, he sometimes uses a consulting company. As a consultant he did not have set hours but worked exclusively for SCL and CA during the period from February 2013 until November 2014.
Mr Wylie was only at CA “for a few months” because he joined SCL Group in early 2013 well before CA existed and CA was not fully set up until the summer of 2014. He had the title of “Director of Research” and the committee has scans of Mr Wylie’s old business cards. Although he now regrets this, Mr Wylie played a pivotal role in the creation of CA, including meeting Robert Mercer, negotiating with Mr Mercer’s lawyers and creating the intellectual basis for the firm through his prior research at SCL.
Mr Wylie has been very clear on this. He had access to a portion of the Facebook data that Dr Kogan harvested through his applications. He did not sell that data or use it on client projects after he left Cambridge Analytica
When Dr Kogan and Mr Wylie first met, Dr Kogan said he was setting up an academic institute that would be aimed at furthering the emerging field of computational social sciences. Originally this was to be called the “Mutual Science Institute”, but as “mutual” is a protected term for mutual funds, he incorporated as Global Science Research (“GSR”). Emails relating to the proposed institute are with the committee.
Mr Wylie agreed to help Dr Kogan set up the academic institute, as he thought it was a compelling idea to bridge data science and social science for the mutual benefit of both domains. It should be noted that Facebook has said that it was also under the impression that Dr Kogan was collecting data for academic use, although Mr Wylie was not part of those discussions.
Mr Wylie later agreed to help Dr Kogan acquire more data for the institute even though he was leaving Cambridge Analytica, as he thought the institute was a promising idea. However, he later discovered that Dr Kogan went back to CA after Mr Wylie left and was discussing commercialising the data with Mr Nix, who was then the CEO of CA. After learning that Dr Kogan was still working in collaboration with CA, and that this relationship also may be in a commercial context, he did not continue with his relationship with Dr Kogan and did not transfer any data to GSR. Mr Wylie then deleted the GSR-harvested data in question.
To be absolutely clear, Mr Wylie is the only party who had access to the GSR-harvested Facebook data who did not sell the data or use it on client projects. Last month, the UK Information Commissioner wrote a letter stating quite clearly that not only is Mr Wylie proactively co-operating with British authorities, but that Mr Wylie is not under investigation. Plainly, had he been involved in the misuse of data, the ICO would not have been able to provide that assurance.
Several former staff and consultants from CA went on to found another company that did in fact start working for right wing candidates in the USA. To be clear, Mr Wylie was never part of and did not join that other company. Instead he worked on the things that interested him: fashion projects and progressive campaigns. Mr Wylie has actually turned down several venture capital offers because he is happy with the freedom his current work gives him.
Mr Wylie is in possession of materials from Cambridge Analytica: these were the same documents and emails that the Guardian and New York Times published revealing the firm’s unethical practices and wrongdoing. He retained this information not for commercial gain but because he was concerned about the practices of the company. It was not information taken in order to compete and has never been used in that way. Any breach of a non-disclosure agreement is clearly justified where a whistleblower reveals potential criminality or unethical behaviour as in this case.
After his departure, CA continued to harass Mr Wylie with on-going legal threats and Mr Wylie agreed to an undertaking that he would not solicit Cambridge Analytica’s alt-right clients or use their intellectual property, such as “psy-ops” or the firm’s datasets. Since Mr Wylie did not plan on engaging in psychological warfare in elections, or working for the American alt-right, he agreed to those terms.
However, the undertaking does not apply for public interest whistleblowing where the confidential information being made public reveals potential criminality or unethical behaviour.
At the time, Mr Wylie was of the view that American voter data should be processed in America, rather than ported to servers in several different countries, which would create potential risks to those American data subjects. It should be noted that Dr Kogan frequently travelled to Russia and recent revelations about his Russian-funded research on profiling online trolls is extremely concerning.
Mr Wylie drafted a version of Terms of Service for Dr Kogan after he googled various sample app terms. He has already said this on record. It was up to Dr Kogan to finalise those terms. Dr Kogan was the one responsible for his app’s compliance with Facebook’s terms, not Mr Wylie, as it was not Mr Wylie’s app and he was never given access or control of the app.
These references are about a very standard dataset of registered US voters with some additionally appended consumer data. There are approximately 160 million registered US voters, so this number roughly refers to the number of records sourced from US voter rolls. Some records may have also included people who were likely eligible to vote but had not yet registered, or consumer records not yet matched to a voter record. Mr Wylie has many relationships with US based data vendors and many of those same datasets are used by campaigns on both sides of the aisle. Mr Wylie had access to this information lawfully and with the appropriate consents.
This is plainly untrue. Mr Wylie has a long history of working on data science projects and was endorsed for a Tier 1 Exceptional Talent visa by the UK Home Office specifically on the basis of his unique data science skills.
This is irrelevant to any wrongdoing by Cambridge Analytica or GSR. Unlike Facebook, Cambridge Analytica or GSR, Mr Wylie proactively disclosed evidence to the Information Commissioner’s Office and the National Crime Agency. Before going public, he spent months working with the authorities to help with their investigation. Given that Facebook has just announced a new reward programme with “bounties” for those who report security flaws, it is baffling as to why Mr Wylie is still banned. Mr Wylie is the only party who had access to the GSR-harvested Facebook data who did not sell the data or use it on client projects. Last month, the UK Information Commissioner wrote a letter stating quite clearly that that
Mr Wylie is not under investigation. Plainly, had he been involved in the misuse of data, the ICO would not have been able to provide that assurance.
April 2018