The 2018 Observer investigation into a hitherto obscure political consultancy sparked the most serious crisis yet to disrupt the world’s secretive social media giants and shed terrifying light on how their collection of our data reshaped political campaigning.
Today, Cambridge Analytica is a household name. But renewed controversy about the activities of the now defunct company demonstrates how our media and legislatures are still struggling to digest the full implications of the scandal.
Last week, Britain’s information commissioner, Elizabeth Denham, announced she had wrapped up a long investigation into the use of personal data in political campaigning in a letter to parliament that warned of “systemic vulnerabilities in our democratic systems”. The letter confirmed that Cambridge Analytica had exploited Facebook data and said that, as investigators closed in on the company, it drew up plans to take its data offshore to avoid scrutiny.
The commissioner summed up how reporting on this topic, led by Pulitzer-nominated Carole Cadwalladr in the Observer, transformed the way that people around the world understood the value of their personal data and their relationships with social media giants. “How people’s information was being used became a dinner table topic, prompting undercover news reports, a TV dramatisation and a Netflix documentary,” said Denham.
Denham underlined that the investigation led to fines on Vote Leave, Leave.EU and Facebook, with the latter “given the maximum financial penalty we could levy”. Cambridge Analytica has since collapsed; if it hadn’t, it would probably have attracted further regulatory action, she added.
The investigation and its findings might have been expected to prompt alarm and a debate about protecting our data and our democracy. Instead, comment over the past week has largely dismissed its findings or misread them. Several focused on CA’s purchase and use of commercially available personal data and software, as if that negated the exploitation of Facebook users’ private profiles. But the company was always open about using commercial software and data; that was combined with information scraped from Facebook to give it an unmatched ability to profile US voters.
One report claimed that the Information Commissioner’s Office (ICO) had “[dispelled] many of the accusations put forward by whistleblowers and digital rights campaigners”, listing concerns about Russian interference in Brexit and interference in the 2016 presidential election. Yet the ICO confirmed that CA and its partner companies held on to parts of the Facebook data until at least 2017 and used it for political campaigning. “It is suspected” that those campaigns included the 2016 US presidential election, the ICO’s letter notes.
A devastating Channel 4 report claimed recently that Donald Trump’s 2016 campaign worked with a team from Cambridge Analytica and used data to target black voters for suppression through ads on Facebook.
On Russian meddling, the ICO said that possible evidence it had found of “Russia-located activity” fell beyond its remit and had been referred to the National Crime Agency for further investigation. Beyond that, it noted no “additional evidence of Russian involvement” in material on the CA servers it seized; it stretches credulity to present that as a full investigation into potential Russian influence on Brexit.
Other reports focused on the ICO’s confirmation of its earlier conclusion that CA was not actively involved in the Brexit referendum, while inexplicably ignoring its findings about the Canadian data company AggregateIQ (AIQ), which did work on the winning Vote Leave campaign and was described by whistleblowers as an unofficial “department” of the scandal-hit firm.
The ICO said there was a range of evidence demonstrating a “very close relationship” with Cambridge Analytica’s parent company, SCL, which included paying some of AIQ’s Facebook invoices, but didn’t untangle it further. AIQ denies having a relationship that went beyond that between a software developer and its client.
Media reporting, including the Observer’s, has always focused on AIQ. It was Cambridge Analytica employees, and figures from the unofficial Leave.EU campaign, who claimed in the aftermath of the vote that the company played a large role, before later back-pedalling.
Critics of Cadwalladr’s reporting argue that “Cambridge Analytica’s main data-related crime was overselling its own capabilities rather than actually hacking democracy”. Others have resorted to trolling and personal attacks, often laced with misogyny. Yet her exposure of Cambridge Analytica prompted political and judicial inquiries on both sides of the Atlantic and permanently altered public understanding of data abuse. It paved the way for sweeping changes to how social media companies regulate political campaigns and advertising.
The ICO report confirmed massive mishandling of private data and its exploitation for political campaigning. The Observer is proud of its role in the exposure of these abuses.