A joint investigation by watchdogs in Canada and British Columbia has discovered that Cambridge Analytica-linked knowledge agency, Aggregate IQ, broke privateness legal guidelines in Facebook ad-targeting work it undertook for the official Vote Leave Brexit marketing campaign within the UK’s 2016 EU referendum.
A fast reminder: Vote Leave was the official go away marketing campaign within the referendum on the UK’s membership of the European Union. While Cambridge Analytica is the (now defunct) agency on the heart of an enormous Facebook knowledge misuse scandal which has dented the corporate’s fortunes and continues to tarnish its fame.
Vote Leave’s marketing campaign director, Dominic Cummings — now a particular advisor to the UK prime minister — wrote in 2017 that the successful recipe for the go away marketing campaign was knowledge science. And, extra particularly, spending 98% of its advertising finances on “nearly a billion targeted digital adverts”.
Targeted at Facebook customers.
The drawback is, per the Canadian watchdogs’ conclusions, AIQ didn’t have correct authorized consents from UK voters for disclosing their private info to Facebook for the Brexit advert blitz which Cummings ordered.
Either for “the purpose of advertising to those individuals (via ‘custom audiences’) or for the purpose of analyzing their traits and characteristics in order to locate and target others like them (via ‘lookalike audiences’)”.
Oops.

Here’s Dominic Cummings describing how he & Vote Leave used AIQ & Facebook to focus on fastidiously tailor-made disinformation on hundreds of thousands of British voters in 2016. It’s past grim that this man is now Boris Johnson’s senior adviser. pic.twitter.com/eGggKHoLU0
— Tom Scott (@Tom___Scott) July 24, 2019

Last yr the UK’s Electoral Commission additionally concluded that Vote Leave breached election marketing campaign spending limits by channeling cash to AIQ to run the focusing on political adverts on Facebook’s platform, by way of undeclared joint working with one other Brexit marketing campaign, BeLeave. So there’s a full sandwich of authorized wrongdoings caught to the brexit mess that UK society stays mired in, greater than three years later.
Meanwhile, the present UK General Election is now a digital petri dish for knowledge scientists and democracy hackers to run wild experiments in microtargeted manipulation — given election legal guidelines haven’t been up to date to take account of the outgrowth of the adtech business’s monitoring and focusing on infrastructure, regardless of a number of warnings from watchdogs and parliamentarians.
Data actually is helluva a drug.

The Canadian investigation cleared AIQ of any wrongdoing in its use of cellphone numbers to ship SMS messages for an additional pro-Brexit marketing campaign, BeLeave; a goal the watchdogs discovered had been licensed by the consent supplied by people who gave their info to that youth-focused marketing campaign.
But they did discover consent issues with work AIQ undertook for numerous US campaigns on behalf of Cambridge Analytica affiliate, SCL Elections — together with for a political motion committee, a presidential main marketing campaign and numerous campaigns within the 2014 midterm elections.
And, once more — as we all know — Facebook is squarely within the body right here too.
“The investigation finds that the personal information provided to and used by AIQ comes from disparate sources. This includes psychographic profiles derived from personal information Facebook disclosed to Dr. Aleksandr Kogan, and onward to Cambridge Analytica,” the watchdogs write.
“In the case of their work for US campaigns… AIQ did not attempt to determine whether there was consent it could rely on for its use and disclosure of personal information.”
The investigation additionally checked out AIQ’s work for a number of Canadian campaigns — discovering fewer points associated to consent. Though the report states that in: “certain cases, the purposes for which individuals are informed, or could reasonably assume their personal information is being collected, do not extend to social media advertising and analytics”.
AIQ additionally will get instructed off for failing to correctly safe the information it misused.
This factor of the probe resulted from an information breach reported by UpGuard after it discovered AIQ working an unsecured GitLab repository — holding what the report dubs “substantial personal information”, in addition to encryption keys and login credentials which it says put the private info of 35 million+ individuals in danger.
Double oops.
“The investigation determined that AIQ failed to take reasonable security measures to ensure that personal information under its control was secure from unauthorized access or disclosure,” is the inexorable conclusion.
Turns out if an entity doesn’t have a correct authorized proper to individuals’s info within the first place it is probably not majorly involved about the place else the information may find yourself.
The report flows from an investigation into allegations of unauthorized entry and use of Facebook person profiles which was began by the Office of the Information and Privacy Commissioner for BC in late 2017. A separate probe was opened by the Office of the Privacy Commissioner of Canada final yr. The two watchdogs subsequently mixed their efforts.
The upshot for AIQ from the joint investigation’s discovering of a number of privateness and safety violations is a sequence of, er, “recommendations”.
On the information use entrance it’s instructed the corporate take “reasonable measures” to make sure any third-party consent it depends on for assortment, use or disclosure of non-public info on behalf of shoppers is “adequate” beneath the related Canadian and BC privateness legal guidelines.
“These measures should include both contractual measures and other measures, such as reviewing the consent language used by the client,” the watchdogs recommend. “Where the information is sensitive, as with political opinions, AIQ should ensure there is express consent, rather than implied.”
On safety, the suggestions are equally for it to “adopt and maintain reasonable security measures to protect personal information, and that it delete personal information that is no longer necessary for business or legal purposes”.
“During the investigation, AIQ took steps to remedy its security breach. AIQ has agreed to implement the Offices’ recommendations,” the report provides.
The upshot of political ‘data science’ for Western democracies? That’s nonetheless tbc. Buckle up.
https://platform.twitter.com/widgets.js