Facebook–Cambridge Analytica data scandal

Data characteristics

Numbers

Wired, The New York Times, and The Observer reported that the data-set had included information on 50 million Facebook users. While Cambridge Analytica claimed it had only collected 30 million Facebook user profiles, Facebook later confirmed that it actually had data on potentially over 87 million users, with 70.6 million of those people from the United States. Facebook estimated that California was the most affected U.S. state, with 6.7 million impacted users, followed by Texas, with 5.6 million, and Florida, with 4.3 million. Data was collected on at least 30 million users while only 270,000 people downloaded the app.

Information

In April 2018, Facebook sent a message to those users believed to be affected, saying the information likely included one's "public profile, page likes, birthday and current city". Some of the app's users gave the app permission to access their News Feed, timeline, and messages. The data was detailed enough for Cambridge Analytica to create psychographic profiles of the subjects of the data. The data also included the locations of each person. For a given political campaign, each profile's information suggested what type of advertisement would be most effective to persuade a particular person in a particular location for some political event.

Data use

Ted Cruz campaign

In 2016, American senator Ted Cruz hired Cambridge Analytica to aid his presidential campaign. The Federal Election Commission reported that Cruz paid the company $5.8 million in services. Although Cambridge Analytica was not well known at the time, this is when it started to create individual psychographic profiles. This data was then used to create tailored advertisements for each person to sway them into voting for Cruz.

Donald Trump campaign

Donald Trump's 2016 presidential campaign used the harvested data to build psychographic profiles, determining users' personality traits based on their Facebook activity. The campaign team used this information as a micro-targeting technique, displaying customized messages about Trump to different US voters on various digital platforms. Ads were segmented into different categories, mainly based on whether individuals were Trump supporters or potential swing votes. As described by Cambridge Analytica's CEO, the key was to identify those who might be enticed to vote for their client or be discouraged to vote for their opponent. Supporters of Trump received triumphant visuals of him, as well as information regarding polling stations. Swing voters were instead often shown images of Trump's more notable supporters and negative graphics or ideas about his opponent, Hillary Clinton. For example, the collected data was specifically used by "Make America Number 1 Super PAC" to attack Clinton through constructed advertisements that accused Clinton of corruption as a way of propping up Trump as a better candidate for the presidency.

Interfering in the elections in Trinidad and Tobago

In the Caribbean country of Trinidad and Tobago, the majority of the population is subdivided into two groups, those of South Asian and African origin. The South Asian population constitute the largest ethnic group in the country (approximately 35.4 %), mainly descendants of indentured workers from South Asia (mostly India), brought in to replace freed African slaves who refused to continue working on the sugar plantations. Through cultural preservation, many residents of Indian descent continue to maintain the traditions of their ancestral homeland. On the other hand, the African population constitute the second largest ethnic group in the country, with approximately 34.2 % of the population identifying themselves as of African descent.

In 2010, Cambridge Analytica designed a campaign called Do So, aimed at trying to increase abstention among young people of African descent. This campaign, presented as if it were something that arose spontaneously on social media, was developed as a resistance movement against traditional politics, encouraging young people not to vote as a form of protest, so that, by reducing their electoral participation, it favored the United National Congress (UNC), the party representing the Indian population. The Do So campaign had a significant impact on reducing voter turnout among young people of African descent, which contributed to the UNC's electoral victory in 2010.

Russia

The UK Parliament's Digital, Culture, Media and Sport Committee reported that the Information Commissioner's Office investigated the extent to which data was shared between Aleksandr Kogan's company, Global Science Research (GSR), and Russian systems. Information Commissioner Elizabeth Denham testified in March 2018 that investigators discovered IP addresses and a server linked to Kogan in Russia and associated countries; she confirmed this evidence was referred to the National Crime Agency. Deputy Information Commissioner James Dipple-Johnston testified that IP addresses originating from Russia were connected to an earlier application at the Cambridge University Psychometrics Centre, noting that these addresses were linked to a Tor entry point and alleged past cyber attacks. Cambridge Analytica could not access the Psychometrics Centre's data, so they hired Centre insider Kogan to build a "clone" of the Centre's technology through his private GSR side-business.

Also in 2018, Parliament questioned SCL Group (Cambridge Analytica's parent company) director Alexander Nix in a hearing about Cambridge Analytica's connections with Russian oil company Lukoil. Nix stated he had no connections to the two companies despite concerns that the oil company was interested in how the company's data was used to target American voters. Cambridge Analytica had become a point of focus in politics since its involvement in Trump's campaign at this point. Democratic officials made it a point of emphasis for improved investigation over concerns of Russian ties with Cambridge Analytica. It was later confirmed by Christopher Wylie that Lukoil was interested in the company's data regarding political targeting.

In April 2018, Aleksandr Kogan testified regarding the data harvesting operations of his company, GSR. Kogan said his application, "thisisyourdigitallife," collected broad sets of user data, including public profiles, birth dates, location data, and page "likes" from Facebook users and their friends. He confirmed that GSR shared this data and other derivatives with Cambridge Analytica. A key point of contention during the hearing was the extent of the data access; while Facebook claimed they had denied Kogan's request for the "read_stream" permission (which grants access to users' timeline posts and their private messages), Kogan discussed the mechanics of the data collection which contradicted Facebook's assertions, a discrepancy also noted by the Information Commissioner's Office. Kogan also addressed his ties to Russia, stating that he was named on a grant at Saint Petersburg State University to research cyberbullying following a visit in 2013; he maintained that his role was limited to occasional lectures and advice, and when pressed on the potential for state interference, he argued that equating basic science with "spycraft" was a "silly process".

Brexit

Cambridge Analytica was allegedly hired as a consultant company for Leave.EU and the UK Independence Party during 2016, as an effort to convince people to support Brexit. These rumors were the result of the leaked internal emails that were shared with the British parliament. Brittany Kaiser declared that the datasets that Leave.EU used to create databases were provided by Cambridge Analytica. These datasets composed of the data obtained from Facebook were said to be work done as an initial job deliverable for them. Although Arron Banks, co-founder of Leave.EU, denied any involvement with the company, he later declared "When we said we'd hired Cambridge Analytica, maybe a better choice of words could have been deployed." The official investigation by the UK Information Commissioner found that Cambridge Analytica was not involved "beyond some initial enquiries" and the regulator did not identify any "significant breaches" of data protection legislation or privacy or marketing regulations "which met the threshold for formal regulatory action".

Responses

Facebook and other companies

Facebook CEO Mark Zuckerberg first apologized for the situation with Cambridge Analytica on CNN, calling it an "issue", a "mistake" and a "breach of trust". He explained that he was responding to the Facebook community's concerns and that the company's initial focus on data portability had shifted to locking down data; he also reminded the platform's users of their right of access to personal data. Other Facebook officials argued against calling it a "data breach," arguing those who took the personality quiz originally consented to give away their information. Zuckerberg pledged to make changes and reforms in Facebook policy to prevent similar breaches. On March 25, 2018, Zuckerberg published a personal letter in various newspapers apologizing on behalf of Facebook. In April, Facebook decided to implement the EU's General Data Protection Regulation in all areas of operation and not just the EU.

In April 2018, Facebook established Social Science One in response to the Facebook-Cambridge Analytica data scandal. On April 25, 2018, the company released its first earnings report following the revelations. Although declined compared to the previous quarter consistent with typical social trends following the holiday period the reported revenue was the highest for a first quarter and the second highest overall in company history

Amazon said that they suspended Cambridge Analytica from using their Amazon Web Services when they learned in 2015 that their service was collecting personal information. The Italian banking company UniCredit stopped advertising and marketing on Facebook in August 2018.

Governmental actions

The governments of India and Brazil demanded that Cambridge Analytica report how anyone used data from the breach in political campaigning, and various regional governments in the United States faced lawsuits from affected citizens affected by the incident.

In early July 2018, the United Kingdom's Information Commissioner's Office announced it intended to fine Facebook £500,000 ($663,000). This was the maximum fine allowed at the time of the breach, stating Facebook "contravened the law by failing to safeguard people's information".

In March 2019, a court filing by the U.S. Attorney General for the District of Columbia alleged that Facebook knew of Cambridge Analytica's "improper data-gathering practices" months before they were first publicly reported in December 2015.

In July 2019, the Federal Trade Commission (FTC) voted 3–2 to approve fining Facebook $5 billion to finally settle the investigation into the data breach. The record-breaking settlement was one of the largest penalties ever assessed by the U.S. government for any violation. In the ruling, the FTC cited Facebook's continued violations of FTC privacy orders from 2012, which included sharing users' data with apps used by their friends, facial recognition being enabled by default, and Facebook's use of user phone numbers for advertising purposes. As a result, Facebook was made subject to a new 20-year settlement order.

In July 2019, the FTC sued Cambridge Analytica's CEO Alexander Nix and GSRApp developer Aleksandr Kogan. Both defendants agreed to administrative orders that restrict their future business dealings and to destroy both any collected personal data and any work product made from the data. The GSRApp collected information initially on up to 270,000 GSRApp users, then harvested data on up to 65 million Facebook friends. Cambridge Analytica declared bankruptcy.

Also in July 2019, Facebook has agreed to pay $100 million to settle with the U.S. Securities and Exchange Commission for "misleading investors about the risks it faced from misuse of user data". The SEC's complaint alleged that Facebook did not correct its existing disclosure for more than two years despite discovering the misuse of its users' information in 2015.

Impact on Facebook users and investors

Since April 2018, the first full month since the breaking of the Cambridge Analytica data breach, the number of likes, posts and shares on the site had decreased by almost 20%, and has decreased ever since, with the engagement only momentarily increasing during the summer and during the 2018 US midterm elections. Despite this, user growth of the site has risen in the period since increased media coverage, increasing by 1.8% during the final quarter of 2018.

On March 26, 2018, a little after a week after the story was initially published, Facebook stock fell by about 24%, equivalent to $134 billion. By May 10, Wall Street reported that the company recovered their losses.

#DeleteFacebook movement

The public reacted to the data privacy breach by initiating the campaign #DeleteFacebook with the aim of starting a movement to boycott Facebook. The co-founder of WhatsApp, which is owned by Facebook, joined in on the movement by declaring it was time to delete the platform. The hashtag was tweeted almost 400,000 times on Twitter within a 30-day period after news of the data breach. 93% of the mentions of the hashtag actually appeared on Twitter, making it the main social media platform used to share the hashtag. However, a survey by investment firm Raymond James found that although approximately 84% of Facebook users were concerned about how the app used their data, about 48% of those surveyed claimed they wouldn't actually cut back on their usage of the social media network. Additionally, in 2018, Mark Zuckerberg commented that he didn't think the company had seen "a meaningful number of people act" on deleting Facebook.

An additional campaign and hashtag, #OwnYourData, was coined by Brittany Kaiser. The hashtag was created by Kaiser as a Facebook campaign that pushed for increased transparency on the platform. #OwnYourData was also used in Kaiser's petition for Facebook to alter their policies and give users increased power and control over their data, which she refers to as users' assets and property. In addition to the hashtag, Kaiser also created the Own Your Data Foundation to promote increased digital intelligence education.

Witness and expert testimony

The United States Senate Judiciary Committee called witnesses to testify about the data breach and general data privacy. They held two hearings, one focusing on Facebook's role in the breach and privacy on social media, and the other on Cambridge Analytica's role and its impact in data privacy. The former was held on April 10, 2018, where Mark Zuckerberg testified and Senator Chuck Grassley and Senator Dianne Feinstein gave statements. The latter occurred on May 16, 2018, where Professor Eitan Hersh, Dr. Mark Jamison, and Christopher Wylie testified, while Senators Grassley and Feinstein again made statements.

Mark Zuckerberg

During his testimony before Congress on April 10, 2018, Zuckerberg said it was his personal mistake that he did not do enough to prevent Facebook from being used for harm. "That goes for fake news, foreign interference in elections and hate speech". During the testimony, Mark Zuckerberg publicly apologized for the breach of private data: "It was my mistake, and I'm sorry. I started Facebook, I run it, and I'm responsible for what happens here".

Zuckerberg said that in 2013 Aleksandr Kogan had created a personality quiz app, which was installed by 300,000 people. The app was then able to retrieve Facebook information, including that of the users' friends, and this was obtained by Kogan. It was not until 2015 that Zuckerberg learned that these users' information was shared by Kogan with Cambridge Analytica. Cambridge Analytica was subsequently asked to remove all the data. It was later discovered by The Guardian, The New York Times and Channel 4 that the data had in fact not been deleted.

Eitan Hersh

In 2015, Eitan Hersh published Hacking the Electorate: How Campaigns Perceive Voters, which analyzed the databases used for campaigns between 2008 and 2014. On May 6, 2018, Eitan Hersh, a professor of political science at Tufts University testified before Congress as an expert on voter targeting.

Hersh claimed that the voter targeting by Cambridge Analytica did not excessively affect the outcome of the 2016 election because the techniques used by Cambridge Analytica were similar to those of presidential campaigns well before 2016. Further, he claimed that the correlation between user "likes" and personality traits were weak and thus the psychological profiling of users were also weak.

Mark Jamison

Mark Jamison, the director and Gunter Professor of the Public Utility Research Center at the University of Florida, testified before Congress on May 6, 2018, as an expert. Jamison reiterated that it was not unusual for presidential campaigns to use data like Facebook's data to profile voters; Presidents Barack Obama and George W. Bush also used models to micro-target voters. Jamison criticized Facebook for not being "clear and candid with its users" because the users were not aware of the extent that their data would be used. Jamison finished his testimony by saying that if the federal government were to regulate voter targeting to happen on sites like Facebook, it would harm the users of those sites because it would be too restrictive of those sites and would make things worse for regulators.

Christopher Wylie

On May 16, 2018, Christopher Wylie, who is considered the "whistleblower" on Cambridge Analytica and also served as Cambridge Analytica's Director of Research in 2013 and 2014, also testified to the United States Senate Judiciary Committee. He was considered a witness to both British and American authorities, and he claims he decided to whistle-blow to "protect democratic institutions from rogue actors and hostile foreign interference, as well as ensure the safety of Americans online." He claimed that at Cambridge Analytica "anything goes" and that Cambridge Analytica was "a corrupting force in the world." He detailed to Congress how Cambridge Analytica used Facebook's data to categorize people into groups based on political ideology. He also claimed that Eitan Hersh contradicted "copious amounts of peer-reviewed literature in top scientific journals, including the Proceedings of the National Academy of Sciences, Psychological Science, and Journal of Personality and Individual Differences" by saying that Facebook's categorizing of people were weak.

Christopher Wylie also testified about Russian contact with Cambridge Analytica and the campaign, voter disengagement, and his thoughts on Facebook's response.

Aftermath

Following the downfall of Cambridge Analytica, a number of related companies have been established by people formerly affiliated with Cambridge Analytica, including Emerdata Limited and Auspex International. At first, Julian Wheatland, the former CEO of Cambridge Analytica and former director of many SCL-connected firms, stated that they did not plan on reestablishing the two companies. Instead, the directors and owners of Cambridge and its London-based parent SCL group strategically positioned themselves to be acquired in the face of bankruptcy procedures and lawsuits. While employees of both companies dispersed to successor firms, Cambridge and SCL were acquired by Emerdata Limited, a data processing company. Wheatland responded to news of this story and emphasized that Emerdata would not inherit SCL companies' existing data or assets and that this information belongs to the administrators in charge of the SCL companies' bankruptcy. David Carroll, an American professor who sued Cambridge, stated that Emerdata was aiming to conceal the scandals and minimize further criticism. Carroll's lawyers argued that Cambridge's court administrators were acting unlawfully by liquidating the company's assets prior to a full investigation being performed. While these administrators subjected SCL Group to criminal injury and a $26,000 fine, a U.K. court denied Carroll's lawsuit, allowing SCL to disintegrate without turning over his data.

In October 2021, following Facebook employee Frances Haugen whistleblowing Facebook activities, NPR revisited the Cambridge Analytica data scandal by observing that Facebook neither took responsibility for their behavior there nor did consumers get any benefit of reform as a result. In August 2022, Facebook agreed to settle a lawsuit seeking damages in the case for an undisclosed sum. In December 2022, Meta Platforms agreed to pay $725 million to settle a private class-action lawsuit related to the improper user data sharing with Cambridge Analytica and other third-party companies.

In popular culture

Documentary

The Netflix documentary The Great Hack examines how Cambridge Analytica used the personal data of millions of Facebook users without consent to influence electoral processes, including Donald Trump’s 2016 presidential campaign and the Brexit referendum. It highlights how the exploitation of personal data can undermine free and fair elections in democratic societies. The documentary features interviews with several key figures, including Brittany Kaiser, former director of business development at Cambridge Analytica, and Carole Cadwalladr, a British investigative journalist who uncovered the scandal.

Feature film

Between 2019 and 2021, the production company AGBO announced a feature film about the Cambridge Analytica scandal. The script was written by Christopher Markus and Stephen McFeely. In March 2020, it was reported that Paul Bettany would portray Alexander Nix, with David Gordon Green considered as director. In July 2021, media outlets reported that Eddie Redmayne was in talks to play Christopher Wylie, while Peter Farrelly was being considered to direct. At that time, the project had no distributor attached and remained in development.