The investigation no one is talking about
Updated: Feb 3, 2021
(8 minute read)
On March 23, 2018, the Information Commissioner’s Office in the United Kingdom raided the headquarters of the now defunct British consulting firm Cambridge Analytica - the same firm that claimed to have 2,000-5,000 data points on every U.S. voter in the 2016 election. The Information Commissioner, Elizabeth Denham who heads the agency, told Parliament that the ICO seized, “700 terabytes of data, which is equivalent to about 52 billion pages, of information from Cambridge Analytica.” On those servers is believed to be information regarding Cambridge Analytica’s illegal scraping of 87 million users Facebook data, alleged illegal dealings with the Trump and Brexit campaigns, possible information into contracts sought out in Russia - particularly with Lukoil, the second-largest oil company in Russia - and millions and millions of data points on users that were psychographically targeted in elections around the globe.
In April of 2019, the Deputy Information Commissioner, James Dipple-Johnstone, told the select committee on Digital, Culture, Media, and Sport (DCMS) who headed the investigation into Cambridge Analytica, that the ICO hoped to publish a report in the autumn of 2019. The report is now almost a year late.
But a recent development casts a shadow on the now two-year-long investigation into those servers. On August 27 of 2020 Dr. Emma Briant, an expert and lead researcher on Cambridge Analytica, published an email response she received from the ICO after inquiring about the release date of the ICO’s final report. The ICO told Briant that “no further reports are intended to be published aside from those that already exist on the ICO’s website” and further claimed that the release of such reports is “at the discretion of the Commissioner [Elizabeth Denham].”
The non-departmental body, the ICO, responsible for upholding information rights in the public interest, promoting openness by public bodies and data privacy for individuals has certainly changed their tune from July of 2018 when they stated in their investigation update that, “There is a considerable amount of relevant material to review from retrieved servers and equipment.” And in their November 2018 update, the ICO stated that “a number of the issues set out in this report are still ongoing, or require further investigation or action,” meaning there was still considerable work to be done. The ICO failing to provide a final report should concern citizens around the globe.
The ICO failed to cooperate with the U.S. Senate
In August of 2020, the U.S. Select Senate Committee on Intelligence (SSCI) published volume Volume 5 of its bipartisan report into Russian interference into the 2016 election. It was 966 pages. In that report were 40 pages dedicated to explaining companies “for hire” who played significant roles in the 2016 election. The most prominent company investigated by the SSCI was Cambridge Analytica. But the SSCI reported that it was “unable to obtain the corporate communications of Cambridge Analytica or SCL Group, which had already been seized by U.K. authorities.” Why an allied government chose not to cooperate with the U.S. Senate's historic investigation into Russian interference is currently a matter of speculation. But it is concerning to see the lack of cooperation over such a global issue. The Deputy Information Commissioner has also stated that “some of the systems linked to the investigation were accessed from IP addresses that resolve to Russia and other areas of the CIS [Commonwealth of Independent States].” Especially considering the fact that Elizabeth Denham, the ICO commissioner and the person with the authority to release the report, has publicly said that “this is a global issue [data protection], which requires global solutions,” and that “data crimes are real crimes.”
The ICO is woefully underfunded
According to Teiss, “only 3% of its [the ICO’s] 680 staff is focused on tech privacy problems.” Despite being the most funded data protection authority in the European Union (EU) - and the most expensive to run - the ICO has lacked adequate resources in investigating the matter of Cambridge Analytica. When whistleblower Christopher Wylie gave evidence before the select DCMS committee he said that “they [the ICO] have had to ask me a lot of questions...before going in to search an office [of Cambridge Analytica], asking questions, fairly basic questions, about databases; even just asking, ‘What are the file names called?’” This goes to show that the lack of resources the ICO has made it incredibly difficult for the agency to act quickly and effectively when seizing the servers. The ICO also lacks regulatory authority to issue substantive fines. In 2018, the ICO issued its maximum fine to Facebook for £500,000 ($667,552.50) due to the company's lax data practices that allowed Cambridge Analytica to scrape data from 87 million users. But Facebook is worth over $527 billion. That fine is by no means a harsh or deterring regulatory action. This goes to show that the ICO has finite resources and power. But in the course of more than two years, the ICO has poured many of its resources into a critical investigation over the safety and security of the electoral process around the globe, just to drop the investigation at the last moment?
Questionable oversight
What is most concerning about this matter seems to be the lack of oversight. Elizabeth Denham and the rest of the ICO has consistently demonstrated a commitment to producing a thorough report detailing important information to not just citizens of the U.K. but around the globe. Denham has appeared before the EU parliament advocating for data protection laws to better secure the rights of citizens not just in the U.K. But the opaque nature of the ICO’s latest development has left many scratching their heads wondering if this was a call made from the powers above.
According to the ICO’s Management agreement for 2018-2021, “the ICO may be reviewed periodically, by DCMS,” which has been a fairly common practice as we have seen throughout the ICO’s investigation. However, the ICO can also be reviewed periodically by the “Cabinet Office and HM Treasury guidance.” And particularly Michael Gove, the Minister for the Cabinet Office, and Dominic Cummings, the Chief Adviser to Prime Minister Boris Johnson. Michael Gove is Elizabeth Denham’s boss. But what’s more, is that Cummings served as the Campaign Director and Gove as a co-convenor of the Vote Leave campaign - Britain’s vociferous campaign to leave the European Union. In 2018, The Guardian and the DCMS committee found evidence that Vote Leave hired subcontractors and engaged in business with Cambridge Analytica. That was a matter the ICO would ultimately decide if there had been substantial work undertaken by Cambridge Analytica for Vote Leave which would be a breach of the U.K. and E.U.'s new General Data Protection Regulation (GDPR) laws.
But, in a sense, it seems that Cummings and Gove are overseeing an investigation into their own campaign. That’s where real concern has been raised by experts and journalists following the matter closely.
No coverage
A simple Google search reveals no relevant results for the “ICO Cambridge Analytica report.” The mainstream media has failed to cover a critical point in the investigation into Cambridge Analytica who have now liquidated and its previous management has disappeared into hiding escaping all legal and regulatory challenges that would have been made against them. Even The Guardian and the Observer's Carole Cadwalladr who has extensively covered the issue of Cambridge Analytica has yet to weigh in with any media coverage beyond Tweets of the latest developments. While technology journalists were all over this story when it first broke, journalists and the media have begun to opt not to cover the story of Cambridge Analytica more and more. It’s anyone's guess what is on those servers that the ICO seized from Cambridge Analytica - some of which were physically and technically damaged in an attempt to hide any traces of nefarious or illegal activity. The only people who know definitively are those who work in the ICO and what's more concerning and more likely, British government officials.
What’s next
In the latest development of this saga, Carole Cadwalladr released a statement obtained from the ICO that says, “As part of the conclusion to our data analytics investigation we will be writing to the DCMS select committee to answer the outstanding questions from April 2019. We have committed to updating the select committee on our final findings but this will not be in the form of a further report.”
But it seems that mere questions over 700 terabytes of information won’t be sufficient to completely unravel the truth behind Cambridge Analytica. What’s more, the current members of the select DCMS committee have replaced the likes of Damian Collins and Ian Lucas who were staunch advocates for concluding this investigation. The current select committee has shown apathy to providing thorough oversight and searching for conclusions to this investigation.
DIG is currently in the process of working to uncover whatever information is out there that can be made available to the public. In an attempt to understand why the ICO did not comply with the U.S. Senate’s investigation, I have asked to see communications between the SSCI and the ICO to understand what justification the ICO gave for not working with the SSCI in completing their report. I have contacted nine offices of senators to date, and am actively pursuing lines of inquiry with three.
I have also submitted letters to all 11 members of parliament of the select DCMS committee in the United Kingdom imploring them to provide oversight of the ICO and urging them to publish the final report.
Finally, I have submitted news tips to The New York Times, The Washington Post, NBC News, the BBC, The Guardian, CNN, NPR, and others asking them to cover this story.
DIG will continue to keep investigating and is committed to ensuring the public is aware of what is happening regarding this issue.
If you have information regarding this matter please contact us at discussionisgood@gmail.com.