Evidence of meeting #101 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was work.
A video is available from Parliament.
9:35 a.m.
Liberal
9:35 a.m.
Chief Operating Officer, AggregateIQ
They subcontracted us to do a portion of that work.
9:35 a.m.
Chief Operating Officer, AggregateIQ
I think I mentioned before, we did a political customer relationship management tool for a political party there, and—
9:35 a.m.
Chief Operating Officer, AggregateIQ
No, it was a completely different tool.
9:35 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Ripon is a separate entity? Every time you have a customer you develop individual proprietary software for each company?
9:35 a.m.
Chief Operating Officer, AggregateIQ
We do development in a number of different ways. Sometimes we make our own software, that we then license to clients along the way. Other times they will want their own custom software. In the case of Trinidad and Tobago, they were asking for some custom software.
9:35 a.m.
Conservative
9:35 a.m.
Conservative
9:35 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Thank you, Chair.
We learned from UpGuard, the data breach investigator that is associated with Chris Vickery's cyber-risk research, that two of the project families, as described by UpGuard, called Saga and Monarch, "are designed to gather and use data across a number of platforms".
Saga seems quite innocent and similar to programs that are used by political parties in perhaps a less sophisticated way, which is intended or "able to automate the creation, analysis and targeting of ads in way that would make it easy for a small number of people to manage a large number of Facebook ad accounts."
UpGuard says—and I'll ask you whether or not it's accurate—that "Saga was used specifically to interface with the Facebook ad system through APIs and scraping methods and gauge response to images and messages."
UpGuard says that Monarch takes up where Saga leaves off. Saga, they say, "is a tool capable of tracking what happens when someone clicks a Facebook ad, Monarch seems designed to track what happens afterward, giving a controlling entity a more complete picture of their targets' behavior."
Is this what is described as “psychographic profiling”, and is that essentially what Saga and Monarch do?
9:35 a.m.
Chief Operating Officer, AggregateIQ
No. Some of your description wasn't entirely accurate, so if I could explain....
9:35 a.m.
Conservative
9:35 a.m.
Chief Operating Officer, AggregateIQ
The security researcher, while he's able to see some of the code, is not able to see how we deploy or implemented that, so he can only make assumptions based on what he's looking at. The Saga tool does connect to the Facebook ad account side. That is where we place the ads in order to get numbers on how ads have performed over time for our clients. Monarch takes information that people voluntarily enter when they go to our customer's website. Indeed, many of the members here have websites that ask for the exact same thing. You might ask on your site, for example, “Please sign up to my mailing list.” You want to make sure when someone puts their email address in there they get signed up to a mailing list. That's what Monarch does. It helps to make sure that information gets to the right place on behalf of the client.
9:35 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
What UpGuard seems to be suggesting is that some of the data that would be provided to AIQ to process and to report on may have been improperly harvested.
9:40 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Do you have any way of knowing whether or not the data you're dealing with is properly or improperly harvested?
9:40 a.m.
Chief Operating Officer, AggregateIQ
Yes and no. With the information that we get from Monarch or Saga when we implement that for a client, that's information that is provided by people who visit their website voluntarily when they enter their information on the website, like joining a mailing list, volunteering, or whatever it happens to be. The information from Facebook is completely anonymous information on the performance of a particular ad—whether it was seen x number of times, how many times it was clicked on.
To your question about processing data, we don't really process data for folks. We take information that they provide to us, like a voter list, as I mentioned, and put it into a tool like the political customer relation management tool.
We're not data harvesters by any stretch of the imagination. Certainly, we don't do psychographic profiling, or profiling of any other type. We're not psychologists; we're tech people, and we place ads.
9:40 a.m.
Conservative
Peter Kent Conservative Thornhill, ON
Have you or has AggregateIQ ever used a database like The Database of Truth or the Saga or Monarch programs to affect the outcomes of elections in Canada, either federal or provincial?
9:40 a.m.
Chief Operating Officer, AggregateIQ
We have done work in Canada, though not for the federal parties. Do we use information in the tools that we've created and deployed for a customer to help influence the outcome of the election? I would suggest that the volunteers and the candidates who use that are certainly trying to influence the outcome.
When you go door to door, I expect you're doing so because you would like to influence the person you speak to into perhaps voting for you. It's really no different from what we do. The ads that we show are the digital equivalent of an ad on someone's lawn or on a street corner. You choose where you want it to go, you put your message on there, and people drive by and see it. It's the same for the internet. It's same with going door to door and the same with making phone calls.
9:40 a.m.
Conservative
