Information & Ethics Committee on May 3rd, 2018

[The Chair, Conservative, Bob Zimmer]

I will call order meeting number 104 of the Standing Committee on Access to Information, Privacy and Ethics. Pursuant to Standing Order 108(3)(h)(vii), we are studying the breach of personal information involving Cambridge Analytica and Facebook.

Today we welcome our friends from across the water. From the United Kingdom House of Commons Digital, Culture, Media and Sport Select Committee, we have Mr. Damian Collins.

Welcome to Canada this morning.

[Damian Collins, Chair, MP, United Kingdom House of Commons Digital, Culture, Media and Sport Select Committee]

Thank you. It's a pleasure to be part of your inquiry.

[The Chair, Conservative, Bob Zimmer]

We appreciate your time.

Go ahead. We'll hear your opening comments. Then we'll open it up for questions.

[Damian Collins]

Thank you, Mr. Chairman.

I thought I would just set out the nature of the work we're doing in the United Kingdom at the moment.

Our inquiry is slightly different in scope from yours. It's looking at the use of fake news and disinformation and the disruptive impact they have on elections and democracy. A particular focus in recent weeks has been the use of data in targeting voters with particular pieces of information, the lack of transparency of that and how it's done and, in particular, the legality of some of those practices, particularly if information about people's political views is being held by private companies and consultantcies and being used in campaigns directed toward them.

We are conducting our inquiry as a parliamentary committee, and therefore as a consequence of that work, there's been a particular interest for us in the work of Cambridge Analytica, SCL, and AggregateIQ, particularly because of AIQ's work in the European referendum, the Brexit referendum in the U.K. We have particular interests in that area.

We're also working quite closely with the U.K. Information Commissioner. She is conducting an investigation into these matters, as you know. In particular, she is looking at the use of data in elections. She'll be producing a policy report on that later this month, as well as conducting what are now criminal investigations of certain individuals involved in this work. The U.K. Electoral Commission is also conducting an inquiry into some of the questions around the way in which the leave campaigns were run and whether there was coordination between them in the U.K. during that same referendum as well.

We have three separate inquiries going on. They overlap in places but will report separately.

Certainly for my committee, our main interest at the moment, as part of our disinformation campaign, is looking at the way data is used to target the information of people on social media.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Collins.

We'll open it up for questions, starting with Mr. Erskine-Smith.

You have seven minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much, Mr. Collins. It's nice to see you.

My first question is about AIQ. We certainly had them before us, and they were less than forthcoming. Have they agreed to testify before your committee?

[Damian Collins]

They've agreed in principle to testify. They wanted to get back to us to confirm when they would testify, but after they've given evidence to your committee. We are currently in discussions with them about when they will give evidence, but I hope that will be in the next few weeks.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm curious. We typically do not swear witnesses in, although we have the powers to do so. Have you sworn in witnesses in the course of your investigation and inquiry?

[Damian Collins]

No, we haven't yet. Similar you in Canadian House of Commons, there is a general presumption that people should tell the truth in front of parliamentary committees. It can be considered contempt of Parliament if you don't.

We do have a separate power to get people to swear on oath, which would carry a similar offence to perjury if someone were found to have lied under oath, but we've not yet used that. It's certainly not the custom in the British House of Commons to use that, but it's a power we can use.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It's the same in our Parliament, of course. It's not our custom traditionally, but I would encourage you to consider it when you have AIQ before you.

When Chris Vickery testified before you recently, he seemed to directly contradict the testimony we heard from AIQ. Perhaps you could give a brief rundown for our committee the nature of that testimony and how directly in conflict it was.

[Damian Collins]

Chris Vickery identified on GitLab a set of files and data that had been placed there by AIQ. He made a copy of that dataset, and he's given us a copy, but he also discussed some elements of that data and what it contained when he gave evidence to the committee.

What it does seem to demonstrate, though, is the high level of coordination between AIQ, SCL, and Cambridge Analytica, the ability to access and share information in files between those different companies. Also, all of the data that was being managed as part of the Brexit referendum campaign was interchangeable and easily shared. Indeed, at some point, all of that information was made publicly available on the web.

Of course the question is, why was it made available in that way? Was that just a mistake that someone made? Chris Vickery seems to think it could have been a mistake. But, of course, it could have been done deliberately so that the people they wanted to find it could find it if they knew what they were looking for—and Chris Vickery managed to find it.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Obviously, we are not engaged with the issue of Brexit. Our investigation was specific to the Facebook-Cambridge Analytica data scandal. However, we heard testimony that seemed to be relevant to your purposes. We heard testimony from AIQ that there wasn't coordination between the various Brexit campaigns, and yet the evidence seemed to directly contradict their testimony. Their testimony and the answers they gave us didn't seem all that solid.

What are the next steps for your committee in examining this, and can our committee be of assistance?

[Damian Collins]

Absolutely. One of the reasons I was particularly pleased to be speaking to you today is that I think the more closely our respective committees coordinate in examining these issues, the more effective we will be. We have different jurisdictional powers but common interests. I think the evidence that you received from AIQ is certainly significant for us. They said that the invoices that have come from different campaign groups in the referendum campaign were paid by Vote Leave, which would suggest a degree of coordination. Certainly, in the management of data, there seems to be coordination by AIQ across different campaigns. We know that the U.K. Information Commissioner is trying to get access to the data and has been frustrated in that process.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

On the point of co-operation, I completely agree with you. That's why we had been in touch with you one how important co-operation is even before your attendance today. What specific areas of co-operation do you see? Are there witnesses you think we should hear from that we perhaps haven't heard from? One option would of course be to have AIQ back after we've heard from Christopher Wylie and other potential witnesses. Maybe you could give us some broad strokes on how you think we could co-operate going forward.

[Damian Collins]

Just to give you an idea of what we're looking to do next, we want AIQ to come in front of us. We want Alexander Nix to come back in front of us as well. We also want Dominique Cummings to give evidence to the committee about the work of Vote Leave. We're also interested in hearing from Arron Banks and Andy Wigmore of Leave.EU. I think there could be other areas where we have a common interest. I think one of the key things on jurisdictional issues is where the AIQ servers are and where they service data from. Are they in Canada, or are they in the U.K.? I know that the U.K. Information Commissioner is Canadian herself. I know she's obviously seeking to pursue all of this in fine detail.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Of course, we can continue to co-operate, and since AIQ is a Canadian player we can have them back if they refuse to co-operate with your committee going forward. Certainly, we'd be interested in doing so.

We heard a revelation yesterday that Cambridge Analytica and SCL Group are declaring bankruptcy. Perhaps it comes as no surprise that they're looking for a way out. How does this impact your inquiry, if at all? What steps are you taking in the course of your investigation to deal with that new information?

[Damian Collins]

As far as we're concerned, it doesn't change our inquiry at all. I discussed this just this morning with Elizabeth Denham, the Information Commissioner. As far as she's concerned, it doesn't make any difference to her inquiry, either. She's investigating whether civil criminal offences have been committed. She can pursue the directors of these companies even if the companies themselves have been declared insolvent. She can still press charges, issue fines, just as she would have done before. There is an interest in saying that if wrong-doing has occurred, people should be able to go after the wrong-doers and they should face whatever penalties they should face. There's also a public service provided in being able to say in public what happened, what these companies did. Did they breach the law? How it [Technical Difficulty—Editor].

Your final question talked about some of the parties we're interested in seeing again who are directly involved in this particular issue, and we are seeking to pursue Facebook as well, as I know you are doing, too. Of course, a lot of these interactions are with Facebook and Facebook data, because Facebook itself is an important repository of information that would be useful to us—if only we could get hold of it.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Erskine-Smith.

Next up is Mr. Kent.

[Peter Kent, Conservative, Thornhill, ON]

Thank you, Chair, and thank you, Mr. Collins, for hooking up with us today.

Just to follow on the last question regarding Cambridge Analytica's declaration of bankruptcy and announcement that it's shutting down, what provisions or protections are in place to prevent the destruction of evidence in your inquiry and the Information Commissioner's inquiry?

[Damian Collins]

Well, you are right to say there is that risk, but [Technical difficulty--Editor] had already received a warrant and had the power to go into Cambridge Analytica's offices and take their servers and information that was relevant to her inquiry. She holds that. I know they—as we have done as a committee—have received a great deal of information and evidence directly that we can investigate.

I think we are in quite a strong position there, but of course both we and the Information Commissioner, in particular, can follow the data trail wherever it takes us. If that takes her into companies like Emerdata, which is another entity that is effectively connected to SCL and Cambridge Analytica, then she can pursue it there as well. There's no limit to where she can go while following the data and the people connected with it.

I think an interesting issue here—and this is something we discussed with Chris Vickery yesterday—is that we talk about these companies as though they are legal entities and physical companies. What if they're not really that at all? What we're dealing with is massive data and tools to process it and people who do it. They wear different hats and sit in different organizations, but effectively, it's just one thing. In that case, we can still go after the thing, even if the brass plates on the door are changed.

[Peter Kent, Conservative, Thornhill, ON]

Also, following up on your suspicion of the possibility—even probability—that AIQ's files were left open for users to come in to use as they might, but still giving AIQ plausible deniability that they were not engaged in improper or even criminal activity, AIQ's testimony to us also indicated that they had received data, but didn't particularly care where that data came from. They merely massaged it through their different programs like Saga and others.

Have you discovered this as well? Do you see this as an attempted defence of their basically trafficking in improperly acquired or stolen property?

[Damian Collins]

Well, I think an area of great concern is where this data is coming from, and obviously, with the Cambridge Analytica data breach and the data acquired through Aleksandr Kogan, we're looking at that directly.

Looking at the transcript of AIQ's evidence to your committee, I think they're very careful in the words they use. They talk about being a whole big dataset and that they don't hold the data. That may be technically true if exists in the cloud somewhere, but they have access to it. They may say, “We don't have big databases of data. We don't keep data”, but they may have access to it, and they can use it.

Certainly the techniques that have been used here seem to be the gathering of multiple datasets, some of it commercial data that can be acquired through companies like Experian, some of it data acquired from Facebook profiles, and some of it voter data and other data—anything you can get your hands on effectively all put into the mix. You get the very sophisticated profiling of individuals crucially linked to their Facebook profile with the ability then to target them directly through Facebook in that way. Not only that, but you can also create a custom audience of those people, and then take that up to Facebook. Facebook will then find you a look-alike audience of people like them that will make your campaign even more widespread and successful.

What's clear is that, once you've built these custom audience datasets, and you've linked them back to Facebook, you don't need the original datasets anymore. These companies can then say—and maybe honestly—that they've given back that data or have destroyed that data. That may be true, but the derivative of that data is something they own in perpetuity, and there's certainly nothing Facebook can do to get that data back.

As you rightly say, there could be all sorts of datasets acquired in there. Our concern would be if that data had been acquired illegally. That's a serious a matter, and we as a parliamentary committee would certainly come to a view on that, but it's right that the UK authorities would seek to bring criminal charges against people who have broken the law.

[Peter Kent, Conservative, Thornhill, ON]

Going back to the source of this evolving scandal, Mr. Kogan, he still denies.... He says he's being scapegoated, that what he did was common practice, that Facebook has endured harvesting—improper harvesting, if you will—by any number of companies. He says that what he did was perfectly legal and within the terms of Facebook service. Now, that's obviously one of many contradictions, denials, deflections, mistruths, and flat-out lies that we have seen through the testimony to our committees.

Is there an element of truth in what Professor Kogan says, that he may well be only a very small part of a much broader misuse of harvested social media data, whether from Facebook or anywhere else?

[Damian Collins]

I think that's right. Sandy Parakilas gave evidence to our committee a few weeks ago. He used to work at Facebook and had oversight of their relationships with developers and the way they use data. His concern was that abuse of data was widespread; large amounts of data were being taken from the platform by developers; there was no real scrutiny by Facebook of what they did with it and how they did it. My contention with the Aleksandr Kogan data would be that I think Facebook would never have known about it if it hadn't been for a newspaper article in The Guardian in the U.K., which exposed it; and they then followed up on that once they'd been told. I don't think they have any monitoring or auditing of what happens to data acquired by developers.

However, there's another question. Kogan is right to say that, well, the terms and conditions for using the app he created say that he may want to give that data to other people. The question then is why Facebook didn't stop that at the time. Why did they approve it and let him do this? Clearly, Dr. Kogan would have known, and should have known, that to do what he did was a breach of Facebook's rules. I think there's, then, a separate question about the existing U.K. data protection law at the time he did it, which has got quite strong provisions in place to stop people holding political data about people and gathering data to use in political campaigns. I think he should have known that there were certainly serious legal questions about what he was doing.

[Peter Kent, Conservative, Thornhill, ON]

This is a very short question, as my time is almost up.

What is the timeline for your study, your investigation, and do you expect to have any firm, hard conclusions at that outcome? Furthermore, what is the timeline of the Information Commissioner's investigation?