Information & Ethics Committee on May 3rd, 2018

[Damian Collins]

In the parliamentary inquiry, we are aiming to report before the summer recess in the U.K., so that is around July 20. That's what we're looking to do. We'll be holding all evidence hearings into June, but then we'll look to bring our findings to a conclusion at that point and produce our first report. As we said, we'll be looking to make concrete conclusions based on what we think happened and based on the evidence we've received. Also, as is normal for select committees in the House of Commons, we'll make policy recommendations to the U.K. government. The government has already given ground on one of the issues we have championed, and that is on additional powers for the Information Commissioner, for her to be able to have no notice period before arriving to take and seize data, so we don't have a repeat of what was a farcical situation where it took her five days to get a warrant to go into Cambridge Analytica. She will have substantially enhanced powers, which will help the conclusion of this investigation and future ones too.

In terms of her work, I believe she's looking to produce a policy report, looking at the general issues of data use in elections, and she's aiming to produce that report by the end of this month. I certainly believe it's her hope that she would have concluded the initial investigations into criminal and civil offences, again, I think probably by July. I know that she's received a lot of new information; therefore, it's possible that it might take longer.

[Peter Kent, Conservative, Thornhill, ON]

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Kent.

Next up, for seven minutes, is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Collins.

It's a pleasure to have you with our committee today. In my 14 years in Parliament, I've never seen a situation where one of our committees is actually speaking to a committee in the U.K., or in any other jurisdiction, but maybe it is a reflection of the nature of the big data beast that all of us are dealing with, which is very much cross-border and almost beyond the jurisdiction of domestic laws, as they seem to think.

You could probably help us get a better sense of some of the questions that we were left struggling with after AggregateIQ came before us, because they are listed as SCL Canada; Zack Massingham is identified as having the phone for SCL Canada. He says there's no connection between AggregateIQ and SCL. Do you think that's a credible response?

[Damian Collins]

The evidence we've received contradicts that. We've been told by Chris Wylie and Brittany Kaiser that, as far as they were concerned, that's what it was. It was SCL Canada, and indeed there are documents that Chris Wylie gave us that show employee lists and directories where SCL Canada is listed. We know there's a huge number of projects that SCL and AIQ worked on together—the staff teams worked together—going back a number of years; and there's a document we published, which Chris Wylie gave us, which is about a project in 2014 done for Ambassador Bolton's super PAC, the campaigns they were supporting in the mid-terms in America that year. Again, there were staff members from SCL, Cambridge Analytica, and AIQ all working on the same projects, including Dr. Kogan as well.

The impression you get is one of a high-level of integration and partnership, and the evidence we had from Chris Vickery, yesterday, looking at these datasets he found on GitLab would, again, suggest that this is an entity of work that is totally integrated.

[Charlie Angus, NDP, Timmins—James Bay, ON]

That's very helpful.

Our concern also, which we couldn't get a clear answer on, was how did this obscure company in Victoria, British Columbia, get every single contract for the leave campaign. That didn't seem credible.

The question is what would be the role of SCL? Can you explain to us how SCL, as the parent company, would have played a role in this and the credibility of AIQ suddenly stepping into the Brexit campaign and getting all those contracts?

[Damian Collins]

It's a really interesting question. I thought it was a great question to ask them how they had come to get this contract given that they had no links to the U.K. and were a relatively small company.

There are things we know. Brittany Kaiser told us that there was an initial introduction to Leave.EU—the other campaign, Arron Banks' campaign—to Steve Bannon. They made an introduction through Arron Banks to Cambridge Analytica. Cambridge Analytica were working with Leave.EU from the autumn of 2015 through to the point where Leave.EU didn't get the nomination to be the official campaign. Leave.EU say they never paid Cambridge Analytica for that work they never got, but they had a contractual relationship with them. There are still some questions around that. We know that links between Cambridge Analytica and SCL seemed to continue after the official designation was made. They were involved in supporting Arron Banks' visit to Washington, D.C., before the referendum. There seem to be close links there. Some of the these things are even detailed in Arron Banks' book and he refers to the fact they hired Cambridge Analytica. There seems to be quite a strong relationship there.

With AIQ one of the things we're interested in understanding more about is how the introduction was made of AIQ to Vote Leave when Vote Leave got that official designation. Who was responsible for that introduction? It does seem very strange that you have what, at the time, seemed to be unconnected companies. We know now that the companies, even if they weren't one legal entity, were highly coordinated in the way they worked together and were potentially advising two sides of the same campaign.

[Charlie Angus, NDP, Timmins—James Bay, ON]

That leads me to my next question, because we heard the news that SCL and Cambridge Analytica are closing up shop and how hard it is for them. I'm looking at this new company, Emerdata Limited, which has the same address as SCL. Rebekah Anne Mercer from SCL, Jennifer Mercer from SCL, Julian David Wheatland from SCL, Alexander Tayler, Mr. Nix, are all now working as directors at Emerdata.

Have you looked at any of the role and the work of Emerdata? Is that part of your committee work at all?

[Damian Collins]

It's a good question.

We certainly ask questions about Emerdata. As you say, they seem to be completely connected to these other companies. Therefore, if Emerdata is holding information, documents, datasets that are relevant to our inquiry, there's no reason why we couldn't go after that. The same would apply for the Information Commissioner as well. Again, we seem to have a series of entities that are highly interconnected, with the same people, who one would imagine are using some of the tools and information. I've not been there. The office is in Westferry Circus, the one, I think, you're referring to.

I've not been down there but I was told by a journalist in London this morning who has been there that there seems to be no evidence of anyone working at that address at all. Again, the nature of this company, what it is, and what it does, is unclear. But if that company is the legal guardian and owner of data, information, and contracts that are relevant to our inquiry, then it would certainly fall within it.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

I received a letter last night from UpGuard. We'll present that letter to the committee today. They are very concerned that this legal decision to shut down Cambridge Analytica could allow them to start erasing and getting rid of data. They're concerned about data that may be on other hosting sites. They're looking to see if there have been any preservation requests for Cambridge Analytica data, or SCL or AggregateIQ, particularly with third-party service providers such as Amazon Web Services.

Have you put any of those data preservation requests in?

[Damian Collins]

No. That would probably be for the Information Commissioner to do. I don't know whether she has done that. I did speak to her earlier today and she reassured me that as far as she was concerned, she had all the powers she needed to complete her investigation. I know she has access to and has received a large amount of data, which they are currently working through. You're right to raise these concerns. There may be data that does not yet fall within the scope of the inquiry, and that we don't yet know about or have access to, and that could be destroyed. I don't know if these files are held in the cloud by Amazon as a storage provider or another company. I don't know what the scope is to go back to that company to get the original files if an attempt were made to erase them. That's certainly a question that I will put to the Information Commissioner in the U.K.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you very much.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Angus.

Next up, for seven minutes, is Mr. Saini.

[Raj Saini, Liberal, Kitchener Centre, ON]

Hello, Mr. Collins. Thank you very much for being here.

I first want to touch upon some testimony that was given in front of your committee by Mike Schroepfer, the chief technical officer at Facebook. To me it seems that this whole situation began, as you said, with an article in The Guardian. Since then Facebook has finally admitted that probably 87 million Facebook profiles were compromised, one million of them in the U.K.

Under questioning regarding the influence on the Brexit referendum, Ms. Elliott said that the campaign was run based on email lists, that it had acquired email lists of people from some source—Mr. Kogan's app. Mr. Schroepfer goes on to say that it could not have been his app, because he didn't acquire an email list. He said that AggregateIQ must have acquired that data from some other source.

Have you investigated what other source that could have been? It seems to me we're all chasing the same data, but the chief technical officer is now saying that it could have been some other data.

[Damian Collins]

I think there are a couple of quite important things there.

With regard to the data collected from Dr. Kogan's survey, that would seem to be primarily psychological profiling of people who completed the survey, but then crucially linked to their Facebook profile. I think that's important, because if you then take that data and add it to other datasets they may have acquired, and the email lists that the campaign group itself had acquired, you can then not only merge all those datasets together, but you can also tie it back to the Facebook user profile, which helps you to retarget the individual back through Facebook, where Facebook is effectively acting like a giant telephone exchange, and you're programming the data in, not generically to categories of people, but to named individuals.

Mike Schroepfer was saying that the Kogan datasets wouldn't have included email addresses. That could be right. They could have just found those emails in other ways. But from the evidence that we had yesterday from Chris Vickery, I think it's clear that you can have many different datasets that you process together through your targeting tool and then use that for the basis [Technical difficulty—Editor] Facebook.

[Raj Saini, Liberal, Kitchener Centre, ON]

So there is an overlap going on with different datasets?

[Damian Collins]

Yes, absolutely.

[Raj Saini, Liberal, Kitchener Centre, ON]

Also, in written testimony, Mike Schroepfer says that they also found “billing and administration connections” between SCL/Cambridge Analytica and AIQ.

Have you done any research into any of these connections?

[Damian Collins]

This is one of the issues we want to follow up on with Facebook to see if they can help us.

I wrote to Mark Zuckerberg on Monday with a list of over 40 outstanding questions and issues from the Mike Schroepfer session. That's one of the reasons we want Zuckerberg to come back—there are so many outstanding questions. But this is an important issue.

I know that the Information Commissioner in the U.K. has been in contact with Facebook about her inquiry, but I think this is one of the key issues, not for the Information Commissioner, but for the Electoral Commission and U.K. election law. If there was coordination between different campaigns, that's an issue. And I think we will understand more about the day-to-day coordination between these companies as well.

[Raj Saini, Liberal, Kitchener Centre, ON]

I know that yesterday Mr. Vickery gave you a hard drive. It might be too soon, but have you started the analysis procedure of reviewing what's on the hard drive?

[Damian Collins]

We haven't started that process yet. We're putting our apparatus in place to start it. It's a lot of information. I think he said that the compressed files are 19 gigabytes of data, so the whole files will take some time to go through, and we need to get a team of people in place to do that.

I also spoke to the Information Commissioner to let her know that we have this dataset, but as a parliamentary committee, we're keen to go through it ourselves to see what it contains. There may be information that's both relevant to our inquiry and helpful to the Information Commissioner too, but it's going to be quite a task.

[Raj Saini, Liberal, Kitchener Centre, ON]

Are you going to make that information public? Will we have an ability to review the information for the purposes of the work on this committee?

[Damian Collins]

Our primary task is to go through the data to see what's there, and then to take advice on what we can publish. There will be things that we want to publish, as a committee, but we want to make sure that in doing so it wouldn't prejudice other investigations that are under way. Although clearly, the people who created this dataset know what's in it, and it was taken down a few days after Chris Vickery discovered it. They will be aware of what it contains.

I need to take advice on it from the U.K. authorities, but we would certainly be very happy to share information. And I think Chris Vickery would also be happy to share it with your committee directly.

[Raj Saini, Liberal, Kitchener Centre, ON]

For my final question, when we look at the number of data profiles accessed by Cambridge Analytica and the worldwide downloads of that survey, it was about 270,000, which led to 87 million profiles being garnered. In Canada, fewer than 300 profiles were accessed, and 621,000 profiles were garnered.

According to Mr. Schroepfer's testimony, he said that 1,040 people had done the survey in the U.K., which led to a million profiles being accessed. To me, mathematically—going on what we heard—that is a very low number.

Is that a number you're confidant with, that one million only?

[Damian Collins]

This seems to be just from this app. That's based on the number of people who took the survey, and then an average of the number of friends that people had on Facebook at the time. That multiple gets you to around a million. Of course, there may have been other datasets and sources that were part of the data-gathering exercise as well, and then the targeting exercise that derived from that data.

When Brittany Kaiser gave evidence to us, she said that a good-sized working set of data, if you were going to plan a Facebook campaign, is around 40,000. If you have around 40,000 profiles with good mapping data, understanding who these people are, what motivates them, that's your good working set. Of course, then you can acquire look-alike audiences from Facebook as well, to grow that to help you target a much wider group.

Even if that were the limit of the data they acquired through Dr. Kogan's app, the power of that data is potentially significant.

Kogan also said to us that he didn't think that data, in and of itself, was worth very much, just with the surveying he was doing and the Facebook accounts they were linked to. But, of course, it was never intended to be used in isolation. It was intended to be used as part of a much richer set of data, of which this was going to be an important part.