Evidence of meeting #109 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was scl.
A video is available from Parliament.
8:50 a.m.
Conservative
The Chair Conservative Bob Zimmer
Good morning, everybody, and welcome to the Standing Committee on Access to Information, Privacy and Ethics meeting number 109. Pursuant to Standing Order 108(3)(h)(vii), we are doing a study of breach of personal information involving Cambridge Analytica and Facebook. Today with us is Christopher Wylie, via teleconference from the U.K.
Thanks for coming, Mr. Wylie.
Have you been made aware that you're going to be sworn in today?
8:50 a.m.
As an Individual
I, Christopher Wylie, do solemnly, sincerely, and truly affirm and declare the taking of any oath is according to my religious belief unlawful; and I do solemnly, sincerely, and truly affirm and declare that the evidence that I shall give on this examination shall be the truth, the whole truth, and nothing but the truth.
8:50 a.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Mr. Wylie. It's unfortunate that you couldn't be with us today, but we understand you're testifying in the U.K. on the current case that's before Parliament in the U.K. We appreciate it. It would have been nice to have you here, but we realize your obligation is over in the U.K.
Would you like to have any opening comments, Mr. Wylie?
8:50 a.m.
Conservative
The Chair Conservative Bob Zimmer
We'll start off. The first question goes to Mr. Erskine-Smith, for seven minutes.
8:50 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Thanks very much, Mr. Wylie.
First, just a short question is, can you confirm how long you worked for Cambridge Analytica?
8:50 a.m.
As an Individual
Yes. Does your question have to do with Cambridge Analytica precisely, or are you talking also about SCL Group?
8:50 a.m.
As an Individual
I was the director of research. I started my engagement in July 2013 with SCL Group, and I completed that engagement around the end of October or November 2014.
8:50 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
I have a couple of quick confirmations. By the way, when I say Cambridge Analytica or SCL, I'm going to refer to them both together. Cambridge Analytica/SCL worked on the Brexit campaign for Vote Leave and related campaigns, and in the U.S. election on behalf of President Trump. Is that correct?
8:50 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
To your knowledge, these campaigns used the information improperly collected by Kogan from Facebook users.
8:50 a.m.
As an Individual
I did not work on the Trump campaign, so I cannot speak specifically to what specific data was used or not used on the Trump campaign. What I can say is that the foundational modelling and data assets of Cambridge Analytica were derived from the Kogan dataset that you're referring to.
8:50 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
We had Chris Vickery start us off here at our committee. He indicated there was this master dataset that included a number of different points of information, from U.S. election lists to the RNC trust. He even referenced the Koch brothers. We have one example that really was the foundation for why we started this study, which was of Cambridge Analytica improperly collecting information through Kogan from Facebook. Do you have other examples that you can point to of improper collection of personal information by Cambridge Analytica or SCL?
8:50 a.m.
As an Individual
The most concerning misappropriation of information relates to Facebook data in the United States. However, I am also aware that in other countries the company, whether it was under the auspices of SCL Group or under the auspices of Cambridge Analytica, did attempt to misappropriate other datasets. To be clear, those datasets weren't necessarily Facebook or social media datasets, those could have been government records or private company records, for example. To give you an example, my understanding is that in Trinidad there was an attempt to procure online browsing histories of citizens—
8:55 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
The idea is to compile all this information from as many sources as possible into one master dataset.
8:55 a.m.
As an Individual
Yes. That's what you call the database of record, or the DBOR.
The idea of a DBOR is to create what you would call a “single citizen view” or a “single customer view”.
The more information you have from different contacts about a person, the more you are able to accurately infer their behaviour. If you have a dataset that shows their consumer behaviour, you're able to predict certain facets of that person. If you also have online data, whether it's social media data, clickstream data, or cookie data, you're able to see another facet of that person, etc.
The idea of a DBOR is to create a holistic view of a person so you can more accurately predict different facets of their behaviour.
8:55 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Mr. Vickery suggested that there were very personal aspects of people's lives. The example he pointed to was leading a Biblical life, whatever that might mean. That was a way people were tagged.
In your view, what's the most personal information you saw in these databases that was acted upon?
8:55 a.m.
As an Individual
It depends on the definition of “most personal”. I guess it's relative to what each person considers most personal.
To give you some examples of things I think most people would consider highly personal: religious views, sexual orientation, even the fact that the wider datasets were being used to infer attributes in people related to their psychological disposition, which they may or may not have known or wanted to be inferred. If you are inferring, for example, some sort of psychological neurosis in a person, that may feel very sensitive and very personal, even if that data wasn't necessarily collected as such but rather inferred from the other data that was collected.
The issue is not just what direct observations were acquired in datasets but also how less intimate observations can be transformed into inferred information about things that would be quite personal.
8:55 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
You mentioned that it could be used for a range of different purposes. To a large degree at this committee, we've been dealing with political purposes. The information you saw collected for a range of different purposes, including from political parties, perhaps was put into this master database. Was information collected for political purposes or from election lists used for commercial purposes?
8:55 a.m.
As an Individual
When I was there, the primary focus after the Mercers and Steve Bannon took over was for political purposes. I know there was planning to do commercial projects, and I believe the company subsequently did perform commercial work for various companies. To be clear, I didn't work specifically on commercial projects, simply for a company itself.
8:55 a.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
My last question is in relation to custom audiences. Just practically, for the sake of Canadians but also our committee, when you have this personal information about people and you want to target people, presumably you are creating a custom audience and then uploading that custom audience to advertise to that custom audience. Perhaps explain the mechanics of how this works.
8:55 a.m.
As an Individual
A custom audience is what Facebook would call a list of particular people who have been identified externally to create your target universe. Essentially there are a few ways to target on Facebook.
One is using Facebook's own targeting applications, for example, picking different likes that you want to target, or wanting to target people in Alberta but not Saskatchewan, that kind of thing. That doesn't involve specific lists of people. It just involves attributes, and then Facebook pulls people who match the attribute. In that process, you don't engage what is called PII, personally identifiable information.
The other way you can target ads on Facebook and other sites like Facebook is through custom audiences. This is where you have a list of people, for whatever reason, whether it's because of an algorithm or simply because of an observed attribute you want to target. You upload a list of specific individuals from your own database into Facebook, and then Facebook targets only those individual people. That directly involves the management of PII.