Information & Ethics Committee on April 17th, 2018

[Chris Vickery]

I want to be clear that I'm not here as a proponent of either party, but I can state for a fact that every voter data breach that I have found regarding U.S. politics, and every system of influence and so forth that I have looked at just recently in this past find, has been a Republican-based operation. I have not come across, to my knowledge, a Democratic system of selectively micro-targeting and influencing. Although it may exist, I have not come across it, so I can't speak to the Democratic side. I think it's clear that, yes, at the very least, the Republican side did, to great effect, utilize micro-targeting, compilations of disparate and wide-ranging databases, all-encompassing databases, from places you might not even expect, and, yes, brought it all together in a very effective way that sought out people who were influential and influenceable, and targeted those types of people with messaging to get a desired outcome.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you.

Mr. Therrien, it seems that Cambridge Analytica had access to data from 650,000 Canadian Facebook users. If those Canadians had been undecided voters, could they have been influenced and, given our Canadian electoral system, could that have determined the outcome of a relatively tight election?

[Daniel Therrien]

I think it's about 620,000 users. I am not an expert on electoral matters, but that number is obviously significant. So I think the answer to your question is yes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

In your investigation, will you be able to determine whether these 620,000 users were scattered across Canada or whether certain ridings were targeted? This is because 620,000 people targeted in 90 ridings have a lot more influence than if they are spread across 338 ridings. Maybe we could discover something that nobody has seen yet.

[Daniel Therrien]

I will certainly take note of that question.

Our point of departure is more the matter of purpose. Our investigation will focus on the use of Facebook user information—a network that essentially exists to communicate with friends—for analytical purposes in support of political goals.

You are suggesting that we push our work to a level of detail that would probably not be necessary for our purposes, but that could be useful. We will consider it, but I feel that the matter would be more the responsibility of Mr. Perrault at Elections Canada.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

If Facebook offered a political party the opportunity to advertise on Facebook and, a week before the election, it provided a list of 620,000 Canadians who had watched the advertisement about its leader, it would not mean that the vote of those Canadians would be assured or that they intended to vote. On the other hand, if, coincidentally, a second advertisement from the party was broadcast encouraging people to vote according to the values of the party, and it appeared four or five times a day on their Facebook pages in the week before the election, could it have an effect, especially if those people had said that they had seen the previous advertising? That would be more than profiling. That would be inappropriate.

[Daniel Therrien]

It can certainly have consequences on the election. So I encourage you to consider those questions. As you describe this situation to me, my main thought is that Facebook users provided the company with data mainly in order to communicate with a certain number of people, certainly not in order to receive advertising on the eve of the election urging them to vote for one reason or another.

In terms of the principles of privacy, in the scenario you are describing to us, the interpretation of consent seems to have been excessive. As to whether it would have electoral consequences, I would say that would probably be the case, even if these issues are not in my area.

[The Chair, Conservative, Bob Zimmer]

You are out of time, Mr. Gourde. It goes by fast.

Next up, for seven minutes, is Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Vickery, let's try to play the game of follow the data. We have SCL, we have GSR, we have Cambridge Analytica. Now, GSR sets up this Facebook app for scientific research, gathers around 86 million profiles, and then for a pittance—probably the price of two Cokes—sells all that data to Cambridge Analytica. Facebook becomes aware of it and asks them to delete the information, and they say they do. Then this company, AggregateIQ, which is a completely unknown company from Victoria that doesn't even have its own website, suddenly gets 40% of the Brexit leave budget to run the leave campaign.

Would you be able to tell us if that Facebook information that was scraped is what's in the AggregateIQ's database?

[Chris Vickery]

I'd like to dispel some misunderstandings that may exist and further this along. The Facebook data that was scraped through Facebook apps as well as surveys that were conducted over Mechanical Turk, which is an Amazon offering that people can do—there were a lot of different ways that GSR was gathering data and tying it all back into Facebook profiles—wouldn't necessarily be needed anymore after the modelling, the analysis, the behavioural tools had been developed using that data. Once you understand the interactions and the way to make people do certain things with certain messaging, the raw data from Facebook can be purged. You don't need it anymore. You can then take that framework and use it with more election-based voting data that you start to build up to get the desired outcomes, because you've already used those frameworks on the social media data.

So no, I have not come across what is obviously the Facebook data in question within this repository. That's not to say it never existed, but yes, that's the—

[Charlie Angus, NDP, Timmins—James Bay, ON]

You said the information could also have come from Amazon?

[Chris Vickery]

I want to be clear that Amazon's Mechanical Turk system is a way to have people fill out surveys and pay them for it. That is one of the methods that GSR employed as they were gathering this type of data. They tied it back into the Facebook profile, but Amazon's Mechanical Turk was a vector used.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay. So what is the connection, then? Cambridge Analytica and AggregateIQ claim to be completely separate. Again, AggregateIQ gets 40% of the leave budget. Christopher Wylie says they were basically used as an electioneering money-laundering scheme through Cambridge Analytica, as a franchise. What in the database connects the two?

[Chris Vickery]

One of the earliest connections between Cambridge Analytica and Aggregate IQ is the fact, reflected in the code and the commentary from the employees, that they got the original software for the Ripon platform from a server owned under the name of Alexander Nix, who was the recently departed CEO over there at Cambridge Analytica SCL Group. So there is that direct tie-in.

One of the apps that was developed by AggregateIQ is a phone, community outreach, and voter-influencing messaging platform. It operated on a domain known as dclisten.com, which is also registered under the name of Alexander Nix. There are plenty of examples of resources and assets flowing between these two groups.

[Charlie Angus, NDP, Timmins—James Bay, ON]

For Alexander Nix, who is with SCL and on the board of Cambridge, it's his website that AggregateIQ has listed as the only website they had when they were given 40% of the Brexit Vote Leave. Wasn't it an SCL-AggregateIQ website?

[Chris Vickery]

The only website they had up at the time...? I don't know the history of that website now. I just don't know.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay.

There's been talk about AggregateIQ's involvement in many elections, and there have been some very disturbing allegations from Christopher Wylie about a culture of illegality. One of those allegations was the illegal collection of raw user data from ISPs in Trinidad and Tobago. Were you able to confirm any of that?

[Chris Vickery]

The Trinidad and Tobago allegations—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Yes, of ISPs. Did you not mention that on Twitter?

[Chris Vickery]

I believe the evidence to show that those allegations are factual exists here. It's not in a final conclusion phase, but yes, there is a Trinidad and Tobago project in here with personally identifiable information of a great deal of people.

[Charlie Angus, NDP, Timmins—James Bay, ON]

You can say that AIQ, that database, had collected raw data from ISPs in Trinidad and Tobago?

[Chris Vickery]

Whether they got it from ISPs or other means—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Other means, yes.

[Chris Vickery]

—is not definitive, but yes, there is personally identifiable—

[Charlie Angus, NDP, Timmins—James Bay, ON]

Okay. Let me rephrase that. There was data that could have affected the elections in Trinidad and Tobago that was in the AIQ database.