The United Kingdom's Information Commissioner Office has completed its investigation into the 700 terabytes of data and 300,000 documents in collected from SCL Group (formerly Strategic Communication Laboratories) Cambridge Analytica, the "psychographic" data mining company that played a major rule in helping conservative political interests manipulate Facebook data ahead of the US presidential election and Brexit votes in 2016.
Cambridge Analytica had previously pled guilty to violating EU data laws. Both Facebook and Cambridge Analytica also acknowledged that the company had exploited a loophole in Facebook's systems, accessing a trove of user data that it should not have had access to (and of course, Facebook did nothing about it, 'cause hey, why would they?).
But after all that, the British ICO report concluded that Cambridge Analytica didn't actually do anything illegal. Worst case, they just maliciously exploited some existing regulatory loopholes that — while undoubtedly being manipulative and unethical invasions of privacy — were still technically OK, according to the law. From The Financial Times:
At first glance her findings, which were released on Tuesday, dispel many of the accusations put forward by whistleblowers and digital rights campaigners over the course of 2018.
The most serious of these was that the digital marketing specialist had colluded with Russia to steer the results of the Brexit referendum and broken US campaign rules during the 2016 presidential election. Campaigners had also previously argued the company failed to delete contentious data sourced from Facebook without users' permission when asked.
Denham told a parliamentary select committee on Friday that "on examination, the methods that SCL were using, were in the main, well recognised processes using commonly available technology".
As far as deliberate schemes by Russian Intelligence are concerned:
On Russian involvement, meanwhile, the Commissioner reminded that the ICO had already handed over what evidence they had found to the National Crime Agency. The final report by the Digital, Culture, Media and Sport Committee revealed in February 2019 that this pertained to the discovery of Russian IP addresses in the data associated with Aleksandr Kogan's server. The Commissioner added the investigation had not found any additional evidence of Russian involvement in material contained in the Cambridge Analytica servers it had since obtained. The National Crime Agency, meanwhile, is yet to pursue any action.
In other words: while someone using a Russian IP address did indeed access the data compiled by Cambridge Analytica, the ICO could find no evidence that the company was knowingly scheming with Russian agents in any way.
Of course, the ICO's investigation was also limited by the nature of its jurisdiction, which is why the National Crime Agency's own investigation is still underway:
The findings also introduce questions about the breadth and scope of the regulator's current remit. Chief among them is whether the ICO, as an independent body funded in part by fees and government grants, is well suited to evaluating wrongdoing — both in terms of resources and expertise — which extends beyond the immediate remit of data protection law and UK jurisdiction.
The most damning thing the ICO investigation found was that SCL and Cambridge Analytica knowingly oversold the effectiveness of their "psychographic" targeting. From the report:
Through the ICO's analysis of internal company communications, the investigation identified there was a degree of scepticism within SCL as to the accuracy or reliability of the processing being undertaken. There appeared to be concern internally about the external messaging when set against the reality of their processing.
The ICO report is likely welcome news to both Cambridge Analytica and the US and UK conservative parties that came to power in 2016. But in its own way, it also presents a damning case of the regulatory failures that allowed a bunch of snake oil salesmen to harvest so much data like they did.
ICO's final report into Cambridge Analytica invites regulatory questions [Izabella Kaminska / Financial Times]
Image: Book Catalog/Flickr (CC 2.0)
