6 ms·

ICO investigation into use of personal information and political influence [pdf]

46 points by esseti 6y ago

esseti 6y ago
some twitter extracts https://twitter.com/benedictevans/status/1313872314245808128 https://twitter.com/benedictevans/status/1313872314245808128
- raverbashing 6y ago
  That's interesting. Something that catches my eye: > The ICO found Cambridge had more or less the same tech in the 2016 campaign that competitors did—and even within the company, staff worried that Nix & Co. were exaggerating CA’s “impact and influence.” > All those things you read about the thousands of data points CA had on American voters? Most of it was commercially available to anyone with the $. Points to larger issues of data & privacy but not something unique to CA.
  - vkou 6y ago
    The parties themselves own more voter information in their datasets than CA ever dreamed of. It's one of the reasons for why third parties can't break into the American system - it's hard to compete without access to a curated-over-decades dataset of likely voters, swing voters, potential volunteers, single-issue voters, etc, etc.
    - bleepblorp 6y ago
      The US is a two party system[0] because it uses first past the post elections. First past the post electoral systems can't support more than two viable parties. [0] Nominally. In practice, the commonality of ideas between elected Democrats and Republicans, combined with structural advantages that give the GOP a disproportionate hold on power, mean that the US is more of a 1.5 party system.
easytiger 6y ago
I've been harassed and insulted for repeatedly saying that CA story was massively over blown and entirely misunderstood. Cadwalladr is a total charlatan and low effort polticially motivated troll seeking to undermime democratic proces As will be evidinced by the response to this comment.
- ceejayoz 6y ago
  Don't mistake "downvoted for complaining about downvotes in advance" for harassment. That said, I do think Facebook PR deliberately played up the CA story as a way of masking the fact that any Facebook app at the time had access to this data, and many thousands were certainly siphoning it off in the same way. It was very successful.
- george_morgan 6y ago
  I think the statements: "CA were ineffective charlatans" and "Carole Cadwalladr is misinformed" and "the methods by which CA attempted to influence the election were wrong" can all be simultaneously true.
- klelatti 6y ago
  The CA story may have been massively over blown but given what they were claiming to be able to do and their political links they deserved public exposure. Drawing attention to the wider issues around use of personal data was a public service no matter what the motivation (and the coverage has been meagre given the importance of the issue).
- Jestar342 6y ago
  > Cadwalladr is a total charlatan and low effort polticially motivated troll seeking to undermime democratic proces Spot the mouth foaming brexiteer. Carole is investigating if democratic process _was_ followed, and has found it _wasn't_. Yet somehow pointing out that Leave broke the law, that the politicians promising amazing things from brexit have all been proven liars, and that there is as yet not a single benefit shown with brexit to be even possibly true.. no. Must be that she is the troll.
  - 6y ago
fareesh 6y ago
All Facebook apps at the time could request the same permissions as the CA apps - I know this because I built many of them for ad campaigns, such as contests and games. A lot of game/contest mechanics relied on things like posting on friends' timelines, or your own timelines, etc. In my case there was no real interest from our customers in taking the data and doing something with it, but if the intent was there, it could have very easily been done. Furthermore, when my firm did security and pentesting projects, we routinely found exploits that could eventually lead to us getting the access tokens and secrets for their user database, or the app token and secret. If I had to guess - 70% of the game/contest applications that we audited had these vulnerabilities after they had been launched leading to companies approaching us us panicked, asking for help with users who were cheating. Many were aghast to learn of what could have potentially happened over and above rigging the leaderboards. It's not enough that there were apps out there who had the ability to get this data. It's also not enough that there were apps who wanted to get the data intentionally. You also have to consider the number of apps that had this data and had weak security. Someone could have just broken in, taken the keys, and taken their users' data that way. Nobody would have known. At best it may have emerged in Facebook's "auditing process" in 2017 that they conducted to see which apps performed these kinds of queries - does anyone believe they did this in good faith and disclosed 100% of such apps which looked at social graph, friend posts, messages, etc? I am pretty sure the Obama 2012 campaign did something similar with their outreach Facebook apps too, as it was reported in the press at the time (https://www.theguardian.com/world/2012/feb/17/obama-digital-data-machine-facebook-election https://www.theguardian.com/world/2012/feb/17/obama-digital-...) Most users were uninformed and blindly hit accept at the permissions screen because they could win a car or an iPad or a Playstation by entering the contests. In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to.
- dane-pgp 6y ago
  > In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to. Are you claiming that online advertising doesn't work, or that gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads?

46 points by esseti 6y ago

some twitter extracts https://twitter.com/benedictevans/status/1313872314245808128 https://twitter.com/benedictevans/status/1313872314245808128

raverbashing 6y ago
That's interesting. Something that catches my eye: > The ICO found Cambridge had more or less the same tech in the 2016 campaign that competitors did—and even within the company, staff worried that Nix & Co. were exaggerating CA’s “impact and influence.” > All those things you read about the thousands of data points CA had on American voters? Most of it was commercially available to anyone with the $. Points to larger issues of data & privacy but not something unique to CA.
- vkou 6y ago
  The parties themselves own more voter information in their datasets than CA ever dreamed of. It's one of the reasons for why third parties can't break into the American system - it's hard to compete without access to a curated-over-decades dataset of likely voters, swing voters, potential volunteers, single-issue voters, etc, etc.
  - bleepblorp 6y ago
    The US is a two party system[0] because it uses first past the post elections. First past the post electoral systems can't support more than two viable parties. [0] Nominally. In practice, the commonality of ideas between elected Democrats and Republicans, combined with structural advantages that give the GOP a disproportionate hold on power, mean that the US is more of a 1.5 party system.

easytiger 6y ago

I've been harassed and insulted for repeatedly saying that CA story was massively over blown and entirely misunderstood. Cadwalladr is a total charlatan and low effort polticially motivated troll seeking to undermime democratic proces As will be evidinced by the response to this comment.

ceejayoz 6y ago
Don't mistake "downvoted for complaining about downvotes in advance" for harassment. That said, I do think Facebook PR deliberately played up the CA story as a way of masking the fact that any Facebook app at the time had access to this data, and many thousands were certainly siphoning it off in the same way. It was very successful.
george_morgan 6y ago
I think the statements: "CA were ineffective charlatans" and "Carole Cadwalladr is misinformed" and "the methods by which CA attempted to influence the election were wrong" can all be simultaneously true.
klelatti 6y ago
The CA story may have been massively over blown but given what they were claiming to be able to do and their political links they deserved public exposure. Drawing attention to the wider issues around use of personal data was a public service no matter what the motivation (and the coverage has been meagre given the importance of the issue).
Jestar342 6y ago
> Cadwalladr is a total charlatan and low effort polticially motivated troll seeking to undermime democratic proces Spot the mouth foaming brexiteer. Carole is investigating if democratic process _was_ followed, and has found it _wasn't_. Yet somehow pointing out that Leave broke the law, that the politicians promising amazing things from brexit have all been proven liars, and that there is as yet not a single benefit shown with brexit to be even possibly true.. no. Must be that she is the troll.
- 6y ago

fareesh 6y ago

All Facebook apps at the time could request the same permissions as the CA apps - I know this because I built many of them for ad campaigns, such as contests and games. A lot of game/contest mechanics relied on things like posting on friends' timelines, or your own timelines, etc. In my case there was no real interest from our customers in taking the data and doing something with it, but if the intent was there, it could have very easily been done. Furthermore, when my firm did security and pentesting projects, we routinely found exploits that could eventually lead to us getting the access tokens and secrets for their user database, or the app token and secret. If I had to guess - 70% of the game/contest applications that we audited had these vulnerabilities after they had been launched leading to companies approaching us us panicked, asking for help with users who were cheating. Many were aghast to learn of what could have potentially happened over and above rigging the leaderboards. It's not enough that there were apps out there who had the ability to get this data. It's also not enough that there were apps who wanted to get the data intentionally. You also have to consider the number of apps that had this data and had weak security. Someone could have just broken in, taken the keys, and taken their users' data that way. Nobody would have known. At best it may have emerged in Facebook's "auditing process" in 2017 that they conducted to see which apps performed these kinds of queries - does anyone believe they did this in good faith and disclosed 100% of such apps which looked at social graph, friend posts, messages, etc? I am pretty sure the Obama 2012 campaign did something similar with their outreach Facebook apps too, as it was reported in the press at the time (https://www.theguardian.com/world/2012/feb/17/obama-digital-data-machine-facebook-election https://www.theguardian.com/world/2012/feb/17/obama-digital-...) Most users were uninformed and blindly hit accept at the permissions screen because they could win a car or an iPad or a Playstation by entering the contests. In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to.

dane-pgp 6y ago
> In my view, the entire story was exaggerated and turned into a public spectacle, for very obvious reasons that nobody likes to admit to. Are you claiming that online advertising doesn't work, or that gathering large amounts of data about individual users to tailor ads to them doesn't increase the effectiveness of those ads?