Cambridge Analytica raided by UK data watchdog | Hacker News Reader

Cambridge Analytica raided by UK data watchdog

techcrunch.com

112 pointsdoppp76 comments

Previous discussion: https://news.ycombinator.com/item?id=16662141

In the blink of an eye, it seems, we have gone from a world in which collecting, storing, and using personal data for financial gain was largely viewed as a harmless activity, to a world in which doing those same things will be increasingly controlled and regulated, scrutinized, criticized, investigated, fined, and ultimately, I suspect, criminalized.

Years ago Bruce Schneier said that nothing would happen until there was the privacy equivalent of the Exxon Valdez / Bhopal / Chernobyl; a leak high profile and toxic enough to irrevocably change public opinion. Maybe this is that trigger event.

The EU was ahead on this, adopting data protection rules from 1995, before even the first dotcom boom. I believe it's a legacy of fear of the Stasi driving opposition to surveillance.

Also the CCC and European hacker culture. I think in the US hacker culture is different and less political, because of the FBI suffocating its roots early on, and a general fear of leftist politics. In europe, and Germany in particular, the CCC and close structures have been really important correctives since before the internet. And they are like reeeally left wing anticapitalist idealists and antiauthoritarians, which plays part to their motivation.

    they are like reeeally left wing

The historical record of the extreme left is extremely pro-state, pro surveillance. Indeed, the Marxist corrective to freewheeling capitalism was a strong socialist state (to cover the period before communism emerges and the state withers away) [1]. Many modern surveillance techniques were pioneered or refined by the likes of the OGPU [2], the NKVD [3] and their equivalents in satellite states like the Stasi [4] in the GDR, or the secret police in China (sorry I have no good reference). Note that both Wilhelm Zaisser [5](founder of the Stasi) and Kang Sheng [6] (founder of China's secret police) had worked in Moscow under Stalin in the security services.

This is historically very well documented, but seems to be somehow unpalatable ...

[1] https://www.marxists.org/archive/marx/works/1848/communist-m...

[2] https://en.wikipedia.org/wiki/Joint_State_Political_Director...

[3] https://en.wikipedia.org/wiki/NKVD

[4] https://en.wikipedia.org/wiki/Stasi

[5] https://en.wikipedia.org/wiki/Wilhelm_Zaisser

[6] https://en.wikipedia.org/wiki/Kang_Sheng

Edit: replaced "left" by "extreme left" for additional clarity.

Here's a list of talks given at the CCCongress: https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events...

You don't have to go from "left-wing hacker collective" right to Stalin if there's data readily available on the actual subject being discussed.

(There should actually be a left-wing equivalent of Godwin's law. Maybe "There-Is-No-Godwin's law"?)

I have commented not on the CCC but on user: 46886532558's original claim that being "reeeally left wing" is somehow a plausible reason for being anti-surveillance. This association is misleading, and I feel a responsibility to correct this historical mistake.

This correction is especially apt since Germany is still full of Stasi victims.

> The historical record of the left is extremely pro-state, pro surveillance

I think the problem with your comment is that you're flat-out misrepresenting the 'reeeally left wing'. There are plenty of 'leftist' movements that are just as opposed to 'the state' as they are to our corporate overlords. Arguing otherwise is either plain stupidity or intentional misrepresentation.

Railing against "the state" or "our corporate overlords" is not a mature political position, but merely unfocussed, reflection-free rage that gets tooled / channeled by political organisers and activists on the left and right, not to mention commercially exploited by the Facebooks of this world, whence Zuckerberg's "Dumb Fucks".

> Railing against "the state" or "our corporate overlords" is not a mature political position

Why not? Historically anarchists played a mentionable role in this whole leftist thing.

EDIT: Also, could you elaborate on what you mean with 'a mature position'? I've found that kind of statement to be an effective but dishonest way to dismiss things.

The anarchists, qua bombings, played a potent role in 19th, and early 20th century politics, but not a good one.

Politically, anarchists are really quite different from the socialist/communist tradition:

- Anarchists: reject the state

- Socialists/communists: reject capitalism

Naturally there could be overlap, and indeed there is a well-known tradition of anarcho-communism [1] which was especially potent in the Spanish Revolution of 1936 (note that there were bitter fights between anarchists and the Stalinists), but at the same time, it's difficult to reconcile the philo-capitalism of the libertarian wing of anarchism with the socialist tradition. Likewise, it's difficult to reconcile the philo-stateism of the socialist tradition with anarchism.

As to "mature": as a first approximation, I'd say, having a written, elaborate and communicable theory behind one's political actions, one that has survived multiple round of (friendly) critique. A mature political position includes reflection on the nature of political power, the shape of politial organisation, and political activism, and clear end goals with reasons why the desired end-goals are likely to come about. A mature political position also contains an understanding of other political positions, including those of one's political adversaries. An prime example of a mature political position is Marx. As an example of political immaturity, I'd point to myself when I was 19. I was nothing but an angry, raging young person, who railed against "the system", wanted to "stick it to The Man" and save the world. But I would not have been able to explain why, in way that I would have found plausible.

[1] https://en.wikipedia.org/wiki/Anarcho-communism

Thank you for elaborating. Truly.

Is there any way I could continue this conversation via email or some other form of communication? I very much would like to pick your brain on some of this in a more personal form.

EDIT: my email is my username at gmail.com

Yeah–the comment didn't use talk about "reeally left-wing". It was "reeeally left wing anticapitalist idealists and antiauthoritarians".

The description uses "left wing" to help you conjure up the right mental image. Because "anticapitalist idealists and antiauthoritarians" would also describe buddhists and anarchists.

Not so much unpalatable as irrelevant? Using a descriptor like "left wing" to ignore people's actual politics and go straight to accusing them of being Stalinists?

I was clearly referring to 46886532558's "reeeally left wing", i.e. extreme left.

It is historically accurate to identify the extreme left with the ComIntern, i.e. the Soviet communist party, ruled during his lifetime by Stalin. Almost all communist parties were in the mould designed by Lenin, and refined by Stalin.

Even today, socialist / communist parties operate using the Leninist style of organisation, e.g. in the UK the SWP or RS21.

It is useful to know this, just as it's useful to know that Cambridge Analytica was owned by a company whose board is full of UK military/security-service types [1].

[1] http://bellacaledonia.org.uk/2018/03/20/scl-a-very-british-c...

> It is historically accurate to identify the extreme left with the ComIntern, i.e. the Soviet communist party, ruled during his lifetime by Stalin.

No, it is absolutely not.

I invite you to defend your claim.

Start by asking yourself which non-fringe socialist/communist party was not using the Leninist model of organisation, and which was not a member of the ComIntern and its successors? Which did not receive funding and ideological schooling in the Soviet Union?

You have an uphill struggle against history against you.

How would you define 'fringe', and how does this not include views that are less pro-state?

Fringe is clearly a vague predicate. One way of defining Fringe is via the number of followers that can be mobilised for political action. E.g. in the UK the Tories, and Labour are not fringe, but CISTA (Cannabis Is Safer Than Alcohol) is. In the Weimar Republic the KPD was not fringe, but the Socialist League was.

Never mind that, how do you define "left"?

> non-fringe socialist/communist party was not using the Leninist model of organisation, and which was not a member of the ComIntern and its successors?

UK Labour party? Has everyone forgotten the Fabians?

The modern Green parties tend to be "left" but not necessarily inheriting from the Marxist tradition at all, generally post-dating WW2 (although this produces endless arguments about "watermelons"). Also modern left-wing parties of almost all colours are explicitly pro-human rights, which includes not only the right to privacy but the right to property!

Again, I'm not saying that there aren't some actual pro-Stalin "tankies" around, but it gets incredibly tedious having to defend everyone to the left of the Daily Mail from automatic charges of being a Stalinist. Congratulations on your dozen posts of derailing.

Apologies if I misinterpret your comment, but aren't we arguing the same thing?

> fear of leftist politics...

What I said, huh?! Maybe before you throw in the Stasi Wikipedia article, you should check out the CCC's. They advocate for a strong state regulations, strong democratic structures and freedom of the individual, including privacy. Transparency for the state, privacy for the individual. Large parts of their member base are anticapitalists and anarchists, minding the collective welfare, so I figured from an American perspective that's quite far left.

You won't find advertisement or any commercial interests on their very large conferences, which are completely organized and managed by volunteers. On every level. There is absolutely no tolerance for right wing ideas, police or military.

That's why I think their political background here is important, they always been activists advocating for everyone's welfare and rights. Something rather unusual for non left wing politics.

In France we always had strong laws too (we basically adapted our super old laws for "files and info on paper" to "files and info on paper on a computer"), in decent part because Vichy.

Technically I could already ten years ago ask any company to show me every file they had on me, allow me to edit, and ask them to delete, and they had to comply. But the era on gigantic worldwide corp made this much harder to enforce, and thus much harder for user to enjoy their rights. I'm glad the EU moved forward on standardisation and enforcement at EU level.

No more "the data you refer to is in Ireland and owned by an Irish company that doesn't operate in France !" and crap like that.

It’s interesting how the collection of the same information by the likes of the five eyes is ok, yet for Facebook it isn’t.

It is interesting how it is ok for a country to jail people whose conduct it disapproves of, yet for any non-government entity it isn't. /s

Seems perfectly in line with restrictions on other dual use technologies, such as biological pathogens, nuclear fuels, etc.

The crackdown on free speech / Section 230 legislative changes is all part of this reining in of the 'information merchants'. https://www.eff.org/issues/cda230

Expect the launch of a shiny new 'social network' foundationed in 'safe' cryptocurrency commerce and led by an unknown fresh faced kid who 'invented it in his dorm room' and took no money from Russian offshore mob oligarchs...

Sorry I don't quite follow your comment. What does free speech have to do with unregulated, unconsented mass surveillance and violation of end user privacy?

That "new" social network already exists. It's called Snapchat. I think it's an open question whether social networks will even continue to exist in their current form. There was a time when people connected over Yahoo Chat and AIM...

'What does free speech have to do with unregulated, unconsented mass surveillance and violation of end user privacy?'

the original legislation that enabled the modern web 2.0 platforms to exist was Section 230. Now that logic looks set to be struck down. https://www.law.com/therecorder/2018/03/21/senate-overwhelmi... I suggested a new more invasive platform will launch for deeper and more covert mass surveillance in light of GDPR in europe and now the end of the FB and Google gravy train when Section 230 changes makes the platform companies liable for what you say when you exercise your free speech in the USA...

At least in the US, there are legal prohibitions on government propaganda programs targeting Americans, whereas that's more or less entirely what Facebook is for. If the govt is caught running influence campaigns inside the US, there will be hell to pay- Congressional hearings, new legislation, etc.

They have been caught. Or are you referring to something else?

That isn’t very hard to understand.

I just hope this does not backfire as new service models that require explicit consent (through ToS) from the user to allow monetizing user data in order to use such service.

news reports and reported public opinion seem to have shifted rapidly. but lots of people have been very vocal about how this is bad for a long time.

And this is the climate while tremendously powerful corporations consider personal data collection to be a lynchpin of their moneymaking strategy (i.e., advertising.) Once internet advertising becomes broadly recognized as being not worth the cost, the demand for this data could fall off a cliff- what will policy look like then?

I consider it a reason to be optimistic.

Too early to tell. It took almost a week to get a warrant to raid the CA offices, and while I do sort-of understand why, it's not promising. Furthermore, the Snowden revelations didn't have as much of an effect as I'd hoped, and once it 'blew over' it largely stopped being a public concern.

The same could happen here. Perhaps Zuck will be fired or we'll stop hearing about his (alleged) ambitions to enter politics, and that will be the end of it.

Let's not forget that CA is just one company. As long as Robert Mercer can continue doing what he does under various shell companies that are easy to register, we really haven't gotten anywhere unless regulations are implemented, and somehow applied globally.

This is on the front page of reddit https://www.reddit.com/r/pics/comments/86qxrb/cambridge_anal...

I’m guessing it’s real the building does look like the CA HQ.

I'm not sure why you would doubt it.

But anyway, the Guardian has an article too: https://www.theguardian.com/news/2018/mar/23/judge-grants-se...

Skepticism is healthy.

Thx I couldn’t find the article and it does look damning but reddit sometimes has a tendency to run with things so I prefer to be cautious.

The reddit link speculates that CA removed evidence from the building before the warrant was served. The Guardian article you link doesn't say anything about that.

(it's a legit Reuters photo, visible in the results at https://www.reuters.com/search/pictures?blob=cambridge+analy... )

It'd be incredibly stupid for CA to have destroyed any evidence[0].

Privacy protections are, as far as I know, completely a matter of civil law. The worst that one would expect from the facts known so far is a high fine, bankrupting the company.

Buy CA is toast anyway: no politician or reputable brand will ever want to be associated with them.

Destroying evidence, however, can rather quickly result in criminal prosecution.

So this doesn't make much sense even for the owners of CA. It's even worse for employees: their risk was mostly limited to losing their job when the inevitable happens. Participating in obstruction of justice for the sake of job security is borderline insane. That's actually the #1 reason why I mostly doubt conspiracy theories in the private sector.

The only way to possibly way to square destruction of evidence with rational thinking is the possibility of CA having engaged in things worse than currently known. Maybe they actually engaged in honeytraps or killing Kennedy.

[0]: Which doesn't mean it's not possible. They don't have the best track record as far as not-being-stupid goes.

> Destroying evidence, however, can rather quickly result in criminal prosecution.

I disagree with all your points. This would imply that no one has ever destroyed evidence. You are also implying they are acting rationally. You are also projecting US laws onto the U.K.

> The only way to possibly way to square destruction of evidence with rational thinking is the possibility of CA having engaged in things worse than currently known.

Why are you assuming that this is unlikely rather than most likely?

My point is that destroying evidence may make sense if you're accused of serious crimes. It doesn't make any sense if your employer is accused of civil law violations. And I'm actually in the EU and believe my representation of the law to be mostly correct.

>> The only way to possibly way to square destruction of evidence with rational thinking is the possibility of CA having engaged in things worse than currently known.

> Why are you assuming that this is unlikely rather than most likely?

I don't want to extrapolate from the known into the unknown. Also note that I didn't actually give an estimate on the possibility.

The data protection act introduces some criminal offences. Here's a list: https://www.cps.gov.uk/legal-guidance/data-protection-act-19...

Section 55(1) DPA unlawful obtaining etc. of personal data

It is an offence to knowingly or recklessly obtain, disclose or procure the disclosure of personal information without the consent of the data controller.

There are some exceptions to this for example, where such obtaining or disclosure was necessary for crime prevention/detection. Section 55(2) sets out four defences to section 55(1).

If a person has obtained personal information illegally it is an offence to offer or to sell personal information. Section 55(3) makes the contravention of section 55(1) a criminal offence.

Section 55(4) and section 55(5) DPA create offences of selling and offering to sell personal data. For the purposes of section 55(5) DPA an advertisement indicating that personal data are or may be for sale is an offer to sell the data.

When prosecuting DPA cases as per the case of R v Julian Connor (Southwark Crown Court, 19 May 2003) prosecutors should remember to adduce evidence that the individuals named in each charge were alive at the time their data was obtained, and as per R v Buckley, England, Wallace and Moore (Winchester Crown Court, September 2003), the prosecution has to prove that the information was data within the meaning of Section 2(1) of the DPA.

There are no custodial sentences in respect of DPA offences and no powers of arrest; all offences are punishable only by a fine. Search warrants are available to the Information Commissioner by virtue of section 50 and the powers outline at schedule 9 of the DPA.

---End Quote---

>Buy CA is toast anyway: no politician or reputable brand will ever want to be associated with them.

That doesn't really matter, I think. AFAICT, CA was merely a shell company and figurehead for SCL Group. I think what will just happen is SCL will found another shell company and keep on going as usual.

http://www.dailymail.co.uk/news/article-5521893/Warrant-soug...

Best source from reverse image search

Relatedly, some more Brexit whistleblowing: https://twitter.com/MichaelLCrick/status/977601337889312768

and https://www.huffingtonpost.co.uk/entry/brexit-outing_uk_5ab6...

Sorry, I failed to see the relevance, apropos Cambridge Analytica.

Cambridge Analytica conducted research for Leave.EU, one of the biggest pro-Brexit campaign groups, and are under investigation by the Electoral Commission for their role in the EU referendum.

Specifically this includes allegations that they were doing work which was outside the election spending rules.

Big Brother raids Step Brother for data provided by Little Brother.

I can't imagine I'm any safer now.

The raid was conducted by the Information Commissioner's Office, which has a mission to "uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals". That doesn't seem very Big Brother to me, even if other government agencies do fit that characterization.

Source: the bottom of their homepage - https://ico.org.uk

This is gov / quasi-gov agency, yes? Do they also oversea what the gov and other quasi-gov agencies collect? Or is their protection limited to what happens in the private sector?

I suppose you directed this to me, so to be honest, I don't know. I'm not British and didn't know about this agency before I posted my comment. I just wanted to raise the point that the government isn't a monolithic entity that can be solely described by its actions that we disapprove of.

Ah, this completes the triad for me. I had previously heard FB deny responsibility and Kogan deny responsibility. Hadn't yet heard CA deny responsibility until now.

That's settled then. I guess nobody's at fault! Success has many fathers but failure is an orphan.

I was just reading this article about Kogan https://www.theguardian.com/education/2018/mar/24/cambridge-...

The article is a bit confusing for me, it suggests that Kogan initially went to the parent company of CA and asked for $500,000 for the data+modelling, and they refused?

It's not entirely clear, but at some point some money must have changed hands for the work, the thing that surprises me the most is even with figures like $500k being bandied about, is that the going rate for stuff like this these days?

Thank you for the article, very interesting.

At first read I had the impression that Kogan was criticized on an "ethical" base, then re-reading it, I understood that they were only arguing on how to divide the loot.

If SCL actually had given 1 million, half to Kogan and 1/4 each to Kosinski and Stilwell, we wouldn't have the mails.

>The correspondence reveals the deep anxiety among university psychologists over the activities of Kogan, ...

Deep anxiety over the activities my sock, they wanted US$ 500,000 and were proposed only US$ 100,000 instead, and there started the disagreement ...

did Facebook deny responsibility?

Facebook has sort of apologized, but their position has been that CA bamboozled them, not that this is an inherent outcome of their business model.

A strange sort of non-denial denial.

"The usual people tried to claim responsibility. First the IRA, then the PLO and the Gas Board. Even British Nuclear Fuels rushed out a statement to the effect that the situation was completely under control, that it was a one in a million chance, that there was hardly any radioactive leakage at all, and that the site of the explosion would make a nice location for a day out with the kids and a picnic, before finally having to admit that it wasn't actually anything to do with them at all."

-- Douglas Adams

At fault for what exactly, Trump getting elected? I still don't understand what we know today that anyone sort of paying attention didn't expect a year ago, or even five years ago.

I was thinking about the mere leakage of the data itself, but you make a good point. I pretty quickly figured out the nature of Facebook years ago and deleted mine. But all the people coming out of the woodwork now to hate on Facebook all of a sudden, you have to assume 1) they accepted all the things about Facebook that we all knew, including the use or misuse of data, and 2) what made them finally object was Facebook's sudden supposed intrusion into the (supposed) democratic process (though Kogan said profiling and ad targeting was worse than useless[0]), and specifically the fact that Trump won and now they're mad and looking for someone/something to blame.

[0] https://www.bloomberg.com/news/articles/2018-03-21/facebook-...

I understand this line of reasoning from a butt-hurt nerd perspective, but surely we can agree that it's a good thing that the consequences of 'all this' is finally hitting the mainstream?

And if so, what is the value of such an attitude other than some kind of petty 'told you so' need? Do we demand badges for our wokeness?

I don't claim my attitude has value.

It's fine if it hits the mainstream, but if it's because of Trump, and not because of what Facebook is, then it will end up being just another half-assed initiative by only half the population - the half that happens to disagree with one flash-in-the-pan, here-today-gone-tomorrow, and ineffective-to-boot, President.

I'm among those who think the world would probably be better off without both Facebook and Trump, but the consensus out there in the world doesn't agree with that. They elected Trump and continue to make Facebook rich. Somewhat counter-intuitively, there is really not a lot of fodder there for feeling superior about oneself.

I see your point. It's depressing, but still.

On one hand I don't want to look this gift horse too closely in the mouth, because I do support better control over my private data.

On the other hand, the broader responses by the big tech firms seems to be a heavy-handed punishment of run of the mill right wing media. While not illegal it is pretty terrifying to see so much modern day book burning.

Too late...

Raiding has to come with a sufficient reason for those raided to believe the raiding party already has at least a portion of the material, either obtained through interception or inside sources.

The idea is that the people being raided will hand over as much as possible because it’s in their own best interest - knowing that anything they don’t produce may be in the material already obtained, making them liable for destroying it.

A late and preannounced raid without any material obtained beforehand is useless.

(It should be noted that there is no need to actually obtain any material if you can make the people raided believe you have some of the material)

The legal term for the phenomenon is "spoliation": https://en.wikipedia.org/wiki/Spoliation_of_evidence

Didn't know that. Thank you.

I’m not sure this is the case here. It may well be that in this case they are going for a fruitless search for material destroyed days ago. But at least I hope they are more clever than that.

How much of that relies on the raided party to have a desire to remain in business and to avoid criminal charges?

I can't help but feel that those individuals who really 'matter' in this situation have insulated themselves appropriately from CA as a corporate entity that whatever happens to CA specifically is just a minor inconvenience.

They may have deleted the data, but missed mentions of the data, or conversations that imply the use of such data, in internal emails, etc.

Ultimately, this is a company founded by Bannon, who’s nearly as good at hiring The Best People (TM) as Trump is (see Milo, for instance). These are not the world’s smartest people. Even if they did decide to indulge in a bit of illegal destruction of evidence, there is every chance they would fuck it up.

And destruction of evidence is probably not as common as people think in these cases; it’s a huge risk.

Reply on news.ycombinator.com