Subsequent reporting by The Guardian, the Channel 4 TV network, and The New York Times suggests Cambridge Analytica not only used the data to target Facebook users for misinformation campaigns during the 2016 election, but also that the firm ran sophisticated black-ops campaigns in a number of countries including Kenya. Facebook, meanwhile, has been asked to appear before the UK’s Information Commission and a number of US Congressional committees, and there have been suggestions the company may have breached a consent decree it signed with the FTC in 2011 with respect to privacy.
Although David Carroll’s filing didn’t directly trigger these developments, the issues involved in the case—which is crowdfunded—implicate not just the behavior of Cambridge Analytica or Facebook, but the entire commercial advertising-technology marketplace that both are a part of, which uses massive data-collection techniques to track, identify, and target users. CJR spoke with Carroll about his case, and what follows is a transcript of that conversation, edited for length and clarity.
You seem to be at the center of a hurricane right now. How does it feel?
It’s been a crazy, crazy day. I haven’t even had time to reflect on it, really. I knew this day would come, I just didn’t know how big it would end up being. A few hours after I filed, the [Facebook] suspension announcement came. I don’t necessarily think it was connected, I think there were parallel things in motion at the same time, but the way things converged was quite astonishing. I knew about the whistleblower [former Cambridge Analytica employee Christopher Wylie] going into this, so I knew the scale of some of it, but I did not know that the Channel 4 sting video was coming, and that kicks it up another level. I hope to get to a point where I can record it and process it, and maybe write a book about it, but right now I’m just trying to keep up with it and not lose my perspective.
Tell me about the filing. You are asking Cambridge Analytica for more detail on the personal profile they gave you, is that right?
The basic complaint is that [the profile] Cambridge gave me is not complete, so it’s not compliant [with the law]. The company’s public position is that [they should have] 4,000 to 5,000 data points on me, but when I asked I only got about a dozen. And two academic experts have both independently said, based on their own views and assessments of the data, that there’s no way this could be complete. There’s evidence [they have] data points beyond just the demographic ones they provided me. All you have is ZIP code, gender, birth date, and party registration, and that’s not granular enough to have such nuanced predictions [about a person’s ideology, as CA claims to do]. The experts I used were Phil Howard from the Oxford Internet Institute and David Stillwell from the Cambridge psychometrics lab, who was one of the three who originally created this model.
Did you think that your lawsuit would help trigger this kind of storm of controversy?
I did, yes. I thought it would really shift the ground that data-driven advertising and marketing sits upon, because it’s too intertwined with the ad-tech industrial complex to be a separate issue. We haven’t seen all the reverberations yet, but what will be interesting is if we get disclosure beyond this. Facebook isn’t the only source for this data—commercial entities like Acxiom, Experian, comScore and so on are also involved. All of those companies will have their image tarnished by affiliation with what is potentially a black-ops contractor like Cambridge.
I hoped the suit would cause a wake-up call for the whole industry. The line that they like to give to privacy advocates is that it doesn’t do harm, you can’t prove harm so it shouldn’t be regulated. That whole mentality is crumbling before our very eyes. That is the thing that the whole ad-tech house of cards is based on, the idea that we should be able to collect people’s data because you can’t prove it’s harmful.
And you would argue that it is harmful, obviously.
Yes, I do. I think the first question to ask someone who’s a skeptic is, “Do you feel privacy in the voting booth is sacred?” If the answer is yes, then we can work back from there. If your likes and credit-card purchases and the TV shows you watch allows us to predict what you will do to an accuracy level of 75 percent, that’s good enough to take away your privacy in the voting booth. It’s not just about predicting, it’s about how you can be exploited without your knowledge or understanding.
What Christopher Wylie has revealed is that this operation is not a typical voting-analytics operation, it doesn’t just create traditional campaign ads for candidates, it’s a full media operation that creates all manner of content, not just to resemble traditional campaign advertising, but literally fake news sites created as a proxy for political advertising. And then it starts to resemble the practices of the Internet Research Agency, or even more sophisticated than that. If Wylie’s claims are corroborated, we’re talking about a company that literally built vast networks of psychologically targeted media to distort truth and reality. We’re not talking about ad banners, we’re talking about completely fabricated editorial worlds, and tracking mechanisms and re-targeting mechanisms being used in a very sinister manner.
Some people seem to believe that Cambridge was mostly just a marketing scam, and that their methods didn’t really achieve what they promised.
All I will say is that we don’t know enough to know. If you take that idea all the way to its full completion, maybe there is no data, and they just fabricated the Excel spreadsheet, so it’s all an illusion, everything is a con or a scheme, a fabrication. It’s conceivable. That’s why we need the auditing and the forensics. The story is less about what people think about it and whether it works, and more about how can we know what really happened, and then decide. The more we learn the more it seems like it’s not what we thought it was.
To get back to what drove me to do this, when I learned of the military work of the parent company [SCL Group] there was this idea that there was no longer a boundary between civilian and military sectors of this business. The data itself is intermingled, so there’s election campaign data being used for other unknown, potentially clandestine, covert purposes.
How did you come to start this case and why? What were you trying to accomplish?
The short answer is that it just felt right, but the long answer is that it was a natural trajectory of my career. I’ve been moving towards these issues for a while, from working in the digital marketing space, to trying a startup [a visual-content aggregation service called Glossy] and seeing how the sausage is made there, then being an academic, where you’re encouraged to be a critical voice, and then taking up the cause of privacy in 2014 and 2015. So when the issue of privacy came up in 2016, I was looking at the campaigns and I was curious what the news practices were. I knew that [presidential candidate Ted] Cruz was using Cambridge, and they were doing really really invasive data collection, so that was on my radar. After the election, I thought, “I know what happened, and I think I can prove it.”
How did that lead to the filing? Can you take me through the steps that led up to it?
I started finding other people that had the same mindset, like Jonathan Albright [research director at Columbia University’s Tow Center for Digital Journalism] and Paul Olivier-Dehaye [founder of PersonalData.io], and journalists and other people working on it, and we just started figuring stuff out forensically. Then when Paul Olivier-Dehaye encouraged me to do the data request from Cambridge, I thought, why not?
That set off a chain of events. When I got [the profile from Cambridge] I knew it was significant but I didn’t know exactly why. I started talking to British lawyers and they were like “This is not legal.” It was kind of alien concept to me as an American, the idea that they couldn’t do what they’re doing in the UK, it would be illegal, because they’re doing things without consent, without the proper rights. That led to the idea that since they processed our data, we have the right to request it.
And the UK government said you could force Cambridge to release that data, even though you aren’t a British citizen?
Yes, after [Cambridge Analytica CEO Alexander Nix, who has been suspended by the company pending an investigation] went before Parliament, then Elizabeth Denham, the Information Commissioner, was asked about my case, and she explicitly said I do have standing, because they processed my data, and nothing excludes people [from using the Data Protection Act] by citizenship.
The precedent that we could set if we succeed is really important. And it’s happening at a time when all of these things are coming to an apex, as well as the upcoming GDPR [General Data Protection Regulation] and its impact on the industry. The timing of this is really important; I think it will create a small but significant cataclysm in the industry, and shake up the status quo. I don’t know exactly how, but it’s clear that in a year or so things will be different.
You crowdfunded your case—can you tell me a bit about how that worked?
[Guardian journalist] Carole Cadwalladr helped me out significantly by publishing a story about my suit before it was filed so that I could do the crowdfunding for it, and that was instrumental. That was in October. The minimum target to convert was 25,000 pounds and we made it very organically, word of mouth, we didn’t have to do any aggressive marketing of the campaign, and we have kept it on a kind of stretch target since then, so anyone who wants to donate can. I think it was at about 28,000 pounds on Friday. The stretch target is up to 100,000 pounds, but the legal stage we’re at we don’t need that much money.
Technically I haven’t filed a lawsuit, I’ve filed a claim for pre-action disclosure, so we’re asking the judge to force them to disclose so that we can file a lawsuit. The beauty of that is if the judge forces them to disclose then we don’t need the lawsuit because we’ll get what we’re after.
So you might not proceed with the actual lawsuit if you get full disclosure?
I can’t say for sure that we won’t pursue a lawsuit, because the situation is very fluid. Going into this all I cared about was disclosure, auditable full disclosure, and so if I get all 4,000 or 5,000 data points and the Information Commissioner says it’s legitimate, then I could say we’ve achieved our goal. But my lawyers might advise me differently based on unfolding events, We could take a different strategy now that [the Information Commissioner’s Office] is raiding Cambridge’s offices [the ICO has asked for a warrant to search the company’s premises]. The situation is very fluid.