Last week, David Carroll—a professor at the Parsons School of Design at the New School in New York—filed a legal challenge in Britain asking the court to force Cambridge Analytica to disclose how it came up with the psychographic targeting profile it had on him. Later that same day, Facebook announced that it had banned Cambridge Analytica from using the social network because the company had acquired the personal information of more than 50 million Facebook users in a way that contravened the social network’s terms of use, and had failed to delete it as requested.
Subsequent reporting by The Guardian, the Channel 4 TV network, and The New York Times suggests Cambridge Analytica not only used the data to target Facebook users for misinformation campaigns during the 2016 election, but also that the firm ran sophisticated black-ops campaigns in a number of countries including Kenya. Facebook, meanwhile, has been asked to appear before the UK’s Information Commission and a number of US Congressional committees, and there have been suggestions the company may have breached a consent decree it signed with the FTC in 2011 with respect to privacy.
Although David Carroll’s filing didn’t directly trigger these developments, the issues involved in the case—which has been crowdfunded through a web-based service—implicate not just the behavior of Cambridge Analytica or Facebook, but the entire commercial advertising-technology marketplace that both are a part of, which uses massive data-collection techniques to track, identify and target users. CJR spoke with Carroll about his case, and what follows is a transcript of that conversation, edited for length and clarity.
You seem to be at the center of a hurricane right now. How does it feel?
It’s been a crazy, crazy day. I haven’t even had time to reflect on it, really. I knew this day would come, I just didn’t know how big it would end up being. A few hours after I filed the [Facebook] suspension announcement came. I don’t necessarily think it was connected, I think there were parallel things in motion at the same time, but the way things converged was quite astonishing. I don’t know if hurricane is the right metaphor, but I’m still processing it all. I knew about the whistleblower going into this, so I knew the scale of some of it, but I did not know that the Channel 4 sting video was coming, and that kicks it up another level. I hope to get to a point where I can record it and process it, and maybe write a book about it, but right now I’m just trying to keep up with it and not lose my perspective.
Tell me about the filing. What are you asking Cambridge Analytica for?
The basic complaint is that what Cambridge gave me is not sufficient, it’s not complete, so it’s not compliant [with the law]. There are two ways of looking at it: One is that it’s not complete based on the company’s own public statements. The company’s public position is that I should have 4.000 to 5,000 data points on myself, but when I asked I only got about a dozen. The more sophisticated take on this question is actually included in the claim filing, two academic expert have both independently said, based on their own views and assessments of the data, that there’s no way this could be complete. There’s evidence of data points beyond just the demographic ones they provided, so if you were to look at the dataset and say how do you take these demographics and get to ideology, it’s insufficient. All you have is zip code, gender, birth date and party registration, and that’s not granular enough to have such nuanced predictions. The experts I used were Phil Howard from the Oxford Internet Institute and David Stillwell from the Cambridge psychometrics lab, who was one of the three scientists who originally created this model.
Did you ever think that your lawsuit would help trigger this kind of storm of controversy?
I did, yes. I thought it would really shift the ground that data-driven advertising and marketing sits upon, because it’s too intertwined with the ad-tech industrial complex to be a separate issue. We haven’t seen all the reverberations yet, and I don’t know if we will, but what will be interesting is if we get disclosure beyond this, that Facebook isn’t the only source for this data—that commercial entities like Acxiom, Experian, comScore and so on are also involved. Then all of those companies, their image is going to be tarnished by affiliation with what is potentially a black-ops contractor like Cambridge. I hoped the suit would cause a wakeup call for the whole industry. The line that they like to give to privacy advocates is that it doesn’t do harm, you can’t prove harm so it shouldn’t be regulated, and I feel like that whole mentality is crumbling before our very eyes. That is the thing that the whole ad-tech house of cards is based on, the idea that we should be able to collect people’s data, as much as we want because you can’t prove it’s harmful.
And you would argue that it is harmful, obviously.
The first question to ask someone who’s a skeptic is ‘Do you feel privacy in the voting booth is sacred?’ If the answer is yes, then we can work back from there. If your likes and credit-card purchases and the TV shows you watch allows us to predict what you will do to an accuracy level of 75%, that’s good enough to take away your privacy in the voting booth. It’s not just about predicting, it’s about how you can be exploited without your knowledge or understanding. What whistleblower Christopher Wylie represents is that this operation is not a typical voting-analytics operation, it doesn’t just create traditional campaign ads for candidates, it’s a full media operation that creates all manner of content, not just to resemble traditional campaign advertising, but literally fake news sites created as a proxy for political advertising. And then it starts to resemble the practices of the Internet Research Agency. If Wylie’s claims are corroborated and verified, we will be talking about a company that literally built vast networks of psychologically targeted and modelled media to distort truth and reality and to target people based on that. We’re not talking about ad banners, we’re talking about falsified media environments, completely fabricated editorial worlds, and tracking mechanisms and re-targeting mechanisms being actively used in a very sinister manner.
Some people seem to believe that Cambridge was mostly just a marketing scam, and that their methods didn’t really achieve what they promised.
I’ve heard that argument too, and all I will say is that we don’t know enough to know. I’m seeking maximum disclosure so that we can put this to bed. Here’s another possibility, if you take that idea all the way to its full completion: Maybe there is no data, and when I requested my data I gave them my driver’s license and my Con-Ed bill and they just fabricated the Excel spreadsheet, so it’s all an illusion, everything is a con or a scheme, a fabrication. It’s conceivable that that happened. That’s why we need the auditing and the forensics. The story is less about what people think about it and whether it works and more about how can we know what really happened, and then decide. People want to dismiss it, but we don’t know enough to make an assessment, and the more we learn the more it seems like it’s not what we thought it was. To get back to what drove me to do this, when I learned of the military work of the parent company [SCL Group] there was this idea that there was no longer a boundary between civilian and military sectors of this business. The data itself is intermingled, so there’s election campaign data being used for other unknown, potentially clandestine, covert purposes, and that was very disturbing and unsettling.
How did you come to start this case and why? What were you trying to accomplish?
The short answer is that it just felt right, but the long answer is that it was a natural trajectory of my career. From a sort of big picture view, I’ve been moving towards these issues very naturally, whether it’s working in the digital marketing space, trying a startup [a visual-content aggregation service called Glossy] and seeing how the sausage is made there, then being an academic, where you’re encouraged to be a critical voice, and then taking up the cause of privacy in 2014-2015. So when the issue of privacy and the technology/privacy conundrum came up in 2016, I was looking at the campaigns and I was curious what the news practices were. I knew that [presidential candidate Ted] Cruz was using Cambridge, and they were doing really really invasive data collection, so that was on my radar. After the election, it was a feeling of I know what happened, and I think I can prove it.
How did that lead to the filing? Can you take me through the steps that led up to it?
I started finding other people that had the same mindset, like [Tow Center research director] Jonathan Albright and Paul Olivier-Dehaye [founder of PersonalData.io], and journalists and other people working on it, and we just started figuring stuff out forensically. Then when Paul Olivier-Dehaye encouraged me to do the data request from Cambridge, I thought why not? And that sort of set off a sort of an inevitable chain of events, because when I got [the profile from Cambridge] I knew it was significant but I didn’t know exactly why. It took time to figure out why it was significant, I started talking to British lawyers and they were like ‘This is not legal.” It was kind of alien concept to me as an American, the idea that they couldn’t do what they’re doing in the UK, it would be illegal, because they’re doing things without consent, without the proper rights. That led to the idea that since they processed our data, we have the right to request it.
And the UK government said you could force Cambridge to release that data, even though you aren’t a British citizen?
Yes, after [Cambridge Analytica CEO Alexander] Nix went before Parliament, then Elizabeth Denham the Information Commissioner was asked about my case, and she explicitly said I do have standing, because they processed my data, and nothing excludes people [from using the privacy act] by citizenship. And going back to why I decided to do this in the first place, proving that the jurisdiction is in effect is its own story, the precedent that we could set if we succeed is really significant and important. And it’s happening at a time when all of these things are coming to an apex, as well as the GDPR [General Data Protection Regulation] and its impact on the industry. The timing of this is really important, I think it will create a small but significant cataclysm in the industry, and I think it will allow for some change, and to shake up the status quo. I don’t know exactly how, but it’s clear that in a year or so things will be different.
You crowdfunded your case—can you tell me a bit about how that worked?
[Guardian journalist] Carol Cadwalladr helped me out significantly by publishing a story about my suit before it was filed so that I could do the crowdfunding for it, and that was instrumental in getting the momentum going. That was in October. It was critical to being able to have the money to do what we just did. The minimum target to convert was 25,000 pounds and we made it very organically, word of mouth, we didn’t have to do any aggressive marketing of the campaign, and we have kept it on a kind of stretch target since then, so anyone who wants to donate can. I think it was at about 28,000 pounds on Friday. The stretch target is up to 100,000 pounds, but the legal stage we’re at we don’t need that much money. Technically I haven’t filed a lawsuit, I’ve filed a claim for pre-action disclosure, so we’re asking the judge to force them to disclose so that we can file a lawsuit. The beauty of that is if the judge forces them to disclose then we don’t need the lawsuit because we’ll get what we’re after.
So you might not proceed with the actual lawsuit if you get full disclosure?
I can’t say for sure that we won’t pursue a lawsuit, because the situation is very fluid. Going into this all I cared about was disclosure, auditable full disclosure, and so if I get all 4,000 or 5,000 data points and the Information Commissioner says it’s a legitimate audited thing, then I could say we’ve achieved our goal. But my lawyers might advise me differently based on unfolding events, so we could take a different strategy now that the government has a warrant and is raiding Cambridge’s offices, the situation is very fluid.