How trustworthy is Cambridge Analytica

Final report of the data protection authorityNo, the Cambridge Analytica scandal is not collapsing

When the data scandal surrounding Facebook and Cambridge Analytica shook the public in spring 2018, the British data protection authority provided iconic images: In their jackets, described in large letters as "enforcement", the employees of the Information Commissioner's Office (ICO) were more reminiscent of FBI agents than data protection officers . They confiscated 42 laptops and computers, 31 servers, 700 terabytes of data and over 300,000 documents. Now ICO boss Elisabeth Denham has officially closed her investigation with a public letter to parliament [PDF].

The struggle to interpret the scandal is also not over two and a half years, hundreds of articles and a Netflix documentary after the great story of disclosure in the British Observer.

Because Denham repeats the already known information in her report that she can prove neither interference by Russia nor direct cooperation between Cambridge Analytica and the pro-Brexit camp, several media outlets are taking the publication as an opportunity to retrospectively dismiss the collective outrage of the To distance spring 2018. According to the Financial Times, not much remains of the allegations made against Cambridge Analytica at the time. The NZZ even downgraded the scandal to “hype” and headlined that it was “collapsing”.

Disenchantment of the data mage?

As a reminder: Cambridge Analytica was a spin-off from the British company SCL, which specializes in behavioral research and strategic communication. The seedy marketing company had taken the data of 87 million Facebook users: inside, used it for psychological profiling and thus supported the US presidential candidate Donald Trump, among other things. Both companies filed for bankruptcy shortly after the revelations - in order to avoid further clarification, as many suspect.

While interest in the topic quickly waned in Germany when Facebook announced that only a few Germans were affected, the willingness to educate was greater in the UK. Several government agencies have extensively reviewed the event.

In the letter to Parliament, ICO boss Denham reiterates her warning against the "systemic vulnerabilities" for democratic systems that arise from the use of personal data in a political context. Thanks to the courageous approach taken by her authority in spring 2018, she was able to prove, among other things, how close the data cooperation was between the British company and the Trump campaign and how those responsible at Cambridge Analytica tried frantically to delete data from British servers and save it abroad when the scandal boomed.

On the occasion of the final report, however, NZZ and Co. prefer to express a skepticism that accompanied the reappraisal from the beginning: In the end it was not so wild, think quite a few. Just data-based marketing. Cambridge Analytica, they were just pushy sellers of snake oil, a supposed miracle drug with no effect. Indeed, Denham shows once again that the Cambridge Analytica itself coined narrative of the great data wizards who practically single-handedly turned the US election is exaggerated. However, the data protection officer does not give the all-clear.

Data on the voting behavior of 160 million people

So let's get down to the facts: Denham reports, among other things, that Cambridge Analytica has sold its own data and analytical capabilities well beyond its value. The marketing firm had advertised that it had 5,000 data points each on 230 million American adults. In truth, the data protection authority could just Find databases with 50 to 500 data points for 160 million individuals each, including data on consumption and voting behavior. In addition, a database with 3,000 data points for over 100 million people.

Cambridge Analytica has also apparently exaggerated when it comes to its own analysis tools: beyond psychographic profiling, which was not carried out by the company itself but by university researcher Alexandr Kogan, the marketing company had no particularly elaborate or even self-developed methods in its repertoire. Instead, Denham reports on standard data science algorithms that have been used to visualize and analyze data and for forecast models.

So far, so expectable. It is not uncommon for a marketing firm to sell its own skills for value. In fact, one of the central elements of the scandal was not at all about the question of What Cambridge Analytica did with the data, rather where from these came from. Because even if Denham mostly came across commercially available databases from data brokers such as Acxiom or Experian on the servers, computers and mail accounts of the marketing people: the data of the millions of Facebook users are anything but standard goods.

It was always a Facebook scandal too

The researcher Alexandr Kogan, who was still employed at the University of Cambridge at the time, stolen the treasure trove of data for Cambridge Analytica by pretending Facebook to collect it for scientific purposes. He had developed an app for the third-party platform in the social network. Using the personality quiz “thisisyourdigitalife”, he was able to collect not only the data of the users, but also all of their Facebook contacts without them even noticing.

Denham has now confirmed the existence of this data, of which the data from 30 million Americans were apparently primarily relevant for Cambridge Analytica. This included not only the psychographic profiles of the Facebook users calculated by Kogan, but also all of the likes and social graphs of those affected, i.e. the mapping of all their social relationships in the network.

The fact that Facebook left this gateway to its users' data so far for app developers is a central element of the scandal. After all, the group had several internal warnings about a flourishing black market with users: ignoring internal data for far too long and not controlling third-party providers on its platform at all. To date, Mark Zuckerberg has not kept his promise to the US Senate to transparently process further data leaks to other app developers. And to this day Facebook, unlike Twitter and Google, refuses to restrict microtargeting in a political context.

The Cambridge Analytica scandal was and is therefore always a Facebook scandal. The data company paid a record fine of five billion US dollars to the American trade regulator FTC. The British Data Protection Authority also imposed a record sanction, but due to the low range of fines prior to the introduction of the General Data Protection Regulation, it was only £ 500,000.

Until today in Team Trump

The fact that Russia was involved in all of this was not a particularly plausible assumption from the start. The Cambridge Analytica scandal was never about the interference of a dark, alien power - from the outset it was about what the political actors within the democratic systems are capable of. Because there is no doubt today that Cambridge Analytica worked directly with Donald Trump's core campaign. Its employees try to downplay the cooperation, but the facts speak against them.

When the British company SCL wanted to found its subsidiary Cambridge Analytica, it was Trump friend and billionaire Robert Mercer who gave it financial support. The Breitbart boss and then Trump strategist Steve Bannon even acted as a vice-boss of the company. And it was Kellyane "Alternative Facts" Conway, the communications advisor to the President who soon became famous, who acted as a kind of liaison officer between the two organizations.

It is therefore no surprise that the data protection authority at Cambridge Analytica has also found data from the inventory of the Trump camp, including information about 30 million people in the pro-Trump Facebook group "Pro America" ​​and information about millions of people the data warehouse of the Republican Party called the "Data Trust".

Only a few weeks ago, the British television broadcaster Channel 4 showed on the basis of a leak that the other way around, the psychographic profiles used by Cambridge Analytica were also found in Trump's own election campaign database with information over 200 million. There is therefore no doubt about the close cooperation. According to the medium, two former Cambridge Analytica employees still work on Trump's 2020 campaign team.

Open questions about Brexit

However, the evidence is much thinner when it comes to Cambridge Analytica's involvement in the Brexit vote. Kogan's Facebook dataset contains the data of a maximum of one million Britons. Elisabeth Denham also makes it clear again that she could not find any evidence of direct collaboration with vote-leave groups. Although this was planned, it was apparently never put into practice.

However, much remains unclear for the time being: The data protection authority confirms that the pro-Brexit camp has worked closely with a Canadian company called Aggregate IQ. SCL had previously described this company as a Canadian subsidiary and paid bills on their behalf. Aggregate IQ, however, denies closer ties to SCL and Cambridge Analytica.

So in the end the question of the effect remains. For years there has been a debate about how exactly microtargeting works and whether psychographic profiling really has an effect.

As a reminder: The users of Kogan's data collection app filled out a questionnaire to analyze personality traits, which worked according to the OCEAN model, which is widely used in psychology. People are divided into categories such as “openness” and “neuroticism” based on their statements. Finally, the tens of millions of users who had not even completed the questionnaire were divided into its categories: Based on their Facebook data, they were categorized in the same way as the people they are statistically similar to.

Impostors and shady characters

Denham reports that there was skepticism internally at Cambridge Analytica as to whether this transfer would work. The criticism has a real core here. We still know far too little about how microtargeting works. That the story of Cambridge Analytics is so full of shady characters and impostors rhetorically increasing the power of microtargeting to the immeasurable doesn't make it any better.

It starts with Alexander Nix, the co-director of SCL and founder of Cambridge Analytica, who always seemed less like a businessman and more like a villain from a Bond film. He himself was the busiest seller of the story of the big data vodoo, with which political opinions can be turned 180 degrees and supposedly hopeless elections can be won. With the skillful self-marketing, he was a guest at congresses (including the German) marketing industry.

Then there are the dazzling whistleblowers: inside. Christopher Wylie is the main source for the exposure story in the British Observer, but only turned to the public after his attempt to build his own Cambridge Analytica clone failed. Brittany Kaiser is the main character of a Netflix documentary about the scandal and author of her own book, but only jumped on the bandwagon when her employer was on the verge of public implosion. To this day, both are never at a loss for superlatives in relation to their old company - also because it helps to sell their own stories.

And last but not least, there is the self-proclaimed inventor of psychographic profiling with Facebook data: the psychologist Michal Kosinski, who developed the method at Cambridge University. He became famous even before the machinations of Cambridge Analytica were exposed through the "bomb" article in the Swiss magazine [PDF], in which he could rave about the quality of his forecasting model without being contradicted. To this day, Kosinski has benefited from this story, giving well-paid lectures all over the world on an allegedly inevitable privacy tsunami and has thus become the most prominent representative of the long-forgotten post-privacy ideology.

A few tens of thousands of votes made the difference

The exaggerated promises of the self-marketers: Inside, however, do not change the fact that the Cambridge Analytica case is one of the most important exposé stories of the last decade.

Like no other, the scandal has brought the use of personal data in political marketing to public awareness. It showed how negligent Facebook is with its users' data and was a turning point for the public image of the blue data company. He showed how unscrupulous companies and researchers can handle citizens' personal information if they are allowed to. He has illustrated that data protection has so far been the only effective means of illuminating and controlling the gray areas of political microtargeting.

And the scandal has proven that Donald Trump was not afraid to get his hands dirty in order to get into office. For this he did not have to politically change the polarity of those sympathetic to the democratic camp with microtargeting. It was enough to keep them from voting in the first place. Because in the end he won the election with a few ten thousand votes in some swing states. Together with Cambridge Analytica, his team has developed a strategy to demobilize black people in particular with targeted negative advertising. The social graphs, likes, and psychological assessments of 30 million Americans: ye will have had their part in it.

Lack of transparency in Germany too

Meanwhile, the revelations around Cambridge Analytica continue. It was only in mid-October that a US non-governmental organization filed a complaint with the Federal Election Commission. The accusation: illegal coordination between Trump's team and the Robert Mercer-funded super PAC "Make America Number 1", in which Cambridge Analytica acted as an intermediary.

If you want to take seriously the warning from ICO boss Denham about the vulnerability of democratic systems through the misuse of personal data in a political context, you don't have to look across the Atlantic first. In Europe, too, data-driven campaigns are becoming more and more standard. That does not have to be a problem in itself and the General Data Protection Regulation limits the likelihood of abuse. But the example of the Austrian Post, which sold contact details and information on political affinities of millions of people to political parties, shows that borders are being exceeded in this country too.

In Germany, politicians are comparatively cautious when it comes to microtargeting, but still refuse real transparency to this day. But that would be the minimum to prevent abuse. Even better would be democratically legitimized rules for the use of personal data in political communication.

Elisbaeth Denham has now completed her investigation into the Cambridge Analytica case. However, the subject is far from over for them. In her letter to parliament, she announced further investigations for the near future. In addition to the industry of data dealers and around the psychology department of the University of Cambridge, she also wants to look at the data use of the British parties.

Would you like more critical reporting?

Our work at is financed almost exclusively by voluntary donations from our readers. With an editorial staff of currently 15 people, this enables us to journalistically work on many important topics and debates in a digital society. With your support, we can clarify even more, conduct investigative research much more often, provide more background information - and defend even more fundamental digital rights!

You too can support our work now with yours Donation.

About the author


Ingo is a communication scientist and has been an editor at since 2016. He writes and speaks about data politics, surveillance capitalism and the digital structural change of the public. Ingo gives workshops for young and older people in digital self-defense and teaches at universities on the political economy of digital media. He also moderates events and discussions, for example at the re: publica or at the Internet Political Evening in Berlin. Ingo is a member of the Digital Society Association and the EKD Chamber of Social Ethics and advises church organizations on digital transformation. Contact: Ingo is by mail to ingo | point | dachwitz | ett | (PGP key) available and on Twitter as @roofjoke.
Published 10/23/2020 at 7:30 AM