The first I heard about the Cambridge Analytica/Facebook story was when someone posted a link to the Facebook blog, which stated that Facebook suspended SCL and their political data analytics firm Cambridge Analytica. I have read about the company before and was not really surprised but what did surprise me was all the new media attention that followed and especially the big outrage surrounding Facebook and Mark Zuckerberg. I believe it is based on a misunderstanding of what really happened and how online ads actually work.

So let’s go back to what I have read about Cambridge Analytica before. This German article (here is an English version, that is also not behind a paywall) was originally published in December 2016 in “Das Magazin”, which is a weekly supplement of some Swiss newspapers. I don’t remember where and when exactly I’ve come across it but if you read the article – and I do recommend that – you start to wonder what all the current fuss is about. The original story focuses on Michal Kosinksi, a researcher at Cambridge University who developed a method with his team to extract psychological traits just using a person’s Facebook “likes”. The process is simple: they used a Facebook app to let people fill out a personality questionnaire (similar to this one) which is the traditional way to get a person’s “Big 5” or OCEAN profile. Then they correlated the results with the data points they received through the user’s Facebook profile. The more people filled out the survey the stronger the correlation data was. To his own surprise Kosinski ended up with millions of profiles. I’m reminded of the days in which friends on Facebook constantly posted some sort of survey result. Kosinski and his team had enough data that they could make predictions about a person simply based on their “likes” and as the article says they made same bold statements.

“Before long, he was able to evaluate a person better than the average work colleague, merely on the basis of ten Facebook ‘likes.’ Seventy ‘likes’ were enough to outdo what a person’s friends knew, 150 what their parents knew, and 300 ‘likes’ what their partner knew. More ‘likes’ could even surpass what a person thought they knew about themselves.”

— Hannes Grassegger & Mikael Krogerus

This happened in an academic context and the work is ongoing, but it is also used in commercial aspects and of course ad targeting as can be gathered from their own website.

Now where does Cambridge Analytica fit into all of this? In early 2014 Alexandr Kogan, an assistant professor at the psychology department, approached Kosinski because he was interested in the data on behalf of SCL, Strategic Communication Laboratories, the PR company that founded Cambridge Analytica. Kosinski was worried about the use of his methods in a political campaign and broke off contact with Kogan. However, nothing could stop Kogan from replicating the survey and apparently that’s exactly what he did. He used Amazon’s Mechanical Turk to pay people to take part in his survey via a Facebook app and generate the correlation data. Instead of stopping there, he also accessed some of the participants’ friends’ data which was possible through the Facebook API at that time, depending on their privacy settings. Those people never filled out the psychological survey and so their psychological profiles are based on the results from the others. So instead of just working with an anonymized correlation set, which would be a valuable asset for a marketing company already, Kogan decided to use the concrete user profiles and even sell them on to SCL. At least that is the accusation that The Guardian researched back in 2015 when Cambridge Analytica was working for the Ted Cruz campaign. To my understanding this is also what Facebook is referring to in its recent blog post:

“In 2015, we learned that […] Dr. Aleksandr Kogan lied to us and violated our Platform Policies by passing data from an app that was using Facebook Login to SCL/Cambridge Analytica, a firm that does political, government and military work around the globe. He also passed that data to Christopher Wylie of Eunoia Technologies, Inc.”

— Facebook Newsroom

Facebook’s reaction back then was to remove the app and demand that all the gathered data must be destroyed.

Whistleblowers and Secret Tapes

So that’s all old news. Facebook’s statement also mentions Christopher Wylie and his company Eunoia Technologies, Inc., who is the “whistleblower” the New York Times bases their article on. The article reiterates what happened in 2014 and crucially Cambridge Analytica still possesses most of the data obtained from Facebook. This is based on interviews with former employees and contractors. Wylie himself ended his work with Cambridge Analytica already in late 2014.

On top of that Britain’s Channel 4 had a man pose as potential Sri Lankan client for Cambridge Analytica and secretly filmed its CEO Alexander Nix offering all sorts of shady PR services that have nothing to do with targeted advertising. It’s more about getting dirt on political opponents and if they cannot find any, Nix doesn’t seem to have a problem with fabricating it. In my opinion that is the real story here. It sheds a light on Cambridge Analytica, their tactics and what sort of messaging Nix and his team uses and may have used in Trumps presidential campaign.

Instead the public’s focus seems to be on Facebook and an alleged data breach even though no data was stolen. It feels like we are reliving a discussion from 2011 about Facebook’s too open default privacy settings. Yes, it took them a while to change that, but new defaults, API rules, constant user awareness campaigns have been in effect for years now.

There is an argument to be made that Facebook should have informed all affected users as soon as it learned about Kogan’s policy breach and that it should set stricter standards for allowing app developers on its platform, but I don’t think that’s the discussion we are having right now. Instead there is #DeleteFacebook outrage that is circling around the ideas that Mark Zuckerberg is selling all our secrets, helped Trump win the presidential election, and censoring right- and left-wing voices all at the same time.

Microtargeting 101

Cambridge Analytica claims that it didn’t use any of 2014’s user profiles for the Trump campaign and regardless if they did, they wouldn’t really need to. For their microtargeting method the anonymized correlation set is what is important and even that can be recreated using surveys on and off Facebook. There is also no shortage of companies that are simply in the business of selling information about people. Those companies really do what Facebook is often accused of and most people don’t know anything about their own data there and how it was obtained. Maybe that would be a more important point worth discussing, also in light of Equifax’ data breach last year, which was an actual one.

I think it’s also worth pointing out that an actual ad is delivered using the targeting capabilities of the platform itself, be it Facebook, Twitter, Google or whatever ad platform they want to use. That’s what they do and earn their money with, showing you ads based on your location, age, gender, education, “likes”, browsing history, etc. The difficult part is to choose from all the options. Cambridge Analytica’s PR is all about how they don’t care much about specific demographics but about a user’s personality, which they think they can deduct from those same facts. Then they post messages specifically tailored to however many personality traits they are after. It’s a concept that is not so different from “personas”, an idealized buyer profile that you create before you start any marketing activity. Nobody simply posts ads by age group and gender anymore.

The public outcry about the recent news shows that there may be a new sensibility when it comes to privacy online. That’s great and the US could be ready for some serious regulation along the lines of the GPDR in the EU but judging from the current administration’s track record when it comes to consumer rights I doubt it.

What irks me is the knee-jerk reaction of “Facebook is evil”, without questioning what really happened and why. It’s good that there is a discussion but I’m afraid it just spreads a lot of misinformation and doesn’t create more awareness about privacy, online marketing, and also everybody’s own role in it.