LONDON — As the upstart voter-profiling company Cambridge Analytica prepared to wade into the 2014 US midterm elections, it had a problem.
The firm had secured a $15 million investment from Robert Mercer, the wealthy Republican donor, and wooed his political adviser, Stephen K. Bannon, with the promise of tools that could identify the personalities of US voters and influence their behavior. But it did not have the data to make its new products work.
So the London-based firm harvested private information from the Facebook profiles of more than 50 million users without their permission, according to former Cambridge Analytica employees, associates, and documents, making it one of the largest data leaks in the social network’s history.
The breach allowed the company to exploit the private social media activity of a huge swath of the US electorate, developing techniques that underpinned its work on President Trump’s campaign in 2016.
An examination by The New York Times and The Observer of London reveals how Cambridge Analytica’s drive to bring to market a potentially powerful new weapon put the firm — and wealthy conservative investors seeking to reshape politics — under scrutiny from investigators and lawmakers on both sides of the Atlantic.
Christopher Wylie, who helped found Cambridge and worked there until late 2014, said of its leaders: “Rules don’t matter for them. For them, this is a war, and it’s all fair.”
“They want to fight a culture war in America,” he added. “Cambridge Analytica was supposed to be the arsenal of weapons to fight that culture war.”
Details of Cambridge’s acquisition and use of Facebook data have surfaced in several accounts since the business began working on the 2016 campaign, setting off a furious debate about the merits of the firm’s so-called psychographic modeling techniques.
But the full scale of the data leak involving Americans has not been previously disclosed — and Facebook, until now, has not acknowledged it.
Interviews with a half-dozen former employees and contractors, and a review of the firm’s e-mails and documents, have revealed that Cambridge not only relied on the private Facebook data but still possesses most or all of the trove.
Cambridge paid to acquire the personal information through an outside researcher who, Facebook says, claimed to be collecting it for academic purposes.
During a week of inquiries from the Times, Facebook downplayed the scope of the leak and questioned whether any of the data still remained out of its control. But on Friday, the company posted a statement expressing alarm and promising to take action.
“This was a scam — and a fraud,” Paul Grewal, a vice president and deputy general counsel at the social network, said in a statement to the Times earlier on Friday.
He added that the company was suspending Cambridge Analytica, Wylie, and the researcher, Aleksandr Kogan, a Russian-American academic, from Facebook. “We will take whatever steps are required to see that the data in question is deleted once and for all — and take action against all offending parties,” Grewal said.
Alexander Nix, the chief executive of Cambridge Analytica, and other officials had repeatedly denied obtaining or using Facebook data, most recently during a parliamentary hearing last month.
But in a statement to the Times, the company acknowledged that it had acquired the data, though it blamed Kogan for violating Facebook’s rules and said it had deleted the information as soon as it learned of the problem two years ago.
Saturday afternoon, Massachusetts Attorney General Maura Healey announced that her office would investigate the matter. “#BREAKING: Massachusetts residents deserve answers immediately from Facebook and Cambridge Analytica,” Healey tweeted. “We are launching an investigation.”
The attorney general’s office confirmed that it was opening a civil investigation and had been in touch with Facebook already.
In Britain, Cambridge Analytica is facing intertwined investigations by Parliament and government regulators into allegations that it performed illegal work on the Brexit campaign. The country has strict privacy laws, and its information commissioner said on Saturday that she was looking into whether the Facebook data was “illegally acquired and used.”
In the United States, Mercer’s daughter, Rebekah, a board member, Bannon, and Nix received warnings from their lawyer that it was illegal to employ foreigners in political campaigns, according to company documents and former employees.
Congressional investigators have questioned Nix about the company’s role in the Trump campaign. And the Justice Department’s special counsel, Robert S. Mueller III, has demanded the e-mails of Cambridge Analytica employees who worked for the Trump team as part of his investigation into Russian interference in the election.
While the substance of
Mueller’s interest is a closely guarded secret, documents viewed by the Times indicate that the firm’s British affiliate claims to have worked in Russia and Ukraine.