Facebook's latest data scandal is just the beginning – and not even the worst of it, warn privacy experts

'I think this scandal is the tip of the iceberg'

The scandal over the collection of data by Cambridge Analytica is only one small part of a huge industry that uses Facebook and other services to manipulate people’s behaviour, experts have warned.

Many of those companies, like Cambridge Analytica, have avoided drawing attention to the work they do, and usually describe their work in the most general of terms. Such firms tend to describe themselves as data, technology and marketing firms, for instance.

But the reach those companies have is often vast. They collect trillions of pieces of information on billions of users across the world, claiming to offer insights into the people in its databases, who are not even aware of the fact they are being studied. The data is incredibly detailed, with companies collecting thousands of different pieces of information about each of the people they study.

The use of that information underlies many modern industries, and reaches into the most central parts of people’s lives. The Cambridge Analytica controversy has arisen in large part because it was being used by the Brexit and Trump campaigns – but as well as politics, the collection and use of data stretches deep into the most personal parts of our lives, and even attempts to predict whether people might come to commit a crime.

“I think this scandal is the tip of the iceberg,” said Javier Ruiz Diaz, policy director at Open Rights Group. “It also shows that there is a continuum between what you would call normal marketing and this completely unethical manipulation.”

The difficulty of picking between legitimate uses of data and unethical ones – as well as the broad use of such firms – makes legislating against it very difficult.

Downing Street released a statement calling the breach “very concerning” on Monday, but further disclosures in a Channel 4 News investigation have shown that the company discussed propaganda, disinformation and extortion tactics with prospective clients.

Liam Byrne, Labour’s shadow minister for digital, called the combination of big data companies and foreign powers an “unholy alliance” which demanded legislation to stop any “interfering in our democracy”.

The use of data underpins the very idea of free services, which are paid for by collecting data about their users and then allowing advertisers to target them. But that same advertising data is being used to change the results of elections and other political events – something that Facebook and other companies have highlighted when courting political parties.

“We have become accustomed to throwing away our data with scant regard to the insight companies have about our lives,” said Raj Samani, McAfee Fellow and Chief Scientist. “Often we hear and worry about cybercriminals stealing from our devices, but in the same vein we accept ‘free’ services and pay by giving away every insight into our lives and those of our families.”

Cambridge Analytica’s work was described by the company’s chief data officer, Alex Taylor, in a documentary.

“If you’re collecting data on people and you’re profiling them, that gives you more insight that you can use to know how to segment the population, to give them messaging about issues that they care about, and language and imagery that they’re likely to engage with,” said Mr Taylor, in a secretly filmed meeting with Channel 4 News, broadcast on Monday.

“We used that in America and we used that in Africa. That’s what we do as a company.”

But that same description could apply to Facebook itself, as well as a whole host of other data broker companies that do similar work to Cambridge Analytica.

“We see data exploitation happening in the entire advertising ecosystem – the certainly unethical, and perhaps unlawful harvesting of data,” said Frederike Kaltheuner, who leads Privacy International’s Data Programme.

“So if you’re worried about this harvesting of Facebook data, you should also be worried about the ways in which third parties are tracking and profiling you. These companies, that you aren’t even aware of, hold vast amounts of very personal, very intimate information about you.”

It is almost impossible to know how effective the work of Cambridge Analytica was in the Brexit, Trump or other campaigns it has been attached to, since it cannot be measured. But other similar companies point to spectacular successes – many of them reaching to the most high-profile crimes and high-risk situations.

Palantir, for instance, describes itself as a firm that makes products that “transform the way organisations use their data”. But the company, backed by Trump ally Peter Thiel, is reported to have clients including many of the most secretive and powerful parts of the US government: a document leaked in 2015 said it was being used by the CIA, the NSA, the FBI, the Marine Corps and the Air Force.

Though the company says very little about what it does, it is thought to be something like the crime prediction powers fictionalised in Minority Report. Its software can run through vast amounts of data and try to pick out the people who might be involved in crime – it is said to have helped identify the scams run by Bernie Madoff, and has been deployed in Iraq to predict where roadside bombs might be detonated.

Other companies are involved in the collection and sale of more personal, less specific data. The firm Equifax, for instance, came to the fore when it was revealed last year that it had been hacked; many of the people involved were told that some of their most private information might have been disclosed, despite not even knowing that they had been part of the company’s database.

There have been substantial concerns about the lack of transparency around data brokers since at least 1970, when the US passed the Fair Credit Reporting Act. But that law only covers companies that buy and sell data for credit, employment and other similar purposes, and left exempt companies that use that data for marketing or political campaigns.

Since then, there have been relatively few regulations on both data brokers and the social networks who are customers of each other. Much of the data collected by US authorities – such as crime and even some health records – are readily available to data providers.

The EU and the UK, for instance, are both working on new data protection law this year. But such regulations require input from the US, and campaigners said that little is likely to be done without global pressure.