Ted Cruz is still using a blacklisted Cambridge Analytica app developer

06 Nov Ted Cruz is still using a blacklisted Cambridge Analytica app developer

In his re-election campaign’s final hours, Senator Ted Cruz (R-TX) is still deploying a smartphone app created by a software team at the heart of the Cambridge Analytica controversy.

The app, Cruz Crew, was developed by AggregateIQ, a small Canadian data firm that was for years the lead developer used by the infamous data analytics consultancy that made headlines last spring for harvesting user data on millions of unsuspecting Facebook users while working for the Trump campaign. Since that firm’s demise, AggregateIQ has become one focus of an international investigation into alleged data misdeeds during the 2016 Brexit campaign, and is the first company to be targeted by regulators under Europe’s new data privacy law.

Both Cruz Crew as well as an app for Cruz’s presidential campaign in 2016 share an interconnected history of developers and clients linked to Cambridge Analytica, its British affiliate SCL Elections, and architects of the Republican Party’s recent digital efforts. Part of a group of apps presented as walled-garden social networks for political supporters, the software helps campaigns collect voter data and microtarget messages.

In April, Facebook announced it had suspended AggregateIQ over its possible improper access to the data of millions of Facebook users. But over a dozen apps made by AggregateIQ remained connected to Facebook’s platform until May and June, when Facebook belatedly took action against them.

A Facebook spokesperson told Fast Company that it was still investigating AIQ’s possible misuse of data, amid an ongoing investigation by Canadian prosecutors. The Cruz campaign did not respond to requests for comment.

David Carroll, a professor at Parsons School of Design at the New School in New York, who has brought a legal challenge against SCL and Cambridge Analytica for release of his voter data profile, said Cruz’s continued relationships with AggregateIQ highlighted problems with the use of data by a growing ecosystem of partisan election apps and databases. The risks are particularly high, he said, when the vendors are combining data from multiple sources and processing Americans’ data overseas.

“Despite the Cambridge Analytica fiasco, it seems that the Republican data machine is still a shadowy network that includes international operators, tangled up with vendors under intense scrutiny for unlawful conduct in multiple jurisdictions,” he said. “I don’t understand why Republicans don’t insist on working with domestic tech vendors and technologists who are U.S. citizens.”

The Cruz-Cambridge Analytica connection

During the 2016 race, a U.S.-based software firm named Political Social Media, but better known as uCampaign, was credited as developer and publisher for the official “Ted Cruz 2016” presidential primary app. At the time, the app achieved modest notoriety as a somewhat novel data collection tool– appearing alongside Cambridge Analytica under headlines like, “Cruz App Data Collection Helps Campaign Read Minds of Voters”–with the app colloquially referred to in the press as “Cruz Crew.”

As in 2016, the 2018 Cruz re-election campaign relies on constant polling and voter modeling to understand and target mainstream conservatives in Texas. Cruz and his Democratic challenger Beto O’Rourke, who has repeatedly brought up Cambridge Analytica during the campaign and has refused to use big data analytics, have both heavily invested in social media. The media blitz hasn’t been cheap: According to data from the Center for Responsive Politics, the candidates in the 2018 Texas Senate race have set the all-time record for most money spent in any U.S. Senate election.

As part of its digital push, the Cruz campaign rolled out a new app, officially named “Cruz Crew,” which awards points to users for tweeting pro-Cruz messages, volunteering, and taking part in other campaign activities. On the app’s pages in the Google and Apple stores, AggregateIQ is not mentioned, but its name is visible as the developer in the app URL and in internal code. The app’s publisher is listed as the political marketing agency WPA Intelligence, or WPAi.

Chris Wilson, WPAi’s founder and chief executive, is a veteran GOP pollster who previously worked for George W. Bush and Karl Rove. WPAi’s past campaign successes include a trio of high profile Tea Party-cum-Freedom Caucus sympathizer senators: Cruz, Mike Lee (R-UT), and Ron Johnson (R-WI). By far, however, Cruz has been WPA’s biggest political client in the U.S. Between his bids for senator and president, Cruz campaign committees have paid out over $4.3 million to Chris Wilson’s firm since 2011.

As the director of research, analytics and digital strategy for Cruz’s 2016 presidential campaign, Wilson oversaw a large data team that included Rebekah Mercer and Steve Bannon’s Cambridge Analytica. Rebekah’s father, Robert Mercer, footed the $5.8 million bill for Cambridge Analytica by doubling that amount in donations.

Wilson and the Cruz team have repeatedly said that Cambridge Analytica represented to the campaign that all of the data it had was legally obtained. They also claimed that Cambridge did not deliver the results expected of them, neither through their much-discussed psychographics work nor through an important piece of software called Ripon.

In schematics, Ripon was drawn up as an all-in-one campaign solution to manage voter data collection, ad targeting, and street canvassing. According to files retrieved by computer security analyst Chris Vickery, Ripon was intended to tap into something called “the Database of Truth.” Documents revealed that the Truth project “integrates, obtains, and normalizes data from disparate sources,” beginning with the Republican National Committee’s Data Trust database, combined “with state voter files, consumer data, third-party data providers, historical WPA survey, and projects and customer data.”

Despite being a deliverable promised by Cambridge Analytica, the work on Ripon was outsourced to AggregateIQ. More recently, WPAi hired the firm to develop and manage the software for Cruz Crew, along with its two other currently available apps: one for Texas Governor Greg Abbott’s re-election campaign, and one for Osnova, a Ukrainian political party dedicated to the long-shot presidential aspirations of its oligarch founder, Serhiy Taruta.

In the 2018 race, WPAi and the Cruz campaign have said Cruz’s effort isn’t using new Cambridge Analytica-style “psychographic” modeling, but it is using social media data for specific targeting, and relying on previous campaign data. “We use social data to ID voter groups in our core universes,” WPA’s Chris Wilson previously told Fast Company. “A lot of those are 2016 voters who we know are persuaded by specific messages.”

Cruz Crew and TedCruz.org currently share a privacy policy has barely changed since late 2015, when Cambridge Analytica and uCampaign were Cruz vendors. In both cases, the policy states that the campaign may “access, collect, and store personal information about other people that is available to us through your contact list,” match the info to data from other sources, and “keep track of your device’s geographic location.”

Beyond the existing campaign app, however, AIQ’s current involvement in the Cruz campaign’s data management and software development is unknown. A report by the New York Times last month found that when users shared their friends’ contact information with the Cruz app, that data was still being sent to AggregateIQ domains.

Wilson told the Times that his company, not AggregateIQ, received and controlled app users’ information. Representatives for AggregateIQ did not immediately respond to a request for comment, and WPAi did not respond to questions about the data firm.

Intelligence quotient

AIQ, founded in 2013 in Victoria, British Columbia, is currently under investigation in the U.K. and its homebase of Canada for electoral impropriety during the Brexit Leave campaign. The company’s name has come up repeatedly in parliamentary testimony for its alleged campaign finance and data protection misdeeds in connection with the parent company of Cambridge Analytica.

“Concerns have been raised about the closeness of the two organizations including suggestions that AIQ, [SCL Elections, and Cambridge Analytica] were, in effect, one and the same entity,” stated a recent report by the U.K.’s Information Commissioner’s Office.

In testimony to a U.K. parliamentary committee, former Cambridge Analytica executive Brittany Kaiser said that AggregateIQ was the exclusive digital and data engineering partner of SCL, the British parent affiliate of Analytica.

“They would build our software, such as a platform that we designed for Senator Ted Cruz’s campaign,” she said. “That was meant to collect data for canvassing individuals who would go door-to-door collecting and hygiening data of individuals in those households. We also had no internal digital capacity at the time, so we did not actually undertake any of our digital campaigns. That was done exclusively through AggregateIQ.”

AIQ founders Zack Massingham and Jeff Silvester had been brought into the fold a year prior by their friend Christopher Wylie, then an SCL employee, who blew the whistle on the firm’s practices earlier this year. According to Wylie, the founders registered their company in their hometown of Victoria as a result of an SCL contract, which subsequently led to political work in the Caribbean.

After the two firms first made contact in August 2013, while SCL was performing its first American political work in the Virginia gubernatorial race, AIQ designed solutions for deployment in campaigns under SCL’s supervision in Trinidad and Tobago. Part of the intent, according to records obtained by the Globe and Mail, was to harvest the internet histories of up to 1.3 million civilians in order to more accurately model their psychographics for message targeting.

In December 2013, an SCL employee proposed requesting the data from the country’s internet provider by posing as academic researchers, while seeking to tie internet addresses to billing addresses, without naming customers. In response, AIQ CEO Massingham replied by email that he could use every bit of data they could get. “If the billing addresses are obfuscated, we’ll have a difficult time relating things back to a real person or household,” he wrote. It remains unknown if that data was obtained.

Related: How Cambridge Analytica fueled a shady global passport bonanza

The primary work AIQ performed was to design software that could be used to motivate volunteers, canvassers, and voters. This software concept was repeated for multiple clients, including Petronas, an oil company that sought to influence voters in Malaysia.

AggregateIQ’s work across the pond

During the U.K.’s Brexit campaign in 2016, Vote Leave hired AIQ to place online ads, with AIQ paying for all 1,034 Facebook ads run by the campaign. AIQ’s services were also retained to develop and administer a piece of software that Vote Leave executives, including chief technology officer and former SCL employee Thomas Borwick, later credited with a large portion of the campaign’s success.

Vote Leave campaign director Dominic Cummings wrote an extensive blog post about the project, called the Voter Intention Collection System (VICS).

“One of our central ideas was that the campaign had to do things in the field of data that have never been done before,” Cummings wrote. “This included a) integrating data from social media, online advertising, websites, apps, canvassing, direct mail, polls, online fundraising, activist feedback . . . and b) having experts in physics and machine learning do proper data science in the way only they can, i.e. far beyond the normal skills applied in political campaigns.”

As the voter-facing front end for the Leave campaign data team, uCampaign was brought in and paid by AIQ to deliver the smartphone apps that helped to gather users’ cell numbers, email addresses, phone book contacts, and Facebook IDs for integration, exactly as it had done during the previous months for the Cruz 2016 campaign. Just as in that case, the app collected voter information for use in AIQ tools.

“We could only do this properly if we had proper canvassing software,” Cummings wrote. “We built it partly in-house and partly using an external engineer who we sat in our office for months.”

AIQ’s Zach Massingham repeatedly flew to the U.K. as his company was paid hundred of thousands of pounds for its Vote Leave work in 2016 after a series of transactions between several campaigns that Canadian officials have questioned as “money laundering” and British authorities are investigating as criminal offenses. Nonetheless, after the referendum, Cummings released an open-source version of VICS code on Github for future micro-targeters to use.

In early 2018, one of Vote Leave and SCL vet Thomas Borwick’s handful of data firms, Kanto, was hired to do canvassing and social media work during the Irish abortion referendum. Anti-abortion activist groups also contracted uCampaign to build two separate apps, which alarmed campaign finance and privacy watchdogs and led to a ban on internet advertising.

As with uCampaign, which has also made apps for the likes of Donald Trump and the NRA, AIQ’s smartphone apps were designed to gather information via Facebook Login, a tool offered by Facebook to streamline user registration across the internet. Though Facebook tightened some restrictions this year as a direct response to the Analytica flare-up, Login has allowed third-party developers to gain access to a wide range of Facebook account information about registered users.

As part of its investigation into Cambridge Analytica and its affiliates, on April 7, Facebook said that it had suspended AIQ, effectively ending its ability to deploy Facebook Login. However, security researcher Chris Vickery discovered that AIQ’s access to the Facebook platform was still active as of May 17. Additionally, he found, AIQ had already collected info on nearly 800,000 Facebook account IDs in a database, with many matched to addresses and phone numbers. Facebook removed more AIQ apps two weeks later, but it was not until June 19 that the Facebook Login feature was removed from the apps for Cruz, Osnova, and Abbott.

In written testimony to Parliament, AIQ chief technology officer Jeff Silvester, who visited British prime minister Theresa May’s office with Massingham in the weeks after the Brexit vote, explained the history of the relationship between SCL and AIQ, which began in late 2013.

After building a “customer relationship management (CRM) tool” for SCL in Trinidad and Tobago, AIQ created “an entirely new CRM tool” for the 2014 U.S. midterm elections. “SCL called the tool Ripon,” Silvester wrote. AIQ was then required to transfer all software rights to SCL before working “with SCL on similar software development, online advertising, and website development” in support of Cambridge Analytica’s work for the Ted Cruz 2016 campaign.

A referral from “an acquaintance who was working with Vote Leave” led to AIQ being hired by Vote Leave in April 2016, the day before the campaign was designated as the official Leave organization.

This past May, after questioning the legality of AggregateIQ founder Zach Massingham’s work on British soil while developing VICS, parliamentary committee chair Damian Collins asked Silvester about AIQ’s recent work for WPAi.

Silvester explained, “They sell their software that we create for them to whomever they like, and we just simply support that work.”

In March, WPAi CEO Chris Wilson told Gizmodo that he had almost no knowledge of the controversy surrounding AIQ, despite their work for the Cruz 2016 campaign. “I would never work with a firm that I felt had done something illegal or even unethical,” he said. The firm’s work for WPA was the result of a competitive bidding process, he said, and AIQ “offered us the best capabilities for the best price.”

Leaving the nest

In February 2017, a story on the Politico Pro website announced Archie, WPA Intelligence’s new piece of software for 2018 campaigns. The software goes by a nickname used by Texas Governor Greg Abbott’s political team, referring to Archimedes, the Greek mathematician who said, “Give me a lever and I can move the world.”

“The program allows campaigns to work across all formats and vendors to collect data in one place,” the article said, and campaign staffers “will be able to use the app to generate models, target audiences, cut lists, and produce data visualization tools to make strategic decisions.”

From that description, Archie sounded very much like AIQ’s Ripon and VICS all-in-one campaign solutions. AIQ’s smartphone app for WPAi client Greg Abbott first appeared on Google Play and Apple’s iOS Store three months later, in May 2017.

Archie’s predictive modeling of Texan voters “yielded approximately 4.5 million individual targets for turnout efforts,” according to WPAi. That helped the Abbott campaign win the 2018 Reed award for Best Use of Data Analytics/Machine Learning in Field Program. In attendance at the March ceremony were representatives from Cambridge Analytica, which was nominated for Best Use of Online Targeting for Judicial Campaign.

Three weeks after the Reed awards, Christopher Wylie’s whistleblower account in the Observer were splashed across the world’s front pages. By the following month, SCL and Analytica were claiming bankruptcy, and AIQ’s cofounders were appearing at Canadian Parliament and dealing with its suspension from Facebook as developers.

Watch these 30 seconds. pic.twitter.com/oyOYaADcuZ

— Chris Vickery (@VickerySec) June 12, 2018

In June, a week before AIQ’s WPA apps finally removed Facebook Login, Silvester appeared before Canadian Parliament for a second time, where he was admonished by Vice Chair Nathaniel Erskine-Smith, who remarked, “Frankly, the information you have provided is inadequate.” After being threatened with a contempt charge for excusing himself from sworn testimony with a one-line doctor’s note, Massingham later spoke with the committee via audio-only link from his lawyer’s office.

In July, AggregateIQ was served with the U.K.’s first-ever enforcement notice under the EU’s new General Data Protection Regulation, known as GDPR. The U.K.’s Information Commissioner’s Office subjected AIQ to millions in fines if it did not “cease processing any personal data of U.K. or EU citizens obtained from U.K. political organizations or otherwise for the purposes of data analytics, political campaigning, or any other advertising purposes.”

After AIQ appealed the order, it was merely mandated to “erase any personal data of individuals in the U.K.,” though it was found to have “processed personal data in a way that the data subjects were not aware of, for purposes which they would not have expected, and without a lawful basis for that processing.”

As Ted Cruz wraps up his campaign, he continues to outsource part of his voter data harvesting to a foreign firm that has been blacklisted by Facebook and British and European regulators. The total data amassed through apps like Cruz Crew and projects like Ripon and Archimedes remains unknown, but they raise concerns that Cruz acknowledged when he launched his presidential campaign at Liberty University in March 2015. “Instead of a government that seizes your emails and your cell phones,” he said, “imagine a federal government that protected the privacy rights of every American.”

Jesse Witt (@witjest) is an independent researcher, writer, and filmmaker.

With additional reporting by Alex Pasternack.

Source: Fast Company