{"id":14417,"date":"2019-01-25T10:45:02","date_gmt":"2019-01-25T18:45:02","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/01\/25\/news-8169\/"},"modified":"2019-01-25T10:45:02","modified_gmt":"2019-01-25T18:45:02","slug":"news-8169","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2019\/01\/25\/news-8169\/","title":{"rendered":"One Man\u2019s Obsessive Fight to Reclaim His Cambridge Analytica Data"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/media.wired.com\/photos\/5c4a19d59f7d4c2cf990b86c\/master\/pass\/Backchannel-David-Carroll-2w.jpg\"\/><\/p>\n<p><strong>Credit to Author: Issie Lapowsky| Date: Fri, 25 Jan 2019 11:00:00 +0000<\/strong><\/p>\n<p><span class=\"lede\">It\u2019s 8 on<\/span> a Wednesday morning in January, and David Carroll\u2019s Brooklyn apartment, a sunny, wood-beamed beauty converted from an old sandpaper factory, is buzzing.<\/p>\n<p><span class=\"lede\">His 10-year-old daughter, <\/span>dressed in polka-dot pants, dips out the front door and off to school, Jansport backpack slung over her shoulders. His 5-year-old son darts into the living room in a luchador mask he picked up on the family\u2019s holiday trip to Mexico. (His wrestling name, he tells me, is Diablo.) Carroll\u2019s wife, Alex, who was unaware a reporter was coming to interview her husband this morning, hurries around picking up the detritus any family of four might leave behind in the morning rush and tucking away product samples from her job as a market researcher. There\u2019s a crayon drawing on the coffee table, an intricate toy camping scene set up on the floor. And on the refrigerator, someone\u2014I suspect the boy\u2014has spelled out the word POOP in multicolored alphabet magnets.<\/p>\n<p>For most everyone in Carroll\u2019s bustling household, today is a morning like any other. Not for Carroll. This morning, he rolled out of bed at 6 am to news that the parent company of Cambridge Analytica, the now defunct international conglomerate, had pled guilty to criminal charges of disobeying a British data regulator.<\/p>\n<p>The story of how the data analytics firm and former Trump campaign consultant misappropriated the Facebook data of tens of millions of Americans before the 2016 election is by now well known. But the company\u2019s guilty plea wasn\u2019t really about all those headlines you\u2019ve seen splattered in the news over the past year. Instead, their crime was defying a government order to hand over all of the data they had ever collected on just one person: David Carroll.<\/p>\n<p>For more than two years, Carroll, a professor of media design at The New School in Manhattan, has been on an obsessive, epically nerdy, and ultimately valuable quest to retrieve his data from Cambridge Analytica. During the 2016 election, when the firm worked for both the Trump campaign and senator Ted Cruz\u2019s campaign, its leaders bragged openly about having collected thousands of data points to build detailed personality profiles on every adult in the United States. They said they used these profiles to target people with more persuasive ads, and when President Trump won the White House, they hungrily accepted credit.<\/p>\n<p>A year ago, Carroll filed a legal claim against the London-based conglomerate, demanding to see what was in his profile. Because, with few exceptions, British data protection laws allow people to request data on them that\u2019s been processed in the UK, Carroll believed that even as an American, he had a right to that information. He just had to prove it.<\/p>\n<p>Carroll shuffles past me barefoot, a mug of coffee in one hand, his phone in the other. \u201cEnjoy the moment,\u201d he says, reading a message from his lawyer, Ravi Naik, who\u2019s been feeding him updates from London all morning. About an hour later, an email floats into Carroll\u2019s inbox from the British Information Commissioner\u2019s Office, the regulator that brought the charges. Carroll turns his phone toward me to reveal the news. Cambridge Analytica\u2019s parent company, SCL, is being fined the equivalent of roughly $27,000. Carroll\u2019s cut? About $222.<\/p>\n<p>He couldn\u2019t help but laugh. The sum is insignificant. The moment, anything but.<\/p>\n<p><span class=\"lede\">When he started <\/span>out, Carroll was an underdog, facing off against a corporation with ties to the president of the United States and backed by billionaire donor Robert Mercer. If he lost, Carroll would be on the hook for the opposing team\u2019s legal fees, which he wasn\u2019t quite sure how he\u2019d pay.<\/p>\n<p>But if he won, Carroll believed he could prove an invaluable point. He could use that trove of information he received to show the world just how powerless Americans are over their privacy. He could offer up a concrete example of how one man\u2019s information\u2014his supermarket punch card, his online shopping habits, his voting patterns\u2014can be bought and sold and weaponized by corporations and even foreign entities trying to influence elections.<\/p>\n<p>But more importantly, he could show what\u2019s possible in countries like the UK where people actually have the right to reclaim some of that power. He could prove why people in the United States, who have no such rights, deserve those same protections.<\/p>\n<p>Much has changed since David Carroll picked this fight with Goliath. Following a relentless flood of scandals last spring, <a href=\"https:\/\/www.wired.com\/story\/cambridge-analytica-shuts-down-offices-facebook-crisis\/\">SCL shuttered<\/a> and is now going through insolvency proceedings in the UK. The Cambridge Analytica scandal spurred just the kind of privacy awakening in the US that Carroll was seeking. Facebook <a href=\"https:\/\/www.wired.com\/story\/facebook-exposed-87-million-users-to-cambridge-analytica\/\">tightened<\/a> its hold on user data and has been increasingly asked to answer for all the ways it gave that data away in the first place. A strict data protection law passed unanimously in <a href=\"https:\/\/www.wired.com\/story\/california-unanimously-passes-historic-privacy-bill\/\">California<\/a> last summer, and members of Congress have begun floating plans for broader <a href=\"https:\/\/www.wired.com\/story\/tim-cook-data-broker-registry\/\">federal privacy legislation<\/a>.<\/p>\n<p>Carroll, meanwhile, has emerged as a cult hero of privacy hawks, who follow every turn in his case, Twitter fingers itching. This week, he\u2019ll become a movie star, appearing as a central character in a feature-length documentary called <em>The Great Hack<\/em>, premiering at the Sundance Film Festival. \u201cWe hope this film sheds light on what it means to sign the terms and conditions that we agree to every day,\u201d the filmmakers, Jehane Noujaim and Karim Amer, explained in an email. \u201cWhat does it mean when we actually become a commodity being mined?\u201d<\/p>\n<p>But for all that\u2019s changed during these past two years, so much has stayed the same. Despite SCL\u2019s guilty plea, Carroll still hasn\u2019t gotten his data. And Americans today have no more legal rights to privacy than they did when Carroll\u2019s crusade began two years ago. That could change this year. With a strict data protection law set to go into effect in California next January, even tech giants have begun pushing for federal regulation that would set rules for businesses across the country. Now more than ever, Carroll says, having that information in hand could help illustrate exactly how this new economy\u2014so often misunderstood and discussed in the abstract\u2014works. Which is why, nearly a year after the Cambridge Analytica story broke, and many months after its name has fallen out of the daily headlines, Carroll keeps fighting.<\/p>\n<p><span class=\"lede\">If you know <\/span>Carroll from Twitter\u2014where, as @profcarroll, he spends his days tweeting bombastically about Facebook\u2019s duplicity or stridently skewering obscure figures from the Trump campaign in long, snarky, and inscrutable threads\u2014then you couldn\u2019t possibly imagine the nervous, affable guy I first met in a downtown Manhattan coffee shop back in 2017.<\/p>\n<p>He looked exactly the way I expected a tenured liberal arts professor to look: gray stubble on his face, a disarming smile. I could easily imagine him in tweed. It was November 8, a year to the day since Donald Trump was elected president of the United States. That evening, Carroll sat across the table from me, a lit tea light casting his face in a film noir glow, and told me what he knew so far of his story.<\/p>\n<p>Carroll hadn\u2019t always been in academia. During the dotcom boom and bust, he worked in digital marketing and watched as advertising evolved from the sort of broad branding exercise that had been the dominion of television and print to an industry dominated by Google, which used infinite quantities of user data to hyper-target ads. When he left his marketing career to teach full time, Carroll, who has an MFA in design and technology, transformed from an industry participant to a chief critic, lecturing students on what he calls the \u201cmyth\u201d that advertising doesn\u2019t work if it\u2019s not targeted.<\/p>\n<p>In 2014, while he was on sabbatical, Carroll began working on a startup called Glossy, which integrated with Facebook to recommend articles from magazine archives based on users\u2019 interests. The idea never took off; Carroll couldn\u2019t get funding, and his early employees got quickly poached by tech giants. But he got just far enough to see how much user data Facebook was willing to give away in the name of growth. At the time, the social networking giant allowed developers to slurp up data not just from their own users but from their users\u2019 friends, all without their friends\u2019 awareness or explicit consent. Facebook didn&#x27;t officially end this policy until April 2015, and continued to give some developers access even after that.<\/p>\n<p>\u201cI saw how the sausage got made and how easy it was to amass data and create a surveillance infrastructure,\u201d Carroll says.<\/p>\n<p>Around that same time, across the Atlantic Ocean, another young professor at the University of Cambridge named Aleksandr Kogan was building an app of his own. It used a personality quiz to collect users\u2019 profile information, including their location, gender, name, and Page likes, and then spit out predictions about their personality types. Like Carroll, Kogan knew that when Facebook users took the quizzes, not only would their data be free for the taking, so would the data belonging to millions of their friends. Unlike Carroll, Kogan viewed that not as an invasion of privacy but as an opportunity.<\/p>\n<p>\u201cIt didn\u2019t even dawn on us that people could react this way,\u201d Kogan says.<\/p>\n<p>Beginning in 2014, Kogan paid about 270,000 US Facebook users to take the quiz, which Kogan has said unlocked access to some 30 million people\u2019s data. But Kogan wasn\u2019t just working on his own. He was collecting this information on behalf of SCL, which had big plans to use it to influence American elections. Kogan sold the data and his predictions to the company, and though he didn\u2019t know it then, lit the fuse of a time bomb that would detonate three years down the line.<\/p>\n<p>Carroll knew none of this at the time. But his experience building Glossy made him enough of a self-proclaimed \u201cprivacy nerd\u201d that by the time the 2016 election rolled around he was keeping a close eye on the presidential campaigns and their digital strategies. He was watching SCL\u2019s spinoff Cambridge Analytica, in particular, because it had taken credit for helping senator Ted Cruz win the Iowa primary, using so-called psychographic targeting techniques. But it wasn\u2019t until President Trump\u2019s upset victory, in a campaign that had been buoyed by Cambridge Analytica data scientists and consultants, that Carroll, a Democrat, began to worry about what this firm could really do with millions of Americans\u2019 information.<\/p>\n<p>He wasn\u2019t the only one. Thousands of miles away, in Geneva, Switzerland, a researcher named Paul-Olivier Dehaye, who now runs a digital rights nonprofit called PersonalData.IO, was deep into a months-long investigation of SCL. At the time, he was trying to answer a fundamental question about the company that was also rumored to have played a hand in promoting the Brexit referendum: Did Cambridge Analytica really know as much as it claimed? Or was it just selling snake oil? One way to answer that question conclusively, Dehaye believed, would be to see what information the company actually held.<\/p>\n<p>The UK\u2019s Data Protection Act guarantees the right to access data that\u2019s processed within the UK. But in the past, it was mainly British residents who had exercised that right. Few had ever tested whether the law applied to people outside of the country as well. Dehaye believed this would be the perfect opportunity to try, so he began reaching out to American academics, activists, and journalists, urging them to submit what is known as a \u201csubject access request\u201d to the company. It was Americans\u2019 data, after all, that Cambridge Analytica seemed most interested in. Carroll was one of Dehaye\u2019s targets.<\/p>\n<p>\u201cDavid was very vocal on Twitter, and he already knew a lot about ad tech,\u201d Dehaye says. \u201cThat\u2019s why I thought I had a chance to convince him.\u201d<\/p>\n<p>He was right. Carroll was one of a handful of people who accepted the challenge. He says he viewed the project as an academic experiment at first, and, he says, a good use of his tenure. \u201cI can\u2019t get fired for what I do,\u201d he said. \u201cMy job gives me the freedom to pursue these things. If I don\u2019t do it, who\u2019s going to?\u201d<\/p>\n<p>In early 2017, Carroll submitted his request, along with a copy of his driver\u2019s license, his electric bill, and a \u00a310 fee, which Dehaye paid. Then he waited. Dehaye never really expected Carroll to receive a response. In fact the story may have ended there, had SCL denied that Carroll had the right to his data from the outset. \u201cThey could have just said UK law doesn\u2019t apply to you because you\u2019re an American,\u201d Dehaye says.<\/p>\n<p>Instead, one Monday morning about a month later, as Carroll sat alone in his apartment, sipping coffee at the dining room table, an email landed in his inbox from the data compliance team at SCL Group. It included a letter signed by the company\u2019s chief operating officer, Julian Wheatland, and an Excel file laying out in neatly arranged rows and columns exactly who Carroll is\u2014where he lives, how he\u2019s voted, and, most interestingly to Carroll, how much he cares about issues like the national debt, immigration, and gun rights, on a scale of one to 10. Carroll had no way of knowing what information informed those rankings; the thousands of data points Cambridge Analytica supposedly used to build these predictions were nowhere to be found.<\/p>\n<p>\u201cI felt very invaded personally, but then I also saw it was such a public interest issue,\u201d Carroll says.<\/p>\n<p>He promptly <a href=\"https:\/\/twitter.com\/profcarroll\/status\/846347516341837825\" target=\"_blank\">tweeted<\/a> out his findings. To Carroll, his file seemed woefully incomplete. But to Dehaye and other experts of the internet, it seemed like exactly what he needed to prove a case. In answering Carroll at all, Dehaye argued, SCL conceded that even as an American, he was entitled to his data. But in showing him only the smallest slice of that data, Carroll and Dehaye believed, SCL had broken the law.<\/p>\n<p>Dehaye put Carroll in touch with Ravi Naik, a British human rights lawyer, who had worked on data rights cases in the past. \u201cImmediately, he was like, \u2018This is going to be a massive case. It\u2019s going to set precedents,\u2019\u201d Carroll says.<\/p>\n<p>Still, Naik was cautious, knowing that the case law regarding foreigners gaining access to their data was extremely limited, resting on just two cases where death row inmates from Thailand and Kenya had attempted to get their data from the British police. But Naik also viewed Carroll\u2019s case as the beginning of a new civil rights movement. \u201cIt\u2019s really balancing the rights of individuals against those with mass power,\u201d Naik says.<\/p>\n<p>In April 2017, Carroll and Naik sent what\u2019s known as a \u201cpre-action\u201d letter to SCL, laying out a legal claim. In the UK, these letters are used to determine if litigation can be avoided. In the letter, Naik and Carroll argued that not only had SCL violated the UK\u2019s Data Protection Act by failing to give Carroll all of the underlying data, the company hadn\u2019t received the proper consent to process data related to his political views to begin with. Under the law, political opinions are considered sensitive data.<\/p>\n<p>Once again, Carroll got no additional data in return. According to Alexander Nix, Cambridge Analytica&#x27;s then-CEO, the company shared certain data with Carroll as a gesture of &quot;good faith,&quot; but received legal advice that foreigners didn&#x27;t have rights under the Data Protection Act. Asked why the company didn&#x27;t share more of that data, Nix said, &quot;There was no legal reason to comply with this request, and it might be opening &#8230; a bottomless pit of subject access requests in the United States that we would be unable to fulfill just through the sheer volume of requests in comparison to the size of the company.&quot; (After answering WIRED&#x27;s questions, Nix retroactively asked for these answers to be off the record. WIRED declined.)<\/p>\n<p>Carroll wasn\u2019t the only person who had tried and failed to get his data from SCL. Initially, Naik says, about 20 people around the world were on board. But when it came time to bring the case to court, he says, they needed only one complainant, and it was Carroll who was most willing to take the risk. \u201cIt says a lot about David that he\u2019s willing to stand by not just his own rights but also the rights of everyone affected, to work out what this company was doing,\u201d Naik says.<\/p>\n<p>Carroll and Naik spent the bulk of 2017 preparing the case and hedging their bets against worst case scenarios, of which there were many. In the British legal system, whoever loses a legal case winds up paying the winning side\u2019s fees. Carroll worried that could amount to hundreds of thousands of dollars, the kind of costs he couldn\u2019t bear on his own. So that fall, Carroll launched his own legal defense fund on <a href=\"https:\/\/www.crowdjustice.com\/case\/scl\/\" target=\"_blank\">CrowdJustice<\/a> and announced his plans to file the complaint in <em><a href=\"https:\/\/www.theguardian.com\/technology\/2017\/oct\/01\/cambridge-analytica-big-data-facebook-trump-voters\" target=\"_blank\">The Guardian<\/a>.<\/em> Suddenly, he was flooded with support from strangers who\u2019d grown similarly suspicious of Cambridge Analytica. He raised nearly $33,000 in a matter of weeks. Today, he\u2019s raised another $10,000 more.<\/p>\n<p>But for all the encouragement Carroll received, almost as soon as he went public with his plans he also got more than a few words of warning. Once, Carroll says, a Cambridge Analytica employee approached him after a film screening at The New School, shook his hand for a few beats too long, and told him to drop the case. Another time, Carroll got a mysterious email about a British journalist who had supposedly been investigating SCL when he died suddenly falling down the stairs. \u201cPlease don\u2019t forget how powerful these individuals are,\u201d the email read.<\/p>\n<p>It was almost certainly a coincidence, and Carroll never followed up with the woman who sent the email. \u201cI didn\u2019t want her to talk me out of it,\u201d Carroll says. But he still couldn\u2019t help but feel spooked. In the fall of 2017, he rightly felt like he had a lot to lose.<\/p>\n<p>The night we met in the coffee shop, I asked Carroll whether all these risks he was taking worried him. He smiled anxiously and said, \u201cIt scares the shit out of me.\u201d<\/p>\n<p><span class=\"lede\">A few months <\/span>later, I spotted Carroll across a crowded auditorium at PutinCon, a gathering of reporters, foreign policy experts, intelligence officials, and professional paranoiacs being held in an undisclosed location in Manhattan. The express purpose of the conference was <a href=\"https:\/\/putincon.com\/\" target=\"_blank\">to discuss<\/a> \u201chow Russia is crippled by totalitarian rule\u201d and explore how Russian president Vladimir Putin\u2019s power \u201cis based in fear, mystery, and propaganda.\u201d<\/p>\n<p>But Carroll had other matters on his mind. That day, March 16, 2018, his lawyers in London were finally serving SCL with a formal legal claim, requesting disclosure of his data and laying out their intention to sue for damages. The request had been more than a year in the making, and Carroll spent much of the morning darting out to the hallway, exchanging Signal messages with Naik, even though he was scared that any venue hosting something called PutinCon must have been hacked.<\/p>\n<p>After Naik\u2019s colleague served SCL with the paperwork, Carroll stood looking at his phone in satisfied disbelief. \u201cIt\u2019s finally real,\u201d he told me. \u201cIt\u2019s not just an idea anymore.\u201d<\/p>\n<p>There was one other thing. Carroll said he\u2019d heard \u201crumblings\u201d from British journalist Carole Cadwalladr that some big news regarding Cambridge Analytica was coming from <em>The Guardian<\/em> and <em>The New York Times<\/em>. \u201cIt\u2019s going to make Facebook look really bad,\u201d he said.<\/p>\n<p>Less than 24 hours later, Carroll turned out to be more right than he even knew. The next morning, photos of a pink-haired, self-styled whistleblower and former SCL contractor named Christopher Wylie were splashed across pages of <em>The New York Times<\/em> and <em>The Guardian<\/em>. \u201cRevealed: 50 million Facebook profiles harvested for Cambridge Analytica in major data breach,\u201d <a href=\"https:\/\/www.theguardian.com\/news\/2018\/mar\/17\/cambridge-analytica-facebook-influence-us-election\" target=\"_blank\">read<\/a> the <em>Guardian<\/em> headline. \u201cHow Trump Consultants Exploited the Facebook Data of Millions,\u201d <a href=\"https:\/\/www.nytimes.com\/2018\/03\/17\/us\/politics\/cambridge-analytica-trump-campaign.html\" target=\"_blank\">read<\/a> the <em>Times\u2019<\/em>. The night before, Facebook had tried to preempt the stories, <a href=\"https:\/\/newsroom.fb.com\/news\/2018\/03\/suspending-cambridge-analytica\/\" target=\"_blank\">announcing<\/a> it was suspending Wylie, Cambridge Analytica, SCL, and Aleksandr Kogan for violating its policies against sharing Facebook data with third parties.<\/p>\n<p>That hardly helped Facebook\u2019s case. The news did more than make Facebook look bad. It did what history may judge to be irreparable damage to a company at the peak of its unprecedented power. Facebook\u2019s stock price plummeted. Zuckerberg was <a href=\"https:\/\/www.wired.com\/story\/mark-zuckerberg-congress-day-one\/\">summoned to Congress<\/a>. The company gave itself the impossible task of auditing apps that had access to mass amounts of data, and began cutting off other developers from collecting even more. Google <a href=\"https:\/\/trends.google.com\/trends\/explore?q=how%20to%20delete%20facebook&amp;geo=US\" target=\"_blank\">searches<\/a> for \u201chow to delete Facebook\u201d spiked.<\/p>\n<p>In the end, Facebook CEO Mark Zuckerberg acknowledged that as many as 87 million people may have been affected by the data intrusion. Eventually, the Federal Trade Commission launched an investigation into whether Facebook violated a 2011 consent decree regarding its data privacy practices. &quot;I started Facebook, and at the end of the day I&#x27;m responsible for what happens on our platform,&quot; Zuckerberg wrote on Facebook days after the news broke. &quot;While this specific issue involving Cambridge Analytica should no longer happen with new apps today, that doesn&#x27;t change what happened in the past.&quot;<\/p>\n<p>Earlier this month, <em>The Washington Post<\/em> <a href=\"https:\/\/www.washingtonpost.com\/technology\/2019\/01\/18\/us-regulators-have-met-discuss-imposing-record-setting-fine-against-facebook-some-its-privacy-violations\/?utm_term=.8760e241fd90\" target=\"_blank\">reported<\/a> that the FTC is considering \u201cimposing a record-setting fine\u201d against Facebook.<\/p>\n<p>As bad as things were for Facebook, they soon got worse for Cambridge Analytica. Days after Wylie\u2019s story first made headlines, Britain\u2019s Channel 4 News began airing a series of devastating undercover videos that showed the firm\u2019s once sought-after CEO, Alexander Nix, discussing using dirty tricks like <a href=\"https:\/\/www.wired.com\/story\/cambridge-analytica-execs-caught-discussing-extortion-and-fake-news\/\">bribery and blackmail<\/a> on behalf of clients. In one case, Nix boasted that using Ukrainian women to entrap politicians \u201cworks very well.\u201d<\/p>\n<p><span>Alexander Nix, ex-CEO of Cambridge Analytica, was captured on camera by Britain\u2019s Channel 4 News, discussing using tactics like extortion and bribery on behalf of clients. Nix later denied the company used such tactics, but was replaced as CEO before SCL went out of business last May.<\/span><\/p>\n<p><span>After the news about Cambridge Analytica\u2019s use of Facebook data made headlines in March, the British Information Commissioner\u2019s Office searched the company\u2019s London-based office and seized its servers as part of an ongoing investigation into the use of data in politics.<\/span><\/p>\n<p><span>Former SCL contractor Christopher Wylie blew the whistle on Cambridge Analytica last March, telling *The Guardian* and *The New York Times* that the company misappropriated the data of tens of millions of Facebook users and used it for political purposes during the 2016 presidential election in the US.<\/span><\/p>\n<p><span>During the 2016 election, Cambridge Analytica staffers and data scientists worked side by side with President Trump\u2019s staff in the campaign\u2019s digital headquarters in San Antonio, Texas.<\/span><\/p>\n<p><span>Before working on the Trump campaign, Cambridge Analytica consulted for senator Ted Cruz\u2019s campaign. The company would later claim credit for helping Cruz win the Iowa primary.<\/span><\/p>\n<p><span>As a professor at the University of Cambridge, Aleksandr Kogan built a personality profiling quiz that scraped its users\u2019 Facebook data, as well as the data of millions of their friends. Kogan sold those people\u2019s data, and his predictions about their personalities to SCL, which used it to build psychological profiles of every adult in the United States. SCL\u2019s American spinoff, Cambridge Analytica, then pitched its so-called \u201cpsychographic\u201d ad targeting methods to political operatives in the US.<\/span><\/p>\n<p><span>The Cambridge Analytica scandal hit Facebook hardest, revealing just how much data the company gave away to app developers before 2015. In April, Facebook CEO Mark Zuckerberg was called to Congress to answer for the company\u2019s actions.<\/span><\/p>\n<p>Nix has since denied that the company engages in those practices. &quot;That was just a lie to impress the people I was talking to,\u201d he <a href=\"https:\/\/www.wired.com\/story\/alexander-nix-parliament-testimony-cambridge-analytica\/\">told<\/a> a parliamentary committee last summer. But almost as soon as the videos aired, Nix was replaced as CEO. By May, buried under an avalanche of negative press, SCL Group announced it was shutting down completely and filing for bankruptcy and insolvency in the US and the UK. Today, just one of its many corporate properties\u2014SCL Insights\u2014is still up and running.<\/p>\n<p>As SCL was crumbling, Carroll\u2019s case took on a new sense of urgency. He was thrown into the media firestorm, crisscrossing Manhattan as he discussed his claim on an alphabet soup of television networks. Suddenly, this wasn\u2019t just a wonky academic endeavor to retrieve data from some company. It was a story about rescuing that data from the one company the public had decided, and Facebook had claimed, was singularly sinister. \u201cChris Wylie took the story that I knew was a big deal for a long time and made it a worldwide story, a household name,\u201d Carroll says.<\/p>\n<p>When the news broke in March, the UK\u2019s Information Commissioner\u2019s Office was already investigating SCL for its refusal to hand over Carroll\u2019s data. Carroll and Naik had filed a complaint with the ICO in 2017. But for months, SCL told the regulator that as an American, Carroll had no more rights to his data \u201cthan a member of the Taliban sitting in a cave in the remotest corner of Afghanistan.\u201d The ICO disagreed. In May, days after SCL declared bankruptcy, the regulator issued an order, directing the firm to give Carroll his data once and for all. Failure to comply within 30 days, they warned, would result in criminal charges.<\/p>\n<p>SCL never complied. Julian Wheatland, director of SCL Group, told me he thinks the guilty plea the company issued in January is a \u201cshame\u201d and says it merely represented the path of least resistance for SCL\u2019s liquidators, who oversee the insolvency proceedings and are duty bound to maximize the company\u2019s assets. \u201cThere was little option but to plead guilty, as the cost of fighting the case would far outweigh the cost of pleading guilty,\u201d Wheatland says. SCL\u2019s administrators declined WIRED\u2019s request for comment.<\/p>\n<p>The ICO fine was ultimately measly. Carroll\u2019s slice of it couldn\u2019t buy him more than a MetroCard and a bag of groceries. It\u2019s also no guarantee he\u2019ll get his data. Naik is still waging that battle on Carroll\u2019s behalf, as SCL\u2019s insolvency proceedings progress. Meanwhile, an ICO spokesperson confirmed that the office now has access to SCL\u2019s servers and is \u201cassessing the material on them,\u201d which could help to bring Carroll\u2019s information to light.<\/p>\n<p>But the ICO\u2019s charges were meaningful nonetheless. It clearly underscored the fact that people outside the UK had these rights to begin with. &quot;This prosecution, the first against Cambridge Analytica, is a warning that there are consequences for ignoring the law,\u201d the information commissioner, Elizabeth Denham, said in a <a href=\"https:\/\/ico.org.uk\/about-the-ico\/news-and-events\/news-and-blogs\/2019\/01\/scl-elections-prosecuted-for-failing-to-comply-with-enforcement-notice\/\" target=\"_blank\">statement<\/a> following the hearing. \u201cWherever you live in the world, if your data is being processed by a UK company, UK data protection laws apply.\u201d<\/p>\n<p><span class=\"lede\">By the time <\/span>I interviewed Carroll in June 2018, about a month after SCL announced it was shutting down and just days after the ICO\u2019s deadline had ticked by, the fear Carroll felt that first time we met had almost evaporated. We were in London to hear Cambridge Analytica\u2019s fallen CEO Alexander Nix state his case before a committee of British parliamentarians. It seemed as if the entire cast of characters involved in the story had settled into the hearing room\u2019s green upholstered chairs. There was Cadwalladr, <em>The Guardian<\/em> reporter who\u2019d cracked the story open, and Wylie, the pink-haired source who\u2019d helped her do it. Carroll sat to my right, busily tweeting every tense exchange between a defiant and defensive Nix and his inquisitors.<\/p>\n<p>There was also a documentary film crew, stationed toward the back of the room. They\u2019d been trailing Carroll for months.<\/p>\n<p>When husband and wife team Jehane Noujaim and Karim Amer initially set out to make what is now <em>The Great Hack<\/em>, <a href=\"https:\/\/www.theguardian.com\/film\/2015\/jun\/03\/sony-hack-leaked-emails-hollywood-documentary\" target=\"_blank\">back in 2015<\/a>, they planned to follow the story of the Sony Pictures breach that had exposed the film studio\u2019s secrets in what US intelligence officials said was an attack by North Korea. But as time went on, their attention, like that of the public\u2019s, shifted focus from the ways in which private information is straight-up stolen to all of the little ways we give it away to powerful corporations, often without realizing it or knowing what will happen to it\u2014and certainly without any way to claw it back.<\/p>\n<p>That led them to Carroll. \u201cWe were initially drawn to David\u2019s story because his mission to reclaim his data summarized the complexities of this world into a single question: What do you know about me?\u201d the directors, who were nominated for an Academy Award for their film <em>The Square<\/em>, wrote in an email. \u201cOne of the things that has become increasingly clear is that whether David gets his data back or not, his case has brought to light some of the largest questions around data privacy.\u201d<\/p>\n<p>This weekend, Carroll will head to Park City, Utah, to see himself on the big screen. For Naik, the fact that a film like this is debuting to mainstream audiences represents an \u201castonishing step in the data rights movement.\u201d \u201cThis shows a rapid change in interest in this field and the interest in data rights as a real and enforceable facet of human rights,\u201d he says.<\/p>\n<p>Over the past few years, these rights have expanded drastically. Last May, Europe\u2019s General Data Protection Regulation went into effect across the European Union, giving Europeans the right to request and delete their data, and requiring businesses to receive informed consent before collecting that data. The law also established stricter reporting protocols around data breaches and created harsh new penalties for those who violate them.<\/p>\n<p>Last summer, the state of California unanimously passed its own privacy law, which lets residents of the state see the information businesses collect on them and request that it be deleted. It also enables people to see which companies have purchased their data and direct businesses to stop selling it at all.<\/p>\n<p>Some of the most influential business leaders in the world have simultaneously rallied around the cause. In Brussels last year, Apple CEO Tim Cook condemned what he called the \u201cdata industrial complex\u201d and called for a federal law that would prevent personal information from being &quot;weaponized against us with military efficiency.&quot; Even data gobblers like Google, Amazon, and Facebook have finally come out in support of a federal privacy law, partly due to the fact that such legislation could prevent the stricter California bill from taking effect in 2020.<\/p>\n<p>If Congress is ever going to make good on its recent promises to crack down on rampant data mining, this could be the year. So far, senator Ron Wyden (D-Oregon) has floated some draft legislation. Senator Marco Rubio (R-Florida) proposed a bill that would task the FTC with drafting new rules. And in December, senator Brian Schatz (D-Hawaii) introduced a bill of his own, cosponsored by 14 other Democrats, that requires companies to &quot;reasonably secure&quot; personally identifying information and promise not to use it for harm. It would also force businesses and the third parties they work with to notify users of data breaches and gives the FTC new authority to fine violators.<\/p>\n<p>\u201cJust as doctors and lawyers are expected to protect and responsibly use the personal data they hold, online companies should be required to do the same,\u201d Schatz said in a statement when the bill was announced. \u201cOur bill will help make sure that when people give online companies their information, it won\u2019t be exploited.\u201d<\/p>\n<p>Carroll isn\u2019t so sure. He says bills like this hardly address the underlying problem. If data is the new oil powering the economy, then what Schatz is proposing is a process for cleaning up the next oil spill. It\u2019s not a set of safety procedures to prevent that spill from happening in the first place. That\u2019s what Carroll says the United States, whose homegrown tech giants control so much of the world\u2019s data, desperately needs. He continues to believe his SCL file would prove how badly it\u2019s needed.<\/p>\n<p>Cambridge Analytica may have taken data from Facebook that it didn\u2019t have the right to, and Facebook may have made that data too easy to access. But the most overlooked fact in the whole saga is that Cambridge Analytica wasn\u2019t alone. From data brokers that track your every purchase to mobile phone carriers that sell your location to social media companies that give far more detail to developers than is necessary, there\u2019s an invisible, unregulated marketplace of personal information in the United States. And it\u2019s no longer just being used to sell us new boots or connect us with high school classmates. It\u2019s being used to influence decisions about who the most powerful people in the world get to be.<\/p>\n<p>\u201cThey\u2019re not the only ones by any stretch of the imagination,\u201d Carroll says of SCL. \u201cIt\u2019s a dirty business, but sunlight is the best disinfectant.\u201d<\/p>\n<p>This is, perhaps, the one issue on which Carroll and Wheatland, SCL\u2019s director, see eye to eye. Wheatland predictably disagrees with the broad characterization of his company, whose very name has become a proxy for everything wrong with the data trade. He says Cambridge Analytica was a \u201clightning rod\u201d for a confluence of feelings about President Trump\u2019s election, Facebook, Brexit, and the rising use of data. \u201cWe found ourselves at the nexus of all of those and became the whipping boy,\u201d he says.<\/p>\n<p>He doesn\u2019t find many sympathetic audiences for that message these days. But he, too, says that regulation is imperative, given the \u201chuge power\u201d of data modeling. And he too says there\u2019s a risk to casting Cambridge Analytica as somehow unique. \u201cThis is an issue that is much bigger than one company,\u201d he says. \u201cIf we take this villain mentality and think that we\u2019ve moved on, we haven\u2019t. We\u2019ve lost Cambridge Analytica, but we haven\u2019t moved on at all.\u201d<\/p>\n<p>Carroll is hardly pouring one out for the loss of Cambridge Analytica. Far from it. As he watched Nix stammer and squirm in his tailored suit that June afternoon in Parliament, Carroll couldn\u2019t help but recognize how dramatically their roles had been reversed.<\/p>\n<p>These last two years have been emotionally taxing and at times lonely for Carroll, who\u2019s become absorbed by an issue that sometimes even the people closest to him failed to understand. But every new break in the case has provided some validation that it\u2019s all been worth it. \u201cI don\u2019t feel like I\u2019m up against the wall,\u201d he told me the night of Nix\u2019s hearing, the documentary crew\u2019s cameras trained on his face. \u201cThey\u2019re up against the wall.\u201d<\/p>\n<p>But he stopped short of declaring victory. Not until he gets his data back, and sees some real change come of it. \u201cAll I want is everything,\u201d he said. \u201cBecause I\u2019m entitled to it. And so is everyone.\u201d<\/p>\n<p class=\"related-cne-video-component__dek\">The only way to be truly secure on Facebook is to delete your account. But that&#39;s crazy talk! Here&#39;s how to lock down your privacy and security and bonus, keep targeted ads at bay.<\/p>\n<p><a href=\"https:\/\/www.wired.com\/story\/one-mans-obsessive-fight-to-reclaim-his-cambridge-analytica-data\" target=\"bwo\" >https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/media.wired.com\/photos\/5c4a19d59f7d4c2cf990b86c\/master\/pass\/Backchannel-David-Carroll-2w.jpg\"\/><\/p>\n<p><strong>Credit to Author: Issie Lapowsky| Date: Fri, 25 Jan 2019 11:00:00 +0000<\/strong><\/p>\n<p>David Carroll has been locked in a legal war to force the infamous company to turn over its files on him. He\u2019s won a battle, but the struggle continues.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[17573,714],"class_list":["post-14417","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-backchannel","tag-security"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/14417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=14417"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/14417\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=14417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=14417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=14417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}