CEO of Cambridge Analytica Alexander Nix. Photo: Bryan Bedder/Getty Images for Concordia Summit

The data analytics firm that worked for President Trump’s election campaign, Cambridge Analytica, harvested the personal information of tens of millions of Facebook users without their permission, then failed to delete that data when it got caught, according to a new joint-investigation by the New York Times and the Observer of London. Facebook, whose role in the 2016 presidential election has already been widely criticized, suspended Cambridge Analytica’s access to the service on Friday in light of the reports.

The harvested user information, collected under the guise of academic research, included the private social media activity of more than 50 million people. Cambridge Analytica’s data scientists were able to match about 30 million of those users with voter rolls and use that data to build psychographic models aimed at predicting and influencing votes — though the effectiveness of such methods is disputable.

Cambridge Analytica is owned by conservative billionaire Robert Mercer and his daughter, Rebekah, and counted former Trump adviser and Breitbart chairman Stephen Bannon as one of its founders. One of the company’s other founders, Christopher Wylie, told the Times that the leaders of the firm wanted new weapons to “fight a culture war in America,” and that “rules don’t matter for them. For them, this is a war, and it’s all fair.”

Speaking with the Observer, Wylie admitted that the company “exploited Facebook to harvest millions of people’s profiles,” and then “built models to exploit what we knew about them and target their inner demons.” (Wylie is also the subject of an extensive profile published by the Guardian on Saturday, which contains much more detail about his experiences with Cambridge Analytica.)

Wylie explained that the Mercers and Bannon wanted to remake American politics, and saw personality profiling as a way to help them accomplish that goal. The private Facebook information, collected in mid-2014, used link personality traits to voting preferences. The data was then used to tailor campaign messages that could take advantage of voters’ personality traits. Further underlining the shadiness of these efforts: they originally experimented in countries with weak privacy protections where politician clients would pass along government data.

Cambridge Analytica executives have been accused of exaggerating the usefulness of their methods, and it remains an open question how much of an impact their efforts had on the Trump campaign in 2016 (though no one is disputing how effective Trump’s overall digital operation was). Former campaign officials told the Times that the Cambridge Analytica’s services included “designing target audiences for digital ads and fund-raising appeals, modeling voter turnout, buying $5 million in television ads and determining where Mr. Trump should travel to best drum up support.”

The data breach, which was previously reported as far back as 2015, is one of the largest in Facebook’s history. The social media giant hasn’t addressed it until now, and insists it wasn’t a breach at all, merely a mishandling of user data. On Friday, the company announced that it had suspended Cambridge Analytica, its parent firm Strategic Communication Laboratories (SCL), Wylie (who left the company in late 2014), and the Russian-American academic Aleksandr Kogan, who originally collected the data using a Facebook app that asked users to complete a personality test-like survey.

In a statement announcing the temporary suspensions, Facebook said Kogan harvested the data legitimately, but then passed it along to third parties in violation of the social network’s terms. According to the Observer, Facebook failed to alert affected users about the breach, and “took only limited steps to recover and secure” the private information. Facebook had asked the firms to certify that the data had been deleted, which they did without actually following through, according to the Times. Wylie says that all Facebook did to confirm the data was deleted was to ask him to “tick a box on a form and post it back.”

Facebook vice-president and deputy general counsel Paul Grewal insisted on Friday that while the platform’s terms were violated, “no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked.”

The Times also reports that because many of the data scientists employed by Cambridge Analytica and SCL were foreigners, it’s possible that they violated U.S. election law, a charge Cambridge Analytica denies. The company is also being investigated by U.K. authorities over its data acquisition methods and possibly illegal efforts to influence voters to vote in favor of Brexit.

Special Counsel Robert Mueller is reportedly demanding emails exchanged between Cambridge Analytica employees and Trump campaign staff members. One likely reason why: the Times says that a British affiliate of Cambridge Analytica claims to have worked in Russia and Ukraine. The Observer adds that Kogan, the Russian-American academic who collected the data, “has previously unreported links to a Russian university and took Russian grants for research.”

Wikileaks founder Jullian Assange also alleged last year that Cambridge Analytica’s CEO, Alexander Nix, contacted him during the campaign trying to get ahold of Hillary Clinton’s private emails. And Times reporters watched undercover footage of Nix bragging in January that he had employed front companies and former spies in service of his political clients, as well as discussing ways of entrapping politicians in compromising situations.

So far, no American political campaigns or super PACs have reported paying Cambridge Analytica for its services ahead of this year’s midterms.