Cambridge Analytics harvested private information from the Facebook profiles of more than 50 million users without their permission, according to former Cambridge employees, associates and documents, making it one of the largest data leaks in the social network's history. Christopher Wylie, who helped found Cambridge and worked there until late 2014, said of its leaders: "Rules don't matter for them. For them, this is a war, and it's all fair." "They want to fight a culture war in America," he added. "Cambridge Analytica was supposed to be the arsenal of weapons to fight that culture war." In Britain, Cambridge Analytica is facing intertwined investigations by Parliament and government regulators, who are scrutinising possible data privacy violations and allegations that it performed illegal work on the Brexit campaign. Christopher Wylie, who helped found the data firm Cambridge Analytica and worked there until 2014, in London, March 12, 2018. Credit:New York Times

The breach allowed the company to exploit the private social media activity of a huge swathe of the US electorate, developing techniques that underpinned its work on Trump's campaign in 2016. An examination by The New York Times and The Observer of London reveals how Cambridge Analytica's drive to bring to market a potentially powerful new weapon put the firm — and wealthy conservative investors seeking to reshape politics — under scrutiny from investigators and politicians on both sides of the Atlantic. In the US, Mercer's daughter, Rebekah, a board member, Bannon and Cambridge Analitica chief Alexander Nix received warnings from their lawyer that it was illegal to employ foreigners in political campaigns, according to company documents and former employees. On Sunday Democratic US Senator Amy Klobuchar tweeted: "It's clear these platforms can't police themselves." "They say 'trust us.' Mark Zuckerberg needs to testify before Senate Judiciary," she added, referring to Facebook's CEO and a committee she sits on.

Facebook said the root of the problem was that researchers and Cambridge Analytica lied to it and abused its policies, but critics on Saturday threw blame at Facebook as well, demanding answers on behalf of users and calling for new regulation. Loading Loading Facebook insisted the data was misused but not stolen, because users gave permission, sparking a debate about what constitutes a hack that must be disclosed to customers. "The lid is being opened on the black box of Facebook's data practices, and the picture is not pretty," said Frank Pasquale, a University of Maryland law professor who has written about Silicon Valley's use of data.

Pasquale said Facebook's response that data had not technically been stolen seemed to obfuscate the central issue that data was apparently used in a way contrary to the expectations of users. "It amazes me that they are trying to make this about nomenclature. I guess that's all they have left," he said. Democratic US Senator Mark Warner said the episode bolstered the need for new regulations about internet advertising, describing the industry as the "Wild West". "Whether it's allowing Russians to purchase political ads, or extensive micro-targeting based on ill-gotten user data, it's clear that, left unregulated, this market will continue to be prone to deception and lacking in transparency," he said. With Republicans controlling the Senate's majority, though, it was not clear if Klobuchar and Warner would prevail.

Facebook, in a series of written statements beginning late on Friday, said its policies had been broken by Cambridge Analytica and researchers and that it was exploring legal action. Cambridge Analytica in turn said it had deleted all the data and that the company supplying it had been responsible for obtaining it. Andrew Bosworth, a Facebook vice-president, hinted the company could make more changes to demonstrate it values privacy. "We must do better and will," he wrote on Twitter, adding that "our business depends on it at every level." Facebook said it asked for the data to be deleted in 2015 and then relied on written certifications by those involved that they had complied. Nuala O'Connor, president of the Centre for Democracy & Technology, an advocacy group in Washington, DC, said Facebook was relying on the good will of decent people rather than preparing for intentional misuse.

Moreover, she found it puzzling that Facebook knew about the abuse in 2015 but did not disclose it until Friday. "That's a long time," she said. Britain's data protection authority and the Massachusetts attorney general on Saturday said they were launching investigations into the use of Facebook data. "It is important that the public are fully aware of how information is used and shared in modern political campaigns and the potential impact on their privacy," UK Information Commissioner Elizabeth Denham said in a statement. Massachusetts Attorney General Maura Healey's office said she wants to understand how the data was used, what policies if any were violated and what the legal implications are. Reuters, New York Times