Committee chair calls on firms to freeze data linked to Facebook privacy scandal

The chair of the parliamentary committee investigating the Facebook privacy scandal is calling on companies at the centre of the controversy to preserve vital data, following news that Cambridge Analytica is filing for bankruptcy.

Digital security firm UpGuard urges federal government to prevent data destruction

Conservative MP Bob Zimmer rises in the House of Commons in Ottawa, January 31, 2018. Zimmer said Thursday that he's submitting data preservation requests to companies linked to the Facebook scandal. (Adrian Wyld/The Canadian Press)

The chair of the parliamentary committee investigating the Facebook privacy scandal is calling on companies at the centre of the controversy to preserve vital data, following news that Cambridge Analytica is filing for bankruptcy.

Conservative MP Bob Zimmer said Thursday that he's sent requests to Cambridge Analytica, SCL and Aggregate IQ demanding that they protect and maintain all information relevant to the inquiry, including data held by other companies they have worked with.

"The more we dig into this, more layers seem to be developing," Zimmer said. "It gets deeper and deeper and we want to make sure that we freeze records so that we can have a look at them."

The companies could be held in contempt of Parliament if they fail to comply, Zimmer said.

Cambridge Analytica came under fire for obtaining information from Facebook to build psychological profiles on a large portion of the U.S. electorate in the run-up to the 2016 presidential election. The company was able to amass the database quickly with the help of an app that appeared to be a personality test.

The app collected data on tens of millions of people and their Facebook friends — even those who did not download the app themselves.

Zimmer's request comes after Upguard, the American digital security firm where cyber risk analyst Chris Vickery is a director, sent a letter to government officials warning about the potential loss of data.

The letter calls out companies that were used by Cambridge Analytica, SCL and AggregateIQ and urges authorities to submit data preservation requests to them and third-party vendors. Upguard points to accounts at GitHub, Amazon Web Services and Facebook that may contain information relevant to the inquiry.

Committee concerns over data protection

Members of the House of Commons information, privacy and ethics committee discussed today how to preserve data and information essential to the ongoing investigation of the Facebook privacy scandal as key organizations attempt to dissolve their operations.

NDP MP Charlie Angus presented UpGuard's letter to the committee on Thursday morning while hearing testimony from Damian Collins, the co-chair of the U.K. committee investigating the data breaches.

"They're very concerned that this decision to shut down Cambridge Analytica could allow them to start erasing and getting rid of data," Angus said of the company's bankruptcy filing.

When asked whether U.K. authorities have looked into information held by third-party vendors, Collins said that they have not made any such requests.

"I don't know whether the [U.K.] information commissioner has done that either," Damian Collins said. "But I think that you're right to suggest that these third-party hosts may well be holding important data that could be relevant to those inquiries."

Locking down the data

Given the speculation about Cambridge Analytica moving its operations to another company called Emerdata, public officials say they worry that important data could be lost in the process, which would hinder the investigation of the firm.

The company could be trying to evade further probes, Liberal MP Nathaniel Erskine-Smith suggested at today's committee meeting.

"We heard a revelation yesterday that Cambridge Analytica and SCL are declaring bankruptcy," Erskine-Smith said. "Perhaps it comes as no surprise that they're looking for a way out."

When asked how the bankruptcy filing might interfere with the U.K. inquiry, Collins said it can't. U.K. Information Commissioner Elizabeth Denham can still pursue company directors regardless of the status of the company itself or whether that data has been transferred to another firm, he said.

"There's an interest here in seeing if wrongdoing has occurred and people should be able to go after the wrongdoers and they should face whatever penalties they need to face," Collins said.

"But there's also a public service here as well, to explain in public what happened, what these companies did, how they did it, and if they breached the law."