As the fallout continues following a set of bombshell revelations by The Observer, New York Times and Channel 4, the UK data analytics and political consulting firm Cambridge Analytica is firmly in the spotlight.
The firm has been accused of harvesting data from Facebook without users' implicit permission in order to profile and target political ads across the internet in the lead up to the shock Trump election victory and the Leave.EU campaign here in the UK.
So what is Cambridge Analytica, who is behind the company and how much of a threat does it really pose to Western democracy? Here's a reverse timeline of the company and the Facebook scandal and how it has percolated through to the top levels of business and politics in the UK and US.
1 April 2019: Information Commissioner's Office demands CA hand over data or face criminal prosecution
The UK's data protection regulator has urged Facebook to drop its appeal against a £500,000 fine over the Cambridge Analytica scandal after Mark Zuckerberg made an appeal for stronger internet regulation in an opinion piece published in The Washington Post.
Zuckerberg called for more oversight around harmful content, election integrity, privacy and data portability, but critics will remain sceptical over his rebirth as a privacy advocate while Facebook continues to escape a relatively paltry fine for a company that last year had a $56 billion turnover.
"In light of Mark Zuckerberg’s statements over the weekend about the need for increased regulation across four areas, including privacy, I expect Facebook to review their current appeal against the ICO's £500,000 fine - the maximum available under the old rules - for contravening UK privacy laws," information commissioner Elizabeth Denham said in a statement.
22 March 2019: Facebook admits concerns over Cambridge Analytica were flagged earlier than reported
A Facebook employee raised concerns about Cambridge Analytica's data-gathering practices months earlier than Facebook previously told lawmakers it became aware of the breach, according to US court documents.
The documents revealed that a US-based Facebook employee warned colleagues about the data-scraping practices in September 2015, three months before Facebook claimed it had discovered the activity. The claims first appeared in a court filing by the attorney general for Washington DC and were later confirmed by Facebook.
Parliament's Digital, Culture, Media and Sport (DCMS) committee chair Damian Collins MP tweeted that the report "could suggest that Facebook has consistently mislead [sic]” British lawmakers “about what it knew and when about Cambridge Analytica".
15 March 2019: Academic behind app used by Cambridge Analytica for data harvesting sues Facebook
Aleksandr Kogan, the academic who created the personality quiz used by Cambridge Analytica to harvest personal data from Facebook has sued the social network for defamation.
Facebook claims the former University of Cambridge psychology researcher told the company that the data was being collected for academic purposes when it was actually being used in political campaigns.
"Alex did not lie, Alex was not a fraud, Alex did not deceive them, this was not a scam," Kogan's lawyer, Steve Cohen, said, according to the New York Times. "Facebook knew exactly what this app was doing, or should have known. Facebook desperately needed a scapegoat, and Alex was their scapegoat."
Facebook spokeswoman Liz Bourgeois called his claim a "frivolous lawsuit" from someone who "violated our policies and put people's data at risk."
25 October 2018: Facebook fined £500,000 for Cambridge Analytica scandal
Facebook was slapped with a £500,000 fine for its role in the Cambridge Analytica scandal by the UK's data watchdog.
The Information Commissioner's Office said Facebook had failed to protect users' personal information by application developers access to their data without sufficient consent, even if users had not downloaded the app. The social network was also accused of making inadequate checks on apps and developers using its platform.
"Facebook failed to sufficiently protect the privacy of its users before, during and after the unlawful processing of this data," said information commissioner Elizabeth Denham. "A company of its size and expertise should have known better and it should have done better."
The fine is the maximum allowable under the data protection laws that applied at the time the incidents occurred and would likely have been far higher had they taken place after the introduction of GDPR, which includes maximum fines of £17 million or 4 percent of global turnover.
5 May 2018: ICO demands CA hand over data or face criminal prosecution
When American citizen David Carroll noticed that US voter data had been processed in the UK by Cambridge Analytica affiliate SCL Elections, he filed a subject access request in the UK.
Cambridge Analytica refused the request, and said that filing it via the UK Data Protection Act gave him no more rights to his data than "a member of the Taliban sitting in a cave in the remotest corner of Afghanistan".
But the ICO disagreed and has said that SCL Elections had 30 days to comply or appeal.
Carroll referred to the ruling by the ICO as a landmark event because although he had no rights to request his data in the USA, due to the fact it was processed in the UK he was able to go through the British courts. The decision could open up other Americans to file similar appeals.
2 May 2018: Cambridge Analytica and SCL Elections shut down
Cambridge Analytica told employees in a company town hall meeting at its New York City offices that it would be shutting down all of its offices as well as SCL Elections in the UK.
New CEO Julian Wheatland reportedly told staffers that all operations would close imminently, with sources describing the atmosphere of the meeting as one of "shock".
"There was indication the company was in trouble and change would be coming, but we didn't see this as the resolution," the source said.
CA will file for bankruptcy in the USA while insolvency proceedings have begun in Britain.
Cambridge Analytica said in a statement: "Over the past several months, Cambridge Analytica has been the subject of numerous unfounded accusations and, despite the company's efforts to correct the record, has been vilified for activities that are not only legal, but also widely accepted as a standard component of online advertising in both the political and commercial arenas."
It added that although the business has "unwavering confidence" that its employees have "acted ethically and lawfully", the negative media coverage has "driven away virtually all" of its customers and suppliers.
"As a result, it has been determined that it is no longer viable to continue operating the business, which left Cambridge Analytica with no realistic alternative to placing the company into administration," the statement reads.
29 April 2018: Aleksandr Kogan had access to Twitter data
Aleksandr Kogan bought access to large-scale Twitter data from the social network for one day in 2015 – covering months of posts.
A Twitter spokesperson told Bloomberg: "In 2015, GSR did have one-time API access to a random sample of public tweets from a five-month period from December 2014 to April 2015. Based on the recent reports, we conducted our own internal review and did not find any access to private data about people who use Twitter."
The company later stopped any advertising partnerships with Cambridge Analytica and SCL.
10 April 2018: Lawyers file lawsuit against Facebook, Cambridge Analytica
A group of lawyers launched a joint class action lawsuit against both Facebook and Cambridge Analytica – plus CA's parent SCL Group and Global Science Research Limited – for the alleged misuse of millions of people's data.
The filing argues that although Facebook might have been misled originally, it ultimately failed to protect the people whose data was compromised.
The Guardian reported that London law firm McCue and Partners was leading the suit on the UK side. Jason McCue of the firm said at the time: "The defendants effectively abused the human right to privacy of ordinary Facebook users and, if that were not enough, then the fruits of that abuse are alleged to have undermined the democratic process.
"This case will go some way to ensure that neither of these things can happen in the future."
4 April 2018: Zuckerberg admits 87 million accounts could have been shared with Cambridge Analytica
During a conference call with reporters on Wednesday 4 April, Facebook CEO Mark Zuckerberg admitted that the data of up to 87 million users - not 50 million as originally feared - may have been improperly shared with Cambridge Analytica.
Zuckerberg admitted that this figure was a worst case scenario, telling reporters "it very well could be less but we wanted to put out the maximum that we felt it could be as soon as we had that analysis."
20 March 2018: MP Damian Collins raises concerns
Damian Collins, the Conservative MP and chair of the digital, culture, media and sport select committee wrote to the Facebook CEO to demand he provides oral evidence in front of the committee regarding "this catastrophic failure of process".
Collins also called upon Nix to give further testimony to the committee.
20 March 2018: Cambridge Analytica responds to ICO comments
In a press release on its website, the company said that it had been in touch with the ICO since February 2017, "when we hosted its team in our London office to provide total transparency on all the data we hold, its usage and other aspects of our business.
"We have been fully compliant and proactive in our conversations with the ICO," it went on. "On this point we have offered to share with the ICO all the information that it asked for and for the ICO to attend our office voluntarily, subject to our agreeing the scope of the inspection.
"We remain committed to helping the ICO and all other concerned organisations in their investigations and audits."
19 March 2018: ICO applies for warrant
The Information Commissioner Elizabeth Denham said that is seeking a warrant to search Cambridge Analytica's offices for evidence.
"We need to get in there, we need to look at the databases... We need to look at the servers to look at how the data was processed or deleted by Cambridge Analytica. There are a lot of conflicting stories."
According to Channel 4, Facebook was willingly granted access to Cambridge Analytica's offices on March 19, before the ICO had a chance to file a warrant. It's unclear what the nature of Facebook's visit was, however.
February 2018: Alexander Nix questioned in Parliament
Cambridge Analytica's Old Etonian CEO Nix was questioned by MPs on whether Cambridge Analytica had ties to the Leave campaign or Leave.EU in February 2018.
The evidence cited was a pair of tweets by Leave.EU comms man Andy Wigmore, an appearance at a Leave.EU press conference from someone at Cambridge Analytica, plus a press release issued by Cambridge Analytica that said it had "teamed up" with Leave.EU, reports the Register.
Nix denied that the company had worked with the Leave campaign, paid or unpaid. He said that the press release was "in anticipation" of work with Leave.EU that ultimately didn't happen, and that it is "not unusual to speak in public together" when "exploring a working relationship with a client".
19 March 2018: Channel 4 airs undercover investigation
An undercover investigation from Channel 4 has Cambridge Analytica bosses on tape talking about setting up fake IDs, propagating fake news, and appearing to say sex workers could be used to discredit political opponents.
A reporter posed as a Sri Lankan national, operating on behalf of a wealthy client seeking to get candidates selected in that country.
Nix was filmed saying: "Many of our clients don't want to be seen to be working with a foreign company, so often we set up, if we are working then we can set up fake IDs and websites, we can be students doing research projects attached to a university, we can be tourists, there's so many options we can look at. I have lots of experience in this."
Nix was also filmed saying that in response to a question about digging up material on opponents, that they could "send some girls around to the candidate's house".
A spokesperson for Cambridge Analytica said: "We entirely refute any allegation that Cambridge Analytica or any of its affiliates use entrapment, bribes, or so-called "honey-traps" for any purpose whatsoever... We routinely undertake conversations with prospective clients to try to tease out any unethical or illegal intentions."
18 March 2018: Cambridge Analytica's Christopher Wylie blows the whistle
The Observer published an in-depth interview with Christopher Wylie, who helped to set up Cambridge Analytica, about the compromising of millions of Facebook accounts without their consent on March 18, 2018, setting off a major scandal and drawing responses from Facebook, Cambridge Analytica and the UK government.
The article claimed there were receipts and emails to back the claims up.
The interview also quotes data expert Paul-Olivier Dehaye who describes Facebook as "abusive by design".
"Facebook has denied and denied and denied this," Dehaye was quoted as saying in the Observer. "It has misled MPs and congressional investigators and it's failed in its duties to respect the law. It has a legal obligation to inform regulators and individuals about this data breach, and it hasn't. It's failed time and time again to be open and transparent."
But VP and deputy general counsel for Facebook Paul Grewal said that the claim this is a data breach is "completely false".
"Aleksandr Kogan requested and gained access to information from users who chose to sign up to his app, and everyone involved gave their consent," Grewal wrote at the time. "People knowingly provided their information, no systems were infiltrated, and no passwords or sensitive pieces of information were stolen or hacked."
Britain's Information Commissioner's Office said it is investigating.
"A full understanding of the facts, data flows and data uses is imperative for my ongoing investigation," Information Commissioner Elizabeth Denham wrote at the time. "This includes any new information, statements or evidence that have come to light in recent days.
"Our investigation into the use of personal data for political campaigns includes the acquisition and use of Facebook data by SCL, Doctor Kogan and Cambridge Analytica.
"This is a complex and far reach investigation for my office and any criminal or civil enforcement actions arising from it will be pursued vigorously."
Feb-May 2017: links between Leave.EU and Cambridge Analytica alleged in the Guardian
A story in the Guardian by claimed Leave.EU's comms director Andy Wigmore revealed Robert Mercer, described as being a good friend to Nigel Farage, had directed Cambridge Analytica to ‘help' on the Leave campaign – a claim Cambridge Analytica denies and that is currently part of a legal complaint against the Guardian. An article in May called ‘the great British Brexit robbery: how our democracy was hijacked', also subject to a legal complaint, appeared to tie the various strands together.
September 2016: Cambridge Analytica CEO interview
An interview with Contagious.com revealed that Alexander Nix believed the Democrats had been "leading the tech revolution" with data analytics and digital engagement, and that the Republicans had "failed to catch up".
"We saw this as an opportunity to leverage our international track record in global political campaigns to enter the political market in the US and address this need," Nix said.
June-November 2016: Donald Trump presidential campaign
Cambridge Analytica infamously aided Trump in his election campaign for President in 2016.
In a later interview with TechCrunch, CEO Alexander Nix claims that there wasn't enough time to roll out a new psychographic survey to target potential voters, and what the team did was focus on messaging in the swing states.
It also used historic data to identify core Trump supporters, and to target them with a donor solicitation, which raised $27 million in the first month and "hundreds of millions" by the time Trump had won. Nix said that the company started off with data services and then went ‘end to end', so encompassing research, digital, TV and donations.
February 2016: Ted Cruz wins Iowa caucus
Cambridge Analytica boasted in a press release that by "combining advanced data analytics with psychological research based off the five factor model for gauging personality traits, OCEAN, Cambridge Analytica helped the campaign identify likely pro-Cruz caucus voters and reach out to them with messages tailored to resonate specifically with their personality types.
"This method provided the Cruz campaign with the edge it needed to spread the candidate's message and drive a come-from-behind victory in the first primary of the 2016 election," the company claimed.
2015: Cambridge Analytica partners with Cruz Presidential campaign
In 2015 Politico reported that Rebekah Mercer had introduced Cambridge Analytica to political committees supported by the Mercer family. Elections that Cambridge Analytica had rallied behind up to this date included US senator Tom Cotton in Arkansas, and Art Robinson in Oregon.
But the Cruz presidential run was the most high profile campaign to date. Politico reported that Cambridge Analytica had sent staff to the Cruz campaign headquarters in Houston to "help set up an intensive data analysis operation".
The Guardian noted in December 2015 that the campaign included paying UK academics to collect profiles on potential voters – the data amassed by Kogan and advertised as paid quizzes on Mechanical Turk.
2014: Getting the data
According to emails seen by the Guardian, Wylie first approached Michal Kosinki, one of the co-founders of myPersonality, but these negotiations didn't go anywhere. A separate psychologist, Aleksandr Kogan, who ran a company called Global Science Research (GSR) said that he could replicate the research.
The Guardian says Wylie has receipts that show Cambridge Analytica spent $7 million to get this data, and roughly $1 million of it with Kogan.
Kogan's programme advertised a paid personality quiz on Mechanical Turk and Qualtrics through an app called thisismydigitallife. This requested permission for access to the quiz taker's Facebook profiles, as well as their friends' profiles, meaning the roughly 320,000 people who took the test also opened up access to 160 other people's profiles – without their consent. Facebook later said that Kogan claimed to be collecting the data for academic reasons.
2013/2014: Wylie meets Trump right-hand man Steve Bannon and the Mercers
Steve Bannon, an ex-chief strategist for President Trump, first heard about SCL third-hand from Republican strategist Mark Block, who was sat next to a cyberwarfare expert on a plane. Bannon introduced the idea to billionaire Republican donor Robert Mercer and his daughter Rebekah Mercer. The Mercers flew SCL Elections CEO Alexander Nix and Christopher Wylie to Manhattan, where they gave the Mercers the pitch.
The pitch, as based on a 2014 paper by Cambridge University's Psychometrics Centre, ‘Computer-based personality judgments are more accurate than those made by humans', and how it could be applied to political messaging. This paper was based on data built by a Facebook application for conducting personality tests for academic reasons, called ‘myPersonality'.
2013: Cambridge Analytica cofounder Christopher Wylie meets with SCL
A Canadian data scientist, Christopher Wylie, had just completed a PhD in fashion forecasting. He began looking into the British Liberal Democrats party – and exactly why they weren't winning. He was struggling with data until he found a paper published by Cambridge University about how personality traits could serve as precursors to political behaviour.
Someone involved with the Lib Dems introduced Wylie to Alexander Nix, CEO of ‘SCL Elections' – which would later become Cambridge Analytica. Nix, according to the first Guardian expose, offered Wylie ‘total freedom'. "Come and test out all your crazy ideas," he said.
1993: SCL Group founded
Former TV production and advertising executive Nigel Oakes created ‘Strategic Communication Laboratories Group (SCL Group) as a spinout from his strategic communications agency Behavioural Dynamics Institute in 1993. By studying mass behaviour, Oakes believed that public opinion could be manipulated and shifted to alter political outcomes. The company has worked in regions from Libya to Afghanistan and Ukraine.
It would later spin off into Cambridge Analytica, a subsidiary designed specifically to target the US market.
For its work until then, see this Slate story where it details in-depth SCL's "psychological operations" and boasted that it could foment coups.
Additional reporting by Thomas Macaulay