Facebook/Cambridge Analytica 'the canary in the coalmine of a new Cold War', says whistleblower Wylie

Whistleblowers, journalists and the ICO addressed the European Parliament on Monday

The UK information commissioner Elizabeth Denham, Cambridge Analytica whistleblower Chris Wylie, his Facebook counterpart Sandy Parakilas, US professor David Carroll, and Observer and Guardian journalist Carole Cadwalladr all gave evidence before Committee on Civil Liberties, Justice and Home Affairs of the European Parliament yesterday.

The hearing was entitled 'Use of Facebook users' data by Cambridge Analytica and impact on data protection - mapping the case'. It followed the appearance of Facebook CEO Mark Zuckerberg before the Parliament at which he widely was accused of evading questions.

The evasiveness of the tech giants was a focus of Cadwalladr's opening address. Describing the European Parliament as the only body they are scared of, she nevertheless chided MEPs for letting Zuckerberg off the hook. "He was allowed to appear to be cooperating while not cooperating, which is the classic modus operandi," she said.

Cadwalladr has been investigating the murky connections between the Brexit Leave and Leave.EU campaigns, Cambridge Analytica, parent company SCL and offshoot AggregateIQ and the funding of the campaigns by US billionaire Robert Mercer and former Trump staffer Steve Bannon. Election funding laws and transparency have been completely undermined by private digital platforms, she said.

"Everything is running through the black boxes of tech companies and we have no idea what's going on inside them. So critically we have no idea how much money was spent during the referendum, we don't know who spent it, we don't know where the money came from, we don't know what advertisements people saw, we don't know how they were targeted or what data that was based on."

That information certainly exists, but it is proprietary, she went on, and the public has no access. The tech companies deny, obfuscate and occasionally threaten legal action on those who get too close.

"We have this situation where these foreign companies have played an absolutely pivotal role and we have no way of obtaining that information," Cadwalladr said.

Former Facebook employee Sandy Parakilas, who went public on the firm's data protection practices, said the way data was used was by third-party developers. For a start Facebook users are encouraged to agree to data sharing by the consent form's design which features a large 'accept' button and with links to alternative options relatively obscure. Once the button has been clicked it's anybody's guess what happens next, he said.

"Once the application has the data there's no way for Facebook to know what the application is doing with the data. If the developer is a bad actor they could pass the data to an unauthorised fourth party. In this case the developer was [Cambridge University academic] Aleksandr Kogan and the fourth party was Cambridge Analytica."

Developers were able to access Facebook users' friends' data too, amplifying the information available to them by 200 or 300 times. Facebook claims it put a stop to that practice in 2015, but recent revelations about data sharing with mobile platforms cast doubt the veracity of that statement.

Cambridge Analytica whistleblower Chris Wylie described the scandal as "the canary in the coalmine of a new Cold War emerging online."

"I don't believe Brexit would have happened were it not for the data

targeting technology and network of actors set up by Cambridge Analytica," he said.

Wylie added that multinational actors and tech and data companies were working together to manipulate elections and predicted that things would get worse as technology becomes ever more pervasive. He accused the UK government of "trying to stall any stall any public inquiry until they have secured Brexit".

In response to a question from an MEP about the European Commission reportedly hiring CIA backed analytics firm Palantir, Wylie advised the EC to set out clear guidelines, adding that Palantir employees used to visit the Cambridge Analytica offices to work on projects and share data, sometimes in a personal capacity.

"I recommend they set up mechanisms to ensure that any company is transparent on what they're working with and also what their employees are working with on the side," Wylie said.

David Carroll is still waiting for SCL Elections to hand over his data from the Facebook campaign as well as a list partner organisations used in the US election campaign, having successfully sued the company in the British courts. He described the current situation as "data laundering" because "data is secretly and illicitly misappropriated across boundaries and borders and used for possibly unlawful purposes".

"This is a new story and it has rattled the world," said Carroll. "Almost all of us can agree that a data crime has occurred, possibly a crime against democracy itself. Personal autonomy and national sovereignty are under siege with only election and privacy laws in place as shields"

Even though these shields are barely adequate against "new realms of micro-targeting that intermingle with information warfare", they are at least better than the protections in place in the USA where "a typical deference to the tech companies and a reluctance to consider comprehensive privacy regimes" have made it ripe for voter manipulation, he said.

UK Information Commissioner Elizabeth Denham said she shared the concerns about data misuse for political ends.

"Recently we have seen that the behavioural advertising ecosystem

has been applied across to political campaigning to influence how we vote. I am deeply concerned that this has happened without due legal or ethical consideration of the impacts to our democratic system."

"I recognise that some aspects of our legal systems have failed to keep up with the unforeseen pace of the internet's development," she said.

The ICO has 40 full time investigators and 20 outside experts working on the Facebook - Cambridge Analytica case, she said, calling the investigation "unprecedented in scale".

However she admitted to limitations of what the ICO could do and urged other authorities to make full use their powers.

"We now need sustained willingness by citizens to exercise their data protection rights. We need data protection authorities unafraid to use our new tools, sanctions and fining powers. And we need legislators supporting their data protection authorities to ensure they have the capacity and capability to deliver their important role," Denham said.

Two further hearings into this case will be held in the coming weeks.