Oral evidence: Fake News, HC 363
Oral evidence, 16 May 2018.
Chair
Good afternoon. Welcome to this further session of the Digital, Culture, Media and Sport Select Committee inquiry into disinformation and fake news. We are very grateful, Jeff Silvester, to you for travelling out from Canada to join us for this evidence session today.
Jeff Silvester
I appreciate the invitation.
Chair
We are grateful to have the chance to put our questions to you in person. Also thank you as well for the written statement that you prepared and sent in. That has now been published by the Committee, so it will be available for people to view from now on the Committee website as well. We have also published some correspondence that we were given on Monday between the Electoral Commission and Facebook, and with the permission of the Electoral Commission, we have published that. I hope, Mr Silvester, that you and your representatives have received copies of that as well.
Jeff Silvester
We have that, yes.
Chair
Great, thank you. Just for the benefit of the record and the Committee, although you touch on this a little bit in the written statement, I wonder if you could just give us a bit of background towards your decision with Zack Massingham to set up AggregateIQ and the work you have done before then. Could you tell us when you set the company up and what you were doing before you set the company up?
Jeff Silvester
Sure. First of all, again, thank you for inviting me. It is a pleasure to be able to come and to speak with you in person and to be able to give you some factual information about what we do. Zack and I met in 2012, when working for a software company. I had already been working there and we hired him on board. Previous to that, I had done some work in politics. I worked for a Liberal Member of Parliament in the Canadian Parliament and volunteered and worked on elections sort of at every level in Canada. Separately, Zack had started doing some work in and around campaigns and as part of that, he found that a lot of the processes that they were undertaking did not make a lot of sense from a business perspective. That is when he first conceived of and created AggregateIQ. He registered the domain in 2011 and used it as a tradename. When he and I met and quickly found some shared interests, we then decided to work together. In November of 2013—I just want to make sure—we incorporated AggregateIQ. One of our early clients was a company by the name of SCL. It was Mr Wylie, who I knew previously, who introduced us to SCL and they asked us to do some work for them and we did that work. Some of our other earlier work is really around creating webpages, online advertising and software development. That is predominantly what we do.
Chair
Sure. Sometimes when two people get together and set up a company, they want to work together, but they have different skillsets. The skillsets of Zack and yourself, were they different at that time? Was one of you more technical and one of you more political or a mix of both?
Jeff Silvester
Zack has a bit more of a business background than I do. He provides more of a business view into problem-solving, whereas I come from an IT background. My education is in computer engineering technology, whereas his is in business. When we came together, I had been working, like I said, for a Member of Parliament and he decided not to run again. I had been working in IT originally, then worked for the Member of Parliament for a time and then went back into IT and we were making software at that time. When we got together, when we met, we were sort of surprised that we had not met each other previously, because we had been in and around a lot of the same places. So Zack’s background is in business, whereas mine is in the IT side of things.
Chair
So Zack did not have much experience in IT before you entered into business together, would that be correct?
Jeff Silvester
No. He had some, but it was a different type of experience in IT. I think he had done some work with respect to some websites, where he would create websites for people when he was younger. He is certainly not unfamiliar with IT, but my level of experience in information technology is a lot deeper, that is all.
Chair
How did you first meet Chris Wylie?
Jeff Silvester
I can’t recall the first meeting, but it was back in 2005. He was still in high school at the time and he was a volunteer on a campaign that I was volunteering on for that same Member of Parliament that I mentioned earlier. He and I met then. We just did a few common things on the campaign in terms of door to door and this type of thing. He subsequently wanted to volunteer with that same Member of Parliament, so he was volunteering in our office. Then I helped to speak with the Member about him volunteering in Ottawa and then we got to know each other a little bit during that time. Then subsequently, after he graduated high school, he went to Ottawa and worked in the Member’s office and then in the Liberal Leader’s office in Ottawa.
Chair
He sounds like someone you would probably consider a friend, someone you worked with on and off, you have known for a number of years.
Jeff Silvester
Yes. I have known him, like I said, since 2005. Over the time between then until somewhat recently, we kept in occasional contact with an e-mail or something like this.
Chair
He introduced you to SCL?
Jeff Silvester
Correct, yes. He introduced us to SCL to do some work in 2013.
Chair
That was the work in Trinidad, is that right?
Jeff Silvester
Trinidad and Tobago, correct.
Chair
The scope of work for Trinidad seems quite broad and certainly very technical. Your company was relatively young at that stage.
Jeff Silvester
Correct.
Chair
Had you engaged in work like that before?
Jeff Silvester
I had done software development work before, yes, and Zack had done online advertising work before, but in Trinidad, online advertising was not what we were doing there. The Trinidad work was to create a political customer relationship management software tool. That was the bulk of the work. It was a custom tool for that country, so they go door to door and find out who their supporters are, communicate with the volunteers and send SMSs out to encourage people to come to events. That was that tool.
Chair
Sure. When did you first meet Alexander Nix?
Jeff Silvester
Oh, gosh. I certainly had a phone call with him previous, like as we were talking about the work for Trinidad and Tobago. I think the first time I met him was in 2014, maybe March-ish. I do not know, I do not recall exactly, but in around the beginning of 2014.
Chair
But you did not meet while you were working on the Trinidad project?
Jeff Silvester
No, we did not meet.
Chair
Were you working from your office in Canada or were you—
Jeff Silvester
Correct. Well, in Trinidad we had not established an office, everyone was working from home.
Chair
The decision for you to work with SCL, was that taken by Chris Wylie? Did he effectively just say, “Can you come and help us with this piece of work?” and you were given a contract to do it or did you meet various people at SCL to establish that you were suitable?
Jeff Silvester
It was some time ago. He contacted me originally to talk about a project and get some advice. Through the conversation, I introduced him to Zack to talk a little bit about some of the online advertising possibilities and though we did not end up doing that, we did end up doing the work on the political CRM, the customer relationship management tool. I believe—and again, this is 2013, so it is some time ago—Zack went to London to meet with a couple of people during that time, but I do not know if he met Nix at that time. I can certainly find out.
Chair
But if it was not him, it would have been other SCL people?
Jeff Silvester
Not Chris Wylie or not Mr Nix you mean?
Chair
When you said Zack came to London and met a couple of people, you said it may not have been Alexander Nix, but would it have been other people from SCL to discuss that contract?
Jeff Silvester
Yes, correct.
Chair
Then in 2014 AIQ worked with SCL on developing the Ripon tool; that is correct?
Jeff Silvester
Sort of. The Ripon tool has been described in a lot of different ways. The part that we have done was a political customer relationship management tool focused on the US market. This was software that again would help with people going door to door. There was a tool in there that you could do phone banking so that you could call people and get their opinions on things and keep track of all that sort of information. It was a tool not dissimilar from the same political CRMs that each of you have here, like the Conservatives have Votesource and previously Merlin, Contact Creator I think Labour has, and the Lib Dems have Connect, which interestingly is based on the NGP VAN out of the US. That is the same tool that the Canadian Liberal Party is using. It is a tool just like that, but custom-made for that audience.
Chair
I have a copy of the contract between yourselves and SCL for that project and there is a third-party revenue share clause in that as well, where either company can be compensated for any future use of that tool if it is sold on and if it is licensed to third parties. Were there any third-party licensing arrangements put in place for that tool?
Jeff Silvester
I do not recall that specific part of that contract. I do not know if that contract you have is the same one that we signed, but if shared, I can certainly take a look.
Chair
I will read it. Clause 3.1 says, “In the event either party enters into third-party arrangements utilising the product to generate revenue, the revenue shall be shared between AIQ and SCL”.
Jeff Silvester
I do not have the benefit of seeing that to know if that is the contract, because I do not recall all the details, but to answer your question specifically, no, we never licensed it with anyone else and we do not know that they did either.
Chair
You never received revenue from SCL relating to the development of this product or indeed paid money to SCL as a consequence of the development of this product?
Jeff Silvester
To the question, we have never paid money to SCL for it, no. They did pay us for the development of that software. The contract that we had for them was to write software that they would own.
Chair
You are saying beyond the money you received to execute this contract and deliver the product, you have not received future payments from SCL because they have then taken that product and licensed it to other people?
Jeff Silvester
After 2014 we did some additional customisations to that software, the software development for it, leading up to the 2015 cycle. There are no external clients. The only work we did with respect to that was development work for that software, if that answers your question, because later in 2015, leading up to the 2016 primaries, we did do some additional software development on that software for SCL, but that again is just more development work, increasing the scope of what they wanted it to do and that sort of thing.
Chair
Because this third-party revenue share clause, I think it would be a fairly standard thing in a contract like this, because what you are saying is, “We were paid for developing the product for what you say it is going to be used for, but after we have done it for you, if you then sell that on to other people, license it to other people and it has a much greater commercial application, then we should receive some compensation for that as well, because we are the people that developed it”.
Jeff Silvester
I do not know about that particular section. I would have to go back and read it myself. We enter into different contracts with clients from time to time. In the case of the SCL contract that we signed, what I have seen, is the one that essentially says at the end of the development cycle, if they are happy with the product that we created for them and they pay us on time, then we transfer the code to them. Once we make that transfer, they can do whatever they want with it; they can use it however they like. That is fairly standard in software development.
Chair
But basically, regardless of the contract itself, the issue is revenue derived from the work, so what you are saying is you were paid to develop the tool, you were paid to do effectively some more work on that product in 2014, and other than that, you have not been paid by SCL—
Jeff Silvester
In 2015. But yes, other than that, that is all the payments we received from SCL for that work.
Chair
Obviously in 2016, we know that you did work on Vote Leave in the referendum campaign. During this period of time, you had several projects with SCL, we know as well that obviously you worked on Cambridge Analytica’s work, I think it was, for the Bolton super PAC in 2014 as well. You were involved in the work they did on various different political campaigns that Ambassador Bolton’s super PAC was supporting.
Jeff Silvester
In 2014?
Chair
2014.
Jeff Silvester
In 2014, the work we did there was all part of that Ripon contract with SCL. We understood that SCL had some relationship with Cambridge Analytica, but our contract was with SCL at that time. Bolton PAC was one of the organisations that SCL had asked us to deploy that Ripon tool—that Ripon political CRM—for, so we deployed it on their servers and assisted with loading information into it for the client, yes.
Chair
Yes, so in terms of your SCL work, you were hired to work in Trinidad; you were hired then to develop Ripon. You worked, as a consequence of developing Ripon, on the Bolton super PAC work and then in late 2014, it would seem for the 2015 cycle, as you said, you were involved in doing some further work on Ripon?
Jeff Silvester
On the Ripon tool, correct.
Chair
Yes, exactly. During this time there is quite a lot of work obviously with SCL. Are you working with other clients as well?
Jeff Silvester
Yes. We have worked with all kinds of clients doing website development and online advertising. SCL at that time was certainly our largest client, our largest single client, but it was not our only client.
Chair
Could you give us an idea of what your company’s turnover was at that time?
Jeff Silvester
In terms of staff?
Chair
No, in terms of revenue.
Jeff Silvester
I do not have that right now. I could certainly try to find that for you and get it to you, but I do not have it in front of me right now.
Chair
Yes. Rather than going to Companies House in British Columbia, if you were able to just send us the turnover figures for your company accounts.
Jeff Silvester
Yes, I can send you some general figures when I get back to the office.
Chair
Presumably you have to report accounts as a company?
Jeff Silvester
Yes, there is some reporting we have to do. I am happy to share that with you.
Chair
Yes. I am not asking for secret commercial information, just the reported accounts.
Jeff Silvester
No, I understand, just general top-line numbers. Yes, I can see if I can find them for you.
Chair
I know we are going to come on and talk about the referendum later on, but just in terms of the chronology of your company, you say in your written statement that you were introduced to Vote Leave by a mutual friend in April 2016. Is that right?
Jeff Silvester
I think 31 March or 1 April, one or the other, but yes, it was at that time.
Chair
Who was the person that made the introduction?
Jeff Silvester
We have not disclosed that now just in terms of his privacy, but I think he has come out for that. It was Mark Gettleson who introduced us.
Chair
Who was the introduction to, to Dominic Cummings?
Jeff Silvester
No, to Henry de Zoete, who is the digital director.
Chair
You had not had any contact with Vote Leave or people who worked for Vote Leave previous to that?
Jeff Silvester
Previous to that, no.
Chair
Just one question on that before we move on to other colleagues’ questions. You will have seen the Facebook letter they sent to the Electoral Commission. They say, “In total, AIQ ran 1,390 ads on behalf of the pages linked to the referendum campaign between February 2016 and 23 June inclusive”. How were you running ads in February 2015 for Vote Leave if you had not met them until 31 March?
Jeff Silvester
I am only aware of us running ads on the first Friday following the announcement of the actual campaign. I know Vote Leave ran some ads previous to that, but I do not think we did anything with that.
Chair
Obviously what Facebook can see is who the administrators are for the pages that are running the ads.
Jeff Silvester
Correct.
Chair
They are not saying Vote Leave, they are saying in total AIQ ran those ads on behalf of these pages from February.
Jeff Silvester
I do not recall running any ads previous to that, because our first introduction to Henry was on, I think, 31 March or 1 April. I know we started running ads shortly after the 13th, it would have been, but that was the first time we ran ads, to my knowledge.
Chair
You are saying that is the first time you met was on 31 March, but were you in contact remotely?
Jeff Silvester
No, not at all. No, the first introduction was at that time. I can get the exact date if it is important, but it is either 31 March or 1 April.
Chair
This is an important point. If you are able to check that for us, maybe with Zack as well, and we will certainly ask Facebook just to confirm that is correct. Clearly what Facebook have put in their statement to the Electoral Commission, based on the work they have done looking at this, is obviously very different from your own position. I think we just need to establish what the truth is.
Jeff Silvester
Yes. I do not know what Facebook is looking at in order to make that assumption—or that assertion, rather—but I do know that we did not do anything until they launched, essentially. I do know that Vote Leave did run ads on their own through their page. When we run ads, we do it through the client, essentially, so we did run ads for them for their launch, but not previously. But again, I will double-check and look into that to make sure, but I have no records anywhere that we have spoken to them previous to that or did anything for them previously.
Chair
It is a question of when did you have administration rights of the pages.
Jeff Silvester
I can try to find exactly when we got access to run ads on their page. I will see if I can get that data.
Julian Knight
Thank you, Mr Silvester, for appearing before us today, it is greatly appreciated. In your evidence you gave before the Canadian committee, you said essentially you do not hold data on individuals. Is that correct?
Jeff Silvester
Our practice is not to, yes.
Julian Knight
Your practice is not to? Does that mean that you do or do not?
Jeff Silvester
It means that we have at times, but we do not keep that information.
Julian Knight
Is that therefore the reason why when we asked Mr Vickery, who gave evidence before us, he said that AIQ was asked that very same question and he said that you were not quite fully straightforward in your answer to the Canadian committee? He says, “They may not have the large oceans but they have the residual ponds from them accessing it, such as I was able to locate my own information in a spreadsheet called Online Activists, which had been pulled and was available to AIQ”. Effectively, who is telling the truth here? Is it yourself or is it Mr Vickery?
Jeff Silvester
What Mr Vickery is making reference to is, unauthorised, he gained access to our code repository. Our code repository is a server where we store backups and our working product of the software code that we write for our clients and for ourselves. We were alerted to that on 25 March by a journalist, so we quickly disabled access and secured that and other servers. In our quick and initial investigation, we found that we had inadvertently backed up some client information into that repository. That client information was contact information or voter contact information from some of our clients. When we discovered that, we immediately contacted the Office of the Information and Privacy Commissioner of British Columbia. We let them know and we followed up with them in the morning with a conversation. We subsequently reported to them more of our findings and our investigation into that is continuing. The information that was in there was not supposed to be in there. When we have access to information from clients, it is for the purposes of doing work for that client and at the end of that we delete that information. Information was deleted off the live systems when they were shut down. Unfortunately, when some code backups were made, it backed up some of the information in addition to the code, unbeknown to our developers.
Julian Knight
You are saying that inadvertently it saved voter information?
Jeff Silvester
It was contact information for voters, yes.
Julian Knight
Contact information for voters. It is not specifically client information, not like, for example, if I am your client, you would back up my name. Effectively it would be all those people—and potentially a huge number of people—I have information on that I come to you about in order basically for you to use that data. That is the information that has been inadvertently backed up, is that correct?
Jeff Silvester
Some of it, yes.
Julian Knight
Exactly how much voter data was inadvertently backed up?
Jeff Silvester
I do not have the numbers right here in front of me, but we did share our initial findings with the Office of the Information and Privacy Commissioner of British Columbia; we have shared some with the ICO here.
Julian Knight
Did they not ask you that question? They must have asked you that question, how much—
Jeff Silvester
We have sent that information to the BC—
Julian Knight
You know the number?
Jeff Silvester
Yes. I do not have it with me here but I can happily get that for you.
Julian Knight
When will you be able to let us have precisely the number of people who were involved in inadvertent backing up?
Jeff Silvester
As soon as I get back to my office, yes.
Julian Knight
Thank you. Where is your data stored though for your company? Obviously this was inadvertently backed up, but how do you back up your data? Do you use, for example, Amazon Web Service?
Jeff Silvester
We do not hold a lot of data. When we create software for a client, and I will use a political customer relationship management tool as an example, it does have its own database. We will deploy those particular tools to the region using cloud services like Amazon where the customer is located. In the case of the United States, where we do most of our work, we will choose a state closest to the state where they are working, where we can get suitable servers, and then all the backups exist there within that location.
Julian Knight
Basically if I was from North Carolina, for example, and I was your client, you would use a server from let’s say South Carolina?
Jeff Silvester
If that was the closest server that we could get, yes. We try to find the servers closest to where they are. It is not always possible to get in the exact same state or the exact same country, but we make our best effort to do that.
Julian Knight
Do you or have you stored data on GitLab?
Jeff Silvester
Yes. As you know, when we did some inadvertent backups of the information from some of the voters, it did end up on GitLab, yes.
Julian Knight
That was the one that was inadvertently backed up on GitLab?
Jeff Silvester
That is what we have talked about, yes.
Julian Knight
It is a 1.8 gigabyte file, I understand. Is that what you are referring to in terms of Calypso, I believe it is called? What is Calypso, basically?
Jeff Silvester
I do not know what Calypso is.
Julian Knight
No idea at all, so this is not anything to do with the information that is stored on GitLab?
Jeff Silvester
I do not know that that is on GitLab. I have never heard the term. Well, I have heard the term Calypso, but not in relation to any work that we have done.
Julian Knight
When have you heard this term?
Jeff Silvester
I mean, there are songs about it, like it is just a word. I am thinking of a John Denver song in particular, but in terms of work that we have done, to my recollection, I cannot think of any time when we have called a project Calypso or anything like that. If you have information there that you can share, I can take a look, but I do not—
Julian Knight
This isn’t effectively a large database that you have stored on GitLab, 1.8 gigabytes?
Jeff Silvester
Not to my knowledge, no.
Julian Knight
Not at all. Would you know about that?
Jeff Silvester
I could certainly double-check to see if somebody has put something in there called Calypso. I would have to go and look at the data.
Julian Knight
A file of that size, just supposing there was a file existing of that particular size, that is really quite substantial in size, is it not?
Jeff Silvester
It depends what is in the file. 1.5 you said, or—
Julian Knight
1.8.
Jeff Silvester
Oh, 1.8 gigabytes. Depending on the nature of the file, it could be a large file or a small file. If it is videos and stuff, it would be small; if it was information—
Julian Knight
If it was voter information, it would be quite considerable?
Jeff Silvester
If it was voter information, it would be quite large.
Julian Knight
When you say “quite large”, hundreds of thousands, potentially?
Jeff Silvester
Hundreds, potentially.
Julian Knight
Just one other question as well. You told the Canadian committee that AggregateIQ is not a data analytics company, so what precisely do you do?
Jeff Silvester
We are an online advertising, software development and website development company. We work with clients around the world, but mostly in the United States, providing those services.
Julian Knight
Online advertising and software development. To be involved with these particular campaigns globally from Trinidad and Tobago to Vote Leave, that does not sound like an overly-specialist sort of area. Effectively, it seems very odd that a company from where you are located will be so intrinsically involved in these particular elections.
Jeff Silvester
It is somewhat specialised in that we do focus in and around politics. There are lots of website development companies, there are lots of online advertising companies, there are lots of software development companies, but having those companies with some experience in the political side of things is more specialised. We are able to provide the work for the clients and understand what they are asking when they say, “We are trying to do some voter contact in this area”. That type of information and that type of knowledge and experience is helpful when you are developing software for that or a website or whatever it happens to be.
Julian Knight
Your USP is not the fact that you have had access to this large ocean of data and have been able to draw off these models from that data and then basically you are able then to effectively sell those in the international political community? That is not your USP?
Jeff Silvester
No, we do not download and sell models or anything.
Julian Knight
No, I am not saying you are selling specific information, but, for example, if you have had this data and then what you are doing, you have created this working structure from that data, that is not your USP when it comes to it? It is based on the fact that you are very good at building these websites and you understand political speak when someone gets on the phone or sends an e-mail; is that just your USP?
Jeff Silvester
Let me be clear, we are not using data from any client for any other client. If we have had access to any model or anything like you have suggested, that is for that client and that client only. We do not retain that information; we do not use that information for anything. It is theirs. Our work is in the online advertising, software development and website development, particularly for politics, but also for community organisations, some companies, things like that. That is the work we do. We are not data scientists, we are not a data analytics company. We do not model or do anything like this with data. If we have information from a client that they want us to use in providing services, like, for example, information about voters that you might get if you are a registered candidate or a political party, then we help them use that information how they want it to be used. But as you are saying, our expertise is in applying those technical sensibilities to the political space.
Chair
On this area, you have talked a bit about your Monarch project when you gave evidence in the Canadian House of Commons. Can you explain a little bit about how Monarch works, how data is gathered to support the systems that Monarch runs?
Jeff Silvester
Yes. There are two parts to that project. One is a simple reporting tool that uses the Facebook API to just get information on the performance of ads. If we were running an advertisement for you, for example, you would be able to log in and see they ran 12 different ads, here was the popularity of each and here is how much was spent. That is what you can see there. The other part of Monarch integrates with your website so that if somebody comes to your website and let’s say you have a link on there to sign up for my mailing list and they put information, their name and e-mail address there and hit “submit”, it makes sure that that gets into your database in a way that is marked so that you know it is an e-mail sign-up as opposed to somebody who is volunteering, as opposed to somebody who might be—I do not know—providing information because they want you to phone them later. It tracks that information and so what we track is how many people do each of those things, so then I could let you know, “We ran 12 ads. Five people who came to your website because of an ad, they signed up to your e-mail list, four people signed up to your get more information and another signed up to volunteer” or something like that. That is predominantly what those tools do.
Chair
Predominantly. Does that include any data that is gathered from the site, so if we were using pixels, would Monarch record that data?
Jeff Silvester
Monarch does use pixels in order to track that information, so it does temporarily store the anonymous browsing information on the individual and then we link that up. Because essentially a pixel is a tiny piece of code that lives on a web server, so that when you get to that web server, if you have clicked on a particular ad, you know that it was an ad that was clicked on, so that is how the person got there. It is a way that advertising companies use to track who comes to their website.
Chair
But using pixels with Facebook helps you link that ad traffic, that site traffic back to Facebook users?
Jeff Silvester
Not to a Facebook user, no. It tells you that they have come from Facebook and which ad on Facebook it came to, if you put that tracking in place. When you advertise with Facebook, the information that Facebook provides back to you is all anonymous. If you run enough ads, you can generally see how many people are within certain demographic categories, so you could say people between 25 and 35 clicked more often than people between 45 and 55, but you do not get individual information or individual user information from Facebook at all.
Chair
No, it would not name the user but it helps you contact that person again. You could run that back to the person that has been detected through pixels, even if you do not necessarily know the name of that person.
Jeff Silvester
That is a different kind of pixel called a retargeting pixel. A retargeting pixel on Facebook or Google, what it lets you do is if Facebook or Google detects someone who they think is that same person—you have asked them to show ads say to people that have been to my website, you can go on Facebook or Google, for example, and say, “I would like to show ads to people who have been on my website”—then if they see that person again, they will then show them the ad, but you do not get to see who those people are. You only know that X number of people came to your website and you would like to show ads to them again.
Chair
This information that comes back to the Monarch system, you said it is gathering this information based on how people are interacting with some sites.
Jeff Silvester
The information that Monarch gathers is the general advertising information, so it would get the number of people who clicked on an ad and the number of people ads were shown to, but not the people themselves.
Chair
That information, is that held in perpetuity within the system or is it destroyed after a period of time? What happens there?
Jeff Silvester
There are two. The information that we get, because of course people come to your website all the time and not all of it is related to ad traffic, so periodically, it is like a log file that as you go, it just cleans out a couple of days before, so you might have a couple of days’ worth of information there that you has come into your website, so you can compare to see if it was an ad that drove them or not. But then we remove the information, and then as with all of our clients, at the end of our work with those clients, we delete all the information from that client.
Chair
It was reported, I think after the referendum campaign, that you used an app called uCampaign during the referendum. Is that correct?
Jeff Silvester
The Vote Leave campaign did use uCampaign, yes, that is right.
Chair
Were you involved in the deployment of that app?
Jeff Silvester
Not the deployment, but we certainly made the introduction and connected them and supported the relationship in that respect, yes. I did not do the physical technical deployment, but—
Chair
But effectively uCampaign gathers the contacts out of someone’s phone, doesn’t it, if they use the app?
Jeff Silvester
The American version does. I understood that they changed this version for the UK to meet the UK rules with respect to data collection, as such.
Chair
I am sure the Information Commissioner will want to check that they did do that.
Jeff Silvester
Yes. I was not involved in the technical element. I e-mailed them pictures, like for the icons. I was not involved in any of that.
Chair
But if uCampaign works in exactly the same way or works in a similar way in the UK, that it is gathering and people sign up to it to use it as part of supporting a campaign, the idea is that all their friends, all their contacts that they have in their phone get told that their friend is going to vote one way in this referendum and is active in some way. Is the campaign also benefiting from that data, because you are then getting phone numbers, potentially e-mail contacts as well? Is that coming back to the campaign?
Jeff Silvester
I had some experience using the uCampaign app previously, but I understood that when it collects the information—and again, I do not have first-hand knowledge of that, only just what I observed—is that it used the information so that you can choose which friends you wanted to e-mail, so when you went to use that feature, like it would say, “Here are your friends. Do you want to e-mail them or send them an SMS?” or something like this. I do not remember exactly. That is not really my area of expertise, so I can’t really speak to that, so I do not know if that information then comes to the campaign, in the American sense anyway, and I do not know from the UK perspective.
Chair
But the app slightly gamifies the process as well. In some ways, it sort of rewards people for sharing their contacts.
Jeff Silvester
I think you get points when that happens but, again, I do not know in the context of the UK. I did not use the one that was deployed for Vote Leave, so I do not know. I know in the American context that, yes, you get points when you do certain tasks, like sharing something with a friend or looking at a Facebook page and this type of thing, but I do not know what information it collects specifically and where that goes. That would really be a better question for them.
Chair
Yes, but obviously what it does in effect is basically gathering personal contacts from people’s phones to support the campaign by encouraging people to use the app—
Jeff Silvester
Certainly in theory it could. Whether that happened in the UK, I do not know, but in the US context, I know that is possible. It certainly can happen, they can do that, but I do not know if that is what they deployed for the UK.
Chair
But it is interesting as well, because the uCampaign app was used in the referendum here, it was used in the Cruz campaign and it was used in the Trump campaign. That is correct, isn’t it?
Jeff Silvester
I know it was used in the Cruz campaign. That is the experience that I had working with them. I think they might have worked with Trump, but I was not involved.
Chair
It was reported at the time that they were.
Jeff Silvester
I trust what you are saying, yes.
Chair
It is just a bit of a coincidence as well that SCL and Cambridge Analytica worked on the Cruz campaign, they worked on the Trump campaign, you guys worked on the referendum.
Jeff Silvester
With respect to the uCampaign, it is not a coincidence at all. I had experience helping when they deployed it for the Cruz campaign through my work there, so when the Vote Leave campaign was looking for an app, I suggested that one.
Chair
You worked on the Cruz campaign?
Jeff Silvester
I worked with SCL on the Cruz campaign.
Chair
That is another one. When we were talking earlier on, we did not cover off you working with SCL in 2016 on the Cruz campaign.
Jeff Silvester
That is what I mentioned, the primaries in 2015, correct.
Chair
So when you mentioned the 2015 cycle, you were talking about the Republican primaries?
Jeff Silvester
Correct, the presidential primaries, yes.
Christian Matheson
I just have a follow-up to Mr Knight’s questions on this data repository, the code depository that we have talked about a little earlier. Can you just say again—I think you referred to it in the answers—when and how you discovered that they had been left exposed?
Jeff Silvester
On 25 March, we were alerted by a journalist that there had been unauthorised access to our code repository. We immediately shut down the code repository and indeed secured all of our servers and all of our systems to make sure no further access was possible and we started an investigation right then. We did discover, as I said, that there had been some personal information from one of our clients previously that had been left in that repository and it was not supposed to have been there, as I said. That is when we contacted the Office of the Information and Privacy Commissioner in British Columbia to let them know about that.
Christian Matheson
“Unauthorised access” sounds like hacking.
Jeff Silvester
Mr Vickery has described how he accessed the service. Our investigation is still ongoing into how he was able to do what he said he did. We are doing a very thorough investigation and it unfortunately takes quite a lot of time going through every log and every system and every backup, but we are continuing to do that. I cannot speak to the methods by which he accessed the repository, but it certainly was not authorised by us.
Christian Matheson
What is happening with your investigations at the moment into this?
Jeff Silvester
As I said, we did find some additional information beyond the stuff that we first found in our first look at the systems, which we have reported to the Information Commissioner in British Columbia and to the UKICO. We are following up on that with both of them. We are still looking into how the access was obtained and the whole circumstance behind that. We also are going through every log file. So far all we have found is that Mr Vickery and the journalist were the only ones that had accessed that system aside from our staff, but we want to be 100% certain of that. We are going through every log file and checking all of that to make sure.
Christian Matheson
When do you think that inquiry is going to finish?
Jeff Silvester
I do not want to prejudge.
Christian Matheson
Give us a rough idea: June, July, August?
Jeff Silvester
I would say within the next month or two, yes.
Christian Matheson
Do you feel a sense perhaps of gratitude to Mr Vickery for demonstrating that some of this data was exposed?
Jeff Silvester
I think my gratitude is more to the journalist who reported it to us before reporting it anywhere else. In his statement, Mr Vickery said that normally when he finds these things he notifies the company right away. In this case, he notified the journalist first, so I do have a lot of gratitude to the journalist for letting us know before reporting it. We have not spoken directly with Mr Vickery but we have sent letters via our lawyers to his lawyers to get confirmation that he will not share that information with anyone outside of the relevant legal authorities. Certainly I appreciate him not doing that, because of course, as you know—as I have mentioned—there was some personal information in there that should not have been there. In the interests of protecting people’s personal information, we are glad that he has agreed not to share it with any one.
Christian Matheson
“Some personal information that should not have been there.” What exactly does that mean?
Jeff Silvester
As I described earlier to Mr Knight, it was some contact information on individual voters from some of the clients that we have had previously.
Christian Matheson
Including clients in the USA?
Jeff Silvester
In the USA predominantly, yes.
Christian Matheson
Have you not stepped over a line there, because obviously you are a Canadian company and the data is being kept in Canada, but this is data of American people, which could be useful for an American election?
Jeff Silvester
I do not know where the exact server location is for that code repository. I think it is in the United States though for that particular repository. I would have to get that information for you.
Christian Matheson
But if the server location was not in the USA, might you be in trouble?
Jeff Silvester
I do not believe so, no.
Christian Matheson
No. There is a cynical view—I am not suggesting I share it, I am just going to chuck it in there—that the reason that the data and the code was left unsecured was so that people that you would approve of would gain access to it, but there would not have to be a physical transfer that could be audited or followed, there would not have to be a data transfer. You would just give somebody the nod, “This is where you will find the data, this is where you will find the code” and they access it that way, so a different organisation can access the same code and dataset. Do you think that is fair or is it only a cynical assessment?
Jeff Silvester
No. The information that we store in our repository is, like I said, predominantly code about the work that we are doing for our clients. Anyone getting access to that code certainly has the potential risk of giving people access to our client’s proprietary information, so we would never want that information to get out. With respect to the personal information that was inadvertently stored there, that would be an incredibly inefficient way to do what you are suggesting, from a simple perspective, but moreover, we log everything. We would definitely be able to go back and look at who had accessed that.
Christian Matheson
It would be inefficient but it would also be efficient in terms of covering your tracks.
Jeff Silvester
I totally disagree.
Christian Matheson
Why?
Jeff Silvester
Right now we are spending—
Christian Matheson
You are the expert and I am not. Tell me why I am wrong.
Jeff Silvester
Right now we are spending quite a good deal of time looking into exactly who accessed that information, so all of that will be available. We can see that Mr Vickery and the journalist did access that information. The journalist did not download it though.
Christian Matheson
Yes, but you are only looking at it because Mr Vickery and the journalist found it and told you it was publicly available. If they had not done so, then you would not have needed to do the audit. If the cynical suggestion that I am suggesting was the case, then nobody would have known about it, other than the people that your company had suggested.
Jeff Silvester
That is certainly not how we conduct the business and that is not what we do. As I said, the personal information that was in there, I should say, was basic contact information. I do not know how that could help anyone, but at the same point it was not supposed to be there. I think I mentioned—maybe I did not—we have put processes into place now to ensure that that does not happen, including additional audits on a regular basis. Now, even on projects that we are no longer working on—and this was one of the early findings—we still go back and audit those GitLab repositories to make sure that there is nothing there that should not be there.
Christian Matheson
Did Mr Vickery hack GitLab?
Jeff Silvester
I do not want to describe it that way.
Christian Matheson
Did he gain access to it?
Jeff Silvester
He certainly gained access to a portion of our GitLab, yes.
Christian Matheson
Did the journalist gain access to it?
Jeff Silvester
Yes.
Christian Matheson
Did you see that the journalist had gained access to it from your auditing?
Jeff Silvester
Yes, we did.
Christian Matheson
Presumably, they both accept that anyway, that they did?
Jeff Silvester
Correct.
Ian C. Lucas
Does GitLab belong to AIQ?
Jeff Silvester
The GitLab installation. When you use GitLab, it is a tool that anyone can use and use for their own development. We do not own the code for GitLab, but we have a licence to use one version of it for our development. Does that make sense?
Ian C. Lucas
There are parts of GitLab that are exclusively yours?
Jeff Silvester
There was information on that server that is exclusively ours, yes.
Ian C. Lucas
That is what was accessed by Mr Vickery?
Jeff Silvester
He accessed a couple of things on that server. He accessed code, both some code that is our client code and some code that is our own, and he accessed some contact information from voters, again that came from our clients.
Ian C. Lucas
Can I read you something in your statement that you sent to us? You said, “At the end of our engagement with a client or at any time before that when any information is no longer required, we return the information to our client and destroy it from our systems”.
Jeff Silvester
Correct.
Ian C. Lucas
I am puzzled because I do not understand why the information on GitLab that was accessed by Mr Vickery had not been destroyed.
Jeff Silvester
It is a very good question because, as I said, that information was not supposed to be there.
Ian C. Lucas
So what is the answer to the question? Why was it still there?
Jeff Silvester
That is what I was just about to explain. The information that was on there was information that during the process of changing code for a server or for a client—when we do that oftentimes the developers do not just go straight on to the server and update the code because there are all kinds of risks associated with that. What they will do is they will make sure they have the latest version of that code. They will set up a test server or a development server, which looks just like the other server but without the data, and then they make the changes, test it out, make sure it is going to work. Then when they are ready they use GitLab to transfer that new code on to that server that is functioning for the client. As part of that process before they do that deploy, they will oftentimes make a backup of that server before they deploy the code, just as an extra step. But in that, if they then discover quickly that they need to make another quick change, sometimes they do that directly on that server. They are like, for example, “Oh, I forgot to change the domain”. I apologise that this is a little bit technical, but when they do the development on a test server, it might be called “test.yourdomain.com” but when you move that over to deploy for the production, it has to be called “production.yourdomain.com”. If they forgot to make that change, they might make that quickly on the server. They then will back up that code and this is how some of these happen. They then back up that code again to GitLab but because they had made a backup of the whole system on that server before they deployed their code, that might include personal information like we saw, the contact information that ended in our repository. The developers did not know that they were backing up that information when they did it. They thought they were just backing up code. They had backed up the information from the server. Again, I apologise, it is rather technical, but essentially the developers when doing the backup—and it is not in all of the cases and all of the things we have done but in a few of them that is—
Ian C. Lucas
The thing is, Mr Silvester, you are right, it is technical and you have well and truly lost me.
Jeff Silvester
I am sorry.
Ian C. Lucas
You are the expert and the situation is that that should not have happened.
Jeff Silvester
Correct.
Ian C. Lucas
How long was the information there for? It is 2018 now and this was flagged up to you in March.
Jeff Silvester
I believe the latest information was from 2017 but I would have to confirm that. I will happily look to see what the last date of any information being on there was.
Ian C. Lucas
It is a pretty important question, isn’t it? You have been operating since November 2013 as a business?
Jeff Silvester
Correct.
Ian C. Lucas
Have you been using GitLab since then?
Jeff Silvester
We have used different implementations of Git and GitLab but there was code on there from stuff as far back as 2013, correct, and there was actually information from as far back as 2013.
Ian C. Lucas
You have been involved in the referendum campaign. You have been involved in earlier elections in different places.
Jeff Silvester
Correct.
Ian C. Lucas
All of that information is on GitLab?
Jeff Silvester
No. There is information from a limited number of clients on there. Where we did some of that—
Ian C. Lucas
Is there information from SCL there?
Jeff Silvester
There was information that SCL provided to us for campaigns, yes, but there was no information from during the Brexit campaign.
Ian C. Lucas
There is no information from during the Brexit campaign?
Jeff Silvester
Correct.
Ian C. Lucas
Can you just give me a moment?
Jeff Silvester
Please.
Jo Stevens
Can I ask one question while you are doing that?
Chair
Yes.
Jo Stevens
You have explained now what you are doing in terms of audits, but why were you not doing that before?
Jeff Silvester
What we would audit previously was the products we were working on and we did not go back and audit the ones that we had worked on previously. That is a failing on our part. We should have been going back in time and looking previously when really the audits would only happen for the ones we were working on. That is one of the initial findings of our investigation.
Jo Stevens
It concerns me, and I am sure it concerns the Committee, that in your written evidence to us you have said—and Mr Lucas quoted the passage from your evidence—that you destroy information from your systems and you return it to your client. You have said that in your statement knowing, in fact, that your company did not do that.
Jeff Silvester
That is our process. We destroy the information on the systems that we create for them. For example, if we deployed a political customer relationship management tool for you and you had gone around and talked to your constituents and maybe kept track of who said they would support you and who did not, at the end of the campaign we ensure that if you retain that information that you have that and then we destroy the data and shut down that server. Then we do not keep any of that. The information, though, that unfortunately was backed up in our Git repository was not supposed to be backed up there.
Jo Stevens
I know, but what I am saying is in your statement you say that you destroy it and/or return it to the client, but in fact you did not. Your evidence is contradictory.
Jeff Silvester
I was trying to perhaps describe what our practice is, and I fully admitted and have been completely open about the mistakes that we have made. That was a mistake. It was not supposed to have been backed up, though it was, and that is why we have already put into place measures to prevent that from happening again. I have apologised previously and I would apologise again to anyone who is affected.
Jo Stevens
You said that you could tell that Mr Vickery had accessed the information on GitLab and you could tell that the journalist had accessed it?
Jeff Silvester
Correct.
Jo Stevens
Has anybody else accessed it?
Jeff Silvester
Like I said, our investigation is ongoing, but so far we have only seen access from our staff and from those individuals with relation to that information.
Ian C. Lucas
Thank you very much for that and thanks to Jo for her help. I am just going to hand you a list of GitLab files that I have highlighted. The reason I was a bit taken aback—
Jeff Silvester
This is the highlighted section you mean?
Ian C. Lucas
Yes. I think I started highlighting at “Change Britain”.
Jeff Silvester
Correct.
Ian C. Lucas
“Sitemaster, Wordpress site, client Brexit, My Polling Station, Master”. This is a Vote Leave website for finding a polling station. Note it says “client” and the name, “Vote Leave, Client Brexit, SyncMaster”. Those are all Brexit files on GitLab?
Jeff Silvester
Correct.
Ian C. Lucas
You said there weren’t any?
Jeff Silvester
But that is code. As I said, predominantly our repository holds information on the code that we write for our clients. Sometimes it has pictures and things like that from websites, but the vast majority of the information in there is software code. We do have software code from some of the work we did on Brexit, but we have not found any personal information from that time.
Ian C. Lucas
None of these will contain personal information relating to Brexit?
Jeff Silvester
So far our investigation has not found any Brexit information.
Ian C. Lucas
Have you investigated these particular files?
Jeff Silvester
I have had my staff go through all of the files and report them to me and I have not seen anything yet. If there are additional files we have missed, it is theoretically possible, but so far they have done a very comprehensive job of doing that. Now, here’s the thing. As our investigation goes on, if we do find any additional information I will happily share that with you. When we conclude our investigation I am happy to report all the findings to you as well.
Ian C. Lucas
You are a Canadian company. You have information relating to the referendum in the UK, which is continuing to be stored in this GitLab repository. Another person, a third party, has gained access to it. That causes me great concern about your ability to protect data belonging to my constituents.
Jeff Silvester
Like I said, I have not seen anything in there and I am not aware of any Brexit data being in there, but in general it certainly is a concern. It is a concern that it was able to happen and it is a concern that the information was in there in the first place. Again, it should not have been and we certainly made mistakes in allowing that to happen. We are working hard to correct that. We are working with the Canadian authorities in the Office of the Information and Privacy Commissioner for British Columbia and, indeed, with the UK ICO here and reporting information to them as well. I will be following up with both of them as this goes on and those are the relevant authorities to deal with this particular situation.
Ian C. Lucas
Okay, I have finished with that bit.
Chair
With regard to the ICO, you have spoken a bit about this. This was of interest when you gave evidence to the Canadian Parliament. I have spoken with the ICO again today. They have said, for the record, that your company has responded to letters. I understand there is a discussion about whether you will meet with them while you are in London; I hope you do. They said they have not received any information from you directly in response to their questions. There has been nothing, no documents, no data. Nothing that they have requested has been delivered to them. There has been contact and correspondence but no information shared, and the only information they have been able to gather so far to support their investigation has come to them from third parties and not from you. I would ask you: could you just confirm for the Committee—and the ICO is here in the room as well—what you have given to them? You have referred several times now to information that you have shared with the ICO. What have you directly given to the ICO?
Jeff Silvester
They sent us a letter on 17 May 2017 and we responded to their letter with a letter. The whole content was the letter. Then again on 30 January 2018 they sent us a letter and we responded with a letter. After that, we communicated. I do not have the exact dates but we sent them another letter and then immediately following the appearance at the Canadian Parliament we sent another letter specifically to ask why they had mentioned that they believed we were not co-operating. We have subsequently had quite a lot of back and forth on e-mail. It is certainly our intention to co-operate as best as we can. We have had quite a number of e-mails go back and forth now and, indeed, we are meeting with some of their officials after this meeting.
Chair
Yes. You can engage in correspondence with someone about questions you want them to answer without them answering the questions. That seems to be the case. They have contacted you saying, “We want information about things that are relevant to our investigation”. You can respond to their letters and you can say, “We are in contact, we are co-operating” but you are not actually co-operating because you are not giving them what they are asking for.
Jeff Silvester
We do have restrictions with respect to what we are able to provide because of confidentiality with our individual clients, and we are clear about that with them. If we cannot give them something, we have been clear. I can only answer the questions as best as I can. When we reached out after the Committee meeting and they responded, we invited them again to send any additional questions they felt we had not answered and they have sent those to us. We are going to go through and make sure that we address those individually and provide that information to them. We are going to do our best to get them all the answers and information they need, but again we do have confidentiality obligations we have to balance.
Chair
This is the UK Information Commissioner seeking information relevant to an investigation they are running about use of data in a referendum election in the UK, so their jurisdictional power is absolute. Today and on previous occasions I think you have sought to confuse us by saying that responding to letters is the same as answering questions, and that is what seems to have been lacking. What you have said today is you are going to answer their questions and you are going to meet with the Information Commissioner while you are in London, so I am pleased to hear that. It is also the case you wrote to the Information Commissioner telling her to back off and you thought the investigation was damaging your company, isn’t that correct?
Jeff Silvester
I am happy to provide all of that correspondence to the Committee confidentially.
Chair
I would be grateful for that.
Jeff Silvester
Once I get back to the office I will send that to you. In one of the letters we did state that we thought that the commissioner’s comments were not appropriate that she had made to the press and that her comments had been damaging. That is true. Subsequently, we did say that we thought that the matter was closed because we believed that we had answered all their questions substantively. It is clear once we got to the Canadian commissioner and I believe you had sent an SMS or a text to one of the Members of Parliament to say that the commissioner had told you that we had not been co-operating or she was not happy with our answers, whichever it was—and I have not seen that SMS—that is why we reached out to them right after to clarify. Aside from those two letters and our two responses, we had no letters from them saying what you told us or through the Committee in an SMS. I would hope that rather than communicate through you or through the media that if they had additional questions they would just let us know or if we have not answered something to their satisfaction they would just let us know and we will happily respond.
Chair
I watched the session in the Canadian House of Commons and I contacted a member of the committee, Nathaniel Erskine-Smith, who had asked you about this, because your answer to the question was that you were co-operating with the investigation, which was not the case.
Jeff Silvester
We believed we were.
Chair
If you have been asked a series of questions and asked to supply information and then you do not do it, how would you consider that to be complying with the requests that had been made and co-operating with the investigation?
Jeff Silvester
As I said, I will happily provide you all the correspondence so you can take a look for yourself, but we answered the questions as best as we could subject to the confidentiality obligations we have.
Chair
That amounted, though, to you saying, “We cannot answer these questions”.
Jeff Silvester
There are some questions that we could only answer partially and we let them know which those were and the circumstances by which we could answer them more fully.
Chair
Okay, but then did you actually answer them at all? You said there were questions that you could partially answer, but did you go ahead and then partially answer them?
Jeff Silvester
In their second letter on 30 January they asked us some more specifics about specific clients for which they satisfied the conditions by which we could provide the information, so we provided the information they asked for. If they have follow-ups on that letter from 30 January, which they have sent to us subsequently and I am working on responding to, we will respond.
Chair
As I said earlier on, the Information Commissioner has been pretty clear that they have not received information directly from you. I think the best way of clearing this up would be if you would share the correspondence with the Information Commissioner with the Committee and then that will establish it once and for all.
Jeff Silvester
Yes, I will do that, but I think what is more appropriate is additionally I said we are meeting with a few of their folks right after the meeting with you here today. What I am seeking to do is establish better, more clear and direct communication with them so that they can get the information they need and we can provide that in the most efficient way.
Chair
That is all anyone has been asking for.
Jeff Silvester
That is all we want.
Brendan O'Hara
Many witnesses, including Chris Vickery and Christopher Wylie, have described how file systems can be created that have no real owners, not a single owner, they just exist in cyberspace. Or they have described where perhaps one owner or one entity may own a file system that many other parties can access via cloud or other networks. Is that a system that you recognise?
Jeff Silvester
Insofar as you can create a file system on a server on the internet and you could copy that server, that is accurate. Does that address your question?
Brendan O'Hara
As I say, what witnesses including Messrs Vickery and Wylie have been saying is that it can be convenient for a file system to be created of which there is either no single owner or there is one owner who then leaves or gives open access to others to access a file system. Is that a system that you recognise?
Jeff Silvester
There are systems like that that exist around the world. If you look at a webpage like Wikipedia, there is certainly an owner of that webpage but people can go on and register and make updates to Wikipedia, for example, and that updates their database with the record. With respect to the work that we do, the systems that we set up for our clients are just for that client. We do not share them with anyone else.
Brendan O'Hara
Have you ever or do you operate a system like that at any level at the moment?