Victoria-based AggregateIQ Had Access to Personal Information on Tens of Thousands of BC Voters

A Victoria company central to an international controversy about using people's private information to manipulate them for political purposes had access to the British Columbia Green Party's voter database in 2016.

The party is preparing to notify tens of thousands of people in B.C. that AggregateIQ had access to their personal information while the company worked for the BC Greens for about eight months ahead of the 2017 election, said Stefan Jonsson, the director of communications for the party.

"At the time, they were just a company our campaign director had introduced us to," Jonsson said. "It's now that we know they've been involved in all sorts of other things that red flags started to be raised."

Former BC Green campaign director Brian Rice brought AggregateIQ in to build a website and create new customer relations management software for the party, Jonsson said. Rice had previously been the president of the federal Liberal Party in B.C.

At the time, Ray Larson, another former Liberal who had worked in London for SCL Group, a company closely connected to AggregateIQ, was also involved in the BC Green Party.

Jonsson said he believed both Rice and Larson had left the Liberals due to disappointment with then premier Christy Clark and seemed to be sincere about wanting to get Greens elected.

Neither now works for the party and knowledge about what AggregateIQ had done was lost in the transition, he said. "There were holes in our knowledge of the details of that project because there were changes in staff."

There were "yellow flags" raised a year ago over AggregateIQ's involvement in Brexit, but it was after media reports in the last couple weeks about allegations from whistleblower Christopher Wylie that the Greens took another look at what the company had done for them, Jonsson said.

"Their possible illegal activity, whether they knew it or not, and their connection with other organizations like Cambridge Analytica and SCL that have been accused of breaching other regulations, the red flags went up for us and we needed to go back and review our relationship with them and ensure that information that they had access to was respected like it should be," Jonsson said.

"What we realized, when we started looking back into what our [non-disclosure agreement with AggregateIQ] said, what they were working on, is that they did have access to our database of personal information, and confidential information," he said. "We didn't fully know that until we started to look back."

Political parties in B.C. have access to the province's voters list, which includes the personal information of millions of British Columbians, including whether or not they voted in the last election.

While the database would include people from all over the province, Jonsson said the bulk of what the Greens retained was from four constituencies on Vancouver Island that the party viewed as winnable in 2013: Oak Bay-Gordon Head, Saanich North and the Islands, Esquimalt-Royal Roads and Victoria-Beacon Hill.

Jonsson said the Greens wanted to make sure AggregateIQ had deleted the data it got from the party and that it had never been misused. "They've written back to us with confirmation that that's the case," he said. "We feel as good as we can given that that's their word."

While the party believes nothing inappropriate happened with the data, he added, "It is the association that's the problem, noting the association ended in August 2016."

Neither AggregateIQ's CEO Zack Massingham nor chief operating officer Jeff Silvester responded to interview requests Wednesday.

In testimony to a British parliament committee on Tuesday, Wylie testified about illegal and unethical activity he alleged AggregateIQ, or AIQ, had been involved in during elections in several countries.

He talked about the company's work in Nigeria in 2015. "The videos that AIQ distributed in Nigeria with the sole intent of intimidating voters included content where people were being dismembered, where people were having their throats cut and bled to death in a ditch," he said. "They were being burned alive. There was incredibly anti-Islamic and threatening messages portraying Muslims as violent."

In Trinidad, the company gained access to raw Internet data for the entire country, something Wylie said he believes is illegal in both Trinidad and the U.K.

"This is a company that has worked with hacked material," he said. "This is a company that will send out videos of people being murdered to intimidate voters. This is a company that goes out and tries to illicitly acquire live Internet browsing data of everyone in an entire country."

AggregateIQ had inherited a "disregard for the law" from SCL Group, he said.

In a March 24 statement posted on its website, AggregateIQ denied any wrongdoing. "AggregateIQ works in full compliance within all legal and regulatory requirements in all jurisdictions where it operates," it said. "It has never knowingly been involved in any illegal activity. All work AggregateIQ does for each client is kept separate from every other client."

Wylie, who grew up in Victoria and who has known Silvester for at least a decade, said in his testimony that he was involved in setting up AggregateIQ as a Canadian "franchise" for SCL Group.

"When you work in a lot of countries, sometimes it's beneficial to have different billing names on invoices," he said, adding it could help with election spending disclosures. "Particularly if you're trying to get around coordination rules like in the United States... The paperwork looks compliant even if the project isn't."

SCL Group describes itself on its website as "the global leader in data-driven communications." The private firm specializes in data mining and data analysis, using the results to target key audiences in hopes of modifying their behaviours. According to its website it has done work for governments and military organizations around the world and has worked to influence elections in 19 countries, including Italy, India, South Africa, Colombia, Indonesia, Thailand and the United Kingdom.

Noting that what's been in the media are allegations and not proven, BC Green spokesman Jonsson said, "I'm horrified by everything I'm hearing about the work they've done."

He said that while AggregateIQ completed the website for the Greens, its work on customer relations management software for the party was too slow to be ready in time to use for the 2017 election, so the Greens ended the relationship and went back to using the system they'd used previously.

"We really want to know how to improve our management of personal information," he said. "What we're learning is there are risks the current laws and regulations do not cover and we want to be proactive in keeping up with the technology and the use of technology in the modern world."

The project with AggregateIQ never had anything to do with compiling data sets for the Greens, nor did it deliver any digital advertising for the party, he said. "They had talked about the fact they could provide that for us and we never pursued that."

The Greens have done what they could to ensure there wasn't a breach and is going further than required to let people know about the work AggregateIQ did for the party, Jonsson said. "We want people to trust us with the information they give us ... We want to demonstrate we really do take this seriously and we want to be constantly improving our practices around this."

Jonsson said he's looking forward to the Information and Privacy Commissioner's coming recommendations on how parties should manage personal information, but said he expects regulations will always be a step behind the technology.

"Tracking the details of where personal information is and where it has gone is a problem for all political parties," he said.

The Greens are in the middle of hiring someone whose job will include oversight of personal privacy and keeping careful records of who has access to information in the party's database, he said, adding the party couldn't afford to employ someone in such a position until recently.

There are lots of regulations on parties, and more are needed to close the existing gaps, he said.