A little-known Canadian data firm ensnared by an international investigation into alleged wrongdoing during the Brexit campaign created an election software platform marketed by Cambridge Analytica, according to a batch of internal files obtained exclusively by Gizmodo.
Discovered by a security researcher last week, the files confirm that AggregateIQ, a British Columbia-based data firm, developed the technology Cambridge Analytica sold to clients for millions of dollars during the 2016 US presidential election. Hundreds if not thousands of pages of code, as well as detailed notes signed by AggregateIQ staff, wholly substantiate recent reports that Cambridge Analytica's software platform was not its own creation.
What's more, the files reveal that AggregateIQ - also known as "AIQ" - is the developer behind campaign apps created for Texas Senator Ted Cruz and Texas Governor Greg Abbott, as well as a Ukrainian steel magnate named Serhiy Taruta, head the country's newly formed Osnova party.
Other records show the firm once pitched an app to Breitbart News, the far-right website funded by hedge-fund billionaire Robert Mercer - Cambridge Analytica's principal investor - and are currently contracted by WPA Intelligence, a US-based consultancy founded by Republican pollster Chris Wilson, who was director of digital strategy for Cruz's 2016 presidential campaign.
The files were unearthed last week by Chris Vickery, research director at UpGuard, a California-based cyber risk firm. On Sunday night, after Gizmodo reached out to Jeff Silvester, co-founder of AIQ, the files were quickly taken offline.
The files are likely to draw the interest of investigators on both sides of the Atlantic. Canadian and British regulators are currently pursuing leads to establish whether multiple "Leave" campaigns illegally coordinated during the 2016 EU referendum.
Ties between AIQ and Cambridge Analytica - the focus of recent widespread furor over the misuse of data pulled from 50 million Facebook accounts — has likewise drawn the interest of US and British authorities. Cambridge CEO Alexander Nix was suspended by his company last week after British reporters published covertly recorded footage showing Nix boasting about bribing and blackmailing political rivals.
Cambridge Analytica did not respond to a request for comment.
AIQ is bound by an non-disclosure agreement the company signed in 2014 to take on former client SCL Group, Cambridge Analytica's parent company, according to a source with direct knowledge of the contract.
In an interview over the weekend with London's The Observer, Christopher Wylie, the former Cambridge Analytica employee turned whistleblower, claimed that he helped establish AIQ years ago in an effort to help SCL Group expand its data operations. Silvester denied that Wylie was ever involved on that level, but admits that Wylie helped AIQ land its first big contract.
"We did some work with SCL and had a contract with them in 2014 for some custom software development," Silvester told Gizmodo. "We last worked with SCL in 2016 and have not worked with them since."
UpGuard first discovered code belonging to AIQ last Thursday on the web page of a developer named Ali Yassine who worked for SCL Group. Within the code — uploaded to the website GitHub in August 2016 — are notes that show SCL had requested that code be turned over by AIQ's lead developer, Koji Hamid Pourseyed.
AIQ's contract with SCL, a portion of which was published by The Guardian last year, stipulates that SCL is the sole owner of the intellectual property pertaining to the contract — namely, the development of Ripon, Cambridge Analytica's campaign platform.
The find led UpGuard to unearth a code repository on AIQ's website. Within it were countless files linking AIQ to the Ripon program, as well as notes for active projects for Cruz, Abbott, and the Ukrainian oligarch.
A mockup of a "meme generator" being developed by AIQ for Texas Gov. Greg Abbott's phone app.
In an internal wiki, AIQ developers also discussed a project known as The Database of Truth, a system that "integrates, obtains, and normalizes data from disparate sorces, including starting with the RNC Data Trust." (RNC Data Trust is the Republican party's primary voter file provider.) "The primary data source will be combined with state voter files, consumer data, third party data providers, historical WPA survey and projects and customer data."
The Database of Truth, according to the wiki, is a project under development for WPA Intelligence.
Wilson told Gizmodo on Monday that he has almost no knowledge of the controversy unfolding over AIQ's role in the UK. "I would never work with a firm that I felt had done something illegal or even unethical," he said. AIQ's work for WPA followed a competitive bid process, he said. "They offered us the best capabilities for the best price."
Until recently, Cambridge Analytica operated largely in the shadows. For years, it planned to target right-leaning voters for a host of high-profile political campaigns, working for both Cruz and President Donald Trump. With its billionaire backing, the firm promised to leverage oceans of data collected about voters - which we now know was acquired from sources both legal and unauthorised.
Known as Project Ripon, Cambridge Analytica's goal was to furnish Republican candidates with a technology platform capable of reaching voters through the use of psychological profiling. (SCL Group has long used behavioural research to conduct "influence operations" on behalf of military and political clients worldwide.)
Cambridge Analytica, which eventually chose AIQ to help build its platform, once boasted that it possessed files on as many as 230 million Americans compiled from thousands of data points, including psychological data harvested from social media, as well as commercial data available to virtually anyone who can afford it. The company intended to classify voters by select personality types, applying its system to craft messages, online ads, and mailers that, it believed, would resonate distinctively with voters of each group.
Sources within the Cruz campaign, which largely funded Ripon's development, claim the software never actually functioned. One former staffer told Gizmodo the product was nothing but "vaporware."
AIQ's internal files show the company had unlimited access to the Ripon code, and a source within the Cruz campaign confirmed to Gizmodo that AIQ was solely responsible for the software's development.
The campaign eventually dumped more than $US5 ($6).8 ($8) million into Ripon's development — which is only about half the amount Robert Mercer, Cambridge Analytica's principal investor, poured into Cruz's White House bid. (After Trump took the nomination, Mercer contributed more than $US15.5 ($20) million to his campaign, $US5 ($6) million of which ended up back in Cambridge Analytica's pockets.)
A former Cruz aide, who requested anonymity to discuss their work for the campaign, told Gizmodo that even at the highest levels, no one knew that Cambridge Analytica had outsourced Ripon's development. "Ultimately, I found out through some emails that they're not even doing this work," the source said. "It was being outsourced to AIQ."
According to the aide, when Cruz's staff began to question AIQ over whether it was behind Ripon's development, AIQ confirmed that it was, but said it was never supposed to discuss its work.
In 2016, Mercer reportedly offered up Cambridge Analytica's services for free to Leave.EU, one of several group urging the UK to depart the European Union, according to The Guardian. Leave.EU was not, however, the official "Leave" group representing the Brexit campaign. Instead, a seperate group, known as Vote Leave, was formally chosen by election officials to lead the referendum.
Whereas Leave.EU relied on Cambridge to influence voters through its use of data analytics, Vote Leave turned to AIQ, eventually paying the firm roughly 40 per cent of its £7 million campaign budget, according to The Guardian. Over time, however, Vote Leave amassed more cash than it was legally allowed to spend. While UK election laws permitted Vote Leave to gift its remaining funds to other campaigns, further coordination between them was expressly forbidden.
Roughly a week before the EU referendum, Vote Leave inexplicably donated £625,000 to a young fashion design student named Darren Grimes, the founder of a small, unofficial Brexit campaign called BeLeave. According to a BuzzFeed investigation, Grimes immediately gave a "substantial amount" of the cash he received from Vote Leave to AIQ. Vote Leave also donated £100,000 to another Leave campaign called Veterans for Britain, which, according to The Guardian, then paid AIQ precisely that amount.
A review of the AIQ files by UpGuard's Chris Vickery revealed several mentions of Vote Leave and at least one mention of Veterans for Britain, apparently related to website development.
In an interview on Monday, Shahmir Sanni, a former volunteer for Vote Leave campaign, told The Globe and Mail that he had "first-hand knowledge about the alleged wrongdoing in the Brexit campaign." Sanni, who was 22 when he worked for Vote Leave, said he was "encouraged to spin out" another campaign, but that he had "no control" over the £625,000 that was immediately spent on AIQ's services.
British authorities are pursuing leads to establish whether BeLeave and Veterans for Britain were merely a conduit through which Vote Leave sought to direct additional funds to AIQ. While the UK Electoral Commission took no action in early 2017, in November it claimed that "new information" had "come to light," giving the commission "reasonable grounds to suspect an offence may have been committed."
In an email, the UK Election Commission told Gizmodo its investigation into Vote Leave payments was ongoing.
"All of the direction for BeLeave came from BeLeave and all of the direction for Vote Leave came from Vote Leave," AIQ's co-founder told Gizmodo.
Silvester added: "AggregateIQ works in full compliance within all legal and regulatory requirements in all jurisdictions where it operates. It has never knowingly been involved in any illegal activity. All work AggregateIQ does for each client is kept separate from every other client."