Tag: Conservative Campaigner

Posted on

Campaign tool supplied to UK’s governing party by Trump-Pence app dev quietly taken out of service

An app that the UK’s governing party launched last year — for Conservative Party activists to gamify, ‘socialize’ and co-ordinate their campaigning activity — has been quietly pulled from app stores.

Its vanishing was flagged to us earlier today, by Twitter user Sarah Parks, who noticed that, when loaded, the Campaigner app now displays a message informing users the supplier is “no longer supporting clients based in Europe”.

“So we’re taking this opportunity to refresh our campaigning app,” it adds. “We will be back with a new and improved app early next year – well in time for the local elections.”

(Bad luck, then, should there end up being another very snap, Brexit-induced UK General Election in the meanwhile, as some have suggested may yet come to pass. But I digress… )

The supplier of the Conservative Campaigner app is — or was — a US-based add developer called uCampaign, which had also built branded apps for Trump-Pence 2016; the Republican National Committee; and the UK’s Vote Leave Brexit campaign, to name a few of the political campaigns it has counted as customers.

Here’s a few more: The (pro-gun) National Rife Association and the (anti-abortion) SBA List.

We know the name of the Conservative Campaigner app’s supplier because this summer we raised privacy concerns about the app — on account of its use of uCampaign’s boilerplate privacy policy, if you clicked to read the app’s privacy policy earlier this year.

The wording of uCampaign’s privacy policy suggested the Conservative Campaigner app could be harvesting users’ mobile phone contacts — if they chose to sync their contacts book with it.

The privacy policy for the app was subsequently changed to point to the Conservative Party’s own privacy policy — with the change of privacy policy taking place just before a tough new EU-wide data protection framework, GDPR, came into force on May 25 this year.

Prior to May 23, the privacy policy of the Conservatives’ digital campaigning app suggests it was harvesting contacts data from users — and potentially sharing non-users’ personal information with entities of uCampaign’s choosing (given, for example, the company’s privacy policy gave itself the right to “share your Personal Information with other organizations, groups, causes, campaigns, political organizations, and our clients that we believe have similar viewpoints, principles or objectives as us”).

This sort of consentless scraping of large amounts of networked personal data — by sucking up information on users’ friend groups and other personal connections — has of course had a massive spotlight thrown on it this year, as a result of the Facebook Cambridge Analytica data misuse scandal in which the personal data of tens of millions of Facebook users was extracted from the social network via a quiz app that used a (now defunct) Facebook friends API to grab data on non-users who would not have even had the chance to agree to the app’s terms.

Safe to say, this modus operandi wasn’t cool then — and it’s certainly not cool now.

Politicians all over the globe have been shaken awake by the Cambridge Analytica scandal, and are now raising all sorts of concerns about how data and digital tools are being used (and or misused and abused).

The EU parliament recently called for an independent audit of Facebook, for example.

In the UK, a committee that’s been probing the impact of social media-accelerated disinformation on democratic processes published a report this summer calling for a levy on social media to defend democracy. Its lengthy preliminary report also suggested urgent amendments to domestic electoral law to reflect the use of digital technologies for political campaigning.

Though the UK’s Conservative minority government — and the party behind the now on-pause Conservative Campaigner app — apparently disagrees on the need for speed, declining in its response last week to accept most of the committee’s laundry list of recommended changes.

The DCMS committee’s inquiry into political campaigns’ use (and misuse) of personal data continues — now at a transnational level.

An ethical pause?

Shortly after we published our privacy concerns about the Conservative Campaigner app, the UK’s data protection watchdog issued its own a lengthy report detailing extensive concerns about how UK political parties were misusing personal data — and calling for an ethical pause on the use of microtargeting for election campaigning purposes.

Which does rather beg the question whether the Conservative Campaigner app going AWOL now, until a reboot under a new supplier (presumably) next year, might not represent just such an ‘ethical pause’.

The app is, after all, only just over a year old.

We asked the Conservative Party a number of questions about the Campaigner app via email — after a press office spokeswoman declined to discuss the matter on the telephone.

Five hours later it emailed the following brief statement, attributed to a Conservative spokesperson:

We work with a number of different suppliers and all Conservative party campaigning is compliant with the relevant data protection legislation including GDPR.

The spokesperson did not engage with the substance of the vast majority of our concerns — such as those relating to the app’s handling of people’s data and the legal bases for any transfers of UK voter data to the US.

Instead the spokesperson reiterated the in-app notification which claims “the supplier” is no longer supporting clients based in Europe.

They also said the party is currently reviewing its campaigning tools, without providing any further detail.

We’ve included our full list of questions at the bottom of this post.

We’ve also reached out to the ICO to ask if it had any concerns related to how the Conservative Campaigner app was handling people’s data.

Similarly, the former deputy director & head of digital strategy for the Conservative party, Anthony Hind, declined to engage with the same data protection concerns when we raised them with him directly, back in July.

According to his LinkedIn profile he’s since moved on from the Conservatives to head up social media for the Confederation of British Industry.

For this report we also reached out to uCampaign’s founder and CEO, Thomas Peters, to ask for confirmation on the company’s situation vis-a-vis European clients.

At the time of writing Peters had not responded to our emails. We’ll update this story with any uCampaign response.

The company’s website still includes the UK Conservative Party listed as a client — though the language used on the webpage does not make it explicit whether or not the party is a current client…

Another graphic on the same page plots the UK flag on a world map depicting what uCampaign dubs its “global platform”, where it’s marked along with several other European flags — including Ireland, France, Germany and Malta, suggesting uCampaign has — or had — multiple European clients.

Here’s the full list of questions we put to the Conservatives about their campaigner app. To our eye it has answered just one of them:

Can you confirm — on the record — the reasons for the app being pulled?

Does the Conservative Party intend to continue working with uCampaign for the new campaign app that will relaunch next year? Or does the party have a new supplier?

If the latter, where is the new supplier based? In the UK or in the US?

Did the Conservative Party have any concerns at all related to using uCampaigner as a supplier? (Given, for example, concerns flagged about its data privacy practices by one of the DCMS committee’s recent reports — following an inquiry investigating digital campaigning.)

If the Conservative Party was aware of data privacy concerns pertaining to uCampaign’s practices can you confirm when the party became aware of such concerns?

Was the party aware that the privacy policy it used for the app prior to May 23, 2018 was uCampaign’s own privacy policy?

This privacy policy stated that the app could harvest data from users’ mobile phone contacts and share that data with unknown third parties of the developer’s choosing — including other political campaigns. Is the Conservative Party comfortable with having its supporters’ data shared with other political campaigns?

What due diligence did the Conservative Party carry out before it selected uCampaign as its app supplier?

After signing up the supplier, did the Conservative Party carry out a privacy impact assessment related to how the app operates?

Please confirm all the data points that the app was collecting from users, and what each of those data points was being used for

Where was app user data being processed? In the US, where uCampaign is based, or in the UK where potential voters live?

If the US, what was the legal basis for any transfer of data from UK users to the US?

Is the Conservative Party confident its use of the campaigner app did not breach UK data protection law?

Earlier this year the former Cabinet Minister Dominic Grieve suggested that the bosses of tech giants involved in the Cambridge Analytica data misuse scandal should be jailed for their part in abusing online data for political and financial gain. Does the Conservative Party support Grieve’s position on online data abuse?

Has anyone been sacked or sanctioned for their part in procuring uCampaign as the app supplier — and/or overseeing the operation of the Conservative Campaigner app itself?

Will the Conservative Party commit to notifying all individuals whose data was shared with uCampaign without their explicit consent?

Can the Conservative Party confirm how many individuals had their personal data shared with uCampaign?

Has the Information Commissioner’s Office raised any concerns with the Conservative Party about the Campaigner app?

Has the Conservative Party itself reported any concerns about the app/uCampaign to the ICO?

Posted on

One more thing re: “privacy concerns” raised by the DCMS fake new report…

A meaty first report by the UK parliamentary committee that’s been running an inquiry into online disinformation since fall 2017, including scrutinizing how people’s personal information was harvested from social media services like Facebook and used for voter profiling and the targeting of campaign ads — and whose chair, Damian Collins — is a member of the UK’s governing Conservative Party, contains one curious omission.

Among the many issues the report raises are privacy concerns related to a campaign app developed by a company called uCampaign — which, much like the scandal-hit (and now seemingly defunct) Cambridge Analytica, worked for both the Ted Cruz for President and the Donald J Trump for President campaigns — although in its case it developed apps for campaigns to distribute to supporters to gamify digital campaigning via a tool which makes it easy for them to ‘socialize’ (i.e. share with contacts) campaign messaging and materials.

The committee makes a passing reference to uCampaign in a section of its report which deals with “data targeting” and the Cambridge Analytica Facebook scandal, specifically — where it writes [emphasis ours]:

There have been data privacy concerns raised about another campaign tool used, but not developed, by AIQ [Aggregate IQ: Aka, a Canadian data firm which worked for Cambridge Analytica and which remains under investigation by privacy watchdogs in the UK, Canada and British Columbia]. A company called uCampaign has a mobile App that employs gamification strategy to political campaigns. Users can win points for campaign activity, like sending text messages and emails to their contacts and friends. The App was used in Donald Trump’s presidential campaign, and by Vote Leave during the Brexit Referendum.

The developer of the uCampaign app, Vladyslav Seryakov, is an Eastern Ukrainian military veteran who trained in computer programming at two elite Soviet universities in the late 1980s. The main investor in uCampaign is the American hedge fund magnate Sean Fieler, who is a close associate of the billionaire backer of SCL and Cambridge Analytica, Robert Mercer. An article published by Business Insider on 7 November 2016 states: “If users download the App and agree to share their address books, including phone numbers and emails, the App then shoots the data [to] a third-party vendor, which looks for matches to existing voter file information that could give clues as to what may motivate that specific voter. Thomas Peters, whose company uCampaign created Trump’s app, said the App is “going absolutely granular”, and will—with permission—send different A/B tested messages to users’ contacts based on existing information.”

What’s curious is that Collins’ Conservative Party also has a campaign app built by — you guessed it! — uCampaign, which the party launched in September 2017.

While there is nothing on the iOS and Android app store listings for the Conservative Campaigner app to identify uCampaign as its developer, if you go directly to uCampaign’s website the company lists the UK Conservative Party as one of it’s clients — alongside other rightwing political parties and organizations such as the (pro-gun) National Rife Association; the (anti-abortion) SBA List; and indeed the UK’s Vote Leave (Brexit) campaign, (the latter) as the DCMS report highlights.

uCampaign’s involvement as the developer of the Conservative Campaigner app was also confirmed to us (in June) by the (now former) deputy director & head of digital strategy for The Conservative Party, Anthony Hind, who — according to his LinkedIn profile — also headed up the party’s online marketing, between mid 2015 and, well, the middle of this month.

But while, in his initial response to us, Hind readily confirmed he was personally involved in the procurement of uCampaign as the developer of the Conservative Campaigner app, he failed to respond to any of our subsequent questions — including when we raised specific concerns about the privacy policy that the app had been using, prior to May 23 (just before the EU’s new GDPR data protection framework came into force on May 25 — a time when many apps updated their privacy polices as a compliance precaution related to the new data protection standard).

Since May 23 the privacy policy for the Conservative Campaigner app has pointed to the Conservative Party’s own privacy policy. However prior to May 23 the privacy policy was a literal (branded) copy-paste of uCampaign’s own privacy policy. (We know because we were tipped to it by a source — and verified this for ourselves.)

Here’s a screengrab of the exchange we had with Hind over LinkedIn — including his sole reply:

What looks rather awkward for the Conservative Party — and indeed for Collins, as DCMS committee chair, given the valid “privacy concerns” his report has raised around the use (and misuse/abuse) of data for political targeting — is that uCampaign’s privacy policy has, shall we say, a verrrrry ‘liberal’ attitude to sharing the personal data of app users (and indeed of any of their contacts it would have been able to harvest from their devices).

Here’s a taster of the data-sharing permissions this U.S. company affords itself over its clients’ users’ data [emphasis ours] — according to its own privacy policy:

CAMPAIGNS YOU SUPPORT AND ALIGNED ORGANIZATIONS

We will share your Personal Information with third party campaigns selected by you via the Platform. In addition, we may share your Personal Information with other organizations, groups, causes, campaigns, political organizations, and our clients that we believe have similar viewpoints, principles or objectives as us.

UCAMPAIGN FRIENDS

We may share your Personal Information with other users of the Platform, for example if they connect their address book to our services, or if they invite you to use our services via the Platform.

BUSINESS TRANSFERS

We may share your Personal Information with other entities affiliated with us for internal reasons, primarily for business and operational purposes. uCampaign, or any of its assets, including the Platform, may be sold, or other transactions may occur in which your Personal Information is one of the business assets of the transaction. In such case, your Personal Information may be transferred.

To spell it out, the Conservative Party paid for a campaign app that could, according to the privacy policy it had in place prior to May 23, have shared supporters’ personal data with organizations that uCampaign’s owners — who the DCMS committee states have close links to “the billionaire backer of SCL and Cambridge Analytica, Robert Mercer” — view as ideologically affiliated with their objectives, whatsoever those entities might be.

Funnily enough, the Conservative Party appears to have tried to scrub out some of its own public links to uCampaign — such as changing link for the developer website on the app listing page for the Conservative Campaigner app to the Conservative Party’s own website (whereas before it linked through to uCampaign’s own website).

As the veteran UK satirical magazine Private Eye might well say — just fancy that! 

One of the listed “features” of the Conservative Campaigner app urges Tory supporters to: “Invite your friends to join you on the app!”. If any did, their friends’ data would have been sucked up by uCampaign too to further causes of its choosing.

The version of the Campaigner app listed on Google Play is reported to have 1,000+ installs (iOS does not offer any download ranges for apps) — which, while not in itself a very large number, could represent exponentially larger amounts of personal data should users’ contacts have been synced with the app where they would have been harvested by uCampaign.

We did flag the link between uCampaign and the Conservative Campaigner app directly to the DCMS committee’s press office — ahead of the publication of its report, on June 12, when we wrote:

The matter of concern here is that the Conservative party could itself be an unwitting a source of targeting data for rival political organizations, via an app that appears to offer almost no limits on what can be done with personal data.
Prior to the last update of the Conservative Campaigner app the privacy policy was simply the boilerplate uCampaign T&Cs — which allow the developer to share app users personal info (and phone book contacts) with “other organizations, groups, causes, campaigns, political organizations, and our clients that we believe have similar viewpoints, principles or objectives as us”.
That’s incredibly wide-ranging.
So every user’s phone book contacts (potentially hundreds of individuals per user) could have been passed to multiple unidentified organizations without people’s knowledge or consent. (Other uCampaign apps have been built for the NRA, and for anti-abortion organizations, for example.)
uCampaign‘s T&Cs are here: https://ucampaignapp.com/privacy.html
Even the current T&Cs allow for sharing with US suppliers.
Given the committee’s very public concerns about access to people’s data for political targeting purposes I am keen to know whether Mr Collins has any concerns about the use of uCampaign‘s app infrastructure by the Conservative party?
And also whether he is concerned about the lack of a robust data protection policy by his own party to ensure that valuable membership data is not simply passed around to unknown and unconnected entities — perhaps abroad, perhaps not — with zero regard for or accountability to the individuals in question.

Unfortunately this email (and a follow up) to the DCMS committee, asking for a response from Collins to our privacy concerns, went unanswered.

It’s also worth noting that the Conservative Party’s own privacy policy (which it’s now using for its Campaigner app) is pretty generous vis-a-vis the permissions it’s granting itself over sharing supporters’ data — including stating that it shares data with: 

  • The wider Conservative Party
  • Business associates and professional advisers
  • Suppliers
  • Service providers
  • Financial organisations – such as credit card payment providers
  • Political organisations
  • Elected representatives
  • Regulatory bodies
  • Market researchers
  • Healthcare and welfare organisations
  • Law enforcement agencies

The UK’s data watchdog recently found fault with pretty much all of the UK political parties’ when it comes to handling of voter data — saying it had sent warning letters to 11 political parties and also issued notices compelling them to agree to audits of their data protection practices.

Safe to say, it’s not just private companies that have been sticking their hand in the personal data cookie jar in recent years — the political establishment is facing plenty of awkward questions as regulators unpick where and how data has been flowing.

This is also not the only awkward story re: data privacy concerns related to a Tory political app. Earlier this year the then-minister in charge of the digital brief, Matt Hancock, launched a self-promotional, self-branded app intended for his constituents to keep up with news about Matt Hancock MP.

However the developers of the app (Disciple Media) initially uploaded the wrong privacy policy — and were forced to issue an amended version which did not grant the minister such non-specific and oddly toned rights to users’ data — such as that the app “may disclose your personal information to the Publisher, the Publisher’s management company, agent, rights image company, the Publisher’s record label or publisher (as applicable) and any other third parties, for use in conjunction with additional user promotions or offers they may run from time to time or in relation to the sale of other goods and services”.

Of course the Matt Hancock App was a PR initiative of (and funded by) an individual Conservative MP — rather than a formal campaign tool paid for by the Conservative Party and intended for use by hundreds (or even thousands) of Party activists for use during election campaigns.

So while there are two issues of Tory-related privacy concern here, only one loops back to the Conservative Party political organization itself.