Elections are opportunities for voters to exercise their choice through a secret ballot for governance at local, provincial, or national levels. Candidates and political parties try to influence that choice through campaigns trying to get inside voters’ minds and hearts. Elections authorities work to ensure that campaign activities are properly regulated. Yet, advances in mass media and social media are making election campaigns more complex and their regulation, much harder. As I argued in the last two columns, regulating just the explicit campaign messages in television, radio, newspapers, and social media is no longer sufficient. A bigger concern is the subtle and manipulative political messaging enabled by microtargeting of individual users of internet services – mainly social media. Such messaging relies on gathering voters’ demographic, psychographic, geographic, and behavioural data – through social media and various apps that automatically track it. Analytical tools allow personalised profiles to be created using factors such as consumer choices, social interests, and political opinions. In the digital age, this is being widely used for marketing products and services. For marketers, demographics explain “who” a buyer is while psychographics explain “why” s/he buys something – and thus, how a product should be promoted. Such “microtargeting” has been used in some election campaigns in the US from around 2000, but the data tools are getting better (read: manipulation is deeper), and their use is spreading globally. Cambridge Analytica It hit global headlines in March 2018 when key news organisations like The New York Times and the UK’s The Observer broke the story about activities of a voter profiling company named Cambridge Analytica (CA). CA was a British political consulting firm, set up in 2013 as an offshoot of the SCL Group, which combined data mining, data brokerage, and data analysis with strategic (i.e. purposeful or well-targeted) communications during elections. With help from a whistleblower, an ex-CA employee named Christopher Wylie, the media revealed how CA had acquired and used personal data about millions of Facebook’s American users for delivering psychographically targeted political messages for Donald Trump’s 2016 presidential campaign. How did CA get hold of such a massive dataset? It was through a personality-quiz app for Facebook called “thisisyourdigitallife”, developed in 2014 by Aleksander Kogan, a psychologist and data scientist who worked as a research associate at the University of Cambridge. About 270,000 people had installed this app on their Facebook accounts. Facebook’s data access rules at the time allowed Kogan’s app to gather personal data not only about users of his app, but also of all their Facebook “friends” too. Kogan’s app stored it in a private database, which was later provided (sold?) to CA where they subsequently made “psychographic” profiles of voters. CA originally claimed they had personal data of 30 million Facebook users, but The Observer and The New York Times said the dataset had information on at least 50 million users. Facebook later confirmed that CA actually had amassed data on up to 87 million users; 70.6 million of them from the US. Data-driven psychographic tools were used in consequential elections. These included microtargeting online ads for the Brexit “Leave” campaign, that eventually won the UK referendum held on 23 June 2016 in which 51.9% of those voting supported leaving the EU, and the 2016 Trump campaign. Fallout for Facebook CA’s illegal harvesting of personal data was first reported in December 2015 by Harry Davies, a journalist for The Guardian, yet Facebook declined to comment except to say it would investigate. Other occasional media discussions were similarly ignored. When the scandal finally erupted in March 2018 through multiple media exposés, it proved highly damaging for Facebook. The world’s largest social networking company lost over $ 100 billion of its market capitalisation, and the reputational damage was immeasurable. Politicians in the US, UK, and elsewhere demanded answers from Facebook CEO Mark Zuckerberg, who later testified in front of the US Congress. During his testimony, Zuckerberg apologised for the breach of private data. “It was my mistake, and I’m sorry. I started Facebook, I run it, and I’m responsible for what happens here.” The CA scandal can be seen as a watershed moment in the public understanding of personal data and its many misuses. Even before this scandal, regulators had started investigating and asking difficult questions. In May 2017, the UK Information Commissioner’s Office (ICO) – an independent body set up to uphold information rights – launched an investigation into the use of data analytics for political purposes. It involved 30 organisations and hundreds of individuals, from political parties, data brokers, journalists, whistleblowers, and others. The probe found “a significant shortfall in transparency” in how political parties and campaigning companies processed and used personal data. ICO recommendations ICO’s November 2018 report, titled “Investigation into the use of data analytics in political campaigns: A report to Parliament”, recommended that the UK Government should introduce a statutory code of practice for the use of personal data in political campaigns. ICO also urged all UK universities to consider the risks arising from use of personal data by academics. (Full report at: http://bit.ly/ICONov18.) The report also outlined regulatory action ICO had already taken based on its findings. These included imposing the maximum monetary penalty of £ 500,000 allowed under the prevailing laws, warning letters sent to 11 main political parties, and criminal prosecution of CA (which ceased operations in 2018). Elizabeth Denham, the Information Commissioner, wrote in the ICO website on 6 November 2018 that she and her staff had “little idea of what was to come” when they embarked on the probe. “Eighteen months later, multiple jurisdictions are struggling to retain fundamental democratic principles in the face of opaque digital technologies,” she said. “Throughout our enquiries, we found a disturbing disregard for voters’ personal privacy by players across the political campaigning ecosystem – from data companies and data brokers to social media platforms, campaign groups, and political parties.” The various journalistic investigations and governmental probes during 2017-18 have been an eye-opener on invisible manipulations during election campaigns on both sides of the Atlantic. As Denham noted: “Parliamentarians, journalists, civil society, and citizens have woken up to the fact that transparency is the cornerstone of democracy. Citizens can only make truly informed choices about who to vote for if they are sure that those decisions have not been unduly influenced.” The Commissioner said the ICO is “working with the (UK) Electoral Commission, law enforcement, and other regulators in the UK to increase transparency in election campaign techniques.” She also noted that this is a global issue, which requires global solutions. “Our work has helped inform the EU’s initiatives to combat electoral interference. A Canadian Parliamentary Committee has recommended extending privacy law to political parties and the US is considering introducing its first comprehensive data protection law.” Democracy disrupted? In a related policy analysis issued in July 2018, the Information Commissioner also called for an “ethical pause” to allow the key players – Government, Parliament, regulators, political parties, online platforms, and citizens – “to reflect on their responsibilities in the use of personal data in the era of big data, before there is a greater expansion in the use of new technologies”. That report, titled “Democracy disrupted? Personal information and political influence” is available at: http://bit.ly/DemoDis. One of its recommendations (for the UK Government, but relevant to democracies worldwide) is to conduct a review of the regulatory gaps in relation to content and provenance and jurisdictional scope of political advertising online. ICO says: “This should include consideration of requirements for digital political advertising to be archived in an open data repository to enable scrutiny and analysis of the data.” Public trust is the cornerstone of elections, and its erosion threatens electoral integrity. While seeking to ensure a level playing field for all election candidates and their adherence to prevailing laws and regulations, the Election Commission of Sri Lanka (ECSL) needs to address these new concerns. With Sri Lankan political parties and their proxies deploying social media, apps, and other digital tools for campaigning at key upcoming elections, there is plenty of room for sophisticated manipulation of voters’ minds. (Science writer Nalaka Gunawardene has been chronicling and critiquing information society for over 25 years. He tweets from @NalakaG)