CBI registers case against Cambridge Analytica for Facebook data theft

Facebook had collected certificates from both the firms in 2016-17 that data collected by them using "thisisyourdigitallife" was accounted for and destroyed

The CBI has registered a case against controversial UK-based entities Cambridge Analytica (CA) and Global Science Research Ltd (GSRL) for illegally harvesting data from around 5.62 lakh Facebook accounts for commercial purposes after a 29-month-long preliminary enquiry.

The premier investigating agency filed the FIR on January 19 charging GSRL of "dishonestly and fraudulently" accessing the data of the users of one of its App and their Facebook friends and entering into a conspiracy in 2014 to give CA the right to use the "illegally harvested datasets" for "commercial gains".

Both the companies have been booked under Section 120B (criminal conspiracy) of the Indian Penal Code and Sections 66B (dishonestly receiving stolen computer resource or communication device), 85 (which makes in-charge of the erring company responsible for contraventions) and 43A (negligence of corporate in dealing with sensitive personal data) of the Information Technology Act.

In mid-2018, CA was earlier in the eye of a storm as it faced allegations that it used personal information harvested from 87 million Facebook accounts to help Donald Trump win the 2016 United States Presidential Election. Following this, it also emerged that data of Indians were also illegally harvested, prompting a war of words between the ruling BJP and the Opposition led by Congress.

The CBI had launched a preliminary enquiry after Rakesh Maheswari, Group Coordinator (Cyber Law and e-Security) in Ministry of Electronics and Information Technology (MeitY), wrote the CBI seeking an investigation on the basis of a legal opinion received from Additional Solicitor General Vikramjit Banerjee.

According to the FIR, GSRL founder Dr Aleksandr Kogan had created an App 'thisisyourdigitallife', which was authorised by Facebook to collect "certain specific data" of users for academic and research purposes.

However, GSRL allegedly illegally harvested "additional unauthorised data", including demographic information, pages liked on Facebook and content of private messages among others, of the App users as well as their Facebook friends.

Facebook told the MietY that 335 people had installed the App in India and they had estimated that data of around 5.62 lakh additional users who were part of their friends' network has also been "unauthorisedly" harvested.

The CBI claimed that it has confirmed that the GSRL illegally harvested the data as Facebook had collected "written certificates" from Kogan during 2016-17 declaring that all such data collected through the App was "accounted for and destroyed".

"However, (the CBI) enquiry could not authenticate the veracity of the claims of GSRL and CA that they had destroyed the said databases," the FIR said.

In his letter to the CBI on 25 July 2018, Maheshwari had said that the CA told the MeitY that they received data only for American citizens and they do not have "any Facebook data" on Indians, "though they have worked on a range of products in India for the past 10 years".

While Facebook had responded to MeitY's letters later, he said CA did not respond to its subsequent correspondence in 2018. The MeitY was of the view that CA's response in the initial letter in which it claimed that it did not have any data of Indian citizens as "incomplete and evasive".

"With rapid digitisation, ensuring the protection of data of Indian citizens, including data available on social media platforms and taking action against the unlawful use of such data have become a priority," Maheshwari wrote urging the CBI to register a case.