[Breaches](/breaches) Digital Gangsters, Disinformation and Dark Adverts: The UK Parliament DCMS Report [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Digital Gangsters, Disinformation and Dark Adverts: The UK Parliament DCMS Report ##### [UpGuard Team](/team/upguard) Published Feb 18, 2019 ##### Join 27,000+ cybersecurity newsletter subscribers On February 18th 2019, the [UK Parliament’s DCMS (Digital, Culture, Media and Sport) Committee published the final report](https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/1791/179102.htm) detailing their 18 month investigation into the emerging field of online disinformation as well as the privacy practices of platforms such as Facebook. The report pulls no punches. The quote from Damian Collins, committee chairman, sums it up: “Democracy is at risk from the malicious and relentless targeting of citizens with disinformation and personalised ‘dark adverts’ from unidentifiable sources, delivered through the major social media platforms we use every day.” UpGuard’s head of [Cyber Risk](/blog/cybersecurity-risk) Research, Chris Vickery, has been a key witness to the investigation since his original discovery of the AggregateIQ files in March 2018. [Chapter 4 of the published report](https://publications.parliament.uk/pa/cm201719/cmselect/cmcumeds/1791/179107.htm) explores the AggregateIQ breach discovered by Chris, focusing on: * Relationships between key entities (AIQ, SCL and Cambridge Analytica) * Work that AIQ carried out for the EU referendum * Capabilities that were open to AIQ, by the types of tools that were exposed in the repository. ## The Aggregate IQ Breach It was with some astonishment to the residents of picturesque Victoria, British Columbia, that AggregateIQ - [a small data firm of “about half a dozen employees,” headquartered on the city’s Market Square](http://nationalpost.com/news/who-is-aggregateiq-the-canadian-company-accused-of-being-at-centre-of-facebook-data-breach-scandal) - emerged as a central player in an international news story stretching from London to Silicon Valley. [With more evidence emerging of its close ties to Cambridge Analytica](https://www.theguardian.com/uk-news/2018/mar/31/aggregateiq-canadian-tech-brexit-data-riddle-cambridge-analytica), the political analytics company has been under investigation for its harvesting of data from over 87 million Facebook user accounts. Facebook, under congressional fire, suspended the company from its platform, citing AIQ’s documented ties to Cambridge Analytica and its parent company, [Strategic Communication Laboratories (SCL)](https://www.newyorker.com/news/letter-from-the-uk/life-inside-scl-cambridge-analyticas-parent-company). This was a significant discovery and took some time to process. As such, we split the story into four distinct parts. ### [Part One - How a Political Engineering Firm Exposed Their Code Base](/breaches/aggregate-iq-part-one) In our first story, we discussed the initial discovery of an exposed Gitlab repository owned by AggregateIQ. Inside the repository we found the Ripon application, described by AggregateIQ co-owner Jeff Silvester as “a political customer relationship management tool focused on the US market”. The story of the Ripon application, and its intersection with the presidential aspirations of Ted Cruz, Cambridge Analytica, and AggregateIQ, turned out to be one element in a greater story. [*Read more*](/breaches/aggregate-iq-part-one) ### [Part Two - The Brexit Connection](/breaches/aggregate-iq-part-two-brexit) In the second part, we examined more closely a particularly important category of AggregateIQ’s data set: code from several websites, each concerning a British political organization, party, or pressure group. The repositories named for Vote Leave, the DUP, Gove 2016, Change Britain, and Veterans for Britain provided a detailed look into web assets produced by AggregateIQ on behalf of a wide array of pro-Brexit groups and figures. These repositories were rife with exposed credentials, tokens, and passwords. [*Read more*](/breaches/aggregate-iq-part-two-brexit) ### [Part Three - A Monarch, A Peasant, and a Saga](/breaches/aggregate-iq-part-three-monarch) The third part of the disclosure of the AggregateIQ breach covered the remainder of the tools found in their exposed Gitlab repository. With names like “Monarch” and “Saga”, these tools helped AIQ optimize their political advertising campaigns which is in of itself, uncontroversial. However, we also uncovered the “Database of Truth”, a massive repository which includes US voter registration lists from every state that have been enhanced and scored via predictive behavioural analysis and advanced correlation methods. By combining the tools with the data, AIQ and Cambridge Analytica were able to scale and target voters at a level never seen before. [*Read more*](/breaches/aggregate-iq-part-three-monarch) ### [Part Four - NorthWest Passage](/breaches/aggregate-iq-part-four-canada) In part four, we returned to examine data revealed in the exposure showing AIQ’s involvement in political efforts closer to its home base of Victoria, British Columbia. While AIQ’s work on behalf of a number of Canadian politicians was already known, the data provided clear insight into what specific assets were built and possessed by AIQ for their clients, along with previously unreported information - including about exposed credentials and passwords. [*Read more*](/breaches/aggregate-iq-part-four-canada) ## Where to from here? ***“Companies like Facebook should not be allowed to behave like ‘digital gangsters’ in the online world, considering themselves to be ahead of and beyond the law.”*** The DCMS report is a fascinating read, covering political campaigning, digital advertising and outright manipulation via online misinformation. Ultimately, the report concludes that companies such as Facebook should be brought under regulatory control, arguing “social media companies cannot hide behind the claim of being merely a ‘platform’ and maintain that they have no responsibility themselves in regulating the content of their sites”. Facebook has claimed that it is evolving, and is not the same company it was even a year ago. It seems that the fight between social media giants and regulators may just be beginning. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)