Technology

More than two months after a cyberattack hobbled many of its critical municipal systems, the city of Atlanta is still sorting through the wreckage of what is likely the worst cyberattack targeting a U.S. city to date.

On March 22, Atlantaconnected systems city-wide were hit with a ransomware message locking their respective files and demanding an approximately $50,000 payment in bitcoin (the price has fluctuated since). The ransomware is believed to be from the group known as SamSam, which has been operating and executing similar attacks since at least 2015.

In the days following the March 22 incident, Atlanta residents were unable to do simple city system-dependent tasks like paying parking tickets or utility bills. City employees didn&t get the all-clear to turn on their computers until five days later and many city systems still have not recovered.

On Wednesday during a budget meeting, Daphne Rackley, AtlantaInterim Chief Information Officer and head of Atlanta Information Management, disclosed new details about the extent of the damage. As Reuters reports, at least one third of the 424 software programs that the city runs remain offline or partially inoperable. Almost 30 percent of those programs are deemed &mission critical& by the city meaning that they control crucial city services like the court system and law enforcement. In the meeting, Rackley explained that the city initially believed only 20 percent of the citysoftware programs to be affected by the attack, none of which affected critical systems.

While reporting the updated numbers, Rackley estimated that $9.5 million would need to be added to the department$35 million budget to address the remaining damage. That amount is on top of the more than two million dollars in emergency procurements sought by Atlanta Information Management following the attack.

TechCrunch has reached out to Atlanta Information Management about how that additional $9.5 million for recovery from the attack would be allocated and will update if we learn further details. Earlier this week, AtlantaPolice Chief disclosed that the cyberattack destroyed &years& worth of police dash cam video footage.

Atlanta has been regarded as a frontrunner for Amazonsecond headquarters in some analyses,though itnot immediately clear how the cyberattack will affect the cityodds.

The repeat grillingby the U.K. parliamentDCMS committee today of Alexander Nix, the former CEO of the now ex company Cambridge Analytica — aka the controversial political and commercial ad agency at the center of a Facebook data misuse scandal — was not able to shed much new light on what may or may not have been going on inside the company.

But one nugget of information Nix let slip were the names of specific data aggregators he said Cambridge Analytica had bought &consumer and lifestyle& information on U.S. voters from, to link to voter registration data it also paid to acquire — apparently using that combined database to build models to target American voters in the 2016 presidential election, rather than using data improperly obtained from Facebook.

This is more information than Cambridge Analytica has thus far disclosed to one U.S. voter, professor David Carroll, who in January last year lodged a subject access request with the U.K.-based company after learning it had processed his personal information — only to be fobbed off with a partial disclosure.

Carroll persisted, and made a complaint to the U.K.data protection watchdog, andlast monththe ICO ordered Cambridge Analytica to provide him with all the data it held on him. The deadline for that passed yesterday — with no response.

The committee questioned Nix closely over responses he had given it at his earlier appearance in February, when he denied thatCambridge Analytica used Facebook data as the foundational data set for its political ad targeting business.

He had instead said that the work Dr. Aleksandr Kogan did for the company was &fruitless& and thus that the Facebook data Kogan had harvested and supplied to it had not been used.

&It wasn&t the foundational data set on which we built our company,& said Nix today. &Because we went out and we licensed millions of data points on American individuals from very large reputable data aggregators and data vendors such as Acxiom, Experian, Infogroup. That was the cornerstone of our data base together with political data — voter file data, I beg your pardon — which again is commercially available in the United States. That was the cornerstone of our company and on which we continued to build the company after we realized that the GSR data was fruitless.&

&The data that Dr. Kogan gave to us was modeled data and building a model on top of a model proved to be less statistically accurate… than actually just using Facebookown algorithms for placing advertising communications. And that was what we found out,& he added. &So I stand by that statement that I made to you before — and that was echoed and amplified in much more technical detail by Dr. Kogan.&

And Kogan did indeed play down the utility of the work he did for Cambridge Analytica — claiming it was essentially uselesswhen he appeared before the committee back in April.

Asked about the exact type of data Cambridge Analytica/SCL acquired and processed from data brokers, Nix told the committee: &This is largely — largely — consumer and lifestyle data. So this is data on, for instance, loyalty card data, transaction data, this is data that pertains to lifestyle choices, such as what car you drive or what magazines you read. It could be data on consumer habits. And together with some demographic and geographic data — and obviously the voter data, which is very important for U.S. politics.&

We&ve asked the three data brokers named by Nix to confirm Cambridge Analytica was a client of theirs, and the types of data it licensed from them, and will update this report with any response.

Fake news committee told itbeen told fake news

What was most notable on this, Nixsecond appearance in front of the DCMS committee — which is investigating the role and impact of fake news/online disinformation on the political process —were his attempts to shift the spotlight via a string of defiant denials that there was much of a scandal to see here.

He followed a Trumpian strategy of trying to cast himself (and his former company) as victims — framing the story as a liberal media conspiracy and claiming no evidence of wrongdoing or unethical behavior had been produced.

Cambridge Analytica whistleblower Chris Wylie,who Nix had almost certainly caught sight of sitting in the public gallery, was described as a &bitter and jealous& individual who had acted out of resentment and spite on account of the companysuccess.

Though the committee pushed back against that characterization, pointing out that Wylie has provided ample documents backing up his testimony, and that it has also taken evidence from multiple sources —not justfrom one former employee.

Nix did not dispute that the Facebook data-harvesting element of the scandal had been a &debacle,& as he put it.

Though he reiteratedCambridge Analyticaprevious denial that it was ever the recipient of the full data set Kogan acquired from Facebook — which Facebook confirmed in April consisted of information on as many as 87 million of its users — saying it &only received data on about 26 million-27 million individuals in the USA.&

He alsoadmitted to personally being &foolish& in what he had been caught saying to an undercover Channel 4 reporter — when he had appeared to suggest Cambridge Analytica used tactics such as honeytraps and infiltration to gain leverage against clients& political opponents (comments that got him suspended as CEO), saying he had only been talking in hypotheticals in his &overzealousness to secure a contract& — and once again painting himself as the victim of the &skillful manipulation of a journalist.&

He also claimed the broadcaster had taken his remarks out of context, claiming too that they had heavily edited the footage to make it look worse (a claim Channel 4 phoned in to the committee to &heavily& refute during the session).

But those sole apologetic notes did not raise the tone of profound indignation Nix struck throughout almost the entire session.

He came across as poised and well-versed in his channeled outrage. Though he has of course had plenty of time since his earlier appearance — when the story had not yet become a major scandal — to construct a version of events that could best serve to set the dial to maximum outrage.

Nix also shut down several lines of the committeequestions, refusing to answer whether Cambridge Analytica/SCL had gone on to repeat the Facebook data-harvesting method at the heart of the scandal themselves, for example.

Nor would he disclose who the owners and shareholders of Cambridge Analytica and SCL Group are — claiming in both cases that ongoing investigations prevented him from doing so.

Though, in the case of the Information CommissionOfficeongoing investigation into social media analytics and political campaigning — which resulted in the watchdog raiding the offices of Cambridge Analytica in March — committee chair Damian Collins made a point of stating the ICO had assured itit has no objection to Nix answering its questions.

Nonetheless Nix declined.

He also refused to comment on fresh allegations printed in the FT suggesting he had personally withdrawn $8 million from Cambridge Analytica before the company collapsed into administration.

Some answers were forthcoming when the committee pressed him on whether Aggregate IQ, a Canadian data company that has been linked to Cambridge Analytica, and which Nix described today as a &subcontractor& for certain pieces of work, had ever had access to raw data or modeled data that Cambridge Analytica held.

The committeelikely interest in pursing that line of questioning was to try to determine whether AIQ could have gained access to the cache of Facebook user data that found its way (via Kogan) to Cambridge Analytica — and thus whether it could have used it for its own political ad targeting purposes.

AIQ received£3.5 million from leave campaign groupsin the run up to the U.K.2016 EU referendum campaign, and has been described by leave campaigners as instrumental in securing their win, though exactly where it obtained data for targeting referendum ads has been a key question for the enquiry.

On this Nix said: &It wouldn&t be unusual for AIQ or Cambridge Analytica to work on a clientdata sets… And to have access to the data whilst we were working on them. But that didn&t entitle us to have any privileges over that data or any wherewithal to make a copy or retain any of that data ourselves.

&The relationship with AIQ would not have been dissimilar to that — as a subcontractor who was brought in to assist us on projects, they would have had, possibly, access to some of the data… whether that was modeled data or otherwise. But again that would be covered by the contract relationship that we have with them.&

Though he also said he couldn&t give a concrete answer on whether or not AIQ had had access to any raw data, adding: &I did speak to my data team prior to this hearing and they assured me there was no raw data that went into the Rippon platform [voter engagement platform AIQ built for Cambridge Analytica]. I can only defer to their expertise.&

Also on this, in prior evidence to the committee Facebook said it did not believe AIQ had used the Facebook user data obtained via Koganapps for targeting referendum ads because the company had used email address uploads to Facebookad platform for targeting &many& of its ads during the referendum — and it said Koganapp had not gathered the email addresses of app installers or their friends.

(And in its evidence to the committee, AIQCOO Jeff Silvester also claimed: &The only personal information we use in our work is that which is provided to us by our clients for specific purposes. In doing so, we believe we comply with all applicable privacy laws in each jurisdiction where we work.&)

Today Nix flat denied that Cambridge Analytica had played any role in the U.K.referendum campaign, despite the fact it was already known to have done some &scoping work& for UKIP, and which it did invoice the company for (but claims not to have been paid). Work which Nix did not deny had taken place but which he downplayed.

&We undertook some scoping work to look at these data. Unfortunately, whilst this work was being undertaken, we did not agree on the terms of a contract, as a consequence the deliverables from this work were not handed over, and the invoice was not paid. And therefore the Electoral Commission was absolutely satisfied that we did not do any work for Leave.EU and that includes for UKIP,& he said.

&At times we undertake eight, nine, 10 national elections a year somewhere around the world. We&ve never undertaken an election in the U.K. so I stand by my statement that the U.K. was not a target country of interest to us. Obviously the referendum was a unique moment in international campaigning and for that reason it was more significant than perhaps other opportunities to work on political campaigns might have been which was why we explored it. But we didn&t work on that campaign either.&

In a less comfortable moment for Nix, committee member Christian Matheson referred to a Cambridge Analytica document that the committee had obtained — described as a &digital overview& — and which listed &denial of service attacks& among the &digital interventions& apparently being offered by it as services.

Did you ever undertake any denial of service attacks, Nix was asked

&So this was a company that we looked at forming, and we never formed. And that company never undertook any work whatsoever,& he responded. &In answer to your question, no we didn&t.&

Why did you consider it, wondered Matheson

&Uh, at the time we were looking at, uh, different technologies, expanding into different technological areas and, uh, this seemed like, uh, an interesting, uh, uh, business, but we didn&t have the capability was probably the truth to be able to deliver meaningfully in this business,& said Nix. &So.&

Matheson: &Was it illegal at that time&

Nix: &I really don&t know. I can&t speak to technology like that.&

Matheson: &Right. Because itillegal now.&

Nix: &Right. I don&t know. Itnot something that we ever built. Itnot something that we ever undertook. Uh, ita company that was never realized.&

Matheson: &The only reason I ask is because it would give me concern that you have themens reato undertake activities which are, perhaps, outside the law. But if you never went ahead and did it, fair enough.&

Another moment of discomfort for Nix was when the committee pressed him about money transfers between Cambridge Analytica/SCLvarious entities in the U.S. and U.K. — pointing out that if funds were being shifted across the Atlantic for political work and not being declared that could be legally problematic.

Though he fended this off by declining to answer — again citing ongoing investigations.

He was also asked where the various people had been based when Cambridge Analytica had been doing work for U.S. campaigns and processing U.S. voters& data — with Collins pointing out that if that had been taking place outside the U.S. it could be illegal under U.S. law. But again he declined to answer.

&I&d love to explain this to you. But this again touches on some of these investigations — I simply can&t do that,& he said.

Every day, tech investors and reporters are pitched on new services that intend to generate digital tokens that its creators expect will trade . . . somewhere.

Perhaps unsurprisingly, Coinbase, known currently for trading a handful of the largest cryptocurrencies, wants to be that somewhere. To that end, itacquiring securities dealer Keystone Capital, a California-based FINRA-registered broker-dealer that, according to the WSJ, can operate as a registered investment and run an alternative trading system.

Coinbase said the move sets it on a path to &offer future services that include crypto securities trading, margin and over-the-counter trading.&

Terms of the deal weren&t disclosed. Coinbase will need regulatory approval to operate under the Keystone licenses, and its COO Asiff Hirji told the WSJ that it expects to take several months after those approvals are obtained to integrate Keystoneoperations.

More than $13 billion has been raised by startups via so-called initial coin offerings since the beginning of last year — a whopping $6.3 billion of that raised in just the first three months of 2018. That represents a huge opportunity for a company like Coinbase, particularly as more startups submit to regulatory oversight and, as a result, produce what are called &security& tokens. (Startups also sometimes sell &utility& tokens, which are designed to represent future access to a companyproduct or service rather than as an investment, though the SEC has repeatedly signaled itbelief that these tokens are similarly expected by purchasers to rise in value.)

Coinbase, which has so far raised $225 million from investors, isn&t alone in its interest and along with sizable contenders abroad, itfacing growing competition in the U.S.

Robinhood, for example, the free stock trading app, is also a FINRA-approved broker-dealer that recently began offering cryptocurrency trading; one can imagine it getting into the business of token trading in the not-too-distant future, fueled in part by the $363 million in new funding it disclosed last month that it had raised (at a reported $5.6 billion valuation).

Circle, a trading desk for cryptocurrencies, also has strong financial backing, including $110 million Series E funding that the company announced last month. Like Coinbase, it also has very big ambitions, as evidenced in part when, in February, it acquired Poloniex, one of the worldmost active cryptocurrency exchanges. According to the WSJ, Circle is also currently seeking a banking license.