Dr Aleksandr Kogan, the Cambridge neuroscientist whose research was integral to an international data usage scandal, publicly revealed he was given access to the private messages of Facebook users as part of his research as early as three years ago.

At a talk held in Cambridge in March 2015, Kogan said he had been allowed to see the “very sensitive, private conversations” of some users, and told the audience it was “startling that people authorise that”.

Facebook told the BBC yesterday that approximately 1,500 users had consented to having their private messages accessed, a feature which the tech giant said was turned off in 2015. 

Responding to an audience question about why Facebook data was being so heavily relied upon, Kogan said it was “easy to get”, and partially used “because nobody else shares”.

Kogan, who is based at the Department of Psychology, gathered data using an application he developed called ‘thisisyourdigitallife’, a personality test app connected to Facebook.

Users consented to have both their own information and information from their friends scraped by the application: this meant Kogan was quickly able to gather data on tens of millions of people for research use. He was banned by Facebook because he then sold that data on to Cambridge Analytica, via his own company, Global Science Research (GSR). 

Kogan told Varsity on Wednesday that no private message data was passed on to Cambridge Analytica.

The applications gained around 270,000 users, giving Kogan access to the data of 87 million people through shared friend data, including over a million in the UK.

On Monday, Facebook released a diagnostic tool which tells users whether their data may have be taken by thisisyourdigitallife. Users affected are told their public profile, page likes, date of birth and current city were shared. It also says: “A small number of people who logged into ‘This Is Your Digital Life’ also shared their own News Feed, timeline, posts and messages which may have included posts and messages from you. They may also have shared your hometown.”

Facebook’s admission and Kogan’s statements suggest that thisisyourdigitallife may have gathered enough private messages to use them as part of building psychological profiles.

Commenting via email on Wednesday evening, Dr Kogan said: “As part of my university research, we collected private messages from 1000-2000 or so people in 2014. This was used to help us study emotional expression. Before we ran the project, it was ethics approved by the an IRB committee in the university. All users gave explicit consent for the messages to be collected. Data was stored on a private, secure server in my lab.”

“The data in question was only used for university research. When we did the project with SCL, we used a completely different database – in Portland, Oregon – to store the data. So there was no risk of data flowing from the university projects to the company,” he said.

Work undertaken by Kogan and other Cambridge researchers researching psychometrics and psychology was thrust into the limelight last month, after Kogan was banned by Facebook for releasing data gathered for academic purposes to the political consultancy firm Cambridge Analytica. Issuing the ban, Facebook said Kogan “lied to us and violated our Platform Policies”, but Kogan claimed he was being made into a “scapegoat”.

The fallout of revelations made by a whistleblower in The Observer and The New York Times about the way user data was collected and shared by Facebook has produced a large global fallout, with inquiries currently underway in the UK and USA, and a class action lawsuit launched by British and American lawyers on Tuesday. Yesterday, Facebook founder and CEO Mark Zuckerberg gave testimony to the US Congress about the scandal.

Cambridge Analytica is said to have received data about ‘likes’ from tens of million of people, which they then used to target Facebook users in the build-up to several elections. A method for determining users’ personalities, developed by Kogan based on research taken by other academics, is said to have been used as part of this targeting process.

In a blog post last week, Facebook’s chief technology officer, Mike Schroepfer, said “In total, we believe the Facebook information of up to 87 million people – mostly in the US – may have been improperly shared with Cambridge Analytica”. Responding to Schroepfer, Cambridge Analytica said it had received data for “no more than 30m people from GSR” and “did not receive more data than this”.

At the talk, Kogan listed the information that had been made available to him: “it depends on what you authorise, they usually give you a big long list of stuff.”

He said the data included location, date of birth, page likes, wall posts, comments on wall posts, pictures, friends lists, limited data about friends, and private messages.

“Sometimes I’m allowed to do research where we try to get private messages to study what kind of emotional expressions people use,” he said. “It’s amazing, it’s startling that people authorise that when we’re going to be getting stuff, because it’s very sensitive, private conversations.”

A Facebook spokesperson told the BBC: “Prior to 2015, Facebook’s platform policy allowed developers to request permission to access inbox content but only if the person explicitly gave consent for this to happen”.

“According to our records, only a very small number of people – approximately 1,500 – explicitly opted into sharing this information with Kogan’s app. The feature was turned off in 2015.”

Kogan spoke about his team’s use of private messages at a 2015 talk titled ‘What your Facebook says about you’ as part of the Cambridge Science Festival. A recording of the talk is still publically available online.

Kogan told the audience mass data collection from social media had assisted researchers by removing their reliance on data gathered through conventional surveys.

He said the psychological profiles often proved to be incredibly accurate, citing a paper by another research group which found: “The models do better than pretty much anybody other than your spouse”.

Kogan said that the profiling usually relied upon page likes over and above any other kind of data.

He said that Cambridge researchers had also received data from Twitter, comprising around 1.5 million Tweets per day – a service which still exists in some form, and is likely to be less contentious as Tweets are usually already public. He said “nobody’s ever authorised this in terms of Twitter accounts...what Twitter does is they give away 1% of the Tweets sent per day to anyone who wants it”.

Kogan told Varsity today: “Twitter data was purchased directly from Twitter's data reseller, GNIP, well after the SCL project. We shared an anonymized version of the Twitter data with my lab at the university through a data transfer agreement. No data was ever shared with SCL/CA or any other entity. ”

Speaking at his talk about whether he would be able to use emails from Google for profiling if given them, Kogan said it raised an ethical question: “Even if you could get access to it, will people be ok with you getting access to it?”. He said that Google and Microsoft were both more strict about the privacy of user data.

The University has called on Facebook to release all the information it holds about Kogan’s role in the harvesting of the data.

• Update 21:11pm, 11th April: This article was updated after Varsity received comment from Dr Kogan.