By: Carole Cadwalladr

This weekend marks a peculiar anniversary for the Observer. One year ago we published the article that led to the first of a series of legal threats from Cambridge Analytica: threats that have dogged the reporting of this story ever since. And this weekend marks the end of the week in which the company collapsed.

It was not the first piece we had published about the company – the lawyers cited six previous ones – but it was our article on 7 May, “The Great British Brexit Robbery”, that prompted the “pre-action protocol for defamation”. Or, as one colleague said: “It appears that you have put your stick into the hornets’ nest one time too many.”

On Wednesday, Cambridge Analytica announced that it had gone into liquidation. It’s not the end of the road for the company, or the investigations into it, but it is a remarkable moment in Cambridge Analytica’s short and eventful life – the zenith of which was helping Donald Trump become US president only 18 months ago – and in the Observer’s involvement in it.

The Observer and its sister paper the Guardian have been on Cambridge Analytica’s heels for most of that short history – from the first piece in theGuardian in December 2015, to its first mention in the Observer in December 2016, to the article in February 2017 that revealed the central role in the company of Robert Mercer, the US data billionaire and supporter of rightwing causes.

It was this article that triggered two investigations, both of which continue: one by the Electoral Commission into whether it had done work – that was not declared – for the Brexit campaign Leave.EU, the other by the Information Commissioner’s Office.

And it was this investigation that led to the ICO announcing a wider inquiry into the use of data in politics: an inquiry that reached a dramatic culmination when the ICO raided Cambridge Analytica’s offices in the week that the Observerpublished revelations from Christopher Wylie, a former employee turned whistleblower.

Last week Cambridge Analytica portrayed itself as a victim – a victim of unwarranted press attention that had driven away customers. It had been the subject of “numerous unfounded accusations” and “vilified for activities”, it claimed. From a firm that drew on its parent company SCL’s 30 years of expertise in military psychological operations, one would expect nothing less. And, in some respects, the Observer’s battle royale with Cambridge Analytica is a microcosm of everything that has happened to the news and information landscape over the past two years.

This is not the end of Cambridge Analytica, and it is not the end of the use of our personal data in ways we may not even be aware of – but it is a triumph of sorts. News has won over fake news. Facts over lies. A mainstream news organisation over false narratives crafted by expert manipulators and seeded across the internet by untraceable websites.

Trump’s presidency unleashed an existential crisis for news organisations that is still playing out. How do you combat articles that have no basis in fact but which – as Cambridge Analytica’s chief executive, Alexander Nix, told an undercover reporter for Channel 4 – can be made to “infect the bloodstream of the internet”?

There are still no easy answers to any of this, but what the Observer investigation into Cambridge Analytica uncovered was that none of it was accidental. Trump has called the press “the enemy of the American people” but what we found was that Mercer and Steve Bannon, the key Trump aide who became his chief strategist, were waging a war on facts, on the mainstream media, on multiple fronts.

Fake news is merely the most recent tool in a billionaire’s armoury. There are other more traditional ones. Britain’s defamation laws are a minefield. Legal threats from Cambridge Analytica, which is funded by Mercer – the man who heads the most lucrative hedge fund in the world, and who was Trump’s biggest donor – have hung over both the paper and me personally.

It remains to be seen what the liquidation of Cambridge Analytica and the affiliated SCL Elections will ultimately mean. It’s unclear what data or intellectual property has been transferred to a new Mercer-funded vehicle, Emerdata, whose directors include all the main individuals involved in Cambridge Analytica – Mercer’s daughter Rebekah Mercer; Alexander Tayler, CA’s chief data officer; and Julian Wheatland, its chairman, among them. Paul-Olivier Dehaye, a Swiss mathematician and data expert whose research has been pivotal to this investigation, said on Friday that he suspected data had already been migrated to Emerdata. His start-up, personaldata.io, processes data requests on behalf of individuals and he had noticed Cambridge Analytica had changed its form response to these requests.

As Chris Vickery, a cybersecurity specialist, told MPs on the day the firm collapsed, data is “sticky”. Once it’s out there, he said, “it doesn’t go away”. Collecting it is expensive, difficult and time-consuming. “And in my experience,” he said, “it never actually disappears.”

The data is out there. That much we know. Since we published Wylie’s firsthand account on 17 March and Facebook subsequently confirmed that as many as 87 million people may have had their personal information improperly harvested on Cambridge Analytica’s behalf, we have also learned that hundreds, maybe thousands, of other app developers did the same.

What has also become clear is that this, the first age of extractive data harvesting, is over. That certainly does not mean that it is not going to happen any more – across large swaths of the world, it is only just beginning – but the collapse of Cambridge Analytica marks the end of the age of data innocence, as Wylie has said.

However, the untangling of the web of Cambridge Analytica’s influence is only just beginning. And in the middle of it – at the heart of a skein of threads, of people, of companies – is Brexit.

The most dramatic development in the Cambridge Analytica story last week was not the company’s demise. Instead, it took place, almost unnoticed, inside Portcullis House, the Palace of Westminster’s overspill building where much of the routine business of government takes place.

There, in an anonymous committee room, Vickery, who works for the data security company UpGuard, told the select committee for Digital, Culture, Media and Sport (DCMS) how he had stumbled across a data breach online: an unsecured repository of source code left online by AggregateIQ, the company employed by the official Vote Leave campaign that we reported a year ago was Cambridge Analytica’s Canadian affiliate.

The code has tangible proof of almost everything we reported then – things that Cambridge Analytica had denied in long and detailed legal letters, and that had been saved by Vickery on to a hard drive and handed over to parliament.

It was inconceivable, Vickery said, that Trump’s campaign did not have access to psychological models derived from Facebook data. Cambridge Analytica and AIQ were technologically inseparable. And there was “prima facie evidence” that four different Leave campaigns had collaborated, that they had coordinated in their efforts, and that this had been facilitated by AIQ. Coordination which is illegal under UK law. Coordination which had been facilitated by Facebook.

AggregateIQ has repeatedly denied any wrongdoing. It maintains it is 100% Canadian-owned and operated, and not a direct part, or branch, of Cambridge Analytica. Jeff Silvester, one of AIQ’s founders, said that Cambridge Analytica was not in contact with AIQ during the referendum campaign. “AIQ never worked or even communicated in any way with Cambridge Analytica or any other parties related to Cambridge Analytica with respect to the Brexit campaign. Any claim that we shared Vote Leave data with Cambridge Analytica or anyone else in any way is entirely false.” Canadian MPs, however, have suggested the founders of the company had been lying to parliament. They asked Zackary Massingham and Silvester to give evidence about their relationship with Cambridge Analytica and the work the company had carried out on the referendum. In an evidence sessionthat Charlie Angus MP said was the most extraordinary he had seen in Canada’s parliament in 14 years, he told them their answers “beggar belief”. The chair of the committee added: “Something doesn’t smell right here.”

Last Thursday, the Canadian committee asked the head of the UK’s DCMS committee, Damian Collins, to give evidence by Skype, and another Canadian MP, Frank Baylis, told him the referendum groups were “actively coordinating” and that “there was a series of coincidences that defy logic”. He said the evidence they had seen pointed to “SCL, Cambridge Analytica, SCL Canada, AIQ – all one organisation”.

It’s what happens next that’s the question. Canadian MPs are pointing to a crime that is potentially so much bigger than breaking electoral law. A crime that is beyond the powers of the Electoral Commission to investigate, that happened outside British jurisdiction, and was enabled by a company – Facebook – whose head has refused, repeatedly, to answer questions to parliament.

Where does this leave British law? British democracy? And, crucially, parliament? What will it do with the evidence it has gathered? Will MPs alert the crown prosecution service? The police? The National Crime Agency? There have been so many systemic failures that have brought us to the point at which a US technology platform can be accused of having interfered in the democratic process.

And from the void, a host of unlikely actors has emerged. America has special counsel Robert Mueller. We have the DCMS committee: backbench MPs who have found themselves plunged into a world of data and dark money.

That this story is complicated is no accident. As the liquidators may soon find out, Cambridge Analytica’s corporate structure, a web of interlinked entities, is confusing by design.

But there are also things that are simple to understand: evidence, for example. Testimony. Witness after witness who has stood up and told them that laws were broken. And, while there are multiple threads to this story, there’s also a central node, an interface between them and us: Facebook. One company, run by one man, Mark Zuckerberg, that governs and controls how political messages are delivered to two billion voters. It’s an insane proposition that the world has sleepwalked into this situation – and, as the DCMS committee has discovered, that there appears to be no democratic means of calling people to account.

Last week, Collins published his fourth letter to Zuckerberg, issuing an extraordinary notification. If Zuckerberg did not come to testify voluntarily, he warned, the next time he entered British territory, he would be “summoned” more formally.

The news about Cambridge Analytica’s “closure” is a red herring. There’s no closure yet: there’s so much more to this story still to come. And Cambridge Analytica and Facebook are in it, intimately bound in an embrace that encompasses two of the greatest political upheavals since the second world war – Britain’s decision to exit the EU and the election of Donald Trump.

Cambridge Analytica’s cheap and easy fix of calling in the liquidators is not going to cut it. We know the company is a subject of interest to Mueller. We know that the data operation of Trump’s campaign is one point of his investigation into potential collusion with the Kremlin. We know that the same cast of characters were involved, Bannon and Nigel Farage chief among them, in both campaigns on both sides of the Atlantic – or, at least, this is what Canadian lawmakers believe. We know that parliament now has evidence that suggests referendum campaigners colluded to break the law.

Mike Schroepfer, Facebook’s chief technology officer, was grilled last week by British MPs on the company’s decision to send the Observer a legal threat the day before we published our interview with Wylie. Jo Stevens MP pointed out that it was only because of the Guardian’s 2015 article that the company knew about the Cambridge Analytica data breach in the first place. And then Julian Knight took up the baton. Had he any idea what kind of chilling effects these threats had? Schroepfer, out of his depth, was flustered. “My understanding is that this is common practice in the UK,” he said. And then: “I am sorry that journalists feel that we are trying to prevent them from getting the truth out.”

This is not how apologies work. But then, none of this is how any of this should work. It’s not how democracy works. It’s not how the law works. It’s not how select committees are supposed to work. Everything failed, including our ability to hold our own laws to account. And the evidence eking out, week by week, in Portcullis House is making that painfully apparent.

Cambridge Analytica is gone. But what I want to know is this: what will happen next?