Wednesday 12 December 2018

Data Protection Commissioner 'intends to undertake an investigation' into INM alleged data breach

INM
INM

Dearbhail McDonald and Shane Phelan

Data Protection Commissioner Helen Dixon intends to undertake an investigation into a suspected data breach at Independent News & Media.

The move follows concerns, expressed by the Office of the Director of Corporate Enforcement (ODCE), that data was removed from the company's premises in October 2014, taken out of the jurisdiction and "interrogated" by at least six companies external to INM.

The ODCE fears data relating to a number of directors and staff, including journalists, was involved.

In a statement, the office of the office of the Data Protection Commissioner said: "The DPC intends to undertake an investigation into whether personal data was accessed and if so, whether it was processed lawfully and fairly in accordance with data protection legislation. We are currently scoping the parameters of that investigation, including seeking additional information from  INM this afternoon on foot of the breach notification it filed with the office last week."

INM has said it contacted the commissioner after being informed of new information by the ODCE on March 23 last.

This new information accompanied a notice from the ODCE that it intended to apply to the High Court on April 16 for the appointment of inspectors to INM.

Irish Secretary of the National Union of Journalists (NUJ) Séamus Dooley said in a statement this evening: “We welcome the announcement that the Data Protection Commissioner is to carry out an investigation into the alleged breaches.

"INM employees require a detailed explanation as to how and why the alleged breaches occurred. The long term interests of workers and of INM are best served by an open and transparent process.

"Journalists at Independent House had a right to work without their data being put at risk. The current Chairman and board must give unambiguous support to the editorial staff and commit to the principle that editorial independence will not be compromised by internal or external commercial or corporate interests”.

The move comes after it was revealed that two high-profile journalists were identified as “persons of interest” on a list of 19 names discovered by the corporate enforcement watchdog during its investigation into an alleged data breach at Independent News and Media (INM).

Two senior barristers who represented the Moriarty Tribunal are also on the same list revealed in an affidavit filed by the Office of the Director of Corporate Enforcement (ODCE).

The journalists are Brendan O’Connor of the ‘Sunday Independent’ and his colleague on the same newspaper, Maeve Sheehan.

Mr O’Connor is one of Ireland’s best-known writers, commentators and broadcasters. He is deputy editor at the ‘Sunday Independent’, editor of ‘Life’ magazine and a successful television and radio broadcaster. Most recently, he has fronted the ratings success ‘Brendan O’Connor’s Cutting Edge’ on Wednesday nights on RTE One.

Ms Sheehan is one of the country’s most respected investigative journalists who has a long track record of probing articles in the ‘Sunday Independent’ on the big issues of the day.

It is unclear why their names appear on the list.

The list of names does not give any indication as to its purpose.

However, one reason given to the ODCE was the company was searching for a contract that INM management was unable to furnish or find at this particular period. It is thought the contract was a legal services contract.

Two others identified on an Excel spreadsheet are barristers.

They are Jerry Healy SC and Jacqueline O’Brien SC. Both were employed on a full-time basis for several years as counsel for the Moriarty Tribunal.

Among other matters, the tribunal investigated the awarding in 1995 of the State’s second mobile phone licence to businessman Denis O’Brien’s Esat Digifone.

The tribunal found then Communications Minister Michael Lowry assisted Mr O’Brien, who is INM’s largest shareholder, in his bid to secure the licence. Both men dispute the tribunal’s findings.

According to an affidavit filed by ODCE director Ian Drennan, the barrister’s names appear on the list alongside four journalists, six former INM board and staff members and seven other people.

Mr Drennan says the list was uncovered during an investigation into a suspected data breach at INM in October 2014, where he alleges data was removed from the company’s premises, taken out of the jurisdiction and “interrogated” by at least six companies external to INM.

The ODCE director claims the data interrogation was directed by then INM chairman Leslie Buckley and that two invoices associated with it were paid by Blaydon Limited, an Isle of Man company beneficially owned by Mr O’Brien.

According to Mr Drennan, the journalists on the list are Maeve Sheehan, Brendan O’Connor, and Sam Smyth who was a writer on the Irish Independent but had left the company by 2014. Also named as a “journalist” is Rory Godson, but he was a public relations executive in 2014.

Speaking on the News at One on RTÉ today, former INM journalist Sam Smyth said the first time it was confirmed to him that his data had been allegedly breached was when he read about it in the Irish Independent today.

He said he was told by a friend about a week ago that there was a “list going around, a list of people who apparently had all of their communications with INM monitored, harvested and so on. I could get no other detail. I heard nothing whatsoever from INM or anybody else in authority there. The first time I saw it confirmed was this morning when it was in The Irish Independent.”

“When I read it in the Irish Independent I took it seriously because its Irish (sic) News and Media that’s in the firestorm of this so you’d assume that if anybody had knowledge of it, it would be them,” he said.

“I’m not as surprised as you might have thought,” he said of his reaction to being on the so-called list.

“For a  long time rumours were flying. Different people said to me – some people involved in security said to me – be very careful with your telephone communications. Be very careful about this. I would be naturally quite cautious anyway about emails and would have used my own email address a lot on this. But you never know, obviously when I worked there I was communicating regularly with Independent News and Media so yes, I am in one way, I’m a bit annoyed about it but I’m certainly not surprised.”

He said he is now seeking advice on the matter.

“When I heard about it I certainly wasn’t shocked. There was an air almost of inevitability about it because we had spoken about this for some time.”

“Am I very annoyed? Not very annoyed. It’s the sort of thing I expected may well turn up some day.”

Asked about his experience covering the Moriarty Tribunal for over a decade, he said: “I certainly had a working knowledge of it and had written extensively about what was going on and clearly this upset some people and at the end of the day, the findings by the High Court judge in the Moriarty Tribunal… there was a lot of controversy through that time of reporting it.”

The former INM board and staff members on the list are former chief executive of INM’s Irish division Joe Webb, former INM director of corporate affairs Karl Brophy, former INM chief executive Vincent Crowley, former INM director and chief financial officer Donal Buggy, the late former chairman of INM James Osborne, and Mandy Scott, a former PA to the chief executive of INM.

Mr Brophy is now the chief executive of public relations firm Red Flag Consulting, which is being sued by Mr O’Brien for alleged conspiracy and defamation.

Mr Brophy is also being personally sued. Ms Scott also now works for the firm.

Seven other less well-known names are also included.

It is understood that of these “additional persons” some were involved in public relations, media monitoring and one was a former INM executive.

It is unclear if Mr O’Brien was aware of the data interrogation or the payment by Blaydon of the invoices. INM told the ODCE it does not know why Blaydon discharged the costs.

Mr O’Brien’s spokesman has said he was not making any comment, while a spokesman for Mr Buckley has said: “It is not appropriate to comment as a review process is ongoing.”

According to Mr Drennan, Mr Buckley explained that the data interrogation was part of a “cost-reduction exercise”. He says Mr Buckley told the ODCE he authorised the work so he could find out more detail about the awarding by INM of a professional services contract and that he wanted to consider whether the cost and duration of the contract could be renegotiated.

Mr Drennan says the 19 names were found by the ODCE in an Excel spreadsheet attached to emails exchanged by employees of companies external to INM who were involved in the data interrogation.

He says the spreadsheet and emails were obtained during a year-long investigation into various corporate governance matters at INM.

The spreadsheet is an exhibit to an affidavit Mr Drennan has filed with the High Court in a bid to get inspectors appointed to investigate a range of matters at INM, including the suspected data breach. The court will consider the application on April 16.

Seamus Dooley, General Secretary of the National Union of Journalists in Ireland, also appeared on the News at One this afternoon.

He said: “Working journalists named in this are reporters of the highest integrity. They had a right to have their data protected, indeed all employees have a right to have their data protected. Companies have an absolute legal obligation to protect data.”

“We would have a particular concern if journalists’ data is compromised and I believe the decision, allegedly taken by an non-executive chairman, to have data removed and interrogated out of the country, that put at risk all data, so there is a serious issue there.”

“Journalists are obliged to protect confidential sources of information and of course, normally when we associate protecting sources we identify the threat as being external. What is alleged here is that the threat came internally and that makes it all the more serious.”

“I think it’s impossible to imagine any situation where it’s morally or ethically justifiable for a company to undermine in any way the principle of journalistic sources.”

“We have written to the Data Protection Commissioner looking for an immediate investigation and I am shocked that Sam Smyth says he has not been advised. He was entitled to be advised of an alleged breach. That reinforces my view that there is a role for the Data Protection Commissioner.

"At the heart of the issue is a wider issue, in my view, about media control and ownership in Ireland. We can’t pretend any more that there is nothing wrong. We in the NUJ have been calling for a long time for a government commission on the future of the media in Ireland and central to that is a debate about ownership and control.”

Asked about the future security of INM journalists, he said: “There are many honourable men and women across the INM titles, including many, many fine journalists and this type of corporate shenanigans, or boardroom shenanigans, do serve to undermine the reputation of a company which plays an important role in Irish society and which provides employment.”

“I would have a very real concern at anything which would undermine the ability of INM to trade and I would hope that the company can get through this and that the rights, the data rights and indeed the employment rights of the employees and the rights of former employees are protected in the weeks and months ahead.”

He said he will be seeking a meeting with INM on the matter and said the NUJ is “offering assistance to any member who feels their data may have been compromised.”

Online Editors

Business Newsletter

Read the leading stories from the world of Business.

Also in Business