What we know so far about the data breach claims rocking Ireland's biggest publisher

IN A WORLD where the use of people’s data has become front-page news, Ireland is in the midst of its own scandal involving the country’s biggest media group.

The ‘INM19′ hashtag has been doing the rounds on Twitter over the past few days, as details have emerged that a number of journalists and senior staff at Independent News and Media had their emails allegedly accessed by an external company.

Caught up in the story are high-profile names such as journalist and TV presenter Brendan O’Connor and investigative journalist Maeve Sheehan, both of whom were unaware their data was allegedly being probed by an external company in a different jurisdiction.

INM’s largest shareholder, the businessman Denis O’Brien, also features prominently. It is alleged that the data interrogation was ordered by the company’s former chairman, Leslie Buckley, an O’Brien business ally, but that the firm’s board had no idea what was going on.

This is what we know so far:

How it all started

The recent furore was sparked by INM’s abandoned bid for radio station Newstalk. The Office of the Director of Corporate Enforcement is the State’s corporate governance watchdog, with powers to investigate companies suspected of contravening the law.

It has been dealing with Independent News and Media – which publishes the Irish Independent, Sunday Independent, Herald and other newspapers – for some time.

In March 2017, the ODCE asked INM to “produce books and records” in relation to the publisher’s interest in Newstalk. This move came following a protected disclosure from former INM CEO Robert Pitt in relation to the bid.

It had been reported that Pitt disagreed with then chairman Buckley over the price that should be paid for Newstalk.

Pitt had suggested a valuation of €12 million, but the radio station’s parent company, Communicorp, had designated a valuation of €30 to €35 million.

Robert Pitt (left) and Leslie Buckley

Buckley, a long-time bussiness associate of billionaire O’Brien, is alleged to have told Pitt that another valuation of €14 million was “insulting to the majority shareholder”.

Communicorp is almost wholly owned by Denis O’Brien, who is also the largest shareholder at INM.

How the ODCE got involved

On 23 March this year, the ODCE issued notice to INM that it would be seeking to appoint inspectors to investigate corporate governance at the group and whether there had been any unlawful action at the firm.

To appoint these inspectors it must get the approval of the High Court, and this action is due to take place later this month.

In a statement from March, INM said its board was “taking legal advice as to whether the court would have sufficient grounds to make the appointment”.

Independent offices on Talbot Street in Dublin

As reported in the Sunday Independent, ODCE director Ian Drennan said in an affidavit filed with the High Court that the back-up storage for INM’s IT systems had been removed from the company’s premises.

According to the document, they were moved to the premises of a company outside the Irish jurisdiction in October 2014. Drennan said that INM data was subsequently interrogated over the course of many months.

In the affidavit, he said: “During the course of the data interrogation, INM’s data appears to have been searched against the names of various individuals, including, amongst others, a number of INM journalists and two senior counsel.”

Drennan alleges in the affidavit that the data interrogation was directed by Buckley, who stepped down last month. The ODCE director claims that the INM board only became aware of the data interrogation exercise in August 2017.

He added that Buckley said the data interrogation was part of a “cost-reduction exercise”, but Drennan claims that some of the output of the work “does not have any obvious connection to the cost reduction purpose asserted by the chairman”.

What was included in the data

According to ODCE director Drennan, the watchdog’s investigation uncovered emails containing a list of names to be included in searches during the data interrogation.

It includes current journalists, former journalists, executives, staff members and two senior counsel not related to the company. References are made in the affidavit to “email hits” against a number of the names listed.

Drennan said he wants to establish “whether journalists’ email, or other data, was accessed and, if so, by whom and for what purpose”.

On the board not being aware of this exercise being conducted and data being given to a third party in 2014, Drennan describes this as “clearly problematic”.

We do not yet know for sure to what extent the emails of the journalists and others involved were accessed by these third parties, and the ODCE is seeking to appoint inspectors to investigate this further.

Stephen Rae, the editor-in-chief of the Irish Independent, has said he is concerned that data of journalists working for INM may have been accessed without their knowledge.

In a statement to his own newspaper, Rae said the company will investigate if any data has been compromised.

He said: “We have always invoked a strict protection or ‘firewall approach’ to both our journalists’ research and sources to maintain the integrity of our journalism.

“We will look seriously at this new information to see what data, if any, may have been involved during this reported event in 2014.”

Who are the ‘INM19′

The hashtag ‘INM19′ has since been doing the rounds on social media, referring to the 19 people whose data was allegedly interrogated as part of the company’s action.

The Irish Independent reported this morning that journalists Brendan O’Connor and Maeve Sheehan were on its list, as was former INM director of corporate affairs Karl Brophy.

Also on the list were two senior counsel from the Moriarty Tribunal, which found that then communications minister Michael Lowry secured the State’s second mobile phone licence for O’Brien in 1995.

Drennan said that the 19 names were found by the ODCE in an Excel spreadsheet that was attached to emails exchanged by employees of companies external to INM involved in the data interrogation.

One of the names being reported as amongst the so-called INM19 is Sam Smyth, who now works as a columnist with the Mail on Sunday.

He told RTÉ’s News at One that he had been told by someone within the media his data had been “harvested”.

However Smyth said no one has contacted him to say there may have been a breach of his data while he worked at INM.

“I’m a bit annoyed, but certainly not surprised,” Smyth said. “There was an air of inevitability about it. We had spoken about this for some time. It was the sort of thing I expected may turn up some day.”

He told RTÉ that he was prominent in INM’s coverage of the Moriarty Tribunal. “I sat there for 10 years… and wrote extensively about what was going on,” he said.

Sam Smyth

What is Trusted Data Solutions

Meanwhile, the Sunday Times reported that the firm granted access to the INM records was a firm called Trusted Data Solutions (TDS).

The services provided by the Wales-based company include back-up tape services and email archive migration. However, the firm that paid the bill to TDS for its email interrogation services was not INM.

It was Isle of Man company Blaydon which footed the €60,000 bill, the Sunday Times reported. It is not known why Blaydon discharged the costs associated with the services provided by TDS.

During its reporting of the Paradise Papers, the Irish Times established a link between the investment holding company and O’Brien.

Is there a connection to the Red Flag case?

Denis O’Brien is already engaged in a long-running legal battle with the company Red Flag consulting, which compiled a dossier of information on the telecoms tycoon.

The billionaire sued both Red Flag and its CEO, former INM man Brophy, after a USB stick containing the dossier was anonymously delivered to his office in 2015. Brophy is one of the INM19.

When approached by both the Sunday Times and the Independent, a spokesperson for Denis O’Brien did not provide comment on the story.

What happens next

Stephen Rae

INM editor-in-chief Stephen Rae has assured staff that their welfare is the company’s primary concern.

Rae told staff that those named as having their emails searched has been informed of the incident, RTÉ reported.

He said: “Clearly we have to get to the bottom of what is alleged to have occurred and as always identify the actual facts of the case in the first instance and thereafter what lessons can be learned.”

The issue has been taken up by Séamus Dooley, the Irish secretary of the National Journalists Union, who has called on INM to publicly clarify the extent to which the personal data of staff, including the confidential records of journalists, may have been compromised.

He said in a statement: “Every employer has a legal obligation to protect personnel records. It is imperative that INM issue an unambiguous explanation to employees about what has happened and why their data appears to have been put at risk.

“Clear lines appear to have been crossed and it is in the long-term interest of the company and of Irish journalism that this matter is addressed as a matter of urgency.”

The ODCE case to have inspectors appointed to investigate INM will be heard in the High Court on 16 April.

Written by Sean Murray and posted on TheJournal.ie