How the media broke into confidential databases

Published August 2009 No comments... »

The Guardian

August 2009

From his cramped office at the back of his family home on a quiet street in New Milton on the Hampshire coast, Steve Whittamore worked for years as the link between news organisations and a network of sources who could penetrate the security of confidential databases.

Eastwards, on the Sussex coast, he paid a long-haired hell’s angel who had perfected a spiel which allowed him to phone up British Telecom to extract home addresses and ex-directory numbers. To his north, in Salisbury, he used a fellow private investigator who worked on mobile phone companies as well as British Telecom. To the west, in Devon, a civil servant in the department of work and pensions had access to the giant database of the social security system. Inside a regional office of the DVLA, he had two men who sold him the private details of any registered car owner. At Wandsworth police station in south London, a civilian worker sold criminal records and other personal information from the Police National Computer.

Whittamore is only one of a dozen or more private investigators who have been involved in breaking the law for Fleet Street. There is the former actor who uses his skills as a mimic to ‘blag’ the same databases; the former detective, who was bounced out of the police for corruption, who has spent years carrying cash bribes from newspapers to serving officers; the London investigator who paid police to moonlight for his agency and to provide live intelligence which he sold on to newspapers. Some have supplied the technology to allow journalists to use ‘trojan horse’ emails to steal information from computers and to tap live phone calls and to hack into voicemail messages, the technique which led to prison two years ago for a journalist and a private investigator working for the News of the World.

Whittamore’s network has become notorious simply because they were the ones that were busted, in Operation Motorman which saw the Information Commissioner’s staff descend on his office in New Milton in March 2003, emerging with a vast cache of hand-written records of requests from journalists many of which appear to lack any sign of the kind of public interest which would make them legal.

The sheer scale of the activity speaks to the collapse of the security walls around organisations which are trusted by millions to protect their privacy and the rapacious will of the news media to rush through the gaps. And yet, when the Information Commissioner obtained the material, they were so short of resources that they approached and warned only a handful of those whose privacy had been compromised even where that involved people who were potential targets for terrorism or other crime.

Lord Imbert, a former commissioner of the Metropolitan police and also a former special branch detective with a long history of investigating terrorist groups, had his home address and ex-directy phone number handed out by British Telecom. In spite of Lord Imbert’s position as a potential target for terrorists, the Information Commissoner’s Office never informed him of this.

Even though high-profile footballers have been the victims of burglary while playing matches, British Telecom handed out the home addresses and ex-directory phone numbers of eight members of the England football squad who played in the World Cup in Japan. They also disclosed the carefully protected home addresses of journalists such as the former editor of the News of the World, Phil Hall, and the investigative reporter Martin Short, both of whom had specialised in exposing gangsters and violent criminals. “I incurred the long-term wrath of many violent folk,” Short told the guardian. A woman who had been tracked down and raped at her secret address by her violent ex-husband then had that secret address released to journalists.

In other cases, where the physical safety of victims was not obviously in jeopardy, the victims simply suffered gross violations of their privacy. The actress Joanna Lumley was targeted repeatedly by news groups who were trying to uncover the identity of the father of her child. In one 18-month period, News International paid a total of £1,726 in five different invoices, apparently for print-outs of phone numbers she had been dialling.

The editor of Private Eye, Ian Hislop, is named in the paperwork as a victim of the notorious celebrity newspaper photographer Jason Fraser, who hired the network to obtain his phone records. Hislop says that this followed his publishing a series of stories in the magazine which criticised Fraser for invading the privacy of his subjects. Fraser reacted by invading Hislop’s privacy.

“It was fantastically vindictive,” Hislop told the Guardian. “He had my list of Friends and Family. He even had my bank manager’s number. He rang me up and just said ‘I’ve got your number’, which was ex-directory. That was when we lived in London and then we moved out, and he rang me up at our new house, too. He just wanted to gather information about me. It was rather spooky that somebody could pay a little money and have all this information about you.”

Some of the targets whose home details were obtained from British Telecom are particularly sensitive because of crimes which have been committed against them or their families, including Valerie Storie who nearly died when she was attacked in the notorious 1961 crime for which James Hanratty was hanged; Lady Pamela Hicks and separately Lord Brabourne, respectively the daughter and grandson of Lord Mountbatten, who was killed by the IRA in 1979; Frances Lawrence, whose husband, Phillip, was stabbed to death at the school where he was headmaster in 1996; and Elisa Ferraina who had died in the twin towers in September 2001.

Sometimes, the number appears to be sought simply as a matter of convenience so that a reporter can phone up for a quote, for example from the former director general of the National Trust, Sir Angus Stirling. On other occasions, it is part of a campaign of bitter harrassment. When Brian Paddick as a south London police commander was being pursued because of his life as a gay man, newspapers fished in the BT database in search of his former home addresses, apparently hoping to locate his ex-wife. When the Southampton football manager Dave Jones was wrongly accused of sex abuse during his earlier career as a care worker, a Fleet Street reporter paid Whittamore who paid his hell’s angel who rapidly acquired Jones’ home address and ex-directory number.

Among thousands of requests for confidential data, only one shows any sign of being defeated by BT’s security system, when the Mirror Group tried to obtain the ex-directory phone numbers at George Harrison’s home near Henley-on-Thames. The record of the request is marked ‘No go – security tags’.

The security of other organisations proved to be just as porous as that of British Telecom. The two bent employees at the DVLA routinely handed over personal data. Through Steve Whittamore, journalists passed them car registration numbers in search of home addresses for the fashion model Caprice; the former England football manager Glen Hoddle; a football supporter who was caught up in a riot; a man who happened to park his car at a game of cricket in which the actor Hugh Grant was playing; and Robert Kilroy-Silk’s son, just because they were interested in the state of his marriage. On one occasion, the DVLA  sources handed them the details of a Jaguar which appears to have been used as an undercover vehicle for a government department.

The civilian police worker casually rifled the police national computer, covering his tracks by recording phony reports from the public to justify each log-on and searching for dozens of criminal records, for example: for a young man who had died of a drugs overdose, who was of interest because his father is a well-known actor; of an actress who had appeared in a TV soap; the father of a Big Brother contestant; three Millwall football fans; the partner of a famous singer; and a woman who was suing her health authority.

The security around mobile phone companies was also penetrated, leaking home details, for example, for the snooker player Steve Davis and the former England footballer Tony Adams. One of the tabloids bought a photograph of a woman kissing a man who had once been married to a well-known comedienne – and the woman’s mobile phone company handed over her personal details. Frantic efforts by several different newspapers to uncover the romantic life of the former head of Ofsted, Chris Woodhead, included tricking a mobile phone company into providing his home address. In their efforts to prove that a Labour MP, Clive Betts, was having a gay relationship with a Brazilian student, journalists hired the network to trick City of London college into handing over the student’s mobile phone number and then to trick the mobile phone company into disclosing his home address.

The seized paperwork includes numerous requests for the home addresses of targets, some of which may have been found through perfectly legal searches of the electoral register. Others, however, appear to have involved accessing the social security database to find targets whose jobs exempted them from the electoral register, including a forensic psychologist working with criminals, and the then head of MI6, Sir Richard Dearlove.

The 1998 Data Protection Act would allow access to some confidential databases if the journalist were acting in the public interest, obtaining information which clearly needed to be made public. However, the public interest is not obvious in the work summaries which Whittamore listed on his weekly pay claims: “Bonking headmaster, Lonely heart, Dirty vicar, Street stars split, Miss World bonks sailor, Dodgy landlord, Judge affair, Royal maid, Witchdoctor, Footballer, TV love child, Junkie flunkie, Orgy boss, BBC gardening blunder, Hurley and Grant, East Enders star…”

In some cases, there is a strong scent of hypocrisy, for example in one Sunday paper’s exlusive story about the relationship between Miss Dynamite and her boyfriend’s former partner, Sanshica Carew. The newspaper accuses Miss Dynamite of sending hostile text messages to Sanshica who, it reports, changed her phone number and was ‘horrified’ when Miss Dynamite managed to get hold of it. That newspaper was not only routinely paying to get hold of phone numbers but, on this very story, also commissioned three illegal searches of the police national computer at £500 a time, looking for any sign of a criminal record for Miss Dynamite, her boyfriend or her manager.

There is the same strong scent around the newspapers covering the imprisonment of Michael Ahearne, formerly a star of the television programme Gladiators, who acted as a go-between for criminals who were bribing a police officer to supply information: those same newspapers were using Whittamore as a go-between for their own bribes to be paid to the civilian police worker to supply information.

Beyond the potentially illegal extractIon of information from databases, Whittamore’s network also conned information out of organisations including banks and prisons. Credit Lyonnais, for example, was tricked into handing over the home phone number of one of its clerks, who had written an email describing a recent sexual adventure. Whittamore then used the hell’s angel in his network to get the clerk’s home address out of the BT database. Goldman Sachs and the Hang Seng bank also show up as targets as well as a Los Angeles hotel where a BBC executive was suspected of entertaining his lover; a theatre where Britt Eckland was playing; various locations which might have been used for Prince Edward’s stag party; the post office who handed over the details behind PO boxes owned by the former chancellor Nigel Lawson and the jockey Kieren Fallon; and two prisons, Glen Parva and Stocken, apparently in search of information about Winston Silcott, who had been wrongly jailed for the murder of a police officer during the 1985 Tottenham riot.

This is by no means limited to the rich and powerful. The bulk of the victims appear to be ordinary people who happen to have strayed across the media’s radar. Sometimes it is because they are linked to a celebrity: the people who moved into Lady Thatcher’s former home in Dulwich, Wayne Rooney’s mother, Carol Vorderman’s brother, the former wife of the poet laureate Andrew Motion, the murderous Dr Harold Shipman’s daughter, and a man whose name happens to sound like Andrew Lloyd Webber’s. Others are simply news fodder for the week: the man who was accused of driving his van into his former girlfriend’s car, or the family whose teenaged daughter ran off with her teacher.

And, with the exception of a handful of victims who were asked to make witness statements for the ICO, none of them has ever been told. Syrita Collins-Plante complained to the Press Complaints Commission that the Sunday People had invaded her privacy and harrassed her in search of a story about the boxer Lennox Lewis, phoning her repeatedly until a police officer asked the newspaper to stop. The Press Complaints Commission ruled that her privacy had not been breached – apparently without knowing that her private address and phone number had been blagged out of British Telecom by Whittamore’s network.

Beyond that, the newspapers who commissioned this activity were never prosecuted, and attempts to prosecute Whittamore’s network ended in fiasco with Whittamore and three others receiving conditional discharges, and a trial of other members collapsing before it even started.

Post a comment.

You must be logged in to post a comment.

Back to top

>>> Archive of Nick Davies work >>> Flat Earth News is now out in paperback Flat Earth News >>> Reporting Masterclass