After 868 pages and €5.67 million, the reason 19 names were searched in INM data breach remains a mystery

“In many respects the purpose and extent of the data interrogation was and remains unknown to the company, and the company awaits the Inspectors’ findings in that regard.”

This was the view of Independent News & Media (INM), now known as the media group Mediahuis, in a submission to the inspectors whose report was published on Wednesday.

Like many who have been waiting for the extraordinary events inside the group to be explained, the authors of the INM submission may be disappointed by the 868-page report the two inspectors, Irish senior counsel Sean Gillane and British solicitor Robert Fleck, have produced at a cost of €5.67 million to the State’s Corporate Enforcement Authority.

No explanation – at least none they found convincing – was given to the inspectors about why the email data in one of the State’s largest media groups came to be interrogated in the way it was.

The inspectors, appointed in 2018 to investigate this and other matters, decided not to speculate in their report as to the reasons behind the exercise, which the Data Protection Commission, the State’s data privacy watchdog, concluded in 2021 breached data privacy law and had no legal basis.

The details of what happened are well rehearsed in the report. In late 2014, when Denis O’Brien was INM’s largest shareholder, the then executive chairman Leslie Buckley engaged a cyber consultant not just tosearch the INM computer server but eventually to export backup tapes to Wales in two high-impact resistant pelican cases so a “library” could be created and interrogated off-site.

Lists of names were drafted as part of this exercise, including one of 19 names that included two barristers who had worked on the years-long Moriarty tribunal investigation into the awarding of the State’s second mobile phone licence to O’Brien.

O’Brien appointed Buckley to the board of INM in 2012 after O’Brien had replaced the late Tony O’Reilly as the media company’s dominant shareholder. O’Brien viewed the Independent’s coverage of him under O’Reilly as having been unfairly negative, and some of the people who had been involved in that coverage were still working at INM. Buckley, the report makes clear, harboured suspicions about some people still working in the company.

The 2014/2015 data breach at INM, authorised by Buckley, involved cyber consultant Derek Mizak, who was recommended to Buckley by a security consultant called John Henry. Buckley knew Henry, a former Irish soldier, from security work he did for a charity in Haiti established by Buckley, and Henry was also well known to O’Brien.

“Mr O’Brien told us he first met Mr J. Henry over 20 years ago when, following intrusions at his home, it became clear that he and his family needed security,” the inspectors said.

“Over the intervening period, Mr Henry has provided security to Mr O’Brien’s business interests in certain overseas locations … Mr O’Brien told us that Mr Buckley managed the relationship with Mr Henry.”

According to Buckley, in late 2014, as part of a cost-cutting exercise, he was anxious to terminate the contract INM had with its long-time legal adviser, solicitor (now Circuit Court judge) Simon McAleese. Buckley sought emails from the INM system relating to the contract and, he said, when one email couldn’t be found, decided to engage Mizak.

Asked by inspector Sean Gillane SC whether he considered going to McAleese to get the background to the contract, Buckley said no.

“I felt at that stage there was something wrong going on,” he said. “Meeting Mr McAleese wasn’t going to help me.”

Contacting Gavin O’Reilly, the former INM chief executive who had left the previous year, “certainly wasn’t going to help me,” he said. Buckley said he was concerned about the fact that the email could not be found.

“Whatever was happening at that stage, you know, was pretty serious and we weren’t going to get anything from him and that was it,” Buckley said.

McAleese told the inspectors he would have handed over the correspondence relating to his contract to INM if asked. He gave the inspectors a copy of the email that Buckley had not been able to locate on the INM server.

In time Buckley authorised the widening of Mizak’s interrogation of the INM data. Buckley told the inspectors the inability to find the McAleese email led him to think “this is much bigger than I thought”. Mizak told Buckley it would help if INM back up tapes were moved to a facility in Wales operated by a group called Trusted Data Solutions, where a “library” could be established, and the data then returned.

Buckley authorised this. Asked by Gillane whether he was “spending a pound to save a shilling”, Buckley said what had started as a cost-cutting exercise had become “this big issue of this email not being found … were company funds being misused, and who else was involved in this process. And are there people within the company that really are still involved in that process.”

Mizak compiled four lists of names to be used by Trusted Data Solutions, only one of which, dated February 2015, was seen by the inspectors, the others having been destroyed. The list of 19 included the names of the tribunal barristers, journalists, public relations officials, Gavin O’Reilly and others. Public disclosure of the list in 2018 caused enormous controversy.

The inspectors asked the INM directors from 2018 for their reaction when they heard about the list.

“Horrified. Absolutely completely horrified,” said Len O’Hagan. “You think you know people, you think you know their failings and all the rest of it. But that was just something.”

Another director, Terry Buckley, said he was “astonished” because the list of names “suggested that the data interrogation was far different to what” Buckley had told them. David Harrison said it was “probably one of the most serious matters that I have ever, ever encountered. This is a newspaper that relies on tip-offs and confidentiality of sources. So you’re immediately worried that may have been compromised in some way. It’s the goodwill of the business.”

O’Brien told the inspectors he knew about Buckley’s interest in the McAleese contract but knew nothing at the time about Mizak’s interrogation of the INM data. He first learned about the list of names, he said, when he read about it in the newspapers in April 2018. He immediately called Buckley.

“I was absolutely shocked,” Buckley told the inspectors. He was in Cork when he got the call from O’Brien and found a report on the matter in The Irish Times. “I was shocked, really shocked.”

Under cross-examination, Buckley was asked whether it was his evidence that Mizak created the list “purely off his own bat without any direction from you? Is that what you’re saying?”

Buckley replied: “Absolutely.”

The inspectors found that by early 2015 Buckley knew it would not be possible to terminate the McAleese contract and the continuing interrogation of the INM data, which continued to late 2015, had to have a different purpose.

In January 2015 O’Brien had sent an email to Buckley urging him to transfer INM’s legal work to solicitor Paul Meagher, a long-time associate of O’Brien’s who did legal work for O’Brien’s radio interests. Buckley replied saying that unfortunately there was “no paper trail” that would assist in breaking the McAleese contract.

[ Timeline – the Independent News & Media data breach and its falloutOpens in new window ]

In their report, the inspectors said that as they were not persuaded by Mizak’s explanations as to how he generated the 19 names, and in the absence of other evidence, “and bearing in mind the very serious nature of the allegation and the degree of care which we have to exercise in reaching a conclusion, we do not think it would be appropriate to speculate on how the list of 19 persons of interest or any other lists were compiled.”

More definitive conclusions were reached in relation to other matters, including two where Buckley was accused of acting in a fraudulent way that sought to favour O’Brien’s interests over those of the INM shareholders generally. In both instances the inspectors said the evidence did not support the allegations. Both O’Brien and Buckley welcomed the inspectors’ report, with O’Brien saying his legal costs were €2.6 million and he expected the overall cost of the inquiry, which began in 2018 but was delayed by the Covid pandemic, to be in the region of €40 million.

Gavin O’Reilly, who was not interviewed by the inspectors, described their report in a short statement to The Irish Times as “weird”. INM was sold to the Belgian media group, Mediahuis, in 2019.

[ The Irish Times view on the INM report: questions of governanceOpens in new window ]