Cybersecurity expert ‘was given desk at INM for data removal’

A cyber-security expert hired on behalf of then-chairman Leslie Buckley to extract Independent News and Media's (INM) backup IT tapes was given a desk and had free access to the company's premises to set up the operation, court papers show.

The removal of the tapes and their subsequent “interrogation” for information on at least 19 individuals, including journalists and lawyers, is now at the centre of an investigation by the State’s corporate watchdog into a major suspected data breach at INM.

The Office of the Director of Corporate Enforcement (ODCE) has asked the High Court to appoint inspectors to INM to further the investigation, after the watchdog expressed "doubts" over Mr Buckley's explanation of events.

Exchanges

Text exchanges outlined in the court papers submitted by the ODCE show that the physical extraction of the data appears to have started on October 8th, 2014.

Watchdog alleges Buckley may have shared ‘inside information’ with O’Brien

---

INM saga drifts on and catches more people in its tentacles

---

Irish television producer signs deal to create ‘big laughs’ on Sky

---

INM investor wants company to buy back O’Brien’s stake

---

Mr Buckley texted his personal security consultant, John Henry, whom the ODCE suspects "ran" the data interrogation, to ask if "all is ok" with Mr Mizak's arrival on-site that day.

Mr Henry replied that Mr Mizak had "free access" and would begin preparations for removing the back-up tapes the following day.

Subsequently, it appears the extraction of the tapes turned into a difficult and protracted affair over several weeks, and Mr Mizak complained he was meeting resistance from within INM to his requests for the tapes.

"I am waiting for backup tapes from Citywest [the location of INM's printing facility] to be delivered since Wednesday. Strange reasons given why they are not here," Mr Mizak texted to Mr Henry on October 13th.

Mr Mizak added that he suspected “those guys are buying time, hoping we will get tired, and suggested “we should have a chat with boss” to ask for extra help.

About 10 days later, the messages in the court papers show, Mr Henry went to Dublin airport to pick up an engineer from TDS, the Welsh company that is alleged to have subsequently “interrogated” the data tapes.

"Specialist equipment" to assist in the operation was delivered to INM's headquarters by Mr Henry the following day. By October 30th, the engineer returned to Wales.

Mr Henry and Mr Buckley then discussed how to get some of the tapes to Wales, where Mr Henry indicated they would be worked on for seven days.

Tapes

In an exchange highlighted by the ODCE, Mr Henry informed Mr Buckley that INM’s head of IT would be told the tapes were being taken to Wales “to reduce significant cost”, as otherwise the TDS engineer would have to be in Dublin for up to six weeks.

Mr Henry and Mr Buckley continued to correspond about the operation over the next several weeks. The messages in the court papers suggest a courier collected more “items” from INM in November.

All of the backup tapes were returned to the company by December.

Over the next three months, Mr Henry kept Mr Buckley updated on data that was extracted from the tapes by staff from TDS.

The ODCE alleges that Blaydon, a company controlled by INM's major shareholder, Denis O'Brien, paid for the data interrogation. The watchdog expressed "doubts" in its court papers about Mr Buckley's explanation that the operation was conducted to assist a purported "cost reduction exercise".

Mr Buckley has said he will defend himself against all allegations. The application for inspectors is due back before the High Court on May 9th, when INM will seek a judicial review to block the process. The company declined to comment last night.

Mr Mizak said he could not comment as it would “breach client confidentiality”. Mr Henry made no response to a request for comment.

Text messages between Leslie Buckley and John Henry

Text messages between then Independent News & Media chairman Leslie Buckley (LB) and John Henry (JH), the outside security consultant he asked to manage the removal and interrogation of data from the company

5.43pm, October 8th, 2014

LB to JH: "John is all ok with Derrick [sic, Derek Mizak, another IT consultant involved in the data interrogation] Leslie

JH to LB: "Hi Leslie. All ok and has desk and free access. He will be starting feasibility tomorrow in relation to back up tapes and retrieval."

11.21am, October 13th, 2014

JH forwards by text to LB what appears to be a message sent by some involved in the technical aspects of the project, possibly Mizak. Sender tells JH that he has been waiting for back-up tapes to be delivered from INM's offices in Citywest, Dublin since Wednesday. "Strange reasons given why they are not here yet," he says. Sender says he has been looking for mailbox for a named individual. "Still don't have it. Based on my previous experience it looks to me that those guys are buying time, hoping that we will get tired. Without full cooperation my work is very very slow. If this will not improve by the close of business today, we should have a chat with boss and suggest maybe give me another hand/help for this search or possible to talk to main man here."

Texts sent by JH to LB that same day:

“Just looking at [initials of a person’s] archive mailbox with mails going back to 1999!!!! Yuppie!!!!”

“Will have 39354 [ person’s ]emails”

“Making some progress. Have solution to set stuff out as well. Got tapes. Talk later.”

2.51pm, October 23rd, 2014

JH tells LB that "eng" picked up something this morning and that he will be in a particular location for the next five days.

9.05am, October 30th, 2014

JH tells LB that the "operator" has returned to Wales and that he will attach a proposal to move tapes to Wales "in order that significant cost reduction can take place." He says the tapes will have to be in facility for about seven days before being returned to Dublin. He says INM's IT director "would be told it is to reduce significant cost" as another IT consultant would have to be in Dublin for at least four to six weeks.

11.05am, December 1st, 2014

JH tells LB: "Items in Cardiff"

1.41pm, December 12th, 2014

JH shares two texts with LB which appear to be from someone involved in the technical aspects of the project, possible Mizak. "John, I know that I don't have any hard evidence for any wrong doing [SIC]but all of this looks like someone do [ sic ]not want to disclose all of the sources of information we are looking for. It does look like some information could be hidden from me or even sanitised."

1.54pm, March 2nd, 2015

JH to LB: "Hi Leslie, could we discuss [named individual]. May have something. Talk face to face rather than phone."

12.50pm, December 11th, 2015

JH to LB: "Hi Leslie. Spoke with [named individual] and went through details etc. Am meeting him next week in order that I can get additional info from his wife. Wasn't convinced and he was very agitated. I will follow through respectfully and report asap. Regards JH"