INM data breach: ex-CEO shares details with Data Commissioner

The Data Protection Commission is examining voluntary disclosures received as part of its investigation into the alleged removal of data from the emails of journalists and others at Independent News & Media.

Helen Dixon, the commissioner, said her office was looking into "a number of" disclosures it had "requested and received from a number of parties relevant to the inquiry" into the media company and this was leading to "very much an evolving picture".

She declined to comment on a report in the Sunday Business Post that her office was examining claims that the computer hard drives of up to six editors at the newspaper group were taken by the company at night and copied without their knowledge as part of an investigation into an alleged leak of an email to another publication.

The newspaper reported that in 2015 the company looked at the computers of five or six journalists in an effort to find out whether they had leaked details in an email sent by the personal assistant to INM's then chief executive Robert Pitt to various editors at the group to news and current affairs magazine the Phoenix.

Newstalk makes Kieran Cuddihy permanent breakfast co-host

---

Thomson Reuters to axe 12% of workforce

---

Denis O’Brien stopped payments to FAI in 2016

---

Netflix’s next big push is on kids’ content

---

The email was sent to the editors to inform them that the publisher of an autobiography by UK media mogul Richard Desmond was going to send them copies of the book for review in the group's newspapers.

The interrogation of the computers is reported to have been managed by Derek Mizak, an outside IT consultant who carried out an interrogation of data at the centre of an earlier data breach.

It is believed that Pitt revealed details of the search for the source of the alleged leak as part of his disclosures to the company. The incident was the first time Mr Pitt became aware that Mr Mizak was carrying out data interrogation for INM. He insisted that any searches of staff emails had to be done on the premises, and data could not be removed from its offices.

A spokesman for INM said that the company was not commenting on the report.

Emails accessed

On the latest revelations, Ms Dixon said: “We are a examining a number of voluntary disclosures we have requested and received from a number of parties relevant to the inquiry. So it is very much an evolving picture on which we cannot comment specifically right now.”

She said that it was difficult to say when her office’s statutory investigation would be concluded as “matters are evolving”. The office has a senior investigator – a qualified barrister on its staff – leading the investigation and “a number of resources assigned to him actively progressing the inquiry”.

Former Sunday Independent editor Anne Harris, who left INM in late 2014, confirmed that she had shared information with Ms Dixon's office. She says she was told by INM management that her emails were accessed in 2013 as part of an investigation into the leaking of an editorial charter for journalists to The Irish Times.

“I was informed by INM management that my emails had been accessed without reference to me, without any authorisation from me in the spring of 2013,” she said.

Ms Harris said she shared correspondence she had received from INM with the commissioner’s office after the company “started to stonewall” when she asked questions in correspondence since last year about whether her data was shared with third parties, why and when it was shared and who authorised it.

The latest revelations about INM widen the period of alleged data breaches beyond suspected breaches in October 2014, which were among the reasons why the High Court appointed inspectors to the company.

The court appointed inspectors to carry out an investigation into the alleged breaches and other matters on an application by the State’s corporate law watchdog, the Office of the Director of Corporate Enforcement.

String of resignations

The controversy has led to a stream of resignations from the board of the company since it emerged that at least 19 individuals, including current and former INM journalists and executives, had their private data removed.

Ms Harris was not among the 19 individuals listed in court papers submitted by the ODCE.

INM is suing its former chairman Leslie Buckley over the circumstances surrounding the alleged data breach, which involved information in company emails being taken out of the country and examined by outside firms.

The ODCE has alleged that Mr Buckley oversaw the operation, which the INM board said it had no knowledge of, to extract data, including the contents of journalists’ emails, from back-up IT tapes at INM.

Details of the breach were disclosed by Mr Pitt in a voluntary disclosure to the ODCE. He said he told the board that Blaydon, a company controlled by Mr O'Brien, paid for the data to be extracted from the company.

Mr Buckley, a nominee of INM’s largest shareholder, Denis O’Brien, stepped down from the company’s board in March. He has said he plans to fully and robustly defend himself against each and every allegation.

INM journalists responded with concern to the latest reports about further alleged breaches.

"Worrying development," tweeted INM's deputy political editor Philip Ryan. "The quicker this is resolved the better for all the hard-working journalists who work for the company."

"Hear hear," tweeted the company's group political editor Kevin Doyle in response. "Full answers needed sooner rather than later."