Claims that Independent News & Media (INM) was "entirely unaware" of the issues underlying allegations of a data breach at the company are challenged in a lengthy affidavit by the head of the Office of the Director of Corporate Enforcement (ODCE), Ian Drennan.
The 83-page affidavit was sworn last May by Mr Drennan in response to a number of others sworn on behalf of INM, most notably one by Leonard O’Hagan, the senior independent director at the media group.
The O’Hagan affidavit was itself a response to Mr Drennan’s grounding affidavit in his quest to have the High Court appoint inspectors to INM.
Mr O'Hagan had examined early claims of a data breach at INM and the alleged role of the then chairman, Leslie Buckley. He swore an affidavit in support of the company's efforts to fend off the appointment of High Court inspectors.
Subsequent to Mr Drennan’s highly critical affidavit, Mr O’Hagan responded with a second, replying affidavit in which he expressed surprise at what he termed the ODEC director’s “sustained criticism” of the INM board.
In Mr Drennan’s forensic dismantling of the original O’Hagan affidavit, the ODCE says there was “a wealth of information available to INM from August 2017” about the data breach, who allegedly ordered it and how it was financed (by a Denis O’Brien-owned Isle of Man company).
In October 2017, the board, including Mr O'Hagan, accepted an internal report, written by Deloitte, the finance and risk management consultancy, which said, in substance, that there had been a mere technical data breach at the company.
The board backed the version of events enunciated by its then chairman, Mr Buckley, a board nominee of Denis O’Brien.
INM maintained the company was unaware of the gravity of the data breach until, in the same month, it received allegedly new information – a spreadsheet detailing 19 people whose data inside INM had been interrogated by third parties.
In his affidavit, however, Mr Drennan argues forcefully that was not the case and that it had extensive information available to it “long before the ground affidavit was served on INM and INM thereby became aware of the spreadsheet”.
He goes on to remind the company that his office served a statutory requirement for explanation and assistance on INM “in which it was alerted to the ODCE’s concerns” on August 11th, 2017.
He then details the actions of Robert Pitt, INM's chief executive who, behind the scenes had been battling with Mr Buckley, first over the abortive attempt by Mr Buckley to have INM buy the Denis O'Brien-owned Newstalk FM, and then over the data breach.
On August 14th, Mr Pitt’s solicitors wrote to the INM board about data tapes that “contain a considerable amount of personal data relating to employees and others and, in the circumstances, there is a real risk that a very serious breach of the Data Protection Acts has occurred and that same should be forthwith reported to the Office of the Data Protection Commissioner”.
On August 15th, Mr Pitt’s solicitors wrote again urging all INM directors to “obtain all information on this matter immediately”.
On August 22nd, Mr Pitt emailed all board members "and expressed serious concerns". He made references to Derek Mizak and John Henry, two non-INM employees to whom the personal data had been given, allegedly on Mr Buckley's orders.
Mr Drennan's affidavit states: "Mr Pitt also drew the board's attention to, inter alia, the nature of the data he believed to have been extracted ('large indiscriminate quantities of data comprising emails and records') and to [INM's IT director] Mr [Gerry] Wilde's understanding of the persons searched (ie, 'former directors and employees and possibly legal advisers of the company' and references [former INM chief executive] Mr Gavin O'Reilly, [former INM executive and journalist] Mr Karl Brophy and [former INM solicitor] Mr Simon McAleese)."
Mr Drennan said the board of INM had been told by Mr Pitt that “large indiscriminate quantities of data, which most likely included personal data, was removed from INM’s control and reconstituted elsewhere in the hands of third parties and that this had been done at the instance of the then chairman”.
Mr Drennan says that on August 22nd, Mr Pitt told the board that Blaydon, the company owned by Mr O'Brien, the 29 per cent major shareholder in INM, had paid for what had been done.
Affidavit’s key points
Mr Drennan said that, as a result, and contrary to Mr O’Hagan’s assertions, in August 2017, INM:
– knew of the data breach and that the data had been sent outside the jurisdiction of Ireland;
– knew that “large and indiscriminate” amounts of data had been removed;
– knew that the people doing this “were not employees or persons under the control of INM”;
– knew of Mr Pitt’s concerns about Mr Buckley;
– and “perhaps most critically” knew what Mr Wilde had told Mr Pitt. This was that data of former directors, employees and legal advisers had been searched, for the benefit of a third party/parties; that it was done “under severe pressure from” Mr Buckley; that other IT employees inside INM did not know;
– knew that Mr Wilde was told by Mr Buckley not to tell Mr Pitt what had been done.
Finally, Mr Drennan said, the board of INM “knew that a company associated with the major shareholder [Denis O’Brien] had paid for this; [and] it knew that its chief executive officer was raising concerns that the former chairman had told Dr O’Hagan that he (ie, the former chairman) had paid for the interrogation”.
Mr Drennan says the absence of reference in Mr O’Hagan’s affidavit to Mr Pitt’s August 22nd letter to the board “is a significant omission”.
“Given the information available to INM, which ought to have caused it concern in respect of the data interrogation – not least the fact that associated costs were discharged by Blaydon Ltd for reasons that the board did not understand – I find it, frankly, concerning that Dr O’Hagan . . . should make averments [legalese for an assertion] of this nature.”
O’Hagan’s reply
In reply, Mr O’Hagan says that, after disclosures in November and December 2016, the INM board set up a committee and then had “an independent review” of the allegations.
“Distinguished and highly experienced experts were appointed as independent reviewers and they conducted a lengthy and detailed review and made findings and recommendations,” said Mr O’Hagan. “The board accepted their recommendations in full.”
He said that when the “data interrogation matter came to the attention of the board in August 2017, INM notified the issue to the ODPC [Office of the Data Protection Commission] on 24 August 2017 and appointed Deloitte to investigate”.
Mr O’Hagan charges that prior to August 2017, Mr Pitt had not raised concerns about data interrogation during the “protracted independent review process”.
He alleges that Mr Pitt’s “sudden report to the ODCE” appears “to be a reaction to the outcome of the independent review, just as his previous disclosures appeared to be a reaction to the fact that his role as CEO had not been a success and was in jeopardy”.
