The mystery invoice that led to data breach probe
Dearbhail McDonald outlines the story behind the ODCE’s move to get High Court inspectors appointed to INM
ON December 18, 2015, Ryan Preston, chief financial officer of Independent News & Media (INM), received an unsolicited email from Trusted Data Solutions (TDS), a British company.
The €46,260 invoice sought payment for work done in October 2014 ‘on site’ at the editorial HQ of Ireland’s largest media company and also covered costs of shipping ‘back-up tapes’ outside of the country.
Mr Preston was concerned that there was no relevant contract or purchase order.
The invoice raised by TDS UK had not been budgeted.
According to court documents, Mr Preston made queries, only to receive an email from a colleague which said: “This invoice is not for INM.”
Months earlier, INM’s then chief executive, Robert Pitt, claims that on foot of a conversation he had with an employee, he had stopped using his company email address to record notes of events due to concerns about the privacy of his communications amid concerns INM “had a track record of reviewing former directors’ emails”.
These concerns were amplified, it is claimed, by a conversation Mr Pitt had in May 2015 with the same INM employee, during a walk that the duo took outside INM’s Talbot Street premises in Dublin.
The employee said they were “very concerned and worried about something”, namely that, unknown to the chief executive, a third party was given access to INM’s servers on the direction of INM’s then chairman, Leslie Buckley.
Mr Buckley is an associate of businessman Denis O’Brien, INM’s largest single shareholder, whose Isle of Man company, Blaydon Ltd, paid for the TDS UK invoice and another invoice associated with a data exercise conducted at INM in late 2014.
The so-called ‘data interrogation’ is one of a range of alleged corporate governance issues that forms an application, by the Office of the Director of Corporate Enforcement (ODCE), to have High Court inspectors appointed to INM, which publishes the Sunday Independent and other market-leading titles.
The appointment of High Court inspectors (the full application will be heard on April 16) is a rarity in Irish law and is a most serious matter for any company subjected to that process.
The ODCE’s year-long investigation into INM was prompted by a series of protected disclosures made to the corporate enforcement watchdog by Mr Pitt in November 2016 and August 2017.
The range of issues ODCE director Ian Drennan says inspectors are required to interrogate at INM includes potential breaches of company legislation, the Protected Disclosures Act, the Data Protection Acts and Market Abuse Regulations.
But it is the suspected data breach — whose purpose and extent the ODCE has been unable to establish in full — that goes to the very heart of the confidentiality between reporters and their sources.
Mr O’Brien has maintained a silence since the revela- tions broke in the media last weekend.
For his part, Mr Buckley, who stepped down as INM chairman last month, has castigated the now widespread coverage of Mr Drennan’s affidavit and says he will continue to work with the ODCE and “robustly defend my position against each and every allegation”.
INM has hired a former Attorney General, Paul Gallagher senior counsel, and corporate law expert Shane Murphy senior counsel to represent its largely newly constituted board and new chairman, Murdoch MacLennan.
Last Friday INM’s chief executive, Michael Doorly, poised to announce a new strategy for the group, presided over a difficult staff meeting.
Mr Doorly told staff — INM employs 815 people across the island of Ireland — that they had done nothing wrong and would emerge stronger from the controversy.
******* The data interrogation wasn’t the first thing on Mr Pitt’s mind when he made a protected disclosure to the ODCE on November 18, 2016.
Then it was a dispute with Mr Buckley over the price to be paid by INM for Newstalk, the loss-making radio station wholly owned by Mr O’Brien’s Communicorp Group, that was his concern.
Mr Pitt also said he was concerned about a proposed ‘success fee’ to be paid to Mr O’Brien’s advisory firm, Island Capital, for work carried out on the disposal of INM’s shares in APN, the Australian and New Zealand news group. The ‘success fee’ wasn’t paid and, elsewhere, was deemed appropriate in findings by independent reviewers appointed by INM.
Nonetheless, Mr Pitt disclosed both matters to the ODCE. ‘Devalero’ was the project name assigned to the aborted acquisition of Newstalk by INM whose early stage negotiations involved contested valuations ranging from €10m to €35m.
For his part, Mr Pitt valued the deal at €12m. Davy, INM’s advisers, weren’t prepared to value it at more than €14m. In contrast, IBI, advisers to Mr O’Brien’s Communicorp, valued the transaction at some €30m to €35m.
The preliminary talks were abandoned, but not before Mr Buckley allegedly told Mr Pitt and Mr Preston that a valuation of €14m was “insulting” to Mr O’Brien.
The ODCE says that, according to Mr Pitt, Mr Buckley also said at a meeting on October 20, 2016, attended by Mr Pitt, Mr Preston and Mr Buckley, that Mr O’Brien was “entitled to a reward for bailing out INM”.
“Do you not get it lads?” Mr Buckley is also alleged to have told Mr Pitt and Mr Preston at a separate meeting on October 26, 2016. In any event, the deal was never considered by INM’s board and the Newstalk acquisition did not proceed.
But the circumstances of the aborted deal, the proposed — but not paid — success fee, and the relationship between Mr O’Brien and Mr Buckley — one of three of Mr O’Brien’s nominees on INM’s board — is at the heart of the ODCE’s application to have High Court inspectors appointed to INM.
Like many a mechanic who looks under the proverbial bonnet, the perceived problem at INM — the Newstalk deal and the APN ‘success fee’ — turned out not to be the ODCE’s biggest concern in the end.
On foot of Mr Pitt’s November 2016 disclosure, the ODCE commenced an in-depth yearlong investigation into INM.
The ODCE’s investigation took an unexpected turn in August 2017 when Mr Pitt made another disclosure, this time about the ‘data interrogation’, leading to new and more devastating inquiries by the corporate enforcement watchdog. Using its powers (inspectors’ powers are more forceful and wide-ranging), the ODCE discovered that, in October 2014, INM’s back-up tapes were removed from its Talbot Street HQ.
The ODCE has been told that the back-up tapes contained content from INM’s primary data files stores and Microsoft Exchange backups and that this exercise was directed by Mr Buckley, ostensibly as part of a costreduction exercise.
The back-up tapes, according to the ODCE, were removed from INM’s Talbot Street offices and taken to another jurisdiction where they were accessed by six companies external to INM, including TDS UK.
Moreover, the ODCE has established that two invoices totalling almost €60,000 — including the TDS UK invoice — were paid by Blaydon Ltd.
Of concern is a chain of emails under the heading ‘persons of interest’ which includes a spreadsheet with 19 names including current and former journalists, former INM directors and executives.
The names of Moriarty Tribunal senior counsel Jerry Healy and Jaqueline O’Brien are also contained in the Excel spreadsheet recovered by the ODCE.
Mr Drennan also has concerns about five potentially relevant password-protected documents that the ODCE has been unable to open, despite efforts by its own forensic experts and third party expert forensic specialists to open them. The ODCE claims that inspectors are required to establish why Mr Buckley authorised the data exercise, whether Mr O’Brien was aware of it, why Blaydon settled the two invoices and who ultimately benefited from the data interrogation.
The purpose of the exercise, as advanced by Mr Buckley, was to obtain information on the amendment of a professional services contract whose cost and duration he queried.
Then acting as chairman with executive authority and with responsibility for cost reduction, Mr Buckley apparently took the view that INM should not have to incur costs in relation to the data project “in circumstances where nothing was found”.
Mr Buckley has told the ODCE that it was initially envisaged that the exercise would be a brief engagement with a relatively simple job specification, namely to recover the relevant data about the contract.
“Although I understand it later transpired that the exercise proved to be significantly more involved than initially envisaged,” he said in a statement to the ODCE dated August 16, 2017.
But the ODCE claims this explanation is difficult to reconcile with the actual searches that appear to have been conducted.
Mr Drennan also says that, in particular, certain of the apparent output of the data interrogation exercise — namely the Excel spreadsheet — does not have any obvious connection to the cost-reduction exercise appointed by the chairman.
INM is emphatic that the board was not aware of the data project, that it was never brought to its attention or ever minuted. Indeed, it seems the INM board was not aware of the data interrogation at all prior to being alerted by the ODCE — itself an alarming prospect.
Caught up in this drama are INM’s journalists and our colleagues honouring the 100-year-plus tradition of breaking news in the public interest and performing the difficult but necessary task of writing the story, even — and especially — when we became the story. Dearbhail McDonald, Group Business Editor, together with Shane Phelan, Irish Independent Legal Editor and Samantha McCaughren, Sunday Independent Business Editor, have been reporting on the suspected data breach and related governance issues at INM across the media group’s titles and platforms.
‘Of concern is a chain of emails under the heading ‘persons of interest’ ‘Appointment of High Court inspectors is a rarity in Irish law’