Private Investigators: follow-up correspondence 30 March ... · Private Investigators inquiry As you will be aware, the Home Affairs Committee is currently conducting an inquiry into

Private Investigators: follow-up correspondence

30 March 2012: Letter from the Chair to Trevor Pearce

25 April 2012 : Letter from Trevor Pearce to the Chair

24 June 2013 : Letters from the Chair to Sir Ian Andrews

25 June 2013: Letter from the Chair to Sir Ian Andrews

26 June 2013 Letter from Trevor Pearce to the Chair (with confidential Report – not reproduced here)

26 June 2013 Letter from Sir Ian Andrews to the Chair

1 July 2013: Letter from Sir Ian Andrews to the Chair

2 July 2013: Letter from Trevor Pearce to the Chair (with redacted Report– not reproduced here)

3 July 2013: Letter from the Chair to Trevor Pearce

8 July 2013: Letter from Trevor Pearce to the Chair


12 July 2013: Letter from Keith Bristow, Dir. Gen., National Crime Agency, to the Chair

17 July 2013 : Letter from the Chair to Sir Ian Andrews


(with confidential lists – not reproduced here)



30 July 2013: Email from Charles Yates to the Chair

1 August 2013: Letter from Sir Ian Andrews to the Chair

8 August 2013: Letter from Trevor Pearce to the Chair

16 August 2013: Letter from Trevor Pearce to the Chair

30 August 2013: Letter from Commander Neil Basu to the Chair (with confidential appendices – not reproduced here)

2 September 2013: Letter from Trevor Pearce to James Clappison MP

5 September 2013: Letter from Christopher Graham, Information Commissioner to the Chair

6 September 2013: Letter from Trevor Pearce to the Chair

10 September 2013: Letter from Stephen Rimmer to the Chair

Letter from the Chair of the Committee, to Trevor Pearce QPM, Director General, Serious Organised Crime Agency, 30 March 2012

Private Investigators inquiry

As you will be aware, the Home Affairs Committee is currently conducting an inquiry into the possible regulation of private investigators.

I am writing to a request a copy of the SOCA report Private Investigators: The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data, which was reported by Channel 4 News yesterday.

I believe that this document would be most useful in helping the Committee come to fully informed conclusions about the regulation of private investigators in the UK.

I look forward to receiving your response by noon on 5 April.

Rt Hon Keith Vaz MP Chair of the Committee

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 25 April 2012

SOCA Report: Private Investigators: The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data

I am writing further to your letter of 30 March and our subsequent telephone conversation on 19 April in which we agreed the handling issues of the above 'Confidential' report. I can confirm that the Home Office are sighted on these arrangements.

I have asked Martin Molloy, SOCA's Deputy Director Prevention, to make contact with your office to make the necessary arrangements for you to view, in a controlled environment, a copy of the 'Confidential' report together with a redacted 'Not Protectively Marked' (NPM) version. We are happy for the 'NPM' report to be shared with HASC colleagues to help them with their inquiry into the possible regulation of private investigators.

Trevor Pearce QPM, Director General, Serious Organised Crime Agency

Letter from the Chair of the Committee, to Sir Ian Andrews, Chair, Serious Organised Crime Agency, 24 June 2013

Private Investigators

I am writing to you regarding the Home Affairs Select Committee’s inquiry into Private Investigators.

You will be aware of the article in the Independent newspaper on Saturday 22 June regarding the SOCA report “The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data”.

I would be most grateful if you could provide the Committee with the full, un-redacted version of this report by Thursday 27 June.


Follow-up letter from the Chair of the Committee, to Sir Ian Andrews, Chair, Serious Organised Crime Agency, 24 June 2013



Further to my previous letter, and the report in The Independent on 22 June regarding the SOCA report “The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data”. I would be most grateful if you could provide the Committee with a list of clients who hired Private Investigators to break the law that SOCA is aware of.

It would be very helpful if you could respond by 28 June 2013.


Letter from the Chair of the Committee, to Sir Ian Andrews, Chair, Serious Organised Crime Agency, 25 June 2013



Further to my previous letter, I would be most grateful if you could provide the Committee with all the information SOCA holds on private investigators and their links with the police and private sector.

It would be very helpful if you could respond by midday on 1 July 2013.


Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 26 June 2013

Private Investigators The SOCA Chair has asked me to respond to your letter of 24 June 2013 as it relates to operational issues. A copy of the SOCA report "The Rogue Element of the Private Investigation Industry and Other Unlawfully Trading in Personal Data", as requested, is being hand delivered to the committee offices today. You will recall that, following a phone conversation between us on 19 April 2012, it was agreed that we would provide you personally with a confidential version of the report, as well as a not protectively marked version of the report for use by the Committee as it took forward its inquiry into private investigators. Accordingly, on 1 May 2012 a copy of the confidential report was hand delivered by SOCA Deputy Director Martin Molloy for you to read. A not protectively marked version of the report together with not protectively marked information on a number of law enforcement operations focussing on private investigators, including SOCA Operation Millipede which was undertaken after the SOCA report was produced, was also provided. The not protectively marked report has been available on SOCA's website since July 201 2. In session on 22 May 2012 you referred to the fact that the committee had obtained a copy of the report from SOCA (0462 refers). In light of media commentary in recent days, it may be useful if I highlight some of the background to the report. SOCA produced it in 2008. It was based on analysis of pre existing law enforcement operations, to identify the types of offences committed by private investigators, their modus operandi and the key enablers which supported their activities. The purpose of the report was to identify for policy makers and law enforcement partners future intervention opportunities to address the threat posed by unscrupulous members of the private investigation industry. The report was forwarded to the Home Office and the Police Service and it was referenced in the SOCA Annual Report 2008-09. Operational activity continued following publication of the report. In addition, SOCA issued Alerts to the banking and telecommunications industries to raise awareness of the threat from the acquisition of personal data by private investigators. We also provided written evidence to the committee's inquiry on private investigators on 10 February 2012, again at confidential, with your agreement. This made mention of the report. The report remains confidential under the Government Protective Marking System (GPMS), and therefore the handling requirements that previously applied remain. If it is wished to show it to anyone other than members of the committee and clerks to the committee, I would ask you to revert back to us for approval. The document should be kept in accordance with the requirements of the GPMS. SOCA requirements in respect of the storage of confidential material is that it is kept in a safe in a locked room, within a secure building and that the document should not be left unattended on a desk at any time. We will respond separately to your second letter of 24 June, and your letter of 25 June asking for a list of clients who hired private investigators to break the law that SOCA is aware of; and for all information that SOCA holds on private investigators and their links with the public and private sector. Trevor Pearce, Director General Serious Organised Crime Agency

Letter from Sir Ian Andrews, Chair, Serious Organised Crime Agency, to the Chair of the Committee, 26 June 2013

Private Investigators Thank you for your various recent letters to me on the subject of the Committee's Inquiry into private investigators. Trevor Pearce responded to your first letter of 24 June earlier today. I am responding to your second of that date and also to your subsequent letter of 25 June. I understand that you have asked SOCA to provide evidence to the Committee on Tuesday 2 July. We welcome the opportunity to explain the Agency's understanding of the threat posed by private investigators and will of course continue to engage with the Committee's work on this important subject. From the material you saw on 1 May last year, you will appreciate the sensitive nature of much of the information that SOCA holds on private investigators and, in particular, that which relates to ongoing operational activity. I suggest that the Committee might find it helpful to receive a confidential briefing, which would have to take place on a SOCA site, on the subject of the links between private investigators and the public and private sectors, to augment the written evidence we provided on 10 February 2012. This would enable us to go into more detail than would be appropriate for the public evidence session. We would also be able to provide the Committee with a sensitive briefing on the nature of links between private investigators and organised criminals. If you would wish to take up this opportunity, I should be pleased to make the necessary arrangements at a time convenient to you. Sir Ian Andrews, Chair Serious Organised Crime Agency

Letter from Sir Ian Andrews, Chair, Serious Organised Crime Agency, to the Chair of the Committee, 1 July 2013

Private Investigators I am writing to you further, ahead of my appearance with Trevor Pearce at your Committee tomorrow, to set out clearly the background to the 2008 SOCA report "The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data". I know that Trevor is writing to you separately and further to his letter of last Thursday on the subject of making the report available at a Not Protectively Marked level, and also to provide the Committee with more details of SOCA activity against private investigators. The report was commissioned to identify for policy makers and law enforcement partners intervention opportunities to address the threat posed by unscrupulous members of the private investigation industry. It informed the then government's consultation process launched in August 2007 on whether to regulate "Private Investigation and Precognition Agents" as provided for in the Private Security Industry Act of 2001. It was, if you like, a "review of the information available to law enforcement" based on a snapshot examination as at the end of September 2007 of information derived in the process of five law enforcement operations, three of which were being conducted by the Metropolitan Police Service (MPS), and additional information from the Information Commissioner's Office (ICO). A number of these cases had, or subsequently have, resulted in prosecution and conviction of the individuals concerned. In September 2008, the then government announced its intention to introduce regulation. The statement at the time specifically acknowledged that SOCA had both provided evidence of the level of risk (along with other law enforcement agencies) and had subsequently pressed the case for a regime based on competency criteria to "improve levels of compliance, and discourage unlawful or unethical practices" such as the accessing of data or other information. Licence holders would be both "fit and proper'' and demonstrably competent, although it was recognised that regulation would not completely eliminate unlawful or unethical activity. The report was correctly classified CONFIDENTIAL at the time because compromise of the information could have impeded the investigation of serious crime and caused damage to operational effectiveness. A Not Protectively Marked version was subsequently produced which, as your Committee's Report on Private Investigators published on 6 July last year stated, is "freely available on the SOCA website". This includes the statement that:

"The clients of private investigators can be categorised mainly, but not exclusively, as follows: a. domestic - persons seeking to discover activities of their partners, mainly in matrimonial or family proceedings; b. debt recovery tracing - seeking to discover the locations of debtors; c. insurance claim -loss adjusters investigating the veracity of claims; d. media - seeking material for "scoops" about high profile figures; e. criminal fraternity- the frustration of law enforcement."

The report did not make any comment on the scale of use by any of the categories identified. It is not within SOCA's remit to investigate unlawful activity by Private Investigators unless it is as part of the facilitation of activities within the scope of the Home Secretary's current strategic priorities. Trevor's letter sets this out in more detail and describes activity that has taken place within this remit. Were SOCA officers to become aware of such practices as a bi-product of another investigation they would pass the information to the appropriate law enforcement or regulatory authority. Sir Ian Andrews, Chair Serious Organised Crime Agency

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 2 July 2013

Private Investigators I am writing further to my letter of 27 June on whether the report “The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data" could be made available at Not Protectively Marked level, ahead of the SOCA Chair and I appearing before the Committee later today. I have risk assessed the confidential RIVERSIDE report, and consulted with partners as to its potential release at Not Protectively Marked. I attach a Not Protectively Marked version of the report for use in public. This contains a small number of redactions required by the Metropolitan Police Service (MPS) and SOCA for operational reasons or due to commercial sensitivities or data protection. The reasons for the redactions are footnoted to ensure transparency. I also want to take the opportunity to provide clarity on what SOCA has done against the threat of private investigators which the Committee's report has rightly identified as an issue. Intelligence indicates that some private investigators continue to work as the proxies of organised criminal groups and there is a continued threat from them to law enforcement operations, information and assets, particularly from those who have knowledge and experience of law enforcement or relevant military covert tactics and techniques and are prepared to exploit these for criminal ends. However, the period 2009-2012 saw a reduction in intelligence reporting received by SOCA and Law Enforcement partners from across the UK concerning the threat posed to law enforcement from Private Investigators. There may be a number of reasons for this, including negative post-Leveson image in the media, combined with enforcement action by the Information Commissioner's Office and UK law enforcement, which may have had a deterrent effect on the demand for the unlawful services that some PIs provide. It may, however, be the case that enforcement activity has displaced the threat rather than nullified it. SOCA's strategic priorities are set by the Home Secretary. Its priority threat areas are drugs, cyber crime, firearms, organised immigration crime and fraud. Its activity in relation to Private Investigators therefore is to (a) ensure that others in government and law enforcement know about the problem and to (b) pursue those instances of it which arise in operations tasked under the umbrella of those priorities, where it serves as an enabler of organised crime. On the first of these, (a) ensuring that others in government and law enforcement know about the problem: SOCA has informed appropriate authorities of its nature in a comprehensive and timely manner in line with its responsibilities to assess the overall threats from serious organised crime to the UK. It is then for others to act as appropriate according to their own operational priorities. It has:

• developed intelligence, such as that in the 2008 report, on the threat posed by private investigators, for use by a range of partners;

• at the beginning of February 2008 the RIVERSIDE report was sent to the Home Office. It was also then sent to ACPO and the MPS. SOCA subsequently engaged closely with the Home Office and the Security Industry Authority (SIA) to inform the case for, and scope areas to develop the proposed regulation. SOCA's Annual Report for 2008/09, notes that 'strong evidence provided by SOCA about the threat posed to the UK by corrupt private investigators helped inform a decision in September 2008 by Home Office Ministers' to introduce the licensing of the private investigation industry1;

• held discussions with ICO on PIs and the related threat in July 2008; • SOCA had discussions, in October 2008, with the Ministry of Justice about

strengthening the penalty under s55 of the Data Protection Act to two years 1 The 2007/08 Impact Assessment of Regulations to Implement the PSI Act 2001 in respect of Private Investigators and Precognition Agents, published on the Home Office website, references that SOCA provided evidence of a level of risk associated with criminal activity which supports the need for licensing.

imprisonment to increase the risk to unlawful acquisition of data not captured under RIPA. In December 2009 SOCA also made submissions to the MoJ consultation (CP22/09) on this issue;

• issued information to public-sector data controllers highlighting the threat from PIs to confidential data in 20082;

• in 2008, issued an Alert to private sector organisations most affected by illegal activities conducted by Pls. This detailed the techniques used and key vulnerabilities. 3 The release of the document was followed with a series of visits and interviews with senior security managers within the Telecom and Banking sectors. This initiative had a tangible effect on training and security awareness for vulnerable staff;

• released a further alert in 2010 to the private sector detailing the threat of criminals, including PIs, using social engineering to obtain personal data;

• released an alert, in December 201 1, in collaboration with Ofcom, highlighting the risks of criminals obtaining surveillance, counter-surveillance and protective security equipment to frustrate law enforcement, and seeking the reporting of suspicious activity;

• provided ongoing support to MPS operation TULETA, providing full access to material SOCA had seized in one of its operations, all original computers, in addition to forensically produced hard drive images, original statements and documentary exhibits as required. Access was provided to SOCA officers for further statements and queries:

• in line with an action for SOCA in the Government's Organised Crime Strategy, in October 2012 SOCA provided the Home Office with an assessment of the extent of corruption by organised criminals in the public and private sectors and recommend ways for addressing it.

On (b) pursuing those instances of corrupt private investigators that arise:

• in line with the Integrated Operating Model, SOCA ensures it has operational activity against all the organised criminals against which it leads. This will include those where there are identified links to private investigators4;

• in a SOCA operation concerning drug trafficking and money laundering, it was identified in early 2008, that the organised crime group was utilising the services of a number of PIs, one whom was a former MPS and SERCS officer. The PI was identified transporting drug money, later arrested and imprisoned;

• in February 2012 four private investigators were convicted and sentenced for committing fraud by false representation, under offences which were introduced in the 2006 Fraud Act. The case involved the illegal acquisition of confidential information. Philip Campbell Smith, Adam Spears and Graham Freeman used the services of Daniel Summers, an expert in a technique known as blagging, to acquire personal and financial information on behalf of corporate clients and private individuals. SOCA's investigation into the four men began when it received intelligence that Summers' computer may have had information about criminal activity stored on it. When Summers put his computer up for sale, an undercover SOCA officer succeeded in buying it from him for £590 cash. Following the seizure of a number of computers, SOCA's forensic analysts retrieved files showing that Philip Campbell Smith, Adam Speers and Graham Freeman has been tasking a fourth person, Daniel Summers, to obtain confidential information for payment.

I look forward to explaining further SOCA's involvement in these matters in session today.

Trevor Pearce, Director General Serious Organised Crime Agency

2 Communities and local Government: DVLA; DWP; HMRC; Home Office; ICO: National Anti-Fraud Network; Royal Mail and SIA. 3 Association of Payment & Clearing Services; British Banking Association; Building Societies Association; Council of Mortgage Lenders; Credit Industry Fraud Avoidance Scheme. It was also sent to the Financial Services Authority. 4 A multi-agency approach to improving prioritisation activity and an agreed set of principles to determine which agency should have primary responsibility for taking action against identified organised crime groups.

Letter from the Chair of the Committee, to Trevor Pearce QPM, Director General, Serious Organised Crime Agency, 3 July 2012

Private Investigators Please find enclosed correspondence Mr Ian Hurst has sent you regarding the evidence you gave the Committee yesterday.5 The matters he raises are of course serious and I would be most grateful if you could answer each of the following questions in full:

• The date you handed the Operation Millipede case file and the copy of Phillip Campbell Smith's hard drive disks to Operation Tuleta and the date of the guarantee letter sought from Operation Tuleta, as well as a copy of that letter and Tuleta's request

• The amount of data from Mr Campbell Smith's hard drive that has not been copied to Operation Tuleta

• Which of the material you have provided to Operation Tuleta was original, and which copies • How bank/credit account information and an Interpol trace can be compliantly obtained by a

private investigator • Why SOCA did not prosecute a client that was identified during Operation Millipede that had

obtained bank and credit card statements and an Interpol trace • Why SOCA allowed a Trojan to be applied to the computer of Mr Hurst and why SOCA failed

to warn him of the compromise at any time. It would be very helpful if you could respond by noon on 8 July 2013.


5 Not printed


Private Investigators I am writing in response to your letter 3 July. Given that Operation Tuleta is an MPS led ongoing criminal investigation, you will appreciate that this limits my response. Taking each of your questions in turn: Question 1 - The date you handed the Operation Millipede case file and the copy of Phillip Campbell Smith's hard drive disks to Operation Tuleta and the date of the guarantee letter sought from Operation Tuleta, as well as a copy of that letter and Tuleta's request. In relation to case material, SOCA instigated contact with the MPS in May 2011 and has co-operated fully with the investigation. SOCA has been in regular contact with members of the Operation Tuleta team over the last two years. During this period the MPS has been provided full access to all material held by SOCA, and SOCA has responded fully to all information requests from the Operation Tuleta team. SOCA does not recognise what is meant by the term "guarantee letter" in the context of these exchanges. Question 2 - The amount of data from Mr Campbell Smith's hard drive that has not been copied to Operation Tuleta. All data retrieved forensically from Mr Smith's hard dive disks has been made available to the Operation Tuleta team. Question 3 - Which of the material you have provided to Operation Tuleta was original and which were copies Full access to the operation Millipede exhibits has been given to members of operation Tuleta team on an ongoing basis since May 2011. Original exhibits retained by SOCA for the purposes of the Millipede prosecution have been released to the Tuleta team when requested. Question 4 - How bank/credit account information and an Interpol trace can be compliantly obtained by a private investigator. There are clearly private investigators that dishonestly and unlawfully obtain confidential details about people for financial gain. This in part led to SOCA highlighting these issues in the 2008 report. However, there are limited circumstances where a private investigator can legitimately seek and receive personal information by applying to data controllers using recognised exemptions under the Data Protection Act: the ICO provides published guidance on this issue. It is also possible for a private investigator to retrieve significant financial information from the internet without recourse to illegality. Finally, an "Interpol trace" is not a formally defined tem. A private investigator can go to the Interpol website (www.interpol.int) and access a range of yellow notice (missing person) or red notice (wanted person) information which is freely available to users. Question 5 - Why SOCA did not prosecute a client that was identified during Operation Millipede that had obtained bank and credit card statements and an Interpol trace A recorded operational policy decision was made to refer this to the Information Commissioner's Office which has the appropriate regulatory powers. This action has been pended while an associated criminal investigation takes place. Question 6 - Why SOCA allowed a Trojan to be applied to the computer of Mr Hurst and why SOCA failed to warn him of the compromise at any time. This relates to an ongoing criminal investigation, therefore it would be inappropriate for SOCA to comment on this. I will respond separately to the request from Eleanor Scarnell dated 5 July by noon 16 July 2013. Trevor Pearce, Director General Serious Organised Crime Agency


Private Investigators I am writing to you, further to my appearance before the Committee with Trevor Pearce on the 2 July, and the subsequent letter he received from the Committee, on the 5 July. You have asked Trevor to provide further information about identity of people or companies which SOCA has intelligence to suggest may have commissioned illegal activity when they instructed private investigators to acquire information on their behalf. The letter rightly observed that this data would be limited to closed cases where SOCA was the lead investigator. In order to assist the Committee, SOCA has reviewed all of the very extensive case material in Operation Millipede records and has compiled a list of all those clients it could identify who instructed the private investigators who were the targets of this investigation. The fact that they have been identified does not mean that they placed their instructions in the knowledge that the private investigators or their agents would act unlawfully. As you know, the Metropolitan Police Service is currently conducting investigations under Operation Tuleta, aspects of which rely on evidential material provided from Operation Millipede. You will appreciate that we need to ensure that publication of any such information would not prejudice, or otherwise undermine, any potential prosecution. We are similarly concerned that publication of the client names from Operation Millipede could prejudice any future enquiry or possible regulatory action on the part of the Information Commissioner, to whom SOCA undertook in April 2012 to pass its Operation Millipede material once the current Operation Tuleta investigations are finalised. Given the lack of certainty over guilty knowledge on the part of Operation Millipede clients, and the impact that any publication might have on those named (recognising the requirement for public authorities to have respect for individuals' private and family life under the Human Rights Act 1998), together with the possible prejudice which any publication might have on ongoing criminal investigations and future regulatory action, the list of Operation Millipede clients which SOCA has created following your request has been formally classified as "Confidential" in accordance with the guidelines for operating the Government Protective Marking Scheme. This reflects the fact that the information it contains, if published, might prejudice individual security or liberty, impede the investigation (or facilitate the commission) of serious crime or substantially undermine the financial viability of major organisations by tainting them with public association with criminality. Given the above assessments, the provision of the information requested by the Committee must be on the basis that such material is sensitive information which will not be published and will be treated "in confidence". In accordance with extant Cabinet Office guidance regarding the provision of sensitive material to Select Committees, I should be grateful for confirmation in writing that the Committee would treat the client information it has requested on this basis so that the concerns SOCA has about possible publication and its consequences are appropriately addressed. lf you would find it helpful to know more of the background to these judgements, or explore alternative ways in which we might satisfy the Committee which would avoid the concerns raised in this letter, I should be happy to offer you a personal briefing on Privy Council terms. Please let me know if you would like to take advantage of this offer. Sir Ian Andrews, Chair Serious Organised Crime Agency

Letter from Keith Bristow, Director General, National Crime Agency, to the Chair of the Committee, 12 July 2013

Private Investigators I am writing to you in response to your letter dated 1 July 2013 where you requested some information in relation to the National Crime Agency (NCA) and activity against private investigators. Timetable of Serious Organised Crime Agency (SOCA) staff. resources and responsibilities to the NCA. The NCA will 'go-live' on 7 October 2013. The Home Secretary has signalled her wish to see change being effected in advance of then. Since 1 February 2013 SOCA and other pre-cursor elements have systematically moved across into shadow working. Shadow working describes how the NCA can begin to operate in advance of go-live by utilising the resources that will comprise the Agency against the NCA's expected priorities. It enables the organisational model to begin to be populated and its operating model to be tested internally and externally; effectively stress-testing the prototype to ensure a smooth transition. The NCA staff matching process has been completed and all officers are being advised where their new role will be within the NCA. Budget Information The NCA will be delivered within the budget of its precursor organisations. SOCA's budget (which includes the Child Exploitation and Online Protection Centre) will form the bulk of the budget for the NCA. For the current financial year (2013/14) SOCA's delegated budget from the Home Office is £417m (resource and capital and includes funding for NPIA functions that were transferred to SOCA). From 'go-live', the NCA will organise its budgets to provide focus on the strategic priorities that the Home Secretary will set for it, and will invest in future capability for tackling serious and organised crime. It is too early to set out what these budget breakdowns will be. Also, the NCA- like SOCA - will be in receipt of other supplementary funding and income streams to support delivery of operations. SOCA information on Private Investigators You have requested a guarantee that none of the information that SOCA holds on private investigators will be lost during the transition to the NCA. On 7 October 2013 all information held by SOCA will pass from SOCA to the NCA. In line the SOCA Director General's evidence to you on 2 July 2013, SOCA is obligated to comply fully with data protection and Criminal Procedure and Investigations Act 1996 (CPIA) requirements that dictate how information and evidence is stored and how long it must be held for. I am confident that SOCA complies fully with its obligations as will the NCA following go-live. NCA role in respect of Private Investigators Intelligence indicates that some private investigators continue to work as the proxies of organised crime groups and there is a continued threat from them to law enforcement operations, information and assets, particularly from those who have knowledge and experience of law enforcement or relevant military covert tactics and techniques and are prepared to exploit these for criminal ends. While this remains the case, the NCA will continue to have a focus on private investigators. This will mean continuing to work with partners to apply a range of measures, such as:

• developing intelligence on the threat posed by private investigators, for use by law enforcement and government:

• issuing information to enable partners to: take law enforcement action; regulatory action; and take steps to protect themselves; and

• pursuing those instances of corrupt private investigators that arise, and providing ongoing support to operations led by others.

The NCA will build on the capabilities of SOCA and offer new opportunities to achieve further results against serious and organised crime, including through more effective tasking and co-ordination.

Keith Bristow, Director General, National Crime Agency

Letter from the Chair of the Committee, to Sir Ian Andrews, Chair, Serious Organised Crime Agency, 17 July 2013

Private Investigators Thank you for your letter of 12 July, concerning the provision to the Committee of information about the identities of people or companies which SOCA has intelligence to suggest may have commissioned illegal activities when they instructed private investigators to acquire information on their behalf. I confirm that the Committee will treat any such information as confidential and that it will be handled in accordance with current guidance on the provision of sensitive information to select committees. Rt Hon Keith Vaz MP Chair of the Committee

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 22 July 2012 Private Investigators Sir Ian Andrews has asked me to thank you for your letter of 15 July and to respond as the issue relates to operational matters. Following my appearance before the Committee with Sir Ian on 2 July, the Committee asked that the Serious Organised Crime Agency (SOCA) provide further evidence to it, as described in your letter of 5 July. In Sir Ian's letter of 12 July he set out the reasons SOCA has for submitting this information in confidence to the Committee and I am grateful for the written reassurance provided on this point in your letter of 15 July. The information sought is in two documents attached to this letter. These are lists of clients of private investigators that featured in Operation Millipede, including names, addresses and brief descriptions of the information held by SOCA. Client information that continues to feature directly in current actions relating to the Metropolitan Police Service's (MPS) ongoing Operation Tuleta is regarded as sub judice and has not been provided for the reasons given by the MPS in their evidence session. SOCA has already described in evidence the arrangements for cooperation between the MPS Tuleta team and SOCA's Millipede team for sharing the material seized in Operation Millipede in such a way that both investigations could have access to and use all the material they needed. The list at attachment A 6 describes client information that was used as evidence in the prosecutions under Operation Millipede. The list at attachment B7 relates to client information material seized during Millipede that was judged to be potentially relevant to the investigation but which was not in the end needed as evidence. The information is provided on the express understanding that it has the status of and is formally accepted as written evidence given by a witness to the Home Affairs Select Committee (HASC) in response to a formal request and that its formulation and submission accordingly enjoys the protection afforded to proceedings in Parliament. SOCA has provided this information on a strictly confidential basis for sight by and in order to assist members of the HASC. The HASC will of course make its own decisions regarding this matter. However, for the avoidance of doubt, SOCA does not participate in, endorse or authorise any further publication of the information. As referred to in my letter dated 8 July 2013, SOCA decided that at the conclusion of the Millipede prosecution, all the Operation Millipede material, in respect of the clients, should be referred to the Information Commissioner's Office (ICO) once Operation Tuleta had also concluded, to allow consideration for further action to be taken by the ICO. This was a recorded decision of the lead officer for Operation Millipede, which was followed by a joint meeting between SOCA and representatives of the Information Commissioner's Office (ICO) in April 2012 to discuss the arrangement. The fact that this scope for further investigative action remains is in SOCA's view an important reason for refraining from its wider publication at this stage. Finally, SOCA also wishes to make clear that by providing this information it is not alleging, either expressly or by implication that the individuals and companies named in it, or any individuals working for those companies, have or even may have committed a criminal offence. It of course remains entirely possible that a private investigator could act illegally but that the client remains entirely unaware of that illegality. Trevor Pearce Director General Serious Organised Crime Agency

6 Not printed 7 Not printed


Media Reporting As you know, The Independent and Daily Mail newspapers ran stories this morning suggesting that I tailed to declare an interest in that my wife provides General Counsel services to G3 Good Governance Group Limited (G3) when I gave evidence to the Home Affairs Select Committee last month. As both reports acknowledged, I have made clear that there was in my view no such conflict but said that I would write to you and the Home Secretary to explain why. I was invited to give evidence to the Select Committee in my capacity as Chairman of SOCA and made clear that questions on operational issues and judgements should be directed to the Director General, Trevor Pearce. The evidence related to issues arising out of a report (Project RIVERSIDE) and Operation MILLIPEDE which were completed or initiated respectively before I became Chairman of SOCA. The Director General of SOCA has general operational control over SOCA's activities including deciding which operations are mounted in the exercise of SOCA's functions and how such operations are conducted. The MILLIPEDE client list was delivered to you earlier today as agreed under the established procedure for communicating sensitive information to Committees of the House. The decision to place a classification on the list of clients was the Director General's, on legal advice, although it was communicated by me in a reply to a letter you had sent me. The subsequent issue of the disclosure of evidential material to the Metropolitan Police Service (MPS) involved judgements which were quite properly for Mr Pearce to address, which he did: and this has since also been the subject of a joint statement with Commander Basu of the MPS. It is matter of public record that my wife, Moira Andrews, after leaving the Foreign and Commonwealth Office in 2011 and amongst other independent interests became General Counsel of G3, a role she has filled since 2012 as a part time consultant. G3 is a strategic advisory consultancy specialising in providing advice on managing opportunities, risk mitigation, governance and regulatory compliance, particularly in emerging markets. My wife and I also conduct outside consultancy work employed by Abis Partnership Limited (Abis) of which she and I are joint Directors. Abis has not yet filed its first accounts but when it does it will describe its principal business as legal and management consultancy. I have delivered services through Abis to the Department of Health, Kings College London and Transparency International (UK). Sir Ian Andrews, Chair Serious Organised Crime Agency


Private Investigators Thank you for your letter of 25 July 2013 in which you raised two questions in relation to the list of companies and individuals that we provided to you on 22 July 2013. You have asked on whose authority, and with what reasoning, the information provided was classified as confidential. lam satisfied that the SOCA decision-making process in classifying this material was correctly applied taking into account the Government Protective Marking System (GPMS), legal advice and relevant legislation including the Data Protection Act. This included, as set out in previous letters to the Committee:

• the Metropolitan Police Service (MPS) is currently conducting investigations under Operation Tuleta, aspects of which rely on evidential material provided from Operation Millipede. Therefore, we need to ensure that publication of the information would not prejudice, or otherwise undermine, any potential prosecution;

• in addition, we are similarly concerned that publication of the client names from Operation Millipede could prejudice any future enquiry or possible regulatory action on the part of the Information Commissioner or other appropriate bodies;

• SOCA is not alleging the individuals or companies named on the list have or even may have committed a criminal offence.

As I explained in my letter to you dated 22 July, for the reasons given by the MPS in their evidence session, some client information was not provided to the Committee. I can confirm this relates to five clients. Turning now to your second question seeking confirmation of whether the organisations and persons involved already know of SOCA's interest in their activities and that their names have been listed in this way. I can confirm that SOCA has not informed these clients. As referred to in my letters of 22 July and 8 July, a recorded decision was taken by the Operation Millipede Senior Investigation Officer (SIO) in 2010 to refer all the Operation Millipede material, including that in respect of the clients to the Information Commissioner's Office which has the appropriate regulatory powers, at the conclusion of the Millipede prosecution. This limb of the investigation currently awaits the conclusion of Operation Tuleta. Trevor Pearce Director General Serious Organised Crime Agency

Email from Charles Yates, Strategy & Information Business Area, Serious Organised Crime Agency, to the Chair of the Committee, 30 July 2013

Following the conversation between Mr Pearce and Mr Vaz this afternoon please find below the lists of clients broken down by category that can be placed in the public domain. I'd be grateful if as agreed with Mr Pearce if you could share with us a copy of your draft press release so we can check it for factual accuracy. Summary of attachment A - Client information that was used in evidence in the prosecutions under Millipede

Sector number of clients Oil 1 Law 1 Insurance 1 Personal 2 Rail services 1 Risk Advisors 1 Security Industry 1 Total 8 Summary of attachment B - Client Information that was judged as potentially relevant to Millipede which was not needed as evidence Sector number of clients Accountancy 2 Auditors 1 Asset recovery 1 Car rental 1 Celebrity 2 Chemical Industry 1 Construction 1 Debt Collection 1 Financial service 8 Food services 4 Insurance 9 Law 21 Logistics 1 Management consultancy 4 Marine 1 Medical supplies 1 Oil 1 Personal 7 Pharmaceutical 1 Private Investigator 16 Risk Advisor 1 Venture Capitalist 1 Not known 8 Total 94

Charles Yates, Strategy & Information Business Area

Serious Organised Crime Agency

Letter from Sir Ian Andrews, Chair, Serious Organised Crime Agency, to the Chair of the Committee, 1 August 2013

Chairmanship of SOCA The Home Secretary announced this afternoon that she has accepted my resignation as Chair of the SOCA Board and I wanted the Committee to understand the circumstances. In my letter of 23 July, I explained why I did not believe that there had been any conflict of interest when I gave evidence to the Home Affairs Select Committee on 2 July. I still believe this to be the case. I have subsequently realised, however, that I had failed to register, as I am obliged to do under the SOCA Code, that I became a Director of Abis Partnership Ltd - the company through which I provide management consultancy services to clients whom I did declare - in July 2012, either at the time or subsequently in my formal Registration of Director's interests to support SOCA's Annual Report and Accounts. I have no explanation for this other than it was both a genuine and unintentional oversight but it is nonetheless inexcusable: and the responsibility is mine alone. My original four year appointment expires at the end of this week and was due to be extended until October to cover the remaining life of SOCA. Given the above, and the fact that I have failed to maintain the standard of integrity to be expected of the head of a public body, let alone one charged with law enforcement, I believe that I had no alternative but to offer the Home Secretary my resignation as the Chairman of SOCA. This is a huge disappointment to me personally because I have been assiduous about avoiding conflicts of interest throughout a public service career spanning almost forty years. And I should make clear, once again, that this is completely unconnected with the evidence I gave to the Select Committee, by which I stand, or issues associated with Private Investigators. I very much regret that this may damage the reputation of an Agency with which I have been immensely proud to have been associated for the last four years and which I was looking forward to seeing into the new National Crime Agency, of which I remain a strong and committed supporter. I should also like to take this opportunity to thank you and your colleagues on the Committee for the close interest you have taken in the business of SOCA over the last four years, in particular. The Committee's recognition of the impact our officers have had on countering the threat of organised crime both in the UK and around the world has been greatly appreciated. Sir Ian Andrews, Chair Serious Organised Crime Agency

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 8 August 2013

Thank-you for your letter of 7th August. I will be delighted to respond with more detail by 16th August to the points raised. Indeed earlier this week I agreed with Commander Basu MPS that because we were seeing some ‘confusing’ reporting in the media over these matters, that we should commission a piece to better inform your Committee and set aside the reported misconceptions. In your letter you helpfully refer to our meeting of 30th July and I am grateful for your personal letter of thanks that followed it. We have been trying to get hold of the note taken of that meeting but thus far have had no luck – I wonder if I could prevail upon you to arrange for its despatch. In the meantime I hope that you continue to have a pleasant holiday. Trevor Pearce Director General Serious Organised Crime Agency

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 16 August 2013

Private Investigators Thank you for your letter of 7 August in which you ask a number of specific questions but also invite me to provide any further relevant information. There has been some confused reporting over these matters in the media over the past few weeks and when we met on 30 July you said it would be helpful to have a full update on SOCA's engagement on the issue of private investigators for when Parliament returned in early September. I have therefore taken the opportunity of not only providing answers to your specific questions but to update you more generally and to provide some further detailed information around issues that have been the subject of correspondence between SOCA and the Committee and subject to speculation by certain commentators. We have also been in correspondence with Mr Clappison around related issues and attach copies of the letters we have received from him at Annex A. Rather than enter into a parallel series of correspondence I thought it would be helpful to respond to the points he has raised in this letter. So in this letter I will provide you with an overall background, answer yours and Mr Clappison's specific questions and bring you up-to-date with events. You will see that I have attached a number of annexes, including a timeline detailing our engagement with the Metropolitan Police around the sharing of material from Operation Millipede. These provide a level of detail that I trust will reassure the Committee around SOCA's engagement on these issues. Project Riverside Project Riverside commenced in March 2007 to look into the threat posed to the UK by corrupt private investigators providing services to serious organised criminals. Its report 'The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data' was issued by SOCA in 2008. It was essentially a snapshot examination as at the end of September 2007, of information from five law enforcement operations as well as additional information from the Information Commissioner's Office (ICO). It detailed a range of methods used by certain elements of the industry to illegally obtain personal data and private information, including the technique known colloquially as 'blagging'. The principal intent behind preparing the report was to inform debate about strengthening policy, legislation and law enforcement's response to the issue. The one SOCA operation named in the report, Operation Flandria, was an intelligence development that did not include the gathering of evidence of clients and did not succeed in gathering evidence of criminal activity. Operation Gloxinia, also mentioned in the report, was a closed National Crime Squad operation where the clients of the private investigator were members of an organised crime group and where covert activity disrupted a threat to an individual. To name them would compromise the identity of the individual who was under threat. The remaining three operations referenced in the report were Metropolitan Police Service (MPS) operations. Operation Millipede, of which more in a moment, commenced after the report had been produced. It has been puzzling to see commentary that SOCA had sought to 'suppress' the Riverside report. While the report was appropriately classified at the time of its production because it contained sensitive operational information, the intent of SOCA in producing the report was to raise awareness amongst relevant partners of the issues it covered to enable mitigating action. Setting out the understanding of a problem in this way is a rudimentary driving principle behind law enforcement activity against the range of serious and organised crime. Such reports are not routinely published for obvious reasons, not least of which is the damage that can be caused by revealing to the criminal community what law enforcement knows and the need to protect sources. I accept that, of course, the value of setting out the problem in this way is confined to the extent to which the intelligence is used to tackle it. In this case, information drawn from the

Riverside report was used to alert certain sectors about the risks posed by rogue private investigators. These included detailed case studies to show how social engineering (or 'blagging') worked; and an Alert jointly prepared with Ofcom and targeted at suppliers of security equipment and services. In addition, a 'Manager's Guide to Good Practice', offering basic security advice for contact centre security and HR managers, was issued under Riverside in October 2007. The report was made available to Lord Justice Leveson's Inquiry in March 2012 and, with your agreement, a copy was produced Jor the Committee in April 2012 to inform its consideration of the private investigator issue. A redacted copy has been freely available on the SOCA website since 6 July 2012. The full report was made available to you in May 2012. In addition, in 2008, SOCA worked with the ICO and the Ministry of Justice to strengthen the penalty under section 55 of the Data Protection Act to two years imprisonment although I understand this has not been commenced. To assist the Committee I attach at Annex B a 'Riverside timeline' to help set this work in context. Operation Millipede I now turn to Operation Millipede which commenced in July 2008; the first arrests were made in 2009 and the four defendants were convicted and sentenced on 27 February 2012 for committing fraud by false representation under offences defined in the 2006 Fraud Act. The issues raised by the Committee's specific interest in the clients of the private investigators convicted as a result of Operation Millipede have been characterised by some sections of the media as 'blue chip hacking'. However, it is important to note that the main focus of Operation Millipede was around the use of 'blagging'. There are different legislative penalties available to investigators and a lack of particularly dissuasive penalties for 'blagging' under the Data Protection Act, as opposed to 'hacking'. Operation Millipede was pursued under the 2006 Fraud Act. At the conclusion of the case the Information Commissioner issued a statement:

“If SOCA had been restricted to pursuing this case solely using their powers under the Data Protection Act then these individuals would have been faced with a small fine and would have been able to continue their activities the very next day."

During the course of the investigation SOCA worked closely with the ICO which provided specialist advice and expert evidence throughout. In early 2010 a recorded decision was taken by the Operation Millipede Senior Investigating Officer to refer all the Operation Millipede material, including that in respect of the clients, to the ICO at the conclusion of the Millipede prosecution. The ICO issued a statement following the sentencing which said:

"The scourge of data theft continues to threaten the privacy rights of UK citizens. We welcome today's sentencing but note that the outcome of the case underlines the need for a comprehensive approach to deterring information theft. The ICO will be receiving additional case material from SOCA and would not rule out taking further action against the organisations that received information from these individuals if it becomes clear that they failed to comply with the requirements of the Data Protection Act."

SOCA's press statement issued at the time said:

“SOCA's focus during the investigation was criminal conspiracy. However in recognition of the fact that the operation might also uncover information relevant to other authorities, SOCA worked in partnership with a number of bodies including the Information Commissioners Office. SOCA will now hand over any such information to its partners to determine whether further action is appropriate."

The information has yet to be passed to the ICO as it has first been made available to the MPS Operation Tuleta Team. However. SOCA has kept in touch with the ICO in the interim. I attach a timeline at Annex C which details SOCA's engagement with the ICO over this period. Operation Tuleta commenced before Operation Millipede concluded. Tuleta is not a reinvestigation of Millipede. Its terms of reference include to investigate criminal acts that intrude on individual privacy for journalistic purposes, that are not covered by the terms of reference for the MPS Operations Weeting or Elvedon. Operation Millipede was focussed on investigating the fraudulent acquisition of personal data by private investigators. Nevertheless, SOCA worked closely with the MPS to ensure that information from Millipede was made available to the Operation Tuleta team. Commander Basu and I issued a joint statement on the 12 July to clarify the position which you acknowledged had been very helpful when we met. However, I understand some further clarification is now required and I will deal with that under the specific questions you have raised. I attach a timeline, jointly agreed with the MPS, detailing the engagement between us at Annex D. In response to a request from the Committee on 2 July SOCA produced a list of clients, known to SOCA, of the private investigators convicted as a result of Operation Millipede. While the information was available in the Millipede case files, and had been made available to the MPS as outlined in the timeline, it did not exist as structured lists in the form that were presented to the Committee prior to 2 July. While I don't intend to repeat in full the reasons why SOCA has chosen to classify the lists, which were set out in our letters of 12 and 30 July, I would remind the Committee that we advised you of our intention to do so and received agreement that you were content to receive them on that basis. As I made clear in my evidence in July, SOCA has been active in this space since its first year of operation, working to inform the debate around regulation of the industry; to help prevent potential victims from falling prey to rogue investigators; assisting in the strengthening of sanctions; working with the ICO on a landmark investigation and providing partners with information to allow them to carry out further investigations. I am satisfied that SOCA's response has been proportionate given the range of its responsibilities and remit, as set by statute. Specific questions raised in your letter I will now turn to the specific questions raised in your letter of 7 August: 1. How long has SOCA had the information contained in lists a, b, and c? The lists were drawn up in response to the specific request from the Committee on 2 July; structured lists did not exist before then. The information that informed the lists was drawn from material gathered during Operation Millipede in 2009. 2. When did SOCA approach the Metropolitan Police and ask them to review the lists? As you will see from the attached time line at Annex D, SOCA approached the MPS on 3 July and met with members of the Operation Tuleta team on 12 July to review the information and identify that which was subject to MPS investigation. Subsequently, we informed the MPS on 19 July that we were submitting the lists (referred to as Attachments A and B) to you. 3. Who made the decision to protectively mark the lists? Was it you and Sir Ian Andrews or another person? This was an operational decision and, as is normal practice, the classification of material is initially carried out by the originator of the document. I was and am satisfied that the SOCA decision-making in classifying this material was correctly applied taking into account the Government Protective Marking System, legal advice and relevant legislation including the Data Protection Act. 4. Given that SOCA and the Metropolitan Police were working so closely together on this issue why was Commander Neil Basu only given the lists by you at 7pm on 30 July and only after he asked?

My understanding is that Commander Basu requested a personal copy of the lists to inform the response he was preparing to requests for information from the Committee. His office contacted SOCA on the afternoon of the 30 July and a copy was hand delivered later that day. The information that informed the list was drawn from the material in Operation Millipede which had already been made available to the MPS in accordance with the timeline outlined in Annex D. Furthermore, the Operation Tuleta team had worked with SOCA agreeing the content of the lists. 5. Who made the decision to remove these particular live cases from the lists? During the meeting on 12 July 2013 the MPS requested that the five clients be removed as they are currently under active investigation under Operation Tuleta. 6. What are the categories of the firms, organisations and individuals on list c? I would ask that you direct that question to the MPS. 7. You told me when we met on the 30 July 2013 in my office that 4 people had seen the lists. Are these four SOCA officials or Metropolitan police officers? As I recall this came up in conversation in response to concerns you had that the lists may have already been leaked to the media. I was referring to the limited number of officials in SOCA who had been sent the actual list at that time. Of course. there are a wider number of SOCA officers who are aware of the information that informs the lists, in particular those involved in drawing them up. 8. It would be of use to the Committee if you could outline in a timeline the specific actions taken on this issue. Please see Annex D which has been drawn up with the MPS and represents the agreed timeline around the sharing of Operation Millipede information. Mr Clappison's Questions of 25 and 29 July

• To provide a list of the clients of the private investigators in the closed operations referenced in Project Riverside (Barbatus, Flandria and Gloxinia) on the same basis as a list of clients as provided to the Committee in the case of Operation Millipede.

• How many other clients of private investigators relevant to the matter besides the 102

are known to you? lt would be very useful to know how many other clients there are.

Operation Flandria was an intelligence development that did not include the gathering of evidence of clients and did not succeed in gathering evidence of criminal activity. Operation Gloxinia, also mentioned in the report, was a closed National Crime Squad operation where the clients of the private investigator were members of an organised crime group and where covert activity disrupted a threat to a named person. To name them would compromise the identity of the individual who was under threat. The remaining three operations referenced in the report were MPS operations. Also relevant to the matter, Operation Millipede identified 107 clients from material seized; 5 were excluded from the lists submitted to the Committee because they feature in MPS Operation Tuleta.

• How many of the 102 clients have been arrested or charged? SOCA has not arrested or charged any of these. Operation Millipede focussed on the prosecution of the private investigators. I would refer to the statement SOCA issued after the convictions in the operation:

“SOCA's focus during the investigation was criminal conspiracy. However in recognition of the fact that the operation might also uncover information relevant to other authorities, SOCA worked in partnership with a number of bodies including the

Information Commissioner's Office. SOCA will now hand over any such information to its partners to determine whether further action is appropriate."

A recorded decision was taken by the Operation Millipede Senior Investigating Officer in 2010 to refer all the Operation Millipede material, including that in respect of the clients, to the ICO at the conclusion of the Millipede prosecution. The information has yet to be passed to the ICO as it has first been made available to the MPS Operation Tuleta Team.

• Have any other clients been arrested or charged? Not by SOCA.

• How many of the subjects/victims about whom information was transmitted to the clients by the private investigators have been notified of these matters: is it planned to notify all the subjects/victims about this?

During Op Millipede, material was uncovered which indicated that 51 people, who were subject to investigations conducted by private investigators investigated under operation Millipede, appeared to have had their personal data fraudulently accessed. A further 49 people's personal data were found but there was no specific evidence to show fraudulent access to personal data. SOCA considered that these individuals had appeared to suffer intrusion into their private lives. They were notified that material had been uncovered during the investigation and that it might form part of the judicial process. It was not intended or required that they provided witness statements to form part of the prosecution case but that they could make a statement on the lines of a 'victim impact statement'. Letters were sent to those people whose addresses were available. 47 letters were sent to people in the first category: (1) 23 provided no response/reply; (2) 13 provided statements; (3) 4 completed a questionnaire; (4) 7 took no further action following an initial response. 44 letters were sent to people in the second category: (1) 36 provided no response/reply; (2) 8 responded but did not provide statements. Current Position and Next Steps SOCA has kept in regular contact with the MPS and ICO over this issue. It has also had discussions with the Financial Conduct Authority and Solicitors Regulation Authority about future coordinated action. Yesterday, SOCA chaired a meeting with the MPS and the ICO to discuss next steps, including the provision of the information to ICO. Work to achieve this is being taken forward in the coming weeks. SOCA will now convene a further meeting with the MPS and ICO to which other regulatory bodies will be invited. The aim will be to agree further coordinated activity. As I mentioned at our meeting on 30 July, one of the main reasons for classifying the lists of clients passed to the Committee was to ensure that publication would not prejudice current investigations by the MPS or any possible regulatory action by the ICO or others. That process is moving forward and once it is concluded we will be in a position to review the classification. However, there will still be data protection issues to consider and I repeat the point that we are not alleging that the individuals or companies named on the list have or even may have committed a criminal offence.

I trust the foregoing is of assistance in helping to reassure the Committee around these matters. Trevor Pearce Director General Serious Organised Crime Agency Annex A Letter from James Clappison MP, 25 July 2013 Dear Mr. Pearce, Following your appearance before the Home Affairs Select Committee on 2 July and your transmission to the Home Affairs Select Committee of the names of a 102 clients of private investigators relevant to our enquiries, I would be most grateful if you could answer some further questions that occurred to me: I) Could you tell me how many other clients of private investigators relevant to the matters besides the 102 are known to you? It would be very useful to know how many other clients there are. 2) How many of the 102 clients have been arrested or charged? 3) Have any other clients been arrested or charged? 4) How many of the subjects/victims about whom information was transmitted to the clients by the private investigators have been notified of these matters; is it planned to notify all the subjects/victims about this? I am sure you will agree with me that it is very important to ascertain the full extent of these matters. I look forward to hearing from you. Kindest regards, James Clappison MP Letter from James Clappison MP, 29 July 2013 Dear Sir Ian Andrews, The Home Affairs Select Committee has been supplied with a copy of project Riverside which analyses the results of investigations into the activities of private investigators arising from Operations Barbatus, Flandria and Gloxnia. Some of these operations ha\C been closed for many years. I would be most grateful if you could let me have a list of the clients of these private investigators in the closed Operations on the same basis as a list of clients as provided to the Home Affairs Select Committee in the case or Operation Millipede. I would also be most grateful if you could let me know the total number of the clients or private investigators in both the closed and open investigations. I have taken an interest in these matters as a member of the Home Affairs Select Committee and I am anxious to obtain a full picture of what has happened; I am sure you will agree that there is a public interest in knowing as much about these circumstances as can be properly disclosed. I am writing on the same basis, making the same request, to the Metropolitan Police for such information, as in their possession. Kind regards, James Clappison MP

Annex B Project RIVERSIDE timeline Project RIVERSIDE, and associated activity considered the threat posed to the UK by corrupt private investigators providing services to serious organised criminals.

• March 2007 - Project RIVERSIDE was tasked by SOCA under Programme of Activity 2 'Criminal business structures and logistics', under the UK Serious Organised Control Strategy.

• August 2007 - Government consultation process launched on whether to regulate "Private Investigation and Precognition Agents."

• September 2007 - Intelligence cut-off date for the SOCA report published in January 2008 • October 2007 - SOCA issued an Alert to Contact and Call centres offering practical advice

to HR and Security managers to maintain standards of data protection, given that the data held by Contact and Call centres is attractive to organised criminals.

• January 2008 - SOCA report "Private Investigators: The Rogue Element of the Private Investigation Industry and Others Unlawfully Trading in Personal Data' was produced.

• End January 2008/early February 2008 - SOCA report shared with Home Office and MPS • July 2008 - Discussions held with ICO on PIs and the related threat • September 2008 - SOCA issued an Alert to private sector organisations most affected by

illegal activities conducted by Pls. This detailed the techniques used and key vulnerabilities. The release of the document was followed with a series of visits and interviews with senior security managers within the Telecom and Banking sectors.

• September 2008 - Announcement by Home Office Ministers to introduce the licensing of the private investigation industry.8

• October 2008 - SOCA had discussions with the Ministry of Justice about strengthening the penalty under s55 of the Data Protection Act to two years imprisonment to increase the risk to unlawful acquisition of data not captured under RIPA.

• November 2008 - SOCA hosted a multi-agency working group on licensing private investigators.

• December 2009 - SOCA made submissions to the MoJ consultation (CP22/O9) re the strengthening the penalty under DPA.

• September 2010 - Alert issued to the private sector detailing the threat of criminals, including private investigators, using social engineering to obtain personal information.

• December 2011 - Alert issued in collaboration with Ofcom, highlighting the risks of criminals obtaining surveillance, counter-surveillance, and protective security equipment to frustrate law enforcement, and seeking the reporting of suspicious activity.

• March 2012 - SOCA shared a copy of the 2008 report with the Assistant Solicitor to the Leveson Inquiry.

• April 2012 - Not protectively marked version was produced for the Committee. • May 2012 - Report was made available to the Chair of the Committee. • July 2012 - Not protectively marked version was published on the SOCA website. • July 2013 - Full version of report, with a small number of redactions, provided to Committee

at not protectively marked and published on SOCA website.

8 The 2007/08 Impact Assessment of Regulations to Implement the PSI Act 2001 in respect of Private Investigators and Precognition Agents, published on the Home Office website, references that SOCA provided evidence of a level of risk associated with criminal activity which supports the need for licensing.

Annex C Timeline of engagement with Information Commissioner's Office in respect of Operation MILLIPEDE.

• July 2008: Operation MILLIPEDE commenced. • May 2009: ICO briefed by SOCA prior to arrests. ICO officers in attendance for some. • January 2010: MILLIPEDE SIO makes a recorded decision to refer all the Operation

Millipede material to the ICO which has the appropriate regulatory powers, at the conclusion of the Millipede prosecution.

• February 2010: SOCA and ICO meet to discuss MILLIPEDE material. • March 2011: ICO examines some Millipede exhibits and provide expert statement as to

whether material constituted personal data under the Data Protection Act 1998 (DPA). ICO also provides expert witness statement concerning role of ICO and background information about the private investigation industry.

• April 2011 : ICO provides expert statement on DPA • May 2011: ICO provide statement regarding an individual who had contacted them claiming

to have information relating to MILLIPEDE. • February 2012: Conviction and sentencing on MILLIPEDE. ICO issue a press statement. • April 2012: SOCA and ICO meet. Link to MPS investigation discussed. Decision to delay

ICO action pending completion of this action. • July 2013: SOCA updates ICO that TULETA ongoing and reaffirms intention to supply data

as soon as possible. • August 2013: Meeting with ICO to discuss potential timings for handover of MILLIPEDE

material.

Annex D Timeline of engagement with Metropolitan Police Service on operations MILLIPEDE and TULETA Set out below is a timeline of key points of engagement. It does not include all instances of working level discussion and communication, which was ongoing from the point of May 2011. Rather it focuses on the most significant events in terms of the relationship between MILLIPEDE and TULETA and those instances which have previously been of interest to the Committee or subject to commentary.

• July 2008: Operation MILLIPEDE commenced. • March 2011: MPS begins scoping exercise looking at private investigators • May 2011: SOCA contact with alleged victim of hacking • May 2011: Meeting between senior MPS and SOCA representatives. Agreed to brief MPS

on details of MILLIPEDE. MPS confirmed alleged victim was in scope. • June 2011: Request for access to Phillip Campbell-Smith's hard drive(s) from MPS, and

identification by SOCA of potential information of interest. SOCA provides forensically recovered digital material to MPS despite ongoing nature of activity on MILLIPEDE.

• June/July: Two-way engagement regards to technical issues with MPS locating and examining material. Issues successfully resolved.

• July 2011: MILLIPEDE case summary provided to MPS • September 2011: SOCA offers access and copies o{ relevant MILLIPEDE material • October 2011: Operational memorandum of understanding between SOCA and MPS

agreed. This set out the way that requests for intelligence/information would be handled by SOCA, including on occasions when fast-time liaison is necessary.

• October 2011: Meeting at which MPS provided overview of ongoing analysis of digital media provided to date and requested some technical advice of SOCA. Additional forensically recovered digital material provided to the MPS.

• February 2012: Conviction and sentencing on MILLIPEDE • April 2012: MPS provided with exhibit list and other evidential items from MILLIPEDE • May 2012 onwards: Following agreement by SOCA to provide further support, as required,

to TULETA, further evidential material is provided including, once the MILLIPEDE process is complete following confiscation proceedings in January 2013, original exhibits and copy exhibits as requested by MPS.

• July 2013: Discussions lo draw up client list following request by Home Affairs Committee. SOCA approached the MPS on 3 July. On 12 July the lists of 107 clients was discussed with MPS officers, and 5 clients were removed at the request of the TULETA team. SOCA informed the MPS on 19 July that it was submitting the lists to the Committee, prior to providing the list of 102 to the Committee on 22 July 2013. Commander Basu requested a copy and was provided with it on 30 July.

Letter from Commander Neil Basu, Metropolitan Police, to the Chair of the Committee, 30 August 2013

Home Affairs Select Committee Inquiry into Private Investigators I write in response to your letters of 15th and 19th August 2013, which together raise seven questions, and further to your letter of 19th July to the Commissioner. The answers to the seven questions are provided in Appendices 1-7 to this letter. 9 You will see that each Appendix contains a direct answer to the question, and then a table setting out further detailed information. It will also be noted that reference is made to a series of closed and live investigations that have taken place within the time parameters you specified, namely 1998 to August 2013. Question 1 In relation to Question 1, I note that in your letter of 19 July 2013 you originally asked: "How many people the Metropolitan Police have intelligence to suggest may have commissioned illegal activity when they asked for information from a private investigator?" Whereas the question that you now ask is "How many companies or individuals the Metropolitan Police Service have intelligence to suggest commissioned private investigators who have broken the law to obtain information between 1998 and August 2013?" As has been explained to the Committee by both the MPS and SOCA, it may be the case that a client engaging the services of a private investigator may remain unaware of any crime then committed by the private investigator, or anyone that they subcontract the work to, in order to fulfil the terms of the engagement. Such clients nonetheless fall to be included in answer to Question 1. Accordingly, the answer to Question 1 set out in Appendix 1 includes such clients. You will note that, for this reason, I have included a column (column 4), that identifies where there was insufficient evidence to justify an investigation (in 59 of the 118 cases). Question 2 In relation to Question 2, I note that in your letter of 19 July 2013 the question asked was again different and contained limitations - it was: "Please supply us with a list of names of people or companies which the Metropolitan Police has intelligence to suggest may have commissioned illegal activity when they asked for information from a private investigator. We understand that data can only be given where cases are closed and where the Metropolitan Police were the lead investigators." Whereas the question now asked is: "If you would supply us with a list of names of people or companies which the Metropolitan Police Service has intelligence to suggest commissioned private investigators who were involved in illegal activity between 1998 and August 2013." I note in particular that the limitation that data was requested only in relation to closed cases is not included in your latest request. In order to assist the Committee, I have included all investigations (including live investigations), but have redacted the names of the clients themselves to avoid compromising active investigations that are underway. Instead, and again to assist the Committee, I have identified the relevant industry within which they worked. The information in Appendix 2 is provided to the Committee pursuant to the Committee's written agreement that (i) it has the status of and is formally accepted as written evidence given by a witness to the Committee in response to a formal request and that its formulation and submission accordingly enjoys the protection afforded to proceedings in Parliament, and (ii) it is provided on a strictly confidential basis for sight by and in order to assist members of the Committee. 9 Not printed

In relation to the publication of the information in Appendix 2: (1) The names of clients who have been charged are included as they are a matter of public record but, ·of course, in all these cases the matters are in any event sub judice. (2) The names of clients who have been convicted of criminal offences are also included and again are a matter of public record, but are therefore not subject to the same conditions of confidentiality set out above. (3) You will note that Column 4 of Appendix 2 identifies a number of cases in which there is not a live investigation. This may be because there was insufficient evidence to justify an investigation by the MPS (because, for example, there was no evidence linking them to the criminality of the private investigator). It may also be that they fall within those cases to be referred to the Information Commissioner's Office for consideration as to whether any breach of the Data Protection Act 1998 has been committed. Column 4 also contains examples of where clients have been investigated but no further action was taken against them because there was insufficient evidence to do so. In these circumstances, I would respectfully draw your attention to the detailed reasons given by Mr Pearce and Sir Ian Andrews (see their letters of 12 July 2013, 22 July 2013, and 30 July 2013) as to why similar information that SOCA provided to the Committee ought not to be published by the Committee. Questions 3 and 4 Appendices 3 and 4 provide the answers to these Questions. Questions 5-7 Appendices 5, 6 and 7 provide the answers to these Questions. It will be noted that, of the 7,161 people that the MPS has identified as victims, by far the majority of them (5,500) arise from Operation Weeting. As the Committee knows, this class has been sub-divided into "likely victims" and "potential victims" (the latter category consisting of cases where there was not sufficient information to determine one way or the other whether the relevant person had their privacy compromised). Notwithstanding this feature, the MPS decided that efforts should be made to inform people within this category. It will be noted from Appendix 6 that the MPS has managed to inform 3,500 of these 5,500 victims - a truly extraordinary undertaking involving the deployment of very significant resources and thousands and thousands of hours of work by police officers and police staff. Notwithstanding this, it has not been possible to identify or make contact with 2000 individuals. This is for a wide range of reasons, but principally because the information in the possession of the MPS means that it is not possible to identify the likely or possible victim. Thus, for example, the material seized in the course of the investigations may only reveal a single forename on a piece of paper, or a surname with no other identifying information, or a partial and incomplete telephone number, or an incorrect telephone number, or a dead telephone number. In relation to Operation Pinetree, where the MPS is engaged in the task of seeking to identify and contact some 1,250 people, the Committee will be aware that the investigation itself is presently at a formative stage. Limitations of data provided The information provided by this letter and its Appendices has been obtained by conducting searches for operations within those MPS Directorates where it is known that the activities of private investigators and their clients have featured prominently. Additionally, however, I have commissioned a search of MPS electronic data bases to ascertain the extent to which private investigators feature within them. This type of key-word search is the start of any trawl of the large amount of data that the MPS holds. The returns on such searches would probably include some cases additional to those that are mentioned in this letter and its Appendices. But the returns also include cases where the private investigator was a victim of crime, a witness to crime, or those words were simply mentioned as an incidental part of the narrative of the text. Searches were accordingly carried out across the following databases, with the following results: Police National Database (PND) 3584 records (Cris, Custody and Crimint+) Crimint + 1926 records IIP (Integrated Intelligence Platform) 3681 records (Cris, Command & Control

Crimint +, Custody and Merlin)

Confidential Unit 8 records Directorate of Professional Standards (DPS) 658 records and 477 documents The searches thus resulted in a total of 9,857 records and 477 documents which have some reference to private investigators within them. A number of duplicate records will be contained in this return and would need weeding out prior to any research taking place. It is judged that this de-duplication would take up to 1 week to complete. In addition the documents held within the DPS would need to be reviewed to ascertain how long the scanning of these would take. After these exercises had been undertaken, the records themselves would need to be reviewed to determine whether the mention of "private investigator" within the electronic record brought the cases within any of the categories covered by your 7 questions. It is estimated that 1 person could scan on average 48 records a day (6 per hour), namely 240 records per week. Even if 50% of the 9,857 records were duplicates it would take 102 working days or approximately 3 months to complete the initial research. After that was done, then the records would need searching again (probably by reference to the primary materials involved - original case papers; and in some cases by reference to the investigating officers) in order to provide answers to each of the questions that you have asked in relation to that case. It is not possible to predict how long this would take, save to say that the task of compiling the information set out in this letter and its Appendices has been very considerable. I trust that you will agree that the time of police officers and police staff ought not to be further diverted from their primary task of preventing and detecting crime. One final point I would raise at this time is that I note at present your questions are directed solely at the MPS and SOCA, and do not appear to lake into account the fact that such offences are likely to be occurring around the country. I would suggest that the full scale and extent of the issue can only be properly assessed in the national context. Yours sincerely Commander Neil Basu Metropolitan Police

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to James Clappison MP, 2 September 2013


Thank you for your letter 21 August in which you raise two issues. Firstly, how many other clients have been uncovered in addition to those on the list of 1 02, and secondly how much longer it will be before the names of clients are passed over to the Information Commissioner's Office (ICO). On the first issue, Operation Millipede is the only SOCA operation that came to focus exclusively on private investigators and their involvement in 'blagging' information and which revealed a client list of the type you seek information on. As you will be aware from our evidence to the Committee, some private investigators continue to work as the proxies of organised crime groups (OCGs) and there is a continued threat from them to law enforcement operations, information and assets. Private investigators will therefore have featured in operations conducted against OCGs, however in such cases the clients of interest would have been the OCGs themselves. In relation to the extent of any non-OCG clients identified in law enforcement/police operations, beyond those operations carried out by SOCA, this is of course not something we can answer. On your second question, while you may feel that no action has been taken since 2010, the material was passed to the Metropolitan Police Service (MPS) to support its investigations. Additionally, the final proceedings in the Operation Millipede investigation concluded in January 2013 with three of the four defendants being subject to confiscation orders. SOCA chaired a routine meeting with the MPS and the ICO to discuss next steps on 15 August, including the provision of the information to the ICO. We subsequently received confirmation from Commander Basu (MPS) that he was content for a list of clients to be passed to the ICO, for intelligence purposes at this stage. As you are aware, the MPS identified an initial five that were of interest to their investigations and subsequently a further four. These names have been omitted from the list prepared for the ICO which was provided on 28 August. Further supporting material from the Operation Millipede investigation was provided to the ICO on 30 August. The ICO has issued a press notice today confirming that it has launched an investigation into whether clients of rogue private investigators may have breached the Data Protection Act. I look forward to updating the Committee further tomorrow and am copying this letter to the Clerk of the Home Affairs Committee. Trevor Pearce Director General Serious Organised Crime Agency

Letter from Christopher Graham, Information Commissioner, to the Chair of the Committee, 5 September 2013

We spoke on Monday about the 98 organisations and individuals named in the material passed to us by SOCA last week. I told you that I had launched an investigation into potential criminal offences. The material that we have received from SOCA is contained in, it now appears, over 30 files. I have deployed a team of investigators overseen by a Senior Investigating Officer to assess the material and check evidence of criminal acts against each of the 98 clients listed. This is an important but necessarily painstaking task, and we have committed to report on this work as we progress through the investigation. I am writing following the meeting of your committee on Tuesday where you indicated that you intended to publish the identities of the 98 client organisations and individuals included on the list if SOCA had not done so themselves by your deadline of next Monday. I have spoken to Trevor Pearce of SOCA and advised that, in my view, publication at this stage could prejudice my investigation . It is also my view that publication by SOCA of the names of the individuals concerned would not be fair processing under the Data Protection Act. I am concerned about the impact of disclosure on individuals who may not have broken the law. Firstly, it seems to me to be bad policy to publish prematurely the names of organisations and individuals who are being investigated for potentially criminal activity. I am concerned that publication of the list in the early stages of our process could seriously prejudice the ICO investigation. I should like to set out my reasoning for the benefit of your committee. After consulting with SOCA and the Metropolitan Police, I can confirm that none of the 98 clients on the list was contacted during their investigations. We have, therefore, to assume that any evidence held by the clients which could corroborate existing evidence collected by SOCA and/or further implicate each of the clients in any on-going criminal activity associated with the use of Private Investigators has not been lost or destroyed. I want us to be able to maximise this opportunity and conduct a speedy, thorough and robust criminal investigation aimed at securing the best evidence possible and bring to justice those responsible for criminal acts. This may require us to take executive action against some of the clients and execute search warrants using our powers of entry, and also conduct a large number of interviews with suspects not yet identified aimed at implicating or eliminating them from our enquiries. I am not suggesting that we will need to take this action against every client, but, as we are still reviewing the material, we simply do not know. Furthermore, if the list were to be published during the investigation then media interest could be anticipated to escalate to such an extent that it would generate swathes of additional/unused material that we would subsequently need to consider for disclosure to defence teams. These issues would have significant impact on my investigation and the investigation team. I firmly believe that were the list to be published before we had had the chance properly to assess the SOCA material, the opportunities I have described above could be lost. I would therefore ask the committee to bear in mind the public interest in allowing the ICO investigation to proceed without prejudice. Secondly, should your committee still be determined, under Parliamentary Privilege, to publish the SOCA list at this stage I should also, as Information Commissioner, advise that the individuals concerned must at least be given due notice by you of the impending publication. I am not aware (and, I suggest, neither are you) who, if any, knows of their inclusion, given that neither SOCA not the Met has told them. On the same fair processing point, you will recall that the names of the 305 individual journalists who had commissioned work from the private investigator Steve Whittamore were also withheld from publication in the Information Commissioner's 2006 report to Parliament What Price Privacy Now? You will also recall that the same report seven years ago highlighted the involvement of lawyers and accountants as well as newspapers and magazines in the

unlawful trade in personal information and that the recommended action to amend section 55 of the Act to put in place a more effective deterrent sentencing framework remains outstanding. Should your committee decide to publish the list, either on Monday or subsequently, I would ask you to publish this letter at the same time. Christopher Graham Information Commissioner

Letter from Trevor Pearce QPM, Director General, Serious Organised Crime Agency, to the Chair of the Committee, 6 September 2013

Private Investigators I have carefully considered your request to publish the list of clients, and have taken into account views from the Information Commissioner, the MPS and SOCA'S lawyers. As you know, SOCA produced and provided the client list to the Committee in accordance with Cabinet Office guidelines on the provision and handling of sensitive information in conJidence to select committees. You confirmed on 15 July that the Committee would treat the list as confidential, and that it would be handled in accordance with this guidance. Over the course of the last three months and at my appearance before the Committee on 3 September, I have articulated the detailed reasons why SOCA considers the client list should not be published. I remain firmly of the view that publishing the list of clients would atfect ongoing investigations and enquires. Since appearing before the Committee I have spoken with the Information Commissioner, as the head of the UK's independent authority set up to uphold inlormation rights in the public interest and as the Intormation Commissioner's Ojfice now has the lead on taking action against those on the list. I understand that Christopher Graham has written to you. In addition, I have sought the views of Assistant Commissioner Cressida Dick who is also of the view that the list should not be published. SOCA has been clear that it is not alleging the individuals and companies named on the list have or even may have committed an offence. Further, given the fluid nature of investigations the position in respect of individuals may change in status, for example since SOCA provided the lists of 102 clients to the Committee on 22 July 2013, the MPS identified a further four crossovers with MPS operations other than Operation Tuleta. I note the points raised by the Committee in respect of individuals and companies wanting to know whether they are on the list, as this would inform their engagement with private investigators. All businesses should take proactive measures to ensure that where they use private investigators they do so in a lawful manner, irrespective of whether they are concerned as to whether or not they are on the list. The meeting with the MPS, Information Commissioner's Office and other regulators (Solicitors' Regulation Authority and Financial Conduct Authority), which I foreshadowed in my letter of 16 August, is arranged for 19 September and this will further progress coordinated activity including the provision of advice to orofessional bodies. The Committee indicated that if SOCA does not publish the list, you will do so, in which case I presume you will liaise with the MPS which has requested further redactions and also the Information Commissioner's Office. I am clear, as is the SOCA Chairman, that SOCA's responsibility in ensuring the integrity of an investigative process in the interests of justice has not changed and that therefore the conlidential material as presented to and agreed with you should remain confidential. lam copying this letter to Stephen Rimmer, Christopher Graham and Assistant Commissioner Cressida Dick. Trevor Pearce Director General Serious Organised Crime Agency

Letter from Stephen Rimmer, Chair, Serious Organised Crime Agency, to the Chair of the Committee, 10 September 2013

Private Investigators I am writing to you in relation to a statement you made during SOCA's oral evidence session on Tuesday 3 September. During the early part of the session you referred to Francis Plowden, a non-executive director of SOCA, by saying that he was a 'director of Serco Plc'. This is incorrect. I understand that Francis is not and never has been a director of Serco Plc. He has held shares in Serco Plc since February 2005. This fact was clearly stated by him on the SOCA Register of Interests upon his appointment to the SOCA Board in August 2009. Since that date, Francis has continued to declare this interest. I will be writing separately as soon as possible on the other matters you and the Committee raised in respect of the interests of the Non-Executive members of the Board. I trust that this clarifies the position. Stephen Rimmer Chair Serious Organised Crime Agency

Documents

Private Investigators: follow-up correspondence 30 March ... · Private Investigators inquiry As you will be aware, the Home Affairs Committee is currently conducting an inquiry into