SOCA Report on Private Investigators Report Jan 2008

7/28/2019 SOCA Report on Private Investigators Report Jan 2008

1/10

g5EtrASERIEUS OiIEANISED CRIME AIiENEY

Reference: CTH (01/08) 027Originator: Intervention / Crime Techniques

SOCA Report

January 2008

lnstructionsThis report may be circulated within your departmenl in accordance with departmenlal securlty instructionsand with caveats included within the report;The information contained in this report is supplied in confidence and may not be disseminated beyond theagreed readership/handling code recipient without prior reference to SOCA;No part of this report may be disclosed without prior consultation with the originator;This information is supplied in confidence by SOCA, and is exempt from disclosure under the Freedom ofInformation Act 2000. lt may also be subject to exemption under other UK legislation. Onward disclosure maybe unlawful, for example, under the Data Protection Act 1998. Requests for disclosure to the public must bereferred to the SOCA FOI single point of contact, by email on [email protected]@ or bytelephoning +44 (01870 268 8677;This report may contain 'Sensitive Malerial'as defined in the Attorney General's guidelines tor the disclosureol 'Unused Material'to the defence. Any sensitive material contained in this report may be subiect to theconcept of Public Interest lmmunity. No part ol this report should be disclosed to lhe defence without priorconsultation with the originator;This cover sheet must not be detached from the to which it reters.

Page 1 of 10


2/10

Private Investigators: The Rogue Element of the Private lnvestigation lndustryand Others Unlawfully Trading in Personal DataThis report presents the results of analysis under Project RIVERSIDE into the harms inflictedon the UK by the rogue element of the private investigation industry or others unlavvfullytrading in personal data.The report is accompanied by a list of interuention opportunities to target-harden against theenablers which allow unscrupulous members of the private investigation industry to providespecialist seNices to serious organised criminals.It has not been practical to separate comment from detail in this report, and the two arecombined under the heading TEXT .This repoft falls under Programme ot Activity 2 ol the UK Serious Organised Crime ControlSUMMARY

. Certain private investigators are committing criminal offences in relation to theacquisition and misuse of unlawfully acquired personal data and are supported intheir activities by key enablers. This allows them to make substantial financial profits.

. The criminal activities include unlawfully acquiring data, technical interference withelectronic media, interception of communications, corruption, and perverting thecourse of justice.

. Criminal private investigators also use corrupt employees in specialist areas such aslaw enforcement, local government, the communications industry, utility serviceproviders, banking and other public and private sector areas where useful informationis held.The clients of private investigators can be categorised generally as those involved indomestic proceedings, debt recovery tracers, insurance companies, the media andthe criminal fraternity.The ability of the investigators to commit such criminality is supported by the absenceof regulation in the industry, an abundance of law enlorcement expertise eitherthrough corrupt contacts or lrom a previous career in law enforcement, easy accessto specialist experts and abuse of legally-available technology.

INTELLIGENCE BASEThis report is based primarily on five UK law enforcement operations, details oJ which areavailable in Annex A. Additional data was retrieved from the Information Commissioner'sOflice.The intelligence cut-off date for this report was 30 September 2007.

Page 2 ot 10


3/10

TEXTTypes of Criminality and Modi Operandi1. A number of law enforcement operations xxxxxxxATUS, oARYTID,FLANDRIA and GLOXINIA) were analysed under Project RIVERSIDE to establish the typeso{ criminal activity undertaken by conupt investigators, the methods employed and the keyenablers supporting them. Details of the operations are available in Annex A.Unlawf ul Acquisition and Supplv of Personal Data2. All the cases examined under Project RIVERSIDE demonstrated a regular trade inunlawfully acquired personal data. In addition, "pretexting" or "blagging" was evident inOperations CARYTID and BARBATUS.3. The clients of private investigators can be categorised mainly, but not exclusively asfollows:

a. domestic - persons seeking to discover activities of their partners, mainly inmatrimonial and family proceedings;b. debt recovery tracing - seeking to discover the locations of debtors;c. insurance claims - loss adjusters investigating the veracity o{ claims;d. media - seeking material for "scoops" about high proiile f igures;e. criminal f raternity - the f rustration of law enforcement.4. The main business service of any private investigator is the supply of information, thevalue of which increases according to its exclusivity. Corrupt private investigators service the

need for exclusive information at a price. Some services available {rom rogue privateinvestigators are listed below:Ooeration BARBATUS

a. reports of telephone interceptions - GBP 7,000 per month;b. reports of hacking into computers - GBP 7,000 per month;c. personal or company bank details - GBP 2,000;d. surveillance - GBP 25-GBP 55 per person per hour.

Information Commissioner's Off icee. rtemised telephone billing - GBP 450 for one month's billing;l. obtaining from xxxxxxxxxxxer bank account details used to pay directdebit - GBP 100;S. obtaining from bank currenl balance of customer bank accounts and otherrelated accounts - GBP 100:

' One operation name redacted as the operation is subject to judicial review.' Supplier's name redacted as it was a victim of data loss and this is commercially sensitive.Page 3 of 10


4/10

h. obtaining details o1 dlrect debits relating to a bank account - GBP 100;t. confirmation from fx sthat a subject had an account with them buthad moved on - GBP 25;K.

details from xxxxxxxx income and tax paid - GBP 100;details of a mortgage advisor, including explicit details of mortgage - GBP150;details from50.

sconf irming two lines linked to an address - GBP5. "Prete)ding", a technique also known colloquially as "blagging", consists of privateinvestigators calling a company purporting to be someone else to access in{ormation.Blaggers may make several calls to obtain the information they want, often building up aprof ile piece by piece. The most valuable sources of information for a private investigatoraiming to trace a person are those held by HMRC (tax details) and the Department oJ Workand Pensions (DWP). Pay as You Go (PAYG) mobile telephones are often utilised lor suchblagging calls as the originator of the enquiry cannot be traced.6. While investigating a private investigation firm, officers from the InformationCommissioner's Office (lCO) recovered a document called The Blaggers Manual, namely, aguide to successful blagging. The guidance outlines methods of accessing personalinlormation through telephone conversations with staff from a variety of companies, includingfinancial institutions, HMRC, councils, utility service providers, the National Health Service,Royal Mail, and the DWP. Although some of its terminology is dated, the advice on methodsstill holds good.7 . The manual includes the following advice:

...it is probably a good idea to overcome any moral hang ups you might haveabout "snooping" or "dishonesty". The fact is that through learning acts oftechnical deception, you will be performing a task which is not only of value tous or our client, but to industry as a whole.Technical lnterference with Electronic Media8. The increasing proliferation of databases containing confidential personal informationhas resulted in private investigators developing increasingly sophisticated methods toacouire this information electronicallv. Evidence oJ such unlawful intederence was found asfollows:Ooerations FLANDRIA and BARBATUS:

a. hacking for datause of Voice over Internet Protocol (VOIP);use of dead letterboxes on e-mail accounts.

3 As footnote 2.a A Government agency, a victim of data loss.' As footnote 2.6 Relates to planned operational activity.

b.

Page 4 of 10


5/10

10. VOIP and the use ol dead letter-boxes on e-mail accounls were used to preventothers from tracing or identilying the private investigator. VOIP allows individuals to usef reely-available software to make cheap or free calls (to telephones or computers), chat, andsend messages. A dead letterbox is a single e-mail account used by two or more individualsto write and pick up e-mails lrom the 'Draft' section, thus negating the need to send theactual e-mails. Both of these methods allow criminals to have conversations not easilvtraced by law enforcement.Interception o{ Communications11. Operation CARYTID revealed evidence of unlaMul telephone interception, as didOperation BARBATUS (see paragraph 21). In Operation CARYTID, the private investigatorused a combination of corruption and blagging. He posed as an employee of acommunications service provider to acquire the PlNs Jor the mobile telephones ol staffworking for high-profile figures. Having used the information to change the telephones' PlNsback to the factory default setting, he subsequently retrieved voicemail messages, oftenbefore the owners of the phone had heard them. The investigator also managed to interceptthe landline oJ an Automated Tellino Machine at a local shoo to distance himself from hiscalls to the voicemail boxes.12. The private investigator sold the valuable private in{ormation thus acquired to atabloid journalist. He was paid a retainer by the same newspaper ol over GBP 2,000 perweek, and received an additional GBP 12,300 in separate cash payments from the News ofthe World over a ten-month period. The investigator carried out his activity for some 18months before being discovered.Corruotion

Ooerations CARYTID andFLANDRIA provided other examples of corrupt employees of communications serviceproviders. In Operation BARBATUS, the corrupt staff included serving police officers,communication service providers, and links into the banking industry.

Pervertino the Course of Justice15. Operationsxxxxx sand FLANDRIA provided examples of private investigatoractivities which threaten to undermine the criminal lustice system, as follows:a. accessing the Police National Computer to perform unauthorised checks;

b. accessing internal police databases including those containing servingoff icers' private details;

? Relates to planned operational activity.'The operation name and detail that could identify it have been redacted as the operation is subject toiudicial review." The operation name has been redacted as the operalion is sub.iect to judicial review.

14.

Page 5 of 10


6/10

t.

unauthorised checking of details of vehicles involved in surveillance on PNC;accessing details of current investigations against a criminal or criminal group;checking premises and vehicles for technical equipment deployed by lawenforcement;identifying current law enforcement interest in an organised crime group;

providing organised crime groups with counter-surveillance techniques;accessing their own or associates' recorded convictions;attempting to discover identity of CHlSes;attempting to discover location of witnesses;attempting to discover location of witnesses under police protection tointimidate them:accessing DVLA databases.

Key EnablersAbsence o{ Requlation16. The private investigation industry is currently unregulated, meaning that anyone canoperate as a private investigator. There are no benchmarks to denole fit and proper statusand no means of excluding persons of dubious character or with criminal convictions fromthe profession. Likewise, there are no specilic requirements for core skills or specific training.Unlike public authorities, private investigators are not subject to the legislative requirementsof the Regulation of Investigatory Powers Act 2000 (RIPA).Law Enforcement Trainino and Expertise17. Many private investigators have been previously employed in law enforcement or thearmed forces or are employers of such individuals. This was witnessed in Operationsxx", BARBATUS, FLANDRTA and GLoXtNtA.'18. Such individuals bring with them the skills and specialist knowledge accrued duringtheir previous careers. They are experts in law enforcement techniques, often includingsensitive covert methodology, and know the best ways to foil such techniques. In addition,many maintain contacts in current law enlorcement agencies which thqy may then exploit toachieve their ciiminal objectives, as witnessed in dperations I t', enRghtus,GLOXINIA and FLANDRIA.

d.

s.h.

J.

k.

m.

19.officers operations xx13and BARBATUS provide examples of law enforcementsupplying private investigators with intelligence and inlormation for payment. There

to This was single strand intelligence which lor which there was no collateral; it has been redacted soas nol to suggest that which was originally reported was fact or evidence.'' The operation name has been redacted as the operation is subject lo judicial review.'' As footnote 1 1.13 As footnote 1 1.

Page 6 of 10


7/10


8/10

Ixx rxxxx FLANDRIA and BARBATUSI. telephone interception devrces(operations SARBATUS and CARYTID), technical surveillance devices (OP Ixxxx ,VolP (oP xxxx )22 and dead letterboxes on e-mail accounts .

rq Relates to planned operational activity." The operation name has been redacted as the operation is subiect to iudicial review21 As footnote 20.22 As footnote 20.Page I of 10


9/10

ANNEX AProvenance of Data1. Five law enforcement operations (xxxxxxx BARBATUS, oARYTID, FLANDRTAand GLOXINIA) were analysed to establish the types of criminal activity undertaken bycorrupt investigators, the crime techniques employed, and the key enablers which supportedthem.operationxxxxxxxx

Operation BARBATUS3. BARBATUS was an MPS investigation into the unlawful activities of a firm of privateinvestigators, which had been employed by a client to retrieve information to support divorceproceedings.Operation CARYTID4. CARYTID was Metropolitan Police Service (MPS) prosecution concerning a privateinvestigator who was unlawfully acquiring data in relation to high-profile individuals andselling it to a tabloid lournalist.Operation FLANDRIA5. FLANDRIA was a SOCA investigation examining the criminal activities of a particularinvestigator. lt also analysed the activity of other investigators featured in other SOCAoperations.Ooeration GLOXINIA6. GLOXINIA was a National Crime Squad (NCS) operation concerning corruption andprivate investigators.

23 The operation name has been redacted as the operation is subject to judicial review.2a The operation name and detail lhat could identify it have been redacted as the operation is subjectto iudicial reviewPage 9 of 10


10/10

OFIGINATOR CONTACT DETAILSTo discuss the core contents of this paper further, please contact:BranchCrime Techniques DivisionSOCA lntervention DirectorateOriginator I 0207238 4131Head of Branch I 020 7238 8406DISTRIBUTION LIST

r Junior member of SOCA staff whose identity it would be inappropriate to disclose.6 Junior member of Home Office staff whose identity it would be inappropriate to disclose

Sir Stephen LanderBill HughesPaul EvansDavid BoltTrevor Pearce

Page 10 ot 10

Documents

SOCA Report on Private Investigators Report Jan 2008