g

SERIEUS OiIEANISED

5EtrA
CRIME AIiENEY

Reference: CTH (01/08) 027 Originator: Intervention / Crime Techniques

SOCA Report

January 2008

lnstructions This report may be circulated within your departmenl in accordance with departmenlal securlty instructions and with caveats included within the report; The information contained in this report is supplied in confidence and may not be disseminated beyond the agreed readership/handling code recipient without prior reference to SOCA; No part of this report may be disclosed without prior consultation with the originator; This information is supplied in confidence by SOCA, and is exempt from disclosure under the Freedom of Information Act 2000. lt may also be subject to exemption under other UK legislation. Onward disclosure may be unlawful, for example, under the Data Protection Act 1998. Requests for disclosure to the public must be referred to the SOCA FOI single point of contact, by email on l9j4.9!ggjd99@S.89aJ@ or by telephoning +44 (01870 268 8677; This report may contain 'Sensitive Malerial'as defined in the Attorney General's guidelines tor the disclosure ol 'Unused Material'to the defence. Any sensitive material contained in this report may be subiect to the concept of Public Interest lmmunity. No part ol this report should be disclosed to lhe defence without prior
consultation with the originator; This cover sheet must not be detached from the

to which it reters.

Page 1 of 10

Private Investigators: The Rogue Element of the Private lnvestigation lndustry and Others Unlawfully Trading in Personal Data
This report presents the results of analysis under Project RIVERSIDE into the harms inflicted on the UK by the rogue element of the private investigation industry or others unlavvfully trading in personal data. The report is accompanied by a list of interuention opportunities to target-harden against the enablers which allow unscrupulous members of the private investigation industry to provide specialist seNices to serious organised criminals.

It has not been practical to separate comment from detail in this report, and the two are
combined under the heading TEXT
.

This repoft falls under Programme ot Activity 2 ol the UK Serious Organised Crime Control

SUMMARY

. . .

Certain private investigators are committing criminal offences in relation to the acquisition and misuse of unlawfully acquired personal data and are supported in
their activities by key enablers. This allows them to make substantial financial profits.

The criminal activities include unlawfully acquiring data, technical interference with electronic media, interception of communications, corruption, and perverting the
course of justice.

Criminal private investigators also use corrupt employees in specialist areas such as law enforcement, local government, the communications industry, utility service providers, banking and other public and private sector areas where useful information is held. The clients of private investigators can be categorised generally as those involved in domestic proceedings, debt recovery tracers, insurance companies, the media and the criminal fraternity.
The ability of the investigators to commit such criminality is supported by the absence of regulation in the industry, an abundance of law enlorcement expertise either through corrupt contacts or lrom a previous career in law enforcement, easy access to specialist experts and abuse of legally-available technology.

INTELLIGENCE BASE

This report is based primarily on five UK law enforcement operations, details oJ which are available in Annex A. Additional data was retrieved from the Information Commissioner's
Oflice.

The intelligence cut-off date for this report was 30 September 2007.

Page 2 ot 10

TEXT

Types of Criminality and Modi Operandi

oARYTID, number of law enforcement operations xxxxxxxATUS, FLANDRIA and GLOXINIA) were analysed under Project RIVERSIDE to establish the types o{ criminal activity undertaken by conupt investigators, the methods employed and the key enablers supporting them. Details of the operations are available in Annex A.

1.

Unlawf ul Acquisition and Supplv of Personal Data

2.

All the cases examined under Project RIVERSIDE demonstrated a regular trade in unlawfully acquired personal data. In addition, "pretexting" or "blagging" was evident in Operations CARYTID and BARBATUS.
The clients of private investigators can be categorised mainly, but not exclusively as

3.
follows:

a. b. c. d. e. 4.

domestic

- persons seeking to discover activities of their partners, mainly in matrimonial and family proceedings;
seeking to discover the locations of debtors; insurance claims media

debt recovery tracing

loss adjusters investigating the veracity o{ claims;

seeking material for "scoops" about high proiile f igures; the f rustration of law enforcement.

criminal f raternity

The main business service of any private investigator is the supply of information, the value of which increases according to its exclusivity. Corrupt private investigators service the need for exclusive information at a price. Some services available {rom rogue private investigators are listed below: Ooeration BARBATUS

a. b. c. d. e. l. S.

reports of telephone interceptions reports of hacking into computers personal or company bank details surveillance

GBP 7,000 per month; GBP 7,000 per month; GBP 2,000;

GBP 25-GBP 55 per person per hour.

Information Commissioner's Off ice rtemised telephone billing

GBP 450 for one month's billing;

obtaining from xxxxxxxxxxx debit - GBP 100;

er

bank account details used to pay direct

obtaining from bank currenl balance of customer bank accounts and other related accounts - GBP 100:

'

' One operation name redacted as the operation is subject to judicial review. Supplier's name redacted as it was a victim of data loss and this is commercially sensitive. Page 3 of 10

h.
t.

obtaining details o1 dlrect debits relating to a bank account

GBP 100;

confirmation from x had moved on - GBP 25;

details from

sthat a subject had an account with them but

xxxxxxxx

income and tax paid

GBP 100;

K.

details of a mortgage advisor, including explicit details of mortgage

150;

GBP

details from 50.

sconf

irming two lines linked to an address

GBP

5.

"Prete)ding", a technique also known colloquially as "blagging", consists of private investigators calling a company purporting to be someone else to access in{ormation. Blaggers may make several calls to obtain the information they want, often building up a prof ile piece by piece. The most valuable sources of information for a private investigator aiming to trace a person are those held by HMRC (tax details) and the Department oJ Work and Pensions (DWP). Pay as You Go (PAYG) mobile telephones are often utilised lor such blagging calls as the originator of the enquiry cannot be traced.

6.

While investigating a private investigation firm, officers from the Information Commissioner's Office (lCO) recovered a document called The Blaggers Manual, namely, a guide to successful blagging. The guidance outlines methods of accessing personal inlormation through telephone conversations with staff from a variety of companies, including financial institutions, HMRC, councils, utility service providers, the National Health Service, Royal Mail, and the DWP. Although some of its terminology is dated, the advice on methods still holds good.
7

The manual includes the following advice:

...it is probably a good idea to overcome any moral hang ups you might have about "snooping" or "dishonesty". The fact is that through learning acts of technical deception, you will be performing a task which is not only of value to us or our client, but to industry as a whole.

Technical lnterference with Electronic Media

The increasing proliferation of databases containing confidential personal information has resulted in private investigators developing increasingly sophisticated methods to acouire this information electronicallv. Evidence oJ such unlawful intederence was found as follows:
Ooerations FLANDRIA and BARBATUS:

8.

a.
b.

hacking for data use of Voice over Internet Protocol (VOIP); use of dead letterboxes on e-mail accounts.

a
6

As footnote 2.

A Government agency, a victim of data loss.

As footnote 2.

'

Relates to planned operational activity.

Page 4 of 10

VOIP and the use ol dead letter-boxes on e-mail accounls were used to prevent others from tracing or identilying the private investigator. VOIP allows individuals to use f reely-available software to make cheap or free calls (to telephones or computers), chat, and send messages. A dead letterbox is a single e-mail account used by two or more individuals to write and pick up e-mails lrom the 'Draft' section, thus negating the need to send the actual e-mails. Both of these methods allow criminals to have conversations not easilv traced by law enforcement.
Interception o{ Communications

10.

Operation CARYTID revealed evidence of unlaMul telephone interception, as did Operation BARBATUS (see paragraph 21). In Operation CARYTID, the private investigator used a combination of corruption and blagging. He posed as an employee of a communications service provider to acquire the PlNs Jor the mobile telephones ol staff working for high-profile figures. Having used the information to change the telephones' PlNs back to the factory default setting, he subsequently retrieved voicemail messages, often before the owners of the phone had heard them. The investigator also managed to intercept the landline oJ an Automated Tellino Machine at a local shoo to distance himself from his calls to the voicemail boxes.

11.

The private investigator sold the valuable private in{ormation thus acquired to a tabloid journalist. He was paid a retainer by the same newspaper ol over GBP 2,000 per week, and received an additional GBP 12,300 in separate cash payments from the News of the World over a ten-month period. The investigator carried out his activity for some 18 months before being discovered.
Corruotion 14.

12.

Ooerations CARYTID and FLANDRIA provided other examples of corrupt employees of communications service providers. In Operation BARBATUS, the corrupt staff included serving police officers, communication service providers, and links into the banking industry.

Pervertino the Course of Justice

sand FLANDRIA provided examples Operations activities which threaten to undermine the criminal lustice system, as follows:

15.

xxxxx

of private

investigator

a. b.

accessing the Police National Computer to perform unauthorised checks;

accessing internal police databases including those containing serving

off

icers' private details;

Relates to planned operational activity. 'The operation name and detail that could identify it have been redacted as the operation is subject to iudicial review. " The operation name has been redacted as the operalion is sub.iect to judicial review.

Page 5 of 10

unauthorised checking of details of vehicles involved in surveillance on PNC;

d.

accessing details of current investigations against a criminal or criminal group;

checking premises and vehicles for technical equipment deployed by law

enforcement;
t.

identifying current law enforcement interest in an organised crime group;

s.
h.

providing organised crime groups with counter-surveillance techniques; accessing their own or associates' recorded convictions;

J.

attempting to discover identity of CHlSes; attempting to discover location of witnesses;

k.

attempting

to

discover location

of witnesses under police protection

to

intimidate them:
m.

accessing DVLA databases.

Key Enablers
Absence o{ Requlation

The private investigation industry is currently unregulated, meaning that anyone can operate as a private investigator. There are no benchmarks to denole fit and proper status and no means of excluding persons of dubious character or with criminal convictions from the profession. Likewise, there are no specilic requirements for core skills or specific training. Unlike public authorities, private investigators are not subject to the legislative requirements of the Regulation of Investigatory Powers Act 2000 (RIPA).
Law Enforcement Trainino and Expertise

16.

17.
",

Many private investigators have been previously employed in law enforcement or the

armed forces or are employers of such individuals. This was witnessed in Operationsxx BARBATUS, FLANDRTA and GLoXtNtA.
Such individuals bring with them the skills and specialist knowledge accrued during their previous careers. They are experts in law enforcement techniques, often including sensitive covert methodology, and know the best ways to foil such techniques. In addition,
many maintain contacts in current law enlorcement agencies which thqy may then exploit to t', enRghtus, achieve their ciiminal objectives, as witnessed in dperations GLOXINIA and FLANDRIA.

'18.

13and BARBATUS provide examples of law enforcement officers supplying private investigators with intelligence and inlormation for payment. There
19.

operations xx

This was single strand intelligence which lor which there was no collateral; it has been redacted so as nol to suggest that which was originally reported was fact or evidence. '' The operation name has been redacted as the operation is subject lo judicial review. '' As footnote 1 1.
13

to

As footnote

1 1.

Page 6 of 10

may also be occasions when officers supply information as a favour to their ex-colleagues. Theoretically, they may then be forced to continue providing such information because of the threat of their initial breach being reported. Private investigators are expert at developing and cultivating useful relationships for their own purposes, a-s witnessed in operations '', BAR-BATUS, FLANDRIA and pubs,/restaurants frequented by law GLOXINIA. Other methods include socialising in entorcement personnel who may unwittingly compromise operations by being unguarded in provided the following eximple of s6me ot the their conversations. operation methods used to cultivate and maintain relationshios with law enforcement:

20.

Ixx

a. b. c.

joining a Freemasons' Lodge frequented by law enforcement;

socialising

at law

enforcement functions and/or pubs frequented by law

enforcement;

establishing relationships with current law enforcement officer using an exaggerated or fake law enforcement past to gain trust and camaraderie.

Specialist Service Providers

BARBATUS, CARYTID and FLANDRIA all provided examples of contracting out work to specialist service providers. These "experts" were used because of their specilic technical skills or because they were the lirst point of contact with the holder of the information. Examples include corrupt contacts accessed via a third party, trained communication engineers and experts in electronic attacks on inlormation technology.

21.

operations

Ixxxx

an employee of a communications service provider provided subscriber details and billing details to the investigator for payment. Once an investigator has cultivated a corrupt relationship, other investigators will then sub-contracl that strand of work out to the investigator with the contact. This was seen in Operation FLANDRIA.

22. fn operation

-,u

Corrupt employees may also provide valuable inlormation in the form of company passwords, changed on a daily or weekly basis. As seen in Operation CARYTID, these can then allow a person to lalsely validate themselves as a bona fide employee when making a telephone enquiry.

23.

Such use ol specialists is common. Private investigation companies are oJten interconnected through loose networks. Contracting out work distances the person making the enouirv and creates a sterile corridor. makinq detection more difficult. This method was aru r.-ArrunrA. seen In \Jperauon" I

24.

25. Operation BARBATUS revealed the regular interception of telephone calls by a private investigation company thanks to a telephone interception specialist. He
manufactured several devices which were physically attached to the target's landline at the relevant signal box by a British Telecom-trained telecommunications engineer.

Technoloqv

26. A wide range oJ sophisticated technical equipment is legitimately available from private security ret;ilers. Project RIVERSIDE uncoveied evidenc6 of the use ol I
1a

17 18

The operalion name has been redacted as the operation is subject to judicial review. As footnote 14. 16 As footnote 1 4.

''

As lootnote '14. As lootnote 14.

Page 7 of 10

Ixx

VolP (oP xxxx

FLANDRIA and BARBATUSI. telephone interception devrces (operations SARBATUS and CARYTID), technical surveillance devices (OP Ixxxx ,
)22

rxxxx

and dead letterboxes on e-mail accounts

rq

The operation " 21

Relates to planned operational activity.

name has been redacted as the operation is subiect to iudicial review As footnote 20. 22 As footnote 20.

Page

of 10

ANNEX A

Provenance of Data

1. Five law enforcement operations (xxxxxxx BARBATUS, oARYTID, FLANDRTA and GLOXINIA) were analysed to establish the types of criminal activity undertaken by
corrupt investigators, the crime techniques employed, and the key enablers which supported them. operation

xxxxxxxx

Operation BARBATUS

3.

BARBATUS was an MPS investigation into the unlawful activities of a firm of private investigators, which had been employed by a client to retrieve information to support divorce proceedings. Operation CARYTID

4.

CARYTID was Metropolitan Police Service (MPS) prosecution concerning a private investigator who was unlawfully acquiring data in relation to high-profile individuals and selling it to a tabloid lournalist.
Operation FLANDRIA

5.

FLANDRIA was a SOCA investigation examining the criminal activities of a particular investigator. lt also analysed the activity of other investigators featured in other SOCA operations. Ooeration GLOXINIA

6.

GLOXINIA was a National Crime Squad (NCS) operation concerning corruption and private investigators.

The operation name has been redacted as the operation is subject to judicial review. The operation name and detail lhat could identify it have been redacted as the operation is subject to iudicial review
2a

23

Page 9 of 10

OFIGINATOR CONTACT DETAILS

To discuss the core contents of this paper further, please contact:

Branch Crime Techniques Division SOCA lntervention Directorate Originator I 0207238 4131 Head of Branch I 020 7238 8406
DISTRIBUTION LIST

Sir Stephen Lander Bill Hughes Paul Evans David Bolt Trevor Pearce

6 Junior member of Home Office staff whose identity it would be inappropriate to disclose

Junior member of SOCA staff whose identity it would be inappropriate to disclose.

Page 10 ot 10