May 18, 2018

Murdoch MacLennan ‘horrified’ at prospect journalists’ data may have been accessed improperly in security breach at Irish news publisher

The chairman of a major Irish news publisher has said he is “horrified” by the possibility its employees may have had their data improperly accessed.

Directors at Independent News and Media, which publishes seven national titles including the Irish Independent, Sunday Independent, Belfast Telegraph and The Herald, are concerned that journalists’ work data may have been accessed, leading to fears sources could have been exposed.

A suspected data security incident from 2014 came to light after Ireland’s corporate watchdog, the Office of the Director of Corporate Enforcement, applied to the High Court to allow inspectors to probe the affairs of the company in March.

INM has since tried to block any such appointment and is seeking judicial review in the High Court over the ODCE’s decision to apply for an inspector to look into its affairs.

The case was heard last week and both sides now await judgement.

The ODCE’s High Court affidavit revealed the alleged data breach centres around the company’s IT system back-up tapes being removed from its Dublin premises and “interrogated” (searching and obtaining data) by at least six external companies.

There are fears the email communications of several journalists, including Sunday Independent deputy editor Brendan O’Connor, were accessed outside of the organisation.

INM previously said the data was provided to a third-party service provider under instruction from then chairman Leslie Buckley, who stepped down from his role last month and who has said he will robustly defend any allegations made against him.

In a statement prepared ahead of the company’s AGM today, INM chairman Murdoch MacLennan said Deloitte had been appointed to conduct a full investigation into the allegations.

He said: “The board is horrified at the prospect that third parties may have had access for an improper purpose to data held by INM which relates to, or concerns, INM’s employees or others.

“If it has occurred, this is entirely deplorable. The board believes that any person who facilitated or exploited such access should be required to account fully as to how and why they obtained access to such data, for what purpose and what use was actually made of such data.

“The board is particularly concerned by the suggestion that data maintained by journalists for the purposes of their professional activities might have been accessed for any improper purpose.

“The board considers the integrity and protection of journalist sources and inquiries a foundation stone of the operation of a free and effective press and is committed to protecting those fundamental principles.”

He added: “Let me tell you this: if there was any wrongdoing in the past it was done without the knowledge or approval of the board.”

INM, which also publishes 12 Irish regional newspapers, first notified the Data Protection Commissioner in Ireland (responsible for upholding citizens’ data rights) of a data security incident in August 2017.

The company is now cooperating with two ongoing investigations by the DPC and the ODCE.

Explaining why INM decided to oppose the ODCE’s attempt to appoint an inspector to look at the company, MacLennan said the board was “gravely concerned” this would have a “significantly damaging impact”.

He added that the board does not believe it would be “either justified or proportionate in all the circumstances, particularly given INM’s cooperation with the ODCE and the fact that the Data Protection Commissioner is conducting her own investigation”.

They are “acutely conscious” of the “very considerable ongoing cost” and need to dedicate “substantial resources” that the appointment of inspectors would cause the company, he said.

Already in the past year, MacLennan said the company had responded to 14 requests from the ODCE for the production of books and records.

MacLennan nonetheless said the group’s trading performance year to date continues in line with market expectations.

This is despite higher declines in digital advertising than anticipated and the challenges from a red weather warning during the snow in March which made it difficult to get newspapers into shops.