Hacking: Keith Vaz says firms linked to rogue investigators may not be named

Keith Vaz, who has been leading an inquiry into private investigators suspected of hacking and other illegal practices. Photograph: Linda Nylind for the Guardian

The names of law firms, insurance companies and others linked to rogue private investigators suspected of hacking and other alleged illegal practices may not be released because they could compromise a police investigation, the chairman of the Commons home affairs select committee has said.
Keith Vaz, who has been spearheading an inquiry into private investigators' practices, told Radio 4's Today programme he wanted to reveal the names of the organisations on the list and could do so using parliamentary privilege, but had been told by the information commissioner and the Metropolitan police that they could be interested in investigating the 94 businesses and individuals on the list compiled by the Serious Organised Crime Agency (Soca).
The identities of the firms involved have not yet been revealed, although Vaz's committee has released a breakdown of the sectors they work in, including law, oil, rail services and the security industry.
Twenty-two law firms used private investigators convicted of illegally obtaining information, MPs have said.
Others on the list include celebrities, eight financial services firms and 10 insurance companies.
Vaz told BBC Radio 4's Today programme: "I don't think that parliament should be part of a 'secret squirrel' club where we are given a list that is important and should be in the public interest and we are not able to publish it.
"The reason that we can't publish it at the moment – though I am consulting with members of the committee and we will come to a view on this – is because we are told that both the information commissioner and the Metropolitan police may be interested in investigating the 94 companies, firms, individuals that are on the second list."
A final decision on whether to release the names would be taken when the committee published its report, he said.
"The deadline, if you like, is when we publish our report into private investigators, we would like to be in a position where we publish the entire list. But we don't want to compromise any investigation that the Metropolitan police may or may not be involved in."
Vaz said Soca and the police would appear before the committee on 3 September to update members on progress. "We want to be responsible," he added.
Controversy over Soca's refusal to name the rogue operators' clients has grown in the past few weeks as it emerged that blue-chip companies may have inadvertently used investigators who used illegal techniques.
There have been calls for the firms to be named and investigated in the same way as the News of the World executives and journalists were following the phone-hacking scandal.
The list suggested that private investigators often subcontracted work to each other – 16 clients were other private investigation agencies.
It was put to Vaz that the police could keep the committee "stringing along forever", and he said: "That is the balance. This list has been around for a number of years and nobody has done anything about it."
He added: "Frankly, what it just needs is somebody to go along to the 94. This can be cleared up quite quickly. You should ask the firms involved did they know that the rogue investigators were getting illegal information, were they acting illegally? If yes, then you have to consider criminal liability. If no, then you cross them off. These companies, individuals and firms don't even know they are on this list."
Vaz added: "The real root of all this, of course, is we need to regulate about private investigators. We recommended this a year ago, it's not happened and hopefully the government will finally join the debate by doing something about it."

£7,000 to hack a phone or bug a computer: Private investigators have detailed price list of illegal services

Bank details for £2,000 and phone bills for £450 also on 'menu' of services

PIs could also use viruses to steal data, including what tax people pay

Their illicit services were used by law firms, insurers and wealthy individuals

Criminal private investigators charged firms up to £7,000 to hack a phone, according to a secret document leaked yesterday.They offered to hack, blag and steal sensitive personal information in a detailed price list of illegal services, a police intelligence report found.Among those fuelling the underworld trade were information hungry law firms, insurers, financiers and wealthy individuals.The Serious Organised Crime Agency (Soca) found intercepting telephone conversations came with a bill of up to £7,000.

Yours for £7,000: Private eyes could eavesdrop conversations for a cash sum, according to Soca. File picture

And private eyes charged the same amount to use computer viruses to steal data from the hard-drives of targets.

Personal bank details could be obtained for £2,000 and one month of itemised phone billing cost £450.

More...

• Firms hired by Whitehall used rogue private eyes: Revelation means 'secret hacking scandal' has reached doors of Government
• Corrupt private investigators targeted HM Revenue and Customs, BT and British Gas to access sensitive private data

Other services, including getting customer details from utility companies and finding out how much tax people pay, could be purchased for as little as £100.

The price list was compiled in a 2008 report by Soca officials who were deeply concerned at the increasing threat of dodgy private eyes.Yesterday, an uncensored version released on the internet for the first time outlined how private investigators targeted almost every source of official information.

An itemised phone bill for a month would set clients back £450. File picture

Among the public institutions to come under attack were HM Revenue and Customs, the Department of Work and Pensions, the NHS and local authorities.

Other private companies included high street banks, British Gas, British Telecom and mobile phone companies.Rogue private investigators outsourced work to specialist ‘blaggers’ who posed as customers and colleagues to access private information.Using untraceable mobile phones, they often referred to scripts and hints recorded in a document that became known as ‘The Blagger’s Manual’.The incriminating ‘how to’ book of crime was found by police when they raided the offices of one private investigator operating in the London suburbs.

The Soca report, which was previously released in a censored form, was based on the results of five criminal investigations.Among them was Operation Carytid, Scotland Yard original investigation into phone hacking at the News of the World.They found five groups of people were using private investigators to obtain information that they could not get their hands on legitimately.They were those involved in messy divorces, debt collectors trying to find people, insurers investigating claims, criminals who want to frustrate the police and the media.

One of the most prolific private eyes has since come forward to claim that 80% of his clients were not linked to the media.The leak came as pressure continues to pile on Soca and police to name those who may have used criminal private eyes.

MPs, including Keith Vaz, want to find ways of publishing the list

More than 300 companies and individuals may have been identified by police investigating so-called ‘blue chip’ hacking.A list of 102 names has been passed to the Home Affairs Select Committee by Soca on the agreement that they will not be published.So far no-one has been named publicly or prosecuted despite clear evidence that the activities of their snoopers broke the law.Keith Vaz MP, who chairs the Home Affairs Committee, has written to a string of regulators to ask for what guidelines are enforced on the use of private eyes.MPs are concerned that some companies may have turned a blind eye to how they obtained the information because they were desperate for results.Home Secretary Theresa May is expected to announce proposals that will require private detectives to have a licence to operate.

Anyone found guilty of hacking, blagging or other similar offences will be barred from working in the field.

A spokesman for HM Revenue and Customs said it takes expert technical advice to help protect the mass of information it stores.

He said: ‘We take the protection of customer data extremely seriously so we constantly review our processes and procedures in light of developments.’A BT spokesman said staff take their responsibility to protect customers ‘very seriously’ and ‘will not tolerate’ misuse of its databases.A Home Office spokeswoman said: ‘We expect law enforcement agencies to take tough action against criminal behaviour wherever it is identified.’

What's Your Favorite Life Hack for Technology?

Because smart people who are good at solving problems with DIY methods or life hacks also happen to be very good at the Internet and because people who are good at the Internet also happen to be very good at finding DIY methods or life hacks to solve problems, it seems like we've come to a point where we already know how to solve all of technology's minor annoyances with simple DIY hacks.

Like come on, who hasn't figured out ways (or at least saved ways to a folder on their desktop called Hacks) to fix messy cables and power cords with binder clips, bread tabs and/or ribbons or something. And seriously, we all know by now that binder clips are the most versatile tool in a life hacker's arsenal, right? Cardboard toilet paper rolls are a solid second place though.

Did you hear about the one where you tie extension cords together to prevent them from unplugging? Or the accidental genius that created rubber bands on a power adapter? And what about pen springs to extend the life of your cables! There's just so many little fixes out there that blew our minds once upon a time but are just recycled over and over now. And that's fine! We didn't all know the world was round at one point. Or something like that. Whatever.

What's your favorite life hack for technology? Is it one of the nine BuzzFeed cited in the video above or is it something even better? Or maybe it's one of the 40 tricks we featured last year? Or maybe you just like seeing life hacks more than actually using life hacks.

Dotcom says Anonymous protest hack of NZ govt websites will backfire

Hackers disabled several websites of New Zealand's ruling party to protest a new law that would enable the country’s spy agency to snoop on its citizens. Kim Dotcom said hacking the sites only gave PM John Key “a new excuse to pass the GCSB bill”.
Dotcom, the MegaUpload founder who the victim of Government Communications Security Bureau (GCSB) snooping last year, is among those outraged by the New Zealand bill. However, the internet mogul said on Twitter that hacking National Party websites would only make things worse. 

The bill was actually prompted by disclosures that the Bureau had illegally spied on Dotcom, who is fighting attempts by the US government to extradite him on charges of Internet piracy, copyright infringement, and money laundering.

On July 28 hacktivist group Anonymous uploaded a video on YouTube claiming responsibility for the hacking of fourteen websites, including those for Prime Minister John Key and Finance Minister Bill English. The attack was prompted by Key’s refusal to listen to protests against the ''despicable piece of legislation''.

“This new law allows to spy on New Zealanders without a warrant. We strongly condemn this bill,” the video message explained. “John Key, do you think you can pass a new law without a majority of New Zealanders behind it?”

A screenshot from gerrybrownlee.com

The websites of the Prime Minister and Finance Minister were restored after being attacked around midnight. The website of the Deputy Leader of the National Party Gerry Brownlee is still disabled.  

The surveillance bill, which is expected to be passed in parliament, would give the GCSB carte blanche to listen in on citizens’ phone conversations. As things stand now, it spies on foreign targets via electronic listening posts but is not allowed to spy on New Zealand citizens or residents.

The law has been slammed by Internet and civil rights groups, prompting street protests over the weekend. Thousands of people turned out in eleven cities and towns across New Zealand in what was dubbed as an “uphill battle” to stop the bill from coming into effect.

''It has come to our attention that the thousands that have marched against this bill has still not been enough to send John Key and Peter Dunne a message," Anonymous said in the video message.

"John Key make no mistake the majority of New Zealanders oppose this bill. Due to your own arrogance and your unwillingness to listen to the people we have decided to take direct action.''

Anonymous promised that the websites would remain offline until the National Party patched its web servers or withdrew the bill and apologized to those it had affected, including Kim Dotcom.

Last January New Zealand police stormed Dotcom’s mansion, seizing assets and digital material. A judge later condemned the raid as illegal and ordered law enforcement to return items that were seized that were not directly linked the case against Dotcom. The judge’s decision also led to an official apology from Key to Dotcom, who alleged that the GCSB collaborated with the US government in a bid to comply with the extradition order issued by Washington.

Been hacked? Don't dial 999: The plods are too dense, sniffs sec bigwig 'The problem is too big for the authorities to handle'

Police are powerless to stop super-smart criminals from hacking the world's biggest companies, a top-ranking security bod has warned.
Juniper Networks' security chief said there was simply no longer any point in calling the police when hackers and DDoSers came to call, because the cops can't do anything. He wants to see a world where big firms share information about potential targets and stop them before any damage can be done.
Henrik Davidson, the firm's director of security, said: "The problem is too big for the authorities to handle, playing into the hands of the cyber criminals. Additionally there are complications with the global complexity that hacking presents. Who is responsible if a hacker based in Asia attacks a European company? We’ve simply reached a stage where the IT security industry needs to be able to protect itself."
Davidson made the comments while telling El Reg about Juniper's new "next generation data centre security" system, which now incorporates anti-DDoS defence systems. We visited Juniper's Dutch testing lab, where they show off their latest data centre and networking technology.
Amsterdam is, of course, famous for two things - and neither were on offer at Juniper Networks' Dutch outpost. Instead the big data shifting bods wanted to show off their sexy racks, although not in the way that most visitors to the city would understand.
Money is not discussed in the Juniper Proof of Concept lab, where customers - and the nerdier type of journalist - come to coo over various bits of data centre gubbins. Which is just as well, because with prices stretching into the tens of thousands of euros, this is not a place for the casual shopper.
Juniper told us their new data centre security system offers a four-pronged manner of repelling hackers and DDoS assaults.
The system allows companies to collect the "fingerprints" of individual hackers, by building up a picture of the attacker based on 200 characteristics, including browser settings, time zone and even fonts. This allows for the blocking of individual devices, a more sophisticated form of defence than simple IP blocking.
The newest part of this system is called DDoS Secure, which Juniper claims is capable not only of repelling traditional large-scale DDoS attacks, but also the newer “low and slow” attacks, which use slow, small-scale traffic to bypass security and bring down servers.
DDoS Secure monitors incoming and outgoing traffic, learning which IP addresses and devices can be trusted. It can detect unusual activity from a user and then respond by blocking them.
Whenever a threat at one port or other vulnerable point is identified, its details are immediately sent to other access points in order to make sure the attacker is repelled.
Juniper claimed its "Active Defence" system not only worked by fending off attacks, but by identifying threats and stopping them.
Davidson added: "Active Defence allows you to identify the bad guys before they attack. If you know who the bad guys are, and where they are coming from, you can make life difficult for your attackers if they try and break your defences.
"Attackers can be identified by a deception point, of which there are thousands. This allows you to identify the characteristics of their device, what fonts they use, what patches they have installed and their IP address, among others. With that you can push a digital fingerprint to the cloud and share the details with partners and other vendors to ensure that more organisations do not face the same threat."
According to a Juniper survey of 4,771 IT execs worldwide, 60 per cent said their systems had been attacked in the past 12 months. But the same percentage of execs were unhappy with their current defence systems, including next-generation firewalls and IP blocking.
"For 40 anti-virus systems, there is only a 5% catch rate," Davidson continued. "According to William Fallon’s book The Cyber-readiness Reality Check the number of organisations under attack is close to 100%. More than a third of cyber security execs at companies with revenues greater than $100 million are unable to see an attack once it finds its way into the perimeter of their system. It’s like leaving your front door wide open when there is a burglar in the neighbourhood.
"Traditional security methods just aren’t passing the test and companies don’t stand a chance as cyber-crime becomes increasingly sophisticated and more frequent."
Juniper's bosses stepped down on Wednesday in happy circumstances, with the firm's profits and sales both up