Tomorrows Ear - Documentary

National Geographic Channel - 11th November 2004
Tomorrows Ear - Documentary

Interview with Mr Alex Bomberg on the subject of Espionage, telephone interception and room bugging/eavesdropping.

Mr Alex Bomberg, Group CEO, International Intelligence Limited

A former member of the British Army and aide to members of the British Royal Family, Alex specialises in counter espionage and intelligence gathering, heading the operational element of the company.

Since the formation of the company in 2002, Alex has been instructed by a number of Government agencies and Royal families worldwide to provide security and intelligence based solutions

Spies in the boardroom

Not a week goes by without our offices receiving one or more telephone calls from around the world asking if something is technically possible.

Almost anything is technically possible in espionage when you are dealing with multi-billion pound litigation cases, mergers and accusations or intellectual property rights. A budget of £100k will buy a package of email interception and telephone tapping for a month; while this amount sounds quite high, when involved in a hostile takeover or litigation worth hundreds of Millions of pounds it makes good financial sense to some when they are involved in takeover or litigation worth hundreds of millions of pounds.

Many working within the public security sector or defence industry understand little about espionage or the little that they do know is well out of date. Espionage is a very fast moving sector. Each innovation in communications leads to another way of interception, every time microprocessors get smaller and faster covert eavesdropping devices get smaller and smarter.

Almost every day, we at International Intelligence Limited asked how people can communicate safely and our answer always remains the same – “you are far safer talking over your fence to your neighbour than you are making a telephone call, sending an email or fax. All forms of electronic communication can be intercepted at some level or another”.

This may sound a little over the top or scare mongering, but the fact is that a low cost covert transmitter placed within a company’s boardroom can cost the target company millions in lost deals, legal cases or intellectual property theft.

Understanding the basic principles of espionage and human nature is a good start for secure working practices and a basis of an organisations housekeeping policy.

Corporate responsibility
Many organisations and companies fall at the very first hurdle and lack basic internal and external security. For example, can you be certain how many members of your staff would challenge a stranger walking around the office with a clip board under arm or wearing a hard hat and workman’s vest?

It is a good start therefore to have a basic policy of staff identity cards worn at all time is a good start, it is the duty of all staff to make this policy work. What’s the use of having a security policy that is costly, difficult to implement and impractical?

One firm that we recently visited had a sound security policy, CCTV and static security guards checking everyone at reception. Great, you may think, yet we gained access to the offices and boardroom via the fire escape that was propped open by a chair that gave workers access to a place to have a quick smoke.

At the end of the day a security policy is only as good as the staff within the building – it is everyone’s responsibility, from Cleaner and Typist to the CEO.

Espionage is on the increase in the UK and is on the increase, over the past five years, there have been a number of public cases that have involved accusations of bugging, email interception, telephone tapping or waste theft.

Espionage and the Law
In the UK there are no specific laws that cover espionage and therefore any prosecutions have to be carried out under other laws. For example if you were caught tapping a telephone line you could be arrested under a number of acts, you could be arrested under Article 8 of the Convention on Human Rights, Interception of Communication Act 1995/ Regulation of Investigatory Powers Act 2000 or the Protection from Harassment Act 1997. You might be prosecuted for theft of electricity from the telephone provider and trespass.

Company’s which employ investigators in support of litigation cases may run into problems over how intelligence gained is going to be used in court. As all evidence has to be disclosed to the opposition in the case, any which has been obtained unlawfully may be discounted by a judge and action taken against the party submitting it. This happened in the Dubai Aluminium case, when an investigator was employed to obtain bank details in breach of the Data Protection Act 1984 which was then in force.

A recent case where telephone tapping/interception took place was St Merryn Meats Ltd and others vs. Hawkins and Others ([2001 ALL ER (D) 355) where evidence was gained by bugging a person’s home telephone. The court held that this was unlawful, as it constituted an offence under the Interception of Communications Act 1995 which has been replaced by the Investigatory Powers Act 2000.

It is, therefore, probably more sensible and less stressful to avoid the need for litigation in the first place and there are ten basic steps that any organisation can take to secure its operations. These are easy to follow and, far more importantly, easy to implement.

Steps to counter espionage
The first step to counter espionage is to identify the strengths and weaknesses within your organisation or company in order to help develop a sound security policy, based on findings.

• All departments’ should have cross shredding type shredders because the waste from strip shredders can be placed back together with a little work.
• All documents should be locked away in secure cabinets prior to the end of each day.
• Programmes for encryption of email and files to government standards can be downloaded free from the Internet.
• Documentation concerning sensitive issues, mergers or takeovers should never leave the workplace unless signed out and secured.
• A CCTV system giving internal and external coverage will put off any illegal activities and deter the opportunist.

Never open email attachments from unknown sources as these may contain Trojan viruses that can be used to attach your computer from within. Always update your anti virus software and make sure all staff are aware of this risk as viruses can spread on networked systems at speed.

1. Changing from analogue to digital or normal copper pair to fibre-optic telecommunications will foil attempts to intercept telephone or fax lines.
2. The wearing of Staff and Visitor ID will enable all workers to identify persons that do not belong in a given sector or are unaccompanied.
3. A Technical Surveillance Counter Measures (TSCM) Sweep of offices should always form part of a good housekeeping policy as it is designed to find any devices placed within communications systems or offices.

During the course of a year, we hear the same excuses from people who are convinced that their companies’ security policies are adequate and that they need to take no action to update their systems. These include the old myths such as their company not being a target, phone tapping being too expensive to worry about and the belief that they are safe because they work from home.

They ignore the fact that no organisation is too large or too small to be targeted. The very nature of business competitiveness means that people will want to know your secrets, what your new product is, who your clients are and what you charge them.

They ignore the fact that directors who work from home are softer targets for telephone and email interception.

What they should be doing is working out what their last contract was worth and what it would mean to them if they lost it to Joe Bloggs up the road.

Who is watching you?

Who is watching you?
Senior jobs in finance are highly paid and high profile - which helps explain why employers are becoming more aggressive in their vetting processes of potential recruits. But how far can they go?

In bars in the financial districts, the talk is about the jobs market and who is going where. It's a perennial theme but one which recently has been given a new twist. Now much of the chat over the premium beers and pinot grigio comes back to the lengths to which recruiting employers will go to ensure that preferred candidates - both individuals and teams - are all they promise to be.
Gone are the days when a CV was accepted on trust. Gone are the days when a quick check of references was the norm. Increasingly, specialist corporate investigators are becoming a common feature of the recruitment landscape in financial services - and not just for the £1m+ jobs. These people dig into candidate CVs and backgrounds and run checks for their client companies.

For the person on the receiving end it can be an intrusive experience, particularly as the law in this area is grey, to say the least.

There is some protection in place, in the form of the Data Protection Act. The employment practices code of the Information Commissioner the Act's enforcer says firms should only use vetting services when there are "particular and significant risks involved to the employer clients customers or others and where there is no less intrusive and reasonably practical alternative". The code adds: "Wherever practical, firms should obtain the relevant information directly from the applicant, rather than undertake pre-employment vetting."

Given the sensitivity of financial services work, that still leaves a lot of room for digging. As Alan Beazley, of Risk Advisory Group's employee screening service, puts it: "Most of our work is for regulated financial services clients, so we are aiming to protect their reputations and ensure proper vetting of people who are going to become approved persons by the Financial Services Authority (FSA)." It is not uncommon nowadays for potential recruits to be asked to volunteer key personal and financial information. But you have the comfort of knowing that without your consent the information cannot be accessed. Corporate investigators have no power to obtain financial records like bank credit card or loan accounts. The same applies to medical records, and some universities refuse to verify qualifications. But a refusal to play ball can be considered telling in itself.

Alex Bomberg, managing director of International Intelligence, another investigations agency working in this area, says: "We often ask the client to get the applicant to perform a police national computer check on themselves. If someone has got something in their past, they will normally refuse to do it."

The higher the profile of the job and the bigger the salary bill, the more aggressive the vetting can be. Some firms even use surveillance of potentials recruits - and particularly when taking on teams of people, at great cost, from rival institutions. The ethics on this are unclear. A spokesman for the Information Commissioner says: "Surveillance would be frowned upon by us, unless it was made clear to the employee that he was going to be followed home when he left the office. It would be seen as a major intrusion."

Under surveillance even given that surveillance does happen. Bomberg says: "Sometimes, when employing people abroad, potential employers like to know what someone's lifestyle is like. The last thing any big company wants is to employ someone who is out snorting cocaine every night or visiting houses of ill repute."

For people in the industry, the message is clear - get used to the new high-level vetting procedures. Corporate investigations is an "expanding field of work", according to Bomberg. His business now has a staff of 30 and offices in New York, London and Paris. But it is also possible to make life easier for yourself by understanding what recruiting companies are looking for.

Patrick Grayson, one of three founding partners of London investigations firm GPW, says: "Our job is to look for the hair cracks in the CV." Such "cracks" can include gaps in employment history, which can sometimes indicates an unsuccessful short period in a post the potential recruit would rather forget. Grayson likes to ask ex-colleagues what they think of their former associate. "I have seen mindblowingly fictitious CVs which you can drive a coach and horses through," he says. "They range from straight carelessness and modest embellishment to evasion, serious embellishment and downright lies."

Information about past bankruptcies and county court judgments are in the public domain and investigators make regular use of credit checking agencies. The electoral roll is also used to verify addresses, though one-third of people nowadays ask for their details not to be made publicly available. Some people try to evade credit reference checks on property by having second addresses that they do not declare. Standard internet checks can also falter, because some job applicants have been known to write false articles about themselves and post them on websites.

Careful vetting Methods of checking such information are meant to conform to strict legal and ethical codes - although the reality is that in some instances you may not even be aware that you have been investigated. Hopefully these cases are the exceptions - the stuff of gossip in City bars.

Hedley Clark, managing director of the global background screening business of Kroll, the world's largest corporate investigations firm, says: "We do not ask about personal lives. You have to be careful in terms of data protection when you are getting into personal sensitive data like race, religion, sexual preference and union membership. "The majority of the work that we do is verification. There is a fairly detailed review that is required for FSA- approved persons. In 99 out of 100 cases, it is going to pick up any irregularities through references and other checks we make.

"The recruitment market has moved on from the days when it was not very open to wanting people to know that you are going to do a simple screen on them. Often they will not then lie in the first place if they have got something to hide and will tell you upfront. It is less of a cloak and dagger type of thing."

So why do companies pry?
The Chartered Institute of Personnel Development found in a recent survey that one in four British bosses had withdrawn a job offer after finding that the prospective employee had lied on their application form or CV. A similar proportion had fired someone after discovering they had lied to get their job.

Hedley Clark of Kroll recalls: "There was one chap who was trying to find a job in the UK, but the company he had worked for in Switzerland had changed names. It turned out that he had stolen SFr1m (£460,000) from the company and was wanted by the police."

Alex Bomberg of International Intelligence says: "There have been quite a few instances in the last few years of people lying on their CVs. We have uncovered a couple of real Walter Mitty characters who had lied ten years or so ago to bluff themselves into top positions. Once people are in senior management positions, they can quite easily get other jobs at the same level."

Alan Beazley of Risk Advisory Group: "It is not that common that we get blatant fraud, but it does happen. We get a number of cases where people produce bogus academic certificates with fraudulent employer references."

What does it cost companies to screen?
Prices for corporate investigations obviously vary on a case-by-case basis. At the most routine end, a screening service may charge between £120 and £350 to screen a potential employee's CV.Some firms position themselves at the top end of the market, checking out senior executives and board appointments at an advanced stage in the recruitment process.

Patrick Grayson, a founding partner of London firm GPW, says: "To hire us, clients have to be thinking that they might spend not less than £3,000 on our work, so you would expect to get a very thorough job." He adds that a typical assignment might involve someone earning at least £150,000 a year.Surveillance of a candidate obviously costs a lot more.

Alex Bomberg, managing director of International Intelligence, advises that ordering surveillance is still rare - some firms refuse to do it for this sort of recruitment work - and most likely to happen with potential hires from overseas. "You are talking about an extra £350 a day to get someone to do surveillance." His firm uses former SAS and MI6 personnel, and is careful to comply with privacy laws so that following someone around does not become stalking. "It is not normally within the budget."