Conclusions and recommendations
1. We have been frustrated by the confusion which has arisen from the evidence given by the CPS to us and our sister Committee. It is difficult to understand what advice was given to whom, when. Only on the last day on which we took evidence did it become clear that there had been a significant conversation between the Director of Public Prosecutions and Assistant Commissioner Yates regarding the mention in the Mulcaire papers of the name Neville and whether this and Mr Mulcaire's contract with News International were a sufficient basis on which to re-open the investigation. The fact that the CPS decided it was not, does not in any way exonerate the police from their actions during the inquiry.
(Paragraph 34)
The lack of a regulatory authority under the Regulation of Investigatory Powers Act has a number of serious consequences. Although the Information Commissioner's office provides some advice, there is no formal mechanism for either those who know they are in danger of breaking the law or those whose communications may be or have been intercepted to obtain information and advice. Moreover, the only avenue if anyone is suspected of unauthorised interception is to prosecute a criminal offence, which, as the Information Commissioner noted, is a high hurdle in terms of standard of proof as well as penalty.
Especially given the apparent increase of hacking in areas such as child custody battles and matrimonial disputes, and the consequential danger of either the police being swamped or the law becoming unenforceable, there is a strong argument for introducing a more flexible approach to the regime, with the intention of allowing victims easier recourse to redress. We therefore recommend the extension of the Information Commissioner's remit to cover the provision of advice and support in relation to chapter 1 of the Regulation of Investigatory Powers Act.
(Paragraph 39)
2. We also strongly recommend that the Government reviews how the Act must be amended to allow for a greater variety of penalties for offences of unlawful interception, including the option of providing for civil redress, whilst retaining the current penalty as a deterrent for serious breaches.
(Paragraph 40)
3. We note that most of our witnesses claimed to be unaware at the time of the Information Commissioner's two 2006 reports, What price privacy? and What price privacy now?. We are disappointed that they did not attract more attention among the police, the media and in government, and hope that future such reports will be better attended to.
(Paragraph 41)
4. We are concerned about the number of Commissioners, each responsible for different aspects of privacy. We recommend that the government consider seriously appointing one overall Commissioner, with specialists leading on each separate area.
(Paragraph 42)
5. We deplore the response of News International to the original investigation into hacking. It is almost impossible to escape the conclusion voiced by Mr Clarke that they were deliberately trying to thwart a criminal investigation.
We are astounded at the length of time it has taken for News International to cooperate with the police but we are appalled that this is advanced as a reason for failing to mount a robust investigation. The failure of lawbreakers to cooperate with the police is a common state of affairs. Indeed, it might be argued that a failure to cooperate might offer good reason to intensify the investigations rather than being a reason for abandoning them. None of the evidence given to us suggests that these problems were escalated for consideration by the Commissioner of the Metropolitan Police or by Ministers. The difficulties were offered to us as justifying a failure to investigate further and we saw nothing that suggested there was a real will to tackle and overcome those obstacles.
We note that neither of these carefully-crafted responses is a categorical denial: Ms Brooks's denial of knowledge of hacking is limited to her time as editor of News of the World; and on payments to police, she did not say that she had no knowledge of specific payments but that she had not intended to give the impression that she had knowledge of specific cases.
(Paragraph 52)
6. The consequences of the decision to focus within the Mulcaire papers on the areas vital to the prosecution of Mulcaire and Goodman were extremely significant. A huge amount of material that could have identified other perpetrators and victims was in effect set to one side. Mr Clarke explained to us the reasons for taking this approach, starting with the context at the time.
By the middle of 2006 the Anti-Terrorist Branch had more than 70 live operations relating to terrorist plots but some of these were not being investigated because there were not enough officers to do so. In this context, he had to decide on priorities, and the priority of protecting life by preventing terrorist attacks was higher than that of dealing with a criminal course of conduct that involved gross breaches of privacy but no apparent threat of physical harm to the public.
Nevertheless we cannot overlook the fact that the decision taken not to properly investigate led to serious wrongdoing which the Commissioner himself now accepts was disreputable.
(Paragraph 55)
7. When challenged on whether he stood by his decision to limit the investigation in 2006, Mr Clarke said that, despite all that had been revealed since, he believed the decision to have been correct, given the limited resources at his disposal and the absolute priority of dealing with threats to public safety. We note this position. However, its consequences have been serious and we are not convinced that the former Commissioner's decision to merge anti-terrorist and royal protection functions on the basis that both involved firearms, or the decision to pursue this investigation within the command, were justified. It is also revealing about the nature of management within the Metropolitan Police Service that this issue does not appear to have been escalated to the Commissioner or Deputy Commissioner, or even the Assistant Commissioner, as an issue about which they ought to be aware and to which a solution needed to be found.
(Paragraph 61)
8. whilst it is true that mobile phone companies have now acted to provide much greater security for their customers' communications, and whilst the 2005-07 inquiry succeeded on its own terms, we cannot say that inquiry was a success given the extent of the intrusion now becoming apparent and the fact that even now not all the victims of interception have been identified let alone contacted. Nor are we convinced that no hacking takes places or that it cannot take place. We do not have the technical competence to make such a judgement, and nor did we receive detailed evidence on that point.
(Paragraph 62)
9. Mr Hayman claims to have had little knowledge of the detail of the 2006 operation, and to have taken no part in scoping it or reviewing it; his role seems to have been merely to rubber-stamp what more junior officers did. Whilst we have no reason to question the ability and diligence of the officers on the investigation team, we do wonder what 'oversight', 'responsibility' and 'accountability'—all of which words were used by Mr Hayman to describe his role—mean in this context.
(Paragraph 66)
10. Leaving aside the fact that his approach to our evidence session failed to demonstrate any sense of the public outrage at the role of the police in this scandal, we were very concerned about Mr Hayman's apparently lackadaisical attitude towards contacts with those under investigation. Even if all his social contacts with News International personnel were entirely above board, no information was exchanged and no obligations considered to have been incurred, it seems to us extraordinary that he did not realise what the public perception of such contacts would be—or, if he did realise, he did not care that confidence in the impartiality of the police could be seriously undermined.
We do not expressly accuse Mr Hayman of lying to us in his evidence, but it is difficult to escape the suspicion that he deliberately prevaricated in order to mislead us. This is very serious.
(Paragraph 67)
11. Mr Hayman's conduct during the investigation and during our evidence session was both unprofessional and inappropriate. The fact that even in hindsight Mr Hayman did not acknowledge this points to, at the very least, an attitude of complacency. We are very concerned that such an individual was placed in charge of anti-terrorism policing in the first place. We deplore the fact that Mr Hayman took a job with News International within two months of his resignation and less than two years after he was—purportedly—responsible for an investigation into employees of that company. It has been suggested that police officers should not be able to take employment with a company that they have been investigating, at least for a period of time. We recommend that Lord Justice Leveson explore this in his inquiry.
(Paragraph 69)
12. In short, the exercises conducted by the police and the CPS in July 2009 appear to have been limited to the consideration of whether or not, in the light of recent reports in the media, the 2005-07 investigation had been carried out thoroughly and correctly. Critically, because the 2005-07 investigation had focused only on the joint roles of Messrs Mulcaire and Goodman, there was no progress in 2009 to consideration of the relationships that Mr Mulcaire might have had with other journalists, even though the Gordon Taylor story implied that such relationships had existed.
(Paragraph 73)
13. We understand that, when Sir Paul announced in July 2009 that he was asking Mr Yates to look into any new information, this was an unprepared remark made as he was going into the ACPO conference rather than a carefully prepared statement.
Unfortunately it left the public—and indeed Parliament—with the impression that a more detailed examination was to be held than was in fact the case.
(Paragraph 80)
14. We assume that Sir Paul left Mr Yates with a large amount of discretion as to how he should consider the evidence. Mr Yates has subsequently expressed his view that his reconsideration in 2009 of the material available from the earlier investigation was very poor.
We agree. Although what Mr Yates was tasked to do was not a review in the proper police use of the term, the public was allowed to form the impression that the material seized from Mr Mulcaire in 2006 was being re-examined to identify any other possible victims and perpetrators. Instead, the process was more in the nature of a check as to whether a narrowly-defined inquiry had been done properly and whether any new information was sufficient to lead to that inquiry being re-opened or a new one instigated. It is clear that the officers consulted about the earlier investigation were not asked the right questions, otherwise we assume it would have been obvious that there was the potential to identify far more possible perpetrators in the material seized from Mr Mulcaire. Whether or not this would have enabled the police to put more pressure on News International to release information, by making it clear that police inquiries were not merely a 'fishing expedition' but targeted at certain people, is an issue that may be addressed by the forthcoming public inquiry.
(Paragraph 81)
15. Mr Yates has apologised to the victims of hacking who may have been let down by his not delving more deeply into the material already held by the police. We welcomed that and agree that his decision not to conduct an effective assessment of the evidence in police possession was a serious misjudgement.
(Paragraph 82)
16. We are appalled at what we have learnt about the letting of the media support contract to Mr Wallis. We are particularly shocked by the approach taken by Mr Fedorcio: he said he could not remember who had suggested seeking a quote from Mr Wallis; he appears to have carried out no due diligence in any generally recognised sense of that term; he failed to answer when asked whether he knew that AC Yates was a friend of Mr Wallis; he entirely inappropriately asked Mr Yates to sound out Mr Wallis although he knew that Mr Yates had recently looked at the hacking investigation of 2005-06; and he attempted to deflect all blame on to Mr Yates when he himself was responsible for letting the contract.
(Paragraph 86)
17. From the point of view of victim support and of reassurance to the public, DAC Akers's decision to contact all those who can be identified as of interest to Mr Mulcaire is the correct one. However, this is not the same as saying all these people were victims of hacking, let alone that they could be proved to be victims. Only 18 months' worth of phone data from the relevant period still exist: unless Mr Mulcaire provides a list, no one will ever know whose phone may have been hacked into outside that period. Within the 18-months data held, about 400 unique voicemail numbers were rung by Messrs Mulcaire or Goodman or from News of the World hub phones, and these are the voicemails likely to have been hacked into. The total number of people who may eventually be identified as victims of Mr Mulcaire's hacking is therefore much lower than the number of names in his papers.
(Paragraph 91)
18. DAC Akers gave us a guarantee that this further investigation would be carried out thoroughly. We were impressed by her determination to undertake a full and searching investigation. The Specialist Crime Directorate is clearly the correct place for an investigation of this sort, though we note that officers have had to be 'borrowed' from across the Metropolitan Police Service to meet the needs of this particularly labour-intensive inquiry.
(Paragraph 92)
19. We note with some alarm the fact that only 170 people have as yet been informed that they may have been victims of hacking. If one adds together those identified by name, the number of landlines and the number of mobile phone numbers identified (and we accept that there may be some overlap in these), that means up to 12,800 people may have been affected all of whom will have to be notified. We accept that there are a number of reasons why progress may have been slow so far, but at this rate it would be at least a decade before everyone was informed. This timeframe is clearly absurd, but it seems to us to underline the need for more resources to be made available to DAC Akers. We understand that in the current situation of significant budget and staff reductions, this is very difficult. However, we consider that the Government should consider making extra funds available specifically for this investigation, not least because any delay in completing it will seriously delay the start of the public inquiry announced by the Prime Minister.
(Paragraph 93)
20. We are seriously concerned about the allegations of payments being made to the police by the media, whether in cash, kind or the promise of future jobs. It is imperative that these are investigated as swiftly and thoroughly as possible, not only because this is the way that possible corruption should always be treated but also because of the suspicion that such payments may have had an impact on the way the Metropolitan Police may have approached the whole issue of hacking. The sooner it is established whether or not undue influence was brought to bear upon police investigations between December 2005 and January 2011, the better.
(Paragraph 94)
21. We are concerned about the level of social interaction which took place between senior Metropolitan Police officers and executives at News International while investigations were or should have been being undertaken into the allegations of phone hacking carried out on behalf of the News of the World. Whilst we fully accept the necessity of interaction between officers and reporters, regardless of any ongoing police investigations senior officers ought to be mindful of how their behaviour will appear if placed under scrutiny. Recent events have damaged the reputation of the Metropolitan Police and led to the resignation of two senior police officers at a time when the security of London is paramount.
(Paragraph 95)
22. We note that, despite these protections, each of the companies had identified about 40 customers whose voicemails appeared to have been accessed by Mr Mulcaire. We also note that all three companies have disciplined or dismissed employees for unauthorised disclosure of customer information in the last ten years, though there is no indication that any of these employees was linked to this case.
(Paragraph 105)
23. We welcome the measures taken so far to increase the security of mobile communications. However, with hackers constantly developing new techniques and approaches, companies must remain alert. In particular, it is inevitable that companies will think it in their interest not to make using technology too difficult or fiddly for their customers, so do not give as much prominence to the need to make full use of all safety features as they should do. We would like to see security advice given as great prominence as information about new and special features in the information provided when customers purchase new mobile communication devices.
(Paragraph 111)
24. Clearly, Mr Clarke's strategy for informing victims broke down completely and very early in the process. It seems impossible now to discover what went wrong in 2006. Some of the mobile companies blamed police inaction: both Vodafone and Orange UK/T-Mobile UK said that the police had not told them to contact their customers until November 2010. AC Yates accepted that some of the correspondence between the police and the companies had not been followed up properly.
(Paragraph 117)
25. However, the companies cannot escape criticism completely. Neither Vodafone nor Orange UK/T-Mobile UK showed the initiative of O2 in asking the police whether such contact would interfere with investigations (and O2 told us that they were given clearance to contact their customers only ten days or so after being informed of the existence of the investigation). Nor did either company check whether the investigation had been completed later. They handed over data to the police, Vodafone at least sent out generalised reminders about security (Orange UK/T-Mobile UK may not even have done that), they tightened their procedures, but they made no effort to contact the customers affected.
(Paragraph 117)
26. We find this failure of care to their customers astonishing, not least because all the companies told us that they had good working relationships with the police on the many occasions on which the police have to seek information from them to help in their inquiries.
(Paragraph 118)
27. We expect that this situation will be improved by the coming into force of the new Privacy and Electronic Communications Regulations, which provide that when companies discover a breach of data security, they have to notify not only the Information Commissioner but also their affected customers.
(Paragraph 121)
28. This inquiry has changed significantly in its remit and relevance as it has progressed, and further developments are occurring on a regular basis. We expect that further discoveries will go beyond our present state of knowledge. Our Report is based on the information currently available, but we accept that we may have to return to this issue in the near future.
This inquiry has changed significantly in its remit and relevance as it has progressed, and further developments are occurring on a regular basis. We expect that further discoveries will go beyond our present state of knowledge. Our Report is based on the information currently available, but we accept that we may have to return to this issue in the near future.
(Paragraph 122)
| 
