Lee Gibling - Ray Adams Used THOIC to Strongarm Cable Companies Into Giving Up Their Operational Security

Following on from his earlier posts on THOIC and NDS Lee Gibling popped up on Something Awful and said the following:

Well at some point of time it is bound to surface so i would rather give the facts up right now.

if you recall, i posed a question to Brown Moses, somewhat tongue in cheek, "Why would Operational Security aka NDS UK require the resources of a top team of investigators and Agents plus many paid informants when their media they were solely charged with protecting was to be blunt as safe as the Bank of England in terms of piracy".

More salient was where this budget to fund the Mad Hatters Tea Party was going to come from in lieu of Israel controlling the purse strings.

With no activity on a day-to-day basis for the operational team sitting in Maidenhead cutbacks at every corner were looking likely ultimately misplacing the talent Ray in his team had built up over the course of his tenure as head of Operational Security.

Never to be outdone, Ray came up with a magical plan.

The cable companies with their Sky TV lineup were in respect of set-box security running autonomous outside of NDS operational security. NDS UK were protecting card piracy - cable boxes used no card.

Selective hacks and pirates for cable boxes were to be cultured and made available on THOiC and the resulting impact was then delivered by a series of visits to the Cable bosses.

Ultimately Ray won his battle to retain the use of UK Operational Security personnel to take over the battle against what was presented as "blanket piracy" in their industry. I know the words used in the meetings with the Cable bosses as Ray had me write the study paper on his behalf.

Before long, the department had secured full time jobs for both Len Withall and Chris Le Maitre, both whom enjoyed the spoils of "rounding up" the same pirates that had been lured to share their spoils via THOiC.

The budget secured!

Did Israel know - I do not think so but Ray had bosses so go figure.

 You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Lee Gibling Answers Some Questions About THOIC and NDS

Recently Lee Gibling has been in contact with me, and offered to fill in some of the gaps in the earlier investigation of his ICQ logs and Ray Adams' emails.  As I posted earlier, they showed that Lee Gibling worked for a company called AIM who were working on behalf of NDS competitor MindPort/Irdeto at the same time as he was working for NDS on the THOIC website project, and Lee offered to filled in some of the details that were missed.  First he talked about the Panorama programme Murdoch's TV Pirates:

Panorama touched on very little; air time is expensive and litigation from unsubstantiated talk can be dangeous.

I placed a lot of trust in Panorama and this was not displaced. All they went with was 100% but yes, a lot of questions remain unanswered.

Some people say that this is a decade old and it is old hat but if you think the mobile hacking is big business then be prepared to see the hat blown off of News Corp

On Digital was only the one company featured in Panorama that through NDS design I brought to their knees, but under their instruction and that includes on-digital we took on anything we wanted which included the whole UK cable industry.

Many thousands of jobs were lost indirectly as a result of actions made from NDS UK what was called Operational Security at Ray Adams headquarters in Maidenhead and it needs to be brought to account.

My respects go to Milly Dowler family.

He added there was much more filmed for the Panorama programme

The Panorama interview was a single "take" with Vivian. Yes, they condensed the programme to 30 minutes but the interview at one location went well over 2-1/2 hours and covered much that the Producers did not have time to consider as part of the programme. Will there be a Part II aired?  Maybe.

 Then he went on to provide more information about the AIM/MindPort/Irdeto situation:

To set some records straight - afterall many of you have invested much energy into piecing the jigsaw together, Andy Coulthurst is NOT a hacker but a full employee/technician at NDS UK. The other AC that is mentioned in email/ICQ is Andrew Curle who was at the time head of operations at Mindport/Irdeto.

I can also reveal as this is in the public domain albeit not surfaced (surprisingly) that Barry Watters was employed by Sky as a consultant and enjoyed office space at Sky.

Yes, he was seconded to Mindport on a very lucrative retainer, however, I do not believe that Sky knew this. Martin Gallagher of course knew I worked for Ray Adams, as did Barry Watters. I did communicate directly with Andrew Curle and was retained by AIM all of which was known and engineered by Ray Adams. Did NDS Israel (the top chain) know of this arrangement?  Of course they did. It's important to outline that NDS UK operational security had their budget contributions from Sky and Israel plus contributions were made to it by Ray Adam's opposite number in the Pacific Region and Asia which would be Avigail Gutman. Hence the reporting line involved many people although ultimately the buck and call was with Reuven Hasak in Israel. 

And explained how he came into contact with Ray Adams in the first place

Contact was made with Ray Adams via an Agent (employee) meeting at my home in Essex at the time. Thereafter, the same week i was introduced to Ray Adams at his offices in Maidenhead. Bit like visiting Father Christmas at Harrods .

He also gave more information on the subscriptions for THOIC that were discussed in the emails

There was NEVER any monies taken on THOiC - that would have detracted from the whole BDS ethos of using the community as a medium to either attract talented members and/or a complete audience when used to farm out information or media.

Yes, a handful of closed areas where in operation all of which were under control and instruction by NDS personnel who used pseudonyms during their online time on the forum. 

 He went on to pose this question

Why would such a significant operational security department (at great cost) be needed for the UK/Europe regions when the Sky [digital] card itself was not at risk of being compromised?

He also explained the situation with new accusations:

While I was in the UK last week or so I was introduced to Ian Gallagher of the Mail on Sunday. The introduction was made via Max Clifford. We were all set to reveal so much (far more than the Panorama programme), information that I believe will set the record straight once and for all.

The content would have been explosive however, the Mail on Sunday decided they could not follow through. I am not sure ANY newspaper under the current regime would have the balls to print. 

He also mentioned Hairymonster/FR15K

I do know that after all this time, (and I do not take kindly to blanket dismissals from Israel), that Hairy Monster holds some important collaborational evidence that between us working together can deliver a rock solid testimonial to the Leveson Enquiry.

At this present time, my solicitor (Mark Lewis) has not been contacted in respect of tribunal requests. 

 You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 19th 2012

Thanks to @false_dawn, @AlexanderPageSY and @ahmed for some of these videos. Earlier posts in the series can be viewed here.

April 9th 2012 - Aftermath of the destruction of a civilian home by shelling in Latamneh, with around 50 bodies allegedly removed from the rubble, English subtitles

April 16th 2012 - News broadcast of Bashar and Asma al-Assad volunteering at an aid distribution centre in the al-Fayhaa stadium in Damascus, which the newsreader reads a poem, English subtitles

April 19th 2012 - Daraa residents mob a UN observer hoping to tell their stories

April 19th 2012 - An elderly woman in Daraa tells a UN observer how Assad security forces trashed her home

April 19th 2012 - A large crowd of protesters with UN observers in Daraa

April 19th 2012 - Ahmet Himmiche, the Moroccan colonel in charge of the UN monitoring mission in Daraa, Syria, saying what he sees will be recorded in the mission's report

April 19th 2012 - Shelling in Qusour, Homs, with unusual coloured smoke

April 19th 2012 - Massive exploding fireball in Khaldiyeh, Homs

April 19th 2012 - Assad security forces machine gun position on a rooftop in Idlib

April 19th 2012 - Security forces moving through Joora, Deir Ezzor, and firing at the cameraman

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 18th 2012

Thanks to @false_dawn and @ahmed for some of these videos.

I'd also like to note that regular contributor ArabSpringFF/HamaEcho, based in Syria, has been absent from Twitter for 3 days, so if anyone has any news from him I'd appreciate it.

Unknown location and date - GRAPHIC - Leaked: Assad Soldiers Defiling Syrian Corpses, English subtitles

April 14th 2012 - Assad security forces smashing chairs, tents and cars after funeral in Aleppo

April 14th 2012 - Footage of the above funeral before Assad security forces arrived, Aleppo

April 17th 2012 - GRAPHIC - Young girl Rama Akram Saada was shot dead by a sniper, Douma

April 18th 2012 - Funeral procession of 9-year-old girl Rama Saada in Douma

April 17th 2012 - UN observers visiting Deraa with a large security presence

April 18th 2012 - GRAPHIC - A wounded and dead boy, reportedly shot in Jobar, Damascus

April 18th 2012 - Protesters in Arbeen, Damascus, chanting anti-Assad slogans and sticking an anti-government poster to a UN vehicle

April 18th 2012 - UN observers being mobbed anti-government demonstrators in Arbeen, Damascus

April 18th 2012 - Gunfire during a visit by the UN observers to the Damascus suburb of Arbeen

April 18th 2012 - Shelling of Khaldiyeh, Homs

April 18th 2012 - Armoured vehicles entering Aleppo

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Logic Behind Today's CPS Referrals? UPDATED

I was sent a very interesting email today by a reader regarding today referral of the hacking files to the CPS

I *think* I may see the logic of today's CPS announcements re Op Sasha etc.

If identity guesses re Brooks, Amelia Hill, Patrick Foster etc are correct then these are the most recent offences so require less 'historical' digging around for evidence.

However also, todays CPS announcements also involve a very wide BREADTH of offences committed.

I *think* they are testing the waters, in terms of range of OFFENCES, in order to guage how courts might regard evidence. Having established these as precedents, it's then Game On for the main course of Weeting, Elvedon & Tuleta.

Today's cases seem (to me) to be pointing to specific testing of specific bits of legislation. I've cross-referred with CPS publication (also today!) of guidelines for prosecuting journalists. Specific offences are Annex 'A' here, p13 onwards

File 1 (Amelia Hill & unnamed cop, Weeting leak, Op Kilo) tests Misconduct in Public Office offence

File 2 (Brooks etc, Op Sacha) tests Perverting the Course of Justice offence

File 3 (Thurlbeck) tests Intimidating a Witness offence

File 4 ( Patrick Foster re Nightjack) tests Regulation, of Investigatory Powers (RIPA), Section 1 (2)

Choosing RIPA rather than Computer Misuse Act is highly significant. The 'wide' or 'narrow' interpretation of RIPA caused much of the problems over original Op Glade prosecutions of Goodman & Mulcaire - and Yates' one day review of same. I think it's highly likely then that police passing the CPS files today is a way of saying to Director of Public Prosecutions, and courts, to bloody well sort out RIPA interpretations and give CLEAR precedent!

Also, any RIPA prosecution REQUIRES DIrector of Public Prosecutions consent to proceed, Computer Misuse Act doesn't require DPP consent.

Overall, looks to me that police have asked for CPS decisions on these particular cases in order to establish some clarity on wide range of untested legislation, public interest defence criteria and so on. It's about establishing thresholds of evidence needed, quality of setting precedents for sentences etc etc

Indeed DPP Starmer almost confirms this in an interview today.

So, if these prosecutions collapse, so do Weeting, Elvedon, Tuleta....

High stakes for Starmer!

It should be pointed out the names linked to the different files are just theories at the moment, but there's some very good points made, but it does seem like it's something that would make sense under the current circumstances. Hopefully it won't be too long before we know which names are linked to which file.

UPDATE
I received another email about the same subject raising some other points that's worth a read:

I don't quite see how that all works as to needing to test the limits of the offences, or how that works in relationship to other cases.

Lets work through them backwards.

File 4 ( Patrick Foster re Nightjack) tests Regulation, of Investigatory Powers (RIPA), Section 1 (2)

I see how this would link to RIPA, but the hacking in that case appears unlike the rest of the hacking, as far as we know, so I don't know that testing that would teach the police anything that would help in deciding what and where to go next with their decision making process

File 3 (Thurlbeck) tests Intimidating a Witness offence

As far as we know, this is the only witness intimidation case that is running as part of this chain of investigation, so where is this going to take us? do we really need to check the perimeters of the laws application here? or are we suggesting the police should be prepared because they think more journalists will start threatening witnesses down the line?

File 2 (Brooks etc, Op Sacha) tests Perverting the Course of Justice offence

Try as I might, I just don't quite see how the legality needs testing in this case. No one sane would think that they might need to prepare for a Journalists freedom of speech argument, or we're a special case argument in Perverting the Course of Justice. If there's evidence there it seems fairly straightforward to me.

File 1 (Amelia Hill & unnamed cop, Weeting leak, Op Kilo) tests Misconduct in Public Office offence
This one I think actually might be necessary to test the limits of the offence. we may well have whistleblower defences, and a genuine public interest defence being tried here.

If the names are correct, and we have the cases correct, then it's more a case of sweeping up around the edges and getting the disconnected cases out the way before the meat of the hacking charges are dealt with to my way of thinking.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 17th 2012

Previous days can be viewed here.

April 16th 2012 - Al Arabiya - 65 killed from one family in Taftanaz, Syria, English Subtitles

April 16th 2012 - Syrian families forced to store their dead in a meat locker, Khalidiyyeh, Homs, English Subtitles

April 17th 2012 - Bodies discovered in a well near Idlib, English Subtitles

April 17th 2012 - Assad military on top of a school in Sabeel, Hama

April 17th 2012 - Sniper on a rooftop, Hama

April 17th 2012 - Rockets landing in Khalidiyyeh, Homs

April 17th 2012 - 14 missile land in 4 minutes in Homs

April 17th 2012 - Anti-regime protests in Houla, Homs

April 17th 2012 - FSA battalion formation video, Rastan

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 16th 2012

Thanks to @YallaIr7al and @tweets4peace for some of these videos. It's worth watching this BBC report from Ian Pannell, who is currently inside Syria with the FSA in Idlib.

April 15th 2012 - Graphic - Body of the six year old Basil Yousaf al-Najjar, killed in Douma, allegedly shot by forces loyal to Bashar al-Assad, English subtitles

April 15th 2012 - Graphic - 10 month old Yousaf al-Najjar struggles to breath after allegedly being shot by forces loyal to Bashar al-Assad, an incident in which his brother Basil Yousaf al-Najjar was killed, English subtitles

April 16th 2012 - Tank firing inside Jouret Shiyah, Homs

April 16th 2012 - Khaled Bin Walid mosque in Homs being hit by gunfire

Arpil 16th 2012 - Dust cloud from a large explosion in Homs

April 16th 2012 - More buildings being hit by artillery in Homs

April 16th 2012 - Massive explosion filmed in Beyadha, Homs

April 16th 2012 - Anti-Assad protests in Inshaat, Homs

April 16th 2012 - Protest rally in Kafrroumeh, Idlib

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 15th 2012

Thanks to @HamaEcho, @YallaIr7al, @javierespinosa2 and @tweets4peace for some of these videos.

April 14th 2012 - Defection of Syrian Member of Parliament Abdelrazaq Yusuf to the opposition

April 15th 2012 - Artillery bombardment in the Khalidiyyeh neighbourhood of Homs, uploaded April 15th, English subtitles

April 15th 2012 - Heavy shelling in the Qarabis neighbourhood of Homs

April 15th 2012 - Very heavy shelling on Khaldiyah neighbourhood of Homs

April 15th 2012 - Shelling on Jobar and Alsultaniyeh, Homs

April 15th 2012 - Panoramic view of Khalidiyyeh, Homs, during today's shelling

April 15th 2012 - Shelling in Homs, with the sound of a military drone flying overhead in the background

April 15th 2012 - Children in Idlib asking for the FSA to be armed

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Week in Hackgate 09/04/12 to 15/04/12

With a two week break at the Leveson Inquiry it seemed that this week could have been a quiet week for all things Hackgate. It was reported that David Cameron would be appearing at the Leveson Inquiry after Gordon Brown and Tony Blair, which gave us something to look forward to, but all in all it seemed like it would be a quiet news.

Fortuantly Guido Fawkes decided to leak a selection of evidence from the Operation Motorman inquiry, covering 1028 News International entries, one of which included Rebekah Brooks requesting an illegal job. The Hacked Off campaign responded by putting out a statement expressing the view that the Operation Motorman files should be released, while the ICO reacted by expressing their displeasure and summoning Guido Fawkes to an interview over the matter.

More leaks occured when a number of ICQ logs belonging to NDS employed hacker Lee Gibling were released, which showed that not only was he helping NDS with the running of the hacker site THOIC, but also working with another company, AIM, who was in turn employed by MindPort, part of NDS competitor Irdeto. Later on in the week a little birdie told me there's more leaks to come, but for now we'll just have to enjoy what we have.

One Thursday the IPCC told the Met Police they'd been a bit naughty when dealing with Neil Wallis, but nothing serious enough to take any real action, and Mark Lewis announced three alleged victims of phone hacking in the US would begin legal proceedings in America, with later reports also claiming a second lawyer was considering legal action in America. In more good news for the legal profession the author of the NightJack blog exposed by the Times filed legal action against the newspaper.

After all that News International still has the joys of the long awaited Common's Select Committee report on phone hacking being released in the near future, maybe even this week, with the delays being put down to MPs being unsure if James Murdoch was either ignorant and stupid, or a liar and unfit to run a company.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 13th and 14th 2012

Thanks to @HamaEcho, @YallaIr7al and @tweets4peace for some of these videos.

April 13th 2012 - Protest in Khaldiyah, Homs

April 13th 2012 - Large demonstration in Douma

April 13th 2012 - Shelling of Qarabees, Homs

April 13th 2012 - Shelling and gunfire among the destruction in Qarabees, Homs

April 13th 2012 - Massive Hama Protest - 'Revolution for all Syrians', English subtitles

April 14th 2012 - Demonstrator receiving a serious head injury after a funeral is fired on in Aleppo

April 14th 2012 - Another injured or dead demonstrator at the funeral fired on by Assad's security forces in Aleppo

April 14th 2012 - An injured demonstrator being carried away from the funeral in Aleppo

April 14th 2012 - Assad mortar and artillery positions allegedly firing at Homs today, more detail here

April 14th 2012 - Shilka tank firing in al-Qarabees, Homs

April 14th 2012 - Tank firing towards a cameraman in Jouret al-Shayyah, Homs

April 14th 2012 - Buildings burning today in Qusoor, Homs after shelling on the neighbourhood

April 14th 2012 - Buildings being fired on by what could be a shilka, Jouret Al-Shayyah, Homs

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 12th 2012

Thanks to @HamaEcho, @YallaIr7al and @tweets4peace for some of these videos.  I'd be interested in an examples of pro-Assad fakery if anyone has them.

You can view all previous daily video posts here.

June 2011 - A very badly acted faked ambush broadcast on the pro-government Addounia Channel, watch the dramatic deaths of the supposed FSA fighters. English subtitles.

April 11th 2012 - FSA donating money and weapons to the Turkish army. The money box says "Donation Campaign to the Turkish Army from the FSA" and the box with the guns says "The FSA donates its weapons to the Turkish Army so they can defend themselves against the criminal Syrian regime". The note says "We call upon our comrades in the north to set up a buffer zone to protect the Turkish people against the criminal Syrian regime". Translation via az jan jananam of the Something Awful forums

April 11th 2012 - Protest in Central Damascus, Opposite Four Seasons Hotel, English subtitles

April 11th 2012 - Graphic - Carnage in Rastan field hospital following bombardment by Assad's forces

April 11th 2012 - An activist from Mezzeh, Damascus sends a message to all Syrians regarding Zero Hour, English subtitles

April 11th 2012 - Activist Khaled Talluwey sends a message to Aleppo and Damascus regarding Zero Hour, English subtitles

April 12th 2012 - Students at Aleppo University gather to for a SOS

April 12th 2012 - Ammar al-Salem reportedly shot dead in Beyadha, Homs during the ceasefire

April 12th 2012 - Protest in Old Homs after the shelling stops during the ceasefire

April 12th 2012 - Tanks in Idlib and passing cars being stopped by security forces

April 12th 2012 - Military vehicles in Hama, with cars being stopped for inspection by security forces

April 12th 2012 - Video of the new wall separating deserted Baba Amr and destroyed Inshaat neighbourhoods in Homs

April 12th 2012 - Army creating a new checkpoint in Arbain neighbourhood of Hama and snipers on rooftops

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Leaked ICQ Logs - Summary of What We've Learnt

Following on from the leak of Lee Gibling's ICQ logs where we discovered Lee Gibling worked for MindPort/Irdeto contractor AIM at the same time he was running THOIC for NDS Something Awful forum members Shageletic and Munin have put together an summary of what has been learnt from the leaked logs:

Lee is a good friend of Martin Gallagher, cerainly around the year 2000. The log is full of banter and they seem to have a good overview of the activities they are both involved in across NDS, AIM, Irdeto and Mindport. Lee knows that if NDS found out how closely he worked with AIM he might get into trouble.

Lee has a close working relationship with NDS. He was offered a place on the payroll, along with upgrades to servers and direct cash payments.  One of the logs mentions how he was offered the use of Ray Adam's holiday home for him and his family. He also was directly paid and employed by Barry Watters for most of the period of the logs until he started having increasing issues getting Barry Watters to pay him. He didn't have direct contact with Irdeto/Mindport. All contact seems to have been via Martin and neither wanted Mindport to know of Lee's involvement with THOIC.

Martin was employed by Barry Watters but seemed to spend most of his time interacting with Mindspring. He also was familiar with Adams and NDS but didn't seem to do any jobs for them.

Lee's main job for Barry Watters and Martin seems to have been acting as an IT consultant and general finder of information. This involved flagging up new hacker sites, monitoring the progress of various hacker groups towards a hack and providing samples of hacks and tools, with Lee occasionally purchasing them and being reimbursed by AIM.  Barry and Martin seemed to keep their client ignorant of the exact way they obtained them. They also sought to recruit other hackers

Lee's main job for NDS seemed to be doing odd programming and webmaster jobs and maintaining THOIC. He doesn't discuss many of the particulars of his NDS work with Martin. NDS helped set THOIC for Lee, which benefited from Lee's hacker knowledge, along with aggresively acting against other hacker websites.

Martin's main job seems to be as an information channel for Barry Watters and Mindspring. He traveled to meet hackers and informants. He was also (not very competently) setting up a mirror of major hacker sites on a isolated server for MindPort, with MindPort planning to use it as part of a service is wished to offer it's clients. Presumably this was to help them monitor activity on these sites and to have a local copy of any valuable intel should these vanish or get taken down.

Irdeto/Mindspring seemed to be keen on getting sites taken down. Koos and Kuster seemed to be the internal Irdeto/Mindspring security guys who were involved in that. They were both unpopular with Lee and Martin (and NDS, see the Bonds related e-mails) as they were seen as stirring up the nest and threatening valuable informants. In general, in all the logs Lee and Mertin show no desire to see most of the sites shuttered, they are more interested in observing and exploiting them.

As far as illegality is concernd then THOIC is definitely illegal and the logs show how everyone knew Lee well and that essentially everyone knew his involvement with THOIC. One thing to note is that Lee was saying that "the bosses" were monitoring his webmaster@thoic e-mail address. Something rather difficult to do if they didn't have direct control of the operation.

Nothing blatantly illegal has come up in the logs. That said both Lee and Martin were routinely dealing with criminals and buying their goods. They knew the full identities of many major players and essentially did nothing to curtail their activities. All of this, including the blattantly illegal THOIC, was all done with full knowledge of their respective superiors.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 11th 2012

You can view all previous daily video posts here.

March 4th 2012 - Graphic - Leaked clip of Assad soldiers posing with dead bodies.

April 5th 2012 - General Aqeel Hashim of the Syrian Army addressing his troops after the fall of Baba Amr, reportedly filmed in a mosque in Douma, English subtitles

April 10th 2012 - Video of night time clashes near the Kilis refugee camp in Turkey near the Syria border

April 10th 2012 - The independence flag being displayed on Thawra street in the heart of the Damascus

April 10th 2012 - Graphic - A family allegedly burnt alive by forces loyal to the Assad regime, Tel Rifa'at, Aleppo, English subtitles

April 11th 2012 - Shelling in Qarabess, Homs

April 11th 2012 - Building being hit by gunfire in Jouret al-Sheyah, Homs

April 11th 2012 - Buildings being hit by rockets and artillery in Khaldiyeh, Homs

April 11th 2012 - Cheerful protest in Daraa

April 11th 2012 - Numerous heavily decayed corpses discovered in the morgue of Homs National Hospital

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Leaked ICQ Logs - Lee Gibling Worked For More Than Just NDS

Yesterday I posted that a number of ICQ logs belonging to Lee Gibling had been leaked, and myself and others have spent some time working through the logs, looking for interesting information.

A number of the logs appear to belong to Martin Gallagher, who has a rather interesting CV:

Global Operations Manager Alternative Investigation Management Ltd (AIM) Public Company; 5001-10,000 employees; IVZ; Investment Management industry

1997 – 2004 (7 years) London, United Kingdom

I was responsible for all security projects including executive protection of CEOs and executives of well known multinational corportations, security reviews and risk assessments for large multinational media, hardware, software, and manufacturing & logistics companies.

Other areas of my operation and responsibility within the company were:

Surveillance, (Medical, Fraud & Piracy).
Test purchasing, for famous brands in the clothing, media and IT hardware and software industries
Undercover assignments, within logistics companies where high value thefts were prevalent.
Computer Forensics operations for individual clients and Blue Chip Hardware and Media companies.

Internet research, I was responsible for providing intensive internet research on hackers and piracy organisations , often infiltrating these criminal fraternities in order to provide law enforcement agencies and legal entities with criminals' personal details and evidence to support successful arrests and prosecutions.

It appears the following ICQ logs belong to him
56660605 21.12.1999 - 25.09.2000 Martin Gallagher

9552119 06.04.1999 - 05.09.1999 Martin Gallagher
56660445 08.05.2000 - 08.05.2000 SATNET/Ken Frazer
50640200 03.12.1999 - 15.01.2000 Ken Frazer
76873943 12.06.2000 - 03.11.2000 JanJo/Jannette Hess
63376893 05.02.2000 - 18.08.2000 Go4/Gopher Khan

He rather helpfully says this in his SATNET ICQ Log

56660445 (21.12.1999 15:44:31) MARTIN : SATNETºKenºFrazerºº0
56660445 (08.05.2000 18:41:11) MARTIN : yeah, i got several icq addresses
56660445 (08.05.2000 18:41:25) LEE : he he
56660445 (08.05.2000 18:41:58) MARTIN : you still got protium icq?
56660445 (08.05.2000 18:42:20) LEE : nah
56660445 (08.05.2000 18:42:48) LEE : i have also 56660605
56660445 (08.05.2000 18:43:25) MARTIN : that's me official one
56660445 (08.05.2000 18:44:08) LEE : ah - so this is yer dodgy one
56660445 (08.05.2000 18:45:19) MARTIN : satnet
Go4
Protium
those 3 r dodgy
56660445 (08.05.2000 18:46:49) LEE : i wondered who the fuck go4 was :-))
56660445 (08.05.2000 18:47:36) MARTIN : i am hoping that you is a nices peoples and can sends me somthings likes softwares
56660445 (08.05.2000 19:27:34) LEE : yes - we can send you any softwares you want - pls just ask Mr Satpratt

Along with references to his real name and contact details in the other ICQ logs it seems to confirm the accounts belong to him.

Martin Gallagher works for Barry Watters, the founder of Alternative Investigation Management Limited

Barry retired from the Metropolitan Police in 1995 after 31 years of distinguished service where he served as a front line detective at Scotland Yard. During his service he was engaged in a number of high profile departments including the Flying Squad, Regional Crime Squad and Specialist Operations. Whilst serving in these postings he was responsible for determining strategy in combating national and international crime organisations and was deployed on a number of occasions outside the United Kingdom.

He was also responsible for training operatives in Specialist Operations and on leaving the service in 1995 was engaged by Her Majesty’s Foreign and Commonwealth office to provide training specialist through the British Governments ‘Know How’ program to European countries seeking admission to the European Union.

On leaving the police service Barry founded Alternative Investigation Management Limited, a specialist security consultancy providing services to government, major ‘blue chip’ corporations and police services globally on risk assessment, crisis management, kidnap and ransom training, investigations and security training.

Lee Gibling and Martin Gallagher often discussed Barry Watters, especially in relation to Watters sending cheques to Gibling:
From ICQ log 63376893

63376893 (21.07.2000 20:10:00) MARTIN : Hi m8, Thanks for the mail re the free cam patch but I dont follow the story.

Baz said the cheque is in the post. hahaha!

Anyway, I have to do my end of month report now is there anything from you that I should put in?

From ICQ log 76873943

76873943 (31.10.2000 18:08:21) LEE : and wtf is bw?
76873943 (31.10.2000 18:08:39) LEE : i am officially on strike from today
76873943 (31.10.2000 18:08:41) MARTIN : barry watters?
76873943 (31.10.2000 18:08:51) LEE : yes
76873943 (31.10.2000 18:09:12) MARTIN : i am waiting 4 mine 2
76873943 (31.10.2000 18:09:27) MARTIN : go on strike m8!
76873943 (31.10.2000 18:09:59) MARTIN : no more stuff till i get paid :-)
76873943 (31.10.2000 18:10:05) LEE : wad da we wan,,,,, MONEY
wen da we wan it,,,, NOW
76873943 (31.10.2000 18:10:30) LEE : tell em m8! go4it

From ICQ log 56660605

56660605 (12.01.2000 22:13:08) LEE : still no bloody cheque from barry
56660605 (12.01.2000 22:13:40) MARTIN : all and any!!!!!!!!!!!
I gotta cover the globe so i have created country directories
56660605 (12.01.2000 22:13:55) LEE : that's a mean old task eh
56660605 (12.01.2000 22:14:06) MARTIN : I will chase baz up re the cheque
56660605 (12.01.2000 22:15:57) LEE : thanks

56660605 (14.01.2000 17:52:15) LEE : still no cheque with todays post - it doesn't take a whole week to send even 2nd class
56660605 (14.01.2000 17:53:57) MARTIN : I didnt get to speak with him yesterday. I would send an email in red!
56660605 (14.01.2000 17:54:27) LEE : no - i am officially on strike
56660605 (14.01.2000 17:55:46) MARTIN : ROFL :-D

56660605 (17.01.2000 15:51:50) LEE : still no damn cheque - btw i saw BW yesterday

56660605 (17.01.2000 17:55:27) LEE : cheque has turned up - it was only posted on 16th
56660605 (17.01.2000 17:55:49) MARTIN : he's a bad bugger!!!!!!
56660605 (17.01.2000 17:56:07) LEE : that is a bit naughty -
56660605 (17.01.2000 17:56:49) MARTIN : I'll say,,, Perhaps the girls forgot to post it heh heh heh
56660605 (17.01.2000 17:57:14) LEE : it is in BW's writing and had a first class stamp!
56660605 (17.01.2000 17:57:52) MARTIN : HE'S A REALLY BAD BUGGER!!!!
56660605 (17.01.2000 17:58:38) LEE : yep - i won't pay for any other software now until i have the money direct credited into my account - it's not fair having to wait 3 weeks for it
56660605 (17.01.2000 17:59:29) MARTIN : I agree! Perhaps he thinks your'e made of money!

From ICQ log 50640200

50640200 (29.12.1999 16:45:14) LEE : yes! i had to chaps the money on christmas eve!

750.00
75.00 (lee)
15.00 (chaps)

total: 840.00 - i would appreciate the money asap - i'm still out of pocket from the last lot - barry's cheque didn't turn up until friday! and won't clear now until the 4th of bloody january
50640200 (29.12.1999 16:45:38) MARTIN : k - i has been well busy!! yesterday was very very

So that appears to show that Lee Gibling was receiving money from AIM over a period of months, if not years, and in some cases Barry Watters, the founder of AIM, personally signed his cheques.

It appears AIM was working on behalf of Mindport, a division of Irdeto, and Lee Gibling was keeping NDS informed of their plans

From: THOiC Online© [mailto:webmaster@thoic.com]
Sent: Saturday, December 11, 1999 1:54 PM
To: radams@ndsuk.com; agutman@ndc.co.il
Subject: damn and blast!

Avigail

I have been in communication by telephone this morning with Martin
Gallagher who works for Barry Watters. The general chit chat moved to
Dave Cottle, and Martin was excited to tell me that he will be getting
a suprise very soon.

I enquired exactly what he mean't by that and he said that he was
going to be busted - he did not say whether it was he and Barry who
would be involved directly in the bust or whether it would be joint or
just Mindport.

He gleefully explained that MINDPORT had all the email from DC to
others including MM - I enquired what email he was talking about and
he said that they have an intercept running on his mailboxes.

This is crap - Mindport BW and MGallagher couldn't complete a Rubik's
Cube let alone get a hack working on several mailboxes.

I suggest the truth is they are either relying on the quantity of copy
email exchanged between Bond and MM which was furnished through me
or/and the content of Rolf's HDD.

Either way, I am concerned that they (Mindport & BW- AIM) are again
going off at a tangent looking for kudos. I think it would be a
serious judgement of error for them to attack Bond at this stage.

1. There is the GESA development which we have on the boil.

2. It would finish the Forum for GOOD. A forum that has and will
continue to produce excellent information.

3. What exactly will they get on Bond if they rely on the older
emails? a test case in australia - incitement to hack?? wow!

I've copied this to RA - you will no doubt be speaking to him on this
and I would be pleased if you can tell me that all the work we have
done will not be ruined by this complete bunch of amateurs.

Lee'

Now it's apparent that NDS and AIM had contact with each other, as this email shows:

'From: Bary Watters
To: Adams, Ray
Date: 11/17/1999 5:23:54 AM
Subject: eurosky

Hi ray the following forwarded for your info, found by martin:-

Do You live in Europe? Want to have Sky Digital in your home? Well now
you can. Here at Euro sky, we can supply one of two options to fulfill
your needs. Simple click on the option you prefer below:'

But it seems that Lee Gibling may not have been too keen on letting NDS know how much contact he was having with Martin Gallagher

63376893 (17.07.2000 20:16:17) MARTIN : u okm8?
63376893 (17.07.2000 20:17:04) LEE : yes - glad i got you
don't send any mail to lee@thoic.com or webmaster
send any mail to me at snakesurf69@hotmail.com
63376893 (17.07.2000 20:17:36) MARTIN : whats happend?
63376893 (17.07.2000 20:18:15) LEE : just that my mail is being monitored by the bosses
63376893 (17.07.2000 20:18:43) MARTIN : no probs m8. theybin moanin?
63376893 (17.07.2000 20:19:04) LEE : not really - just makin sure there's nothing to moan about
63376893 (17.07.2000 20:19:48) MARTIN LEE : k i will delete all refs to webmaster @ thoic and shall always use the new one,,,,,,,, ok?
63376893 (17.07.2000 20:20:07) LEE : i think that's best for now m8
63376893 (17.07.2000 20:20:19) MARTIN : k

Assuming that by "bosses" Lee means NDS it seems that he didn't want them to see what Martin was sending him.

Now, Martin and Lee seemed to have a very friendly relationship, with Lee apparently providing Martin with plenty of information about THOIC, including letting Martin know when THOIC users who were Mindport plants were accidently letting the webmasters know they were from Mindport.

56660605 (13.02.2000 16:14:17) LEE : MP are total wankers - there are a few people that know their ID's now in the forums
56660605 (13.02.2000 16:14:36) LEE : he he - i couldn;t sleep last night and was up till 4 am
56660605 (13.02.2000 16:14:50) MARTIN : who's bin in there?
56660605 (13.02.2000 16:17:44) LEE : quite a few actually - and silly silly boys think they are safe using a 3rd party email or ISP - but the wankers have been using the 'UBB a Friend' option to send some threads to people and the forwarding addresses they have input as so and so form mindport.com - they never learn - these forwarded messages are read by Bond - the messages are system generated when someone forwards on a message from the forums and it tells everything - bond gets copies as do I - so we can see who is forwarding threads out of the forums! it's common practise and IMO pretty lame
56660605 (13.02.2000 16:18:48) MARTIN : can u get me the details, ie alias used etc? I'll fkin sort em!!!
56660605 (13.02.2000 16:19:27) LEE : yeah - Mindport Australia - they also identify a plant in the forums - how amateur eh!
56660605 (13.02.2000 16:19:47) MARTIN : bond 007 he's one of ours, (i mean yours?)
56660605 (13.02.2000 16:20:07) MARTIN : had to be them eh?

Martin also wasn't shy about asking Lee to perform less than legal tasks

9552119 (13.07.1999 20:49:19) MARTIN : Lee, could you access hotel computers? ie bookings and reservations?
9552119 (13.07.1999 20:49:45) LEE : it's possible - depends on their security
9552119 (13.07.1999 20:50:15) MARTIN : you would have to do it through an annonymous ip eh?
9552119 (13.07.1999 20:50:25) LEE : that's easy enough
9552119 (13.07.1999 20:52:37) MARTIN : well I need to know if two people are checked in or about to checkin at
1. The Westbury Hotel (London)
2. The Hyde Park Hotel Ditto
3. Clariges London
Names: A Kashoggi
and Mr A K Pukar (Could be pookar) Spelling unsure
9552119 (13.07.1999 20:53:05) LEE : you didn't say 3!!!
that'll be 1k each
9552119 (13.07.1999 20:53:46) MARTIN : 1 kiss each okay but only if its Vicky I'm kissing! Ha
9552119 (13.07.1999 20:54:46) MARTIN : I have to phone the hotels but i thought it might be possible to check via their back orifice
9552119 (13.07.1999 20:57:48) LEE : it wouldn't be that quick to gain access - i'd first have to get their network ip address, bust their firewall (if poss dependent on the s/w) then if i got that lucky i'dhave to find the s/w prog and logon for their reservation system! they'd probably have been and left by the time i got in:-))
9552119 (13.07.1999 20:58:15) MARTIN : har har he he ho hum!
9552119 (13.07.1999 20:58:28) MARTIN : I'll stick to the phones

There's no evidence to say Lee went ahead and did the hack, but it does demonstrate how close the relationship was between Martin Gallagher and Lee Gibling at a time Lee Gibling was also apparently working for NDS.

There's still plenty more to read in the leaked ICQ logs, so hopefully tomorrow I'll have another post with even more new information.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Daily Selected Syria Videos April 10th 2012

You can view all previous daily video posts here.

Unknown location and date - A tank driving over confiscated motorbikes

April 9th 2012 - Street lights exploding after shelling

April 10th 2012 - Khaled Abu Salah Responds to Assad's "Complete Commitment" to the Annan Intiative, Homs, English subtitles

April 10th 2012 - Cease-Fire Deadline Arrives in Syria, Activists Respond to Continued Shelling, English subtitles

April 10th 2012 - FSA helping families escape in Arabain neighbourhood in Hama

April 10th 2012 - Tanks inside Douma

April 10th 2012 - English language tour of destruction in Taftanaz, Idlib

April 10th 2012 - Smoke rises from Mare, Aleppo

April 10th 2012 - Rockets being fired at Khaldiyeh, Homs

April 10th 2012 - Tank firing at a building at close range in Qarabees, Homs

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com