*34c3 preroll*
Herald: Welcome everybody to our next talk: Financial surveillance, Exposing the
global banking watch lists. I think everybody in this room would agree that
mass surveillance is a very bad idea, and that of course also goes for financial
surveillance. And our next two speakers, Jasmin Klofta and Tom Wills, are two
investigative journalists, who have uncovered, how the system of financial
surveillance works. And I'm pretty sure that you are just as excited as me to find
out what they have found out. So, please give them a warm round of applause!
*applause*
Jasmin Klofta: So hello, nice to see you all. Microphone's not on I think? Be cool.
I think the headset doesn't work. Herald: Audio? Well you know there's
always a litttle thing that doesn't work, whatever this is. For the talk we just had before,
there was a live demo, it was very well planned - still something went wrong. I think
everybody in the audience had a lot of empathy, because nobody wants to be in
that position. But I think we just fixed the problem. Is it fixed? Is it about to
be fixed? Jasmin: I will try a little bit, yes!
Herald: There we go! Round of applause, now we go!
Jasmin: We can start! *applause*
Jasmin: So, it's nice to see you all, so happy that so many people came. I want to
introduce to you: this is Tom - he's the data journalist working on investigations
at the Times of London and he specializes in a set of techniques such as data
mining, which can reveal wrongdoing and lead to stories that benefit the public.
Tom Wills: And this is Jasmin, she's an investigative journalist working in
Hamburg for Panorama at the broadcaster NDR, which is part of the ARD network, and
she focuses on politics, the digital economy, and surveillance. And we're going
to tell you tonight about findings of an investigation we conducted this year as
part of an international collaboration, and our colleagues were Eveline, Stefania,
Lars, and Cora. And Jasmin. Jasmin: Yeah, and together we investigated
the leaked database and published in June this year our stories in the UK, in
Germany, in the US, Netherlands, Belgium, and Italy. So what was our story? We
investigated, that innocent people around the world have been wrongly added to a
watch list of terrorists and criminals. This watch list of high risk people and
organization is compiled by Thomson Reuters, a British firm, and sold to
almost all the world's major banks, as well as police forces, intelligence
agencies, and non-government organization. It's called World-Check and the leak gave
us the opportunity to review the entire database for the first time.
Tom: So, what exactly is World-Check? Well, if you want to open a bank account, we
know that the bank might your credit rating to see if you are a reliable
borrower. But how does the bank know, if you're a criminal, or a terrorist, or a
potential money launderer? One of the checks that most banks will do, is run your
name against the World-Check watchlist, and they might look in here. If your bank
finds your name on the list, they might refuse your application, or they might
subject your financial transactions to extra scrutiny, or if you're an existing
customer, they might even close your account.
Jasmin: So, Thomson Reuters says about their list that it is to find hidden risk.
The list is of heightened risk people and organizations, such as terrorists,
fraudsters, or senior public officials, who might try to use the account to handle
corrupt funds. So they want to be kind of an early warning system for hidden risk.
And banks are even forced to use these kinds of lists by regulation, they have to take
steps to comply with sanctions and international and domestic law against
money laundering and terror financing. And of course we all want less terrorism, and of
course we want less money laundering, that's clear. And to put it in a World-Check
words, it's to help identify relationships or risk by providing highly
structured intelligence profiles and heightening risk individuals and entities
globally. But since 9/11, governments have to put more and more pressure on banks to
identify terrorists and money launderers among their customers. So, Thomson Reuters
advertises even World-Check with warnings about recent fines and settlements against
banks for violating sanctions. Maybe you know the.. this one story: HSBC had a
historic 1.9 billion dollar payment to US authorities to settle money-laundering
allegation in 2012, and that's one of the most famous example that the banks, of
course, fear very much. So if you look for information how the information is
collected, Thomson Reuters says it compiles a list using hundreds of
thousands of reputable sources in the public domain. You got to remember that
slide, and especially the word "reputable sources", because we will come back to
that a little bit later. Tom: So how do they collect this
information? Well, Thomson Reuters researchers look into public sources,
ranging from EU sanction lists, to local newspapers in order to find names to add
to the database. In total, Thomson Reuters says that World-Check contains profiles on
over two million entities, and that it's adding 20.000 profiles a month, and
updating 40.000. So the list is growing all the time. Now, this is a job advert for a
position as a World-Check researcher in Washington DC and it states, that among the
many responsibilities you need to write more than 220 highly structured and
sourced biographical intelligence profiles every month. I think it's really nice of
them to be so upfront about the workload. And that's about 1 hour per profile,
if you're working full time. So it must be quite a challenge if you are the assistant
research associate to maintain accuracy and quality under that kind of workload.
Jasmin: So not many people had heard of this list until recently but it's one of
the biggest of its kind. According to a World-Check datasheet the service is used
by over 300 intelligence and government agencies, 9 out of the world's top 10 law
firms and 49 of the world's 50 largest banks. Overall more than 6000 customers
from 170 countries are reportedly on their customer list. The content of the list is
secret because Thomson Reuters doesn't tell people when it adds them to the list
and banks are forbidden from passing on the information. Access is only granted
after a vetting process, so the user has to sign a nondisclosure agreement and also
using the database is quite expensive. A year's access can cost up to 1 million
euro. Tom: In recent years there have been some
excellent investigations by other journalists, who've highlighted some
possible issues with World-Check. The BBC has been investigating why HSBC closed the
account of Finsbury Park Mosque in London without any explanation. The BBC
researchers found that the mosque had been listed in World-Check in the terrorism
category. So that may have been part of the bank's decision. VICE news was also
able to view some of the entries in World- Check through a client of Thomson Reuters
and they discovered more examples of questionable entries. So we knew that
there was something potentially going on with this database, but it mostly remained
confidential and nobody had been able to view the entire database in order to find
out, whether there were wider issues with the system.
Jasmin: But then there was a leak: In summer 2016 this security researcher Chris
Vickery was doing what he very much likes to do. He was scanning the internet for
CouchDB instances exposed to the world without any username or password. Well,
you can imagine what comes next. *applause*
Jasmin: He would contact the owners to encourage them to secure the data but he
found something really interesting, and that was the copy of the World-Check
database from 2014. With him finding it the question came up in his head: He
asked: "I have a terrorism blacklist. I have a copy, should it be shared?" Chris
posted on Reddit to say that he was facing a dilemma about, whether to release the
entire database or not. Because on the one hand the database was apparently compiled
from public sources, so: what's the problem with publishing public sources?
The World-Check is a system that is used to make decisions about people's lives and
secrets, so maybe transparency would be in their interest. But on the other hand it
contained personal data relating to millions of people, who might suffer harm
if the information was disclosed. Since it is not so easy to ask the 2 million
people, if he's allowed to publish it, he was asking himself so what now to do.
Thanks to the previous work of the BBC advice we as journalists had reason to
believe, it would be in the public interest to review this data. So we made
contact with Chris and before viewing the leaked data we considered of course the
ethical, legal and security implications. Tom: We had a chance to fully reveal how
the system works for the first time. And this is what the file looked like:
*laughter* Jasmin: Isn't it beautiful?
Tom: We agreed with Chris that we would use the data to do responsible journalism,
but not to publish the data itself, so we can't show you the full database in this
presentation. When we received the data it was a 4 GB JSON line delimited file with
no documentation. The first thing I had to do was write a parser in Python. I started
to flatten this JSON file into a CSV file. Then we had a 4 GB CSV file and I loaded
that into Postgres in order that we could do some analysis of the contents of this
database. So this is an abridged version of the field list showing you the really
key pieces of data on each of these profiles. We've got an ID, we've got an
entity type, that is, if this is a person or an organization, for people there were
first names, surnames, aliases. Position would be: if you're a politician, this
would say what your position is in the government. The categories were really
interesting, because these might be that you're a politician as mentioned or might
be that you're in the terrorism category or the financial crime category. We've got
dates of birth and countries and nationalities, obviously those are really
important so that banks can identify the customers correctly. Information text was
possibly the most interesting part of the data. And then we had various links to
other profiles, the source URLs which turned out to be really crucial and the
dates on which the records have been created and updated. You know, some of
these fields were self-explanatory, but we really needed to see what this database
looked like to the end-user to understand how this information would be interpreted.
Like any good investigative journalists .. we of course turned to Google. After a
bit of experimentation we discovered the magic words: searching for "you are
strictly prohibited from disclosing or copying the content of this service".
*applause*
Tom: And sure enough we find some examples of profiles from World-Check, which people
may or may not realize are on the internet and accessible through Google. Some of
these are from the Panama papers, so obviously the person who put that one
there knew what they were doing. The first example in this result is interesting
though because we have the word "intranet" in the URL and we should perhaps tell this
company that their intranet is not an intranet.
*laughter*
Jasmin: Maybe they found out by themselves.
Tom: They know now, hopefully. This example is actually from a magazine in
Brazil which published World-Check profiles that they obtained as part of an
investigation. This was really useful because we could see exactly what the data
looks like to the end-user. This profile belongs to Eduardo da Cunha, who was the
former leader of the Brazilian Chamber of Deputies and as I said it was published by
the magazine. We can see here the categories that he's been assigned: in
this case he's a political individual and he's a PEP. PEP stands for politically
exposed person. This is a term in anti- money-laundering legislation that means
this person is in senior public office and they are potentially in a position to take
bribes and launder corrupt funds. It doesn't mean necessarily that they've done
anything wrong, but the money laundering rules say that banks have to scrutinize
these people very carefully. So if you are a politician you might be called up by
your bank and they would say we need to interview you about your sources of income
in order to establish what the legitimate level of income is and if you exceed that
level you'll be reported to the authorities. The definition of PEP also
includes the immediate family of the public officials and we'll see that on the
next slide. When we scroll down after the age and date of birth we've got these
links to other profiles: These are the Brazilian politician's immediate family
members, who have their own profiles. Then further down we've got the reports, so in
this case this politician was actually accused of doing something wrong, it
wasn't just that they're a politically exposed person. There's a report of an
allegation of corruption there and since this profile was published it turned out
that he was convicted of corruption. So this is an example of a profile of
somebody who turned out to be guilty. Now that we understood what a profile looked
like we started to analyze the scope of the database.
This table shows for each country how many people were profiled in World-Check as it
stood in 2014, which was the date of the copy of the database that Chris Vickery
found online. We're showing here for each country with at least 5000 entries the
number of non-PEPs, so that could be people in the terrorism or the crime
category or it could be various other things. The number of PEPs: we would
expect them to be senior public officials but it's interesting that there are a lot
of countries where there are tens of thousands of PEPs and so that suggests
that perhaps they've cast the net quite wide there. We're also giving numbers of
relatives of PEPs. We spent a lot of time browsing the data for our countries and
querying the database to understand the types of the different types of people
who've been included. And then everyone in our collaboration started finding people
who really didn't belong on the list. And we started to ask: How did these innocent
people end up on this watchlist? Jasmin: We were for example really
surprised to find Greenpeace, 16 Greenpeace activists, on the list, who
were arrested for peacefully protesting this "Star Wars" missile defense program
in 2001. They were listed under the general category "crime". That was a bit
weird, because they did plead guilty to criminal trespass, but never served time
for this minor charge. But 12 years later, they would still be on that list.
Tom: This is another example, this time from the UK, from a town called Chelmsford
in the South of England. This woman is Jackie Arnott and she was listed in the
politically exposed persons category along with a record of all her civic activities.
So here she is at work, volunteering for an organization called "Harvest for the
Homeless". This is a local campaign in Chelmsford that was collecting food for
people in need. Jackie Arnott is not a senior public official as you might expect
a politically exposed person to be. In fact her only connection to power seemed
to be that her husband Allen had been the mayor of Chelmsford, which is a ceremonial
position. Now to a different town in the South of England: this is leafy Kingston
upon Thames. This is a view of the town hall: it's all very genteel and this is
one of Kingston's local politicians: Yogan Yoganathan. You can see the letters MBE,
member of the British Empire, after his name. He was given an honour by the Queen
for his services to local government and community relations in Kingston upon
Thames. Among his activities he was a peace campaigner. He campaigned for peace
in Sri Lanka and that led to him being listed in World-Check and being linked to
allegedly the Tamil Tiger terrorist organization, which is an extremely
serious and very upsetting claim to have made about you, not least if you're a
peace campaigner. The World-Check database gave the source for this allegation as a
Sri Lankan government website which in 2007, at the height of the civil war in
Sri Lanka, has said: These guys in London organising peace protests about Sri Lanka,
they're all Tamil Tiger terrorists. And that allegation had made its way into the
World Check database and Mr. Yoganathan said he was very hurt by this allegation
and this was completely untrue and completely without any other basis in
fact. Jasmin: So remember when we said, you
should remember this slide because of the beautiful words "reputable sources". If
you read a little bit further Thomson Reuters says: "researchers are bound to
comply with strict research criteria and must remain objective at all time". Well
it seems that the research team was a little bit flexible on these rules. The
reasons why innocent people showed up on the list were very often the problem of
these "reputable" sources and handling them. Now we would like to show you some
of the sources and we put together a little ranking for you.
*laughter* Jasmin: You might all know that one. Yeah,
Wikipedia. We thought we give number 5 to Wikipedia. In thousands of profiles World-
Check used Wikipedia as a source. Well here you still might think: okay it's only
for general information, so maybe it's fine. What about the next one?
Tom: Well at number 4 we have conspiracy sites: this one is called cyberclass.net
and it has all the educational resources you might need on alternative accounts of
the 9/11 attacks. World-Check research has also cited it in a profile of a British
businessman, which of course was used by the banks.
Jasmin: Number 3, also really interesting: We found state-run sites or state-run
propaganda you must say, also used as sources, for example China Daily. It's the
biggest newspaper in China and state-owned and even though it's not an official organ
of the Chinese Communist Party, it's considered to be a quasi-party newspaper.
Because of this commentary that you see on the right side, it's saying that there's a
terrorist group, the Tibetan Youth Congress, the prominent diaspora
organization, is listed as a terrorist group on World-Check. What we found
pretty, I don't know how to say it.. the research team used this article as the
only source for this profile recording the Chinese government's accusations.
Tom: At number 2 we have a website that unfortunately you might have heard of:
Hundreds of listings referenced reports on Breitbart. At the time, Breitbart was
selectively reporting on what it called "black crime" and there was a whole tag
page for what they called "black crime". There were hundreds of listings that
referred to reports that have been carried on Breitbart. But number 1 ...
Jasmin: Our number 1 ... Tom: We have Stormfront which, if you
haven't heard of it, it's a forum for white supremacists. It was founded in 1995
by a former Ku Klux Klan member and there were several listings that referred to
Stormfront. Among them listings for two black British people containing links to a
discussion thread on the forum. Jasmin: So the problem really is that
World-Check uses all the sources that they can find, which is fine, but it seems that
they don't differ between a news site, a propaganda site, extremist sites, whatever
site. And all the sources and information they collect, but they don't weight it or
rate it or assess the information. So for example, if a state attorney accuses a
person or if a competitor blackened somebody in a media report, the
information gets into the World-Check database without any filtering and there
is no final verification of this or any accusation.
Tom: World-Check found an interesting way to deal with this problem of unreliable
sources or potentially unreliable sources: In the profiles they've added this general
legal notice. Here they mention that everyone who views this database should
carry out independent checks to verify the information. They later added a further
disclaimer saying: If this profile contains negative allegations it should be
assumed that such allegations are denied. This is an interesting legal concept, that
you can carry these extremely damaging accusations that people are linked to
terrorist groups, but of course you can tell your customers to assume that the
allegations are denied and to check the information out themselves. We found many
people on the list that had encountered difficulties with their banks and that
raises the question of whether some banks and users of the list were able to heed
this warning and launch their own investigations after seeing adverse claims
in World-Check. In fact, somebody I spoke to as part of my research who works for a
bank said that they were under such pressure that if they found an adverse
listing in World-Check, it would be extremely difficult for them to disprove
it, you know, given the time that was available. This is one issue. But besides
the problems with the sources and the lack of verification of the information there
is another reason why innocent people have ended up in this watchlist: Our research
showed that the database carries entries for people who are merely accused or
investigated over possible crimes without being charged or convicted. Reports of
minor convictions are kept on file for years after the event as we saw with
Greenpeace. and sometimes people had been cleared of their charges but their entries
hadn't been updated to reflect that information. So innocent people just kept
being guilty in the world of the database. Jasmin: For example like him, so please
meet the terrorist Andrej Holm, or at least that's what World-Check suggested
for a couple of years. Holm, maybe some of you know him, is a very well-known
sociologist and later he was a short time, in German "Baustaatssekretär". Maybe in
English at something like housing secretary in the Berlin State Government.
He was targeted by the Federal prosecutor's office ten years ago. The
suspicion was: Membership in a terrorist group. He was arrested at the end of July
2007 and detained for 3 weeks. Holm had obviously been investigated because he had
being critical of the displacement of poorer people and cities and he wrote it
in a very similar way or similar words to a left-wing extremist group active at that
time. But in the end the suspicion that he could be a member himself proved totally
unfounded and in 2010 all procedures against Holm were discontinued. He was
even compensated for his imprisonment. In the end for the state and justice Holm was
innocent. But when Holm wanted to become a customer at Norisbank two years later in
2012, the institute refused to open his bank account and that even without any
explanation. That was when Holm still did not know that he was on the watchlist of
World-Check. When we told him and we talked to him he said: I have a bad
feeling when my life is recorded there without me being aware of it or having any
influence on it. Even years later such an entry can permanently make life
significantly more difficult. But apparently there are institutions that
rely on World-Check or similar databases. When we talked to the Norisbank they said
that the Name List screening, that's what it's called, was an essential part of
fulfilling the legal requirements for combating financial criminality. It's
about preventing money laundering, they said. And the due diligence check would
use many different databases as data sources. I found a little bit funny that
they wouldn't talk about at all about the case from Mr. Holm and they said: They
cannot give any information because of data protection reasons.
Tom: We saw in the marketing brochure that Thomson Reuters say that 49 of 50 of the
world's biggest banks use World-Check. We had a pretty strong idea that most of the
big-name banks would be using it. But for my UK audience I wanted to confirm that
the high street names that my readers would be familiar with had used this
database. I had information that the Co- operative Bank among several other big
names had used World Check and I asked them to confirm that that was the case.
And this is what they said: "I can confirm that the Co-operative Bank doesn't use and
has not used World-Check." Well, this was an interesting response. I went back to
Google and I did a site-search on LinkedIn for World-Check and the Co-operative Bank
and this is what I found: This is Michael, he says he is a high-risk case-analyst at
the Co-operative Bank and his previous position in 2015: he was an anti-money-
laundering analyst and this gives the description of his responsibilities. At
the bottom there you can see that that included exiting customers where necessary
if they were found outside the bank's risk appetite, which is a euphemism for: he can
close your account if you're too risky. So this was quite obviously a considerable
responsibility and then further down in the job description he says that he used
systems including World-Check to make these decisions.
So I went back to the Co-operative Bank press spokesperson and sent them an
attachment to see what they had to say about this. And the reply came: "I can
confirm that we do not use World-Check and any access to that database the bank had
was in excess of 5 years ago." So they admitted that they had used the database,
but they're now saying that they don't use it anymore. I think this is an indication
of exactly how much secrecy there is on the part of the banks and resistance to
any kind of accountability. You know, they're questioned by a journalist from a
national newspaper, they give completely inaccurate information about whether they
had used this system and only admitted it when they were confronted with evidence to
the contrary. You know, if you're a Co- operative Bank customer, you really ought
to have a right to know what is being done with your data and how decisions about you
are being made. This is all enshrined in data-protection law and this seems to be
at odds with all of those principles. So we put all of the findings from the
different countries to Thomson Reuters and they didn't really come back to us on any
of their specific cases, but they gave us a statement. One of the things they said
was that "Individuals can contact us, if they believe any of the information held
is inaccurate and we would urge them to do so." This is quite tricky, if your bank is
not allowed to tell you, why your account has been closed. The bank is certainly not
allowed to show you your listing on World- Check. We have to admit that you can
submit a subject access request to Thomson Reuters, if you have a hunch that you
might be on the list, and then you can find out and obviously you could challenge
your information. But whether that would be acted upon is another question. Thomson
Reuters said they provide identifying information such as dates of birth and
this will be verified with reputable and official sources. On some of the
unreliable sources they said: "If blog content appears it is only as a supporting
source for that secondary information and is clearly identified as such". We don't
know if they've made improvements to the database since 2014, so it may be that
things are different from the snapshot we saw, but that's what they said.
And then they said: "In conclusion, it's important to point out that the inclusion
in World-Check does not imply guilt of any crime and every record states, if this
profile contains negative allegations it should be assumed that such allegations
are denied. The accuracy of the information found in the underlying media
sources should be verified with the profile subject before any action is
taken." One final point they made is that there are competing databases to World-
Check. So LexisNexis and Dow Jones also produce watchlists and we don't know if
there are similar problems with those lists. Why has this happened? You know, we
mentioned that banks are under huge pressure from governments to weed out
terrorists and money launderers among their customer bases and what's the
environment in which this has come about? We don't have a full answer to this
question, but I want to show you one email that gives a sense of the atmosphere and
the paranoia that has led to the current regime.
So this email is from a man who says he's the World Check's General Counsel. It was
sent in 2002 to a US Treasury consultation and so this is a public document. He
declares his interests, he says he works for a company that sells a product to help
financial institutions conduct money laundering checks. Obviously this is a
short time after 9/11 and he argues that under the Patriot Act financial
institutions must be proactive about tackling money laundering. He exerts the
considerable moral pressure, even going so far as to suggest that the banks were
helping the terrorists by their lack of action. So he writes: "The U.S. is in a
war on terror and the front lines of the war are at the doorsteps of every US
financial institution. US financial institutions are inadvertently aiding and
abetting domestic terror against American citizens." This is just one company's
viewpoint, I'm sure the US Treasury took in lots of different viewpoints when they
were forming this legislation, but I think this gives a nice sense of the kinds of
arguments that were being made. If you want more on the wider context of this
there's a really good book called "Speculative Security" by Marieke de Goede
which goes into this in more detail. So can the system be improved or repaired?
Again, we don't give an answer to this question but some thoughts have occurred
to us: There could be better selection of sources used to compile this kind of list.
Perhaps you would narrow it down a bit more to the official sanctions lists and
people who are actually convicted of crimes. Those kinds of categories of
sources, maybe news reports in reputable outlets, perhaps news reports that are
confirmed by more than one outlet, that kind of thing. You could also indicate the
quality of the information. So if you're going to insist on republishing the fact
that the Sri Lankan government has accused a person of terrorism, maybe you would
flag up that the Sri Lankan government certainly at that time did not have a good
record for reliability on who it was accusing of being terrorists. You could
also give rights of reply to people: So on your credit history you can go to a credit
reference agency, see what is said about you and reply to the criticisms of you
that are made there. They could think about doing that. There is an initiative
to make an open-source sanctions watchlist at opensanctions.org, which of course
brings lots of advantages and everyone can see what is said about them on the list.
And I think there's also the wider question of whether we actually want banks
to have this responsibility of predicting and foreseeing crime among their
customers. Do we want the private sector to do that job or do we want that
responsibility to be squarely on the judicial system or on the criminal justice
system? So with that ... Jasmin: So...
Tom: Go on. Jasmin: No, go on.
Tom: We'll be very happy to take your questions and these are all contact
details, so thank you very much for your attention.
*applause*
Herald: Thank you very much for this
super-interesting talk. I have good news for all of you: we have about 20 minutes
time for Q&A, so please pile up at the microphones, if you have any questions, of
which I am sure there are many. We are going to start with one question from the
Internet. Internet-Question: Considering the
database is still online has it undergone changes to conform to GDPR?
Tom: I don't think we have any information on that, sorry.
Herald: Alright, thanks, let's start with another question from microphone number 1.
Mic1: Thank you. If he was the general council for the World Check company, at
what point was it acquired by Thomson Reuters? Or was it already part of Thomson
Reuters? Tom: It wasn't at that point, it was some
years later. An interesting point actually about his job title is that, if you go on
his LinkedIn page, he does have a law degree, this guy, but his job title at
world check in 2002 was not General Council, but a Head of Business
Development. I don't know, if that's just a mistake on his LinkedIn.
Herald: Maybe another question from microphone number 3.
Mic3: So I want to know, if I make a request to access my data will that put me
on the list? And my actual question is: Where did they
get the names from? Because essentially the analyst that does 220 profiles a day,
does he get to pick the names? Jasmin: Yes. So if you put a request to
World Check your name will not be on the list afterwards. So you can do it if you
want. And this is how it works: The research team goes through the internet
and looks for articles and picks out names and puts them in.
Mic3: Ok, so they should be people, who don't go on Stormfront essentially to pick
names. Because is that what's happening? Like they hire people and they go on
Stormfront all day and randomly pick names? No, but seriously?
Jasmin: I don't know, if they do it like that, but somehow they came up with the
source, yes. Mic3: Okay, thanks!
Herald: Microphone number 4. Mic4: Hey, thanks for the talk. You've
mentioned a few people that were on there wrongfully, but what percentage are
actually wrong on there of the profiles that you viewed?
Tom: We don't have a percentage, we think it's a minority, there are lots of people,
who did do bad things and get onto the list. But of course it undermines the
credibility of the entire database, when there are you know many many examples that
we were able to find without even it's not like we read all 2 million profiles, so
who knows. But obviously it's a very good question.
Jasmin: I think it's an excellent question, but I have to admit that we
didn't review all the 2.2 million profiles.
Herald: Alright, mic number 2, please. Mic2: Thank you for your work on this
really important subject. I myself ended up on that list and lost my bank for two
years because of it. With how essential banking is in the modern world to get
paid, to pay your bills, to do anything, what options to people who have had their
banks or organizations like Finsbury Park that have had their banks closed and on
these lists have? Especially with their lists being so ubiquitous amongst all of
the major banks? Tom: Well, Finsbury Park Mosque went to
court, and they sued Thomson Reuters successfully and after that Thomson
Reuters changed the listing and admitted that they had been wrong to list them in
the terrorism category. Obviously that's not an option that's available to
everybody, I think the first step is to request your data from Thomson Reuters to
see exactly what was being said about you and then go from there. But it's very
difficult. Jasmin: But for example Mr. Holm, he
didn't get a account at Norisbank, but he ended up in another bank that didn't use
World Check and that was the Berliner Sparkasse.
Herald: Alright, I think it's the internet's turn again to ask a question.
Internet-Q: Would you agree that the purpose of such a list is to protect not
only the banks from rotten customers, but also the public from terrorism or the bad
businesses that could harm us? And if yes, isn't that sacrificing a few for the
benefit of many? Jasmin: I think, you shouldn't sacrifice a
few for the many, because it would be so easy to make it better. We saw that these
sources were so obviously weird and wrong and so, I think it wouldn't be necessary,
if they were to check the list a lot better.
Herald: Mic number 1, please. Mic1: Hi, great presentation. Did you find
any evidence of banks and such organizations on disclosing information
about their customers towards Thomson Reuters?
Tom: I don't think we saw any sign of that. It does look like they stick to the
public sources. There were various entries that had three-letter acronyms next to
them like CIA and various things. But I think in all of those cases it turned out
that the CIA, or whoever, had said something publicly about that person. So
it didn't seem that there was any covert cooperation in either direction.
Herald: Mic number 3, please. Mic3: Thank you for your work. Obviously,
it's disheartening to see such sites as Stormfront and Breitbart being, well,
cited as sources. In your work did you find how much of the of the data was
supported by these so-called "reputable sources", these extremist sites as the
category. Jasmin: How many?
Tom: It depended on the site. I think Breitbart was hundreds of entries. They
were focused around a particular country, which wasn't the US, it was another
country. Which suggested to us that potentially it had been a researcher, who
had a particular fondness for Breitbart, who had decided to use that as a source.
So there seem to be a lot of variation between different countries in the mix of
sources that have been used. Herald: Mic number 4, please.
Mic4: Hi, thanks. I work on cryptocurrency stuff, so obviously have a long-standing
interest in financial privacy and openness. There was a really interesting,
although terribly written book, I would not recommend it, but was written by
someone, who was at US Treasury and crafted kind of post 9/11 policy around
sanctions. One of the things he said in the book was immediately after 9/11 they
were willing to put people on the sanctions list and block you from the
entire international financial system at 80% certainty level. So if they're about
80% confident that you are somehow related to terrorism, they would just kick you
out. So I was wondering, if.. because I know a lot of the interest in preventing
mass surveillance is all about making it more expensive, so as to force people to
target it more specifically. I was wondering, if you had any thoughts on what
kind of direction people should be thinking about going in terms of forcing
more targeting of preventing people from international financial access. Instead of
allowing it to be so broad and you know controlled by so few.
Tom: Use cash. Jasmin: These were already some good
thoughts. Tom: I mean, I think we should ask our
government for accountability on this kind of surveillance, as we would with a
communication surveillance or any other kind of surveillance. But we've only just
looked at one part of this system, we've looked at this one watchlist, but this is
part of a whole range of stuff that's going on. So I think we should continue to
look at financial surveillance alongside other forms of surveillance.
Herald: Alright, Mic number 2, please. Mic2: I have a question concerning the
Financial Action Task Force, which is an intergovernmental organization
compromising both European Union countries and GCC. Have you confronted them with the
work that thousand in the banks are doing? Jasmin: I didn't.
Tom: We haven't been to them directly, but one of the really useful things that we
pick it up from the Financial Action Task Force is that their definition of politically
exposed person talks about senior public officials and this database seemed to go
way further than that. So there seems to be an interesting discussion going on
about where the limits of this kind of surveillance should be drawn. You might
take the view that heads of state, there's not really any problem with surveilling
their financial activity, but when you start to cast the net wider then this kind
of thing seems to have more worrying implications.
Herald: Internet, if you got a question, fire away.
Internet-Q: It looks like Thomson Reuters basically says you can't disclose the
information you find in our system, because we have the copyright on it. So
are there any jurisdictions that have a law that would require banks to report
what information was used to determine that someone was considered a risk?
Jasmin: No, there's no law that the banks has to say it, but as Tom mentioned before
the people that think that they're on a list they can confront will check with
this. Tom: And I think in some jurisdictions
there are exemptions from subject access request rights for anti money laundering
purposes. I'm not sure exactly how big a part that plays but that may be part of
the reason why banks think that they can just deny people any answers to why these
decisions have been made. Herald: Mic number 1, please.
Mic1: Thank you for the excellent talk. You mentioned that legal regulations
require that banks use some kind of blacklist. Do you know what criteria these
regulations cite? So quality control doesn't seem to be among them. Could you
start your own list and send it to banks? Jasmin: You're right, quality control
seems not to be part of it. But the regulation is, for example, the, I don't
know the English word, "Sorgfaltspflicht" (due diligence obligations) for the
customer. You have to make sure that the customer is not a criminal or a terrorist.
And there are many regulations asking for it. For example, the EG money laundering
law from starting 1991 and then it got newer in 2001, 2005. So that's mainly the part that
we focused on because it's the part that's important for the World Check
database. Herald: Alright, Mic number 3, please.
Mic3: Thanks for the talk. You did find a lot of people who are on the list
wrongfully and I'm curious if you informed them that they are on the list or if you
informed the company that they had these people on the list that shouldn't be
there. Especially I'm interested what happened to the Greenpeace activists you
mentioned. Do you have any information if they are still on the list or not?
Jasmin: All the cases that we showed to you, all the ones we talked to, we
confronted them and we asked them, if we can publish their case and all of them
went to World Check and asked if they are on the list, and asked also to delete them
on the list and I think in almost all the cases the people actually were deleted.
Tom: I think in some of them at least. And as Jasmin said, we were very careful
only to publish people's names, if they had given their consent for us to do that.
The response I got from Jackie Arnott, who was the woman in pink, who you saw in the
presentation, was that the last time she had any adverse attention from the
authorities was when she went on holiday in the 1980s to the Eastern Block and she
got a phone call from the British Foreign Office to say: "What are you doing? Going
over there?" And this was what came to her mind, when we told her about her listing
in World Check. Herald: Thanks. Mic number 4, please.
Mic4: Thanks, in the LinkedIn profile you showed there were a few other systems, I
think Dow Jones and one other, do they suck as badly as World Check?
Jasmin: Well we did check them and there was no leak yet. But if there will be,
maybe we can tell you next year. *Applause* Herald: Alright, Mic number 2.
Mic2: Hi, thank you. Can you go one slide back? Thank you. I was wondering, because
you said that their sources were like terribly wrong and weird and I was
wondering, if we assume that they are not wrong and weird, but they're there that
they are working perfectly well and that all of these questions like the answer to
all these questions was: It's working perfectly well. Who would be the
people, who it's working perfectly well for? And who especially is targeted here?
And is there any possibility of action in that scenario, in this possible world, in
which this was working perfectly well as it is?
Tom: I think maybe there are two different answers for the politically exposed
persons and for the people accused of terrorism. I think for politically exposed
persons, to me, you can make quite a strong case that senior public officials should be
subject to the financial surveillance. You know, if you are a prime minister and
suddenly you have millions of pounds flowing through your bank account, maybe
that's a legitimate.. Mic2: No, sorry. I was not asking, what
are the perfect normative conditions under which this would function. I was asking,
given the state of things as it is now was the perfect way of working, who would it
be perfect for? Who is the real beneficiary of this wrong and weird way of
working? That's my question. Tom: Well, I don't think it benefits the
public. Because I don't think this is a real serious way of stopping terrorism and
I'm not even sure that it's a real serious way of stopping political corruption.
Because actually we looked into some of the cases that came out through the Panama
papers and similar things, which showed sometimes that banks had looked at a
person's World Check listing, seen that they were in the watch list, but said:
This is actually a very lucrative client. So we're going to keep banking them. So
there are two sides to it and I think that's a very important question.
Herald: Internet, it's your turn again. Internet-Q: Tom, considering the
proprietor of your newspaper, Rupert Murdoch, was there any kind of pressure as
to what you published about them? Tom: About World Check, well, that's a
question for the internet, isn't it? No. Herald: Microphone number 1, please.
Mic1: Yeah, two questions. The first is about deletion: Did I get it right that
there's no established mechanism or process, as well as it is known, for
deletion of datasets in that database?
So they claim how many thousands sounds of records they add and they
update. So there is some procedure for reading but none for deletion. It's
obviously weird. The second is about asking them what they have in the records,
if they have a record about me, for example, could I just ask them? And they should
answer me? Are there some conditions, are there costs for it? And maybe guessing:
How would they react if, say, 15000 people would ask the question?
Jasmin: About the deletion of data, you're totally right. There seems to be no
process in reviewing the data that all the data that shouldn't be in there is not in
there anymore. That's a problem, because as we know everybody has the right to
be forgotten in the internet. And to the second question, you can ask them, you can
go there and write them an email and ask them, if you're included in the database.
But what they say if 15000 people would ask them, I don't know. Maybe you can ask
them that. Tom: And remember they're very productive,
they could do 220 profiles in a month, I was writing them, so truly they can handle
15,000 requests, I think. Herald: Mic number 3, please.
Mic3: Have you found any evidence that the customers were pushing sources on World
Check, that some of the customers might have used them just as a filtering
mechanism and push sources that wouldn't be normally checked?
Tom: We don't have any evidence of that. But you do raise an important point, that
some of the banks said: Well, we use lots of sources. And some of the banks said: Of
course, we wouldn't just go on a World Check listing. But again, it's very
difficult to know exactly what was the information that HSBC considered, when
they closed the mosque's account, because that is all subject to secrecy.
Herald: Mic number 4, please. Mic4: Can I please also ask you to go to
the previous slide? Jasmin: Of course.
Mic4: I think the problem is we are focusing too much on the list itself. I
have difficulties imagining that we can control all these lists, which are
circulating, which are being created by different companies. I think the problem
arises, when they are used. So I don't know if we can really achieve through
legislation or through some kind of control better sources, better information
quality, or whatever. Maybe it should be at the point where they are used I in
banks, there should be really the legislative mechanism, the kind of legal
mechanism to solve this. I am imagining, for instance, if the bank uses sources
like these and denies the person to open an account. Or the same case with all
these lists which exist for phone companies and lots of lists like that in
different sectors, if that person is denied the account opening, there could be
a mechanism by which the person would force the bank or the institution to
disclose the sources and to initiate some kind of legal procedure. This would mean..
Herald: Would you be so kind as to develop a question? Because a lot of other people
still have questions and we have only a few minutes left, thank you very much.
*applause* Mic4: The question is: Do you think it
should be rather that we focus on the banks or the points, where this
information is used, rather than talk about the companies which make these lists?
Jasmin: I think that's a really good question, because it's actually a question
of who takes the responsibility for a decision? And the funny thing is that
World-Check puts all the weird sources in it, but still says: "Oh general legal
sentences, you have to check by yourself.." and then the bank says: "No,
in World Check, there was a list and this name was on the list." So right now we
have the scenario that people don't feel responsibility and I think that's the
problem. Herald: Alright, we have time for exactly
one last question and I hope you don't mind, if I give it to the internet,
because everybody else has the chance to catch the speakers later. So if there's
one, please fire away. Internet-Q: Are there any high-profile
politicians on the list? Tom: Yes, I mean the politicians that you
would expect to be on the list, heads of state, were on the list, so I guess at
least that part of the system is working. Herald: Please give another huge round of
applause to our speakers but this super informative talk. Thank you so much.
Tom: Thank you!
*34c3 postroll*
subtitles created by c3subtitles.de in the year 2019. Join, and help us!