Mediapart journalist Yann Philippin was one of several people targeted by hackers based in India who were commissioned to gain access to mobile phones and computers of individuals “who threatened to expose wrongdoing” by Qatar “in the run-up to this month’s World Cup”, according to a joint investigation by The Sunday Times and The Bureau of Investigative Journalism.
The British weekly reported that the hacking group, operating under the name WhiteInt and based in the northern Indian city of Gurugram, was commissioned by various private investigators to spy not only on “critics” of Qatar, but upon a total of “more than 100” individuals in operations mostly unrelated to the Gulf state. These are said to include spying on Pakistani politicians and diplomats, on the Swiss president Ignazio Cassis and former British chancellor (finance minister) Philip Hammond, as well as on a dissident Russian oligarch and two heads of Formula One racing teams.
Enlargement : Illustration 1
The Sunday Times and The Bureau of Investigative Journalism (TBIJ) gained access to a database used by the hackers after sending undercover reporters, presenting themselves as corporate investigators, to meet with them in India. The weekly reported that WhiteInt is “masterminded” by Aditya Jain, 31, who, it said, “also holds down a day job at the Indian office of the British accountancy firm Deloitte”.
According to the report, the services of the hacking group were employed by “private investigators linked to the City of London”. These included "investigators working for autocratic states, British lawyers and their wealthy clients".
It detailed that, using “phishing” email messages – by which malicious software can be sent into a computer or mobile phone – the hackers can gain control of computer or phone microphones and cameras allowing them to view or listen in on their victims.
Those targeted by the Indian hackers for their activities in relation to Qatar were “a dozen” people of various nationalities, including journalists, former and active officials from the world of football, and a French senator, The Sunday Times reported. They included Jonathan Calvert, editor of The Sunday Times celebrated Insight team of investigative journalists which, it said, “had been at the forefront of exposing the corruption that led Fifa to award the World Cup to Qatar in 2010”.
Contacted by Mediapart, a Qatari government spokesman denied that the Gulf state had ordered the hacking, and said The Sunday Times report was “false”. He said that Qatar was looking at “all” legal recourse it may dispose of against those responsible for what he described as “unfounded allegations”.
“This dossier containing falsified information had been shown to other media, who refused to publish this information after having determined that it had no factual basis,” he added.
The investigation by The Sunday Times and TBIJ revealed that among the targets was Michel Platini, former president of the European football governing body UEFA, whose mobile phone was reportedly hacked in May 2019, one month before he was due to questioned by a French judicial investigation into alleged corruption surrounding the awarding to Qatar of the World Cup, football's most important tournament, and which is to be held in the Gulf state between November 20th and December 18th.
Platini, who also sat on the executive committee of football’s world governing body FIFA, and as such took part in the voting to choose the host country, cast his vote in favour of Qatar. The judicial investigation is seeking to establish whether Platini was pressured into doing so by then French president Nicolas Sarkozy while brokering deals with Qatar.
The Sunday Times cited a source “close” to the French public prosecution services’ financial crimes branch, the PNF, as saying that Qatar would have been “anxious” to know what Platini was planning to say to the judicial probe.
In a statement given to French news agency AFP on Sunday, Platini said he was “surprised and profoundly shocked” at the revelations published at the weekend, and said he wanted “the motivations, the actors and those who gave orders in this ‘operation’” to be established.
The weekly said another French victim of the hacking was the author and filmmaker Rokhaya Diallo, an outspoken critic of the conditions of migrant workers employed by Qatar to build the stadiums and other infrastructures for the World Cup.
Yet another target was French centre-right senator Nathalie Goulet, who has a special interest in issues surrounding radical Islam and the funding of terrorist activities, and who has publicly accused Qatar of funding the Sunni Islamist movement, the Muslim Brotherhood. According to The Sunday Times, the hackers gained Goulet’s password to access her email account.
The Sunday Times also revealed that Mediapart journalist Yann Philippin, a member of its dedicated team of investigative reporters and who has published numerous investigations into the allegations of corruption over Qatar’s hosting of the World Cup, notably between May and December 2019, was targeted by the Indian hackers in early 2020. However, it reported, the attempts by email “phishing” messages in order to hack into his devices were thwarted after Philippin became suspicious of these and changed his computer and mobile phone.
“These revelations strengthen the suspicions we had in 2020, when our journalist Yann Philippin was the victim of a sophisticated hacking attempt following his numerous revelations over this affair [of the World Cup award],” said Mediapart publishing editor Edwy Plenel, reacting to the report in The Sunday Times. “We are expecting the French justice authorities, who we contacted at the time, to provide all light, as quickly as possible, on these grave attacks against press freedom, [and against] the right to know and to investigate.”
It was as of January 15th 2020 that Yann Philippin became the target of a sustained and sophisticated phishing campaign, but from then unknown attackers. Over a period of two weeks, he received a total of 16 emails in which hackers tried to convince him to click on web links and also to type in passwords. Several of these were supposedly informing him of articles about the Football Leaks corruption revelations (on which he has widely reported for Mediapart, and notably concerning the Qatari-owned football club Paris Saint-Germain), and about Qatar and Saudi Arabia. The links he was sent were in reality not to media websites but to a server controlled by the hackers.
In one incident on January 17th 2020, he received a message supposedly sent by a member of his family and which contained photos of her husband and children, and a link to the photo-sharing website Flickr where he was invited to download more. Philippin contacted the family member and discovered she had never sent such a message, nor had she uploaded photos for sharing.
Despite his initial ncaution, he did click on a link sent to him via his mobile phone. But realising immediately that he had fallen into a trap, he closed down his navigator before the linked-to page opened, then switched off his phone and removed its SIM card. With advice from Mediapart’s technical services team, he changed his phone, his SIM card, and his computer, as well as passwords to his accounts.
One month later, another journalist from Mediapart’s investigations team, Antton Rouget, also became the target of a phishing campaign, this time over the two days of February 26th and 27th 2020. Rouget, who had co-written with Philippin several investigative reports into issues concerning Qatar, received emails from a person posing as a Qatari journalist, and who said he had confidential information about the 2022 World Cup. Mediapart’s technical team found the emails were fraudulent, and the links contained in them connected with a website where Rouget would have been lured into entering the password to his email account.
A year later, on February 1st 2021, Mediapart, Philippin and Rouget filed a formal joint complaint with the Paris public prosecution services for “attempted fraudulent access to a system of automated treatment of data”, for “attempted fraud”, and “violation of personal privacy”.
That prompted the prosecution services to open a preliminary investigation, which was finally closed after they were unable to identify the perpetrators of the attempted hacking. Following the revelations at the weekend by The Sunday Times and The Bureau of Investigative Journalism, Mediapart has decided to again approach the justice authorities.
It is the second time that Mediapart has been reported to have fallen victim to a digital espionage campaign by a foreign state. The first occasion was the revelation in July 2021 by the Forbidden Stories journalistic consortium that the phones of Mediapart journalist Lénaïg Bredoux and its publishing editor Edwy Plenel were hacked by Morocco’s secret services using Pegasus spyware supplied by the Israeli firm NSO Group.
-------------------------
English version by Graham Tearse
-------------------------
If you have information of public interest you would like to pass on to Mediapart for investigation you can contact us at this email address: enquete@mediapart.fr. If you wish to send us documents for our scrutiny via our highly secure platform SecureDrop please go to this page.
-------------------------