Show Hide image

The bugger, bugged

After a chance meeting with a former News of the World executive who told him his phone had been hacked, Hugh Grant couldn’t resist going back to him – with a hidden tape recorder – to find out if there was more to the story. . .

When I broke down in my midlife crisis car in remotest Kent just before Christmas, a battered white van pulled up on the far carriageway. To help, I thought. But when the driver got out he started taking pictures with a long-lens camera. He came closer to get better shots and I swore at him. Then he offered me a lift the last few miles to my destination. I suspected his motives and swore at him some more. (I'm not entirely sympathetic towards paparazzi.) Then I realised I couldn't get a taxi and was late. So I had to accept the lift.

He turned out to be an ex-News of the World investigative journalist and paparazzo, now running a pub in Dover. He still kept his camera in the car's glove box for just this kind of happy accident.

More than that, he was Paul McMullan, one of two ex-NoW hacks who had blown the whistle (in the Guardian and on Channel 4's Dispatches) on the full extent of phone-hacking at the paper, particularly under its former editor Andy Coulson. This was interesting, as I had been a victim - a fact he confirmed as we drove along. He also had an unusual defence of the practice: that phone-hacking was a price you had to pay for living in a free society. I asked how that worked exactly, but we ran out of time, and next thing we had arrived and he was asking me if I would pose for a photo with him, "not for publication, just for the wall of the pub".

I agreed and the picture duly appeared in the Mail on Sunday that weekend with his creative version of the encounter. He had asked me to drop into his pub some time. So when, some months later, Jemima asked me to write a piece for this paper, it occurred to me it might be interesting to take him up on his invitation.

I wanted to hear more about phone-hacking and the whole business of tabloid journalism. It occurred to me just to interview him straight, as he has, after all, been a whistleblower. But then I thought I might possibly get more, and it might be more fun, if I secretly taped him, The bugger bugged, as it were. Here are some excerpts from our conversation.

Me So, how's the whistleblowing going?
Him I'm trying to get a book published. I sent it off to a publisher who immediately accepted it and then it got legal and they said, "This is never going to get published."
Me Why? Because it accuses too many people of crime?
Him Yes, as I said to the parliamentary commission, Coulson knew all about it and regularly ordered it . . . He [Coulson] rose quickly to the top; he wanted to cover his tracks all the time. So he wouldn't just write a story about a celeb who'd done something. He'd want to make sure they could never sue, so he wanted us to hear the celeb like you on tape saying, "Hello, darling, we had lovely sex last night." So that's on tape - OK, we've got that and so we can publish . . . Historically, the way it went was, in the early days of mobiles, we all had analogue mobiles and that was an absolute joy. You know, you just . . . sat outside Buckingham Palace with a £59 scanner you bought at Argos and get Prince Charles and everything he said.
Me Is that how the Squidgy tapes [of Diana's phone conversations] came out? Which was put down to radio hams, but was in fact . . .
Him Paps in the back of a van, yes . . . I mean, politicians were dropping like flies in the Nineties because it was so easy to get stuff on them. And, obviously, less easy to justify is celebrities. But yes.
Me And . . . it wasn't just the News of the World. It was , you know - the Mail?
Him Oh absolutely, yeah. When I went freelance in 2004 the biggest payers - you'd have thought it would be the NoW, but actually it was the Daily Mail. If I take a good picture, the first person I go to is - such as in your case - the Mail on Sunday. Did you see that story? The picture of you, breaking down . . . I ought to thank you for that. I got £3,000. Whooo!
Me But would they [the Mail] buy a phone-hacked story?
Him For about four or five years they've absolutely been cleaner than clean. And before that they weren't. They were as dirty as anyone . . . They had the most money.
Me So everyone knew? I mean, would Rebekah Wade have known all this stuff was going on?
Him Good question. You're not taping, are you?
Me [slightly shrill voice] No.
Him Well, yeah. Clearly she . . . took over the job of [a journalist] who had a scanner who was trying to sell it to members of his own department. But it wasn't a big crime. [NB: Rebekah Brooks has always denied any knowledge of phone-hacking. The current police investigation is into events that took place after her editorship of the News of the World.]
It started off as fun - you know, it wasn't against the law, so why wouldn't you? And it was only because the MPs who were fiddling their expenses and being generally corrupt kept getting caught so much they changed the law in 2001 to make it illegal to buy and sell a digital scanner. So all we were left with was - you know - finding a blag to get your mobile [records] out of someone at Vodafone. Or, when someone's got it, other people swap things for it.
Me So they all knew? Wade probably knew all about it all?
Him [...] Cameron must have known - that's the bigger scandal. He had to jump into bed with Murdoch as everyone had, starting with Thatcher in the Seventies . . . Tony Blair . . . [tape is hard to hear here] Maggie openly courted Murdoch, saying, you know, "Please support me." So when Cameron, when it came his turn to go to Murdoch via Rebekah Wade . . . Cameron went horse riding regularly with Rebekah. I know, because as well as doorstepping celebrities, I've also doorstepped my ex-boss by hiding in the bushes, waiting for her to come past with Cameron on a horse . . . before the election to show that - you know - Murdoch was backing Cameron.
Me What happened to that story?
Him The Guardian paid for me to do it and I stepped in it and missed them, basically. They'd gone past - not as good as having a picture.
Me Do you think Murdoch knew about phone-hacking?
Him Errr, possibly not. He's a funny bloke given that he owns the Sun and the Screws . . . quite puritanical. Sorry to talk about Divine Brown, but when that came out . . . Murdoch was furious: "What are you putting that on our front page for? You're bringing down the tone of our papers." [Indicating himself] That's what we do over here.
Me Well, it's also because it was his film I was about to come out in.
Him Oh. I see.
Me Yeah. It was a Fox film.
[A pause here while we chat to other customers, and then - ]
Him So anyway, let me finish my story.
Me Murdoch, yes . . .
Him So I was sent to do a feature on Moulin Rouge! at Cannes, which was a great send anyway. Basically my brief was to see who Nicole Kidman was shagging - what she was doing, poking through her bins and get some stuff on her. So Murdoch's paying her five million quid to big up the French and at the same time paying me £5.50 to fuck her up . . . So all hail the master. We're just pawns in his game. How perverse is that?
Me Wow. You reckon he never knew about it?
Him [pause] I don't even think he really worried himself too much about it.
Me What's his son called?
Him James. They're all mates together. They all go horse riding. You've got Jeremy Clarkson lives here [in Oxfordshire]. Cameron lives here, and Rebekah Wade is married to Brooks's son [the former racehorse trainer Charlie Brooks]. Cameron gets dressed up as the Stig to go to Clarkson's 50th birthday party [NB: it was actually to record a video message for the party]. Is that demeaning for a prime minister? It should be the other way round, shouldn't it? So basically, Cameron is very much in debt to Rebekah Wade for helping him not quite win the election . . . So that was my submission to parliament - that Cameron's either a liar or an idiot.
Me But don't you think that all these prime ministers deliberately try to get the police to drag their feet about investigating the whole [phone-hacking] thing because they don't want to upset Murdoch?
Him Yeah. There's that . . . You also work a lot with policemen as well . . . One of the early stories was [and here he names a much-loved TV actress in her sixties] used to be a street walker - whether or not she was, but that's the tip.
Me and Chum MLTVA?!
Me I can't believe it. Oh no!
Chum Really??
Him Yeah. Well, not now . . .
Chum Oh, it'd be so much better if it was now.
Him So I asked a copper to get his hands on the phone files, but because it's only a caution it's not there any more. So that's the tip . . . it's a policeman ringing up a tabloid reporter and asking him for ten grand because this girl had been cautioned right at the start of his career. And then I ask another policemen to go and check the records . . . So that's happening regularly. So the police don't particularly want to investigate.
Me But do you think they're going to have to now?
Him I mean - 20 per cent of the Met has taken backhanders from tabloid hacks. So why would they want to open up that can of worms? . . . And what's wrong with that, anyway? It doesn't hurt anyone particularly. I mean, it could hurt someone's career - but isn't that the dance with the devil you have to play?
Me Well, I suppose the fact that they're dragging their feet while investigating a mass of phone-hacking - which is a crime - some people would think is a bit depressing about the police.
Him But then - should it be a crime? I mean, scanning never used to be a crime. Why should it be? You're transmitting your thoughts and your voice over the airwaves. How can you not expect someone to just stick up an aerial and listen in?
Me So if someone was on a landline and you had a way of tapping in . . .
Him Much harder to do.
Me But if you could, would you think that was illegal? Do you think that should be illegal?
Him I'd have to say quite possibly, yeah. I'd say that should be illegal.
Me But a mobile phone - a digital phone . . . you'd say it'd be all right to tap that?
Him I'm not sure about that. So we went from a point where anyone could listen in to anything. Like you, me, journalists could listen in to corrupt politicians, and this is why we have a reasonably fair society and a not particularly corrupt or criminal prime minister, whereas other countries have Gaddafi. Do you think it's right the only person with a decent digital scanner these days is the government? Whereas 20 years ago we all had a go? Are you comfortable that the only people who can listen in to you now are - is it MI5 or MI6?
Me I'd rather no one listened in, to be honest. And I might not be alone there. You probably wouldn't want people listening to your conversations.
Him I'm not interesting enough for anyone to want to listen in.
Me Ah . . . I think that was one of the questions asked last week at one of the parliamentary committees. They asked Yates [John Yates, acting deputy commissioner of the Metropolitan Police] if it was true that he thought that the NoW had been hacking the phones of friends and family of those girls who were murdered . . . the Soham murder and the Milly girl [Milly Dowler].
Him Yeah. Yeah. It's more than likely. Yeah . . . It was quite routine. Yeah - friends and family is something that's not as easy to justify as the other things.
Me But celebrities you would justify because they're rich?
Him Yeah. I mean, if you don't like it, you've just got to get off the stage. It'll do wonders.
Me So I should have given up acting?
Him If you live off your image, you can't really complain about someone . . .
Me I live off my acting. Which is different to living off your image.
Him Yeah, but you're still presenting yourself to the public. And if the public didn't know you -
Me They don't give a shit. I got arrested with a hooker and they still came to my films. They don't give a fuck about your public image. They just care about whether you're in an entertaining film or not.
Him That's true . . . I have terrible difficulty with him [points to pap shot of Johnny Depp]. He's really difficult. You know, I was in Venice and he was a nightmare to do because he walks around looking like Michael Jackson. And the punchline was . . . after leading everyone a merry dance the film was shot on an open balcony - I mean, it was like - he was standing there in public.
Me And you don't see the difference between the two situations?
Chum He was actually working at this time? As opposed to having his own private time?
Him You can't hide all the time.
Me So you're saying, if you're Johnny Depp or me, you don't deserve to have a private life?
Him You make so much more money. You know, most people in Dover take home about £200 and struggle.
Me So how much do you think the families of the Milly and Soham girls make?
Him OK, so there are examples that are poor and you can't justify - and that's clearly one of them.
Me I tell you the thing I still don't get - if you think it was all right to do all that stuff, why blow the whistle on it?
Him Errm . . . Right. That's interesting. I actually blew the whistle when a friend of mine at the Guardian kept hassling me for an interview. I said, "Well if you put the name of the Castle [his pub] on the front page of the Guardian, I'll do anything you like." So that's how it started.
Me So, have you been leant on by the NoW, News International, since you blew the whistle?
Him No, they've kept their distance. I mean, there's people who have much better records - my records are non-existent. There are people who actually have tapes and transcripts they did for Andy Coulson.
Me And where are these tapes and transcripts? Do you think they've been destroyed?
Him No, I'm sure they're saving them till they retire.
Me So did you personally ever listen to my voice messages?
Him No, I didn't personally ever listen to your voice messages. I did quite a lot of stories on you, though. You were a very good earner at times.

Those are the highlights. As I drove home past the white cliffs, I thought it was interesting - apart from the fact that Paul hates people like me, and I hate people like him, we got on quite well. And, absurdly, I felt a bit guilty for recording him.

And he does have a very nice pub. The Castle Inn, Dover, for the record. There are rooms available, too. He asked me if I'd like to sample the honeymoon suite some time: "I can guarantee your privacy."

-- Listen to the audio now --

This article first appeared in the 11 April 2011 issue of the New Statesman, Jemima Khan guest edit

Fox via YouTube
Show Hide image

Are smart toys spying on children?

If you thought stepping on a Lego was bad, consider the new ways in which toys can hurt and harm families.

In January 1999, the president of Tiger Electronics, Roger Shiffman, was forced to issue a statement clearing the name of the company’s hottest new toy. “Furby is not a spy,” he announced to the waiting world.

Shiffman was speaking out after America’s National Security Agency (NSA) banned the toy from its premises. The ban was its response to a playground rumour that Furbies could be taught to speak, and therefore could record and repeat human speech. “The NSA did not do their homework,” said Shiffman at the time.

But if America’s security agencies are still in the habit of banning toys that can record, spy, and store private information, then the list of contraband items must be getting exceptionally long. Nearly 18 years after TE were forced to deny Furby’s secret agent credentials, EU and US consumer watchdogs are filing complaints about a number of WiFi and Bluetooth connected interactive toys, also known as smart toys, which have hit the shelves. Equipped with microphones and an internet connection, many have the power to invade both children’s and adults’ private lives.

***

“We wanted a smart toy that could learn and grow with a child,” says JP Benini, the co-founder of the CogniToys “Dino”, an interactive WiFi-enabled plastic dinosaur that can hold conversations with children and answer their questions. Benini and his team won the 2014 Watson Mobile Developer Challenge, allowing them to use the question-answering software IBM Watson to develop the Dino. As such, unlike the “interactive” toys of the Nineties and Noughties, Dino doesn’t simply reiterate a host of pre-recorded stock phrases, but has real, organic conversations. “We grew it from something that was like a Siri for kids to something that was more conversational in nature.”

In order for this to work, Dino has a speaker in one nostril and a microphone in the other, and once a child presses the button on his belly, everything they say is processed by the internet-connected toy. The audio files are turned into statistical data and transcripts, which are then anonymised and encrypted. Most of this data is, in Benini’s words, “tossed out”, but his company, Elemental Path, which owns CogniToys, do store statistical data about a child, which they call “Play Data”. “We keep pieces from the interaction, not the full interaction itself,” he tells me.

“Play Data” are things like a child’s favourite colour or sport, which are used to make a profile of the child. This data is then available for the company to view, use, and pass on to third parties, and for parents to see on a “Parental Panel”. For example, if a child tells Dino their favourite colour is “red”, their mother or father will be able to see this on their app, and Elemental Path will be able to use this information to, Benini says, “make a better toy”.

Currently, the company has no plans to use the data with any external marketers, though it is becoming more and more common for smart toys to store and sell data about how they are played with. “This isn’t meant to be just another monitoring device that's using the information that it gathers to sell it back to its user,” says Benini.

Sometimes, however, Elemental Path does save, store, and use the raw audio files of what a child has said to the toy. “If the Dino is asked a question that it doesn’t know, we take that question and separate it from the actual child that’s asking it and it goes into this giant bucket of unresolved questions and we can analyse that over time,” says Benini. It is worth noting, however, that Amazon reviews of the toy claim it is frequently unable to answer questions, meaning there is potentially an abundance of audio saved, rather than it being an occasional occurrence.

CogniToys have a relatively transparent Privacy Policy on their website, and it is clear that Benini has considered privacy at length. He admits that the company has been back and forth about how much data to store, originally offering parents the opportunity to see full transcripts of what their child had been saying, until many fed back that they found this “creepy”. Dino is not the first smart toy to be criticised in this way.

Hello Barbie is the world’s first interactive Barbie doll, and when it was released by Mattel in 2015, it was met with scorn by parents’ rights groups and privacy campaigners. Like Dino, the doll holds conversations with children and stores data about them which it passes back to the parents, and articles expressing concerns about the toy featured on CNN, the Guardian, and the New York Times. Despite Dino’s similarities, however, Benini’s toy received almost no negative attention, while Hello Barbie won the Campaign for a Commercial-Free Childhood’s prize for worst toy of the year 2015.

“We were lucky with that one,” he says, “Like the whole story of the early bird gets the worm but the second worm doesn’t get eaten. Coming second on all of this allowed us to be prepared to address the privacy concerns in greater depth.”

Nonetheless, Dino is in many ways essentially the same as Hello Barbie. Both toys allow companies and parents to spy on children’s private playtimes, and while the former might seem more troubling, the latter is not without its problems. A feature on the Parental Panel of the Dino also allows parents to see the exact wording of questions children have asked about certain difficult topics, such as sex or bullying. In many ways, this is the modern equivalent of a parent reading their child's diary. 

“Giving parents the opportunity to side-step their basic responsibility of talking to, engaging with, encouraging and reassuring their child is a terrifying glimpse into a society where plastic dinosaurs rule and humans are little more than machines providing the babies for the reptile robots to nurture,” says Renate Samson, the chief executive of privacy campaign group Big Brother Watch. “We are used to technology providing convenience in our lives to the detriment of our privacy, but allowing your child to be taught, consoled and even told to meditate by a WiFi connected talking dinosaur really is a step in the wrong direction.”

***

Toy companies and parents are one thing, however, and to many it might seem trivial for a child’s privacy to be comprised in this way. Yet many smart toys are also vulnerable to hackers, meaning security and privacy are under threat in a much more direct way. Ken Munro, of Pen Test Partners, is an ethical hacker who exposed security flaws in the interactive smart toy “My Friend Cayla” by making her say, among other things, “Calm down or I will kick the shit out of you.”

“We just thought ‘Wow’, the opportunity to get a talking doll to swear was too good,” he says. “It was the kid in me. But there were deeper concerns.”

Munro explains that any device could connect to the doll over Bluetooth, provided it was in range, as the set-up didn’t require a pin or password. He also found issues with the encryption processes used by the company. “You can say anything to a child through the doll because there's no security,” he says. “That means you've got a device that can potentially be used to groom a child and that's really creepy.”

Pen Test Partners tells companies about the flaws they find with their products in a process they call “responsible disclosure”. Most of the time, companies are grateful for the information, and work through ways to fix the problem. Munro feels that Vivid Toy Group, the company behind Cayla, did a “poor job” at fixing the issue. “All they did was put one more step in the process of getting it to swear for us.”

It is one thing for a hacker to speak to a child through a toy and another for them to hear them. Early this year, a hack on baby monitors ignited such concerns. But any toy with speech recognition that is connected to the internet is also vulnerable to being hacked. The data that is stored about how children play with smart toys is also under threat, as Fisher Price found out this year when a security company managed to obtain the names, ages, birthdays, and genders of children who had played with its smart toys. In 2015, VTech also admitted that five million of its customers had their data breached in a hack.

“The idea that your child shares their playtime with a device which could potentially be hacked, leaving your child’s inane or maybe intimate and revealing questions exposed is profoundly worrying,” says Samson. Today, the US Electronic Privacy Information Center (EPIC) said in a statement that smart toys “pose an imminent and immediate threat to the safety and security of children in the United States”. 

Munro says big brands are usually great at tackling these issues, but warns about smaller, cheaper brands who have less to lose than companies like Disney or Fisher Price. “I’m not saying they get it right but if someone does find a problem they’ve got a huge incentive to get it right subsequently,” he says of larger companies. Thankfully, Munro says that he found Dino to be secure. “I would be happy for my kids to play with it,” he says. “We did find a couple of bugs but we had a chat with them and they’re a good bunch. They aren’t perfect but I think they’ve done a hell of a lot of a better job than some other smart toy vendors.”

Benini appears alert to security and the credibility it gives his company. “We took the security very, very seriously,” he says. “We were still building our systems whilst these horror stories were coming about so I already set pipelines and parameters in place. With a lot of devices out there it seems that security takes a backseat to the idea, which is really unfortunate when you’re inviting these devices into your home.”

As well as being wary of smaller brands, Munro advises that parents should look out for Bluetooth toys without a secure pairing process (ie. any device can pair with the toy if near enough), and to think twice about which toys you connect to your WiFi. He also advises to use unique passwords for toys and their corresponding apps.

“You might think ‘It's just a toy, so I can use the same password I put in everything else’ – dog’s name, football club, whatever – but actually if that ever got hacked you’d end up getting all your accounts that use that same password hacked,” he says.

Despite his security advice, Munro describes himself as “on the fence” about internet-connected smart toys as a whole. “Most internet of things devices can be hacked in one way or another,” he says. “I would urge caution.”

***

Is all of this legal? Companies might not be doing enough ethically to protect the privacy of children, but are they acting responsibly within the confines of the law?

Benini explains that Dino complies with the United States Children's Online Privacy Protection Act (COPPA) of which there is no real equivalent in the UK. COPPA says that companies must have parental permission to collect personal information over the internet about children under 13 years of age. “We’ve tried to go above and beyond the original layout of COPPA,” says Benini, when describing CogniToys transparent privacy documents. Parents give their consent for Elemental Path to collect their children’s data when they download the app that pairs with the toy.

Dino bears a striking similarity to Amazon Echo and Google Home, smart speakers that listen out for commands and questions in your home. Everything that is said to Amazon Echo is recorded and sent to the cloud, and an investigation by the Guardian earlier this year discovered that this does not comply with COPPA. We are therefore now in a strange position whereby many internet of things home devices are legally considered a threat to a child’s privacy, whereas toys with the same capabilities are not. This is an issue because many parents may not actually be aware that they are handing over their children’s data when installing a new toy.

As of today, EU consumer rights groups are also launching complaints against certain smart toys, claiming they breach the EU Unfair Contract Terms Directive and the EU Data Protection Directive, as well as potentially the Toy Safety Directive. Though smart toys may be better regulated in Europe, there are no signs that the problem is being tackled in the UK. 

At a time when the UK government are implementing unprecedented measures to survey its citizens on the internet and Jeremy Hunt wants companies to scour teens’ phones for sexts, it seems unlikely that any legislation will be enacted that protects children’s privacy from being violated by toy companies. Indeed, many internet of things companies – including Elemental Path – admit they will hand over your data to government and law enforcement officials when asked.

***

As smart toys develop, the threat they pose to children only becomes greater. The inclusion of sensors and cameras means even more data can be collected about children, and their privacy can and will be compromised in worrying ways.

Companies, hackers, and even parents are denying children their individual right to privacy and private play. “Children need to feel that they can play in their own place,” says Samson. It is worrying to set a precedent where children get used to surveillance early on. All of this is to say nothing of the educational problems of owning a toy that will tell you (rather than teach you) how to spell “space” and figure out “5+8”.

In a 1999 episode of The Simpsons, “Grift of the Magi”, a toy company takes over Springfield Elementary and spies on children in order to create the perfect toy, Funzo. It is designed to destroy all other toys, just in time for Christmas. Many at the time criticised the plot for being absurd. Like the show's prediction of President Trump, however, it seems that we are living in a world where satire slowly becomes reality.

Amelia Tait is a technology and digital culture writer at the New Statesman.