 Welcome everybody to our next talk financial surveillance exposing the global banking watch list I think everybody in this room would agree that mass surveillance is a very bad idea and that of course also goes for financial surveillance and Our next two speakers. Yes mean Clofta and Tom wills are two Investigative journalists who have uncovered how this system of financial surveillance works And I'm pretty sure that you are just as excited as me to find out what they have found out So please give them a warm round of applause Audio Well, you know, there's always a little thing that doesn't work Whatever is this for the talk we just had before there was a live demo It was very well planned still something went wrong I think everybody in the audience had a lot of empathy because nobody wants to be in that position But I think we just fixed the problem. Is it fixed? Is it about to be fixed? I will try a little bit. Yes There we go round of applause now we go we can start So it's nice to see you all so happy that so many people came I want to introduce to you. This is Tom. He's a data journalist working on Investigations at the time times of London and he specializes in a set of techniques such as data mining Which can reveal wrongdoing and lead to stories that benefit the public and this is Yasmin She's an investigative journalist working in Hamburg for panorama at the broadcaster NDR Which is part of the ARD network and she focuses on politics the digital economy and surveillance And we're going to tell you tonight about the findings of an investigation we conducted this year as part of an international collaboration and Our colleagues were Evelyn, Stefania, Lars and Cora and Yasmin. Yeah and Together we investigated the leak database and published in June this year our stories in the UK in Germany in the US Netherlands Belgium and Italy So what was our story? We investigated that innocent people around the world have been wrongly added to a watch list of terrorists and Criminals this watch list of high-risk people and Organization is compiled by Thompson Reuters a British firm and sold to almost all the world's major banks as well as police forces intelligence agencies and non-government organization. It's called world check and The leak gave us the opportunity to review the entire database for the first time So what exactly is world check? Well, if you want to open a bank account We know that the bank might check your credit rating to see if you are a reliable borrower But how does the bank know if you're a criminal or a terrorist or a potential money launderer? One of the checks that most banks will do is run your name against the world check watch list And they might log in here if your bank finds your name on the list They might refuse your application or they might subject to your financial transactions to extra scrutiny Or if you're an existing customer, they might even close your account So Thompson Reuters says about the list that it is to find hidden risk The list is of heightened risk people and organizations such as such as terrorists fraudsters or senior public officials who might try to use the account to handle corrupt funds so they want to be kind of an early warning system for hidden risk and Banks are even forced to use these kinds of list by regulation They have to take steps to comply with sanctions sanctions and international and domestic law against money laundering and terror financing and of course we all want less terrorism and of course we want less money laundering that's clear and To put it in a world checks words. It's to help identify Relationships or risk by providing highly structured intelligence profiles and heightening risk individuals and entities globally But since 9 11 governments have to put more and more pressure on banks to identify terrorists and money launders among their customers so Thompson Reuters Advertisements even World check with warnings about recent fines and settlements against banks for violating sanctions Maybe you know the this one story HSBC had a historic 1.9 billion dollar payment to US authorities to settle money laundering allegation in 2012 and that's one of the most famous Example that the banks of course fear very much So if you look for information how the information is collected Thompson Reuters says it compiles a list using Hundreds of thousands of reputable Sources in the public domain You got to remember that slide and especially the word Reputable sources because we will come back to that a little bit later So how do they collect this information? Well, Thompson Reuters researchers Look into public sources ranging from EU sanction lists to local newspapers In order to find names to add to the database In total Thompson Reuters says that world check contains profiles on over two million entities And that it's adding 20,000 profiles a month and updating 40,000 So the list is growing all the time Now this is a job advert for a position as a world check researcher in Washington DC And it states that among the many responsibilities You need to write more than 220 highly structured and sourced biographical intelligence profiles every month I think it's really nice of them to be so upfront about the workload and That's about one hour per profile if you're working full-time So it must be quite a challenge if you are the assistant research associate to maintain accuracy and quality under that kind of workload So not many people had heard of this list until recently But it's one of the biggest of its kind according to a world-check data sheet The service is used by over 300 intelligence and government agency nine out of world tops 10 law firms and 49 of the world's 50 largest banks so overall more than 6,000 customers from 170 countries and Are reportedly on their customer list So the content of the list is secret because Thompson Reuters doesn't tell people when it adds them to the list and banks are forbidden From passing on the information Access is only granted after a vetting process So the user has to sign a nondisclosure agreement and also using the database is quite expensive Years access can cost up to 1 million euro So in recent years have been some excellent investigations by other journalists who've highlighted some possible issues with world-check So the BBC had been investigating why HSBC closed the account of Finsbury Park Mosque in London without any explanation and the BBC researchers found that the mosque had been listed in world-check in the terrorism category so that may have been part of the bank's decision and Advice news was also able to view some of the entries in world-check through a client of Thompson Reuters And they discovered more examples of questionable entries So we knew that there was something potentially going on with this database But it mostly remained confidential and nobody had been able to view the entire database in order to find out whether there were wider issues with the system But then there was a leak In summer 2016 this security researcher Chris Vickery was doing what he very much likes to do He was scanning the internet for couch DB instances exposed to the world Without any username or password. Well, you can imagine what comes next So he would contact the owners to encourage them to secure their data But he found something really interesting and that was the copy of the world-check database from 2014 and With him finding it the question came up in his head. He asked I have a terrorism blacklist I have a copy. Should it be shared? Chris posted on Reddit To say that he was facing a dilemma about whether to release the entire database or not Because on the one hand the database was apparently compiled from public sources. So what's the problem with? publishing publishing public sources and The world check is a system that is used to make decisions about people's lives and secrets So maybe transparency would be in their interest But on the other hand it contained personal data relating to millions of people who might suffer harm if the information was disclosed so since it is not so easy to ask the two million people if He's allowed to publish it. He was asking himself. So what now to do and Thanks to the previous work of the BBC and vice we as journalists had reason to believe it would be in the public interest to review this data so we made come made contact with Chris and before viewing the leaked data we considered of course the ethical legal and and security implications So we had a chance to fully reveal how the system works for the first time and this is what the file looked like So we agreed with Chris We agreed with Chris that we would use the data to do responsible journalism But not to publish the data itself. So we can't show you the full database in this presentation When we received the data it was a four gigabyte JSON line delimited file with no documentation So the first thing I had to do was write a parser in Python Well, I decided to flatten this JSON file into a CSV file and then we had a four gigabyte CSV file And I loaded that into Postgres in order that we could do some analysis of the content of this database So this is a an abridged version of the field list showing you the Really key pieces of data on each of these profiles. So we've got an ID We've got an entity type. So that was is this a person or an organization? For people there were first names surnames aliases Position would be if you're a politician, this would say what your position is in the government The categories were really interesting because these might be that you're a Politician as mentioned or it might be that you're in the terrorism category or the financial crime category We've got dates of birth and Countries and nationalities obviously those are really important so that banks can identify the customers correctly information text was Possibly the most interesting part of the data and then we had various links to other profile profiles the source URLs which turned out to be really crucial and the dates on which the Records have been created and updated So, you know some of these fields were self-explanatory But we really needed to see What this database looked like to the end user to understand how this information would be interpreted? So like any good investigative journalists we've course turned to Google and after a bit of experimentation We discovered the magic words Searching for quote you are strictly prohibited from disclosing or copying the content of this service and Sure enough we find some Examples of profiles from world check which people may or may not realize Are on the internet and accessible through Google some of these are from the Panama papers So obviously the person who put that one there knew what they were doing The first example in this result is interesting though because we have the word intranet in the URL And we should perhaps tell this company that their intranet is not an intranet So maybe they found out by themselves. They know now hopefully So this example is Actually from a magazine in Brazil Which published a world check profile that they obtained as part of an investigation? So this was really useful because we could see exactly what the data looked like to the end user and this profile belongs to Eduardo da Cunha who was the former leader of the Brazilian Chamber of Deputies and As I say it was published by the magazine So we can see here the cascades that he's been assigned in this case He's a political individual and he's a pep pep stands for politically exposed person And this is a term in anti-money laundering legislation That means this person is in senior public office And they are potentially in a position to take bribes and launder corrupt funds It doesn't mean necessarily that they've done anything wrong But the money laundering rules say that banks have to scrutinize these people very carefully So if you are a politician, you might be called up by your bank And they would say we need to interview you about your sources of income in order to establish what the Legitimate level of income is and if you exceed that level you'll be reported to the authorities the definition of pep also includes the immediate family of the public officials and We'll see that on the next slide So when we scroll down after the age and date birth We've got these links to other profiles. So these are the Brazilian politicians immediate family members who have their own profiles and Then further down We've got the reports. So in this case This politician was actually accused of doing something wrong. It wasn't just that they're a politically exposed person there's a report of an allegation of corruption there and Since this profile was published and it's turned out that he was convicted of corruption So this is an example of a profile of somebody who turned out to be guilty So now that we understood what a profile looked like we started to analyze the scope of the database So this table shows for each country how many people were profiled in world check as it stood in 2014 Which was the date of the copy of the database that Chris Vickery found online So we're showing here for each country with at least 5,000 entries the number of non peps So that could be people in the terrorism or the crime category or it could be various other things The number of peps so we would expect them to be senior public officials but it's interesting that there are a lot of countries where there are tens of thousands of peps and So that suggests that perhaps they've cast the net quite wide there and we're also giving numbers of relatives of peps so we spent a lot of time browsing the data for our countries and querying the database to understand the types of the different types of people who'd been included and then Everyone in our collaboration Started finding people who really didn't belong on the list and we started to ask how did these innocent people end up on this watch list? So we were for example really surprised to find Greenpeace 16 Greenpeace activists on the list who were arrested for peacefully protesting this Star Wars missile defense program in 2001 and They were listed under the general category crime and That was a bit weird because they did plead guilty to criminal trespass But never serve time for this minor charge, but 12 years later. They would be still on that list So this is another example this time from the UK from a town called Chelmsford in the south of England and this woman is Jackie Arnott and She was listed in the politically exposed persons category along with a record of all her civic activities So here she is at work volunteering for an organization called Harvest for the homeless This is a local campaign in Chelmsford that was collecting food for people in need Jackie Arnott is not a senior public official As you might expect a politically exposed person to be in fact her only connection to power seemed to be that her husband Alan had been the mayor of Chelmsford, which is a ceremonial position and Now to a different town in the south of England. This is leafy Kingston upon Thames This is a view of the town hall it's all very genteel and This is one of Kingston's local politicians Yogan Yoganathan you can see the letters MBE member of the British Empire after his name He was given an honor by the Queen for his services to local government and community relations in Kingston upon Thames and among his activities. He was a peace campaigner. He campaigned for peace in Sri Lanka and That's led to him being listed in World Check and being linked to Allegedly the Tamil Tiger terrorist organization, which is an extremely serious and very upsetting claim to have made about you not least if you're a peace campaigner and The World Check database gave the source for this allegation as Sri Lankan government website which in 2007 at the height of the Civil War in Sri Lanka had said these guys in London organizing peace protests about Sri Lanka, they're all Tamil Tiger terrorists and that allegation had made its way into the World Check database and Mr. Yoganathan said that he was very hurt by this allegation and This this was completely untrue and completely without any other basis in fact So remember when we said you should remember this slide because of the beautiful words reputable sources If you read a little bit further Thompson Reuters says Researchers are bound to comply with strict research criteria and must remain objective at all time Well, that seems that the research team was a little bit flexible on these rules The reason why innocent people showed up on the list were very often the problem of these reputable Sources and handling them So now we would like to show you some of the sources and we put together a little ranking for you You might all know that one Yeah, Wikipedia. We thought we give number five to Wikipedia in Thousands of profiles will check used Users Wikipedia as a source. Well here you still might think, okay, it's only for general information So maybe it's fine. What about the next one? Well at number four we have conspiracy sites This one is called cyber class net and it was all the educational resources You might need on alternative accounts of the 9-11 attacks Well check researchers also cited it in a profile of a British businessman, which of course was used by the banks Number three also really interesting. We found state-run sites or State-run propaganda. You must say also use that sources for example China Daily It's the biggest newspaper in China and state owned and even though it's not an official organ of the Chinese Communist Party It's considered to be a quasi party newspaper So because of this Commentary that you see on the right side It's saying that there's a terrorist group the Tibetan Youth Congress the prominent diaspora organization is listed as a terrorist group on world check and what we found Pretty I don't know how to say the the research team used this article as the only source For this profile recording the Chinese government's accusations So at number two we have a website that unfortunately you might have heard of Hundreds of listings referenced reports on Breitbart and at the time Breitbart was Selectively reporting on what it called black crime and there was a whole tag page for what they called black crime and There were hundreds of listings that referred to reports that have been carried on Breitbart But number one our number one We have Stormfront, which if you haven't heard of it It's a forum for white supremacists. It was founded in 1995 by former Ku Klux Klan member and There were several listings that referred to storm front among them listings for two black British people Containing links to a discussion thread on the forum So the problem really is that world check uses all the sources that they can find which is fine but it seems that they don't differ between a new sides a propaganda side extremist sides, whatever side and all the sources Information and that they collect but they don't weight it or rate it or assess the information So for example if a state attorney accuses a person or if a competitor blackened somebody in a media report The information gets into the world check database without any filtering and there is no final verification of this or any accusation So World check found an interesting way to deal with this problem of unreliable sources or potentially unreliable sources in the profiles. They've added this general legal notice and Here they mention that everyone who views this database should carry out Independent checks to verify the information and they laid it later added a further disclaimer saying if this profile contains negative Allegations it should be assumed that such allegations are denied So this is an interesting legal Concepts that you can carry these extremely damaging accusations that people are linked to terrorist groups But of course you can tell your customers to assume that the allegations are denied and to check the information out themselves We found many people on the list that had encountered difficulties with their banks and That raises the question of whether some banks and users of the list Were able to heed this warning and launch their own investigations after seeing adverse claims in world check in fact Somebody I spoke to as part of my research who works for a bank Said that they were under such pressure that if they found an adverse listing in world check It would be extremely difficult for them to Disprove it, you know given the time that that was available so This is one one issue But besides the problems with the sources and the lack of verification of the information There is another reason why innocent people have ended up in this watch list Our research showed that the database carries Entries for people who are merely accused or investigated over possible crimes without being charged or convicted Reports of minor convictions are kept on file for years after the event as we saw with Greenpeace and Sometimes people had been cleared of their charges But their entries hadn't been updated to reflect that information so innocent people just kept being guilty in the world of the database For example like him so please meet the terrorist Andre Holm or at least that's what world checks suggested for a couple of years Holm maybe some of you know him is a very well-known Sociologist and later he was a short time in German it's Baustat Secretary maybe in English it's something like housing secretary in the Berlin state government And he was targeted by the federal prosecutors office 10 years ago. The suspicion was Membership in a terrorist group. So he was arrested at the end of July 2007 and detained for three weeks So Holm had obviously been investigated because he had been critical of the displacement of poor people in cities And he wrote it in a very similar way or so similar words To a left-wing extremist group active at that time But in the end the suspicion that he could be a member himself proved totally unfounded and in 2010 all Procedure procedures against Holm were discontinued. So he was even compensated for his imprisonment So in the end for the state and justice Holm was innocent But when Holm wanted to become a customer at Norris Bank two years later in 2012 the Institute refused to open a spank account and that even without any explanation and that was when Holm still did not know that he was on the watch list of World check When we told him and we talked to him he said I Have a bad feeling when my life is recorded there without me being aware of it or having any influence on it So even years later such an entry can permanently make life significantly more difficult But apparently there are institutions that rely on world check or similar databases When we talked to the Norris Bank, they said that the nameless screening That's what it's called was an essential part of fulfilling the legal requirements for combating financial Criminality, it's about preventing money laundering They said and the due diligence check would use many different databases as data sources And I found it a little bit funny that they wouldn't talk about at all About the case from mr. Holm and they said they cannot give any information because of data protection reasons So we saw in the marketing brochure that Thompson Reuters say that 49 of 50 of the world's biggest banks use world check So we had a pretty strong idea that most of the big name banks would be using it But you know from my UK audience I wanted to confirm that the high street names that my readers would be familiar with Had used this database so I had information at the cooperative bank among several other big names had used world check And I asked them to confirm that that was the case and this is what they said I Can confirm that the cooperative bank doesn't use and has not used world check Well, this was an interesting response. I went back to Google And I did a site search on LinkedIn for a world check and the cooperative bank And this is what I found This is Michael. He is a well. He says he is a high-risk case analyst at the cooperative bank and And his previous position in 2015 he was an anti-money laundering analyst and This gives a description of his responsibilities at the bottom there. You can see that that included Exiting customers where necessary if they were found outside the bank's risk appetite Which is a euphemism for he can close your account if you're too risky. So this was quite a Obviously a considerable responsibility and then further down in the job description He says that he used systems including world check to make these to make these decisions So I went back to the cooperative bank press spokesperson and Sent them an attachment To see what they had to say about this and the reply came I Can confirm that we do not use world check and any access to that database the bank had was in excess of five years ago So they admitted that they had used the database but They're now saying that they don't use it anymore and I think this is an indication of exactly how much secrecy there is on the part of the banks and Resistance to any kind of accountability, you know, they're questioned by a journalist from a national newspaper They give completely inaccurate information about whether they had used this system and and only Admitted it when they were confronted with evidence to the contrary and you know If you're a cooperative bank customer, you really ought to have a right to know What is being done with your data and how decisions about you are being made? this is all enshrined in data protection law and This seems to be at odds with all of those principles So we put all of the findings from the different countries to Thompson Royce's And they didn't really come back to us on any of the specific cases, but they gave us statement One of the things they said was that Individuals can contact us if they believe any of the information held is inaccurate and we would urge them to do so This is quite tricky if your bank is not allowed to tell you why your account has been closed The bank is not certainly not allowed to show you your listing and world check We have to admit that You can submit a subject access request to Thompson Royce's if you have a hunch that you might be on the list And then you can find out and then obviously you could challenge your information But whether that would be acted upon is another question Thompson Royce's said they provide identifying information such as states of birth and this will be verified with reputable and official sources on the On some of the unreliable sources. They said if blog content appears It is only as a supporting source for that secondary information and is clearly identified as such We don't know if they've made improvements to the database since 2014 So it may be that things are different from the snapshot we saw, but that's what they said And then they said in conclusion, it's important to point out that Inclusion in world check does not imply guilt of any crime and every record states If this profile contains negative allegations, it should be assumed that such allegations are denied The accuracy of the information found in the underlying media sources should be verified with the profile subject before any action is taken And one final point they made is that there are competing databases to world check So Lexis Nexus and Dow Jones also produce watch lists and we don't know if there are similar problems with those lists So why has this happened, you know, we mentioned that banks are under huge pressure from governments to weed out terrorists and money launders among their customer bases and What's the environment in which this has come about? We don't have a full answer to this question But I want to show you one email That gives a sense of the atmosphere in the paranoia that has led to the the current regime So this email is from a man who says he's the world checks general counsel It was sent in 2002 to a US Treasury consultation and so this is a public document and He declares his interests he says he works for a company that sells a product to help financial institutions conduct money laundering checks and Obviously, this is a short time after 9 11 and he argues that under the Patriot Act Financial institutions must be proactive about tackling money laundering He exerts considerable moral pressure even going so far as to suggest that the banks were helping the terrorists by their lack of action So he writes the US is in a war on terror and the front lines of the war are at the doorsteps of every US financial institution US financial financial institutions are inadvertently aiding and abetting domestic terror against American citizens So this is just one company's viewpoint I'm sure the US Treasury took in lots of different viewpoints when they were forming this legislation But I think this gives a nice sense of the kinds of arguments that were being made And if you want more on the wider context of of this there's a really good book called speculative security By Marica de Gerda, which goes into this in more detail So can the system be improved or repaired? Again, we don't give an answer to this question, but some thoughts have occurred to us There could be better selection of sources used to compile this kind of list perhaps you would narrow it down a bit more to the official sanctions lists and People who are actually convicted of crimes those kinds of categories of sources Maybe news reports in reputable outlets perhaps news reports that are confirmed by more than one outlet that kind of thing You could also indicate the quality of the information. So if you're going to insist on Republishing the fact that the Sri Lankan government has accused a person of terrorism Maybe you would flag up that the Sri Lankan government Certainly at that time did not have a good Record for reliability on on who it was accusing of being terrorists You could also give rights of reply to people. So on your credit history you can go to a credit reference agency see what is said about you and reply to the Criticisms of you that are made there they could think about doing that There is an initiative to make an open source sanctions watch list Open sanctions org which of course brings lots of advantages and everyone can see what is said about them on the list and I think there's also the wider question of whether we actually want banks to have this responsibility of predicting and foreseeing crime among their customers Do we want the private sector to do that job or do we want that responsibility to be squarely on the judicial system? Or on the criminal justice system? So with that Go on I Will be very happy to take your questions and these are our contact details. So thank you very much for your attention Thank you very much for this super interesting talk. I have good news for all of you We have about 20 minutes time for Q&A So please pile up at the microphones if you have any questions of which I'm sure there are many We are going to start with one question from the internet Considering the database is still online has it undergone changes to conform to GDPR? I don't think we have any information on that. Sorry All right, thanks. Let's start with another question from microphone number one He was the general counsel for the world chick company at what point was it acquired by Thompson Reuters? Oh Was it already part of Thompson Reuters? It wasn't at that point. It was some years later An interesting point actually about his job title is that if you go on his LinkedIn page, he does have a law degree this guy But his job title at World Check in 2002 was not general counsel, but head of business development I don't know if that's just a mistake on his LinkedIn. Maybe Thanks another question from microphone number three Yeah, so I want to know if I make a request to access my data. Will that put me on the list? And that's not my actual question my actual question is Where did they get the names from because essentially the analyst that does 220 profiles a day? Does he get to pick the names? Yes So if you if you put a request to World Check your name will not be on the list afterwards So you can do it if you want and this is how it works the research team goes through the internet and Looks for articles and picks out Names and puts them in okay, so they should be people who don't go on storm front essentially to pick names because Is that what's happening like they hire people and they go on store front storm front all day and Randomly pick names, you know, but seriously, I don't know if they do it like that But somehow they came up with the source. Yes, okay, thanks microphone number four Hey, thank for the talk You've mentioned a few people that were on there wrongfully, but what percentage are actually wrongfully on there of profiles that you've viewed We don't have a percentage. I mean we think it's a minority There are lots of people who did do bad things and get onto the list But of course it undermines the credibility of the entire Database when there are, you know, many many examples that we were able to find You know without even it's not like we read all two million profiles. So who knows but yeah, obviously it's very good question I think it's an excellent question, but I have to admit that we didn't review all the 2.2 million profiles All right, Mike number two, please I'd like to thank you for your work on this really important subject I myself ended up on that list and lost my bank for two years because of it With how essential Banking is in the modern world to get paid to pay your bills to do anything What options to people who have had their banks or organizations like the Finsbury Park that have had their banks closed And on these lists have especially with their list being so ubiquitous amongst all of the major banks Well, Finsbury Park Mosque went to court and they sued Thompson Royce's successfully and after that Thompson Royce's changed the listing and admitted that they had been wrong to List them in the terrorism casquery Obviously, that's not an option that's available to everybody I think the first step is to request your data from Thompson Royce's to see exactly what's being said about you and Then go from there, but there's it's very difficult But for example, mr. Hall He didn't get a account at Norris Bank But he ended up in another bank that didn't use world check and that was the Berlina spark hustle Really All right, I think it's the internet's turn again to ask a question Would you agree that the purpose of such a list is to protect not only the banks from rotten customers But also the public from terrorism or other bad businesses that could harm us and if yes Isn't that sacrificing a few for the benefit of many? I Think you shouldn't sacrifice a few for the many because it would be so easy to make it better We saw that these sources were so obviously weird and wrong and So I think it wouldn't be necessary if they would check The list a lot better Like number one, please Hi great presentation Did you find any evidence of banks and such organizations on on disclosing information about their customers towards? Thompson Reuters We I don't think we saw any sign of that. It does look like the stick to the public sources There were various entries that had three letter acronyms next to them like CIA and various things But I think in all of those cases it turned out that the CIA or whoever had said something publicly about that person So it didn't seem that there was any covert cooperation between in either direction Mike number three, please Thank you for your work Obviously, it's disheartening to see such sites as Stormfront and Breitbart being Well cited as sources in your work Did you find how much of the of the data was supported by these so-called? reputable sources these extremist sites as the category How many It depended on the site so I think Breitbart was hundreds of entries They were Focused around a particular country which it wasn't the US it was another country which suggested to us that potentially it had been a Researcher who had a particular fondness for Breitbart who had decided to use that as a source so there seemed to be a lot of Variation between different countries in the mix of sources that have been used Mike number four, please Hi, thanks. I work on cryptocurrency stuff. So obviously have a long-standing interest in financial privacy and openness So there was a really interesting although terribly written book I would not recommend it but Was written by someone who is at US Treasury and crafted kind of pumped post 9-11 policy around Sanctions and one of the things he said in the book was immediately after 9-11 they were willing to put people on the sanctions list and Block you from the entire international financial system at a 80% surety level So if they're about 80% confident that you are somehow related to terrorism, they would just Kick you out. So I was wondering if because I know a lot of the interest in Preventing mass surveillance is all about making it more expensive so as to force people to target it more specifically I was wondering if you had any thoughts on Kind of what direction people should be thinking about going in terms of forcing more targeting of these kinds of Preventing people from international financial access instead of allowing it to be so broad and you know controlled by so few Use cash these were already so good thoughts Yeah, I mean, I think you know, we should ask our governments for accountability on this kind of surveillance as we would with communication surveillance or any other kind of surveillance and But I think we're only you know, we've only just looked at one part of this system We've looked at this one watch list But this is part of a whole range of stuff that's going on. So I think You know, we should continue to look at financial surveillance alongside other forms of surveillance All right Mike number two, please I have a question concerning the financial action a task force which is an intergovernmental Organization compromising both European Union countries and GCC Have you confronted them with the work that thumbs on in the banks are doing? We we haven't been to them directly But one of the really useful things that we picked up from the financial action task force is that their definition of politically exposed person It talks about senior public officials and this database seemed to go way further than that So there seems to be an interesting discussion going on about where the limits of this kind of surveillance should be drawn and you know, you might take the view that Heads of state. There's not really any problem with surveilling their financial activity But when you start to cast the net wider than this kind of thing seems to have more worrying implications Internet if you got a question fire away It looks like Thompson's and writers basically says you can't disclose the information you find in our system because we have the copyright on it So are there any jurisdictions that have a law that would require banks to report what information was used to determine that someone was considered a risk? No, there's no law that the banks has to say it but as Tom mentioned before The people that think that they are on a list they can confront world check with this And I think in some jurisdictions there are exemptions from subject access request rights For anti-money laundering purposes, I'm not sure exactly how big a part that plays But that may be part of the reason why banks think that they can just deny people any Answers to why these decisions have been made Mike number one, please Thank you for the excellent talk You mentioned that legal regulations require that banks use some kind of blacklist. Do you know what criteria this regulation side? So Mineral quality control doesn't seem to be among them. Could you start your own distance? Hello to banks You're right quality control seems not to be part of it But so the regulation is for example, the I don't know the English word the sorgfalts for the customer You have to make sure that the customer is not a criminal or a terrorist or and there are many regulations asking for it for example the the eG money laundering law from starting 91 and then it got new you're done by in 2001 2005 so That's mainly the part that we focused on because it's the part that's important for the world-check database All right, Mike number three, please Thanks for the talk You did find a lot of people who are on that list wrong fully and I'm curious if you Informed them that they are on the list or if you informed the company that they had these people on the list And they shouldn't be there and especially I'm Interested what happened to the Greenpeace activists you mentioned are they have you any information if they are still on the list or not? All the cases that we showed to you all the ones we Talked to we confronted them and we asked them if we can publish their case and all of them Went to world check and ask if they are on the list and ask also for ask also for To delete them on the list and I think in almost all the cases the people actually were deleted on the list Yeah, I think in in some of them at least and the we you know as jasmine said we were very Careful only to publish people's names if they had given their consent for us to do that The response I got from Jackie Arna who was the woman in pink who you saw in the presentation Was that the last time she had any adverse attention from the authorities? Was when she went on holiday in the 80s to the eastern block and she got a phone call from the British home office British foreign office rather to say what are you doing going over there? And this was what came to her mind when we told her about her listing and world check Thanks Mike number four, please Thanks In the LinkedIn profile you showed there were a few other systems I think Dow Jones and one other do they suck as badly as world check Well, we did check them. There was no leak yet But if there will be maybe we can tell you next year All right Mike number two Hi, thank you. Can you go on slide back? Once slide back. Thank you And I was wondering because you said that like these for example that the sources were like terribly wrong and weird And I was wondering if we assume that they're not wrong and weird But that they're they're working perfectly well and that all of these questions like the answer to all of these questions was It's working perfectly well Who would be the perfect the people it's working perfectly well for and who especially is targeted here and and Is there any possibility of action in in that scenario in this possible world in which this was working perfectly well As it is that's the question, right? I think maybe there are two different answers for the politically exposed persons and for the people accused of terrorism and so on I think politically exposed persons To me, you can make quite a strong case that senior public officials should be subject to financial surveillance You know if you are a prime minister and suddenly you have millions of pounds flowing through your bank account. Maybe that's a legitimate I was I was not asking What are the perfect normative conditions under which this would function? I was asking given that the The state of things as it is now was the perfect way of working Who would it be perfect for? Like who is who is the real beneficiary of this wrong and weird way of working that's my question Well, I don't think it benefits the public because I don't think this is a real serious way of stopping terrorism and I'm not even sure that it's a real serious way of stopping political corruption because actually we Looked into some of the cases that came out through the Panama Papers and similar things Which showed sometimes that banks had looked at a person's world check listing Seen that they were in the watch list but said this is actually a very lucrative client so we're going to keep banking them and So there are two sides to it and I think you know, that's very important question Internet it's your turn again Tom considering the proprietor of your newspaper Robert Murdoch was there any kind of pressure as to what you published about them? About world check. Oh, that's a question for the internet, isn't it? No Microphone number one, please Yeah, two questions. The first is about deletion. Did I get to write that a snow established mechanism or process as well as it's known for deletion of data sets in that database so They claim how many thousands thousands of records they add and they upset that there is some procedure for reading but no for none for deletion it's obviously weird and the second is about Asking them what they have in their records if they have a record about me for example could I just Ask them and they should answer me and There are some conditions are At what are their codes for it and well, maybe guessing how would they react if say some 15,000 people would ask us a question About the deletion of data You're totally right there seems to be no Process in Reviewing the data that way that all the deletion that all the data that shouldn't be in there is still is not in there anymore So that's the problem because as we know everybody has the right to to be forgotten in the the internet and to this second question You can ask them you can go there and write them an email and ask them if they're if you were included in the database But what they say if 15,000 people would ask them I I don't know maybe you can ask them that Remember they're very productive. They could do two hundred and twenty profiles in a month Oh, yeah, right in them. So truly they can handle 15,000 requests. I think Mike number three, please Have you found any evidence that the customers were pushing sources on World-check that some of the customers might have used them just as a filtering mechanism and push Sources that wouldn't be normally checked We we don't have any evidence of that but you do raise an important point that the Bank some of the banks said well We use lots of sources and some of the banks said of course we wouldn't just go on a world-check listing But again, it's very difficult to know Exactly, what was the information that HSBC considered when they closed the mosques account because that is all subject to secrecy for please Can I please also ask you to go to the previous slide of course? I think I think the problem is we are focusing too much on the list itself and I had difficulties imagine imagining that we can Control all these lists which are circulating which are being created by the different companies. I think the problem arises When they are used so I I don't know if we can really achieve through legislation or through some kind of control better sources better information quality or whatever and maybe it should be At the point where they are used I in banks where there should be really the and the the legislative Mechanism the kind of legal mechanism to solve this I I'm imagining for instance if the bank Uses sources like these and denies The the person to open an account or the same case with all these lists Which exist for phone companies and there are Lots of lists like that in different sectors if that person is denied the account opening There could be a mechanism by which the person would Force the bank or the institution to disclose the sources and to initiate some kind of legal procedure Which would mean that if the Kind as to develop a question because a lot of other people still have questions and we have only a few minutes left The question is Do you think it should be rather that we focus on the banks or the points where this information is used rather than talk about the companies which make these lists I? Think that's a really good question because it's actually a question of who takes the responsibility for a decision And the funny thing is that wall check puts all the weird sources on it, but still says our general legal Sentences You have to check by yourself and then the bank says no the in world check There was a list and this name was on the list so right now we have the scenario that people don't feel responsibility and I think that's the problem All right We have time for exactly one last questions And I hope you don't mind if I give it to the internet because everybody else has the chance to catch the speakers later So if there's one please fire away Are there any high-profile politicians on the list? Yes, I mean the politicians that you would expect to be on the list heads of state were on the list So I guess at least that part of the system is working Please give another huge round of applause to our speakers for the super informative talk. Thank you so much