On the run with Murdoch's pirates

Toronto, 24 October 1997

Toronto is a mean town when you're looking for a bolthole. The operation was blown, and the agent was running. No ordered retreat here—this was panicked flight, strung out on adrenaline. Far beyond the threshold of fear and desperation, it is when the quarry knows his pursuers are close and all he wants in life is a place to go to ground.

Any halfway serious intelligence operation has an emergency plan. It's Spy Stuff 101 - in the world of John le Carré, a little in-house tradecraft. That means fallback options, safe houses, collateral assets to call on, a whole range of contingencies, a long way before you get round to explaining the really neat pension scheme. But it was long past any of that. Alex couldn't go back to the hotel, the telephone call had made that clear. It was the first place the police would look for him, after the Stop and Detain alert went out to the airports.

The order was to arrest him on probable cause. There were $25,000 in money orders in his hotel room and some expensive computer equipment, but Alex had to walk away from it all. This too was a measure of his distress, for he wasn't the sort of man who walked away from money easily.

Instead he was now heading across town to find another anonymous hotel room, all the time feeling his panic building. He cursed himself for using a credit card that might be traced, flung out of the new lodging and was back on the street. Toronto in late October had the chill of late Fall; a towering blonde German, he was trying to look inconspicuous. He managed to find another hotel, this one cheap and anonymous; he was jumpy as a cat, ready to flee if any police car cruised past. By morning he was in his fourth hotel. It seemed only a matter of time before his luck ran out.

In London, his controller was trying to work out where the operation had gone wrong. Ray Adams had made the travel arrangements himself. In a previous life he had been a Commander at Scotland Yard, running its intelligence division, S11. Now he ran a network of seventeen agents in Europe for Rupert Murdoch. He knew how to do this stuff. He had put Alex on a business class ticket on Lufthansa flight LH 474 at 5pm October 21 out of Frankfurt, to arrive in Toronto at 7.20 that same Tuesday evening. The return flight was a week later.

The complicating factor here was that Alex wasn't travelling alone. Adams had booked a ticket for Alex's wife as well. In part, it was because Adams didn't see any real danger. It would be a little vacation for her, a treat. Agents sometimes need something unexpected like that; their family needs to feel the love. It was just a chance to kick back, really. Think of it as a bit like Date Night, on Uncle Rupert's dime.

At an operational level (he didn't tell Alex this, let alone his wife) it was a nice domestic touch, to disarm the suspicions of the people Alex would be meeting. How could they think he was a spy when he brought his wife along with him? What kind of man puts his partner in danger as well? It was a gesture that has Trust Me written all over it. And the first meeting with the Canadian pirates had gone well. Then hours later they had ratted on him. Did it without a second thought. 'Sure I did it,' the pirate who fingered Alex tells me a decade later when I run him down. 'What's to think about? He was going to help the opposition. Of course I took him out.'

So now Alex and the missus were hotel hopping, on the run together in Toronto then across the US border, accompanied by a business associate of Alex's. Alex had wiped the hard drive of his laptop repeatedly during the night. It would take a very, very good forensic technician to retrieve anything from it. But that was still not completely out of the question.

And it had come to this. A hacker on the payroll of NDS, the arm of News Corporation that provided security for its pay-tv operations, was on the run from the police in two countries. The best prospect now that he had been smuggled across the border into the United States, was to fly him out through an airport with low security. If he was caught, the repercussions for NDS, for News Corporation and for Rupert Murdoch in the glare of publicity were potentially disastrous. The first question would be how News Corporation came to be involved in what looked like criminal piracy directed against NDS's biggest client, DirecTV. How had it come to this?

In late 1997 the story lines at NDS Operational Security were starting to tangle up. In 1996 NDS chief executive Abe Peled had faced a piracy problem that could kill his business. He had made the decision to set up his own security unit to fight the pirates who hacked and then sold their own versions of the NDS smartcards used by BSkyB and the big US satellite broadcaster DirecTV. These pirate smartcards meant anyone could watch the BSkyB and programs for free

He had hired Reuven Hasak, the former deputy head of Israel's internal security agency, Shin Beit, to run it. Hasak had hired Adams as European Security chief, and a former US Army intelligence officer, John Norris, for North America. They had arrested a string of pirates and hired some of Europe's best hackers, including Oliver Kömmerling in Germany, whose NDS codename was Alex.

At some point the mission had changed. Hasak and Peled had set up a Black Hat team in Haifa, which had been trained by Kömmerling to reverse engineer, or hack, NDS smartcards in the sophisticated lab he had helped them set up in Haifa. The theory was that Oliver and the Back Hat team would help show up weaknesses in the NDS cards. But by late 1997 the target for the Black Hat team had changed.

The decision had been made to reverse-engineer the smartcards of their competitors. But even with Oliver's help, doing this would not be simple. The first problem was to get hold of samples of the cards—blank ones from the manufacturer first of all, to practise on; then actual cards issued by the pay-television companies.

Adams emailed Oliver Kömmerling early on Tuesday, October 21 1997: 'Give me urgently a description of all the chips we want as samples.' Oliver replied with the specs on the Wednesday afternoon, October 22. What they needed was the card used by Canal Plus for its Seca card, plus the card then being used by Nagra. This was all very mundane, except that organising the wherewithal to hack NDS's competitors was unfolding right at the same time as NDS had decided to send Oliver on a mission. At the same time as he was orchestrating one of the biggest reverse-engineering events in history, Oliver was going undercover in Toronto.

It was called Operation Duck. It was Ray Adams' idea and, given the timing, it was perhaps the silliest thing that NDS had done to date. As with so much that would happen in the Murdoch empire over the next decade, it only made sense if those involved believed they would never be called to account.

The smartcards that NDS made for the huge US broadcaster DirecTV had been widely pirated. NDS agents would pose as pirates themselves in an attempt to find a major Canadian pirate ring. The problem that no one foresaw was that NDS never told DirecTV about its undercover operation, and DirecTV believed that Oliver was still a pirate.

Oliver (or Alex as he was known at NDS) and Vicky flew business class from Frankfurt to Heathrow and then to Toronto, arriving on Tuesday evening, October 21. They were joined in Toronto by John Luyando, a wheeler dealer in piracy circles who had worked with Oliver in the past. His NDS codename was Jellyfish and NDS's US security chief, John Norris, had a great scorn for him. The prize that Kömmerling was offering to pirates in Canada was a hack for DirecTV's P2 card. He had called one pirate dealer, Ron Ereiser, about it but Ron already had his hack, thanks to his Bulgarians, Plamen Donev and Vesco.

Back in August Oliver had spoken on the phone for almost an hour with Marty Mullin, a big piracy dealer in eastern Canada. Mullin would later testify that Oliver offered him a hack for EchoStar (the other big US satellite broadcaster), but Oliver denies this.

The goal of Operation Duck was for Oliver to program some DirecTV cards for local dealers and use this as a stepping stone to get to Mullin, who was one of the two biggest piracy dealers in North America. Mullin had his own hack for P2 cards and NDS dearly wanted to know who Mullin's hacker was.

By October 25 Oliver had been in Toronto four days and had programmed a swag of pirate cards, using a program he had ripped off another pirate hack. And he had been paid a lot of money. That evening, he met with two piracy dealers in a car and programmed a few cards for them with his portable programmer box, to demonstrate that it worked.

The following night Oliver received a call from a friend in London, a partner in his old piracy ring, who was sleeping with a woman who worked for Federal Express. 'He told me, these guys [from the previous night] sent a parcel to Larry Rissler,' Oliver recalls.

Rissler was a former FBI agent who headed the Office of Signal Integrity—the operational security division—of DirecTV, and he had been hunting Oliver for some time. One of the dealers Oliver had met was a Rissler informant and he had despatched a re-programmed smartcard by FedEx to his boss. The parcel would be with Rissler early the next morning—if it wasn't already there.

Oliver hit the alarm button. He booked out of his hotel with Vicky and Luyando and took a cab ride in the middle of the night twenty miles to the US border, crossed it and booked into a motel on the other side, along the southern Lake Ontario shore. But this was the wrong move because, while piracy might not be illegal in Canada, in the United States you did jail time for it. Forty-five minutes later, Ray Adams called. He said they had to get out.

In Los Angeles, Larry Rissler had already picked up that Oliver was heading into the US. He had entered Oliver's name in the US Customs database, flagged him with a Search and Detain order. For Rissler, Oliver was a glittering prize. For years he had been Enemy Number One for DirecTV, the man who consistently hacked and broke their cards for the pirates. He had no idea that Oliver was working for NDS, or that NDS would not tell him about something like this.

Now it was only a matter of time before Oliver was picked up. But here, in his moment of triumph, Rissler made a mistake. He made a courtesy call to John Norris, to let him know what was happening. It would have been hard not to show a little satisfaction that DirecTV had beaten NDS to the punch.

Norris said it was wonderful news. He didn't tell Rissler that Oliver worked for NDS, or that this was an NDS undercover operation. He just put down the phone and sent an urgent message to Adams, who then got on the phone. 'Adams phoned and told me to go—go quickly,' Oliver said. 'So I had to wake up Luyando, and tell him, “Come, we have to leave.”'

Then the three of them – Oliver/Alex, Luyando/Jellyfish and Vicky - left everything behind in the motel room—computer equipment, money orders, clothes—as they headed south and east, away from the border. They booked into another motel, only to panic when they saw police cars go by. They were back on the road, looking for a new place to hide.

'We did that twice. In the third motel we paid cash.'

Oliver was continually on the phone to Adams. He hadn't even touched the smartcards, he said, so there were no fingerprints. He hadn't personally programmed the card, even if it was his decoder the Canadians used to do it. And even if there was a print or a DNA trace of some kind, there was no continuity of evidence to say it was the card that Alex's decoder had programmed.

Adams was continually emailing Hasak in Jerusalem. It wasn't even a criminal offence to re-program cards in Canada, he said. A good lawyer should get him off. Adams argued with the desperate eloquence that graces a man who is fighting not just for his agent, but for his own job. This was a tricky situation that required managing, he said magisterially. Of course it seemed completely clear that this whole mess was the fault not of Adams, but of his colleague John Norris, who had alerted them to the airports alert that Rissler had put out.

'I am well ware of these provisions and know better than anyone their strengths and weakness,' Adams emailed furiously. 'A stop and detain alert is really a pathetic provision. It means that we have no evidence against this person ONLY suspicion so please stop him and if he has anything with him detain him and let us know.'

The arguments went back and forth as they struggled with the logistics of getting Alex out of North America. It would have to be from an airport with low security, and not a direct flight to Germany. From Jerusalem, Hasak hosed Adams and Norris down when the infighting grew too ugly. In Norris's view, this operation to make contact with pirates had been Adams' bright idea, riding roughshod over the North American operations. Now the blame was all Adams'. Norris had always been contemptuous of Rissler at DirecTV. 'He's a nice idiot,' Norris had told Oliver before the operation. When he was really snitty, Norris called Rissler a speechwriter. But the worm had turned.

'The only possible evidence that could ever have existed to connect Alex to the card was what was on his PC,' Adams later wrote to Hasak, reviewing the episode. Adams had Oliver/Alex reformat the drive and then disassemble the laptop into two parts, each of which was posted by two different courier companies to two different addresses in Germany. But Oliver still had to walk through those airport gates.

'Alex had absolutely nothing with him,' Adams assured Hasak later. 'I even disobeyed your advice that he could walk through with his laptop. He did not even have a credit card with him. There would have been absolutely no legitimate grounds for detaining him for a second. Had anyone done so, there was a lawyer ready to get him out of trouble.'

Oliver did not even have a credit card and Adams had two lawyers on standby ready to get him out of trouble. 'There would have been absolutely no legitimate grounds for detaining him for a second. . . Nothing existed technically to connect Alex to the card in either Canada, the USA or Germany.'

So Oliver was home safe. That was the end of it, everyone walked away clean . . . except that Larry Rissler was seething. He knew someone had tipped Oliver off and his list of suspects was very short. He fronted Norris, who denied any link to Oliver. In reality, Norris had made sure he didn't even know Oliver's real name - he was just Alex. Rissler accused Norris of hiding the fact that Oliver worked for NDS. Rissler's chief source in the pirate community claimed to have proof that Oliver worked for NDS and his accusations became more and more insistent. Norris lied straight-faced to him, told him that Oliver had no connection at all with NDS that he knew of.

The row was escalating to the point where the future of the NDS contract with DirecTV could be at stake—and that would mean the future of NDS itself. Five days after Oliver flew out, the pressure grew too much. The Cowboy blinked. Norris told Rissler that he was right - Oliver was one of their people.

Adams was incandescent. 'We discussed this,' he raged, that 'under no circumstances must we tell Larry Rissler that Alex works for us. It was an absolute priority. That decision was made and we all acted on it…Despite whatever table thumping Larry Rissler may indulge in I knew that there was absolutely nothing that LR could do about Alex . . . My frustration is that we went to great lengths to protect Alex and then give away our greatest secret to someone we do not trust.'

That was the problem. It was DirecTV that wasn't trustworthy. It had come to this. A hacker on News Corporation's payroll was on the run from police in two countries. He virtually had to be smuggled out of the United States. If he had been caught, the repercussions for NDS, for News Corporation and for Rupert Murdoch in the glare of publicity were potentially disastrous. The first question would be how News Corporation came to be involved in what looked like criminal piracy directed against NDS's biggest client, DirecTV. Whatever their ultimate intentions, in order to mount this sting operation NDS had been pirating DirecTV—peddling software codes and stealing the signal from their best customer, without even telling them.

None of this troubled Ray Adams in October 1997 as he struggled with a much simpler issue. Why—why—had Norris come clean? It was so simple. 'All we had to do was stick to our story and deny.'

It would become a familiar legal strategy: Deny, deny, deny . . .

But now Alex/Oliver was home safe. That was the end of it, everyone walked away clean . . . except that there was an enduring problem. The question was: what part of News Corporation should have been alerted to what was going on? What part of a modern media business involves hiding people from the police and working out the best way to smuggle them out of the country, betraying the confidence of the customers whom they were paid to protect? And how was it that none of these players were ever called to account?

And the most troubling thing was that this was just the beginning, the first desperate adventure. The drama that followed would trigger four separate major court actions against NDS, in which almost every major satellite broadcaster in the world sued the News Corp arm for billions of dollars in damages from industrial espionage. And yet, in the end, NDS would prove staggeringly profitable for Rupert Murdoch's empire.

The stakes here were very high and the casualties would not just be on the balance sheet. Twelve months later, Alex's offsider in Germany would be dead, and Alex himself would be hiring bodyguards.

Adelaide, October 1997

A little disclosure here. To write about News Corporation means spending a lot of time talking to lawyers. When I was writing Virtual Murdoch in 2001 I received legal threats from half a dozen law firms around the world. It was educational in highlighting the different national legal styles.

Australian lawyers, in my experience, have not distinguished themselves by their tremendous sense of humour - at times they can be a little snippy. American lawyers don't bother with small threats. They have it down to a routine: they press the button and launch an intercontinental ballistic missile, perhaps in their spare moments between elevenses and the next client meeting. When I wrote in 1999, seeking information from Squadron Ellenoff Plesent & Sheinfeld, the New York firm that had represented News since the 1970s, their reply came from Ira Lee Sorkin. These days Ira is better known for his sterling work over the last two decades as Bernie Madoff's lawyer. Ira duly dropped a thermonuclear device on my head, but I could tell he had more important things to do. His response was so impersonal, and I think it lost something from that. But when it comes to causing pain and discomfort—in short when you want a lawyer to club your target somewhere soft and vulnerable with a large pointy stick—it's hard to go past the British. It's that old-world charm.

But law firms are just the side show. For decades the man who manned News Corp's front line of defence, as chief legal counsel (now Rupert Murdoch's personal advisor), was Arthur Siskind. Arthur and I have never really hit it off. One of the first times I met him was in October 1997, the month that Alex had his little imbroglio in Toronto. I was on the opposite side of the world, in South Australia, when Arthur threw me out of the News Corp annual meeting. Actually it was the morning tea for shareholders afterwards. And he was pretty polite about it, which really shows he was a model of restraint.

The annual meeting was a showcase for what the global media empire was doing: from the newspapers in Australia and the fledgling pay-tv operation Foxtel there; to Star TV, the satellite broadcaster that covered all of India and Asia from its base in Hong Kong; to BSkyB in Britain along with the Sun, News of the World and The Times and Sunday Times. Then there were the big bets that Murdoch had recently made on cable channels in the US—Fox Sports, and a maverick operation called Fox News that Roger Ailes hand launched just a year before, at a cost of $1 billion. Would it really work? And the Fox television network and stations, together with Twentieth Century Fox. The meeting ended with a breathtaking trailer for a film that James Cameron had directed, which was due to launch in two months time, called Titanic.

Annual meetings are a nightmare for Rupert Murdoch's minders. Back in the US he can handle any number of public outings without making a ripple, but in Australia he has a gift for unhappy headlines. He had just told shareholders what a bad idea the current push for tighter privacy laws were. Really, who needs them, when newspapers were so good at self policing? 'Privacy laws are for the protection of the people who are already privileged and not for the ordinary man or woman,' he told reporters at the press conference after the meeting. After the recent death of Prince Diana, he continued, 'I think you'll see a great deal more restraint by all the newspapers in Britain and I think you will see a stronger and better-policed code of ethics.' That restraint would mean paying less money for paparazzi photographs. 'Princess Diana, whom we all had great respect for, generally worked with photographers to her satisfaction . . . I think newspapers paid far too much for them and there'll be a major cost saving if we can bring this thing through.'

Up to then, no one had thought to turn Diana's death into a budget line item. Murdoch also offered a small rebuke to questions from the Sydney Morning Herald as 'part of the consistent and nagging denigration of News Corporation that goes on in your newspaper day after day, orchestrated by friends of another organisation . . . but I won't go any further than that'. That was the Australian public broadcaster, the ABC, that Murdoch was being arch about. It's important when you're kicking your rivals to keep a light touch.

Back then the NDS story was just beginning. But working out what happened next at NDS would prove a long, frustrating trail. The first part of that would be understanding the people and events that had led up to Oliver's close call in Toronto in 1997. The question that would recur for me time and again was: who dropped the ball? Who was overseeing the dramas that played out at NDS? And who at some point should have told the NDS black-hat operations that what they were doing was a really bad idea? NDS reported to the Office of the Chairman at News Corporation. NDS execs reported to Rupert Murdoch's closest people. Arthur Siskind and News Corp's chief financial officer David DeVoe sat on the NDS board, as did James and Lachlan Murdoch and Chase Carey, who was by then co-COO of News Corp. How much of all this, if any, made it into NDS's reports to its board, is not known.

At the time I knew nothing of the adventure in Toronto. In hindsight it's tempting to link it in the same time frame as the annual meeting in Adelaide and getting thrown out of the morning tea, as some sort of indication that senior management's attention was focused elsewhere and no one was minding the store. But that doesn't really work, because the annual meeting was in early October, a fortnight before Oliver's great escape. On October 24 1997 the record shows that Rupert Murdoch was in Beijing for a meeting in the Great Hall of the People with Ding Guangen, the head of the Chinese government's Propaganda Department.

Actually that was later in the day. Earlier in the morning, around the time that Alex was desperately working his way through Toronto's seedier hotels on the other side of the world, Murdoch had taken time off for a little sightseeing and to buy some ties in Xiushui Market, or Silk Street. He had dispensed for the morning with the services of local exec Bruce Dover. Instead he was accompanied by a vivacious young Chinese executive from Star TV, acting as his interpreter for the first time, called Wendi Deng.

Murdoch's Pirates, by Neil Chenoweth, is published by Allen & Unwin, $45.