The transcripts of the official inquiry into the culture, practices and ethics of the press. More…

  • MR KEITH SURTEES (sworn).

  • Mr Surtees, your full name for the Inquiry.

  • My name is Keith Surtees.

  • Thank you. I hope you're going to be able to find easily a bundle with witness statements, and under tab 5 of that bundle you'll see a statement which you gave in the judicial review proceedings on 30 September 2011.

  • You've signed that statement under a standard statement of truth. You are in the current rank of Detective Chief Superintendent; is that right?

  • That's correct, yes, sir.

  • Back in 2006, when you joined SO13, you were Detective Chief Inspector; is that right?

  • And you became the investigating officer of Operation Caryatid on 18 April 2006, following a request, you say, which came from Detective Superintendent Williams. This is paragraph 7 of your statement. Just so we have it in a nutshell, the difference between the responsibilities of a senior investigating officer and an investigating officer?

  • Senior investigating officer essentially sets out the strategy of an investigation, makes sure the resource requirement, et cetera, is met. The investigating officer carries out that strategy, turns that into tactics, if you like, and delivers those tactics to deliver the strategy which has been set by the senior investigating officer.

  • Thank you. At the same time you were performing the role of senior investigating officer for numerous priority terrorist investigations which were within SO13 at this very busy time. Is that correct?

  • Yes, that's correct. My primary role was as a senior investigating officer with a counter terrorism command or anti-terrorist branch as it was then known.

  • You have to be a bit slower, Mr Surtees, because otherwise we don't pick it up.

  • Now, we're not going to cover all the points made in this statement, we're just going to alight on some key points, because we've had a lot of the evidence already from Mr Williams. But paragraph 14, please:

    "The only way to establish whether illegal access to voice messages was taking place was to obtain the incoming telephone data to the voicemail of the complainants, in other words a list of telephone numbers ringing into the voicemails of the victims."

    You say the way you went about doing that was to obtain account information under part 1 of RIPA, in relation to Mr Goodman's telephone. Is that correct?

  • Yes, that's correct. Mr Goodman became a suspect of this investigation pretty early in terms of the investigation, and I did obtain through RIPA legislation access to the call data, the outgoing call data of Mr Goodman's telephone to ascertain who he was calling at that particular time.

  • So it goes without saying that these data would correlate with the phone numbers of the voicemails of your main victims, who at that stage were JLP and HA; is that correct?

  • That's precisely what I was looking for, yes.

  • Put succinctly, was this a straightforward or difficult exercise?

  • Straightforward exercise in so much it did take some time to do. The paperwork isn't one piece of paper, it's a number of documents that need to be put together. It's an assessment that a superintendent would then do, forward it through. So it's a laborious process. In terms of the difficulty of the task, not particularly difficult. It needs to be proportionate and necessary, and we need to account for the fact that we're intruding into somebody's privacy, essentially.

  • If we move forward in time so that we can understand this theme, post 8 August, where you have a list of victims whose phones had been potentially compromised, could you not carry out the same exercise in relation to a limited number of those victims to see who else may have been calling into their voicemails?

  • Had you done so, would that or might that have revealed whether other journalists were concerned?

  • Potentially, yes, eventually.

  • Why eventually? Why not presumably straightforwardly?

  • If I work through the process of a victim first, what I would see is a multitude of data coming in to a victim of crime. So I'd see thousands of lines of data. If I do it the other way, ie I have a suspect in the form of Goodman or Mulcaire, I have what we call and what we termed within this investigation rogue telephone numbers. I have something to pinpoint. That rogue telephone number going into a victim precisely is easier to locate than simply looking at thousands of lines of data from a victim of incoming telephone calls and then potentially translating each one of those individual lines of data into a separate RIPA request to see who those particular lines of data belong to. Virtually impossible to do, I would suggest, under those circumstances.

    The way to do it is when you have a suspect in mind and you're looking at that suspect, to see whether that suspect particularly is accessing the voicemails or DDNs of particular victims.

  • I'm going to just understand that, Mr Surtees. Imagine that you have one of our 418 victims and you have the unique voicemail number. Why don't you simply ascertain who is calling into that number? Are we agreed?

  • In terms of rogue telephone numbers, and in the case of Goodman and Mulcaire I had some rogue telephone numbers. Easy to do to see whether those telephone numbers have gone into any of those victims, accepted. In terms of anybody else, impossible to do unless you identify particular rogue telephone numbers you're looking for.

  • I'm not sure that it's quite so difficult, Mr Surtees. You take one of the victims. You have a series of -- you might see a series of potentially rogue numbers. Why don't you go and speak to the victim, who will say, "I can tell you that these numbers are legitimate numbers" --

  • -- "but I simply don't know who these other numbers are", so why don't you just focus on those other numbers?

  • Possibly a way to do it, yes.

  • It's quite simple, isn't it?

  • It would be possible to hand over the data to those people who hold that telephone and say "Do you recognise any of these numbers?"

  • Or to ask this question: "Do you ever access your voicemail remotely?" Because I would have thought most people would say no.

  • On the telephone bills of the victims we're actually talking about, the fact that the voicemails had been activated or accessed doesn't feature on those telephone bills. You don't receive a telephone bill that actually shows the fact that your voicemail has been activated.

  • No, I think you misunderstand my suggestion and I think I have it right. If you ask somebody, "Do you ever access your voicemail remotely from another phone?", answer, "No", they don't need to know the numbers that have actually tried to do that, they don't need to know the fact that that's happened. You know that because you can get that information from their phone companies, can't you?

  • From the phone companies, going back to a victim, I can get the incoming call data into a victim's telephone, yes.

  • Yes, that's the point. So I'm right, am I?

  • If I were to simply randomly pick a victim, you or anybody else, for instance, and simply look at that data of incoming call data, I'd see lots of lines of information. What I wouldn't see and identify really quickly is the fact that amongst that myriad of lines of data, ie telephone numbers, I would be able to pick out suspicious activity from those lines of data. I simply wouldn't be able to do that. What I would be able to do in terms of Mulcaire and Goodman, for instance, because I know those telephone numbers, I'd be able to pick those out.

  • I understand that. My point was that the data would tell you which incoming calls were remote access to voicemail. Is that right?

  • No. Only the vampire data tells us that. The incoming call -- the vampire data shows us details of calls into voicemails.

  • The telephone companies don't -- the whole sort of problem at the beginning of our investigation was the fact that the telephone companies keep data information on the basis of what they can charge customers for. That's what they keep their data for. They can't and don't charge for this issue of access into voicemails. So it isn't as straightforward as simply looking at somebody's telephone bill or at incoming call data.

  • No, no, I wasn't suggesting you would look at their bill. I was wondering what the telephone companies could do. Anyway, I've asked the question.

  • Of course you already had data which referred to the News of the World hub phone, didn't you?

  • And in those cases you didn't know whether or not that was Mr Goodman within the News of the World, or some other journalist within the News of the World; is that right?

  • It's a hub telephone number attributed at that particular point to nobody.

  • As soon as you were outside that which was of interest to a royal correspondent, you were beginning to suspect that it wasn't Mr Goodman but some other journalist, weren't you?

  • Sorry, in terms of whether it spanned outside of the royal issues?

  • We'll come back to that. In paragraph 18 you identify the total of nine rogue numbers being used by your two suspects, who at that stage were Goodman and Mulcaire.

    Can I ask you about paragraph 24, where you're referring to the serious threat to life presented by terrorist threats. To what extent did those considerations impede the investigation before 8 August 2006?

  • They were in my mind throughout the time between April and the August period you mention inasmuch as in the first instance I was a senior investigating officer responsible for a number of those investigations. I think the term -- I think the number of 50 plus investigations at the beginning of this investigation moving through to somewhere close to 73 by the end of December 2006 I was absolutely cognisant of because as a senior investigating officer I was responsible for a number of those investigations during that period, and whilst undertaking those duties, I was also in and out of the country where those investigations took me.

    So in terms of my responsibilities as a senior investigating officer for terrorist investigations along with this investigation, this was part of my workload if you like as well as other terrorist investigations at that time.

  • Was the position this: at the time Goodman and Mulcaire were arrested on 8 August, you had all the evidence in place which you believed to be necessary to effect those arrests; is that right?

  • And that was notwithstanding all the other pressures you were under, is that also right?

  • Can I move forward, please? You explain the position, paragraphs 29 to 31, in relation to unifying the individual rogue numbers of Goodman and Mulcaire with your victims. In your own words, what did you need to do pursuant to that exercise to obtain evidence which in your view would satisfy the criminal standard of proof?

  • What I needed to show was the fact that in the case of Goodman and latterly Mulcaire they were in possession of some telephones, and from those telephones they were ringing up our victims, they were ringing up the unique voicemails or the direct telephone numbers, simple as that.

    Now, we undertook a process through I think May, June time which is the experimental process, if you like, to try to prove the sequencing of a voicemail message being left, a voicemail message being accessed by a rogue telephone number before it was opened by the intended recipient and who actually did that at the time.

    So the process we went through was obviously with Jamie Lowther-Pinkerton and Helen Asprey, and this was a test period of a number of weeks, to actually prove that sequencing, in terms of proving the unopened envelope, if you like.

    In terms of the process, the process we needed to do was to prove potentially that in the case of Goodman the home telephone number of Goodman was in Clive Goodman's hand at the time. It wasn't in Mrs Goodman's hand or it wasn't in Mr Smith's hand, who may well have happened to be at Mr Goodman's house at the time, because those are always the issues that I as an investigator would clearly look at, because through experience there was --

  • Through an abundance of caution. This is lines of defence some people raise, is it?

  • Yes, but you put together a circumstantial case which blows away the suggestion that this telephone was suddenly used by a guy who said, "Can I borrow your phone?" in the pub.

  • Absolutely right, yes. Yes.

  • I think, if I can cut to the quick, there are possibly two stages. In order to prove an interception of a voicemail, you have to prove that the phone number has been accessed for or been rung for sufficient period of time that the voicemail itself is being accessed. That's about 9 or 10 seconds, is that correct?

  • We took some advice with regard to this and Mr Bristow supplied some of that advice, as did the Crown Prosecution Service, who we spoke to throughout the investigation. To potentially prove the existence of a voicemail in the first instance, clearly we would need to say there was a voicemail in there. Secondly, to prove potentially the fact that somebody had gone into that voicemail and listened to it, actually opened the envelope, if you like, and listened to it, the expert was saying to us this was probably between the 10 to 14 seconds, and that simply was based on the fact that when you or I listen to our voicemail messages --

  • It takes that long to get in?

  • We get a blurb before that, before we actually listen to what I've actually tried to listen to in the first instance. That's just 10 to 14 seconds.

  • I think we can agree, Mr Surtees, that you have to get to those 10 to 14 seconds before an offence is committed, but as soon as you go beyond the 10 to 14 seconds, the inference is that someone is listening to a voicemail rather than there being nothing in the mailbox. Would you agree?

  • Then there's the second point, which is the technical legal argument which we've already looked at, as to whether it's necessary to prove that the listening is occurring before the intended recipient is accessing, and that is something that you pursued along with Mr Bristow, who was your expert adviser; is that right?

  • Yes. Throughout the investigation, even up to August, September time, that advice remained the same from the Crown Prosecution Service.

  • I've asked this question of Mr Williams, but I'll ask it of you. That's true of the direct offence under section 1 of RIPA, but for a conspiracy offence under the Criminal Law Act you wouldn't have to prove that, would you?

  • I don't think so. I think what we'd need to prove is some guilty mind and a guilty act.

  • Overt act to prove the substantive agreement, and if somebody's got hold of the PIN number of an owner of a voicemail, mobile telephone, then that's not an overt act.

  • There are various things I would rely on as an investigator to evidentially put to a suspect in that type of instance. I guess very straightforwardly I would need to prove that either somebody who was receiving information or instructing others to carry out activity on their behalf either knew when they received that information or gave that instruction what they were participating in was an illegal offence.

  • Thank you. Move forward to paragraph 35 of your statement which on the internal numbering is page 16. It starts at 04170. I'm not quite sure where paragraph 35 is going to be precisely, but I hope we'll be able to put it on the screen. 4185? It's the identification of customers who were outside the purview of the royal household. It's Mr Clifford and HJK. This was in May of 2006. At that point did you begin to suspect that these activities may be going beyond Mr Goodman?

  • I don't precisely know the timing of this. We were informed through our contacts within O2 and Vodafone of some potential -- or some suspicious activity with a guy who was ringing into O2 using the name Paul Williams and attempting to change PIN numbers. This was recordings that O2 had had to their various customer service centres that they thought was suspicious activity and that came about as a result of the conversations and the contacts that I and others within the investigation team were having with them at that point.

    I don't know precisely -- it will be in the documentation -- when I was informed of the Paul Williams position, but here we have an expansion, if you like, beyond the royal household. I was cognisant to the fact that we have a royal editor from the News of the World.

  • Can you ask you this, Mr Surtees: did anybody carry out a study, if that's the right word, of the sort of pieces Mr Goodman was writing in the News of the World?

  • There was at a very early stage before I joined this investigation by Phil Williams, which I think started part of the investigation off, which was looking at some of the document -- or some of the stories that had been produced by Clive Goodman in the News of the World.

  • Can I ask you to look at a briefing note which I think was probably for DAC Clarke's eyes. At tab 59 of the first file, which is 03028 -- you will have the first file. This is a briefing note that you prepared.

  • Tab 59. Because Mr Williams was away. By this point, you'd ascertained that Mr Williams and Mr Mulcaire were the same person. At the bottom of the page, various checks in the investigations are recommended, going to be carried out in relation to Mr Mulcaire. The inference you draw as to the conspiracy between Goodman and Mulcaire is the top of the next page, is that right, Mr Surtees?

  • And then other victims, Mr Clifford and HJK are mentioned. You say:

    "This investigation was undertaken by the ATB for the reasons outlined within this decision log. The physical risks to the Royal Family cannot be underestimated and as such anything other than a CT ..." that's obviously counter terrorist?

  • "... investigation into the unlawful access would be unwise. The wider issue, however, is somewhat different, as the potential terrorist risk to private citizens does not fall into the counter terrorist portfolio. That does not mean that it shouldn't be investigated because each unlawful interception is a serious offence. I have briefed DAC Clarke and others into the widening aspect of this investigation with a suggestion that another investigative team should take the wider investigation. I await a response on this issue."

    Well, it goes without saying that your suggestion was rejected; is that right?

  • What reasons were given to you?

  • The parameters of the investigation were set by Mr Clarke at a very early stage. I was clear on those parameters and clearly pursued those parameters in the way in which I conducted this investigation.

    The issue of other victims coming into this investigation and the potential widening of it, looking back at "the potential terrorist risk to private citizens does not fall into the counter terrorist portfolio", clearly it does. I think what I was trying to get at here was here we have a switch in issues going on. The location potentially of senior members or junior members of the Royal Family is clearly a national issue in terms of national security, therefore it quite rightly fits within the confines of the anti-terrorist branch CT investigation. The tittle-tattle issue of other particular members of the public would potential fall out of the remit of the anti-terrorist branch and that's what I'm getting at there.

    I've suggested that at that particular point simply because we have a widening of the investigation at that point with the inclusion of Clifford, HJK, and I've had those discussions, and in terms of that, the suggestion I made, I think on 31 May that is dated?

  • Has been considered and a decision has been made not to accept that at that point.

  • It might be said it's a bit difficult to disentangle the narrow investigation into the royal household and any wider investigation that if there is going to be a wider investigation, it should be kept in the same place, as it were, rather than have two investigations going on concurrently. Is that a fair observation or not?

  • Yes, it's a fair observation, I accept that.

  • There might be a reason why it was kept within SO13.

  • We can ask Mr Clarke tomorrow.

  • Can I ask you to look forward to tab 79.

  • We're just passing tab 60. It doesn't matter, but it does say:

    "Itemised billing on the suspect numbers would show calls into the relevant retrieval number including dates, times and durations."

    All right, tab what?

  • Tab 77 first, which is 03104. You have a cabinet minister whose phone has been accessed, and what you're saying here is this is a reason for accelerating what you call executive action, namely arresting Goodman and Mulcaire; is that right?

  • Yes. I think I refer back in my decision log around this challenge, if you like, between extending this investigation and prolonging the investigation to include the widening aspects of it, and I talk about the actual challenge that that presents to the investigation inasmuch as it would continue to expose potential victims to continued interception.

    My primary concern at that particular point is the continued exposure of both Royal Family, cabinet ministers, because of the national security implications of that, and the fact that we now have, as well as the Royal Family -- and I appreciate the vast majority of the Royal Family issues or access is servicing news stories -- the fact that we now have a cabinet minister causes me more concern with regard to this national security aspect. I need to be able to stop this. Because if I allow this to continue for a number of weeks whilst trying to widen any investigation, I continue the exposure potentially to cabinet ministers and others.

  • So to be clear, Mr Surtees, the widening of the investigation would obviously have embraced widening the victim pool, but might also have embraced widening the group of conspirators, but your primary concern was to move this to a conclusion to halt the exposure of individuals in high office to voicemail interception. Do I have it right?

  • Yes, you have, and I think there are two separate issues in terms of widening it in terms of a victim pool and widening it in terms of a suspect pool. The widening in terms of a victim pool, we would have a point at which, in terms of two defendants going before the court, we have a point at which we saturate, if you like, an indictment against them. Whether that's 100 victims within a pool that have been targeted by two suspects or whether it's in the instance seven or eight, which I think is how the indictment ended up, really matters little. I think, in terms of widening the suspect pool, that is a protracted piece of work, because we'd have to go through the whole process again of trying to identify, et cetera.

  • Thank you. To move the story forward, I'm not hoping to duplicate evidence we've already heard, but just one piece of evidence which we haven't yet heard. At tab 81, 03109, this is seven pages within that tab, there's an email from the CPS copied in to you on 7 August 2006 on the internal numbering at page 200. It refers to a meeting, or rather speaking to counsel. You believe that was leading counsel; is that right?

  • Four lines down:

    "The meeting was very useful. We concluded that in essence the alleged criminal activity alleged against the suspect does give rise to the offences I have outlined. We have briefly discussed before the possibility of arguing that what we have termed our Computer Misuse Act offences might fall to be considered as RIPA offences but the issue had not definitively been argued."

    Is that a reference to bringing this matter within RIPA or to the technical argument about the timing of the interception?

  • The latter, the technical argument about the opening.

  • It's the same point.

  • Because it brings it into RIPA -- if you have to open the envelope, that's only for RIPA purposes, it's not for the Computer Misuse Act purposes.

  • Because the Computer Misuse Act would be infringed even --

  • In any event. The CPS continues:

    "I was reticent about arguing the point in this case. However, having considered the matter with counsel, we have concluded that we could properly argue the point, and in any event nothing would be lost as we already have the four main clear RIPA offences (if not more I hear!)"

    Do you know what that's a reference to?

  • I don't. I can suspect it's because of the ongoing material that has been supplied to us by the telephone companies through August, September, October, et cetera.

  • So that might have been a reference to the possibility, at least, of additional co-conspirators; is that correct?

  • I think it's more with regard to the fact that we've got more information/evidence coming from the telephone companies to talk about access to DDNs and the sequencing which we're concentrating on as opposed to more suspects.

  • I move forward to tab 83, which is 03121, which again I think is your document; is that right?

  • It is the search strategy.

  • We see that strategy explained at the bottom of the first page:

    "There's an issue with the searching of Clive Goodman's office desk area within News International and that a section 8 warrant excludes the application of said warrant if it's likely that journalistic material would be found during the search. I have decided that a section 8 warrant will be sought to allow entry and search of the finance office within News International that would hold details of documents relating to payments by News Corporation International to Glenn Mulcaire. We do not seek nor do I anticipate finding journalistic material during this search.

    "Whilst I accept the entire finance and resource department of News International is likely to be outsourced and not located within Virginia Street, there must be an accountancy financial clearing house within the building that would receive correspondence."

    So what you were doing there was in order to avoid difficulties with journalistic material, focus the search on non-journalistic material; is that correct?

  • In the first instance I've set a very comprehensive search strategy. I think over 13 premises and vehicles were searched as a result of the search strategy I set prior to August 8. The second part specifically deals with the challenges around searching of News International. If we refer back to 82, which is the document from Carmen Dowd, I think from memory she actually talks about the search legislation.

    Whilst I'm producing my search strategy, clearly I'm aware of the limitations of the Police and Criminal Evidence Act with regard to what we can search for and where we're likely to find either journalistic or other protected material. Section 8 specifically precludes actually applying for the section 8 warrant where we're likely to find journalistic material within that search.

    RIPA, the offences for which we were investigating, does not carry a power of search. Thereafter, my only route left beyond section 8 is section 18, section 18(2) and (5). The reason I sought advice is because clearly I wanted the view of the Crown Prosecution Service for this. I wanted very much to get into News International, because I wanted to search the desk, I wanted to search the financial areas, I wanted to find evidence around who was involved in this illegal activity.

    The advice given back was that section 8 was very difficult and it was unlikely to succeed and we may well be breaching at that point where we were likely to find journalistic material. I saw that advice and I justified obtaining the section 8 warrant on the basis of what I put into my decision log on the basis that I thought I'm likely to find not journalistic material in the areas that I'm going to search; I'm going to find financial material.

    So despite suggestions that it would be difficult under section 8 and potentially not possible, I thought there was a way for us to do that and I sought that route and obtained the section 8 warrant.

  • In the event, owing to what happened on the day, is this right, the search was limited to the desk only and did not cover that which was the subject of the warrant as set out in tab 83; is that correct?

  • There was some real difficulty in conducting the search at News International. There were I think four of my officers who actually got into the premises before News International barred the rest of my officers from going into News International. We got to the desk of Goodman, we seized some material from the desk of Goodman. There was a safe on his desk, which was unopened. My officers were confronted with photographers, who were summonsed from other parts of News International, and they were taking photographs of the officers. A number of night or news editors challenged the officers around the illegality of their entry into News International. They were asked to go to a conference room until lawyers could arrive to challenge the illegality of the section 18(1) and 18(5) and section 8 PACE authorities, and it was described to me as a tense stand-off by the officer leading that search.

    The officer tried to get our forensic management team, our search officers into the building. They were refused entry, they were left outside. Our officers were effectively surrounded and photographed and not assisted in any way, shape or form. That search was curtailed. Some items were taken. The search did not go to the extent I wanted it to.

  • I've been asked to make this clear on behalf of News International, that insofar as you look at paragraph 47 of your statement, Mr Surtees, the fourth line, you can see this, that Detective Inspector Pearce was concerned at the time that News of the World staff may offer some form of violence against the small police team in the building, that the clear position of News International and indeed their lawyer is there was no question of any threat of physical violence. Would you accept that?

  • Very difficult, on the basis that I wasn't there, I was simply speaking to my officers at the scene. It's very difficult for me to take a view either way. The information that was relayed to me is in my statement.

  • Okay. It's clear from the --

  • Whether or not you were entitled to do all you sought, if you had a warrant to do certain things, to do certain of what you sought, you were entitled to do it.

  • No. Section 19 of PACE, of course, allows us to seize any evidence whilst we're legally on premises that we think is pertinent to any criminal activity.

  • Was any thought given to returning on another day with a larger team of officers and properly executing the warrant?

  • I think the moment had been lost with regard to the information we sought. It, I think, had gone, quite frankly.

  • Implicit in that answer, Mr Surtees, is that News International might have hidden or destroyed incriminating information. Is that what you're suggesting?

  • Which is obviously a point which cuts both ways, because it would -- well, it goes without saying that it would increase -- if you had that level of suspicion about News International, that level of suspicion might take you into suspicion that others in News International were involved in this conspiracy. Do you see that?

  • Can I ask you about the compilation of tab 94, which is the list of those potentially compromised. We may understand some more about it if you look at tab 93. 03171, which again is your document, isn't it, Mr Surtees:

    "Having reviewed the material seized at the address searches it is clear that there is a wealth of sensitive documents relating to hundreds of individuals, including royal household, Members of Parliament, sports stars, military, police, celebrities and journalists."

    Can I ask you this: did you personally conduct any review of the material?

  • I saw the Blue Book in its various stages of completion, so yes.

  • Did you see any pages of the Mulcaire notebook?

  • I don't recall seeing any pages of the Mulcaire notebook.

  • At some later stage -- this is after 8 or 9 August 2006 -- did you have occasion to look at the Mulcaire notebook?

  • I don't know whether I did or I didn't. I can't recall.

  • When if at all did you become aware of first names, the corner names, the top left-hand side of relevant pages of the notebook?

  • I think in terms of notebook, I'm not familiar with a notebook. What actually was recovered was quite a lot of loose A4 pieces of paper, and I describe them in this decision log as research in various forms of completion, and they ranged from simply first names all the way through to first names, surnames, account numbers, addresses, DDNs, telephone numbers, et cetera, et cetera.

    So I don't recognise a notebook, because I don't recall actually finding one or seeing one. I do recall lots of loose-leaf A4 pieces of paper, as I've said, with various stages of research on, and I think I refer to that within this decision. I see that through the process of -- I think it's probably from August 9, 10, onwards. I firstly negotiate a group of officers, I think somewhere in the region of 20 or 30 officers, who I negotiate because they're not anti-terrorist branch officers because they're all busy doing Operation Overt and everything else. They're Special Branch officers, they're vetted to the highest level, and it's those officers, I negotiate their overtime, because they're working through weekends when they should be off, and they work through I think for a period of five to seven days to go through all of the documentation, and with that they're briefed by me at the beginning around what I want them to do with that in the first instance, which is to ascertain whether there's anything to undermine or assist the police case with regard to Goodman and Mulcaire, because by then we've charged both Goodman and Mulcaire and my obligations under CPIA kick in.

    Is there anything to undermine or assist? Is there any evidence around any other people on these documents? They're given that brief and they work through that for the next five to seven days, and that's what makes this document which is now known and referred to as the Blue Book. That is added to days and weeks later with various bits of information that is supplied by the telephone companies as well.

  • Is the version we see under tab 94 the final iteration of the Blue Book, with the 418 names or 419 names?

  • I'm pretty sure it is.

  • Can I ask you one point on this decision log because you've accurately summarised a lot of what is contained in the book. Look at the second page, level with the upper hole punch:

    "To establish the full picture as to whether individuals have been intercepted or the amount of times they have been intercepted all of the airtime providers will need to search their databases to give us those details."

    Could you explain what that was a reference to?

  • Yes, and this comes back to an earlier conversation where I was explaining perhaps very badly the process that we had to go through to establish that evidence. To establish a full picture as to whether individuals have been intercepted and the amount of times, the airtime providers would need to go through their databases.

    What I have is I have the DDNs now of some people. I have the DDNs on these documents and I need the airtime providers to tell me whether some rogue numbers or any other numbers have accessed that, and this is what I was trying to explain right at the beginning. Here I have just what I was talking about. I have a start point, if you like: telephone companies, can you tell me whether anybody's accessed these DDNs, please?

  • Was this something that you were intending to do at the time this decision log was completed?

  • Yes. But indeed through the days and weeks following this that was done in various guises, because as I said where you see the numbers in this Blue Book on the right-hand side in the columns to the right, those numbers, if you like, have been added as a result of that action.

    So where you see sort of randomly 1, 9, 11, 4, 5, that is where the telephone companies have supplied the information I was talking about.

  • So if, for example, we look -- this is the third column from the right in the Blue Book, is it?

  • No, it's the two columns that are on the right. It's the far right column and the one in from the far right column. So the first time you see a number appearing is number 9 on page 2.

  • So what is that 9 a reference to, Mr Surtees?

  • That is the telephone company is telling us that somebody had gone into the DDN of that particular person nine times.

  • This is the footballer, nine times?

  • But it's not telling us from which phone number that person is calling into nine times?

  • The top of the book, if you go back to page 1 of the book, look at the very badly copied tab at the top.

  • I think from memory that is likely to say either Goodman or Mulcaire in terms of those accesses. So that's telling me either Goodman or Mulcaire has done that nine times.

  • Is this right, the enquiry did not go beyond Goodman or Mulcaire?

  • As I explained right at the beginning, it's very difficult because I didn't have telephone numbers to actually start point at.

  • Okay, so the picture was being built up with reference to the rogue numbers you knew, namely the nine rogue numbers we've referred to earlier, but it wasn't being built up with reference to any other rogue numbers?

  • Is that right? Although you did know in relation to some, if not many, of these victims that people were phoning in from the News of the World hub number; is that correct?

  • I know the News of the World hub number was ringing into DDNs in treble figures, ie hundreds of times, yes.

  • And that was in relation to people who were not, as it were, in Mr Goodman's natural habitat, namely the Royal Family and those associated with it; is that correct?

  • Okay. So is this right, that that sort of information was fuelling your suspicions that others outside Goodman at News International may well be involved in this conspiracy?

  • Can I just understand your analysis of -- I call it a notebook, it isn't a notebook, it's the sheets of paper which is the 11,000 pages. Did this to you create a picture of a consistent trade craft, namely someone who was building up the means unlawfully to access voicemails? In some cases he'd got to last base and had acquired means, but in other cases he had only acquired some of the means to access voicemails?

  • Yes, and I think I phrase that in my decision log:

    "It is clear from the documents recovered from the searches conducted that Mulcaire has been engaged in a sustained (years) period of research on behalf of News International. This assumption is based on the fact that News International have for a number of years paid substantial cash payments to his bank accounts."

    And then I go in to talk about the various states of some of those documents and the varying stages of the research that I think they're in.

  • Thank you. In relation to these substantial cash payments, were they limited to £12,300?

  • What sort of figure were we talking?

  • I think from memory he was on a wage of £100,000 plus per year, and I saw a number of other invoices, if you like, we found from his address where I think he was individually paid for stories. I saw at least one for 7,000, and I think there are one or two others also.

  • Yes, but to be fair, the sums he was receiving pursuant to his monthly retainer -- I think he was actually paid weekly -- was just over £2,000 a week in 2006. That was paid by bank transfer, it wasn't a cash payment, was it?

  • It was into his HSBC bank account, yes.

  • But were you drawing the inference that those sums were being paid for the same unlawful activity: namely accessing voicemails?

  • Broadly, yes. What I was seeing here was an investigator. In terms of the extent of illegal activity, so for instance was his whole week 100 per cent spent in illegal activity? I don't know. I think a substantial amount of his time was spent in illegal activity, and it's difficult for me to actually put a figure on whether the whole of his time, half of his time or whatever amount of his time was put to illegal activity.

    There was also research activity which was taking place, as I have mentioned, with regard to the documents we found in various stages of research. Now, that may well have been legitimate, open-source research and other perhaps nefarious research that he would have been undertaking. Whether that would have breached the criminal law, I don't know.

    So broadly the answer to your question is: yes.

  • Yes, I follow.

    You must have been disappointed, then, that in the criminal proceedings the amount of money that was forfeited was £12,300 and that was it?

  • We had some discussions in court around that and the answer to that question is yes, I was disappointed.

  • Can I ask you please to look at paragraph 52 -- or maybe before we come to 52, if we could take a short break?

  • Yes, let's have five minutes.

  • (A short break)

  • Mr Surtees, paragraph 52 of your statement, please. You refer to the spreadsheet which is our tab 94. About eight lines down you say:

    "It was also clear that on some of the sheets of paper generated by Mulcaire that he had written names on the top corner, which may have been the intended recipients of the information from within News of the World. Whilst the most probable explanation for the corner names was that journalists at the News of the World were in receipt of this information, and that they could be aware of the illegal practices, the difficulty was proving this."

    When did you become aware of the existence of these corner names? Can you recall?

  • Probably during the weekend and the days after when the Special Branch officers I'd tasked to go through the 11,000 or so sheets of paper had been completed.

  • Did you not think it likely that not merely would these journalists -- or rather the corner names be the individuals who were, as it were, commissioning Mulcaire, but that they would also know Mulcaire's trade craft, because Mulcaire would be sharing with them the fruits of his illegal activities, namely what was on the voicemails?

  • There's no point in using him if you're not going to use him.

  • Absolutely right. I know he was supplying journalists with his product. The issue was whether or not those journalists knew how he was obtaining that product and, knowing how he was obtaining that product, were either tasking him or receiving it, or whether they were simply blindly receiving product.

  • You rightly point out at the bottom of this page:

    "This would have meant potentially arresting those journalists listed on Mulcaire's documents."

    Because obviously you couldn't have proceeded without doing this. Then you say:

    "To effect this, there would need to be a full scale criminal investigation sanctioned by senior officers of SO13."

    You're rather suggesting there or you might be suggesting there that was something you would rather have liked to have done. Is that correct?

  • Absolutely. But if I can potentially -- or if I can add something to that -- I need to stop saying "potentially" -- if I can add something to that, yes, I would have liked to have done that, but I was an SIO on a number of terrorist investigations, I was part of the management team and was aware of, by that point, the 70 or so major terrorist investigations that were taking place. I was part of them.

    So in terms of what I would have liked to have done coupled with my obligations and the seriousness of the investigations I was involved in, I knew where my priorities lay, and those were with the issues of serious threat to life investigations. That's where I needed to be and that's where my staff needed to be.

  • Did you consider and discuss with your senior officers the possibility of a more limited investigation in the first instance, namely target the most senior journalists, arrest them, see what can be done with the call data, because you'd be able to find out their mobile phone numbers or other relevant numbers, and just see what the fruits of that enquiry might reveal?

  • I can't remember exactly the extent of the conversations we had at this particular time, which would have been around the late September/October time of 2006, but certainly having had the Blue Book compiled and having had the documents that were gone through and the information with regard to potential journalists at the top corner of some of those documents, the extent of the conversations I had around scoping a possible investigation in the future and the extent of what that investigation would look like, I can't remember the exact details of that. I certainly can't remember going into -- we could have a major investigation or we could have a smaller investigation.

  • I understand. In paragraph 56, towards the bottom of that paragraph, you say that you:

    "... contacted several potential victims to inform them that their phones had been illegally intercepted and to request they provide statements and assist any future trial. One of these victims was Tessa Jowell. All of the potential victims declined to assist us with the prosecution."

    Did they give any reasons?

  • Most of the conversations were greeted with shock, incredulity and surprise. I can't remember specifically whether one person said something or another person said something else. It resulted in me asking them whether they would support an investigation, ie supply a statement to me to say that, "I didn't give anybody permission to access my voicemail box", and they declined that request. I can't remember precisely how that was relayed across to me.

  • It's important that this piece of evidence comes out, because it demonstrates that it wasn't necessarily that straightforward in all aspects of this, at least in terms of identifying victims.

  • But in one sense that helped with one of your other problems, didn't it, Mr Surtees, because there was a pressure on you with other work, some of the victims you'd spoken to didn't really want to go down the prosecution route, but it wouldn't have been an enormous task, would it, to take your Blue Book and make sure that everybody on the Blue Book was told that there was some information to this effect, it may not be possible to prosecute it for reasons which you've explained, but they ought to be aware of that fact and take appropriate security arrangements and at least be alert. That wouldn't have been the work of officers of your rank or indeed officers of senior rank of any sort, would it?

  • I accept that. In terms of the Blue Book and in terms of the document that was produced later, which was a document produced as a result of the analysis of the electronic media, which I think came to us on 23 November 2006, in relation to both those documents, I accept that, the Metropolitan Police, could have approached all of those people and said, "Look what is on a piece of paper", or, "Look what is on a document and look how it relates to you". I accept that.

  • Of course you could. But the value of it is that then they are alert. They can take it further if they want to, and then you have decision trees to go through about what you do, but more significantly, they can take steps to make sure that they change their numbers or whatever, because once it's out there, it's out there. Is that not fair?

  • Yes, I accept that. With the benefit of hindsight, 2012, I think everybody in the Metropolitan Police might accept that. There was a communication strategy which was devised in 2006 and it was multifaceted. It dealt with the information that was put out for offer. Two people had been arrested, two people had been charged with these offences. There was various media lines put out throughout the process: two men have pleaded guilty and then latterly two men have been sent to prison. So there were through the process of August into January 2007 a number of media lines put out and a lot of media coverage as a result of that.

    In addition to that, we were talking to all of the airtime providers for two reasons. One was to ensure that technically the airtime providers were doing something, were putting some remedial action in place to prevent this from occurring in the future, and I understand they did that, and simply it looks like if you have your PIN number changed, this is one example of it, you receive a text on your telephone to say your PIN number has been changed. That didn't happen in 2005, it happens now.

    So there was remedial action taken by the telephone companies to actually stop that. There was other action taken by them.

    There was also my understanding that the telephone companies for the non-four categories of victims, the non-military, royal household, MPs, police, were being told by those telephone companies that potentially their telephones had been accessed.

  • Do you know whether they did that?

  • I know now that they didn't do that.

  • Can I just understand one aspect of the strategy for notifying victims.

  • Can I just follow up on that one point? I know now that some of them didn't do that. O2 I know did do that.

  • Yes. I think they notified 45 individuals. Other companies did nothing.

    Paragraph 58, please, of your statement, the victim strategy. Your understanding of what the strategy was in relation to the four categories, the royal household, MPs, military officials or police officers, was the strategy to notify those who were, as you say here, suspected to have been targeted or was it to notify those in these four categories in respect of whom there was clear proof that their voicemails had been accessed?

  • I was very clear on the victim definition at that time, and that was where there was some evidence that somebody other than the individuals who legitimately ring into their DDNs had rung into their DDNs. If I go to the Blue Book, the examples of that would be where we have numbers supplied by the telephone companies on the two right-hand columns of the Blue Book to say there were suspicious activity, ie there were rogue numbers accessing the DDNs/UVNs of those people. I was clear on that.

  • So is this your evidence, that even in relation to these four, as it were, security categories, there would have to be evidence of unlawful activity as evidenced in the Blue Book rather than the mere fact that they were in Mulcaire's papers?

  • In terms of the strategy that was set at that time, yes.

  • Okay. Paragraph 65, please. Having set out earlier in your statement all the competing considerations which you've given oral evidence about:

    "Consequently it was made very clear that, given the unprecedented amount of operations currently live within SO13 and the huge demand this was having on the CT command, this matter was not to be investigated beyond the original parameters."

    Can you remember when that decision was made, Mr Surtees?

  • Not specifically, but it would have been end of September into October of 2006.

  • Is it your understanding it was made by DAC Clarke?

  • Were you present at a meeting where that was discussed or was the decision as it were communicated to you subsequently?

  • I can't recall being at a meeting. I think the decision was subsequently communicated to me.

  • When it was communicated to you, what was your reaction?

  • As I've already said, I was fully aware of the vast resource requirements on the counter terrorism command at that time with regard to the 72 investigations. I was aware of that because I was leading a number of those, and involved in a number of others. Had I been concerned about the legitimacy or otherwise of that decision, I would have taken that elsewhere. What I mean by that is I clearly am alive to the fact that we have got lines of investigation that had not been pursued in this case. The lines of investigation could have been pursued, and, as a detective, I would have liked to have pursued them.

    If Peter Clarke had made a decision based upon resource, and my experience at that particular time was that there was lots of resource, and I thought the decision was perverse, then I would have taken that elsewhere. That was absolutely not my position when the decision was communicated down to me. I was fully aware of where we were within the anti-terrorism branch or counter terrorism command at that time.

  • In relation to the correspondence with Burton Copeland and their response to your requests for information, was it your view that News International, through their solicitors, were co-operating or not?

  • No, it was my view that they weren't co-operating.

  • Were you asked to put together, as it were, a briefing pack for DAC Clarke to enable him to reach an informed decision on this important issue?

  • With regards to August/September time or --

  • No, this is September/October time, keeping the investigation within the original parameters, which means not expanding it to include the possibility of bringing in other individuals.

  • I don't recall putting together a briefing note as such. And I don't know whether that decision was based upon a verbal briefing delivered or whether it was delivered in a written format. I don't recall doing the written format. I certainly remember having conversations with Phil Williams, Tim White and others, including Peter Clarke, through this investigation. Specifically the late September/October time I don't recall the form that briefing took.

  • When you say in paragraph 69 of your statement, towards the end of it, that consideration was given to outsourcing the outstanding aspects of the investigation to another MPS specialist department, was that something which you were keen to achieve or not?

  • Yes, that was a solution that I was putting forward. As I'd already documented in my decision log earlier in the proceedings, I think around May time, 31 May, from memory, I proffered that as an option/opportunity. Again in the latter part of the investigation, September/October time, I was clear, of course, at that time the levels of police resource that were being absorbed by the anti-terrorist branch to fulfil our obligations under current investigations. For instance, both in Op Overt, which was the August 2006 issue, all of the surveillance resource in London and the vast majority of the surveillance resource across the country was used on this operation.

    Now, what that meant in real terms was that other criminal investigations, such as serious organised crime, armed robbery, professional standards investigations within the police, fraud investigations, would not have that resource for a considerable length of time. This was the reality of what was occurring in 2006, and I was fully aware of that. In addition to that, we had a whole lot of other investigative resources on loan to us. I think at the beginning of 2006 it was probably somewhere in the region of 750 to 1,000 officers over and above ours. I think as we went towards the end of 2006 that diminished slightly, but it was a constant ebb and flow of requests, both within the Metropolitan Police and outside, for resource to support anti-terrorist branch investigations.

    So I could understand Peter Clarke's challenge of going again to ask for more resource with regard to this investigation.

  • That takes you back to the issue that we've just mentioned. If you can't go further forward with it, don't you have to do your best to ensure that you got the very widest benefit from the work that you have put in, first of all by ensuring that everybody knows about it who might have been affected, might have been affected, and secondly, that the organisation which you believe has been the hub of instructing this private detective has demonstrably sorted itself out, if I can just put it colloquially, and that wouldn't have taken a great deal of police resource?

  • No. On the first issue, I accept the organisation could have taken a different tactic, if you like, and tasked to go to a number of persons of interest -- I won't term them victims -- persons of interest, if you like, and inform them of that.

    With regard to the second piece, the communication strategy, if you like, and the actions that we'd taken with regard to News International I think delivered the message to News International very firmly that either we have individuals within News International -- certainly we have individuals within News International who were engaged in sustained periods of criminal activity. That was borne out with the prosecution, it was borne out with the opening that Mr Parry on behalf of prosecution led on.

    I have considered the issue of whether or not we would go to News International and have a conversation, and if we'd done that, it may well have been viewed cynically. Had we done that in 2006, for example, I don't know whether we would be sitting here in 2012 trying to answer --

  • Maybe you would, but then you would be able to say, "Well", as you've just said, actually, "counter terrorism, armed robbery, the resource is not limitless, so we're doing the best we can."

  • Certainly you'd have been able to say, "And my God, when they started to talk about a single rogue reporter, we put them right. We didn't feel that this was doing justice to the work that we'd done and they knew about."

  • Can I ask you about one specific document, tab 157 of file 3. 03823. This is a report from the Directorate of Professional Standards which relates to an interrogation of one of Mulcaire's computers. Is this a report which you saw at the time, Mr Surtees?

  • Yes. I think it was delivered to us either the week the two defendants, Mulcaire and Goodman, pleaded guilty or the week before they pleaded guilty. It was somewhere around 20 November 2006.

  • The week before since it's dated 23 November and the guilty pleas were --

  • Yes, I have seen it and it does relate to a number of computers, not just one.

  • Can I ask you, please, to clarify two points, really. If you look at the second paragraph on the first narrative page of the report under "Tasking", where it sets out the background:

    "Two individuals who were obtaining details of mobile phone messages ... [et cetera]. Attempts have been made to obtain personal details of one politician and Commander Paddick. It is also believed attempts may have been made to corrupt serving police officers and misuse the Police National Computer."

    Could you explain that to us, Mr Surtees?

  • No, I can't. All I can suggest is that the task has been handed to the officer from the Department of Professional Standards by one of the exhibits officers within the counter terrorism command, DC Hills, who has made various assumptions and briefed on that basis. That's all I can assume this is.

    The investigation from December 2005 through to August 2006 and beyond that was a very, very tight investigation. There were very few officers who were involved in that who knew the details of what had gone on. Hence when I opened this up to the 30 or so officers who went through and populated the Blue Book, they were developed vetted staff officers.

    Throughout this investigation and beyond, into 2006, there was a tight investigation, the details of which were known by very few people.

    What I have here and I can assume is that DC Hills, who wasn't part of that, has briefed the officer from the Department of Professional Standards, put some context around this, and that's what the officer has written within this tasking. It's not significant I recognise with regard to the investigation.

  • There were names though in the project list, as it were, that according to Detective Sergeant Maberly were on the witness protection programme. Is that something you knew about?

  • Yes. It was brought to my attention that some names here within this document may well have been from the witness protection programme. What I instructed DS Maberly to do was to contact the witness protection unit, get them to come across to our office, show them the document, get them to look at it, and if there were any risks to people they were protecting, take whatever mitigation they needed to take to protect them. I didn't ask or seek information from the witness protection people around the quantity or individual details of who --

  • Not individual details, but weren't you interested to know whether it was in fact the case?

  • I knew it was the case on some of them because it was quite obvious it was the case.

  • Didn't that itself create an enormous issue for you? This must be among some of the most confidential information that's held.

  • Yes, and the officer from the witness protection unit was best placed to take whatever remedial action needed to be taken in regards to that. In terms of the provenance of the information, that also concerned me, yes.

  • But you didn't do anything about that.

  • I had conversations throughout May, June, July and August in terms of the investigation. I had conversations August, September, October, November with regards to the various drips of information that were coming through, and briefed those up.

  • But in that context, if the conspiracy was limited to Goodman and Mulcaire, there would be concern but there wouldn't be enormous concern, but if the conspiracy went wider, as you suspected it did, to others at News International, that concern would be multiplied, wouldn't it, in relation to possible prejudice to those on the witness protection programme?

  • Witness protection programme, access to government ministers, access to military, right across. There were lots and lots of concerns, yes, including the witness protection issues, yes.

  • I think I'll leave it there, Mr Surtees. Thank you very much.

  • Thank you very much, Mr Surtees.

  • The final witness for today is Mr Maberly, please.

  • Very good. Apparently he's in the annex. I hope he's not been keeping away because in criminal cases witnesses aren't in court.

  • No, sir, he was fully aware.

  • We'll wait then.

  • We'll wait. We'll stretch our legs for two minutes.

  • (A short break)