The transcripts of the official inquiry into the culture, practices and ethics of the press. More…

  • MR MARK MABERLY (sworn).

  • Your full name, please, Mr Maberly.

  • My name is Mark Maberly and I'm a Detective Inspector with the Metropolitan Police Service.

  • It's Mr Maberly?

  • Your rank, please, in March 2006 when you were working within SO13 was?

  • In 2006 was Detective Sergeant.

  • Thank you. In relation to Operation Caryatid, what was your role, please?

  • I was the case officer.

  • As its name might suggest, you were hands-on dealing with the evidence as it came in and progressing the case, is that broadly right?

  • That's right, carrying out the instructions of the SIO and the IO.

  • Forgive me for interrupting, I know you were very anxious to know when the statements were free to go onto the Inquiry website. They have now all been checked and are in that state, and since there are people behind who are keen to see them, I thought I'd let you know straight away.

  • Thank you very much indeed, Mr Garnham. Possibly we could send a message to make sure that that should be done as soon as possible. I am conscious that today, unfortunately, not only there has been that hiatus, but for part of the day, although no longer now, the web streaming has failed.

  • Yes.

    Mr Maberly, I have failed to introduce your witness statement, prepared as it was for the purposes of the judicial review proceedings and not this Inquiry, but it's dated 30 September, signed by you and under a standard statement of truth, so it's the evidence you formally gave within those proceedings; is that right?

  • Mr Maberly, I'm going to focus on a few discrete points rather than go through the history, because we've got the history substantially through your colleagues. Can I just ask you though to clarify two of the technical issues? In relation to Vodafone, we've heard reference to something called vampire, which is separate from the standard call data which I think you can get from a telephone provider. So that we're clear about it, what is vampire?

  • My understanding of vampire data is that it was an engineering or a diagnostic tool that Vodafone use to see how their systems were running, including their voicemail systems. And in the process of doing so, it collected and captured information in relation to people's accounts.

  • What sort of information?

  • Information would include when a message is left, when that message is opened, but I think the significant issue in relation to vampire data is it didn't last very long and it required the company to sort of harvest it on a regular basis.

  • And the length of time or rather the time when it would expire and you could no longer do the harvesting, was that one year?

  • No, I believe it was much shorter than that. I think what you're referring to is at the time there was a requirement on mobile telephone companies to keep their call data for a six-month period. Some of the companies kept them for one year, but in relation to vampire data, there was no requirement on them to keep that data, and it's something that, as I said, it was an engineering tool. It ran constantly in the background. But if I gave you a date, I would be guessing, but my impression was it was a matter of days, maybe a couple of weeks.

  • In relation to the standard call data, we've had evidence that it is rare for people to phone into their mobile phone voicemails from another telephone. Most people access their voicemails, as I do occasionally, from the mobile phone itself. Is that your understanding?

  • The majority of people, on most people's handsets, they press and hold 1, that's a short code, and it directs them directly into their voicemail account. Probably the exceptions that you may have to that are people on contracts where they're paying for voicemail retrieval, in which case it may be more normal for them to sort of recover those from their work address, because they're not paying for it.

  • But given that rarity, doesn't that narrow down the possibilities in relation to people phoning in to voicemails from another number? Because either the owner of the mobile phone is doing it exceptionally for whatever reason, or it's a rogue call. Do you see the point?

  • I do, and I think it's clear that there is a difference in the kind of voicemail interception that was being -- that we believe was carried out by Mr Mulcaire, in that his was a more sophisticated form of voicemail interception. You may hear sort of Fleet Street folklore about something that they call double whacking, and I'll provide that as another example of how voicemail interception could happen in that if I ring your phone and engage it, and then another person rings your phone, they're directed into your voicemail. There is with some of the telephone companies a prospect then of interrupting that voicemail message that you receive and then being diverted into the voicemail account and putting in a PIN number.

    So that's double whacking, and you probably wouldn't be able to do that for too long because there's only so many calls that you could get from someone at the gas board or other spurious calls which would engage your phone before you would catch on to that.

    But the method of voicemail interception that you had from Mr Mulcaire was a much more sophisticated form of voicemail interception. He was changing people's PIN numbers, he was resetting those by calling into the service providers. He had knowledge of their -- the language that they would use, for instance. O2 would talk about direct dial numbers. Vodafone were different, they had unique voicemail numbers, and it was clear that he had a knowledge of different company systems in order to be able to do so.

  • But could you retrieve data that identified that an outside call had been directed to voicemail and then identify the number of that outside call? I'm not talking about me necessarily knowing it about my own, but my service provider?

  • I was not aware -- I don't recall the telephone companies telling me that they would be able to track who had been listening to the voicemails through that method. I think it's almost impossible to know if someone is calling someone and they're listening to their messages, because that would just show as a call to that person's voicemail number.

  • But you would be able to tell what calls were made and directed to voicemail, even if you couldn't necessarily know that it had been for the purposes of accessing voicemail?

  • I think that's why we needed to concentrate on this vampire data, because it's only through that kind of information that person A was leaving a message on person B's voicemail, and someone else was coming in to retrieve that, that's what vampire data provided us with, that kind of background information.

  • Thank you. Can I ask you about paragraph 9 of your statement.

  • Could you remind me which binder it should be in?

  • That one in front of you.

  • Which file is that?

  • Yes. Divider 6.

  • 9. On the internal numbering in the bold it's 113. You say, level with the upper hole punch:

    "DC Green and I made a number of applications for phone data and this predominantly centred on the nine identified numbers that Goodman and Mulcaire were identified as using."

    This suggests that your enquiries went beyond those nine rogue numbers; is that right?

  • That's correct. We were looking at other potential numbers at the time. I can't give you details of these from memory. What I would say is that in addition to our investigation, Vodafone and O2 were carrying out their own assessments of their systems and who potentially was accessing voicemails. I'm aware of at least one number that O2 flagged up that they'd identified as potentially accessing customers' voicemails. From recollection, when we did research on that, it was an unregistered mobile number, and I believe it was -- there was a similar case with Vodafone as well at the time.

  • That all could be sensible trade craft so it couldn't be traced back, wouldn't it?

  • Exactly that, sir. What I would say is that none of the phone companies flagged up to us that they had a large amount of incoming calls to voicemails that they'd traced -- you know, the rogue numbers that we provided was where the bulk of our information came from.

  • Can I ask you about paragraph 22. We can look at the underlying document if it's necessary, but it may be it isn't. You say:

    "On 10 July I received data from a billing request in relation to a PJ Williams ... On examination this data contained calls to the unique voicemail numbers for JLP and HA amongst other members of the royal household. Other unique voicemail numbers contained within this data were to be identified later in the enquiry."

    Can you remember whose those were?

  • Not off the top of my head. We put in a number of applications to the service providers. Initially they had difficulty, and some of our applications had to be submitted several times because they were saying that number didn't exist, when in reality it was a voicemail number.

  • Were these unique voicemail numbers which went outside members of the Royal Family and therefore included victims in a different category?

  • When were those numbers identified?

  • I can't say off the top of my head, but as and when we put in the applications, we would have received the results back over a number of weeks. Because this wasn't a threat to life enquiry, we were just on the standard return rate for our requests.

  • After 8 August, when you compiled the list of those potentially compromised, our tab 94 with the 418 or 419 victims, did you start to obtain data which related to any of those potentially compromised victims?

  • We carried out an analysis of the billing data in our possession. Over a period of time, Mr Mulcaire had a number of different office numbers. We looked at those. We also looked at the 5354 number that was the hub number for News International. They also had another number that ended in 312 that was a very similar -- it had the appearance of a mobile number, but again it was another hub number, and the explanation I received at the time from our telephone expert is that it was least-cost routing, so by doing it through this central hub number it saved News of the World money. However, it did cause us difficulty in then identifying who was the other person at the end of that phone.

  • Of course in relation to the News of the World hub phone, the 5354 number, I've spotted now the 312 number does look like a mobile phone number, but you tell us it isn't. That could be anybody within the News of the World; is that right?

  • Did you make any enquiry with telephone providers as to whether or not it was possible to ascertain who it might be within the News of the World?

  • Or whose desk the phone might be on? You don't ever do that.

  • Yes. We -- that was part of the conversation that we had with Mr Bristow, our telephone expert, and I believe that we also made enquiries with Vodafone, it was on their network, the 312 number, and we were told that we would have to get that information from News of the World, News International.

  • But that suggests it was available to them.

  • The advice that I had from Mr Bristow is that no large firm would have unaccounted for billing. For instance, if you had someone at a particular desk, a lady that was calling her boyfriend in America on a daily basis, they would want to know why there was billing data for thousands and thousands of pounds -- why these calls were costing thousands of pounds, sorry. So there was an expectation that News of the World, News International would be keeping that sort of -- that data, that information, for their own records and to make sure that no one was abusing their internal telephone systems.

  • I rather lost the thread of that piece of evidence --

  • This is all to do with getting to the desk from which calls into voicemail retrieval systems are made. Right?

  • So you were being advised that it was likely that these records would exist to ascertain whose desk it was within the News of the World that was making the call; is that correct?

  • That's correct. And in later applications through BCL solicitors I think one of my requests was to ask for a list of the desk phones and diagrams as to where people were sitting.

  • That's absolutely correct, and I think there was one document only which was provided to you pursuant to that particular request; is that right?

  • And you must have been very suspicious at that point that you were being as it were fobbed off, to use the vernacular; is that so?

  • Equipped with that information, you -- well, it's so obvious it goes without saying. I'm not going to even ask the question.

    If I move on, please, through your statement, I'm only alighting on points which, as it were, are new to us, because your colleagues have --

  • -- kindly dealt with other points. Paragraph 39, an email received on 29 August 2006, which is in file 3, tab 135. Tab 135 is 03621.

  • Tab 135 is an email from Lindsey Hudson.

  • That's right. I just want to understand the significance of this. It's a spreadsheet of other numbers called in by 2228 and 7275, and these were respectively Goodman and Mulcaire's numbers, weren't they?

  • Yes. The 2228 number related to Mr Mulcaire's office and was registered to his offices in Kempton Road.

  • I understand, though, the significance of the next page, the list of numbers and names. What is this telling us?

  • All right, the information that you have would have been the result of a billing data request. The list of numbers that you have alongside the 2228 number, it has a list of the people that were called, their voicemails were called by the 2228 number, and the number that you have there is the amount of times that they were called.

    So in the case of the top line, that number there, their voice number was called 43 times.

  • So let me understand this. That is the number that you've identified as Mulcaire's office phone --

  • -- telephoning somebody else's voicemail, who happens to be a journalist?

  • If we take somebody who was subject to prosecution, the 2228 number, Mulcaire's office, phoned a mobile and accessed the voicemail of Mr Sky Andrew 23 times?

  • Yes. That's correct, yes.

  • What may be important as well is that the next page, which is the 7275 number, which is Goodman's number, we are solely within the royal household, save for the last entry, a singer, apparently, who was phoned once.

  • I can assist with that. I've seen the unredacted document and that particular voicemail number is one digit different to a member of the royal household, so I believe it was a misdial.

  • That's helpful, Mr Maberly. That's giving us some idea what Mr Goodman was doing, what he was interested in and what Mr Mulcaire was doing. But I won't make it more explicit than that.

  • They all are, because JLP, presumably, is Mr Lowther-Pinkerton, the private secretary?

  • I'm very grateful to Mr Sherborne for pointing out that to me rather late yesterday evening as I was reading this. I didn't spot it myself.

    Can I move forward to September 2006. We've heard that a decision was made, possibly the end of September, possibly the beginning of October 2006, that you would keep this investigation within its original parameters and not travel outside down these additional lines of enquiry. What was your view about that, Mr Maberly?

  • There were still lines of enquiry that I would have been keen to follow. In particular, I'd identified three names who, if I had the sufficient evidence, I would have liked to have spoken to. I accepted the decision that, you know, the resources were not there to widen the enquiry, and I myself was deployed on other anti-terrorist branch enquiries at the time.

  • And these were three journalists within News of the World, were they?

  • I don't think we can be more specific than that, because we might begin to start identifying them.

  • If I could just clarify that point, I believe one of them may have potentially moved on and was part of another company at that point.

  • I think we'll leave it.

  • When you say "if I had the sufficient evidence", did you believe that there was sufficient to go a comparatively short distance to get to the state that you would have been able appropriately to interview them?

  • There would have been aspects of the case that I would have liked to have asked them about, but I had no firm evidence of either their knowledge of voicemail interception or of them tasking Mr Mulcaire. That is something that I would have looked to find before speaking to them, because it would have been the case that, you know, if we did bring them in for questioning, the likelihood is that they would have made no comment, as did the other two employees of News of the World. We would have got nowhere.

  • But it's all a question of inference, isn't it? You put the building blocks together and --

  • We had some inference; we had no evidence.

  • Well, I'm not sure about that. Circumstantial evidence --

  • Circumstantial evidence, inference --

  • -- is evidence, is real evidence, is usually very valuable evidence.

  • It is, but it requires something more substantial to obtain a successful prosecution at the end of the day.

  • What's your view about the significance of these what we're now calling corner names?

  • The three journalists that I was interested in following lines of enquiry, I believed that their first names appeared on some of the documents that were recovered from Mr Mulcaire's files.

  • Had you detected a pattern in relation to Mr Mulcaire's activity, whereby he would telephone someone within the News of the World before accessing a voicemail, accessing a voicemail and then phoning that person back?

  • Certainly we believe that to be the case. The difficulty that we had with Mr Mulcaire's billing is that quite often he would just ring one voicemail after another, and in his billing data, you would just get a long list of voicemail type numbers. So it's quite difficult to judge at which point he may have obtained something interesting that he would then want to speak to a particular journalist about. It wasn't always the case that you think, hang on a second, he's listened to that voicemail for a long period of time, then the next call is -- it didn't always work that way, I'm afraid.

  • I can understand it might be more complicated than that, but the person within the News of the World who he'd speak to after accessing in a case where there was evidence of accessing, would that be a person you could identify by call data?

  • In the billing data for Mr Mulcaire, there were calls by him to other journalists. We were aware in the material he had written down those journalists' mobile numbers on bits of paper.

  • So from that point of view, I could identify, for example, one of these three journalists, I had his mobile number, and I was aware that that mobile number appeared in billing data.

  • This is -- yes, well. This is arguably extremely interesting circumstantial evidence, isn't it?

  • I mean, call pattern analysis, which is the police term that we would refer to it by, it can be very good circumstantial evidence, but as I mentioned earlier that sort of Mr Mulcaire's billing was slightly more chaotic than that.

  • There's one other document I'll ask you to look at. Tab 152 in file 3, which is 03765. I just wonder if you could explain the significance of this document. Of course it's heavily redacted. What, if anything, is it telling us? Particularly the second page with the various counts, as we can see them described.

  • If I just explain the fact it's an email, it's the cover, it's an email from a counterpart at O2.

  • On the front cover, the actual email itself, he's explaining that this is a spreadsheet of the DDNs -- as I mentioned earlier that the O2 language that was a direct dial number, so voicemail numbers. And it's the number of times that the voicemail numbers were called by the suspect number.

  • By any of the suspect numbers. So this is you providing them with some numbers that you think you can link to people in whom you are interested, and he's telling you who they called and how many times, is that it?

  • So the first one, the number was called 520 times?

  • To be clear, are these the direct dial numbers of those potentially compromised in our Blue Book?

  • I'm aware of this document. Obviously the email came to me, and you'll see the rather large numbers at the top. Pretty much they relate to the royal household. Those individuals received the most attention.

  • It depends which suspect numbers you were providing then, doesn't it? This doesn't tell us --

  • -- whose numbers you'd asked them to look at.

  • That's correct, sir, yes.

  • The only other document which I'd ask you to consider -- we may already have covered it, but you do address it in your witness statement -- is tab 157, the third file, which is a report from the Directorate of Professional Standards.

    You make it clear that there were those amid the project names who were -- or you believe to be in the witness protection scheme, and you took steps to notify those who were, as it were, in charge of the scheme, and an officer from the witness protection unit came to you and you drew these matters to his attention?

  • Do you know what came of that?

  • No. That's a matter for the witness protection unit, because I wouldn't want to know who was in the scheme and who wasn't. That's a sensitive matter from a police point of view.

  • Not just sensitive; horribly sensitive.

  • I mean, it must be amongst the most secretly kept data.

  • So I can understand why you'd want to look at it a bit further.

  • Did you explain to that person that those who had been, as it were, directly and unequivocally implicated in the voicemail accessing were Goodman and Mulcaire, but there might be others, and therefore the concern was, as it were, increased?

  • Who would I be addressing that concern to? Sorry, I missed that point.

  • To the officer from the witness protection unit, because you'd want to brief that individual as to the background. You'd obviously told them, "We have Goodman and Mulcaire who are about to plead guilty on 27 November", whichever date it was, "but we must draw to your attention that there may be others within News International who are also illegally accessing voicemails and therefore the risks were compounded"; did you explain that?

  • I would have explained to him how our knowledge of the activity had been occurring, but I would have probably also caveated that by saying we do not know to whom that information was provided.

  • Yes. Mr Maberly, those were all my questions. Thank you very much.

  • And you passed from this work in late 2007; is that right?

  • From the -- throughout this investigation -- I continued to service the prosecution until they were sentencing in January of 2007, but I was involved in other investigations throughout this period as well.

  • Sorry, there's one other question I've been asked to put to you. It's a very short one.

    The Mail on Sunday were notified that four people had been targeted by Mr Mulcaire. Do you recall that?

  • I'm aware that was the case. That was my colleague, Keith Surtees, who informed them.

  • Yes, and you were copied in to the email. Do you know why they received arguably different treatment from others?

  • This was probably a period of time when we were trying to contact potential victims of the interception. At that time we were concentrating on those who were in a position to give evidence, had been most affected, and probably where our best evidence laid in relation to the investigation.

  • Thank you, Mr Maberly.

  • Thank you very much indeed.

  • May I raise one administrative matter in relation to tomorrow? Mr Yates is giving evidence by video-link from the Middle East. He's billed for noon. Mr Clarke, I expect, will take about an hour and a half, so subject to your view, may we take an early lunch, because it would be difficult to interrupt the video-link.

  • By early lunch, you mean --

  • It's brunch, really.

  • Yes, we can take a break in advance of midday. We'd then need a little break in the afternoon as well, I have no doubt.

  • Right. Thank you very much. 10 o'clock tomorrow.

  • (The hearing adjourned until 10 o'clock the following day)