Inside the global terror watchlist that secretly shadows millions
Thomson Reuters building in Times Square, New York. (Image: file photo)
There is a private intelligence database, packed full of personal details of millions of "heightened-risk" individuals, which is secretly having a devastating effect on those who are on it. Most have no idea they're under the watchful gaze of some of the world's largest and most powerful organizations, governments, and intelligence agencies.
But for its worth and value, it wasn't nearly kept secure enough.
A copy of the database, dating back to mid-2014, was found on an unsecured server hosted by a London-based compliance company, which specializes in "know your customer" profiling and anti-money laundering services.
Chris Vickery, a security researcher at MacKeeper, who found the database, told me that it was stored on a server configured for public access.
This influential yet entirely unregulated database called World-Check lists over 2.2 million corporations, charities, and individuals -- some notable, like politicians and senior government officials -- which might be connected to illegal activities, like sanctions, violations or financial mismanagement.
Some have been pinned under the database's "terrorism" category, or are thought to be connected to financing violence.
This data could affect a person's ability to be lent money by a bank, their employment opportunities, and even influence the people who do business with them -- simply based on a designation.
Word of the database first widely emerged earlier this year when Vice News disclosed the existence of the project. It said the database was "secretly wielding power over the lives of millions" who are said to have "hidden risk," such as those who are violating sanctions or have laundered money or a connection to criminals -- which has been linked to account closures and bank blacklisting. As the news site pointed out, simply being a high-profile individual can label someone at risk of bribery.
The report said the database now has over 2.7 million entries -- including over 93,000 records relating to those associated with terrorism.
No wonder it's popular with law enforcement agencies and government departments, which subscribe to the database in an effort to uncover potentially improper conduct. Most of the world's largest banks and law firms, and over 300 government and intelligence agencies are subscribers, according to a 2015 sales document from its owner, information and finance giant Thomson Reuters, which in 2011 bought the company for $530 million .
Because of the sensitivity of the data, access is limited to a few thousand customers, which have been carefully vetted and are bound by secrecy and non-disclosure agreements.
Vickery reported the leak to Thomson Reuters, but he still went public in an effort to spark a debate on whether these profiling databases are being run appropriately.
"If governments and banks are going to alter lives based upon information in a database like this, then there needs to be some sort of oversight," he said in an email.
The problem is, there isn't.
Vickery shared access to the database with ZDNet.
Each profile lists a person's potential risks such as "narcotics" or "terrorism," "organized crime," or "politically exposed person." Given the list's potential power to alter a person's opportunities, many would not approve of their name being on it.
Take one example. Maajid Nawaz ran for the British parliament as a Liberal Democrat in the last election, as profiled by Vice. He is a former member of the radical Islamic group Hizb ut-Tahrir, which calls for its own Islamic state. He was detained in Egypt for five years, but is best known for his publicized and well-documented transition away from radical views. He later set up a think-tank dedicated to challenging the extremist narrative, and advised former prime ministers from Tony Blair onwards on Islamic extremism. And yet, after looking up his profile on the World-Check database, created in 2002, it's still maintained with a "terrorism" tag and updated as recently as August 2013, despite "no further information recorded," let alone any connection to extremists or terrorists.
(Screenshot: ZDNet)
He called the database "archaic," and said that the inclusion of his name has had a "material impact" on his life.
It's not just individuals who are designated as affiliates with terrorism, despite equally publicly available data to suggest the contrary.
A BBC investigation last year showed the process behind banking giant HSBC's bid to shut down accounts associated with several prominent British Muslims. A mosque in North London was given a "terrorism" label, despite new management that was installed more than a decade ago.
Other names in the database include diplomats and ambassadors, and senior ranking officials associated with global financial institutes, such as the World Bank, as was previously reported.
national security
Based on how profiles are built, potentially anyone with an internet footprint could be included.
Much of the data comes from law enforcement sources, political information, articles, blog posts, and social media, among other sources. From the records we looked at, the data would often contain names, locations, and dates of birth and details of education. but also in some cases social security numbers, and citizenship and passport numbers were included.
The profiles themselves often have little or no justification for the entry. From our searches, we found high ranking global government officials who were named in the files yet there was no visible or clear justification for why they were there. In most cases there were just a handful of external links to publicly available documents, like speeches, election results or pages linking to official government websites for justification of their presence.
Many of the "reports" list a person's risk as "to be determined," suggesting there were no improprieties, illegal activities, or even an apparent reason for a profile, except for their status as a public figure.
The database we examined is two years old, and the records may have changed since, however.
A spokesperson for Thomson Reuters didn't specifically respond to a question in relation to how profiles are built, vetted, or designated, but pointed me to the World Check privacy policy, which reiterates its effort to get data based on information in the public domain.
This entire market of "know your customer" and profiling remains unregulated and ungoverned -- despite being used by some of the most powerful countries and organizations today. This industry is growing at a rapid rate -- some say by over $30 billion by the start of the next decade. Even though the service has to stand up to strict European and UK data protection rules, a lack of public scrutiny and accountability makes that task almost impossible.
Those who are named in the database have little or no recourse to have their data corrected or removed.
In Nawaz's case, Thomson Reuters reportedly removed his profile earlier this year. But given that the contents of the database are shrouded in secrecy, not everyone will have the same luck, let alone know they're on a database in the first place.