The 2014 Se og Hør media scandal (Danish: Se og Hør-sagen), also known as the Nets-scandal (Danish: Nets-skandalen) or the hush-hush scandal (Danish: tys-tys-skandalen), was a media and IT surveillance scandal in Denmark that broke in 2014. An IT professional employed at IBM leaked sensitive personal data from the Nordic payment services company Nets to the Danish gossip magazine Se og Hør, which allowed the magazine to obtain information on celebrities' and other individuals' use of credit cards.
The scandal came to public attention late in April 2014 after the publication (in Denmark) of the journalist and author Ken B. Rasmussen's roman à clef Livet, det forbandede (English: Life, the damned). A large number of organisations and media groups were ultimately involved, including Nets, IBM, Nordea, Fujitsu, SAS, Naviair, Rigshospsitalet, the Danish armed forces, TV 2, Ekstra Bladet, and Aller Media with their magazines Billed-Bladet and Se og Hør.
Background Se og Hør, which is published weekly, has long carried revealing stories about celebrities. The magazine had previously had "an amicable relationship with the famous", where subjects could prevent the publication of negative stories about themselves. This attitude is perceived to have changed with the appointment of Henrik Qvortrup as editor-in-chief, with Ken B. Rasmussen commenting that "we had no ethical standards that had to be upheld as a matter of life and death". Qvortrup introduced a monetary reward for members of the public who phoned the magazine with tip-offs that lead to published stories. The magazine's owner, Aller Media, would pay up to DKK 10,000 cash-in-hand to sources.
The surveillance
In 2007, Nets outsourced the maintenance of their central IT systems to IBM, which included the transfer of 71 workers. Se og Hørs so-called hush-hush source is believed to have been amongst the transferred workers. The surveillance of celebrities by this source is believed to have begun in 2008. According to investigations in the media, the source received a text message whenever a tracked celebrity used their credit card. The message was possibly sent automatically and could be received by the source at home. Soon after, the source would forward the text to journalists at Se og Hør. This may have been repeated several times a day. The source was apparently unable to add names to the list of tracked celebrities freely; only at certain times could the list be expanded with the names of new persons, after which they would also be under surveillance. Journalists at Se og Hør could suggest new names to the source, which was referred to internally as "bidding".
It was initially uncertain how the surveillance was technically accomplished, but the programmer and IT-blogger Poul-Henning Kamp made the educated guess that it involved an existing "trace" facility in the Nets credit card handling system. Under normal circumstances, this system was only available to police with a court order to track wanted criminals. Kamp suggested that the system involved a real-time SMS service sending text messages directly to the police, which would reduce the paperwork burden for both the police and Nets. It remains unclear whether either of Nets or IBM had a functioning Security Information and Event Management (SIEM) system monitoring their credit card infrastructure. However, IT experts concluded that there was evidence for the absence of a competent system and commented that such a system should have detected the irregularities. During proceedings at Østre Landsret in July 2014 and at the Supreme Court in December 2014, the prosecutor presented their understanding of how it was possible for the source to obtain sensitive data. According to state barrister Mohammad Ahsan, the source had access to data about card transactions but not associated names. Ahsan further commented that it would have been possible to match names to transactions by the source resetting colleagues' passwords and then logging in via their accounts.
According to Ken B. Rasmussen, "anyone with even the slightest reputation" was under surveillance. As well as celebrities, this included murder suspects and accident victims. At least 86 people had personal information about them leaked by the source. High-profile victims included Prince Joachim, the comedian Casper Christensen, and the TV host Line Baun Danielsen. In Prince Joachim's case, the surveillance allowed Se og Hør to locate the Prince and Princess Marie on their otherwise secret honeymoon to Canada following their marriage in May 2008. Baun Danielsen's payment at a private hospital was leaked. The former professional cyclist Bo Hamburger (who had previously attended school with the alleged source) was also a victim. The magazine debated whether credit card transactions detailing the politician Morten Helveg Petersen's travel around Europe by plane, including hotel bookings in Rome, were sufficient grounds for a story. These leaks by the source did lead to Rasmussen writing a story for the magazine in 2008 titled Morten Helveg Petersen: Kærlighedsferie betalt af skatteyderne (English: Morten Helveg Petersen: Love holiday funded by taxpayers), which used the leaks to detail Helveg Petersen's personal relationship with Baun Danielsen during an official NATO meeting. At the time, Helveg Petersen demanded a retraction of the story and bought the case before the Danish Press Council, where he lost in October 2008. Several individuals under the protection of PET were also affected: former Prime Minister Lars Løkke Rasmussen had his card transactions leaked, while Pia Kjærsgaard and her husband Henrik Thorup additionally had their CPR numbers and secret home address leaked.
In Spring 2010, PwC carried out an inspection of IBM's running of Nets' NemID. The report highlighted several problems with access and credential handling. It is unknown when Nets and IBM were last inspected by the Danish Financial Supervisory Authority; no publicly released inspections have occurred since 2010, and inspections were not publicised before that date.
According to Ken B. Rasmussen's novel, the source received DKK 10,000 per month, for a total payment of DKK 310,000 over the course of the surveillance. The source was also provided with access to concerts through Se og Hør's press credentials, including to the TV 2 event Top Charlie. They attended an after-party with guests including Keld and Hilda Heick.
At least 16 employees at Se og Hør, including the editors-in-chief Henrik Qvortrup and Kim Henningsen, were aware of the source's existence. Additionally, the parent company Aller Media's management were aware. In emails from 2011, the Aller Media publishing director Per Ingdal acknowledged awareness of the source from 2009 and instructed Henningsen to cease working with the source. A separate email implicated creative editor Steffen Sørensen and photo editor Peter Grosen in the case. However, according to Se og Hør journalist Kasper Kopping, the source was further used until the then news manager Lise Bondesen ordered a complete stop in Autumn 2011. Ken B. Rasmussen left the magazine in 2012.
The photographer Michael Medgyesi, who worked as a freelance photographer at Se og Hør, warned Nets as early as 18 January 2013 that journalists at the magazine had access to sensitive credit card transactions. Nets initiated an investigation as a result but found nothing. Medgysei had also previously (in 2011) contacted PET regarding the unlawful access. At the time, PET called a meeting but found no justification to continue investigating. Medgysei's suspicions were initially aroused by three overseas photo assignments in 2008 and 2009, where he was given information by the magazine on the locations of Janni Spies, Anni Fønsby, Stein Bagger's daughter, and Bagger's partner Annete Uttenthal.
The source had authorised access to the NemID system as part of their work, and logged on to this at least once. Additionally the source had FE security clearance to work with the Danish armed forces' IT system DeMars, which had been outsourced to IBM in 2010. One of the source's department's responsibilities was to monitor DeMars. The armed forces found no evidence that the source misused access to the system.
Following their employment at IBM, the source consulted for Fujitsu. This included work for Fujitsu's client Nordea immediately up to the breaking of the scandal. At Nordea, the source had access to internal monitoring systems and performed maintenance on them if they stopped working. Nordea felt satisfied that the source did not leak personal information using their access there.
Breaking of the scandal Ken B. Rasmussen's roman à clef was scheduled for release on 29 April 2014. However, a few days prior to this, BT broke the scandal after finding documentation for the parts of the book based on fact. The then former Se og Hør journalist Kenth G. Madsen confirmed to BT that the magazine had a source for credit card transactions, which was later corroborated by the then current Se og Hør journalist Kasper Kopping.
The scandal drew large coverage in the media. Even the royal household issued a statement, calling it "an especially serious case". Rasmus Mark Pedersen, the Director of Journalists for the Danish Union of Journalists, was "completely shocked" and believed the scandal was "without equal the worst case in the history of Danish press". The victim Pia Kjærsgaard described the surveillance as "incredibly uncomfortable", while the additionally monitored Morten Helveg Petersen felt it was "crossing a line", "wildly uncomfortable" and "extremely offensive". He also compared Se og Hørs actions to "pure Stasi methods".
IBM called it "a very serious case" and wrote in an announcement that it would carry out a "complete investigation". Following this, it followed a policy of very sparse communication regarding the scandal.
Se og Hørs former chief editor Henrik Qvortrup initially denied any knowledge of the case. However, a few days after the breaking of the scandal he resigned as a political commentator for TV 2, and shortly after that BT published emails that implicated Qvortrup in the surveillance program.
On 1 May 2014, Se og Hør opted to suspend and send home (with full pay) 7 employees that were seemingly involved in the surveillance. Additionally, Billed-Bladet suspended two of their employees, including an editor-in-chief. This was after it was revealed that the employees had, under previous employment at Se og Hør, received emails about the source. Ekstra Bladet suspended their editor-in-chief Lise Bondesen for the same reason. While suspended, Bondesen wrote an article in Ekstra Bladet giving her version of events, and she resigned on 2 May 2014.
On 19 June 2014, Ekstra Bladet revealed that the so-called hush-hush source had confirmed his identity to the police. He subsequently demanded anonymity but this was rejected by the judge at Retten i Glostrup with reference to "the circumstances surrounding the charge's severity and the very significant media coverage of, and public interest in, the case about Se og Hør".
Aller Media had not reported their editorial database to the Danish Data Protection Agency and were therefore possibly not protected by press data protection laws. This could have meant that individuals registered in the database has a right to obtain the information held about them. Politiken reported that the victim Casper Christensen considered using this to force Aller to release his data.
Further fallout Complementing the hush-hush source revelations, a previous employee at Nets described how customer service team members had, without additional training or checks, complete access to all customer data from their very first working day. The employee felt that there was insufficient monitoring to prevent misuse and commented: