Paradise Papers were not an inside job, says leaky offshore law firm

Revelations from the Paradise Papers, a leaked set of more than 13 million financial documents, have shed light on how the rich and famous channel funds through offshore tax havens. Among early stories spawned from the leak and published over the weekend are allegations that Russia funded Facebook and Twitter investments …

[Adam 52]

"that a forensic investigation by a leading international Cyber & Threats team concluded that there was no definitive evidence that any data had left our systems. This was not the work of anybody who works at Appleby."

In other words "Our security was poor and we didn't even have any logging. Anyone could have done it."

[Voland's right hand]

Live by the sword, die by the sword

An interesting side effect of running a business in a tax heaven is that there is no way in hell for you to obtain a warrant in a developed country jurisdiction over data theft. The relevant treaties are not in place and that they are not in place is exactly what is allowing tax heavens to operate.

[Stuart 22]

Re: Live by the sword, die by the sword

"Putting aside the fact that the leaked financial details appear to include information about the murky world of offshore finance, for the victims, this leak could have life-altering or, at the very least, hugely distressing effects."

I'm almost tempted to say - "if you have nothing to hide, you have nothing to be distressed about". But I won't as I'm not a Home Secretary.

[Yet Another Anonymous coward]

Re: Live by the sword, die by the sword

Or in this case live by the sword, die by a couple of large men with AK47s and Russian accents saying - "Mr Putin is very disappointed in you"

[Version 1.0]

Re: Live by the sword, die by the sword

"Mr Putin is very disappointed in you"

No doubt why "V" took a lot of trouble to remove all traces of the intercept from the logs.

[Androgynous Cupboard]

Re: Live by the sword, die by the sword

You joke but there's probably something to this. The normal pattern for a hack this size is gloating attribution, but this one was leaked to Süddeutsche Zeitung and no hacking crew has publicly claimed responsibility.

I imagine the moment when they realised what sort of data they had (and who it was on) was a bit of an "oh, fuck" moment.

[Voland's right hand]

Re: Live by the sword, die by the sword

The normal pattern for a hack this size is gloating attribution,

Not necessarily. The so called consortium for investigative journalism actually PAYS for data dumps which are "interesting". How much - we do not know, but I suspect that it is in the 6 digit range.

One of the conditions is not to make a lot of noise before it is given to them so they can analyse and coordinate the release. If you gloat you cannot get paid.

[Doctor Syntax]

Re: Live by the sword, die by the sword

" If you gloat you cannot get paid."

Gloating doesn't have to be public. You can gloat all the way to the bank.

The only thing to worry about is that your part in one breach gets outed because it's documented in stuff that subsequently comes out when your own solicitors get breached.

[Anonymous Coward]

Re: Live by the sword, die by the sword

I'm against tax avoidance and evasion and pay my taxes once the accountants are done crunching the numbers. I'd just watched with my housemate Panorama and the 9 O'clock news which was mostly a repeat of Panorama. I was explaining to her the concepts around offshore banking, money laundering, tax avoidance (legal) and tax evading (illegal). After I explained these topics in detail and my objection to not paying, I described a few ways of avoiding tax that were perfectly legal.

I then said that I was thinking of starting a company on the lovely Caribbean island of Antigua, with subsidiaries in Jersey and the Isle of Man. Her reaction when I asked if she would she mind paying the rent there instead of to me was priceless. When she'd worked out I wasn't being serious she then asked why Antigua? Oh it's a nice out of the way place with a good amount of sunshine and a 5 star hotel that I can make a few business trips to. That, the fact that the US State Department don't like it and Bearer Shares*!

*Antigua is attempting to be more compliant with FATF rules though.

[JimboSmith]

Re: Live by the sword, die by the sword

I would recommend The Great Tax Robbery by Richard Brooks if you want a good read on this subject. He wrote/writes for Private Eye has presented Panorama and was on the show last night. When he writes in that book about some of what goes on it's just staggering. Companies avoiding tax in some of the poorest nations etc.

[Loyal Commenter]

If there is no definitive evidence that any data had left [their] systems, how do they know it was the work of a hacker, and not a leaker? Presumably all they can prove is that they were hacked, not that the hackers stole the data, so if they cannot show otherwise, it is entirely plausible that a mole used this as a cover to leak the data.

[Yet Another Anonymous coward]

The old - it must have been a vampire that killed her because there is no evidence of a werewolf - defence

[Blotto]

@Loyal Commenter

I guess they are saying they have no evidence of all the data being bulk accessed internally and have no evidence of it leaving their infrastructure, yet 3rd parties have their bulk data so the only logical conclusion is that they must have been hacked in such a sophisticated manor that the forensic investigators they hired can not determine how.

Probably a government with sophisticated abilities obtained the data and was either hacked themselves or has now leaked it to do some damage to someone.

That or their forensic investigators are too crap to work out what happened.

I suspect that in retrospect that much data leaving the organisation would be detectable & as they can't that is why they are claiming they have been victim to a sophisticated hack.

If they can be believed it will be interesting to read what their security measures are & should be a warning to all other international institutions that hold data that should remain private.

[Roland6]

2+2 = 5 ! :)

I guess they are saying they have no evidence of all the data being bulk accessed internally and have no evidence of it leaving their infrastructure, yet 3rd parties have their bulk data so the only logical conclusion is that they must have been hacked in such a sophisticated manor that the forensic investigators they hired can not determine how.

Well it should be obvious to any El Reg reader how this hack was done:

Appleby were using Kaspersky...

[Mark 65]

I guess they are saying they have no evidence of all the data being bulk accessed internally and have no evidence of it leaving their infrastructure, yet 3rd parties have their bulk data so the only logical conclusion is that they must have been hacked in such a sophisticated manor that the forensic investigators they hired can not determine how.

Or alternatively that their security is so utterly shithouse whilst they are busy clipping the lucrative ticket on tax avoidance that they really cannot tell. Absence of evidence is not evidence of absence and all that. I wouldn't be surprised if someone grabbed it all with an external drive and a USB stick with Kali/Tails/whatever on it. In fact, probably just the external drive.

[wolfetone]

With all the coverage that's being given to Queen Liz's financial affairs (or should that be the UK tax payer's affairs?), it's upsetting to know that the real juicy story of the whole thing has been ignored.

It turns out that Bono's money moves in mysterious ways.

[Anonymous Coward]

It turns out that Bono's money moves in mysterious ways.

Indeed. Hypocritical little twerp that he is.

[Yet Another Anonymous coward]

That's rich - when Ireland isn't enough of a tax haven for you

[Anonymous Coward]

Paying even less tax than Ireland must be the sweetest thing.

[Yet Another Anonymous coward]

I thought Bono bought Ireland in a bankruptcy sale back in 2008 ?

[Anonymous Coward]

Magnificent.

I expect his bank statements go to a obscure PO box. Somewhere where the streets have no name.

[Anonymous Coward]

It's a beautiful day when someone like Bono gets caught out.

[Fatman]

RE: Paying even less tax...

<quote>Paying even less absolutely NO tax than Ireland must be the sweetest thing.</quote>

There!!!

FTFY

[JLV]

wait... wait... I am confused.

is that the same activist Bono who frequently complains that industrialized countries don't do enough 3rd world aid? (which presumably requires more taxation)

and whose band is tax-registered in the Netherlands, because less taxes than Ireland?

[phuzz]

Bono's not being ignored, it's just there's so many different famous people fiddling their taxes that the press doesn't know who to start with. This will continue to play out over the next few months whilst various celebs and their lawyers refuse to comment and in the end practically nothing will change, because those in a position to do something about, for instance, tax evasion in the Channel Islands, have too much to lose.

[tiggity]

El Maj

Given the Queen has a nice cozy arrangement with herRC where she (well, her fiancial bods) get to choose what (relatively miniscule else it would be publicized) amount of tax she pays then Cayman stuff would be financial bods on autopilot as their usual legal (cos laws are useless), but morally reprehensible offshore stuff was not needed.

Not enough hassle of queenie for investing in BrightHouse, a company thet exists to shaft poor people with loan shark levels of interest repayment (where a bog standard fridge can easily be over a grand in repayments over several years): SHe has people doing the finances for her, but it;s not difficult to say only make ethical investments, do all finacial stuff in a transparent and above board way.

Still, living up her figurehead of teh nation status, rich elite screwing over the proles is what the UK is all about.

[deadlockvictim]

I can imagine the conversation

Sir Humphrey: What I want is irrelevant, Bernard, it's up to you - what do you want?

Bernard: I want to have a clear conscience.

Sir Humphrey: A clear conscience?

Bernard: Yes!

Sir Humphrey: I see. And when did you acquire this taste for luxuries?

[Anonymous Coward]

Surely to the Queen, having money in a country that she is queen of, isn't "of-shore", just in another of ones countries

[Anonymous Coward]

You will go far:

"Arise Sir Anonymous Coward".

[Adam 52]

Quite. The Cayman Islands are a British Overseas Territory. The Queen appoints the Governor. They've even got a Westminster cabinet minister. Hardly wild west.

And, most importantly in this instance, they've got a cosy relationship with the UK taxman where they report income earned by UK residents direct to HMG.

[frank ly]

Her Maj's private assets are estimated to be about £500m so it's hardly surprising that she had £10m tucked away there. When you have that much, you tell your people to split it up and put it in sensible places for you. (So I assume. I'll never have anything like that 'problem'.)

[BebopWeBop]

Well one needs to squirrel ones assets away, before the revolution.....

[Anonymous Coward]

£500m?

She's a Queen! Her corgis have more than that.

[Fruit and Nutcase]

HM's mattresses

@frank ly

split it up and put it in sensible places

Under one's mattress at Balmoral, Buckingham Palance, Sandringham and Windsor Castle are perfectly reasonable

[defiler]

Surely to the Queen, having money in a country that she is queen of, isn't "of-shore", just in another of ones countries

It'd be like leaving some cash in a coat pocket when it goes into the wardrobe. Probably just loose change between the cushions...

[W Donelson]

Go after Appleby directors' tax evasions.

[John Brown (no body)]

Can you evade or avoid tax in a tax haven?

[frobnicate]

"that Russia funded Facebook and Twitter"

Here is a real bomb: Russia, on the direct orders of Putin, funded all recent US governments by buying US Treasury bonds to the tune of 100B! And China... oh hell, we are doomed.

[Alan Brown]

Re: "that Russia funded Facebook and Twitter"

"buying US Treasury bonds to the tune of 100B! "

Aka less than the value Broadcom attributes to Qualcom and vastly less than the Trillions that the US spends on its military each year.

[Anonymous Coward]

Re: "that Russia funded Facebook and Twitter"

We haven't hit a trillion dollars in annual military spending yet. If Trump gets his way for more unneeded increases in spending, it might get to 3/4 of a trillion so we will probably reach it eventually.

When trillions are talked about in the context of US military spending it is overall programs over many years, like several trillion for the post 9/11 'war on everyone' and a couple trillion for the F35 that will be spend over a couple decades.

[JLV]

Re: "that Russia funded Facebook and Twitter"

a trillion here. a trillion there. pretty soon you're talking real money and can afford some F35s.

oh, you want them to work? chip in some extra $$$$$$$$$s.

[Anonymous Coward]

As with the Panama Hack I'm not impressed. Who gives the ICIJ the right to decide what gets published?

I don't care who it is I would like to know every single one that is actively avoiding tax or in fact evading it.

I mean, look at the front page of the BBC "Paradise Papers: Mrs Brown's Boys stars 'diverted £2m in offshore tax dodge'", I mean seriously is that the best you have?

It stinks of a cover up.

[Adam 52]

The BBC article no longer says that. Possibly their lawyers got nervous. As El Reg's might if this thread continues.

[Red Bren]

"Who gives the ICIJ the right to decide what gets published?"

The ICIJ spread the workload out as there was too much to sift through for any one publication. Each publication will focus on persons relevant to their home turf, as you're about as likely to be interested in the financial arrangements of some minor German celebrity as a German would be in some UK sitcom actor. So on those grounds, it makes sense to localise what is being reported.

The fact that the BBC decided that sitcom actors were a more newsworthy target than some of the wealthier but unheard of entrants on the list, suggests that the BBC makes its decisions based on what the public are interested in, rather than what is in the public interest.

[Doctor Syntax]

"the BBC makes its decisions based on what the public are interested in, rather than what is in the public interest."

The media view these days seems to be that the latter means the former.

[allthecoolshortnamesweretaken]

"... what the public are interested in, rather than what is in the public interest."

Well put. Also part of quite a lot of other problems.

[Gordon 10]

Err you do know the Panama papers dataset was put online afterwards? If you are that paranoid I suggest you go trawling for the gaps you think exist.

[Anonymous Coward]

I stand corrected, I was unaware of this.

In case anyone is interested,

https://offshoreleaks.icij.org/pages/database

Thanks.

However you do still have to question how each media organisation chooses it's stories and if any are left out.

Edit: I still can't download all the data, I guess its something but then how do I verify nothing has been removed?

Edit 2:Added for comedy.

https://twitter.com/GLove39/status/927499073971802112

[Anonymous Coward]

" you do still have to question how each media organisation chooses it's stories and if any are left out."

You do indeed, but not just on this subject. For example a few years ago when Bob Diamond and his mate Marcus Agius were in charge at an increasingly embattled Barclays Bank, every news outlet under the Sun was covering Barclays difficulties in reasonable depth. Not for the first time, the BBC had little to say on the subject. Obviously it couldn't be connected to the little detail that Agius was a senior director on the BBC board.

No potential conflict of interest there, whatever those pesky shareholders at the Barclays AGMs might have suggested on more than one occasion.

http://www.telegraph.co.uk/finance/newsbysector/epic/barc/9401300/BBC-executive-questions-why-Barclays-chairman-Marcus-Agius-remains-on-corporations-board.html

[Anonymous Coward]

Re: "breaking no laws"

"Many tax avoiders seem keen to point out that they're breaking no laws. "

And some serious tax dodgers realise that if anyone with a clue gets to question them properly, they've had it. Illegal or not, their activities are despicable, most people would regard them as indefensible, and laws can be changed if there's good reason.

But that dialogue can't be allowed to happen in public. Hence this ultimately rather pointless two minute snippet where a BBC Panorama reporter tried to question well known Tory donor and tax dodger, Lord Ashcroft, while both were out and about. And the reporter gets nowhere, because people like Ashcroft know their behaviour is indefensible even if it's not yet illegal.

https://www.youtube.com/watch?v=SMBXARpIqME

Ashcroft has form on this subject, as has Panorama. This from 2010:

https://www.youtube.com/watch?v=F-cwhIodMek

"Lord Ashcroft, the biggest political donor since records began, resigned as deputy chairman of the Conservative Party in September 2010. His millions helped bank-roll David Cameron into power, but where does Lord Ashcroft's money come from? Panorama travels to other countries he calls home, and hears allegations about secret deals and tax avoidance."

[nijam]

> It stinks of a cover up.

Or of people being framed.

[Roland6]

I don't care who it is I would like to know every single one that is actively avoiding tax or in fact evading it.

Well what is interesting, given the names in the headllines, is to consider the names not in the headlines: Microsoft, Google, Starbucks, Amazon etc. ie. the US companies some in the UK/EU accuse of tax avoidance. This isn't to say they aren't doing what Apple are doing, just that they must be using a different offshore law firm if they are.

[Duffy Moon]

Tax avoidance

Many tax avoiders seem keen to point out that they're breaking no laws. Perhaps it's time for some new laws?

[Yet Another Anonymous coward]

Re: Tax avoidance

I'm sure the politicians mentioned in the papers are rushing to draft new laws to stop the sort of thing they have just discovered they are doing

[Brewster's Angle Grinder]

Re: Tax avoidance

We have some General Anti Abuse Rules. Whether they cover these cases and whether HMRC have enough resources to prosecute, are another matter.

[maribert]

It's "Süddeutsche".

If you want to refer to "Süddeutsche Zeitung" by a short name, use "Süddeutsche". That's what any German speaker would do. "Zeitung" just means "newspaper" and could be any German-language newspaper that have that word in their name ("Frankfurter Allgemeine Zeitung" comes to mind, which consequently is commonly referred to as "Frankfurter Allgemeine", or "FAZ").

But if you say "Süddeutsche", everyone with a passing knowledge of the German press landscape will know what you are talking about.

[Anonymous Coward]

Re: It's "Süddeutsche".

Updated, thanks.

[Mystic Megabyte]

Welcome to the new order

From the ICIJ site:

https://www.icij.org/investigations/paradise-papers/paradise-papers-exposes-donald-trump-russia-links-and-piggy-banks-of-the-wealthiest-1-percent/

One offshore web leads to Trump’s commerce secretary, private equity tycoon Wilbur Ross, who has a stake in a shipping company that has received more than $68 million in revenue since 2014 from a Russian energy company co-owned by the son-in-law of Russian President Vladimir Putin.

In all, the offshore ties of more than a dozen Trump advisers, Cabinet members and major donors appear in the leaked data.

I think that the GOP may well have made the biggest mistake in their entire history.

[Suricou Raven]

Re: Welcome to the new order

Don't be so sure. Trump is scandal proof - he shrugs off things which could kill the career of anyone else. That means he is potentially a powerful tool for pushing the party agenda through an uncooperative congress - and he is largely loyal to the party agenda, if only out of convenience.

[Anonymous Coward]

Re: Welcome to the new order

Such revelations would seem to hurt his campaign against "the swamp" when it is shown we traded in the alligators and crocodiles that have inhabited previous administrations' swamps for Krakens and Loch Ness monsters.

Unfortunately he is the first US president with state-run media at his disposal - Fox News will say whatever he wants and no longer cares about the truth - the idea that they are "fair and balanced" is as outdated as the idea Google does no evil. So he will pronounce these leaks about his cabinet as fake news cooked up by democrats and Mitch McConnell to damage his presidency and the 35% of the voters who will support him even if he shoots someone on Fifth Avenue will swallow the lies hook, line and sinker.

It might be enough to get some of them to resign, if they are concerned there is more dirt on them hidden in those documents that could lead to jail time - figuring that once they resign the press will lose interest in them and might not expend the effort necessary to dig up said dirt.

[Rattus Rattus]

Re: "Fox News [...] no longer cares about the truth"

Are you implying they ever did?

[Anonymous Coward]

Re: "Fox News [...] no longer cares about the truth"

They used to basically be the same as other news outlets, just a bit of a conservative slant. Oh sure, the opinion shows like O'Reilly were pretty obviously slanted, but their actual reporting of the news was hard to distinguish from everyone else most of the time.

It REALLY changed in a massive way right when Trump was nominated. A lot of Trump supporters were abandoning it because they felt it was just another MSM site and were fleeing to Breitbart and other places. I guess Fox figured they had to shift with their audience, and now it is totally indistinguishable from what it was 18 months ago, and reports on Kelly Conway's world of alternative facts. It is basically Trump TV.

[ecofeco]

No honor among thieves

Seems like fair turn-about to me.

Steal from the masses and hide the money then get outed by someone else who steals.

Poetic justice, that.

[Anonymous Coward]

Not an insider? IMHO not a credible statement

Let's not forget, this is 1.3 TERAbyte of data that had to be extracted.

1 - if this was via the Internet, it would either take a flaming long time doing it slowly or someone would have noticed 1.3TB of EXIT traffic, typically not the biggest circuit (incoming is usually bigger). Either way, for this to happen without anyone spotting it means their security and performance monitoring either doesn't exist, sucks badly, or was overseen by someone in on the job.

2 - even carrying it out physically must have taken some work - unless someone sidelined an offsite backup run that wasn't encrypted. Again, not an impressive performance of their security unless it involved multiple people.

I just can't see that sort of data volume exit without insider help. It literally doesn't add up.

[Adam 52]

Re: Not an insider? IMHO not a credible statement

I've shared 64TB datasets on a few occasions without anyone noticing. Whether those sorts of volumes are significant depends on the organisation and the architecture. Helps if you arrange it such that the bandwidth bill goes to the right place.

[Blotto]

Re: Not an insider? IMHO not a credible statement

@Adam 52

no one noticed i assumed at the time, but if they went looking in retrospect would they see it?

[Slx]

I get a bit fed up with it.

As someone trying to operate as a tax-compliant, self-employed contractor in Ireland, I end up paying rather a lot of tax.

Yet, if you've the right tax advisor and enough money, or you're a multinational, tax is clearly optional and that's far from unique to Ireland as you can see.

Basically we've two parallel global economies: one for those in the know with enough resources to use it and one for the rest of us plebs who pay for all the services.

[Oengus]

Re: I get a bit fed up with it.

Basically we've two parallel global economies: one for those in the know with enough resources to use it and one for the rest of us plebs who pay for all the services.

I thought this has always been the case. One rule for the rich and another for the poor... Why do the politicians allow this - so they can exploit it for their benefit.

[jake]

Re: I get a bit fed up with it.

It's called "The Golden Rule".

As in "He who has the gold makes the rules".

This has been a fact since time immemorial.

[Anonymous Coward]

Didn't a member of the 0.01% say something about "no such thing as privacy anymore" when referring to people complaining about the 'connected world' ? Seems their peers weren't paying attention ( or assumed that like so much else it didn't apply to them ).

[Lion]

A Taxing decision

Paradise - A sunny place for shady people.

Who owns the decision to investigate the leaks from this hack and do something about it? Obviously the media has decided to wade through the information and expose any suspicious activity, but that will not be enough - been there, done that with the Panama Papers. The decision can only come from a government with titanium balls. The offshore tax account holder needs to hear that the tax man cometh this time with the equivalent of a Tsar Bomba in hand.

[Anonymous Coward]

To be fair

That £10m belonging to Liz was just found down the back of a couch.

The clasp on her handbag must be loose.

[Mark 65]

Re: To be fair

I assumed it was petty cash for when she next visits her overseas territories in the Caribbean.

[EnviableOne]

Tax Havens

Has anyone else noticed that the UK.gov are juming up and down about Off shoring and tax havens, and the three bigest tax havens Caman Islands, Bermuda and Jersey are all overseas teritories or crown dependancies.

If they want to crack down, all they need to do is enforce international tax agreements on the OSTs and CDs

[Twanky]

One rule for the rich...

Oh now I understand.

If someone collects and leaks a truckload of personal/financial information about ordinary people then they're scumbags. If its about people richer than you then it's disclosure in the public interest.

Got it.

[strum]

I'm not one to defend plutocrats, but the coverage of this story in the UK has been awful (don't know about elsewhere).

Everyone seems to be focussing on famous names (who haven't actually done anything much wrong) - just because they're famous. It's little better than gossip.

The Queen hasn't avoided (or evaded) any tax. Bono hasn't avoided (or evaded) any tax. Yet they're headline news - just because we know something we didn't know yesterday. Pathetic.

[Anonymous Coward]

"I'm not one to defend plutocrats, but the coverage of this story in the UK has been awful (don't know about elsewhere)."

Bollocks - The various mainstream media outlets will report in a style relevant to their readership. The horses mouth (The Guardian) in this case has had a broad array of angles since day one - https://www.theguardian.com/news/series/paradise-papers

Some famous names, some influential organisations, some political angles, some extreme examples of what's so wrong, some social comment. Of course the Sun is gonna focus on Mrs Brown's Boys and Lewis Hamilton.

[Gigabob]

Another reason for Higher IT Security Investments

Previously this type of breach, Home Depot, Sony, Equifax, Target - hit the public and there were no consequences for the actual groups who compiled and lost their client data. Hopefully this hits the 1% in their pocket books and public accountability in such a way they start the process of making those who suffered the data breach as liable for fines, penalties and legally responsible for the aftermath. This will result in significantly greater focus on encrypted documents, new processes, better protection and move the costs of security failure from an externality born by clients (you and me) to a direct cost of business for these organizations.