GCHQ intern jailed over data breach which risked exposing 17 colleagues
Manchester University computer science student Hasaan Arshad, 25, was in 'flagrant breach' of tight security rules when he used his mobile phone to remove material from a computer system and transfer it to his private computer on August 24 2022.
The defendant, who has an autism spectrum disorder, was said to be an academically gifted 'perfectionist' who was motivated by a desire to complete the project he had been tasked with at GCHQ as his placement was coming to an end.
But sentencing him on Friday, Mrs Justice McGowan said his was 'intellectual arrogance' and he acted under the belief that the 'rules do not apply to him'.
Arshad, from Rochdale, Greater Manchester, pleaded guilty to an offence under the Computer Misuse Act which carries a maximum penalty of life in prison.
The defendant also admitted two charges of making an indecent photograph of a child in relation to 40 category A videos and four category B videos downloaded from the dark web and found on his personal phone following his arrest.
Sentencing, Mrs Justice McGowan jailed Arshad for six years for the data breach and a further year and a half for the sexual offences.
She said: 'The risk raised by this conduct was at the highest level.
'I accept there is no evidence of any intention to sell, disclose or ransom the material.
'The risk was obvious and the actual damage that might have followed is incalculable.'
The judge went on: 'The consequences are that all the material taken and anything linked to it is now valueless at best and positively dangerous at worst.
'It has been destroyed and alternatives have had to be found. There is a huge economic loss, additionally there is a loss of trust with our allies and damage to the standing of our security which can only be of benefit to others. Additionally these acts have damaged the security of others working for GCHQ.'
Part of the hearing – including a detailed assessment of the harm caused – was held behind closed doors in the absence of the press and public.
However, the court was told that Arshad's actions 'lost a tool' being developed at GCHQ, risked exposing the identities of 17 GCHQ colleagues, and undermined the trust of partners.
Opening the facts in open court, prosecutor Duncan Atkinson KC said the data breach also 'created a significant risk of damage to national security'.
The GCHQ headquarters in Cheltenham (PA)
The Government Communications Headquarters – known as GCHQ – is the UK's intelligence, security and cyber agency and plays an important role in keeping the country safe, in conjunction with MI5 and the Secret Intelligence Service (MI6).
The highest levels of security are needed for GCHQ to carry out its work to gain information about threats to the UK from 'hostile states or terrorists' by using lawful covert tools and techniques, the court was told.
Mr Atkinson said: 'Put bluntly, if hostile states or terrorists were aware of how GCHQ was able to gather intelligence about their plans, they would be able to prevent the intelligence community in the UK from learning of those plans at a stage and to an extent that allows the intelligence community to thwart them.'
At the time of the offence, Arshad was coming to the end of an industry year placement with a technical development team which required him to work at a secure GCHQ site near Cheltenham, Gloucestershire, and use computer systems.
The court heard he was part of a team that worked on the development of 'tools and techniques' to obtain information about threats to the UK.
Arshad had undergone GCHQ induction and was required to sign the Official Secrets Act.
It was made 'abundantly clear' to Arshad that his access to top secret material had to be in controlled circumstances at 'an extremely secure location', Mr Atkinson said.
He went on: 'In flagrant breach of those obvious and necessary restrictions, the defendant used a mobile handset provided for his use whilst on his work placement but with strictly confined scope as to its permitted use, to remove top secret material from the top secret network of the technical development team to which he had been attached.
'He then transported that material from the secure location where he had been working to his home, risking it falling into the wrong hands or being lost, and downloaded it onto a removable hard drive which formed part of the IT system that he used at his home address.
'This significant security breach compromised lawful intelligence-related activity that was being undertaken in the national interest. In doing so, he threw away many thousands of hours of work, and significant sums of taxpayers' money.'
Mr Atkinson said his actions had damaged 'confidence in UK security' because the data included the identities of a 'significant number' of GCHQ colleagues and put others' safety at 'direct risk'.
Following his arrest, the defendant, who went on to achieve a first class honours degree, admitted removing data without authorisation 'out of curiosity' saying he had no intention to share it.
He told police: 'I'm sorry for my actions and I understand the stupidity of what I have done.'
Arshad said he 'went out of my way' to ensure the data was stored locally and not in the cloud.
Mitigating, Nina Grahame KC said the defendant had been 'reckless' 'thoughtless and naive' and put his 'possessive' desire to complete his project above all else.
He took the data home because he wanted to 'continue and complete the most exciting and challenging work the defendant had ever undertaken' in the hope of gaining future employment at GCHQ, Ms Grahame said.
The court was told Arshad was driven by ambition and perfectionism having achieved the second highest mark in the country for his computer science A level.
His parents were 'distraught and heartbroken' at what happened and 'feared' for his wellbeing in prison, Ms Grahame added.
Bethan David, head of the Crown Prosecution Service Counter Terrorism Division, said: 'Hasaan Arshad knew his actions were prohibited after he signed the Official Secrets Act and received his induction training.
'His conduct was deliberate and intentional, and represented a flagrant breach of the obvious and necessary rules in place.
'The Crown Prosecution Service will always seek to prosecute anyone that knowingly jeopardises and endangers the safety of our country.'
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Daily Mail
2 hours ago
- Daily Mail
Former sub-postmistress SEEMA MISRA: Princess Anne gave me an OBE, but if people don't go behind bars for what they've done, we'll give it back...
When Seema Misra was told that the King wanted to award her an OBE for 'services to justice', she was unsure whether to accept it. 'I was shocked,' she says. 'It's a good thing, it's a title I respect, it's the Royal family.' But for Seema, 50, there were strong reasons to turn it down, as justice – in her case and in that of so many others – has still not been served. Almost 15 years since the former sub-postmistress was jailed for 'stealing' £74,000 from the Post Office, and four years since her conviction was overturned, she has yet to receive full damages – or see consequences for the people who ruined her life. YOU covered the sub-postmasters' case in 2022, and ITV 's 2024 drama Mr Bates Vs The Post Office re-ignited the public's interest. 'Now people tap my shoulder in the supermarket and say, 'The whole country is behind you', which is powerful to hear, but we're still living with this injustice, day in, day out.' Seema accepted her OBE, attending the ceremony at Windsor Castle in April with her husband Davinder, 54, sons Aditya and Jairaj, 24 and 13, and her elderly mother-in-law. HRH The Princess Royal presented the award. 'She was really good,' says Seema. 'I started explaining that we still wanted accountability, but she knew everything already. She congratulated me for not giving up. It was a good day.' And yet Seema is adamant, 'If people don't go behind bars for what they did, we will be giving the OBE back.' She has every reason to be angry. We meet in the Surrey home she shares with her husband, his mother and their sons. It has five bedrooms and a yard for their two dogs. They have been here a year, a move made possible by two interim compensation payments. Before this, the family shared a one-bedroom flat: the Post Office had taken their business, capital, property and good name. It's hard to convey how much they lost. 'Seema and I came to the UK with zero pence and big goals,' says Davinder. Arriving from New Delhi in 1999, the newly married couple worked hard – in restaurants, at Tesco and at an estate agent. In less than two years, they bought their first buy-to-rent property at auction. They soon built a thriving property business, and in 2005 sold most of it to buy the West Byfleet Post Office and shop. But there were problems with Fujitsu's Horizon IT system from the start. 'At the end of the first day, the system recorded a shortfall of £100,' Seema recalls. A trainer who was teaching her the system instructed her to take £100 from the till in the shop – the couple's own separate business – and put it into the Post Office to balance the books; otherwise, they couldn't open the next day. This pattern continued, with Seema increasingly alarmed. The next week there was a different trainer, who noted the constant shortfall and called the Horizon helpline. The advisor talked the trainer through an IT procedure – at the end of which the shortfall doubled before their eyes. Still, at the end of that week, the trainer just left Seema to it. Years later, when lawyers tried to call these trainers as witnesses in her trial, the Post Office claimed they didn't exist. The shortfalls mounted, in 2008 Seema was suspended and in 2010 she stood trial for theft and false accounting. A warm person who laughs easily, she somehow remained strong and optimistic throughout the legal proceedings. 'I'm good, honest, god-fearing and I'd done nothing wrong, so I really believed it would be OK,' she says. Mid-trial, she found out she was pregnant – the couple had been trying for a second child for eight years and Seema had been treated for polycystic ovary syndrome. 'I was happy, but when I told Davinder he just said, 'OK.' He had no expression at all.' Davinder remembers it. 'Normally, I'd have been jumping up and down, but I could see the way this was going. I knew they were going to take Seema away from me.' The guilty verdict confirmed his worst fears. Seema was sentenced to 15 months in prison on 11 November 2010, Aditya's tenth birthday. This is the point where her voice breaks and her eyes fill with tears. 'I can't come to terms with going to prison,' she says. 'It's the shame. The stigma. We believed that only bad people go to prison.' She and Davinder kept her conviction secret from her parents in India and from Aditya, who was told his mum was in a special hospital because of her pregnancy. 'If I hadn't been pregnant, I'd have killed myself,' she says. 'The cells were filthy, the meat was halal, which I couldn't eat. There was a lot of self-harming, so when you used the phone there'd be blood on it.' When Seema was released after four months for good behaviour, she barely left home. She gave birth to their second son, Jairaj, wearing her electronic monitoring tag. 'All I could think was, 'What must the midwife think? What kind of mother did she think I'd be?'' For years, even while Seema joined other Post Office victims to clear their names, the shame continued. 'I'm proud of my family but I didn't want the world to know my sons were related to me,' she says. 'I never took them to school or picked them up. At my son's cricket matches, I wouldn't go on to the field. I'd park where I could see him without others seeing me.' A group action of 555 sub-postmasters, including Seema, led to the 2019 High Court ruling that the Horizon IT system was 'not remotely robust'. The case was settled for £58 million, leaving claimants with £12 million after legal costs. And in April 2021, Seema's own conviction was officially overturned. A public inquiry established that bugs in the Horizon system had been detected as far back as 1999, but that the Post Office had withheld evidence and edited witness statements to support their prosecutions. The Metropolitan Police has opened a criminal investigation into personnel from the Post Office and Fujitsu. 'I want every single person named in the inquiry, from the government, the Post Office and Fujitsu, to be held accountable,' says Seema. Paula Vennells, the former Post Office CEO, has had her CBE revoked, but for Seema it is not enough. 'This isn't just about people 'making a mistake',' she says. 'How could I be sent to prison, with no evidence, for a crime I didn't commit, when so many people who lied and withheld evidence are still walking around with no criminal consequences? Paula Vennells is just one person. Alan Cook, a former Post Office managing director is another. Angela van den Bogerd, a Post Office executive, is another. There are so many.' To date, £892 million has been paid to more than 6,000 claimants, with many receiving far less than they believe they're owed. Sir Alan Bates recently accused the government of running a 'quasi kangaroo court' payout system for victims, and revealed he has been offered less than half of his claim. 'They are dragging it out to wear us down,' says Seema. 'It's like torture. They hope we'll accept a lower figure because we want closure.' The Misra family is still waiting to see how much they will receive in total. Bates predicts it will be November 2027 before claims are settled at the current rate, and last month urged victims to take the government to court. Seema has her doubts. 'I've been through court and it's not easy. We'd be using public funds to fight the battle, and the Post Office would be using public funds to defend itself. I think it's a misuse of everyone's money.' Still, she understands why victims would take this route. 'I know the frustration and anger, as it is taking so long,' she says. 'It hurts to think of our business growth in our first five years compared to today,' adds Davinder. The couple sold their Post Office shop in 2010 for less than half they had paid for it. They have since moved away from West Byfleet and started again: they began building another portfolio, acquiring a property using the interim payment and helped by Aditya, who graduated from Imperial College London and works at Deutsche Bank. 'Through all this, our sons have been our focus,' says Seema. 'For years, we might be at meetings, court hearings or doing interviews when they were at school, but when they came home we put on a happy face. They never missed their cricket, tuition, guitar lessons… If they'd known what was happening, they'd be different people.' It wasn't until 2019, after the High Court ruling, that the couple told them the truth. 'Aditya was 19 and he was so shocked,' says Seema. 'He never knew I'd been to prison or anything. He read up about it, watched interviews with me and was so proud. And we're so proud of him. He has done so well. We have come through together.'
BBC News
3 hours ago
- BBC News
Music event in memory of murdered Shropsire man
A music event is being held in memory of a man who was murdered by his estranged Thursday, Amy Pugh from Wolverhampton was convicted of killing Kyle Pugh at her then-home in Newport, Shropshire, in March 2022.A Fringe Lounge night at La Luna bar in Wellington on Saturday has been organised by his friend Baz Pearce, who described Mr Pugh as a man who was "bubbly, kind and thoughtful to other people".It will raise money for ManKind, a charity that supports male victims of domestic abuse. A trial at Stafford Crown Court heard Pugh, 34, killed her ex-partner after an Pearce said he had known the victim since 2007 and had become close friends through the local music Pugh had been "like younger brother" he Pearce added that when the guilty verdict was announced "the stress and the weight off my shoulder was gone".He said it had been a "long fight" and it had been "emotional and upsetting to get to that final hurdle"."Justice is finally here," he said. The Fringe Lounge event will the third to be held, and they were set up to raise awareness of domestic Pearce said this one would also allow people to remember Mr Pugh."He reached out to a lot of people, he knew a lot of people," he said he also believed the crime highlighted that men could also be victims of domestic abuse. Follow BBC Shropshire on BBC Sounds, Facebook, X and Instagram.
The Guardian
3 hours ago
- The Guardian
‘A slap in the face': Grenfell officials still working in housing eight years after fire
The survivors of the Grenfell fire have condemned 'a deep and bitter injustice' that many of the officials criticised in the public inquiry in connection to the tragedy have continued working in related fields. 'We relive the pain every day. They are carrying on with life, careers intact, while we are still here – grieving, waiting and fighting for justice,' said a spokesperson for Grenfell United shortly before the eighth anniversary of the fire. 'The fact that some of the people involved are still working in housing is a slap in the face to every survivor and bereaved family. If there are no consequences for decisions that cost lives, what does that say about this country's values? Justice delayed is justice denied – and we will not stop until those responsible are held to account.' Dozens of the individuals implicated in the Grenfell disaster, from civil servants, government ministers, councillors and corporate executives have gone on to have successful careers, many of them still involved in housing and local government. Laura Johnson, who was director of housing at Royal Borough of Kensington and Chelsea (RBKC) at the time of the fire, is now an interim director of property and development at Barnet Homes, which manages and maintains 13,000 council homes. The inquiry found she had slowed down the installation of self-closing mechanisms on fire doors for 'financial and practical reasons', despite being urged to do so by the London fire brigade. It was found that inadequate fire doors, particularly those lacking self-closing mechanisms, allowed smoke and fire to spread more quickly than expected on the night of the fire. She also pushed for a new contractor to carry out renovation works on the block on a lower budget, which ultimately meant metal cladding was swapped for combustible plastic-filled panels to save money. Johnson has continued working in the housing sector since the fire, including as a consultant at two housing associations and a council. Her LinkedIn profile states that in her current role she has 'overarching responsibility' for delivering health and safety compliance 'including fire and building safety'. Johnson has not responded to a request for comment. Brian Martin, a civil servant who admitted to being a 'single point of failure' on the run-up to the fire, has since gone on to act as a fire safety expert witness and testified in the first UK cladding tribunal case in 2023. He allegedly said: 'show me the bodies' – an accusation he has denied – when he was advised to tighten fire safety rules to prevent a tower block disaster, and was in charge of official building regulations for almost 18 years prior to the fire, which killed 72 people. The inquiry found that in January 2016, 18 months before the Grenfell blaze, he had written that when ACM cladding was exposed to fire, 'the aluminium melts away and exposes the polyethylene core. Whoosh.' He was then urged to tighten the rules on ACM panels in the UK but failed to do so. He continued working within the Ministry of Housing, Communities and Local Government with a role in the planning directorate until at least 2022, although he no longer works in the department. He gave evidence as a 'fire safety expert' at a cladding tribunal in 2023 in which he was praised for 'being balanced, knowledgable and thoughtful'. The Grenfell inquiry found he had no formal fire safety or engineering qualifications at the time of the fire. The Guardian has attempted to contact Martin for comment. Deborah French was a sales manager at Arconic – the multibillion-dollar US company that made the combustible cladding panels on Grenfell Tower – and has admitted she knew the cladding she was selling could burn but did not tell customers. Before the fire, in 2015, she began working at the building materials supplier Taylor Maxwell, where she became their national cladding director, a role she held until 2023. During the public inquiry she said she knew the polyethylene product could burn but she didn't 'specifically explain' this to her customers, although if she had been asked the question, she would have. She also said she had not seen the building regulations guidance on fire safety. Sign up to Headlines UK Get the day's headlines and highlights emailed direct to you every morning after newsletter promotion Taylor Maxwell said French's work during the course of her employment with them did not relate in any way to Grenfell Tower. The Guardian has attempted to contact French for comment. Nicholas Paget-Brown, who was the leader of RBKC at the time of the blaze and initially resisted calls to resign in the face of mounting criticism of his authority's response, now runs a consultancy firm on public policy issues. He resigned weeks after the fire, after accusations of badly organised relief efforts and little support for residents who were left homeless. The inquiry report found he was 'unduly concerned for RBKC's reputation', with the council's response described as 'muddled, slow, indecisive and piecemeal'. According to Paget-Brown's LinkedIn profile, he is a managing director of Pelham Consulting, which tracks manifesto commitments and offers briefings on public policy issues. He did not respond to a request for comment. A Metropolitan police investigation into the Grenfell fire continues. Survivors and bereaved families have criticised the pace of the inquiry. Stuart Cundy, a deputy assistant commissioner at the Met, said: 'The Grenfell Tower fire is one of the most complex investigations ever undertaken by any UK law enforcement agency. We are investigating a range of very serious criminal offences including corporate manslaughter, gross negligence manslaughter and fraud, as well as health and safety offences. 'We cannot begin to imagine the impact that waiting for the outcome of our investigation must have on those who lost loved ones, those who survived, and all those affected by the tragedy.' He added that investigators had spent over a year forensically examining the tower, taking more than 13,000 witness statements and gathering more than 153m documents and files, with 195 dedicated investigators on the case. Barnet Homes have been approached for comment.
