SECRET SERVICES (7): Cybercops with side jobs

“Anything that can go wrong will go wrong.” This motto, also known as “Murphy’s Law,” can be found on the website of a Vienna computer expert. The man obviously has a sense of humor. It is none other than Christian H., the IT chief of the Federal Office for the Protection of the Constitution and Counterterrorism (BVT), which came under scrutiny during a raid in late February. Professionally, he is Austria's top computer agent. However, this does not stop him from monetizing his extensive qualifications – such as being a certified “Computer Hacking Forensic Investigator” – in his private time. We present the eighth part of the ADDENDUM investigation into the Austrian intelligence service.

H. is by no means the only employee of important Austrian security authorities who, in addition to their official duties, has time to pursue private business. In response to an inquiry from Addendum, the office of Interior Minister Herbert Kickl (FPÖ) stated, “As of 1.8.2018, 36 BVT employees and 113 Federal Criminal Police Office employees engage in approved sideline activities.”

Sensitive statement by a BVT witness

However, what is particularly striking is the concentration in the IT sector: In addition to Christian H., Addendum investigations reveal that several other computer experts at the BVT also offer private IT services. In the Federal Criminal Police Office, there are likely more than 15. When someone works in the heart of state computer security during the day and uses their expertise to make money privately in the evening or on weekends, the potential for conflicts of interest is significant. The alarm bells should have started ringing at the latest since one of the main witnesses in the BVT case made a statement.

Anton H., a mobile forensic specialist with the police who was assigned to the BVT until his statement in late February 2018, testified under oath as follows:

“I remember a case, this was at the beginning of December 2017, where as a result of a raid conducted in my office, there were about 60 mobile phones on my desk. H. (the IT chief, note) approached me and asked if I could read the call list, SMS conversations, and the address book from a specific mobile phone. I did it, believing that it was part of the investigation. The next day, in the hallway, I overheard a conversation between H. and G. (a department head at the BVT, note) where they were discussing a report. H. was holding this mobile phone in his hand and said to G. ‘400 for this data.’ It was clear to me that H. meant he had received EUR 400 privately for the report on the analysis of this data.”

Addendum sent questions to IT chief H. regarding his sideline activity. However, his lawyer declined to comment, even regarding the incriminating statement by Anton H. IT chief H. is a suspect in another context in the BVT affair, but has always denied all accusations.

Official data stored privately

The mentioned BVT IT employee Norbert B. is not a suspect, yet there was a raid at his place. The raid has since been declared unlawful by the Vienna Higher Regional Court. However, the investigating public prosecutor Ursula Schmudermayer stated in the BVT committee that “official data” was found on “private storage media” belonging to B. Moreover, B. runs an IT company on the side in the Waldviertel region.

Addendum asked the BVT employee, among other things, if he could rule out having used professional information for private or business purposes. His lawyer replied promptly: “My client will not answer any of your questions and reserves the right to take legal action if contacted by you again.” The lawyer also did not provide any information about the sensitive data discovery.

“Potentially legally relevant in individual cases”

The office of the interior minister provides the following general information on the topic of sideline jobs: “The exercise of a sideline job is to be reviewed by the employing authority. In cases where it hinders official tasks, there is a presumption of bias, or there is a risk to other essential interests, the sideline job must be prohibited in writing by the employing authority. A conflict of interest with work at the BVT could be potentially legally relevant in individual cases.”

Cybercop on a private mission

Nevertheless, strange business connections are not only found in the intelligence services. An interesting case is Erhard F., a “Cybercop” at the Federal Criminal Police Office. His wife runs an IT company – what a coincidence. Even though F. occasionally helps with his extensive computer knowledge, this may be due to the fact that he has a company email address. He did not respond to an inquiry. Instead, a spokesperson for the Federal Criminal Police Office stated that “we do not provide information on personal matters of our employees.” The website was last offline, but his wife's trading license is still valid.

The graphic inspector

The response from the Vienna State Criminal Police Office was similarly brief and brusque. Spokesperson Harald Sörös stated less than an hour after receiving an inquiry from Addendum about the sideline activities of LKA-Vienna employees that he could not provide detailed information. Detail figures, sorted by departments, could not be obtained “without significant administrative effort.” Furthermore, it was not “of any relevance to the public.”

It is surprising that the public may not find it interesting to know how many civil servants, paid for by taxpayers, have time for a sideline job despite demanding official duties. It is, however, understandable that Mr. Sörös may lack the time to handle the “significant administrative effort” in his job. A look into the commercial register reveals that the police spokesperson is also the managing director of a graphics company in Burgenland, which has a branch in the Lower Austrian district of Lilienfeld.

The NSA Connection

Josef R., head of the Cybercrime Unit at the Lower Austria State Criminal Police Office, does provide information about his sideline job. He owns an IT company, with a relative serving as the managing director. Nevertheless, R. has a company email address and is actively involved in the business.

This is interesting because R. has two old acquaintances: Gerald W. and Wolfgang H., the heads of the security firm NSA, who are currently facing a fraud charge. The case involves old mobile phones and suspicions that Meinl Bank was to be induced to pay €1.5 million.

Highly sensitive clients

R. is not mentioned in the investigation file. He confirmed in response that he has known NSA bosses W. and H. for 35 to 40 years from their shared police past and has provided services to them: “When there was an IT need, they came to me.” However, he did not conduct forensic investigations for the NSA, nor did he extract cell phone data. R. rules out conflicts of interest between his private and professional activities.

An invitation to a lecture organized by a bank in spring 2018 stated: “As the founder and owner of the company (...), Ing. R. provides specialist services to highly sensitive clients in the area of networks and security.” “Highly sensitive” is the right keyword. For many specialized investigators in public service and their sideline jobs.

By the way: Sideline jobs are much more strictly regulated at the Military Intelligence Office and the Defense Intelligence Service.

Addendum Article Series BVT:

The introduction on SPARTANAT: BVT in Austria: How broken was the intelligence service?

Part 1: The BVT – a faulty construct?

Part 2: Austrian Agent with an Agenda

Part 3: The “Chief Spy” who came from the party

Part 4: Agent Gridling – the other BVT affair

Part 5: The Wall of Silence

Part 6: The “Chief Spy” and the ÖVP

This article was first published on ADDENDUM. Copyright Text: ADDENDUM. Images: ADDENDUM

ADDENDUM Online: www.addendum.org