FRANCE: In French Inquiry, a Glimpse at Corporate Spying

The story has the elements of a corporate thriller: a cast of
characters that includes former French spies and military men, an
American cycling champion, Greenpeace activists and a dogged judge
whose investigation takes him from a sports doping laboratory outside
Paris to a Moroccan jail and to some of the top corporations in France.

Like installments in a serial novel, new revelations have been
dripping out since March. And while the climax is still probably many
months away, the story is providing a rare glimpse into the shadowy and
potentially lucrative business of gathering what corporations refer to
as "strategic intelligence."

"For most companies, on a daily basis there are many more things
going on than can possibly be handed off to the police," said Christian
Harbulot, director of the École de Guerre Économique, or School of
Economic Warfare, in Paris.

The companies they turn to for "extra help," Mr. Harbulot said,
include everything from corporate security giants like Kroll to what he
terms "small operators," ranging from ex-intelligence agents to
computer hackers.

The sprawling case unfolding in France involves a mix of the latter
and some of the biggest French companies, including Électricité de
France, the world's largest operator of nuclear power plants, and
Vivendi, the media and telecommunications conglomerate.

According to a case file compiled by the investigating judge, Thomas
Cassuto, and reviewed by the International Herald Tribune,
investigators stumbled on to the case almost by accident, in the wake
of a doping scandal at the Tour de France in 2006.

The American cyclist Floyd Landis was stripped of his victory that
summer after testing positive for elevated levels of testosterone. Not
long afterward, in November 2006, the French anti-doping agency filed a
criminal complaint charging that confidential documents related to Mr.
Landis's drug tests had been stolen and sent to the news media and
other labs. The documents had been altered in what lab officials said
appeared to have been an effort to discredit or embarrass them by
casting doubt on the handling of test samples. Investigators concluded
that one such e-mail message was sent from a computer using the same
Internet protocol address used by Arnie Baker, then Mr. Landis's coach.

A search of computers in the lab in Châtenay-Malabry, a suburb of
Paris, turned up a Trojan horse program that allowed an outsider to
remotely download files.

No evidence has surfaced to connect Mr. Landis or Mr. Baker to the
hacking, and both have vigorously denied any involvement. They did,
however, make use of the pilfered documents in their unsuccessful
campaign to overturn Mr. Landis's cycling ban, on the grounds that the
documents had entered the public domain.

The trail, picked up by a special cybercrime unit of the French
Interior Ministry, led to a French computer specialist, Alain Quiros.
He was caught in Mohammedia, Morocco, and questioned by French and
Moroccan officials there (It is not clear from the case file exactly
when).

Mr. Quiros initially denied any knowledge of the lab hacking, but
when presented with incriminating evidence found on his computer, he
confessed, telling investigators he had been paid €2,000 to €3,000, or
$2,800 to $4,000, for hacking into the lab. He identified Thierry
Lorho, head of Kargus Consultants, a corporate intelligence company in
Paris, as having instigated the computer attack.

Then things got complicated. As the French authorities delved more
deeply into Mr. Quiros's computer, they found a copy of the hard drive
of Yannick Jadot, the former campaign director of Greenpeace France, as
well as that of Frédérik-Karel Canoy, a French lawyer and shareholder
rights activist who has battled some of the country's largest
companies, including Vivendi and European Aeronautic Defense &
Space, the parent of the aircraft manufacturer Airbus.

Mr. Lorho, a former French intelligence agent, acknowledged his role
to the French officials. He told them that he had handed off the lab
data to another man, Jean-François Dominguez, who had paid him for it.
Both men are being formally investigated. Mr. Lorho also admitted that
he had collected data on Greenpeace. His client that time, he said, was
Électricité de France, which had paid him for "strategic intelligence"
on anti-nuclear campaigners.

Mr. Lorho has said his contacts at E.D.F. were "perfectly aware" of
the hacking and that such activities were understood to be included
under the two one-year contracts he signed with the company.

One, signed in April 2004, paid Mr. Lorho's company €12,000 a month;
a second, signed in November 2006, provided for €3,900 a month.

The investigation found that in addition to information on
Greenpeace in France, E.D.F. obtained data on the environmental
organization's activities in Spain, Belgium and Britain, where E.D.F.
last year agreed to buy the largest nuclear power company there,
British Energy.

E.D.F. has denied any knowledge of the cybertheft and has portrayed itself as a victim of illegal acts by Kargus Consultants.

But Judge Cassuto, who took over the three-pronged investigation in
April 2008, has declined to grant E.D.F. civil party status in the
case. The decision was upheld on appeal. Instead, the judge has
declared E.D.F. an "assisted witness," one step short of being placed
under formal investigation, and the chief executive of E.D.F., Pierre
Gadonneix, has been called in for questioning.

Alexis Gublin, the attorney who is representing E.D.F. in the case, said the company was cooperating "totally" with the inquiry.

Through their lawyers, Mr. Quiros, Mr. Dominguez and Mr. Lorho
declined to comment. Astrid Granoux, a spokeswoman for the prosecutor's
office, said Judge Cassuto and the prosecutor, Philippe Courroye, would
not discuss the case while the investigation was under way.

Spying by corporations on their perceived enemies is not new. In the
mid-1960s, General Motors sent private detectives to dig up dirt on the
consumer activist Ralph Nader when he began to criticize the auto
industry's safety record.

In 2006, top executives of Hewlett-Packard, infuriated by damaging
leaks from corporate insiders, hired investigators to spy on
journalists in an effort to learn their sources.

And over the past two years, some of the biggest companies in
Germany, including Deutsche Telekom, Deutsche Bank and the national
rail operator, Deutsche Bahn, have been caught overstepping the line
regarding surveillance of critics and their own employees.

People in the field of corporate intelligence say information in the
public domain is considered fair game. Theft of a computer hard drive
would normally be understood as a step too far, they said. But it might
not even be necessary as the technology advances: Experts say the
Trojan horse attack is giving way to automated targeting of the "cloud"
of information that people and organizations generate through their
online activities.

In the Cassuto investigation, the connection to E.D.F., which is 85
percent owned by the French government, has touched a nerve in France,
whose intelligence agents bombed and sank the Greenpeace ship Rainbow
Warrior in 1985 in Auckland, killing a photographer on board.

However, there has been no evidence to suggest that the French government was aware of or involved in the hacking.

In an interview with an intelligence Web site, Lerenseignement.com,
Mr. Lorho said he assumed "full responsibility" for hacking into the
Greenpeace computer, but he added that "I would like to see E.D.F.,
which sponsored the operation, take responsibility for its part."

On April 10, E.D.F. said that, after an internal investigation, it
had terminated its relationship with Kargus Consultants and, as a
"precautionary measure," temporarily removed from their posts two
corporate security employees who had been dealing with the firm.

The two - Pierre-Paul François, an site protection engineer and
former police officer, and his superior, Pascal Durieux, a security
manager and former French Navy admiral - have been placed under formal
investigation by Judge Cassuto. They have been transferred to other
duties but continue to work at E.D.F. and to draw their salaries, their
lawyers said. Both maintain their innocence.

E.D.F. also said it had terminated a contract with another corporate
intelligence company, Securewyse, based in Lausanne, Switzerland.

The French newspaper Le Canard Enchaîné reported that Securewyse had
been retained to monitor the French anti-nuclear group Sortir du
Nucléaire, whose spokesman, Stéphane Lhomme, has been under
investigation in France since 2006, when he passed confidential company
documents to the media.

Securewyse did not reply to numerous requests for comment, but a
company official told Le Canard Enchaîné that it had done nothing
illegal.

Mr. Jadot, who has since left Greenpeace and was elected June 6 to
represent western France in the European Parliament, said the case
showed "a systematic policy of spying by E.D.F."

But E.D.F. defends its need to keep an eye on activist groups.

"We have a duty to be vigilant," Jean-Marc Sabathé, the company's
security director, said in an April interview with Le Monde. "It's
important to know, for example, if this or that group is in the radical
extreme or if it is above board. But we have no need to pay hackers to
find out!"

Meanwhile, the investigation goes on, with Judge Cassuto alternating among the threads as resources and scheduling allows.

In the doping lab case, Mr. Dominguez, who has been described in the
French media as a photographer with links to French intelligence, told
investigators that he had acted only as a middleman, passing on the
data he received from Kargus to another man, who has not been located.

Judge Cassuto summoned Mr. Landis and Mr. Baker to Paris in May for questioning, but neither appeared for the hearing.

The judge has the power to issue international arrest warrants for
both men, although he has not indicated yet whether he intends to do
so.

Mr. Landis did not respond to requests for comment through Team Ouch, his new cycle-racing squad.

But he told Cycling News in November 2006, when rumors of the
computer hacking first surfaced, that "any claims attributing these
actions to me or my defense team are baseless, untrue, irresponsible
and another example of the character assassination that I have faced
since the initial allegations surfaced."

In an e-mail message, Mr. Baker denied any involvement in hacking
into the drug lab's computer, or in hiring anyone to hack into it. "If
the L.N.D.D. computer system was hacked, I do not know who did this,"
he wrote, referring to the drug-testing lab, Le Laboratoire National de
Dépistage du Dopage.

In the case of Mr. Canoy, the shareholder activist, investigators
raided the office of Jean-François Dubos, Vivendi's general counsel, in
June. Antoine Lefort, a spokesman for Vivendi, confirmed that Mr. Dubos
"has been heard as a witness and his office was searched." But he said
that neither Mr. Dubos, who has not been placed under formal
investigation, nor the company had sought to hack into Mr. Canoy's
computer.

Since 2002, Vivendi has fought 13 different lawsuits brought by Mr.
Canoy, and filed two countersuits against him, Mr. Lefort said.

Mr. Canoy said the hackers stole data about his finances and even
his family. "My son has a rock band, and everything including his songs
and poems was stolen," he said. "It is a complete violation of my
personal and professional privacy."

Mr. Harbulot, the expert on economic intelligence, said the most
curious thing about the whole case to him was why a company like E.D.F.
would get involved with "these kinds of people" in the first place.

"All of E.D.F.'s security needs should be taken care of by the state, because it's strategically important," he said.

Still, hackers like Mr. Quiros seem to be proliferating, he said,
estimating there were "a few dozen" in France alone. "Not that he was
very expert," Mr. Harbulot said. "Like most hackers, he was undone by
some really stupid blunders."

• 106 Money & Politics
• 107 Energy
• 192 Technology & Telecommunications