A former Libyan intelligence chief, who told associates he is a shareholder in German payments group Wirecard, funded a surveillance operation in London that targeted a string of investors including hedge fund manager Crispin Odey.

Rami El Obeidi, head of foreign intelligence in Libya’s National Transition Council, which governed the country temporarily in the wake of Muammer Gaddafi’s death in 2011, was hunting for evidence that market speculators were attempting to manipulate Wirecard shares, according to two people familiar with the operation.

He retained the services of two security companies: Sloane Risk Group in London, run by a former British counter-terrorism operative Hayley Elvins, and APG Protection, a Manchester-based firm run by a former special forces soldier Greg Raynor, according to a briefing document outlining the surveillance operation.

Sloane and APG then oversaw an operation codenamed “Palldium Phase 2”, using the services of 28 individual private investigators, the sources said. A surveillance team monitored at least eight men in total, according to the briefing document and photographs dated between October 23 and November 3 this year, which were obtained by the Financial Times.

Wirecard has denied any involvement in such surveillance. The Munich-based technology group, a member of the prestigious Dax 30 index of Germany’s largest companies, has long portrayed critics of its accounts and governance as criminals trying to manipulate its share price, in collusion with the media.

After the publication of the so-called Zatarra report, a critical dossier about Wirecard published anonymously in February 2016, the company’s shares slumped. This prompted a sharp public response from Wirecard and attempts to discover the identity of the authors and their suspected collaborators.

Two professional investors, Matt Earl and Fraser Perring, co-authored the Zatarra report and are among the eight men surveilled over recent weeks, along with Mr Odey, Brett Palos, the stepson of retailer Philip Green, and Nick Gold, a seasoned stock market speculator.

Mr Gold was secretly recorded in July talking to an undercover investigator posing as an investor. In the exchange, Mr Gold appeared to indicate he was aware the FT would shortly be publishing further critical news reporting about Wirecard.

In a statement issued through Wirecard’s lawyers, Herbert Smith Freehills, the company claimed at the time it had obtained the recording of Mr Gold meeting what it described as “potential investors”.

Wirecard said this represented clear evidence of criminal collusion and market manipulation. Details from the recording of Mr Gold were subsequently distributed widely among the German press.

Late last month, excerpts of the recording were also uploaded to an anonymous website, Shortleaks.com, which resulted in a wave of social media criticism challenging the FT’s reporting.

Mr Gold has since told friends that he believes he was subject to a sting operation which encouraged him into making exaggerated claims.

In July the FT commissioned an external law firm to independently examine the allegations. It found no evidence of wrongdoing by the FT’s investigative journalism team.

Wirecard this week denied any association with the Palldium operation or funding any such activity. A statement from Herbert Smith Freehills added: “We understand from our client that it has no known association with Mr El Obeidi and is not aware of Mr El Obeidi holding any Wirecard shares. Further, our client confirms that it did not receive the audio recording of Mr Gold from Mr El Obeidi.”

Copies of some operational “chat” messages between Mr Raynor, Ms Elvins and their teams, reviewed by the FT, reveal that Mr El Obeidi is referred to as “Boss” or simply “Doc” by the security personnel. The teams have used a “push-to-talk” application called Zello, through a channel named “Palldium C2”, for their surveillance communications.

A number of market speculators who have bet against Wirecard shares in the past have told the FT that they were followed and photographed. One said he discovered a tracker device placed on his car.

BaFin, the German financial regulator, has investigated speculators for possible market manipulation and earlier this year introduced temporarily an unprecedented ban on “short sales” in Wirecard stock.

In correspondence seen by the FT between Mr Earl and Wirecard’s then lawyers, Jones Day, the company admitted in 2016 using private investigators. Wirecard insisted this was “limited and lawful” and required to ensure that Mr Earl was available to receive legal letters in person. A different investigations agency was deployed.

Mr El Obeidi did not respond to requests for comment. People who have worked with him say he spends much of his time in Turkey and Dubai, and that he stays in The Dorchester hotel when in London. Outside his claimed investment in Wirecard the FT was unable to ascertain his business interests.

Sloane Risk, which on its website described using former operators from “British intelligence and specific military units who have completed training not available to the commercial sector”, did not reply to a request for comment.

APG Protection said it would not comment on “actual or purported activities or clients of the company”, adding that any “operational activity conducted by APG is always strictly within the law”.

FT under surveillance

This is not the first time that critics of Wirecard have been placed under surveillance.

The FT has today published a separate discussion document in German, which shows plans hatched by an unnamed European private investigations outfit to launch a sophisticated eavesdropping operation in the UK. Titled “Indikatioren zum Insiderprofil”, the 14-page document was dated March 9 2016, two weeks after the Zatarra report was released.

On that occasion, according to the document, those being monitored included Dan McCrum, the principal author of the FT’s coverage of Wirecard, alongside a number of London financiers including Mr Palos. The FT has redacted names of some of those targeted.

The document also mentions an executive in Wirecard’s pre-paid card business in Britain, whom Wirecard has denied monitoring or having concerns about.

The plans involved use of a so-called “IMSI-catcher” — an international mobile subscriber identity-catcher — to harvest audio and data from a target’s phone, and “suck the blood out of suspicious people”, according to the document.

Eavesdropping is illegal in Germany, unless carried out by the state, part of strict privacy laws shaped by the country’s experience of secret police activity in former East Germany.

Wirecard executives appear to have suspected a mole was operating at a senior level within the company after Mr Earl and Mr Perring published their Zatarra Report in 2016, prompting a criminal investigation in Germany into alleged market manipulation.

The case against Mr Earl was subsequently withdrawn. Munich prosecutors have sought to fine Mr Perring, who has denied publishing any false or misleading information.

The electronic eavesdropping document includes details of psychological and social profiling aimed at identifying an internal leaker, before going on to detail the activities of “Kontakt Team England.”

There is a mention of “hacking”, with Mr Palos and Mr McCrum the suggested targets and “SWIFT data” was to be obtained, indicating the investigators were looking for evidence of money transfers between a range of individuals.

Mr Palos was to “get 2-3 pings” each day, which, according to security experts, is a reference to a “silent SMS” or secret text message, which provides the precise location of a target’s phone. In what is known as a “man-in-the-middle” attack, this approach involves placing a “fake” telecoms tower between the user’s phone and the real telecom network.

Other individuals earmarked for “OSINT” or open-source intelligence, included Michael Hedtstück, editor in chief of Finance, a German magazine, who was said to have been “negative” about Wirecard, along with a range of hedge fund managers and other investors.

Get alerts on when a new story is published

Copyright The Financial Times Limited 2021. All rights reserved.
Reuse this content (opens in new window) CommentsJump to comments section