Key news in this bulletin:
- Three Bulgarian cybersecurity workers charged with terrorism following hack on the country’s tax agency;
- Kenya’s finance minister is arrested for fraud and corruption; and
- Russia’s central bank sues former owners of collapsed bank in country’s largest banking lawsuit.
EUROPE & UNITED STATES
Bulgaria: Three charged with terrorism over hack on tax agency
On 24 July, prosecutors in Sofia charged two Bulgarian cybersecurity workers with terrorism, as part of an investigation into a hack on the country’s tax agency in June. More than four million of Bulgaria’s seven million citizens had their personal and financial data accessed during the breach, the largest in Bulgaria’s history, with 189 having their names, ID numbers and addresses leaked. The two men, employees of Sofia cybersecurity firm TAD Group, have been released from custody, though the company’s owner was arrested on terrorism charges when he landed in Bulgaria on 30 July. The tax agency reportedly faces a fine of up to EUR 20 million.
United States: Facebook investigated for antitrust violations following privacy fine
On 24 July, Facebook announced that the US Federal Trade Commission (FTC) was formally investigating it for antitrust violations. Earlier the same day, the social media giant reached a record USD 5 billion settlement with the same regulator for privacy violations, and another USD 100 million settlement with the US Securities and Exchange Commission over claims that investors were misled over the company’s misuse of user data. The FTC agreement included provision to ensure Facebook conducts regular privacy audits. The settlement was criticised for failing to curtail Facebook’s gathering and sharing of users’ personal information.
SUB-SAHARAN AFRICA
Kenya: Finance minister arrested for corruption and fraud
On 22 July, Kenya’s finance minister Henry Rotich and 27 other officials were arrested for acts of corruption and fraud, on the order of the director of public prosecutions Noordin Haji. The charges against Rotich relate to the awarding of a GBP 405 million contract to CMC di Ravenna, an Italian construction company, to build two dams. According to Haji, the tender was awarded for GBP 137 million more than originally agreed, and the conception, procurement and payment process was “riddled with massive illegalities”. Construction has yet to begin, while more than GBP 160 million has been spent on the project. Rotich and CMC deny the allegations. In 2018, CMC faced similar allegations in South Africa over a GBP 404 million sea port construction contract.
MIDDLE EAST & NORTH AFRICA
Iran: Ship seized in Gibraltar
On 11 July, the UK Royal Marines in Gibraltar seized Grace 1, an Iran-owned oil tanker thought to be transporting two million barrels of crude oil to Syria in violation of international sanctions. Grace 1 was originally registered in Panama, though Panama struck the vessel from the register on 29 May as part of a crackdown on Iranian vessels, and Grace 1 reportedly became Iran-flagged en route to Gibraltar. The seizure of Grace 1 raises the issue of “flags of convenience”, whereby ships register in countries with looser regulations, enabling ships from sanctioned jurisdictions to operate undetected in international waters. Panama, the world’s largest shipping register, has removed 59 Iran- and Syria-linked tankers from its register in 2019 to comply with US-led sanctions regulations. On 19 July, in what is believed to have been a retaliation for the seizure of Grace 1, Iran’s Islamic Revolutionary Guard Corps seized Stena Impero, a Swedish-owned and British-flagged oil tanker in the Strait of Hormuz, claiming that the ship had violated international maritime laws.
Bahrain: Data Protection Law comes online
On 1 August, Bahrain’s Personal Data Protection Law (PDPL), which was first enacted in 2018, comes into force. The new regulations closely resemble the EU’s General Data Protection Regulation (GDPR), with some variations. For example, violations of the PDPL can result in imprisonment. As part of this new legislation, Bahrain has established the Personal Data Protection Authority, which will now be notified before any personal data is processed. The PDPL forms part of a broader trend of data protection across the Gulf, beginning with Qatar, whose own law came into force in 2017. In June, the Dubai International Financial Centre also began consulting on plans to update its regulations, which are currently based on the EU’s pre-GDPR rules.
LATIN AMERICA
Brazil: Leaked messages point to collusion between judge and prosecution in ‘Car Wash’ investigations
A trove of leaked messages between public prosecutors and a judge involved in Operação Lava Jato (Operation Car Wash), a wide-ranging anti-corruption investigation, has called into question the impartiality of the probe. According to The Intercept, the website that reportedly received the leaked conversations, former presiding judge and current minister of justice Sérgio Moro may have colluded with a federal prosecutor to find former president Luiz Inácio Lula da Silva (2003-2010) guilty of corruption charges, while shielding other politicians from scrutiny. The scandal, nicknamed ‘Vaza Jato’ (‘Wash Leaks’, a play on Operation Car Wash’s name), has re-kindled suspicions that Moro was appointed minister of justice in return for removing Lula from the 2018 presidential race, which facilitated the election of current president Jair Bolsonaro.
Peru: Former president arrested on corruption charges
Alejandro Toledo, president of Peru from 2001 to 2006, has been held in jail in the US since his arrest on 16 July. He faces extradition proceedings in the US, where he has been living since 2007, over corruption charges in Peru. Peruvian authorities accused Toledo of receiving USD 20 million in kickbacks from Odebrecht, a Brazilian construction conglomerate, in connection with Operation Car Wash. Four former Peruvian presidents have been investigated in relation to Operation Car Wash, including Alan García, who committed suicide in April 2019 after an arrest order was issued for him on corruption charges.
ASIA PACIFIC
Japan: China-based crime group suspected of payment app hack
On 4 July, 7-Eleven Japan, the largest convenience store chain in Japan, reported that its mobile payment app 7Pay had been hacked. The app’s services were suspended less than a week after its roll-out. The company estimated that the security flaw resulted in unauthorised access to more than 900 customer accounts and a financial loss of approximately USD 510,000. The Japan Times reported that police suspect the involvement of a China-based international criminal organisation. Three Chinese nationals have been arrested on suspicion of theft and attempted fraud, and two of them reportedly admitted to having received instructions about the hack via WeChat, a popular Chinese messaging app. The investigation is ongoing.
RUSSIA & CIS
Russia: Central Bank files largest lawsuit in banking history against Otkritie owners
On 3 July, the Russian Central Bank filed a USD 1.3 billion lawsuit against the former owners of Otkritie Bank, which had been one of Russia’s largest privately-owned banks before it was nationalised in 2017. The central bank is seeking to recover the losses incurred by its bailout of Otkritie, which collapsed within months of two other large Russian lenders. To date, the central bank has spent an estimated USD 50 billion recapitalising these banks. Separately, on 11 July a UK court froze assets worth USD 572 million belonging to Otkritie co-founder Boris Mints, who moved to the UK last year after Russian authorities reportedly opened criminal proceedings against him. This ruling will allow the central bank to pursue Mints’ assets should he violate the court order.
Russia: Senior manager of national pension fund pleads guilty to bribery charges
On 10 July, Russian authorities arrested Alexey Ivanov, the deputy chairman of Russia’s national pension fund, on bribery charges. Ivanov subsequently resigned and admitted to accepting a USD 70,000 bribe in return for awarding a state contract to Russian IT company Tekhnoserv in 2017. Initial media reports state that Tekhnoserv’s executives were acting in the interests of another party, whose identity has not yet been made public, and that they are expected to be investigated in due course.
