Military police spoke of ‘cover-up’ concerns after data deletion, inquiry told
Military police officers believed the permanent deletion of data from a computer server by “sheepish” UK special forces personnel would be seen as a cover-up, the Afghanistan inquiry has heard.
The inquiry was told the deletion of the server known as ITS1 at the special forces HQ in the UK was “irreversible” and a “direct disobeyance” to the Royal Military Police’s (RMP) demands to “preserve the data in its entirety”.
ITS1 contained data relevant to Operation Northmoor – a £10 million investigation set up in 2014 to examine allegations of executions, including of children, by special forces in Afghanistan.
Counsel to the inquiry Oliver Glasgow KC said claims from lawyers representing families of the alleged victims that the server deletions were “at worst a patent and criminal attempt to pervert the course of justice in a multiple homicide investigation”, were “not without foundation”.
(SDelete) removes the opportunity to forensically recover any data that has been deleted. If I wanted to delete some data off a computer and move it somewhere else so no-one would find that data, that's the process you would do
The inquiry at the Royal Courts of Justice heard that specialist RMP investigator Jim Priddin was told engineers working on behalf of UK special forces had been running a programme called SDelete for three weeks before he was informed – a process that involved the permanent erasing of deleted data.
Mr Priddin said he was told in a meeting on December 19 2016 that the data “kept corrupting” when the transfer was being made from one server to another, forcing them to use the SDelete process.
The RMP first contacted special forces about recovery data “en masse” from the ITS1 server in October 2015 but despite requests for no data to be deleted, documents showed engineers had begun using SDelete in June 2016.
Asked to describe the attitude of others towards him in the December 19 meeting, Mr Priddin said on Tuesday: “It wasn’t something I remembered until I had my statement taken but I remember them being quite sheepish with us.
“Now, that’s a general reaction to be fair to them – when we come in and take computer systems away … people aren’t laughing and joking when we turn up, put it that way.
“But it did feel a little bit odd – like they had something to tell us – and they did have something to tell us, obviously.”
In my mind they had done something which had completely destroyed data and I needed to tell the (senior investigating officer) about that because it was a significant point
Mr Glasgow continued: “Were you surprised to be told that they had run SDelete in the last three weeks as part of the data migration process?”
Mr Priddin replied: “Yes.”
Questioned on why he was surprised, the former RMP officer said: “Because it removes the opportunity to forensically recover any data that has been deleted.
“If I wanted to delete some data off a computer and move it somewhere else so no-one would find that data, that’s the process you would do.”
Mr Glasgow then asked: “Is it possible that you were told that SDelete had in fact been run much earlier than that, for example in the summer?”
Mr Priddin said: “Never. If they had told me that I would have straight away said ‘why are you deleting data?'”
Commenting on his reaction when he was told SDelete had been run, Mr Priddin said: “I was a bit surprised, and asked them why they’d run it and they explained.
“I think we had a discussion about data size and things like that but in my mind they had done something which had completely destroyed data and I needed to tell the SIO (senior investigating officer) about that because it was a significant point.
“So I think we ended the meeting early.”
I remember discussing at the time with (the senior investigating officer) that people are going to think it's a cover-up, and here we are today. We did say that the best course of action would be for us to investigate that server to see exactly what had happened, but the decision was made not to do it
Mr Priddin told the inquiry he had never seen the servers, as special forces personnel were “very protective over letting us have access”.
Mr Glasgow continued: “If you were given the choice, would you have preferred an RMP investigation into what had happened or an internal at unit level into what had happened?”
Mr Priddin responded: “I remember discussing at the time with Captain Wright (the SIO) that people are going to think it’s a cover-up, and here we are today.
“We did say that the best course of action would be for us to investigate that server to see exactly what had happened, but the decision was made not to do it.”
The independent inquiry is set to examine whether UK special forces had a policy of executing males of “fighting age” who posed no threat in Afghanistan between 2010 and 2013.
The inquiry will look at allegations that “numerous” killings were carried out, as well as the alleged cover-up of illegal activity and inadequate investigations by the RMP.
The inquiry continues.
The best videos delivered daily
Watch the stories that matter, right from your inbox