London mosque case exposes pitfalls of 'terror list' database

For years, London's Finsbury Park mosque found itself locked out of a number of major banks as a result of a decision made by Thomson Reuters to link it to "terrorism" in its influential World-Check database.

On Wednesday, the organisation publicly apologised for the move and agreed to compensate the mosque and correct the information.

But the case, heard at the High Court in London, has revealed major shortcomings in the database, which despite its reputation for thoroughness was shown to be largely based on "open source" data gleaned through Google searches.

"World-Check profile reports are said by the defendant to consist of 'continually updated intelligence' which provides an 'early warning system for hidden risk'," said the particulars of the claim issued by Finsbury Park mosque's lawyers.

"It claims to have 'research hubs in all global regions with research analysts speaking over 60 local languages to ensure the best quality intelligence'."

"In fact, the profile reports are unqualified staff on the basis of 'open source' data, in particular, by means of Google searches. On the basis of this data, the defendant determines the 'category' into which to place the subject of the profile report."

World-Check Risk Screening contains information about people and groups suspected of involvement in terrorism, organised crime and money laundering, as well as other offences.

It is used by over 300 government and intelligence agencies and 49 of the world's top 50 banks.

Peter Oborne's original investigation into World-Check

European privacy laws govern access to the database - however, an out-of-date copy was leaked online in June 2016. Among the revelations in the leak were that the database cited Wikipedia as a source for its information.

According to Vice, more than 6,500 of the profiles including Wikipedia sources are for political individuals, 5,074 are for other individuals, 624 are labelled as being involved in some form of crime, and 178 are suspected of terrorism.

The claim lodged by Finsbury Park mosque also noted that it had not been able to scrutinise the data itself, which could potentially cause enormous reputational and financial damage.

"The defendant's profile reports are not subject to independent checks or research and those who are subject of profile reports are not given the opportunity to check their accuracy of correct errors," it read.

"Checking is expressly prevented by the defendant in that World-Check's terms and conditions of use prohibit subscribers from sharing any of the information contained in its profile reports with third parties."

'Who checks World-Check?

Tom Keating, the director of the centre for financial crime and security studies at the Royal United Services Institute, said the revelations were concerning.

"The extent to which World-Check is relied upon by financial institutions is immense; yet it appears from this case that its quality control does not match this responsibility," he told Middle East Eye.

"Once again we have to ask ourselves, when an organisation has this much existential influence, who checks World-Check (and others)?  It is surely time that the FCA took an active interest in a tool that is so influential in the decision making of banks."

Thomson Reuters said it stood by its statement about its research analysts.

London mosque wins apology over 'terrorism' database listing

"We can clarify the point about sources of information. It’s maybe clearer to say that World-Check is one of several services which aggregate financial crime data from the public domain.

"That includes sanctions data from official bodies (HM Treasury, The Office of Foreign Assets Control of the US Department of the Treasury and the EU and UN authorities, 400+ government sanction, watch, regulatory and law enforcement lists).

"But also, World-Check uses reliable and reputable public domain sources (official sanctions lists, law and regulatory enforcement lists, government sources and trustworthy media publications) for risk-based information or allegations about an individual or entity.

"We also provide secondary identifying information on individuals, such as dates and place of birth, and this will be similarly verified with reputable and official sources.

"If blog content appears, it is only as a supporting source for that secondary information, and we make that clear."