Features

Iranian Regime's UK Cultural Hub in Massive Ramadan Data Breach

April 22, 2021
Hannah Somerville
4 min read
The Islamic Centre of England is the Iranian regime's main cultural outpost in the UK, supervised by an appointed representative of the Supreme Leader
The Islamic Centre of England is the Iranian regime's main cultural outpost in the UK, supervised by an appointed representative of the Supreme Leader
The Iranian state-sponsored cultural hub created a WhatsApp group that exposed hundreds of Iranians' private telephone numbers over Ramadan
The Iranian state-sponsored cultural hub created a WhatsApp group that exposed hundreds of Iranians' private telephone numbers over Ramadan
One of the group administrators was Esmaeil Fallah, who has worked for Islamic Republic of Iran Broadcasting in the UK
One of the group administrators was Esmaeil Fallah, who has worked for Islamic Republic of Iran Broadcasting in the UK
Mr. Fallah told IranWire that he didn't know the WhatsApp group was in breach of the law
Mr. Fallah told IranWire that he didn't know the WhatsApp group was in breach of the law
One embittered group member said: "“The whole reason I’m not in Iran at the moment is because of the propaganda"
One embittered group member said: "“The whole reason I’m not in Iran at the moment is because of the propaganda"

The private phone numbers and other details of more than 200 Iranians in the UK have been shared in a data breach involving the Iranian regime’s official cultural outpost in London.

The Islamic Centre of England (ICE) was established in a former bingo hall in the British capital in 1998, by a personal envoy of Ali Khamenei. It works to promote the Islamic Republic’s spiritual and cultural position in the UK and all of its activities are overseen by an appointed representative of the Supreme Leader.

Last Friday evening, some 232 people were added by ICE to a WhatsApp group, some of whom have nothing to do with ICE and say they were added without their consent. The group, called “Islamic Centre of England 1”, was used by ICE to share Ramadan prayer times and video sermons by an Iranian cleric, Dr. Naser Rafiei-Mohammadi.

More than 100 of the newly-added members left immediately. Scores more were then added by a second administrator: former Islamic Republic of Iran Broadcasting (IRIB) journalist Esmaeil Fallah, who is a UK resident and is working with ICE on a Ramadan program.

Some of the people who were added had no idea that either ICE or Mr. Fallah had their phone number. These numbers and their other WhatsApp profile information were then openly available to the other 230 group members.

One person, who asked not to be named, told IranWire they had had only fleeting contact with ICE back in 2011, and had not been informed that the Centre had hung onto their details.

“I hate the fact that my number’s up there for 230 other people to access,” they said. “I hate the fact that they used my details without my consent. 

"The whole reason I’m not in Iran at the moment is because of the propaganda. And as someone who claimed asylum here, I’m also really scared. I’m thinking of changing my phone number.”

Why Does it Matter?

The Iranian state-run Centre’s WhatsApp group contravened both British and European laws on data protection, including the UK's 2018 Data Protection Act, which governs how organizations and businesses can use people’s personal information in England and Wales in order to protect their right to privacy.

Peter Wright is a British solicitor, the managing director of UK firm Digital Law and a board member of the Law Society. “We absolutely have a breach here,” he said, “on several different fronts.

“Firstly, if you can identify an individual from their phone number – or from the other information on their WhatsApp profile – that makes it personal data. Those people who are fearful now clearly feel that they have been identified.”

Many of the people added by ICE and the IRIB journalist had pictures of themselves and their families as their profile photos. At least one person had their child’s full name and school in their picture.

Under Article 6 of the British law, organizations can also only keep and use personal data for one of a set of very specific, defined purposes, such as for contracts or legitimate business interests. In addition, they need to obtain people’s consent to hold onto their details.

“If they haven’t got that consent," Mr. Wright said, "they should have got rid of them [the numbers]. There’s no way that this information should have stayed in a database for 10 years.”

Some of the people affected plan to complain to UK regulator the Information Commissioner's Office (ICO), which upholds people’s information rights and can take action on reported breaches of the Data Protection Act. “The more of those individuals that complain,” Mr Wright said, “the more likely that the ICO will launch an investigation. It’s really important that all those affected register this.”

Co-Administrator Claims Ignorance of the Law

IranWire contacted the Islamic Centre of England and Mr. Fallah for comment. ICE gave no written or formal response. But Mr. Fallah incorrectly told IranWire that the WhatsApp group was “just for all my friends and Iranian people”.

Mr. Fallah is a veteran IRIB reporter who is alleged to have worked with intelligence agencies in broadcasting the forced confession of a jailed student activist, Ali Afshari, in the early 2000s. He is thought to have worked in the UK for about 10 years, initially on a contract with the IRIB’s London studio, and later applying for UK residency.

He has previously filmed Green Movement supporters at a Stop the War rally in London, student protests in the capital in 2010, and life in the UK during the pandemic, including several video missives about “panic buying” in London supermarkets.

Mr. Fallah told IranWire that all the numbers compromised in the ICE-sponsored WhatsApp group were those of personal friends, saved on his own phone. He also claimed: “I sent all of them a text [beforehand] and I got permission”.

On being told that neither of these statements were correct, he said some people might have been confused because he has two SIM cards and phone numbers, but also conceded that a “mistake” could have been made. He added: “I didn’t know it was a breach of the law and we will get everything off now.”

The group was still live at the time of publication.

Related coverage:

Iran’s Overseas Propaganda: London, Gateway to the World

High Ranking Iranian Official Threatens Iranian Journalists in the Diaspora

Private Information of Citizens for Sale in Iran

Iran's New Data Law Will Usher in Greater Censorship and Surveillance

comments

Speaking of Iran

Kaveh Madani: The Target

April 22, 2021
Speaking of Iran
1 min read
Iranian Regime's UK Cultural Hub in Massive Ramadan Data Breach