Reporters Without Borders calls on the Latvian authorities to abandon a criminal investigation into netizen Ilmārs Poikāns and journalist Ilze Nagla of the state TV station LTV1 for exposing a serious security flaw in the national tax office’s data storage system.
Using the pseudonym of Neo and portraying himself a member of a fictitious hacker group called 4ATA, Poikāns revealed through his Twitter account (twitter.com/neo4ATA) and files uploaded via Mediafire server on 14 February that unauthorised people could take advantage of a flaw in the Electronic Declaring System software developed by the company A/S Dati Exigen to access the tax records of any taxpayer.
Poikāns, a scientist who works for the Artificial Intelligence Laboratory at the University of Latvia’s Mathematics and Information Institute, obtained 7.4 million classified files using a simple computer script that he had devised.
Nagla was the first journalist to take an interest in Poikāns’ discovery, producing a report about the flaw in the Electronic Declaring System for her programme “De Facto.” Several months after the report was broadcast, she and Poikāns were arrested on 22 May and were held for several days. Her home was searched and Poikāns’ Twitter account was closed by the police.
“We are outraged by the way a completely unwarranted criminal investigation has been used to harass Poikāns and Nagla,” Reporters Without Borders said. “What they reported was absolutely true and has not been disputed by the authorities. We demand the immediate withdrawal of all the charges against them.
“The judicial harassment, which began in February, has gone on for too long and violates all the European standards as regards media freedom. Poikāns and Nagla are not to blame for the scandal resulting from the tax office’s flawed software. They just used their right to shed light on a matter that was very clearly of public interest.”
Although Poikāns and Nagla continue to be the target of judicial proceedings, the investigation into the tax official personnel responsible for the flaw and into A/S DATI Exigen, a privately-owned company, has been cancelled. The only measure taken was to deduct 20 per cent from the salaries of three tax office employees (Iveta Bērtulsone, Viesturs Šķiļs and Juris Stumps) for one month as a disciplinary measure.
“We deplore the very strange and one-sided approach adopted by the Latvian authorities in this case,” Reporters Without Borders added. “The people who were to blame for the problem were left alone, while those who legitimately informed their fellow-citizens about the dangers to their privacy are being prosecuted. The authorities seem to be showing a marked preference for media silence in a case involving a key element of state responsibility.”