Driving License / Identity Document Breach Quietly Closed by Brand New Tube but No Apology from Muhammad Butt or Answer Over Pirate Software Allegations

Brand New Tube has finally removed the collection of customer personal identity documents – some as old as 2020 – it had accidentally posted online. The controversial site has announced a planned return on Tuesday at 6pm. Those users unwise enough to remain members will likely be hoping there are no further security breaches. Key questions remain unanswered by the usually irrepressible Muhammad Butt.

Muhammad Butt seen giving an update from his car, about his low rent video sharing website. Whilst Mr Butt has been prominent seen 2020, he has yet to actually set out a clear answer on the 'pirate software' issue. Image used for the purposes of criticism and review of the video and Brand New Tube.

Muhammad Butt seen giving an update from his car, about his low rent video sharing website. Whilst Mr Butt has been prominent since 2020, he has yet to actually set out a clear answer on the ‘pirate software’ issue. Image used for the purposes of criticism and review of the video and Brand New Tube.

Although the site is returning, there has been no apology nor admission by Muhammad Butt as to the breach of personal documents. There has also been no response to allegations by the hackers and by users (archive) that Brand New Tube they were using ‘nulled’, that is pirate, hacked components. As well as being illegal risk, such alleged practises (if true) create a security risk to the site and its users.

Mr Butt is usually a plain spoken man. In his strange, low-rent but blunt video above from 2020, Mr Butt was happy to engage stridently with critics. So, Muhammad, why no answers? Why have you not clearly disclosed the personal identity document breach publicly? Was Brand New Tube using, ‘nulled’ scripts?

Share Button

Explosive: More Brand New Tube Revelations – List of Security Warnings Since 2020 Revealed – Driving Licenses Still Online!

Yesterday, MHN revealed information provided by a whistleblower. In a shocking development to the Brand New Tube story it has emerged that up to thousands of identity documents of Brand New Tube users, including passports, were published online without the knowledge or consent of those users (and indeed, likely without incompetent Brand New Tube’s knowledge). In a shocking update today, a different source has provided a publicly available list of reported bugs on Brand New Tube that have largely gone unfixed since 2020!

The list of errors can be found on a public bug bounty site called www.openbugbounty.org (archive).

Brand New Tube Bugs List From OpenBugBounty.org

A list of Brand New Tube vulnerabilities reported on OpenBugBounty.org. These have gone unpatched in some cases for nearly two years after being reported.

MHN texts BNT lawyer Jeffrey Smele, Partner at Simons Muirhead and Burton

MHN has now had to go so far as texting BNT lawyers on the weekend about the scale of the breach. Click for full size.

This only fuels concern as to Brand New Tube’s poor security policies. Tests today reveal that Brand New Tube are still publishing unsecured identity documents online. Nothing has changed since the MHN article yesterday.

[UPDATE 15:05 27 August 2022] In light of the breached personal identity document still being online, MHN has contacted Muhammad Butt’s and Brand New Tube’s lawyers by text, to warn them and to create evidence of their negligence.

MHN will be posting daily call-outs until the personal identity documents are removed.

Brand New Tube’s negligence is shocking.

Share Button

Explosive! All Brand New Tube User Identity Documents Available Online … and ICO is Failing

The Information Commmissioner’s Office (ICO) and Brand New Tube (https://brandnewtube.com, BNT) face questions after whistleblowing information revealed damning new information about the scale of BNT’s recent data breach. British video sharing website Brand New Tube was hacked in 2020, and again earlier this month by a different group. The hackers emailed users and posted some details online. However, based on information MHN received from a whistle-blower last night, BNT’s disclosures on the scale of its security problems and the recent hack are seriously incomplete. Right now, if you have ever uploaded an identity document to BNT for monetisation, it is likely available online. Disturbingly, it has been quite hard to get the ICO to do something about this. The poor communications and processes reflect badly on Head of Communications Tim Bowden and Chief Executive John Edwards, albeit not as badly as on Brand New Tube CEO Muhammad Butt.

A driving license of a BNT user available from BNT CDN servers this morning, anonymised by MHN.

A driving license of a BNT user available from BNT CDN servers this morning, anonymised by MHN.

Obviously, you would expect the ICO to do something about this pretty promptly. I got in touch this morning with their press office by email. I got a boilerplate message back. Now, just to explain the ICO are embarrassed because last week they wrongly told MHN in writing that Brand New Tube had not disclosed the hack. This was wrong and the ICO had to withdraw it. However, the story has moved on and they need to actually read inquiries. So I called them up and had a few words. I sent in a further inquiry. I just got another boilerplate, “We have nothing further to add to our statement”. As opposed to, for example, “thank you for this new information – we confirm it has been passed urgently to the relevant team to see what can be done and will be looked at today”.

Based on the information from the whistle-blower, Brand New Tube has failed to disclose the fact that it has never deleted user documents, and never put them, y’know, behind a password. It appears that they can all be downloaded. This morning, multiple bloggers and journalists have downloaded multiple identity documents – taking appropriate records for evidence.

The passport above was downloaded this morning. There was no hacking. I just typed in the URL to a BNT server. They have published these peoples’ documents to the world. Then I forwarded it to the ICO. I have anonymised it for this article, and before processing the data, I considered the Editor’s Code and MHN’s policies in accordance with the Data Protection Act 2018 (DPA). I consider it reasonable and in the public interest to process this document to report it to the ICO. I consider it reasonable and in the public interest to process it in anonymised form in the article in order to give a concrete example of BNT’s failure to appreciate or disclose the scale of the breach, and of their security issues. Others are doing the same. There are thousands of ID documents. Anyone who has ever monetised at BNT as far as we can tell. All available online without so much as a password prompt.

Continue reading

Share Button

Whistleblower Sends Evidence BNT Held Personal Identity Document for Years

It is late, and I was only up watching TV. I have just received a whistleblower email making an incredibly serious allegation about Brand New Tube, the troubled online video sharing website hacked in 2020 and again earlier this month, that hosts controversial fringe content like ‘journalist’ Sonia Poulton. This is bad stuff.

I had to check a couple of things because I frankly did not believe it and I needed to check some HTML quickly from a third party site. I will need to call the ICO in the morning. I can say this goes way beyond passwords and emails. Full details tomorrow but there is incontrovertible proof that a lot of data was held that Brand New Tube did not declare as breached.

Share Button

Statement on Brand New Tube Hack – Long Video Coming Soon

I have had a number of people contact me about an alleged hack of Brand New Tube (‘BNT’) last week. They are concerned about their data security. I covered a previous hack of the platform in 2020 and made a video. Readers may rely on that video, because BNT supremo Muhammad Butt sued me in the High Court using expensive lawyers. I defended myself and won, he lost – filing notice of discontinuance and throwing in the towel. Today the ICO have confirmed that Brand New Tube has failed to notify it of the data breach. If true, they have breached data protection law once again. [UPDATE 23 August 2022 – The ICO have corrected themselves. Their initial email was wrong. Brand New Tube did in fact report the incident by 17 August. However, all the other criticisms in this article remain unchanged. In particular, Brand New Tube have failed to answer whether they received concerns in December 2021 about the website’s security.]

ICO Press Officer Rashana Confirms No Mandatory Report was Made

The ICO confirms no report was made. The ICO was asked very specific questions and given My Media World’s registration number. The ICO initially said no report was received. It now admits this was wrong.

I want to confirm to supporters that I am preparing a lengthy video on this. However, I have already verified certain facts. Brand New Tube has been hacked – their Twitter account confirmed it on 14 August 2022 (archive). The hackers claim to have obtained the database including SHA-1 password hashes, and to have been able to extract the passwords. They claim to have extracted over 200,000 customer passwords (it is possible to de-hash unsalted hashed passwords using tools such as rainbow tables). If true, this would only be possible due to negligence of a very serious kind.

In the UK, it is a mandatory legal requirement to report breaches to the ICO. The hackers and Brand New Tube customers on Twitter (archive) allege that BNT was warned months ago and failed to take action. That means at the latest the website operator should have disclosed to the ICO by Wednesday 17 August 2022. The ICO confirms they have not. [The ICO now confirms this was wrong and their initial email above was incorrect.] I also put the allegations to Brand New Tube via their lawyers on Friday and I can confirm that they have not denied being warned of a security breach in December 2021. The ICO was given My Media World Limited’s registration number and the website URL, and was asked very specific questions.

Continue reading

Share Button

Smith v Baker, Summary Judgement on the Counterclaim! MHN Wins. Devastation for David Hencke, Mark Watts and Sonia Poulton

BakerRestrained

Esther Baker has lost her claim over articles that meant (as the court found) that she is depraved, stalked a child abuse victim for years, is a racist stalker worse than most other racist stalkers, tried to undermine a paedophile priest’s criminal conviction, told deliberate and malicious lies on Twitter for the purpose of raising money under false pretences, has made numerous unfounded allegations of sexual abuse, children are being abused by paedophiles because money and police resources have been used up by Ms Baker’s groundless allegations instead of being available to protect them and that it is possible that some of these children have been raped as a result.

In 2020 I filed a lawsuit against Esther Baker for libel and harassment. I won, and she agreed to be restrained for life after her defences of Truth and Public Interest were struck out. That court order is here. However, a counterclaim by Baker against MHN editor Sam Smith continued. Now, in a judgement today of Mr Justice Griffiths, that too has been defeated after your author applied for strike-out and / or summary judgement. The case is over. Esther Baker loses. MHN editor Sam Smith wins. The result is a devastating humiliation for fringe journalists like Mark Watts, Sonia Poulton and David Hencke who have given her account credence over the years.

The result is also a vindication for victims of Baker like former MP John Hemming, Darren Laverty and Simon Just of Real Troll Exposure.  Each of these men has been subjected to substantial police involvement over the years due to Esther Baker’s false allegations. Now her supporters must suffer the consequences.

Baker and her supporters were cock-a-hoop earlier this year when Mr Justice Griffiths held that previous articles on this blog had defamatory meanings. Now, in today’s judgement the same judge has found that those meanings have been successfully defended, including via a defence of Truth –

“94. For these reasons, I am satisfied under CPR 3.9 that Ms Baker’s statements of case disclose no reasonable grounds for bringing the claim, that her statements of case are an abuse of the court’s process and are likely to obstruct the just disposal of the proceedings, and that they fail to comply with the requirements of Practice Direction 53B and the Griffiths Order. I am also satisfied under CPR 24 that Ms Baker has no real prospect of succeeding on her claims and there is no other compelling reason why the case should be disposed of at a trial.”

Furthermore, these are not mere technical findings because Baker failed to comply with court rules. The judge found that, had she complied and filed paperwork on time, she would still most likely have lost and had no realistic prospect of defeating my defence of Truth. As an example, Baker was suing me for saying that her mental illness caused her untrue allegations of child abuse. However, a medical report she had filed in other proceedings stated that she had decided to participate in IICSA (the Independent Inquiry into Child Sexual Abuse), because a voice in her head told her to. The evidence was simply overwhelming. She conceded her mental illness in her draft reply and told the judge at the hearing about the voices in her head.

It is also worth mentioning that before judgement, at several stages, I gave Baker the option to drop her counterclaim with no further order for costs. She was not forced to bring this – it was her claim. No one used expensive lawyers, I am a law graduate and I defended myself. Baker had many warnings. Hard working judges, High Court Master Lisa Sullivan and High Court Judge Martin Griffiths, both gave Baker many chances to correct her pleadings and reply coherently to my defence of Truth. They gave detailed judgements and guidance on what steps Baker should take. They made express allowances for Baker’s mental disabilities. Baker failed to follow the rules in the case she brought and had the opportunity to drop.

There are a lot of meanings spread across eleven articles. The meanings that have now been defended ought to devastate Baker’s reputation, shame her supporters and Staffordshire Police.

The imputations defended are as follows, in the judge’s words cut-and-paste from the judgement on meaning. Because there were 11 articles, some are repetitive or overlapping. Each meaning has a shield next to them to show they have been successfully defended in court and can be relied upon by readers –

Continue reading

Share Button

Sonia Poulton, Fake News, and Holding Herself Out as a Journalist

On Wednesday 13 July 2022, there was a hearing in Hemming v Poulton. I was excused attendance, because although I am a party to the case the technical application between John and Poulton is nothing to do with me and also I had a medical appointment. So, I was astonished to read a highly misleading tweet (archive) by Poulton claiming the court had ‘accepted’ her objections to being described as, “someone who holds herself out as a journalist”. This is fake news.

A tweet by Sonia Poulton

Sonia Poulton’s tweet is misleading. The court has in no way accepted her objections to the phrase referred to, now made any decision on it.

What happened at the hearing is that it was originally listed before a Master but when further issues were raised late by the parties, the Master decided it needed to be dealt with by a judge and adjourned the hearing. Nothing was decided, least of all was there any decision that the phrase could not be used or was wrong, or that Sonia is a reputable journalist. Nor is it likely to be determined when the hearing was resumed as it is not in issue on the applications.

What was before the court was that John Hemming has applied to expand his claim against Sonia Poulton. Poulton objects. That is the application listed to be decided. The night before the hearing, Poulton via her barrister Richard Munden raised an issue of limitation that some of the proposed amendments relate to claims that are out of time. John via his barrister says they are not out of time but on the safe side applied for an extension of time on the morning of the hearing. With the new and technically complex material, the Master decided a judge should hear the applications.

Sonia did (by her barrister Richard Munden), object to the phrase but the court in no way, for example, told Hemming or his barrister Matthew Hodson not to use it nor struck the form of words out of Hemming’s documents. Hodson has not descended into the arena on this issue, but Hemming commented saying that the Master did not address the point at all. It is bizarre because Hemming is not even disputing Poulton is a, ‘journalist’ because it is not a regulated profession or reserved title. Anyone can stumble in off the street and say they are a ‘journalist’ in the UK. John’s pleadings at paragraph 2 say that the, “Defendant is a freelance journalist”. However, I am entitled to the opinion that Poulton is not a good or ethical journalist. There are a number of reasons and my opinion is based upon all of the facts set out in these linked articles of mine – [1] [2][3][4][5] and the matters raised in this one.

Poulton has been raising money on the cases she is involved in and statements like this to her supporters are highly misleading. It is not the first time. At a hearing last year, Poulton claimed that she had received 85% of her costs, “of the hearing” (archive). This was false. Poulton had received 85% of her costs of only one of several applications. The others had been decided differently – one she had no costs of. One she has to pay Hemming, but delayed until the end of the case. She also agreed to pay my costs and Darren Laverty’s. So her overall recovery was lower and she had to pay me. The overall effect of this order is that everyone except me lost money. Extracts from the order are below –

Extracts from the order sealed 14 July illustrate the misleading nature of Poulton's statements.

Extracts from the order sealed 14 July illustrate the misleading nature of Poulton’s statements. She got 85% of her costs on one application, lost all her costs of another, has to pay John later and paid Darren and I.

Continue reading

Share Button

Muhammad Butt and Brand New Tube Abandon Libel Claim – Baker Late and Seeking Relief from Sanctions

Judge's Hammer Coming Down on Gavel

An outright victory for the Witchfinder.

The Witchfinder has been served with notice of discontinuance of the libel and harassment (counter) claim against him by My Media World Limited (operator of Brand New Tube / BNT) and its Director Muhammad Butt. The effect of the discontinuance, according to the Civil Procedure Rules (CPR), is that their claim ends and they automatically become liable for my costs of the claim just as if I had won at trial. Your author is legally qualified with an LL.M LPC (Commendation) and I represented myself in the proceedings. At the time of the discontinuance, your author had entered a robust defence and applied to strike out the claim (much like a motion of demurrer, for American readers) and was threatening to apply for security for costs. All the articles complained of are still up and will now have a new, “Defended!” banner adding. In other news, Esther Baker’s counter-claim is also floundering.

The articles successfully defended are:

There was no proper letter of counterclaim. There was a letter from Muhammad and BNT’s former solicitor Blake O’Donnell which in my opinion (and I dun got a distinction on my civil litigation exam) was drafted incorrectly because it did not clearly identify a head of claim. Indeed, ironically one of the allegedly libellous articles now defended was this one in which I pointed out the technical deficiencies in his letter.

Continue reading

Share Button

UPDATE: Hemming v Poulton, Sonia Poulton and Darren Laverty Settle

Judge's Hammer Coming Down on Gavel

One part of the court case ends.

What was originally called the case of Hemming v Poulton (QB-2020-003558) now actually has 4 parties due to various add-on claims (called Part 20 claims). Two such claims have now ended, being between Sonia Poulton and Darren Laverty.

Darren Laverty has made the following public statement:

“My court case against Sonia Poulton has been settled on mutually acceptable terms. This includes the libel claim I am bringing against them and their harassment claim against me. Neither party has admitted liability. For legal reasons I am not able to comment further. As the matter has settled, I regard the matter as at an end. Please do not criticise or disparage Ms Poulton.”

Sonia Poulton has made the following statement:

“As people know, I have been embroiled in legal disputes for the last year. One of those disputes has now ended. My court case involving Darren Laverty has been settled. It was made plain to me that even if I won at trial – and there was no guarantee of such – I would not be able to recover the significant sums of money spent on legal costs. It was therefore decided to end litigation on both sides. For legal reasons I am not able to comment further but I am truly grateful for the support I have been shown.”

I have been providing pro-bono support to Mr Laverty. Now that this case is over, Mr Laverty will shortly be opening up correspondence for a potential claim against Mr Lee Taylor Ryan (@LeeTaylorRyan).

Mr Ryan has for some years maintained that Darren Laverty is a rapist. The difficulty with this is there is compelling evidence that the rape never happened. Mr Laverty was quoted, when a very young man, in an Observer article as admitting to participating in a rape carried out by older boys when Laverty was a vulnerable child in care. Even if this was true, Laverty would be a victim of child abuse, not a perpetrator.

However, MHN has investigated and obtained police records. Police investigated the allegations at the time and contacted the other alleged perpetrators and ‘victim’. It never happened. Laverty says he was wildly misquoted and at the time as a poverty stricken care leaver could do not nothing about the wrongdoing of a powerful national newspaper.

The allegation appeared in an article in 1992 in the Observer by journalist Brian Johnson-Thomas who was later criticised at length for serious errors and misconducts in that precise series of articles, by Lady Justice Macur in a review published in 2017. Mr Johnson-Thomas for example conducted a photographic identity parade in relation to an alleged VIP abuser. He only used four photographs. Two of them were of the same man.

The Lady Judge said this –

“I regard the actions of Mr Johnson-Thomas in staging a photographic identity parade to have been extremely irresponsible. Whether he produced two or four photocopied photographs for consideration could not produce a reliable identification of an abuser and may well have contaminated any legitimate identification made with the safeguards provided in the Police and Criminal Evidence Act 1984 and associated Codes of Practice.”

There were numerous other complaints about Mr Johnson-Thomas. Given the police investigation seems to show that the rape never happened, and given that he was accused of numerous other professional lapses in his coverage of alleged child abuse at the time, I accept Mr Laverty’s account over that of Mr Johnson-Thomas.

I would encourage others not to repeat Mr Ryan’s mistake of repeating or linking to the allegations against Mr Laverty and anyone with a copy of the article on a website or social media account to remove it. Republishing it would amount to actionable defamation, in my opinion.

I would invite others such as Alan Goodwin (@Ciabaudo) to exercise care and discretion. Persons living in Europe can be sued in London and various treaties oblige foreign governments such as Germany to enforce orders for costs and damages.

 

Share Button

Hemming v Poulton: Partial Strike Out and Poulton Faces New £500,000 Claim

Judgement was handed down in Hemming v Poulton today. Ms Poulton is presenting it as an unqualified success on her fundraising page. In fact Hemming succeeded in having parts of Ms Poulton’s amended Defence struck out. Deputy Master Bard struck out all of Ms Poulton’s Defence of Honest Opinion and parts of her Truth defence, with further amendments likely on both sides and no end in sight. Her harassment counter-claim survives although that is not a high bar in a fact sensitive statutory tort. The hearing also dealt with a counter-counter-claim (in effect) by the 4th Party Darren Laverty. Despite the best efforts of Ms Poulton’s barrister Richard Munden of 5RB, who filed an 18 page Skeleton Argument, unrepresented Laverty got permission to bring a £500,000 (half-million) libel claim against Poulton. Finally, it was also confirmed that Ms Poulton is under police investigation for revealing the names of two underage child abuse victims in a video interview. 

Sonia Poulton Video Statement

Sonia Poulton has issued an inflammatory and misleading ‘official statement’ on the dispute. Extracted still used for the purpose of criticism and review.

Your author did not participate in the hearing today as he was working, but had it on in the background at times (like the radio!), except when having connection problems. The judgement was only an initial procedural one, but one thing that amused me was that despite Poulton engaging an expensive lawyer to rewrite her pleadings the judge still struck out parts of it. She is also not trying to prove the Truth of Esther Baker’s allegations. Anyone on hashtag #Truth is going to be disappointed.

The judge criticised Sonia’s pleas on meaning.

Judge strikes out the plea of honest opinion in the absence of specification of what that opinion was.

Continue reading

Share Button