Portions of leaks verified by nine

“Tan Sri”, a Malaysian honorific, though multiple texts bear the signoffs “Chenlk Naga” and “Chenlipkeong Naga”. Chen Lip Keong is the CEO of NagaCorp, the Hong Kong-listed parent company of Phnom Penh’s only casino, NagaWorld.

About 20 messages are between Tan Sri and another person, identified as “mohan” - a seeming reference to T Mohan, publisher of the English-language newspaper the Khmer Times. In the messages Mohan asks Tan Sri for money to pay salaries for last November, and goes on to say he has made good by cutting down printing costs.

Sok Puthyvuth (left), Hun Manith (centre) and Hun Manet (right) were among those whose alleged private messages were leaked to the media on Wednesday. Post staff /Photo supplied

Portions of leaks verified by nine

Phnom Penh Post | 3 March 2017

 “Joe Matthews”, who asks Manet to accelerate his application for citizenship.

Joseph Matthews is a self-styled television pundit, who espouses a pro-government line in his on-air appearances. Matthews could not be reached for comment over the past two days. In the logs, Joe Matthews plies Manet with electoral strategies, and a pledge to work for “Samdech Techo” – an honorific belonging to Hun Sen – for the rest of his life. 

He also alludes to Manet being sent a strategy for the upcoming elections titled “PSYCHOLOGICAL TACTICS : FEAR FACTOR !”

Nine people have confirmed in interviews the genuine nature of messages of theirs appearing in a trove of leaked correspondence with members of the Hun family, cabinet ministers and wealthy tycoons, lending a level of credence to the at-times damning revelations that is hard to dismiss. 

The leaks came in the form of 20 logs of text messages, forwarded to media outlets by former opposition leader Sam Rainsy. The logs included every immediate member of Prime Minister Hun Sen’s family – first lady Bun Rany; his sons Hun Manet, Hun Manith and Hun Many; and his daughters Hun Mana and Hun Maly – as well as three of Deputy Prime Minister Sok An’s sons. 

Also included are Hun Sen’s cabinet chief Ho Sothy, Transportation Minister Sun Chanthol, Information Minister Khieu Kanharith and Rainsy himself. 

Speaking on condition of anonymity, nine people whose names and correspondence appear in the leaks confirmed over the past two days that they had, in fact, sent the text messages appearing in the logs next to their names and numbers, even going so far as to corroborate the dates and content of the messages.

Additionally, the log purporting to show texts received by Sok An’s son and Hun Sen’s son-in-law Sok Puthyvuth reflects text messages sent to him by a Post reporter requesting an interview last September. 

A Post reporter’s mobile phone displaying a message sent to Sok Puthyvuth. The same message appeared in a cache of leaks revealed on Wednesday. Post staff

The messages, which appear verbatim in the logs with matching time stamps, are still contained in the reporter’s phone (see right).

The logs of messages appear to be computer-generated, and contain the text messages’ content and the senders’ and recipients’ phone numbers, along with the names of the 20 targets of the purported hack. The texts date from September to February, and were sent to Rainsy from the Gmail address of an anonymous sender called “Angkor Borey” on Wednesday. 

However, the data in the logs seem to have been edited, with responses from certain individuals seemingly deleted from two-way conversations. 

Many of the logs contain hundreds of texts, some of them mundane chitchat between the targets and others. Some, however, appear to suggest an ethically questionable confluence of politics, business and media interests.

Among the most noteworthy of the texts is a conversation that appears to show the billionaire CEO of Cambodia’s largest casino colluding with the publisher of an English-language daily newspaper, as well as Hun Manith, the premier’s son and head of military intelligence.

The messages mostly come from the log of a person identified as “Tan Sri”, a Malaysian honorific, though multiple texts bear the signoffs “Chenlk Naga” and “Chenlipkeong Naga”. Chen Lip Keong is the CEO of NagaCorp, the Hong Kong-listed parent company of Phnom Penh’s only casino, NagaWorld.

About 20 messages are between Tan Sri and another person, identified as “mohan” - a seeming reference to T Mohan, publisher of the English-language newspaper the Khmer Times. In the messages Mohan asks Tan Sri for money to pay salaries for last November, and goes on to say he has made good by cutting down printing costs. 

While The Post was not able to independently verify the contents of the Tan Sri log, portions of the purported conversations contained there are reflected in the incoming messages of a separate log linked to a phone number belonging to Hun Manith, a portion of which The Post was able to independently authenticate.

In that conversation, Tan Sri is seen discussing substantial payments to be made to Mohan. 

“Just talk to mohan,” one message from Tan Sri’s phone number reads. “Was told Philip gave him 120k in oct n nov. this month Philip told me he will give another 65k”.

Though “Philip” is never identified by his full name, NagaCorp’s chief financial officer is named Philip Lee Wai Tuck. 

“Besides this monthly thing out of system does not appear anywhere. Better not to talk too much over phone,” Tan Sri says, before ending the conversation. 

Reached yesterday, T Mohan denied knowledge of the leaked texts and claimed to run the Khmer Times with “internal funds”. He denied any transactions with NagaWorld beyond ad sales, adding in reference to NagaCorp’s Lip Keong, “we do not have these kind of conversations”.

“I am not making any comments to you because you are making comments and allegations against a powerful businessman. There is no such transaction,” he said. 

Manith could not be reached yesterday, but on Wednesday he refused to answer questions relating to the leaks, saying he did not talk to “your group”, a reference to The Post. When asked if he had participated in securing the Khmer Times a cash infusion from Keong, Manith repeatedly refused to answer the question.

Emails sent to Lip Keong were not answered, and multiple phone calls and emails sent to various department heads at NagaWorld and NagaCorp – investor relations, corporate communications and marketing – went unanswered yesterday. 

But Manith wasn’t the only son of the prime minister who appeared to collude with media personalities in the purported messages. 

Another set of texts – which The Post was unable to independently authenticate – purports to show premier’s eldest son Hun Manet receiving texts from an individual who identifies himself as “Joe Matthews”, who asks Manet to accelerate his application for citizenship.

Joseph Matthews is a self-styled television pundit, who espouses a pro-government line in his on-air appearances. Matthews could not be reached for comment over the past two days. In the logs, Joe Matthews plies Manet with electoral strategies, and a pledge to work for “Samdech Techo” – an honorific belonging to Hun Sen – for the rest of his life. 

He also alludes to Manet being sent a strategy for the upcoming elections titled “PSYCHOLOGICAL TACTICS : FEAR FACTOR !”

Manet is a three-star general in Cambodia’s ostensibly politically neutral military, and head of the Ministry of Defence’s counter-terrorism unit. Neither Manet nor Matthews could be reached yesterday.

In another series of messages contained in the Manet log, this one in Khmer, a sender who identifies himself as “Leang Samnath” notes a recent appointment as deputy director of the Phnom Penh Municipal Court, and asks for the lieutenant general to intervene and stop an apparent transfer outside the city. 

Deputy court director Leang Samnath is the judge currently adjudicating the trial of the killer of political commentator Kem Ley, Ouet Ang. Samnath could not be reached yesterday.

One of the longest logs disseminated in the leak is purported to belong to Sok An’s son and Hun Sen’s son-in-law Sok Puthyvuth, a prominent businessman. Two sources interviewed by The Post – as well as a Post reporter – confirmed that messages of theirs appearing in the Puthyvuth log were authentic. In the log, Puthyvuth appears to act as an intermediary for the setting up of a smart city in Sihanoukville, and to facilitate the import of antennae for Apsara TV. 

Puthyvuth is the head of the Cambodia Rice Federation (CRF) and runs the Soma Group, a diversified business with a focus on rice. In a portion of the log dating from September, messages from Puthyvuth’s phone number to a man named “Sokhar” ask whether “our Police force can help buy some rice from CRF?” At the time, the ruling party had instructed its wealthier members to buy rice from farmers who were dealing with falling prices.

Puthyvuth did not respond to emails or phone calls yesterday. 

The CNRP has been similarly battered by unverifiable leaks over the past 12 months, which have alleged extramarital affairs and gambling problems and raised questions of illegal wiretapping. One set of leaked phone recordings saw new CNRP president Kem Sokha handed a five-month jail sentence in relation to a “prostitution” case widely seen as politically motivated. 

Manith has also been embroiled in a similar leak, purportedly containing voice messages between him and social media celebrity Thy Sovantha, in which both discuss the latter’s plans to conduct protests against Sokha. 

Government officials at the time did not deny the authenticity of the recordings, but declined to investigate the potential involvement of General Manith in politics, calling the messages a “private matter”.

Niklas Femerstrand, a cyber security expert who occasionally works as a consultant for The Post, said that given the phone numbers contained in the recently leaked logs were from different telecom providers, it was unlikely a “rogue” telco employee had leaked them. Additionally, the exclusion of an IMEI number – a unique identifier for a phone – in the logs again suggests they did not come from a telco provider. 

Fermerstrand also pointed out that the timestamps on the leaked texts are not in chronological order and that certain sections seem to lack conversational flow. “This can either mean that those messages haven’t been picked up the way the messages have been collected or that they have been excluded from the leaks,” he said. 

He added that the hacks could have been perpetrated one of two ways: The government’s own backdoor access to telecom providers could have been exploited by the leaker, or specific malware was developed by the perpetrator then run on a target’s phone. 

“I find it unlikely that all 20 targets of the leak use the same type of phone and the same software versions, meaning that if a malware was used then multiple versions of the same malware must exist,” he said. 

Despite personally distributing the leaks, Rainsy has attempted to distance himself from the matter, saying he was staying away from the files and has refused to discuss whether it was advisable to circulate unverified documents – particularly when such leaks have dogged his own former colleagues. 

Told yesterday of The Post’s authentication of sections of the leak, Cambodian People’s Party spokesman Sok Eysan brushed the releases off as an election season ploy. “These leaks are not strange,” he said. “It’s near election time so the opposition members always distribute bad news and weak points of the ruling party to defame the party.”

Spokesmen for the ministries of interior and defence, Khieu Sopheak and Chhum Socheat, respectively, could not be reached. However, when contacted on Wednesday, both denied having any knowledge of the leaks.