McSweeney goes - but ​​Josh Simons in the frame over targeting journalists

Cabinet Office minister hired a PR firm to investigate journalists. His explanation is bewildering - and begs one big question. How can Starmer keep him on?

By Peter Geoghegan and Khadija Sharife

Morgan McSweeney is gone. His resignation cited his role in the disastrous decision to appoint Peter Mandelson as Britain’s ambassador to the US.

His departure follows revelations by Democracy for Sale that Labour Together - the think tank he built to propel Starmer to power - hired a PR firm to investigate journalists from the Sunday Times, and other outlets.

Sources close to the Irishman admitted he was aware that Labour Together hired APCO Worldwide in November to identify the sources of journalists digging into its undeclared funding. Former Labour Together director Jon Cruddas called it “dark shit”.

But the scandal does not end with McSweeney. Indeed, it now goes right to the heart of Starmer’s government.

APCO’s investigation was commissioned by Josh Simons, the former head of Labour Together who is now MP for Makerfield and a Cabinet Office minister under Starmer.

Simons, who used to work on AI for tech giant Meta, wouldn’t talk to us about paying a PR firm to dig dirt on journalists. Before publication we called his mobile, sent a WhatsApp, and emailed his parliamentary email address and the Labour press office. No response.

He did not respond to the Guardian, the FT, the Times, the BBC or other outlets either.

But over the weekend, Simons broke his silence.

On Twitter, he dismissed our story as “nonsense”. He told his local newspaper that “in my previous job at a think tank, we suspected an illegal hack of sensitive materials. We asked a PR company to look into that.

“It was nothing to do with excellent UK journalists at Sunday Times, Guardian or any other British newspapers.”

So now, finally, we have Simons’ side of the story. But there is a big problem - Simons’ account doesn’t seem to tally with the facts. Indeed, it shows why we need a full investigation into Labour Together’s activities.

Take Simons’ claim that APCO’s work had “nothing” to do with British journalists.

We have seen an internal APCO briefing that references stories in the Sunday Times and other media, saying “it is important to identify the source of the information and to ascertain what additional information could be published”.

The same document lists “significant persons of interest” - journalists including the Sunday Times’ Gabriel Pogrund and Harry York; the Guardian’s Henry Dyer; and others.

Maybe Simons’ singling out of “UK journalists” is intentional.

One of those targeted, Paul Holden, is a South African-born British citizen. Another APCO report said his work for an outlet funded by George Soros’s Open Society Foundation “represented a significant leverage point”.

Call me old-fashioned, but identifying journalists’ sources, listing reporters as “persons of interest”, and mapping out “leverage” over one of them sounds like “investigating journalists”. No wonder the National Union of Journalists called this “deeply concerning”. Of course it’s possible that APCO went beyond its mandate, but that’s never been suggested.

Simons’ other defence is that Labour Together asked “a PR company” to investigate a suspected “illegal hack”.

If you think you’ve been hacked, you call cyber security experts, not “a PR company”.

APCO’s work was carried out by Tom Harper, an ex-Times journalist with no cyber forensics background. We asked whether APCO conducted any cyber security analysis or audits; they refused to say. Evidence seen by Democracy for Sale shows other authors were similarly not tech experts.

And what about the “illegal hack”? If there is any evidence of a hack, we’ve not seen it.

APCO’s reports speculate that stories about Labour Together’s undeclared funding came from a hack of the Electoral Commission, by Russia or China. The hack of the elections watchdog was real, but there was no evidence that Labour Together’s material was accessed or that Labour Together itself was hacked, which is what Simons seems to imply.

The minister’s defence has convinced some. Labour MP Luke Akehurst dismissed the scandal as a bagatelle. Kevin Maguire tweeted that he “accepted” Simons’ version. (Neither mentioned Simons’ garbled late night tweets….HOWZATT.)

PR by tweet: Josh Simons on Friday night

But Simons’ erratic comments only underline the inconsistencies in his account.

The reports that Labour Together paid APCO at least £30,000 for are thin fare: some advanced google searching, maybe a few conversations.

But the PR firm served a purpose.

We can report that in early 2024, Labour Together, with Simons’ direct knowledge, told the National Cyber Security Council it had been the victim of a hack, and gave APCO’s report as proof. The report contained no evidence of any hack, but the National Cyber Security Council said it would look into the matter.

More importantly, APCO’s reports - and the security services’ interest - gave Labour Together material to brief to the media, effectively stopping further reporting into its undeclared finances. What journalist wants to think they might be furthering a Russian hack? At least one senior lobby journalist bought Labour Together’s fantastical story.

The reporting Labour Together wanted to bury came from Freedom of Information requests, well-placed sources and journalists asking the right questions.

These stories went to the heart of British politics: Labour Together’s failure, on McSweeney’s watch, to declare £730,000 in political donations.

That undeclared funding - dark money, if you will - paid for the polling and campaigning that helped power Starmer’s rise to the Labour leadership, and then to Number 10. Its exposure could have proved fatal.

This is why Simons’ comments are so significant. If he was so worried about a “suspected illegal hack” why commission a PR firm? Why produce dossiers on journalists and talk about having “leverage” over them? And why brief a story making reporters look like unwitting agents of foreign hackers?

Those are not the actions of people trying to secure systems. They look like the actions of people trying to shut down scrutiny.

Or, more indelicately put: cover their arses.

This goes to the heart of Starmer’s administration. Who else received APCO’s briefings for Labour Together? Who paid the bills? Did Labour Together waste security services’ time?

All this begs another question: the Cabinet Office is supposed to be responsible for ethics and integrity in government. Can Starmer really retain a Cabinet Office minister who commissioned a PR firm to investigate journalists on the flimsiest of pretexts?

We put these questions and others to Simons, the Cabinet Office, APCO and Labour Together. None have so far responded on the record.