Gotcha!

The snippet above is taken from the Tribunal Judgment by Employment Judge Graham: “Ghost writing was a consistent and concerning theme throughout this matter“

An email comes purportedly from the Vice Chancellor Deborah Prentice at 13 Aug 2026, at 15:23.

Who really wrote the email?

We can look at the source code. We can use MacMail and hover over with our cursor. Or we can copy the email into a text editor (like emacs). In every case, a name appears:

These issues began before my time, but they have come to a conclusion on my watch. I want to now ensure that they are assessed thoroughly and independently, and that we can learn from them and make the necessary changes.

Our aim must be clear: a Cambridge in which academic excellence, merit, fairness and due process are not simply principles we affirm, but standards that are consistently reflected in how we make decisions and how we treat our people.
Yours sincerely,
Kamal

Professor Deborah Prentice
Vice-Chancellor

“Yours sincerely, Kamal“.

This is strange. Why does the name of Prof Kamal Munir appear? A deep dive in recent all staff messages reveals:

7 May 2024: “All-staff notice” (from Munir personally, on the tracked channel): signature image w660_78529_kamal_2022_si.jpg, alt=”Kamal”. This is a genuinely Munir-signed message, the image file itself is named kamal_2022.
29 Jul 2024: “Pay and benefits package”: signature image w660_78530_kamal_2022_st.jpg, alt=”Kamal”, again a Munir signature block, image filename explicitly kamal_2022.
21 Jul 2025: “Professional Services Recognition Scheme is now open”: signature image w660_78530_kamal_2022_st.jpg, alt=”Kamal”, same Munir signature asset reused a year later.
31 Mar 2026 — Rokos School donation announcement: signature image 225309_debbie_2023.png, alt=”Debbie”, a different Prentice signature asset with a correct (informal) alt attribute.

Therefore, in 2024 the template’s signature slot was populated with Prof Kamal Munir’s signature image (w660_78529_kamal_2022_si.jpg / w660_78530_kamal_2022_st.jpg), hard-coded with alt=”Kamal”. Those messages were genuinely from Prof Kamal Munir.

When someone later reused that template block for the Prentice-signed message (the 13 August 2026 message on Jason Arday & Wyn Evans), they swapped the src= to debbie_se_500.png but didn’t update the alt/title attributes, leaving the stale alt=”Kamal”.

In itself, this does not prove that Prof Kamal Munir was the original author.

What is reasonable to infer is that for whatever reason, the communications team when first drafting the 13 August message began with an email block addressed from Kamal Munir, and including his image. This may have been a completely unrelated email in to which they dropped the Vice Chancellor’s text, or it may have been a first draft with Kamal Munir indicated as the intended signatory. Then, at some point, prior to it being sent, the image was replaced with Deborah Prentice, but without changing the “alt” tag attributed to Kamal Munir. The latter seems more likely than the former.

So, who really wrote the email?

Professor Kamil Munir, probably.

Not least because the idea of circumventing the existing Grace on an external HR audit by using the University’s internal Audit Committee was expressed by him earlier. It’s his idea.

Categories: Blog

54 Comments

21percent.org · 13 August 2026 at 18:41

Reposted from previous thread by a contributor:

Be careful with Debbie’s all-staff email. Just told that it contains a surveillance (“tracking”) pixel so the university can monitor whoever opens it.

Have now confirmed this myself a minute ago. It seems that the “tracker” is tied to each individual recipient in order to identify any member of staff who forwards it to another person.

Be sure to view it in text only format – and never in html.

Henry · 13 August 2026 at 20:41

Sorry but that’s not true – the “Message from the Vice-Chancellor, 13 August 2026” email does not include any tracking pixels. If you view the email source there are no html img elements, so viewing the email in your email client does not provide any tracking.

The mail does include a number of HTML links with long random-looking strings in the URL, which are almost certainly unique to each recipient and would hypothetically allow e.g. the original recipient of the mail to be identified if you were to forward it to a third party, and they then clicked the link, and the Uni were then able to identify that website hit based on info like the client IP. That would be extremely difficult/unlikely in practice and the person of the unique links is almost certainly to “track engagement” (not saying I agree with that kind of tracking but it’s a far cry from embedded tracking pixels)

- · 13 August 2026 at 21:44

Think those unique identifier links load automatically on reading the html, but open to input here.

Henry · 13 August 2026 at 22:21

Simple links in emails . Tdo not load automatically. They only offer any possibility of hypothetical tracking via the unique IDs when clicked upon to open the link in a web browser.

Tracking pixels work on the assumption that remote images in emails are automatically loaded (NB this is why I set “autoload remote images” or similar to “off” in Thunderbird). They would show up in the email source as:

a) an html img element (i.e. a string starting <img ……)
b) with a src attribute (src=) set to a remote url starting http or https
c) and, to track individuals, the src URL would probably contain a long string of random-looking characters

I've not checked every "all staff" mail I have received but the one I received today included no such HTML.

Just a Number · 13 August 2026 at 22:17

The html

<img src="https://internal.communications.cam.ac.uk/o/NDv1jOHD3YLyTAFSiGVtNFwr66pR2hyrGOXNDQB55vXAkYPTHfuccOGGQnNhYYvh48lgEDt/o.gif" height="1" alt="" …

looks dodgy to me. I thought that tracking pixels were entirely against the DPA unless one had explicitly given consent? Whatever else, they certainly do not increase trust levels. (I may have changed the long random string above slightly.)

- · 13 August 2026 at 23:13

Looks like a tracking pixel to me. This is illegal under regulation 6 of UK PECR 2003.

Just a Number · 14 August 2026 at 09:51

So some believe that the VC’s response to an ET at which it was ruled that she, personally, was involved in breaking the law is to send an email to all staff which breaks the law? Can 21percent.org get a firmer legal ruling on the status of these tracking pixels, as the opinions of a couple of anonymous contributors here might not have much weight.

It appears to me that the trail ends up at dotdigital.com, whose privacy policy at https://dotdigital.com/terms/privacy-policy/ does not conform with my understanding of UK law, but as it appears to be a UK company openly operating like this, it has presumably found a loophole.

Redhat · 14 August 2026 at 06:14

Correct. This is a tracking pixel. The code is:

img src=”https://internal.communications.cam.ac.uk/o/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX/o.gif” width=”1″ height=”1″ style=”width:1px;height:1px;max-width:100%”

Where the 64-character “XX…XX” block is the unique identifier of each recipient.

As noted this is illegal under UK law, but some additional technical notes:

1. The host is: internal.communications.cam.ac.uk (Cambridge’s ESP / comms platform, not emlfiles4.com which serves the template images).

2. The path: /o/…/o.gif — the /o/ route is the platform’s “open” endpoint; the long opaque string between /o/ and /o.gif is the per-recipient, per-send token that identifies which recipient opened which message.

3. The dimensions: width=”1″ height=”1″ and inline CSS width:1px;height:1px – this is an invisible 1×1 image whose only purpose is to force the client to make an HTTP request that the server can log.

4. The position is it appears near the bottom of the HTML, after the footer content, which is the standard place ESPs inject the beacon.

That is the entire tracking mechanism: one line, one image request, one server-side log entry.

Now the interesting question – are there recipients who can genuinely attest that their emails did not include this tracker? If only selected recipients (incidentally contributors to this group) received it, then the plot truly thickens.

Redhat · 14 August 2026 at 06:59

So, just took a deeper (deep) dive on this stuff.

Do you remember that “cyber security training” module we were sent? You know, with the silly video of Debbie telling us awkwardly why all organisations need to ruthlessly ensure all of their internal data is under lock and key and we sniff out snitches (or whatever)?

That email…. wait for it… contains an illegal tracking pixel. You are reading that right – the very email asking staff to complete their cyber security awareness module – contains a personal cyber security risk!

You cannot make this stuff up.

You’ll find it in there in the same format:

img src=”https://mail.metacompliance.com/wf/open?upn=u001.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX-3D-3D” alt=”” width=”1″ height=”1″ border=”0″ style=”height:1px !important;width:1px !important;…”/

Seems doubtful would survive a challenge under PECR 2003 regulation any better than the other ones we are being provided without consent or any obvious purpose to the processing of our personal data.

Can someone please audit all of their messages for this conduct?

? · 14 August 2026 at 07:19

Congratulations Redhat, you are the first (and only) member of staff to pass the cyber security module

Your prize is immediate contract termination

TheResearcher · 13 August 2026 at 18:57

These people never learn… what a laughing stock!

It reminds me that time when Ms Louise Akroyd drafted a letter on Professor Kamal Munir’s behalf exonerating her own misconduct and he says in reply “Looks fine to me, Louise. Let’s finalise and send, Kamal”.

21percent.org · 13 August 2026 at 19:02

Also, if you have just been found guilty of retaliation against a whistleblower, you should not be setting up any kind of inquiry

? · 13 August 2026 at 19:03

Oh wow. That does look like a fuck-up.

- · 13 August 2026 at 19:10

Fun extra finding – those earlier all-staff messages from Kamal Munir in 2024-5 also contain tracking pixels.

AnAcademic · 13 August 2026 at 19:23

Silly question, perhaps, but what is a tracking pixel? Does this refer to the email we received this afternoon? (Also, the new VC picture made me chuckle…what a change from the picture on yesterday’s press release!)

- · 13 August 2026 at 19:30

It is a tiny (pixel sized image hidden inside an email html. When the email is loaded it loads the image from the recipient, sending back a) the name of the specific individual the email was sent to, b) the time they read the email, c) their IP based location, d) their operating system, e) browser, f) browser language.

TheResearcher · 13 August 2026 at 19:51

“for whatever reason, the communications team when first drafting the 13 August message began with an email block addressed from Kamal Munir”

Why would the communications team start with Munir’s email block if he had not written the draft of 13 August? If it was Prentice who wrote the draft, then they would start with an email block from her. Am I missing something here? The alternative, of course, is that she never sent an email to staff in 3 years and the communications team did not have an email block to build from. That alternative is also revealing about her leadership at Cambridge.

For Justice · 13 August 2026 at 20:19

THIS IS AMAZING:
“6. Pre-determined outcomes appeared to have been rubber-stamped, and little if any paper-trails were put before us showing the thought process behind the decision-making; and various witnesses struggled to explain to us what it was that they took into consideration when reaching their conclusions. In one example the person being complained about drafted the response to the Claimant rejecting his complaints against them. Ghost writing was a consistent and a concerning theme throughout this matter.”
THIS IS EXACTLY HOW THE ONCOLOGY/CANCER RESEARCH SCANDAL IN THE SCM UNFOLDED. THE UNIVERSITY DECIDED TO FOLLOW PROF TEFLON AND DESTROY A WORLD CLASS GROUP WITH FALSE ALLEGATIONS AND A PROCESS AIMED AT ACHIEVING THAT GOAL. THE PRE-DETERMINED OUTCOME WAS THE DESTRUCTION! SCANDALOUS AND DISGUSTING.

Raven · 13 August 2026 at 20:42

Reusing a template is not the same as ghostwriting.

People have been heard.

Let’s step back.

These investigations are not something she can afford to let fail now.

Madam Speaker · 13 August 2026 at 21:08

Sorry, what does ‘let’s step back’ mean? why?

Raven · 13 August 2026 at 21:13

“Let’s step back” means let’s look carefully at the contents of the VC’s message and not attribute motive.

? · 13 August 2026 at 21:18

Why not? Context is content.

Raven · 13 August 2026 at 21:25

Keeping content and context separate at outset does not mean that context cannot inform content eventually.

Anonymous · 14 August 2026 at 00:01

Are you fine with an internal audit in response to demands for an external audit?

Raven · 14 August 2026 at 07:48

The Deputy Chair of the University Council and the Council’s Audit Committee will be asked to establish the terms.

The review itself is referred to as an independent one, of all relevant University processes – independent, not external (since external may not at all be independent).

21percent.org · 14 August 2026 at 07:56

True, but we all know the devil is in the detail of the Terms of Reference — which is being drawn up internally

Raven · 14 August 2026 at 08:02

I agree. We all know that first hand.

Crying Princess · 13 August 2026 at 21:33

Content is watering down HR grace by handing it to Audit.

21percent.org · 13 August 2026 at 21:57

Agreed — the intention is to evade the HR grace of Ronald Haynes by handing it to the (Internal) Audit Committee

https://www.governanceandcompliance.admin.cam.ac.uk/university-committees/audit-committee

!! · 13 August 2026 at 22:03

Sally Morgan on the audit committee? The same Sally Morgan who chaired the Arday hiring panel and CUH? How is that supposed to work?

? · 13 August 2026 at 22:00

Bottom line is that trust is so shot in the leadership right now that staff wont believe anything until the heads start to roll. Everything until that point is just either pretense or prelude. The pressure will continue.

Madam Speaker · 13 August 2026 at 21:47

I query the notion that ‘people have been heard’. Both response letters ignore key parts of the letter to her including the question of how allegations are investigated, and both are about saving higher management’s skin, and throwing education and so called ‘devolved’ decision making into the fire.

‘People have been heard’ appears to be exactly what Old Schools would like to think to dissipate the momentum.

Anonymous · 13 August 2026 at 23:51

I too.

Raven · 13 August 2026 at 21:55

Rest assured Raven is not Old Schools.
Quite the contrary.

Madam Speaker · 13 August 2026 at 22:08

I made no claims of Raven. Simply said that the letters are meant to end discussion.

Actions not words · 13 August 2026 at 23:00

If the VC is serious about the ET which she lost, she will arrange to have a private meeting with Wyn when she is next in town in order to apologise in person. I expect Wyn would then make it clear to her that, whether or not Arday’s case was an isolated aberration, the HR malpractice exposed at the ET has been repeated many times over many years, and that he is aware of several current examples.

It is just possible that the VC is so isolated that she is unaware of the extent of the problem. Once she is, she should realise that, if the UIS can fire people first, and construct a new strategy second, so must she. Given how long investigations and reports take in Cambridge, people will not be content to wait for them to conclude before a more impressive head-rolling session than a PVC stepping down a mere twelve months early.

I wrote “it is just possible”. Many will think that it is not possible, and that the VC has been aware of serious issues for some while, and failed to resolve them. If that is the case, there is little reason to believe that she will do much now. But it is unclear that letters sent to her are read by her, even on the rare occasions when “she” replies.

I do not agree that she needs to get rid of large numbers of people. Two or three could be sufficient to signal that we are now heading in a new direction, and what was previously acceptable no longer is. Such a clear signal might cause several other people to realise that self-preservation requires a change of habits.

I somewhat agree with Raven in that expecting action in August is unreasonable. Even if the VC were here, many of the people she would wish to consult would not be. But patience is wearing thin, and the danger of serious reputational damage to the University increasing.

Madam Speaker · 14 August 2026 at 12:42

Actions Not Words: yes, a number of people need to go beyond the early stepping down of one PVC. Andi Hudson’s position clearly untenable, as also Helms, Vira, and possibly Aston. Before the next academic year.

Anonymous · 13 August 2026 at 23:54

You can say that again

TheResearcher · 13 August 2026 at 22:38

I ask the members of Regent House that read and/or contribute to the 21 Group blog to read carefully this paragraph of the Vice-Chancellor’s email:

“I have therefore taken the step of asking the Deputy Chair of the University Council and the Council’s Audit Committee to establish the terms of an independent review of all relevant University processes, with the outcome to be reported directly to the Council. This will operate independently of, but alongside, the investigation into the circumstances around Jason Arday’s appointment and time at Cambridge. I am also aware of calls from some members of our community for an audit of our HR procedures and practices, which I will ask that this review addresses. I will also stress the importance of this review proceeding at pace and concluding as quickly as is possible.”

Please understand that that the Grace about HR practices explicitly asks an external audit of HR practices for obvious reasons, and given the recent events related to the Research Integrity Office, it is expected that it can include an external audit of this Office as well.

Professor Prentice here is already telling Regent House members that if they approve the Grace of Ronald Haynes as it is, the Council will impose changes, namely that an internal review is done instead. Please do not allow this to happen because what the leadership wants is to control the narrative of these investigations. Gaenor Bagley is aware of what happened in DAMTP and the retaliations I got and ignored it. He is not different from the other leadership and it is rather disturbing that Prentice expects that a person from Council, who were silent for 3 weeks seeing how the University was being humiliated nationally and internally, is the right person to be responsible for this task.

Anonymous · 13 August 2026 at 23:57

They want to control the narrative and ‘mark their own homework’ as Priya said. This cannot happen! An external audit only.

N/A · 14 August 2026 at 05:40

Even in the last week thw reports of retaliation are coming in. They are becoming more vicious – not less. Expulsions, account terminations, appeal denials on vexatious grounds, GDPR and FOIA refusals. Whistleblower retaliation in Cambridge in August 2026 is at the absolute all-time maximum level.

There need to be sackings. Across the administration. Now. Immediately. Make it stop.

TheResearcher · 14 August 2026 at 07:08

” Cambridge to review all HR procedures”

“University to undergo audit after ‘shutting down’ whistleblower’s complaints of bullying and misogyny ”

https://www.telegraph.co.uk/news/2026/08/13/university-cambridge-review-all-hr-procedures-jason-arday/

The Telegraph quotes the section of the email I mentioned above, but do they know already about the tracking pixel and the DeborahMunir affair? They will love!

TheResearcher · 14 August 2026 at 07:18

And another, now from The Times:

“Cambridge boss in turmoil as second inquiry is announced”

https://www.thetimes.com/uk/education/article/cambridge-boss-in-turmoil-as-second-inquiry-is-announced-fdr6xmzmp

“One academic told The Times that the letter implied threats to the power of Regent House and also criticised the vice-chancellor for saying she had not been in place when problems emerged, even though many of her deputies had been.”

“The academic added: “I think they want to see much more power with the vice-chancellor and pro-vice-chancellors.””

Three cheers to this “academic”!

Eileen Nugent · 14 August 2026 at 09:23

https://www.admin.cam.ac.uk/reporter/2009-10/weekly/6171/section8.shtml

In 2009 “Perhaps the most disgraceful argument I have heard in this regard is that, yes, this is an unfair dismissal but the compensation Employment Tribunals award in these cases isn’t very much.”

When did the university not have these problems? When did these problems emerge? Employment tribunals began in the 1960s – did the university not have these problems then?

This is British employment culture – using public funds to buy the employment right on which all other employment rights rest. Using public funds to undermine laws put in place in the public interest. If laws are dynamically maintained in a functional state they should optimally serve the public interest. If the laws never operate as intended then it’s very to dynamically maintain them in a functional state.

Eileen Nugent · 14 August 2026 at 09:45

*difficult

Eileen Nugent · 14 August 2026 at 10:46

The default culture is this : “Perhaps the most disgraceful argument I have heard in this regard is that, yes, this is an unfair dismissal but the compensation Employment Tribunals award in these cases isn’t very much.” i.e. the argument is that an organisation can create a preventable HR/legal problem for a person and pay public funds to not remedy that preventable HR/legal problem.

If the VC is not supposed to intervene in any case – otherwise it could be favouritism – unless the VC willing to intervene in every case – which is the inevitable end point of intervening in any case – then the destiny of a VC is either to engage in serial whistleblowing retaliation or to personally try to solve every HR/Legal dispute in the organisation.

Eileen Nugent · 14 August 2026 at 11:44

The above should have read : “I asked the people who contributed towards generating the HR/Legal problem to contribute towards solving the HR/Legal problem. The HR/Legal problem could have been solved at the departmental level.”

but this is British employment culture :