Windsor council grills ERCA on nearly $300K phishing scam, yet turns down seeing investigative reports

Windsor city councillors turned down the opportunity to look at investigative reports that outline details of a phishing scam directed towardthe Essex Region Conservation Authority, which cost the organization nearly $300,000 last year.

But still, interim general manager for the Essex Region Conservation Authority (ERCA) Tim Byrne was grilled by some Windsor city council members Monday about thefraud scandal that took place July 2020. The incident happenedafter a fraudster pretended to be an internal staff member and then completed two transactions sent to falsified bank accounts.

Though somecouncillorsdemanded answers from Byrneas to how the money was authorized to leave ERCA's account, the majority voted against viewing reports from three separate investigations that were held on the matter.

Investigations were conducted byERCA's own management and theOntario Provincial Police,now another joint investigation is being held by the OPP and RCMP as the fraudsters are believed to be part of an international criminal group, Byrne said.

"Voting against this today I actually think sends the opposite message. It perpetuates more suspicion in the minds of the public," Windsor Mayor Drew Dilkens said prior to the vote.

He noted that he knows the details of what happened, but didn't find out through ERCA or other council members, adding that it's "problematic" he had to find out the details from someone else.

He said ERCA was asked earlier to appear before council but never responded to the request.

"I don't think it was intentional, but there are a number of things that happened here which certainly created a level of concern and suspicion," he said, adding that this all took place as staff members departed and some were on a leave of absence.

Dilkens' comments seemed to relate to the fact that months after the incident took place,the conservation authority announced that its current GM Richard Wymawould leave in September.

It's still unclear whether Wyma's departure was related to thefraud scam.

The investigations, according to Byrne, found that "all existing staff at the conservation authority through all investigations were deemed to have zero responsibility, zero involvement in any of the activities with respect to this incident."

But Ward 6Counc. Jo-Anne Gignac and Ward 1Counc. Fred Francis inquired about whether alack of oversight led to the loss in funds.

"I appreciate the fact that there's no criminality internal in the organization, but ... when you really dig into it that [fraud] would not be possible unless it was okayed... this literally had to be authorized and funding had to be authorized," Francis said.

Gignac made similar comments and in response Byrne said he couldn't speak to that further as it was covered under a personnel agreement with the conservation authority.

Gignac put forward themotion, which requested that ERCAask its board to provide the investigation reports to the city andalso allow the city's auditor general to review the organization on a regular basis. Onlyfour councillors supported the motion and seven were against.

Allcouncillors who sit on theERCA board opposed the motion, including Ward 9 Counc. Kieran McKenzie, Ward 10 Counc. Jim Morrison, Ward 5 Counc. Ed Sleiman and Ward 7 Counc. Jeewen Gill.

Prior to the vote, Morrison said the authority hasalready been transparent about the incident, which is why he doesn't support the motion.

"There was no hiding behind anything, everybody was totally open and honest about the investigation," Morrison said, adding that when the incident took place the organization quickly addressed it with the board.

'We fell prey'

One of the details Byrne revealed during the council meeting was that thehacker got into ERCA's system in March and was able to learn how the organization operated and communicated.

"It's the kind of smash and grab that occurs when we alllive in this digital world," Byrne said. "We unfortunately fell prey to a very sophisticated, complex system where someone could infiltrate your system and thenpretend to be someone else and then gain that trust and then have someone act."

He said ERCA "strongly" recommends that municipalities take a close look at their own cyber security.

Byrne added issues such as these occur when people become "too complacent" and that everyone needs to have "inherent skepticism" to prevent themselves from being victims of a similar scam.