'Not humanly possible': Driving instructor allegedly hacked auto insurance computers

Insurance investigators raided the home office last month of a Richmond, B.C., driving instructor suspected of hacking the province's notoriously backlogged wait list for road tests.

According to court documents obtained by CBC News, the man was able to schedule road tests for his students in as little as two days — when the wait for everyone else is as long as three months.

A search warrant obtained for the instructor's home says his computer's internet address has been linked to hundreds of suspicious transactions involving the booking of coveted road tests slots for his clients.

"There are a number of transactions that are occurring within seconds or simultaneously to other related transactions," the search warrant reads.

"This type of activity is not humanly possible and is believed to be being completed by a computer program or 'BOT.'"

'Where there's a will, there's a way'

CBC is not naming the driving instructor because he hasn't been charged with any offence. His lawyer said he wouldn't comment at this time.

But according to the search warrant, investigators with the Insurance Corporation of B.C. (ICBC) say they have grounds to believe the man committed fraud by depriving the insurer's other customers of road test appointments.

The wait time for road tests has spiked since ICBC, the province's auto insurance provider,  made its tests more challenging in 2016. The insurer has blamed the clogged system on drivers who repeatedly fail.

According to the court documents, the waiting time to book a road test in the Lower Mainland currently ranges between 50 and 90 days. The average wait is 70 days.

As well as the investigation into computer hacking, the search warrant also details a previous investigation that saw ICBC discipline several driving schools for bulk booking appointments.

A handful of schools were caught using licence numbers of old clients to book and hold spots that were later re-allocated to new clients.

The most prolific offender had their licence cancelled.

"I am rather surprised that this has raised its ugly head again," said Kurtis Strelau, director of training for Young Drivers of Canada, the province's oldest and largest driving school.

"I guess, where there's a will, there's a way."

'Highly suspicious'

ICBC would not comment on any active criminal investigations, but said in a statement that the insurer's special investigations unit proactively monitors the online booking system for misuse.

The latest investigation began in October 2018 during a routine shutdown of the computer program which handles the driver's examination appointment system.

The shutdown happened shortly after midnight.

When the computer was reactivated, programmers noticed that five entities had made repeated attempts to gain access by getting past the CAPTCHA — a simple puzzle meant to distinguish human users from bots. 

"This activity was highly suspicious," the search warrant reads.

Investigators believe someone was trying to leave a program running inside the ICBC system that could "auto block, release and book future road test appointments."

A review of computer logs revealed the 10 IP addresses responsible for the most traffic on the system for a two-week period following the late night activity.

An address associated with the suspect topped the list at more than 30,000 transactions.

'He indicated cash only'

Chinese-language internet ads for the suspect's driving school offer "48 hour express" road test appointments.

As part of the investigation, a Mandarin-speaking RCMP officer posed as a driving student who claimed he had failed a road test and needed to retake the exam in the next two weeks.

ICBC created a new driver's licence number for the investigation.

"When asked how much this would cost [the suspect] indicated that it would be $300 and this included the use of test vehicle," the search warrant reads.

"When asked about payment [he] indicated cash only."

The undercover officer was booked in for an appointment, which he then cancelled. But the driving instructor was able to book him in for another test a few days later.

Investigators then traced the history of that time slot, linking it back to a licence that appeared to have been used to block spots and transactions that matched identifiers for the suspect.

They believe the system works by booking an appointment for one person far in advance to hold a time block, and then later rebooking that person into another slot while using a bot to slide a new client into the original appointment.

Strelau said ICBC has taken steps to increase security around the examination appointment system.

At the moment, he's booking his clients into November appointments.

"There are IT guys and hackers that may know how to get around it, although ICBC's road test booking site is pretty picky," he says.

"I can't imagine how they would do that. Not saying it wouldn't happen, but I can't imagine how they would do it.