Windsor council grills ERCA on nearly $300K phishing scam, yet turns down seeing investigative reports

Windsor city councillors turned down the opportunity to look at investigative reports that outline details of a phishing scam directed toward the Essex Region Conservation Authority, which cost the organization nearly $300,000 last year. 

But still, interim general manager for the Essex Region Conservation Authority (ERCA) Tim Byrne was grilled by some Windsor city council members Monday about the fraud scandal that took place July 2020. The incident happened after a fraudster pretended to be an internal staff member and then completed two transactions sent to falsified bank accounts. 

Though some councillors demanded answers from Byrne as to how the money was authorized to leave ERCA's account, the majority voted against viewing reports from three separate investigations that were held on the matter. 

Investigations were conducted by ERCA's own management and the Ontario Provincial Police, now another joint investigation is being held by the OPP and RCMP as the fraudsters are believed to be part of an international criminal group, Byrne said. 

"Voting against this today I actually think sends the opposite message. It perpetuates more suspicion in the minds of the public," Windsor Mayor Drew Dilkens said prior to the vote.

He noted that he knows the details of what happened, but didn't find out through ERCA or other council members, adding that it's "problematic" he had to find out the details from someone else. 

He said ERCA was asked earlier to appear before council but never responded to the request. 

"I don't think it was intentional, but there are a number of things that happened here which certainly created a level of concern and suspicion," he said, adding that this all took place as staff members departed and some were on a leave of absence. 

Dilkens' comments seemed to relate to the fact that months after the incident took place, the conservation authority announced that its current GM Richard Wyma would leave in September. 

It's still unclear whether Wyma's departure was related to the fraud scam. 

The investigations, according to Byrne, found that "all existing staff at the conservation authority through all investigations were deemed to have zero responsibility, zero involvement in any of the activities with respect to this incident." 

But Ward 6 Counc. Jo-Anne Gignac and Ward 1 Counc. Fred Francis inquired about whether a lack of oversight led to the loss in funds. 

"I appreciate the fact that there's no criminality internal in the organization, but ... when you really dig into it that [fraud] would not be possible unless it was okayed ... this literally had to be authorized and funding had to be authorized," Francis said. 

Gignac made similar comments and in response Byrne said he couldn't speak to that further as it was covered under a personnel agreement with the conservation authority. 

Gignac put forward the motion, which requested that ERCA ask its board to provide the investigation reports to the city and also allow the city's auditor general to review the organization on a regular basis. Only four councillors supported the motion and seven were against. 

All councillors who sit on the ERCA board opposed the motion, including Ward 9 Counc. Kieran McKenzie, Ward 10 Counc. Jim Morrison, Ward 5 Counc. Ed Sleiman and Ward 7 Counc. Jeewen Gill.

Prior to the vote, Morrison said the authority has already been transparent about the incident, which is why he doesn't support the motion. 

"There was no hiding behind anything, everybody was totally open and honest about the investigation," Morrison said, adding that when the incident took place the organization quickly addressed it with the board. 

'We fell prey'

One of the details Byrne revealed during the council meeting was that the hacker got into ERCA's system in March and was able to learn how the organization operated and communicated. 

"It's the kind of smash and grab that occurs when we all live in this digital world," Byrne said. "We unfortunately fell prey to a very sophisticated, complex system where someone could infiltrate your system and then pretend to be someone else and then gain that trust and then have someone act."

He said ERCA "strongly" recommends that municipalities take a close look at their own cyber security. 

Byrne added issues such as these occur when people become "too complacent" and that everyone needs to have "inherent skepticism" to prevent themselves from being victims of a similar scam.