Here’s why the investigation into data theft at Desjardins lasted 5 years

Sébastien Boulanger-Dorval, arrested Thursday for theft of personal data of Desjardins customers, admitted on May 27, 2019 to his bosses that he had sold confidential information. During a meeting with his superiors, he explained that he had sold data “for 15 months at a rate of approximately one sale every two to three months”, we learn in police investigation documents that we consulted. At that time, Desjardins had just seized his computer, his cell phone, a hard drive and several USB keys.

Why did we have to wait more than 5 years before he was handcuffed? Our Investigation Office takes you behind the scenes of the investigation.

Passwords that are difficult to crack

The police had great difficulty accessing the seized computer equipment, which demonstrates the growing complexity of fraud investigations.

For example, between 2019 and 2021, the SQ got its hands on nearly 120 “computer items”, including hard drives, USB keys, computers and telephones.

But it was only in May 2022, thanks to “the improvement of the equipment owned by the technological division of the SQ”, that two of them could be unlocked so that investigators could access the content, we read. in an affidavit dated June 2023 signed by Catherine Gohier, the lead investigator on the file.

Even more frustrating, the latest news was that the police had still not managed to remove three seized items.

“[Les mots de passe] generally consist of random combinations of numbers and letters (upper and lower case) of several characters, which complicates their discoveries,” writes investigator Sergeant Gohier.

• Listen to the interview with cybersecurity expert Steve Waterhouse via QUB :

Difficult collaboration with Desjardins

At the start of the investigation, the police repeatedly deplored the lack of collaboration from Desjardins, which would have deprived them of access to certain elements of evidence.

As early as May 2019, a detective sergeant from the Laval police who had obtained information suggesting that Sébastien Boulanger-Dorval was responsible for the leaks allegedly advised the institution not to take any action with regard to its employee, in order to do not alert him and thus prevent part of the evidence from being potentially destroyed.

Despite this, Desjardins conducted his own searches and seizures of documents, and even met with Boulanger-Dorval without notifying the police.

In February 2021, a source spoke to our Bureau of Investigation about the “strong climate of mistrust between Desjardins and the police.”

Desjardins then assured that she did not wish to harm the efforts of the police, and our information suggests that the rest of the investigation was more harmonious.

Thursday, in an interview with LCN, Lieutenant Benoît Richard of the SQ spoke instead of “certain corporate interests different from ours” in reference to Desjardins.

Attorney-client privilege

This is fundamental in Canadian law; investigators should not access discussions between suspects and their attorneys, which are confidential under attorney-client privilege.

This considerably slowed down the investigation, in the context where the numerous computers, telephones and emails seized could contain these types of conversations.

It was only in July 2021, two years after the opening of the SQ investigation, that a protocol to isolate privileged conversations was ratified by a judge.

“Between February 17, 2021 and February 17, 2022, there were 18 hearings to monitor the progress of the protocol (…). The protocol (…) was concluded on April 14, 2023 after 19 months of procedures and 27 court hearings,” describes Catherine Gohier.

Cryptocurrency

Tracking money exchanged between suspects or obtained illegally through identity theft was not easy, according to the lead investigator.

“The subjects targeted by the investigation use cryptocurrency to exchange money between themselves, which complicates the analysis of financial transactions linked to the investigation,” she says.

The pandemic

The Sûreté du Québec also blames COVID-19 to explain the length of the investigation.

“Several investigators have lived with the consequences of the pandemic. This had repercussions on their availability, since they were restricted by strict health rules following the appearance of symptoms, either personally or a member of their family, preventing them from being as efficient in their daily tasks. -on in the SQ affidavit.

Also, “on several occasions, witness meetings had to be postponed for reasons of COVID-19 symptoms”.