A retired RCMP investigator who examined a seized laptop computer said he was “totally shocked” to discover someone had sent sensitive intelligence documents to a criminal suspect.
Former RCMP staff sergeant Guy Belley described Wednesday in Ontario Superior Court how the revelation set off alarm bells five years ago.
Belley, who retired in 2020, was the first Crown witness in the judge-and-jury trial of Cameron Jay Ortis, a former RCMP intelligence director accused of disclosing classified material.
Ortis is charged with violating the Security of Information Act by allegedly revealing secrets to three individuals in 2015 and trying to do so in a fourth instance, as well as breach of trust and a computer-related offence.
Ortis, 51, has pleaded not guilty to all charges.
The charges against Ortis claim he communicated “special operational information” without authority while designated as a person “permanently bound to secrecy”—a category that includes numerous officials in the Canadian security and intelligence community.
At the time, Ortis was away on language training after serving as director of an operations research unit staffed by analysts. Upon his return in 2016, he became director general of the RCMP’s National Intelligence Co-ordination Centre.
Belley was tasked in 2018 with analyzing the contents of a laptop computer owned by Vincent Ramos, chief executive officer of Phantom Secure Communications, who had been arrested in the United States.
An RCMP effort known as Project Saturation revealed that members of criminal organizations were known to use Phantom Secure’s encrypted communication devices.
Ramos would later plead guilty to using his Phantom Secure devices to help facilitate the distribution of cocaine and other illicit drugs to countries including Canada.
Belley told the court he found an email to Ramos from an unknown sender with portions of 10 documents, including mention of material from Canada’s anti-money laundering agency.
The sender would later offer to provide Ramos with the full documents in exchange for $20,000.
The Crown says the RCMP uncovered evidence, after much technical sleuthing, that Ortis had communicated secrets to Ramos and other investigative targets.
A statement of agreed facts, filed as an exhibit in the case, says the material in question was “special operational information” as defined by Canada’s secrets law.
Associated exhibits include details of email messages in the first half of 2015, sent anonymously to Ramos, offering to provide information of interest.
The Crown is expected to spend the next several days of the trial trying to persuade the jury that Ortis was behind the overtures, ultimately breaching the Security of Information Act.
An April 29, 2015, email to Ramos from the email account [email protected] said the various attachments were partial copies of U.S. and Canadian law enforcement intelligence targeting Phantom Secure.
“They are embargoed in that I’ve removed the body of these documents leaving enough remaining to allow you to assess whether or not you would be interested in acquiring the unembargoed full documents,” the email reads.
“Phantom Secure is of considerable interest to both law enforcement and intelligence agencies in the western world. The documents attached here are only a selection of the broader effort against your organization. The ultimate goal is to get at your clients, some of whom are significant global actors.
“Your service has stymied action against them. Thus, their goal is to disrupt or dismantle Phantom Secure.”
Among the documents offered were disclosures from the Financial Transactions and Reports Analysis Centre of Canada to law enforcement, as well as police intelligence assessments of Phantom Secure.
An earlier anonymous email to Ramos, on March 21, asked if Kapil Judge, Phantom Secure’s technical manager, had “met someone friendly” while undergoing a secondary border services agency inspection at the airport.
In an interview with police, Ramos acknowledged receiving and engaging in the email correspondence.
The RCMP then began trying to figure out who had sent the mysterious emails to Ramos.
In 2019, the Mounties determined that in March 2015, Ortis had used the RCMP National Crime Data Bank database to access a March 6 Mountie report from that year outlining a plan to have an undercover police officer approach Judge at the Vancouver Airport.
Ortis was taken into custody in September 2019.
Search warrants were executed at his apartment in Ottawa’s Byward Market neighbourhood and at his office at RCMP headquarters, says the statement of agreed facts.
Investigators seized numerous devices, including five laptop computers, five external hard drives, 10 memory keys and three cell phones.
Some portions of an encrypted memory key found at his apartment were successfully unscrambled. The key had a folder named The Project which contained several subfolders.
One document entitled Email-addresses.txt in The Project folder listed the email addresses and passwords for nine accounts including the variablewinds account, the agreed statement adds.
The RCMP were able to use the login credentials to log in to the variablewinds account and locate the emails exchanged with Ramos’s Tutanota account, the statement says.
