When Cameron Ortis approached the head of a company that was being probed by law enforcement, he allegedly told him that he had access to some highly “valuable” information and mentioned a “business proposition.”
“You do not know me. I have information that I am confident you will find very valuable,” reads an email to Vincent Ramos, the Canadian CEO of Phantom Secure. The email was entered into evidence at the start of Ortis’s trial.
“I assure you that this is a business proposition. Nothing more. It is not risk free, of course, but the risk to reward ratio will prove to be more than acceptable.”
That email and others are part of an astonishing tranche of documents that make up the agreed statement of facts between the Crown and the defence in Ortis’s criminal trial.
The Crown presented the emails to jury members Tuesday. They argue the messages show Ortis was communicating intelligence to police targets. The defence has not commented on the emails in open court.
The former RCMP intelligence official faces six charges, including four counts of violating the Security of Information Act.
Ortis, 51, is accused of three counts of sharing special operational information “intentionally and without authority” and one count of attempting to share special operational information. He also faces two Criminal Code charges: breach of trust and unauthorized use of a computer.
Ortis has pleaded not guilty to the charges against him. His defence told reporters they believe they can prove he had the “authority to do everything he did.”
According to the evidence presented to court so far, the RCMP was gathering information about Phantom Secure as part of an operation dubbed Project Saturation. Court has heard the RCMP believed Phantom Secure was providing encrypted phones at a price. The FBI arrested Ramos in Las Vegas in 2018.
The Crown says that, using the email handle ‘See All Things,’ Ortis reached out to Ramos on Feb. 5, 2015 and told him he had information about a multi-agency investigation targeting Phantom Secure.
Some of the emails shown to the court also used the handle “variablewinds.”
Crown prosecutor Judy Kliewer told the jury that in one of Ortis’s emails, the accused told Ramos certain “files detail this effort, intel about your associates and individuals using your network internationally.”
At the time, Ortis was the director of operations research within RCMP National Security. He was later promoted to director general of the National Intelligence Coordination Centre in 2016.
Kliewer said Ortis urged Ramos to set up a secure email account and to contact him for more information.
Ortis said he had info on associate
Ramos replied, asking for more details.
“I am in the business of acquiring hard-to-get information that individuals in unique high-risk businesses find valuable. I sell that information to them,” said the response.
“Through the course of my normal discovery ops (some call this hacking, others cracking) I came across a number of documents that pertain to your current efforts.”
When Ramos failed to loop back, Kliewer said, Ortis sent another email on March 21 suggesting he had information about Kapil Judge, Phantom Secure’s technical manager.
“I thought I would check in and touch base. Did Judge arrive on the 8th as planned?” says one of the emails tabled in court Wednesday.
“Let me guess, he met someone ‘friendly’ while being secondaried by CBSA at the airport?”
Accused was asking for $20K, Crown says
Ramos replied that he was “a bit intrigued for sure” and promised to set up a secure account.
Kliewer told the jury Ortis followed up in late April by sending partial Canadian and international police agency intelligence on Phantom Secure. In that same message, she said, Ortis told Ramos he was “leaving enough remaining to allow you to assess whether or not you would be interested in acquiring the unembargoed full documents.”
The documents included reports from the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), a criminal intelligence assessment by the RCMP and a document summarizing other western intelligence and law enforcement information on the company.
That apparently convinced Ramos to set up a secure email account on Tutanota, an encrypted email service.
The jury heard that Ortis then asked for $20,000 in exchange for the unredacted documents.
But Ramos still had questions about how to interpret the documents and the identity of the person sending them to him. “Who are you??” he wrote.
Kliewer said Ortis then spelled it out for Ramos.
“For example, the FINTRAC intelligence would help you and your folks to explain transactions in advance. It will also allow you to avoid making the same mistakes. You will be able to see which transactions have ‘blinked’ on their radars and, more importantly, which have not,” says an email presented to the court.
Ramos’s arrest alerted RCMP to Ortis
Kliewer said Ortis also told Ramos that police knew Phantom Secure’s “most sensitive communication components were transiting through Canada, Panama, Japan and Hong Kong.”
She told the jury that Ortis told Ramos law enforcement and intelligence agencies were co-operating to bring down Phantom Secure to get to his users and clients, including an unnamed drug cartel and Altaf Khanani, the Dubai-based head of an international money laundering network.
Ramos is serving a nine-year prison sentence in the U.S. for racketeering conspiracy. His arrest kicked off the investigation into Ortis, leading up to the RCMP official’s arrest in 2019.
The jury heard Wednesday from former RCMP staff sergeant Guy Belley, who was called in to review the contents of Ramos’s computer in the U.S.
He said he was “totally shocked” to discover someone had sent him sensitive intelligence documents.
The hunt to find the leaker
When the RCMP went searching for who could have sent those reports, the trail took them close to home.
According to the agreed statement of facts, Mounties determined that Ortis used the RCMP National Crime Data Bank in March 2015 and accessed an RCMP report outlining a plan to have an undercover police officer approach Judge at the Vancouver Airport.
Investigators also determined that, within a 15-minute window, Ortis queried the crime database for six names, including “Vincent Ramos,” “Farzam,” “Mehdizadeh,” “Aria,” “Phantom”and “Gemayel.”
Ortis is also accused of trying to leak information to Farzam Mehdizadeh, who ran Aria Exchange in Toronto. He fled the country before his anticipated arrest in 2017.
After police arrested Ortis, they searched his Byward Market apartment in Ottawa.
According to the agreed statement of facts, investigators seized numerous devices there, including five laptop computers, five external hard drives, 10 memory keys and three cell phones. They also found an encrypted USB which police were able to partially unlock.
On it were several folders, including something called “what-was-sent.txt.” Police also found an “email addresses” folder which listed the email addresses and passwords for nine accounts, including the variablewinds account, the agreed statement says.
The defence’s cross-examination of Belley continues Thursday.