A WhatsApp chat between former MGA official Jason Farrugia and gaming consultant Iosif Galea hinted that someone “within the police corps” had been tipped to make sure that no steps would be taken should investigators sniff out the alleged data breach at the authority.

This was one of the snippets of information divulged in court on Monday when proceedings continued against former chief technical officer Jason Farrugia and his wife Christine who stand accused of money laundering.

Farrugia is facing separate charges for allegedly leaking confidential information to former authority official Galea, extortion, accepting bribes, fraud, misappropriation, trading in influence and computer misuse.

Last week, the court heard one of the prosecuting officers testify that Galea had allegedly wired Farrugia some €130,000 and had issued a number of cheques in favour of both Farrugia and his wife, bringing up the total to around €170,000.

Farrugia’s wife subsequently told police that she had no idea of those money transactions and did not even know Galea.

The suspected data breach first came to light in November following a story published by The Shift News about direct orders at the MGA, showing a copy of an invoice received by the authority.

That story rang the alarm bells and CEO Carl Brincat immediately ordered an internal investigation which revealed that Farrugia had accessed and downloaded data when he had no cause to do so.

When confronted, Farrugia had come up with some excuse about storage difficulties which did not sound “credible”, said Brincat when testifying on Monday.

Farrugia, who at the time was working from home due to the COVID-19 pandemic, was suspended and his online accounts were disabled to block his access to MGA data.

As chief technical officer, responsible for safeguarding the authority’s information and improving its systems, Farrugia had access to all information. 

On December 9, the same day he was suspended, Brincat sent a driver to collect the work laptop and tower from Farrugia’s home and he was informed that his access was being blocked.

However, there were other attempts to access the system from a Melita address registered in the name of Christine Farrugia.

Magisterial inquiry kicks in

MITA and police were roped in and a magisterial inquiry kicked off. 

On December 18, an IT expert appointed by the inquiring magistrate reported that he had discovered a WhatsApp chat on Farrugia’s phone between him and Galea.

Those messages appeared to indicate that the two were planning some business together.

There were messages asking whether “emails sent in the morning had been saved” and suggestions “to plan all possible options” in case Farrugia was “sacked”.

“Confirm with police whether MGA asked for the laptop,” read one of those messages, according to cybercrime inspector Marcus Cachia who also took the witness stand on Monday.

“They’re talking to someone from within the corps so as not to proceed,” read another message, adding that “he had already given this one something”. 

Investigators later discovered that someone had cancelled all Farrugia’s data remotely, said Cachia, explaining that this was possible by means of an application operated by the owner of the mobile phone. 

When interrogated in January while under police bail, Farrugia confirmed that he had known Galea for a long time but opted not to answer questions. 

Galea confirmed that WhatsApp chat was because the two were planning business together.

Galea was also placed under police bail.

Data post-dated to 2013

One of the pen drives found in Galea’s possession contained data that was post-dated to 2013, namely when Galea stopped working at the MGA.

On one occasion in December, Farrugia made 693 downloads, following those up with another 641 the next day, and forwarded the data to Galea who sent Farrugia substantial sums of money by Revolut and cheques.

In their WhatsApp chat, Galea asked Farrugia whether he had effected a We Transfer and Farrugia replied by sending a screenshot of that transaction. 

Defence lawyer Alfred Abela pointed out that all the witness could confirm was the record of such We Transfer but could not tell its content nor who the recipient was.

The court also heard security and operations manager at MITA, Reuben Gauci, testify that MITA received an official request to provide the necessary digital evidence to assist court experts on December 16, 2021.

All online data and recoverable items relative to Farrugia’s mailbox, including email logs, Microsoft exchange, as well as incoming and originating messages over a six-month span, were made available. 

MITA also explained that, on December 9, there was a ”self-service password reset” relative to Farrugia’s account and that was how Farrugia temporarily regained access to his “blocked” work account. 

That was how Farrugia’s online activity continued after he had been suspended, the court was told.

At the end of Monday’s hearing the court, presided over by magistrate Donatella Frendo Dimech, declared that there was sufficient prima facie evidence for Farrugia and his wife to stand trial. 

The case continues next month.

Inspector Cachia and Superintendent Frank Anthony Tabone prosecuted, assisted by AG lawyer Francesco Refalo. Lawyers Mario Buttigieg and Alfred Abela were defence counsel to Farrugia. Lawyer Lennox Vella was defence counsel to Farrugia’s wife.