Ex gaming authority official received thousands of euros from Iosif Galea

Former Malta Gaming Authority official Jason Farrugia charged with money laundering attempted to access the regulator's systems after his access was blocked following an investigation into leaks • Received thousands from Iosif Galea

Former MGA Chief Technology Office, Jason Farrugia
Former MGA Chief Technology Office, Jason Farrugia

The Malta Gaming Authority’s former chief technical officer Jason Farrugia received thousands of euros in his accounts from Iosif Galea, a court heard on Wednesday.

Farrugia also tried to circumvent the blocking of his MGA account after being informed that he was under investigation.

Magistrate Donatella Frendo Dimech began hearing evidence on Wednesday in the criminal case against Farrugia, who stands charged together with his wife Christine, with money laundering in connection with his work at the authority.

He is also facing charges of extortion, trading in influence, fraud, misappropriation, disclosing confidential information and computer misuse.

At the end of today’s sitting, the couple were granted bail, after the court noted that the Attorney General had not opposed their bail requests.

Galea is a former MGA official himself and now works as a 'gaming consultant'. He is wanted by the Maltese police but was arrested in Italy last month on the strength of a European Arrest Warrant issued by the German police.

Suspicious transfers detailed in court

Police Inspector Thomas Zammit from the Financial Crimes Investigations Department(FCID) took the stand first, giving an overview of the police work involved in the investigation leading up to the couple’s arraignment.

Inspector Zammit explained how on 11 February 2022, the police’s Anti Money Laundering Unit was asked by the police’s Cybercrime Unit to investigate the accused, who had previously also been investigated for corruption and computer misuse. The request was made due to suspicions that they had been illegally selling data obtained by Farrugia as a result of his position.

Investigations into Farrugia and former MGA employee-turned 'gaming consultant' Iosif Galea began and it immediately became apparent that Galea had made some 177 Revolut transactions to Farrugia, transferring amounts ranging from €170 to tens of thousands of euros at a time. Transfers to Farrugia’s wife, Christine were also noted.

Further investigations discovered that Galea had also been issuing cheques from various banks to Jason Farrugia. The total value of the cheques exceeded €11,000, he said.

Galea had also issued cheques to Christine Farrugia in 2020, which had been deposited in Jason Farrugia’s BNF account. These cheques were for a total of €29,150.

The magistrate asked how the cheques were deposited in an account other than that of the addressee, when this required signatures. Inspector Zammit replied that during questioning, Christine Farrugia had explained how she had been asked to sign the cheques and had complied.

Amongst the transactions flagged by investigators, were the deposits of 17 cheques, amounting to €5,500, made out to Christine Farrugia into Jason Farrugia’s HSBC account. A €4,000 cheque had also been deposited by Iosif Galea in the Farrugia’s BNF joint account. A transfer of over €2,000 from Galea to a BOV account belonging to the accused was also noted.

Inspector Zammit testified that the Commissioner for Tax had replied to police queries, informing them that Farrugia had only declared his MGA salary as his income for the applicable period. In view of this evidence, and the fact that Farrugia and Galea were already the subjects of an investigation by the Cybercrime Unit, it was concluded that there were sufficient grounds to issue an arrest warrant.

Christine Farrugia was subsequently arrested in Marsaxlokk and her mobile phone seized. The device was found to be password protected and the woman did not disclose her password to the police, the inspector said.

During her statement, Christine Farrugia claimed not to know about the cheques and said that she didn’t recognise the signature.

After being taken into custody, Jason Farrugia was questioned about the transactions made out to him and Galea, as well as the cheques. He refused to answer, Inspector Zammit said.

The Shift leak traced to Jason Farrugia, MGA officer says

Senior MGA representatives also testified during today’s sitting.

Matthew Busuttil, infrastructure and security officer at the MGA recalled how he had been called into a meeting on 7 December 2021, which had been attended by Jason Farrugia and other high-ranking officials. The subject of the meeting was the leak of invoices to The Shift News, he said.

Busuttil had been tasked with investigating the leaks and had used a software tool, called Detex, which MITA used to track the usage of work laptops.

“Mr Farrugia had copied the invoices, saved them on his desktop and placed them in a zip file,” Busuttil said. The witness said he had informed Farrugia that his login had been used for these actions and asked him to come to the office to give an explanation to MGA CEO Carl Brincat. “He refused… the first thing he told me was that his account had been hacked.”

Asked whether he had checked whether the account had been hacked, the witness said he hadn’t, but said that there had been no unusual login activity.

Brincat, after consulting with the Chief Financial Officer, had spoken to the witness and told him to temporarily disable Farrugia’s accounts.

The CEO had then summoned Farrugia to attend a meeting at 3pm on 9 December and ordered him to hand in his laptop. 

On 14 December, suspicious activity was noted on the MGA’s document management system, which was later identified as having been accessed by Farrugia. The police were then informed and the accused had been taken in for questioning.

The MGA’s internal investigation had continued after 14 December and the resulting information gathered was later handed over to the police.

The user activity log connected to the MGA’s DMS (Data management System), a file server in which documents are stored, flagged several downloads by particular users, “FarrJ266” amongst them.

Dennis Vella, Data and Records manager at MITA, testified about the internal investigation. “As Jason Farrugia was the authority’s CTO and had access to certain systems, I was asked to examine one of the systems, which fell under my responsibility - the DMS.”

Access to the DMS was granted according to the role and position of the user, explained the witness. “The activity was traced to the account pertaining to [Jason Farrugia], FarrJ266. We continued to investigate this detail and discovered that there had been other logins, using different accounts.” One account belonged to an administrator and two other accounts belonged to former employees, he said.

The email address connected to one of these accounts, which had administrator rights, was found to be changing regularly. The witness said that he had not been made aware of the changes to the email address, which he said weren’t sanctioned.

“The activities were various and on two accounts there had been downloads,” Vella said. In order for him to link this to someone, he had checked timestamps and IP address logs corresponding to the time, he explained, adding that these all pointed to Farrugia.

Owen Bugeja, Head of Software Development at the MGA, also testified, telling the court that Farrugia’s account had attempted to use his MITA account to login to the system, after his meeting with the CEO.

“I didn’t come across anything amiss, apart from the attempt to log in to the system on the 9th using his MITA account which hadn’t been closed at that time, but which had already had its access rights revoked.”

The laptop used by the accused was then used to create applications for login credentials in the names of third parties, in an attempt to access the system, explained the witness. This was a process normally used for gaming operators and licence holders, he said.

“The Detex tool on the laptop gave us the logs of all the websites he had opened and when he had opened them. I could then compare it with the times at which the applications were submitted.” The logs all matched the applications, he said.

Bail granted against hefty guarantees

After retiring to chambers to consider the bail requests, the court released Christine Farrugia from arrest, ordering her to sign a bail book once a week, securing her release with a deposit of €10,000 and a personal guarantee of €40,000.

Jason Farrugia was also granted bail on similar conditions, against a deposit €25,000 and a personal guarantee of €75,000.

The case was adjourned to next Monday.

Prosecutors Francesco Refalo and Nathaniel Falzon represented the office of the Attorney General. Police Superintendent Frank Tabone and Inspector Thomas Zammit prosecuted.

Lawyers Alfred Abela and Rene Darmanain were defence counsel to Jason Farrugia, whilst lawyer Lennox Vella appeared for Christine Farrugia.