WhatsApp chats show gaming official discussing joint future business plans with Iosif Galea

A court has been told that the Malta Gaming Authority's (MGA) former Chief Technical Officer Jason Farrugia had discussed the authority's affairs, as well as future joint business plans, in WhatsApp chats with gaming consultant and former MGA employee Iosif Galea.

The compilation of evidence against Farrugia and his wife, Christine, continued this morning before Magistrate Donatella Frendo Dimech. The couple are charged with money laundering offences in connection with Jason Farrugia’s actions while working for the authority.

Farrugia is also facing charges of extortion, trading in influence, fraud, misappropriation, disclosing confidential information and computer misuse. Galea was recently arrested in Italy on the strength of a European Arrest Warrant issued by Germany, whilst on holiday with disgraced former prime minister Joseph Muscat and his family.

Police Inspector Marcus Cachia from the Cybercrime Unit testified that the unit had received a report of unauthorised access to the MGA database, with information having been leaked to the Shift News.

An internal investigation was carried out and it was found that the only account which had accessed the data in question was that of the MGA’s CTO Jason Farrugia, he said. The inspector explained that MGA’s CEO Karl Brincat had reported the internal investigation as showing that Farrugia had accessed data he was not authorised to see on several occasions and had downloaded them.

When confronted about this by Brincat, Farrugia had claimed to have been carrying out maintenance work, but Brincat told the police that this was not Farrugia’s job and that the actions carried out were not compatible with maintenance.

A report was subsequently filed with the police, who inspected the MGA premises together with a court expert and interviewed various employees there. The IP address from which the database had been accessed was traced back to Christine Farrugia’s house, he said. The internet connection registered to the woman, who is Jason Farrugia’s wife, used a static IP, which doesn’t change.

Several electronic items were seized as part of the police investigation and were passed on to the court expert, the inspector said.

When questioned by the police, Farrugia confirmed that his internet connection was registered in his wife’s name and had a fixed IP. Two computer towers with MGA stickers were also retrieved from his house. Farrugia had declined to answer questions about this, the court was told.

Suspicious activity was also detected on two accounts, one of them belonging to a former employee, said the Inspector. The MGA firewall had logged connections from the IP address in question, he said. 

An examination of Jason Farrugia’s Whatsapp chats showed he had been communicating with Iosif Galea about MGA affairs and that the men were discussing plans to go into business together. “We need to think about all possible outcomes,” one message read.

Other messages indicated attempts to bribe a police officer, said the inspector.

The court expert had informed the inspector that all the data on Farrugia’s mobile phone had been remotely wiped. Fortunately, however, the expert had managed to download the data before the data wipe was triggered.

Jason Farrugia had subsequently been granted police bail whilst under arrest and an arrest warrant was also issued for Iosif Galea.

During questioning, Farrugia had told the police that he had known Galea for a long time, but refused to answer any further questions.

Galea was later also released on police bail. He absconded from Malta and was later arrested in Italy on the strength of a European Arrest Warrant issued by Germany a year before.

Evidence showed that Galea had logged in to MGA IT systems after he had left the authority in 2013, added the inspector.

An investigation was started into this, headed by Inspector Thomas Zammit and several high-level witnesses have already testified before a judicial assistant as part of an inquiry, he said.

With the cooperation of foreign law enforcement agencies, the investigators identified IP addresses assigned to email addresses used by several persons of interest, amongst them that of both of the accused and Iosif Galea, as well as Jason Farrugia’s father. 

A Protonmail account registered to Iosif Galea was also used, said the inspector. This was the same IP address that had used a Gmail account linked to the accused which had accessed the MGA DMS database in November and December 2021 - after Jason Farrugia’s suspension.

Logs revealed that Farrugia had also checked the audit history of a particular user and had deleted several files from his work laptop. A court expert later confirmed that its hard drive had been “fried,” added the inspector.

Several MGA database logins had been traced to the accused couple’s fixed IP address, making over 600 downloads at a time. Farrugia had also been using Iosif Galea’s credentials to change details relating to companies associated with Galea, the inspector went on.

Police also discovered that a “substantial” amount of money had been transferred to the Farrugias by Galea by means of cheques and Revolut transfers, he said. One reciprocal transfer had been made by Galea, but only for a few hundred euros.

During his interrogation, Jason Farrugia refused to answer most of the questions, the inspector said, adding that his wife had told the police that she had been unaware of most of the transfers and did not know Iosif Galea.

Farrugia shook his head when the inspector told the court that the accused had taken MGA-owned devices home without authorisation.

Cross-examined by prosecutor Francesco Refalo, the Inspector said that a WhatsApp chat had been discovered on Jason Farrugia’s phone discussing a mass transfer of documents using WeTransfer. In fact, Iosif Galea had sent him a screenshot showing that the transfer was underway.

Refalo also asked about the contents of the 600 documents downloaded from the DMS database, but the witness replied that they had not yet been analysed as they were currently part of the inquiry.

Cross-examined by defence lawyer Alfred Abela, the witness confirmed that he did not know what these documents or those sent by WeTransfer, contained.

“So you are saying that he is accused of stealing documents but you don’t know what these documents actually contain,” remarked the lawyer.

MGA CEO Dr. Karl Brincat took the witness stand next. He gave a resume’ of the timeline of the internal investigation, which started after The Shift published documents leaked from the authority.

“When I saw that there was a substantial amount of information which had been transferred I informed the police,” he said.

Farrugia, as CTO, had access to “everything” said the witness. His function was to take care of the authority’s IT systems and his performance had been “normal, not excellent, not poor,” he said. 

“After his suspension, I sent a driver to collect his laptop,” he said, explaining that this was necessary because of the COVID pandemic. MITA were asked to investigate and it emerged that he had downloaded data onto his personal devices, which was forbidden.

“It started when I realised that the Shift had access to an invoice….later I was informed that the only person who had accessed the documents outside of their job function, was Jason Farrugia.” All Chief Officers have their access limited to their area of work, except the CTO, he said.

“From our investigations we could not establish that he had taken other work devices home, but I’m informed that this emerged from the police investigation.”

All MGA employment contracts expressly forbid this, he said, adding that declarations regarding conflicts of interest had to be regularly signed by all employees.

Lawyer Mario Buttigieg suggested to the witness that Farrugia had no employment contract with the MGA as CTO. Brincat denied this and was ordered by the court to exhibit a copy of the contract during the next sitting. 

Refalo re-examined the witness, asking him what the Gaming Act stated about CTOs. Chief Officers had to be appointed under this act and had to declare any conflicts of interest, he said.

MITA Security Operations manager Reuben Gauci took the stand next. MITA provides a number of services to MGA, including email and Microsoft exchange services, the witness told the court, adding that MITA adopts a 6 month retention policy with regards to deleted items. 

Time-stamped logs of mailbox and database sign ins and audit logs were also handed over to the police by MITA, he said. “We don’t investigate the logs, we just export them and pass them on to investigators,” he explained.

The magistrate requested the witness to identify the person behind the username used to log in to the system, by the next sitting.

Abela cross-examined Gauci, asking him whether he would pass on newly created login details to the end user directly or through the MGA. “When an account involving MITA is created, the credentials are passed on through a password proxy, who is designated to receive the one-time password, to the user.”

The password proxy would pass on the username and password to the user, who would then change it, he explained.

As the sitting drew to a close, Christine Farrugia’s lawyer Lennox Vella informed the court that he was objecting to a decree of prima facie being issued with respect to his client. “In the hours of testimony that I have heard so far, there was nothing about my client,” he argued. This was replied to by Refalo, who pointed out that the court had heard that bank transactions into her account linked her to the crime.

The court decreed that it had seen sufficient prima facie evidence against the accused to justify their indictment, sending the acts of the case back to the Attorney General for this purpose.

The case continues in July.

Prosecutors Francesco Refalo and Nathaniel Falzon represented the office of the Attorney General. Police Superintendent Frank Tabone and Inspector Thomas Zammit prosecuted.

Lawyers Alfred Abela and Mario Buttigieg appeared as defence counsel to Jason Farrugia, whilst lawyer Lennox Vella represented Christine Farrugia in the sitting.