The security lapse that cost Ontario taxpayers

There’s an old saw about a bank robber being asked why he targetted banks.

“Because that’s where the money is,” he explained.

The Ontario government, after seeing a former senior public servant sentenced to 10 years in prison for embezzling $47 million, might find some food for thought there.

Sanjay Madan, a former Ministry of Education computer specialist who plead guilty earlier this month to a massive fraud dating to January 2011, will likely not be the last person tempted by the large sums and sometimes exploitable loopholes presided over by the province.

As the Star’s Robert Benzie has reported, Madan took advantage of lax oversight of information technology to siphon millions from government coffers — right under the noses of various governments and the provincial auditor general.

He was finally caught in 2020 after stealing almost $11 million from the Support for Families pandemic relief fund.

Superior Court Justice Suhail Akhtar called Madan’s efforts a “genius-style” scam.

Whether or not it qualified as that, it was complicated — and lucrative.

By managing to get computer-security protocols relaxed, Madan funnelled tens of thousands of payments to thousands of bank accounts in various financial institutions.

He might have been at it yet had an alert bank employee not noted discrepancies in Madan’s bank accounts in 2020.

The scale of the theft and duration are mind-boggling. This was no snatch-and-grab. This was a sustained draining of the public purse.

What should alarm the Ontario public — the victim of Madan’s crimes — is the relatively passive response of government officials to the holes revealed in provincial security.

Government House Leader Paul Calandra said lessons have been learned. Auditor General Bonnie Lysyk said no new audit into procurement of outside consultant contracts was planned.

That may reveal an excessive faith in current security and too generous a faith in the honesty of humanity.

At one point in his defence, perhaps giving new definition to term chutzpah, Madan even argued he was the victim of the government’s lax security, that the province was “contributorily negligent in that it failed to take reasonable steps to prevent and limit the frauds.”

The court dismissed the contention.

Still, Madan’s looting of public accounts and the failure of the province to detect his activities has already been the subject of case studies.

In a report on the swindling of the COVID-19 relief program, BDO Canada said there was insufficient verification of applicants by the province.

It said any request for changes to computer-access protocols should have been reported to supervisors rather than being done on trust.

Earlier detection might have been produced by independent third-party audits before launch and controls around computer-system configurations.

It advised periodic internal audits on payments, fraud awareness training for employees, an effective reporting mechanism and anonymous whistle-blower program.

The recent Ontario budget announced a spending plan of more than $200 billion for 2023-24.

As our old bank robber might say, that’s certainly one of the places where his craft could be profitably plied.

That money is also spread throughout many, many ministries, administered by myriad government programs, and controlled by vast networks of computer systems that, as Madan demonstrated, are less than foolproof.

It was telling that Madan himself said that it “looked like easy money for me.”

In the wake of this monumental lapse, a sense of urgency by those in charge to tighten security, monitor public money more closely and empower honourable employees seems the least Ontarians could expect.

SHARE: