Nova Scotia gunman left a trail of financial red flags, but none were caught by regulator

Open this photo in gallery:

In the months before the worst mass shooting in Canadian history, the Nova Scotia gunman first went on an online shopping spree. His purchases of police equipment that helped him build the fake RCMP cruiser used in his attack left a digital trail that PayPal Canada was able to share with federal analysts who track the shadowy world of extremist financing.

There’s only one problem: PayPal submitted its report to the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) only after the mass shooting – which killed 22 people in April, 2020 – was over, and after the RCMP began probing Gabriel Wortman’s past.

While Canada requires banks, financial entities, real estate brokers, accountants, securities firms and other businesses to submit suspicious transaction reports (STRs) for activities they suspect could be connected to extremism, the gunman was buying things that weren’t illegal and didn’t initially flag attention within PayPal.

Hundreds of thousands of these “suspicious transaction reports” are reviewed by the country’s financial intelligence regulator annually, and they’re increasing every year. In the fight against money laundering and terrorist financing, it’s critical data for police, law enforcement and national security agencies.

With hearings for the public inquiry into the mass shooting set to begin next week, many Nova Scotians are still looking for answers as to why multiple red flags surrounding the gunman failed to prevent Mr. Wortman’s attack. The gunman – dressed as a Mountie and driving a look-alike RCMP police cruiser – managed to elude police for 13 hours, while killing his 22 victims and burning homes in a bloody rampage across central Nova Scotia.

Warrants used by the RCMP, obtained through a court challenge by The Globe and Mail and other media outlets, show FINTRAC received multiple reports after the attack about transactions made by Mr. Wortman. They included purchases on eBay between March 22 and Dec. 5, 2019, of police cars, light bars, siren light controls, a dashboard camera, vinyl decals and a police-style “push bar” that allowed the gunman to create an almost identical replica of an RCMP cruiser.

The gunman had also previously been flagged by Toronto-Dominion Bank for “atypical cash deposits” that were used to fund bank drafts payable to himself, through his real estate company, Northumberland Investments. In August, 2010, he was reported for suspicious transactions of more than $250,000 – part of a pattern of financial irregularities a Halifax law firm says should have drawn more attention to what it believes are sources of illicit, off-the-books income.

There are many questions why the gunman’s bizarre financial behaviour failed to draw the attention of FINTRAC, and whether online retailers and digital payment firms should have seen warnings in the patterns of his purchases. For families of victims, who also want answers into multiple missteps by the RCMP, the missed signs are an important piece of the puzzle.

FINTRAC is prohibited from discussing information it receives, or passes on to police, says spokesperson Darren Gibb. The RCMP, however, confirms it didn’t get any alerts from FINTRAC on Mr. Wortman until after the attack.

Open this photo in gallery:

Open this photo in gallery:

“The RCMP in Nova Scotia didn’t receive any information from FINTRAC until our investigation began in April, 2020, in response to the events that took place,” said Corporal Chris Marshall, a spokesperson for the Nova Scotia RCMP.

The families of Mr. Wortman’s victims are pressing for details. “These are safeguards put in place to protect the public, and it appears those safeguards failed here,” said Robert Pineo, the Halifax lawyer representing the families, who are suing the RCMP and federal and provincial governments. “Our clients want answers, and the public should, too.”

Part of the challenge for FINTRAC is that the volume of STRs submitted to Ottawa is growing dramatically – to more than 468,079 last year, up from 70,392 a decade ago. But while more and more transactions are being monitored, plenty of red flags can still be missed, as the federal government tries to strike a balance between protecting Canadians’ safety and their privacy.

The workload for FINTRAC is about to get even heavier, as Ottawa broadens the scope of anti-money-laundering and extremist financing rules to require crowdfunding sites to begin reporting to the regulator. The move, announced by Finance Minister Chrystia Freeland on Monday, is in response to the millions of dollars channelled to trucker protesters in recent weeks as the federal government looks to put an end to what it says are illegal blockades.

The government’s financial surveillance apparatus has a responsibility to monitor behaviour that risks Canadians’ safety. But the private sector plays an important role, too, Mr. Pineo said.

Online retailers such as eBay and digital payment systems such as PayPal aren’t doing a great job of flagging these kind of transactions, said Jessica Davis, an Ottawa-based security and intelligence expert who has worked in the Canadian Forces, FINTRAC and the Canadian Security Intelligence Service (CSIS).

“I think PayPal, eBay and other online marketplaces can be doing more to detect patterns of suspicious activity. They’re notoriously bad at trying to detect combinations of purchases,” Ms. Davis said. “One thing on its own is not a big deal. But if you add three, four, five, six things, that starts to paint a bit more of a picture.”

FINTRAC relies on PayPal and other companies to monitor these transactions themselves, although it offers guidelines on when there is reasonable grounds to suspect something may not be legitimate, and on thresholds that should be met for reporting. They’re required by law to report their suspicions under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which was amended in 2001.

While eBay Canada did not respond to interview requests for this story, a PayPal spokesperson said the company works hard to comply with regulations around financial reporting. It monitors millions of transactions, and says many collectors buy police equipment for legitimate reasons.

Open this photo in gallery:

“As a global company, PayPal works closely with law enforcement and regulators around the world. The company takes its compliance obligations very seriously and adheres to all applicable reporting and notification requirements in markets where it operates,” PayPal’s senior manager of media relations, Caitlin Girouard, said in a statement.

Security experts, however, say financial intelligence like the data connected to Mr. Wortman’s online purchases and banking also plays a role in preventing domestic extremism. Combined with other investigative branches of the law, the power to probe huge amounts of private transactions, without the need for a warrant, is an important tool in keeping Canadians safe.

While Mr. Wortman may have held anti-police and anti-government opinions, companies such as PayPal argue it’s difficult to know if his purchases of police equipment, viewed in isolation prior to his attack, required intervention.

After the attack, PayPal Canada reported those purchases that may have been “used in the facilitation of domestic terrorism activities” to FINTRAC, according to the warrants. Mr. Wortman, a 52-year-old denturist who owned a clinic in Dartmouth, often used eBay to buy items “explicitly labelled as being intended for police use,” according to the warrants.

But while FINTRAC has a monitoring system intended to thwart extremist financing, it’s designed for large-scale, international terror organizations such as al-Qaeda, Ms. Davis said. Smaller-scale, homegrown extremism such as that highlighted by Mr. Wortman can be harder to detect.

“The system is really set up to combat that al-Qaeda-style terrorism of 9/11, but the terrorism threat has really moved on,” she said.

Many of Mr. Wortman’s other financial irregularities were below the $10,000 threshold and didn’t involve international transfers of cash that banks and financial institutions must report to FINTRAC.

“A lot of the time, the transactions that we see associated with any kind of terrorism or domestic extremism look like every day transactions,” Ms. Davis said. “You’d never look at them and say, ‘Well, this looks like terrorism to me,’ on their own.’”

FINTRAC says it’s hired more analysts, and is using new technology to help it improve the way it monitors this ever-growing influx of data. But FINTRAC says it can’t discuss that process in detail. It’s also working with companies to refine the reports they send to make the process more effective, and ensure every STR is reviewed and properly acted upon.

“These [STRs] are the crown jewels for us. The numbers have gone up and it’s challenged the organization, but I think through the use of additional analysts and tools and technology, we’re able to keep up with the volume coming in,” said Mr. Gibb, a senior spokesperson for FINTRAC.

The regulator has a team of 120 analysts in Ottawa, and after STRs are reviewed, most are not found to be connected to crime or terrorism. But hundreds are elevated to the level of ″financial intelligence disclosures” and passed on to other branches of government to investigate further. Last year, FINTRAC made 2,046 of these disclosures to police, law enforcement and national security agencies, the vast majority of those reports going to the RCMP. That’s up from 796 a decade ago.

STRs are just one piece of the puzzle for FINTRAC. The regulator also gets information on large cash transactions, international electronic funds transfers, cross-border currency movements and casino disbursements, all part of the roughly 30 million transaction reports the regulator must analyze each year.

Despite this massive monitoring effort, FINTRAC investigations very rarely lead to charges connected to money laundering or extremist financing, said James Cohen, head of the anti-corruption non-profit Transparency International Canada. That’s largely because law enforcement agencies are hesitant to take on these labour-intensive, time-consuming cases, he said.

“As a country, we’re still not doing a great job,” he said. “You have to wonder about the number of cases that are slipping through... They’re making improvements, but there’s a lot of work yet to be done.”

The lawyer for the Nova Scotia victims’ families, meanwhile, says questions need to be asked about how the gunman was able to amass as much cash and assets as he did, far exceeding his income as a denturist, and how that slipped through FINTRAC’s watch. When police began combing through the remains of Mr. Wortman’s torched cottage in Portapique, N.S. they found $705,000 in cash buried on the property.

The warrants also describe how Mr. Wortman, who liked to spend lavishly and complain he hated paying taxes, received $475,000 in $100 bills from a Brinks facility in Dartmouth weeks before his rampage, as he grew increasingly anxious about COVID-19.

“The bigger question is how did a denturist come into that kind of cash,” said Mr. Pineo, whose law firm is conducting a forensic audit of Mr. Wortman’s finances as part of the class-action suit against his estate.

“It doesn’t appear from our early review that his legitimate income was sufficient to generate the assets that he had. Just looking at raw numbers, there was money coming from somewhere else, and it wasn’t on the books.”

The public inquiry into the mass shootings, which has already cost $13-million, has so far declined to share details of its investigative work. Barbara McLean, the commission’s investigations director, said more information on Mr. Wortman’s “financial misdealings” will be made public when hearings begin.

Mr. Cohen says it’s clear FINTRAC isn’t able to follow up on every financial irregularity across the country. While Ottawa is trying to address the regulator’s shortcomings in the fight against money laundering and terrorism financing, Canada still has a reputation as a place where it’s easy to hide illicit cash, he said.

For years, companies and financial professionals who supply FINTRAC with data complained the regulator was like a “black box,” providing no feedback on whether the information reported was useful in preventing or prosecuting crimes, Mr. Cohen said

It’s a question of resources, he said. Politicians need to provide FINTRAC with adequate staff and tools to do its job, he said. Without it, they can only focus on the biggest of cases involving the most money, letting lots of smaller ones fall through the cracks.

Our Morning Update and Evening Update newsletters are written by Globe editors, giving you a concise summary of the day’s most important headlines. Sign up today.