'Curious' Air Canada IT worker tried to think like a crook to trace how airport gold heist was pulled off

Air Canada technology specialist Joshua Priebe was on a trip to Jamaica with dozens of airline colleagues when he heard about the spectacular gold heist at Air Canada’s Toronto cargo warehouse.

“When we were down there we all got a message,” Priebe told court Tuesday at the trial for one of the men accused of pulling off the largest gold heist in Canadian history. “We were talking about it at the pool, in the pool, and speculating on what could have happened.”

Once Priebe got back from the trip, which was a prize in the airline’s employee awards program, and returned to work at the scene of the crime, he heard more about the high-profile heist in which thieves mysteriously made off with a shipment of gold and cash worth more than $22 million.

“I’m a curious fellow by nature and I like to understand things. My mind automatically jumped into how I would have done it,” he said from the witness stand. It seemed like an inside job.

Priebe is now a program manager at Air Canada. At the time of the gold heist — April 17, 2023 — he was manager of application development and maintenance at Air Canada, an IT job at the airline’s large cargo facility at Pearson airport, where he helped keep the airline’s cargo management system running.

As an IT worker, he was asked by corporate security to preserve the corporate computer logs and to help Peel Regional Police investigate the heist, he said.

Analyzing more than 400,000 lines of code that documented employee computer usage from a week before the heist to a week afterwards, he looked for patterns matching the way he figured the heist could have been pulled off.

“I tried to put myself in the mindset of how I would have done something like this. I hope I’m not criminally minded, but I find it interesting. So that’s why I delved into the data,” Priebe testified.

“If I wanted to plan this out, how would I have done it? And looking at the data, I looked at the transactions that I would have done leading up to something like this,” he said.

“I started to piece together the story of what happened.”

Priebe described for Judge Gordon Cudjoe of the Ontario Superior Court of Justice in Brampton the suspicious data trail at the second day of the trial for Parmpal Sidhu, a 56-year-old former Air Canada cargo warehouse employee who is one of the men accused of conspiring to steal the valuable crate.

Priebe said whoever was involved in the heist appeared to have deep knowledge of Air Canada’s shipping and cargo procedures and had credentials with access to its computer systems.

He looked for online activity in the logs for someone using Air Canada’s systems to search incoming air traffic for arriving shipments. He said that’s where a heist plot would likely start, trying to identify a specific high-value shipment as a target.

An employee with credentials could do that search remotely, from anywhere, not just in the office. Priebe figured the person would probably do it from home, where they had more free time and greater privacy, and so Priebe filtered out in-office inquiries and found a profile fitting that pattern — repeated searches over a couple of days made off-site, apparently of flights from Zurich, a financial centre in Switzerland known for shipping high-value precious metals, currency and luxury watches. Such shipments can be a daily occurrence at Pearson, he said.

The login credentials used for those searches, court heard, were for Simran Preet Panesar, who was an Air Canada manager who Sidhu reported to, and who is considered a fugitive wanted by police on charges of being part of the gold heist.

Priebe also found the credentials of a different Air Canada employee were then used to log into the system to change the designation of a specific crate on a flight from Zurich by deleting its code that it was a high-value shipment. This was done while the plane was in the air.

That change meant the crate would not be sent to a secure storage area at the airport, which is locked and guarded, but instead sent to general storage, where any employee could access it.

The timing of the change was a red flag, Priebe said.

“It was suspicious for me because it bypasses the automatic lockdown” on a shipment’s data that kicks in once it touches down and unloading begins. “It looks like it’s trying to bypass the security elements that we had in place.”

Another login, using yet another employee’s computer credentials, made a different but important change to the shipping data for the crate. This change made it so the crate would not be unpacked by warehouse staff and divided for the two different customers picking up the contents — TD Bank collecting the gold and a Vancouver foreign exchange picking up the foreign banknotes — but rather kept intact.

That made sure the entire load of gold and cash stayed together.

That was suspicious to Priebe because he saw the change was made on a mobile phone using the cargo warehouse’s guest Wi-Fi, rather than one of the desktop computers used by staff.

“That is not normal,” he said.

“This is unionized work that they’re doing and a unionized person would have no reason to go on a mobile device on the guest Wi-Fi to perform their duties. They’re provided with a computer at their desk.”

Priebe also described how the corporate digital logs also traced the login credentials used to print off an air waybill — a shipping contract that shows ownership of cargo — that was used by a driver to collect the diverted crate. The access was in the credentials for Sidhu, court heard.

Court heard from the second and third employees whose credentials were used to set up the heist.

On Monday Elizabeth Zaritskaya, now the manager of Hub Operations at Air Canada, testified that she was not at work at the time of the heist and was mystified with her credentials being used. She said she had nothing to do with the heist.

On Tuesday, Rachel Pearce, a former Air Canada manager whose last name at the time of the heist was Bailey, testified was she also was away at the time. When she came back to work, she heard from colleagues that people were talking about her ID being used.

“It was quite shocking,” she said. She said she thinks someone got her credentials or logged into her account by using an access password saved in her browser, before Air Canada changed their systems.

Court has heard that digital hygiene and computer security was woeful at the warehouse at the time and has since been overhauled.

Witnesses described credentials, profiles and logins being shared among employees out of convenience, shared workspaces, shared computers and staff forgetting to log out.

• Email: ahumphreys@postmedia.com | X: AD_Humphreys

Our website is the place for the latest breaking news, exclusive scoops, longreads and provocative commentary. Please bookmark nationalpost.com and sign up for our newsletters here.