Massive unreported security breach, $2 million alleged fraud at NorQuest College

Shortly after the work day began on Feb. 19, 2013, a bizarre email popped up in the inboxes of dozens of NorQuest College senior executives and staff.

"What you're about to read is correspondence of a sexual nature between myself (John Smith) and my little playful sweetie," began the email.

Smith, a senior NorQuest executive, was obviously not the author of the scandal-mongering email. (CBC News has given the executive a pseudonym to protect his privacy.)

• Court documents detail alleged frauds orchestrated by former NorQuest IT manager

The anonymous sender had attached a PDF document that contained a string of sexually graphic emails and texts that appear to have been exchanged between Smith and a woman who was not his wife.

Court records later filed by NorQuest allege this information had been taken directly from the college's Information Technology (IT) system, and had been used to make "slanderous and defamatory comments including (among other things) that (Smith) had engaged in an extramarital affair."

The email, also sent to Smith's wife, suggested Smith had learned some important lessons, including to "always treat people with respect for you never know when something might come back to haunt you."

Massive privacy breach

The email marked the culmination of an escalating campaign of what the college alleged was harassment and defamation of Smith and Shawn Terlson, another senior NorQuest executive, both of whom had played a role in the firing of Clarence Orleski, the college's manager of technology infrastructure.

But a voluminous civil court file details how Orleski's alleged attempt to humiliate the two executives who fired him appears to have backfired. It led to a lawsuit against Orleski that alleged he committed a massive privacy breach and orchestrated two brazen fraud schemes that the college claims caused it nearly $2 million in damages.

NorQuest College, Smith and Terlson sued Orleski and his alleged co-conspirators in the frauds. The defendants who filed statements of defence denied the allegations and none were proven in court.

It appears the case was quietly settled earlier this year and the court record doesn't show how much, if any, money the college recouped.

"We have advised Mr. Orleski to decline the request for an interview," his lawyer told CBC News in an email Tuesday.

"The matter as between NorQuest and our client is concluded, and the terms governing the conclusion are confidential."

NorQuest College did not respond to repeated interview requests by CBC News over several days earlier this week. Instead, the college issued a brief statement that said it had settled its civil action against Orleski and the other defendants and was "very satisfied with the results.

"We are confident we have strong controls in place to protect public assets and confidential information," the statement said, adding that the Edmonton police are "involved."

NorQuest never publicly reported the frauds or the massive privacy breach, even though confidential salary information of all 600 of the college's employees - including the employment contract of CEO Jodi Abbott - was found on Orleski's home computer.

The college claimed Orleski also had "harvested" information of an "intensely personal and private nature including emails between employees and their spouses about finance and personal matters."

'The amount of information belonging to NorQuest found on the hard drive of Orleski is overwhelming...'

An affidavit sworn by a senior NorQuest executive in its lawsuit against Orleski said "the amount of information belonging to NorQuest found on the hard drive of Orleski is overwhelming, including 2.4 gigabytes of information and 45,920 files just within the ("NorQuest College") folder from Orleski's main computer."

NorQuest hired Orleski in June 2007 as its manager of technology infrastructure, which meant he had unrestricted access to all information on the college's IT systems, including its financial data and employee personnel information.

Ominous email

Court documents don't show how Orleski came to detest Smith. But by September 2012, he was summoned to a meeting to discuss work-related issues with Smith and Terlson.

Early on the morning of the scheduled meeting, Orleski sent Smith an ominous email.

"I've been wanting to touch base with you and get the name (and contact info) of the lady you introduced to me back in the late fall last year," Orleski wrote.

"I forget her name, but she is the one that you and her thought no one was in the office at the time. I was going to interrupt the two of you, but I felt I might be intruding on something, so I just hung around for a while.:)

"I think her name was (woman's name)," Orleski wrote.

The meeting went badly.

"In the course of the meeting, (Orleski) indicated that 'he couldn't stand the sight' of Smith, and requested to work from home" until his planned retirement at the end of March 2013 so "he would not have to deal with Smith," an affidavit from NorQuest's former head of human resources states.

Terlson denied Orleski's request to work from home and issued a formal letter that same day warning of further discipline if there were any more problems with Orleski's conduct.

Later that same day, an IT department employee raised concerns about Orleski's "accessing of the NorQuest network."

The college responded by hiring an outside service provider to conduct a review of its network system, which "confirmed that the structure of the network system, for which Clarence Orleski was one of the main architects, created significant risks of security breaches," said a NorQuest affidavit.

Unauthorized computer system access

On Sept. 21, 2012, the day after the tense meeting, Orleski was scheduled to work from home. But he came into the office over the lunch hour and "it was discovered shortly after that (Orleski) had run a program on his NorQuest laptop, known as DBAN, which effectively destroys all data on the computer," an affidavit states.

A few days later, Smith formally reprimanded Orleski for running up a $10,000 roaming bill on his college-supplied phone and iPad while on holiday in Europe. Smith said Orleski had expected the college would pay the bill, but he told Orleski he was not expected to be available for work while on vacation.

Orleski went on sick leave. Over the next two months, the college said it repeatedly attempted to meet with him as part of its investigation of network security issues and the wiping of his laptop.

Finally, on Dec. 4, they met and Orleski was fired.

"Our investigation has made it clear that you accessed our computer systems for unauthorized purposes, you interfered with our investigation by attempting to destroy information of improper computer use, you were not truthful with us in the course of the investigation and you undermined our corporate culture by making ill-considered and inappropropriate comments to co-workers," Terlson wrote in Orleski's termination letter.

The affidavit by the college's human resources director said Orleski had told a meeting of his IT group that Smith was having a sexual relationship with a woman who Orleski named.

Orleski hired a lawyer who sent an aggressive letter to NorQuest. In it, Orleski denied all the allegations and produced a list of improper actions by NorQuest that "would attract additional damages" if he sued.

"While we are unaware as to why NorQuest engaged in such reprehensible conduct, it can be assumed that it was done with the intentions of leading Mr. Orleski to resign his employment," his lawyer wrote.

But Orleski offered to settle and release NorQuest of any future liabilities for a lump sum payment of $49,750.

"Did the two of you really think you were going to win?"

Court documents show the college settled with Orleski for his termination even after Terlson had received anonymous emails that NorQuest later claimed constituted harassment.

On Jan. 21, 2013, NorQuest terminated Terlson for reasons it said were unrelated to the Orleski case. That same day, Terlson received an email from an anonymous account.

The email, court documents state, clearly shows the writer had access to personal emails between Terlson and his wife. The writer gloats about Terlson's termination and suggests Smith will soon also be unemployed.

"I guess what I'm trying to figure out is which one are you? 'Dumb' or 'Dumber'... Don't worry, Mr. pretty boy (Smith) won't be far behind you," the email states.

"Did the two of you really think you were going to win? Get a life you dumb f***. The fun is yet to begin."

Did the two of you really think you were going to win? Get a life you dumb f***. The fun is yet to begin.

Nine days later, Smith received an anonymous text on his phone from a number later traced back to the college's IT department.

The writer asked how Smith's wife was, and referredto her by a name that "was specific to her personal email account, which was accessible on the personal email of Smith on the NorQuest network," an affidavit states.

"I wonder if she knows about (the woman Smith is alleged to have had an affair with)," the text said, adding, "Stay tuned. Lol."

Less than a month later, on Feb. 19, 2013, the anonymous email containing details of Smith's alleged affair was sent to dozens of NorQuest employees. But it also was sent to senior executives within the office of Alberta's auditor general and to senior Alberta Health Services executives, and to the presidents of two other colleges.

Computer seizure reveals alleged fraud schemes

It is not clear from the court documents if the "malicious" email prompted NorQuest's next move. But on March 1, 2013, a lawyer acting for the college appeared in an Edmonton court and obtained an Anton Piller order, a rare legal ruling that allowed the college to search Orleski's home and seize evidence without any prior warning.

By 10 a.m. the next day, five people, including a bailiff, a private investigator, and a forensic computer expert, were on Orleski's doorstep in southwest Edmonton. By 3:15 p.m. they had hauled away his personal computer, a NorQuest iPad and phone, and several other data storage devices.

In an affidavit, a NorQuest executive said a search of Orleski's home computer hard drive revealed emails and documents that showed Orleski was "clearly the author and originator" of the email alleging Smith's sexual relationship. It also uncovered information that the college claimed formed the basis of a harassing email sent to Terlson.

• Court documents detail alleged frauds orchestrated by formerNorQuestIT manager

But court documents allege the search also revealed a privacy breach that extended far beyond the confidential information of Smith and Terlson.

"A vast quantity of confidential NorQuest information was found on the hard drive of Orleski's home computer including the salary of every single employee, the employment contract of the CEO of NorQuest, private emails to the president's confidential email account, notes by the CEO about terminations, disciplinary action, confidential notes from the president to the board chair as well as confidential notes between the president of NorQuest and outside legal counsel," the affidavit states.

There were also files containing information about NorQuest's budget and planning, performance reviews for many senior college personnel, copies of disciplinary letters to employees, transcribed interview notes from internal investigations - even emails between employees and their spouses discussing personal finances.

The search of Orleski's hard drive set forensic accountants hired by the college on the trail of what was alleged to beanother serious breach of trust: two alleged fraud schemes involving what the accountants said were inflated and unnecessary invoices for IT products and services.

The college's statement of claim accused Orleski of "dishonestly and wrongfully designing, orchestrating, and implementing a scheme of fraud and deceit" involving two separate companies, "for his own personal gain and benefit" over a combined period of about five years.

NorQuest alleged Orleski and his co-conspirators caused the college nearly $2 million in damages. The defendants who filed statements of defence denied the allegations and none were proven in court.

NorQuest pursued its lawsuit against Orleski and the others for years. In March 2015, it sought a summary judgment against Orleski and his company but the application was adjourned because the parties were close to a settlement.

In January 2016, NorQuest discontinued its legal action against all of the parties it sued, except one alleged co-conspirator who had already filed for bankruptcy. Nothing in the documents indicates any admitted wrongdoing by Orleski or any of his accused co-conspirators. There is no indication the college recouped any of the money it claimed it lost.

The lawsuit, and the allegations contained in it, apparently did not affect Orleski's future employment. He now works for a large contracting company in Blackfalds, outside Red Deer.

@charlesrusnell
@jennierussell_

If you have any information about this story, or information for another story, please contact us in confidence at cbcinvestigates@cbc.ca