Encrypted email service denies accused RCMP leaker’s claim it has intelligence ties

OTTAWA — A company that provides encrypted email service is disputing a former RCMP official’s claim that it secretly worked on behalf of an intelligence agency.

Cameron Jay Ortis testified in Ontario Superior Court that a foreign ally told him of a plan to encourage targets to begin using Tutanota, an online encryption service that he called a “storefront” operation created by intelligence agents to snoop on adversaries.

Ortis said he began enticing investigative targets through promises of secret information, with the actual aim of getting them to communicate with him via Tutanota.

In a statement on its website Monday, Tuta, as the company is now known, called Ortis’s claim completely false and denied ties to any secret service.

“Tutanota has never and Tuta will never operate a ‘storefront’ for any intelligence or law enforcement agency,” the German company said. “This would completely contradict our mission as a privacy protection organization.”

Tutao GmbH, the company behind Tuta, was founded in 2011 by Arne Möhle and Matthias Pfau, who knew each other from studying together at university in Hannover, Germany, the statement added.

“To this day, the company is wholly owned by Matthias and Arne, and is not liable to anyone else.”

Ortis, 51, has pleaded not guilty to violating the Security of Information Act by revealing secrets to three individuals in 2015 and trying to do so in a fourth instance, as well as breach of trust and a computer-related offence.

The Crown argues Ortis lacked authority to disclose classified material and that he was not doing so as part of some kind of undercover operation.

Ortis has testified that he did not tell his superiors about the plan to nudge targets to use Tutanota because he had been advised by the foreign counterpart to keep it quiet and, furthermore, targets had developed sources inside Canadian law enforcement agencies.

Reporters and the general public were excluded from the courtroom for Ortis’s testimony earlier this month, but transcripts have now been released.

Ortis was the director of the RCMP’s Operations Research group, which compiled and developed classified information on terror cells, transnational criminal networks, cybercriminals and commercial espionage.

He was arrested in September 2019.

The path to that arrest began the previous year when the RCMP analyzed the contents of a laptop computer owned by Vincent Ramos, chief executive officer of Phantom Secure Communications, who had been arrested in the United States.

An RCMP effort known as Project Saturation revealed that members of criminal organizations were known to use Phantom Secure’s encrypted communication devices.

Ramos would later plead guilty to using his Phantom Secure devices to help facilitate the distribution of cocaine and other illicit drugs to countries including Canada.

A retired RCMP investigator has told the jury he found an email to Ramos from an unknown sender with portions of several documents, including mention of material from the federal anti-money laundering agency, the Financial Transactions and Reports Analysis Centre of Canada, known as Fintrac.

The sender would later offer to provide Ramos with the full documents in exchange for $20,000.

Ortis acknowledges he was behind the messages to Ramos and others, saying it was all part of the clandestine operation involving Tutanota.

During cross-examination, Ortis generally played down the sensitivity of materials dangled to targets.

At one point, Crown prosecutor John MacFarlane asked Ortis about a page from a Fintrac disclosure summary sent to Ramos.

MacFarlane suggested disclosure of the information confirmed to Ramos that Fintrac was investigating his company, revealing the number of suspicious transactions the agency had flagged.

Ortis replied that he believed Ramos was already aware of the authorities’ interest, if not this particular set of data.

“When a company has issues with their accounts, and the banks notice suspicious transactions, the company is provided information regarding those suspicious transactions by the bank itself.”

This report by The Canadian Press was first published Nov. 13, 2023.

Jim Bronskill, The Canadian Press