Dastardly Design
By the end of his presentation, Alex Gomez had attained the undivided attention of almost everyone presented at the Structural Engineers’ Seminar (Asia Pacific) for the New Millennium. The topic was “Political Corruption and the Construction Industry in Southeast Asia.” Albert Watanabe, head of Southeast Asian operations for Construction Consultants, Ltd., was among the audience members who were impressed by Alex’s presentation. Construction Consultants, Ltd. (CCL) was a Hong Kong-based structural engineering consulting firm and was well known throughout Southeast Asia. CCL was founded by Edward Lim, a professional engineer. What started off as a small consultancy quickly expanded and, in a mere six years, Lim established his company as one of the most powerful and respected in Southeast Asia. As a knockout blow to its competitors, CCL acquired Nathan & Associates Structural Engineering, Ltd., the second largest such firm in the area.
More recently, Albert Watanabe’s immediate subordinate, Ramesh Pillai, resigned because his wife has insisted on immigrating to Canada, where her parents had retired. This resignation created a vacuum that put incredible pressure and workload on Watanabe. As the regional country manager, he was responsible for the profitability and growth of the Kuala Lumpur office. However, he was also the regional director in charge of offices in Singapore, Indonesia and Malaysia; his new workload was causing him too much stress and he needed a right-hand man to independently run the Malaysian operation with minimal supervision.
A lunch break followed Alex Gomez’s presentation, and Watanabe did not want to lose his opportunity to meet this dynamic speaker because, if the plan worked out, Watanabe hoped to hire Gomez and finally be relieved of his gargantuan workload.
More recently, Albert Watanabe’s immediate subordinate, Ramesh Pillai, resigned because his wife has insisted on immigrating to Canada, where her parents had retired. This resignation created a vacuum that put incredible pressure and workload on Watanabe. As the regional country manager, he was responsible for the profitability and growth of the Kuala Lumpur office. However, he was also the regional director in charge of offices in Singapore, Indonesia and Malaysia; his new workload was causing him too much stress and he needed a right-hand man to independently run the Malaysian operation with minimal supervision.
A lunch break followed Alex Gomez’s presentation, and Watanabe did not want to lose his opportunity to meet this dynamic speaker because, if the plan worked out, Watanabe hoped to hire Gomez and finally be relieved of his gargantuan workload.
Perfect Fit
Watanabe, full of confidence, walked up and introduced himself to Gomez. After a brief conversation, Watanabe asked Alex to visit him in his office the following Monday at 10.00 AM, to discuss Alex leaving his position as the general manager with a local company involved in the construction of commercial complexes. For Gomez, Watanabe’s proposition was a dream come true; since obtaining his BS in civil engineering from the University of Berkley and moving to Malaysia, he had been looking for a high-profile engineering firm that solely provided consultation, not construction.
CCL had been on his radar for a long time and his meeting with Watanabe was truly a breakthrough – at long last his ambition was going to be realized.
CCL was possibly the best-suited firm for Gomez in his mind, especially because the salary offered was close to double what his previous employer had been paying him. For Watanabe – who was looking for a young, dynamic, self-driven person familiar with the Malaysian market and with expertise in structural design – Gomez had perfectly matched skills and experience, so Albert strongly recommended him for the director position in the Malaysian office and got approval from Hong Kong, pending a back- ground check – which was never conducted?
After only eight months at CCL, Alex had demonstrated his uncanny skill in handling his clients and subordinates and showed the innovative creativity needed for structural designing. Watanabe did not feel it was right to make such a talented person undergo a background check and, thus, the first fatal mistake was made. But over the next five years, Gomez repeatedly proved his skills, and he was highly looked upon by Watanabe and Edward Lim himself. Gomez was given a big bonus in appreciation of his design engineering effort for a prestigious client, and everything seemed to be going his way. The business was flourishing, and his subordinates hardly had the courage to go against his instructions; they knew he was connected with the higher authorities and that his orders were final. Watanabe’s visits to the Kuala Lumpur office were mostly confined to meetings with major clients and, taking advantage of this, Gomez was running the office with absolute authority. In a nutshell, with the complete trust of his seniors on one hand, and the unprecedented level of control on the other, Gomez was fully armed.
CCL was possibly the best-suited firm for Gomez in his mind, especially because the salary offered was close to double what his previous employer had been paying him. For Watanabe – who was looking for a young, dynamic, self-driven person familiar with the Malaysian market and with expertise in structural design – Gomez had perfectly matched skills and experience, so Albert strongly recommended him for the director position in the Malaysian office and got approval from Hong Kong, pending a back- ground check – which was never conducted?
After only eight months at CCL, Alex had demonstrated his uncanny skill in handling his clients and subordinates and showed the innovative creativity needed for structural designing. Watanabe did not feel it was right to make such a talented person undergo a background check and, thus, the first fatal mistake was made. But over the next five years, Gomez repeatedly proved his skills, and he was highly looked upon by Watanabe and Edward Lim himself. Gomez was given a big bonus in appreciation of his design engineering effort for a prestigious client, and everything seemed to be going his way. The business was flourishing, and his subordinates hardly had the courage to go against his instructions; they knew he was connected with the higher authorities and that his orders were final. Watanabe’s visits to the Kuala Lumpur office were mostly confined to meetings with major clients and, taking advantage of this, Gomez was running the office with absolute authority. In a nutshell, with the complete trust of his seniors on one hand, and the unprecedented level of control on the other, Gomez was fully armed.
Lunchtime Alarm
As usual, it was a busy day at CCL’s Kuala Lumpur office and the staff was in a rush to complete a design for a renowned developer. Gomez was briefing a subordinate, Rayan Tan, about the final details and minor corrections that needed to be made and was in a hurry because Alex had a lunch appointment with an important client. Rayan assured Gomez that he would have the designs ready on his table for review by the time he got back from his meeting at 3.00 PM. As soon as Gomez was gone, his private telephone rang, Gomez who normally kept his office locked when was out, had left the door open as Rayan requested, in case he needed to refer to some of the files.
Although Tan had access to his boss’s office, he did not answer the call because he felt it would have been a breach of privacy. But after half an hour, the phone rang again. Presuming Gomez might have left his cell phone behind and there is an important
Although Tan had access to his boss’s office, he did not answer the call because he felt it would have been a breach of privacy. But after half an hour, the phone rang again. Presuming Gomez might have left his cell phone behind and there is an important
client might be trying to contact Gomez, Tan reluctantly entered his boss’s room and picked up the phone. No sooner had he done this that the caller started yelling, “Alex! It’s Michael Wong here. Why are you doing this to me? Stop ignoring my e-mails! The renovation of my house is hanging in the balance because of your delay. How long do you expect us to stay in a hotel? Last week, on Monday, you promised to deliver the design by Friday and to have a meeting with our contractors, but it is already Wednesday and there has been absolutely no response from your end.”
“Sir, my name is Rayan, Mr. Gomez’s subordinate, and he is no in the office at the moment. May I have your contact number and ask him to call you back?”
Wong, taken by surprise, said that Gomez had his number and to just tell him to return the call as soon as he got back. After that, as afar as Tan could tell, the phone was slammed back onto the receiver. As a matter of habit, when he was talking, Rayan noticed the caller ID on the phone. He wrote the number in his diary and return to his cubicle with some unease because the caller appeared to be an individual requiring a new design to complete the renovation of his home. CCL dealt only with contractors and builders, an apparently the caller was neither. To understand this mystery, Tan went through the list of active clients but did not find any by the name of Michael Wong. Despite this anomaly, Tan did not have to time to delve into the matter further – he had pending designs to finish for Gomez. He engrossed himself in the project and left the issue to be handled by Alex, who returned at 3.00 PM sharp and was visibly upset. He headed straight for his office and, on the way, told Tan to see him there. Gomez had a received a call on his cell phone from Michael Wong who mentioned his conversation with Rayan.
Gomez jumped into an explanation to Tan about how a crazy customer was on his tail and kept e-mailing him to get some work done despite Gomez’s numerous assertions that CCL did not work with individuals unless they were building contractors or engineers. This explanation further bewildered Tan because Gomez volunteered it, which was against his basic nature as an authoritarian who hardly interacted with his subordinates. Tan was now suspicious.
“Sir, my name is Rayan, Mr. Gomez’s subordinate, and he is no in the office at the moment. May I have your contact number and ask him to call you back?”
Wong, taken by surprise, said that Gomez had his number and to just tell him to return the call as soon as he got back. After that, as afar as Tan could tell, the phone was slammed back onto the receiver. As a matter of habit, when he was talking, Rayan noticed the caller ID on the phone. He wrote the number in his diary and return to his cubicle with some unease because the caller appeared to be an individual requiring a new design to complete the renovation of his home. CCL dealt only with contractors and builders, an apparently the caller was neither. To understand this mystery, Tan went through the list of active clients but did not find any by the name of Michael Wong. Despite this anomaly, Tan did not have to time to delve into the matter further – he had pending designs to finish for Gomez. He engrossed himself in the project and left the issue to be handled by Alex, who returned at 3.00 PM sharp and was visibly upset. He headed straight for his office and, on the way, told Tan to see him there. Gomez had a received a call on his cell phone from Michael Wong who mentioned his conversation with Rayan.
Gomez jumped into an explanation to Tan about how a crazy customer was on his tail and kept e-mailing him to get some work done despite Gomez’s numerous assertions that CCL did not work with individuals unless they were building contractors or engineers. This explanation further bewildered Tan because Gomez volunteered it, which was against his basic nature as an authoritarian who hardly interacted with his subordinates. Tan was now suspicious.
Calling in the Big Guns
The following day, Gomez left for Indonesia to attend a three-day Innovative Construction Seminar. It was the perfect time for Tan to dig further to remove the doubts that clouded his mind. Rayan, uncertain as he was contacted his old friend, Philip Leong. They had been close for many years and had worked together in a well- established construction company, with which Philip was still affiliated. Rayan met
Philip during lunch and briefed him about the incident. Together, they decided that Leong would contact Michael Wong in an attempt to get more information by posing as a consultant. Soon after lunch, Philip called Michael’s office and set up an appointment with him for the next day. During that meeting, Michael showed Philip a structural design that had been proposed by Gomez that required modifications because Michael wanted a swimming pool inside the living area. Seizing this opportunity, Philip assured Michael that if he could have a photocopy of the design, he would come up with new plan, pool included, despite the complications.
Michael told Philip he could pick up a copy from the reception desk at around 5:00 PM. Philip did so and passed it on to Rayan. Tan opened the envelope and was astounded to see that Gomez had stamped the design plans under CCL’s name. This was most definitely against CCL’s policies. “What am I going to do with this? Who should I contact? Who should I discuss this matter with? Would the cost of making this information known be too high for me? These questions left him utterly perplexed and unsettled. It was a stressful night for Rayan; he still felt loyal to his boss.
The following morning, mustering up his courage, Rayan called Watanabe on his personal cell phone and said he needed to discuss something urgent and confidential. Watanabe, who was in Singapore, asked Rayan to wait until Gomez returned from Indonesia; Watanabe said Gomez would be the right person for Rayan to speak with. Rayan took a deep breath and managed to utter, “Sir, this matter involves possible wrongdoing by Mr. Gomez, and I feel that his conduct could be damaging for CCL.” Watanabe’s first reaction was of disbelief because he hardly knew Rayan, apart from the fact that he had been Gomez’s subordinate for the past four years. Nonetheless, he could not ignore Tan. Watanabe asked his secretary to book the earliest available flight to Kuala Lumpur and kept his departure confidential. By 1:30 the same afternoon, Watanabe landed in Kuala Lumpur.
As instructed, Rayan was waiting for Watanabe at the airport with documents of CCL’s current and past customers. These confirmed that Michael Wong was not on the customer list. Watanabe alerted his boss, Edward Lim, who instructed Watanabe to probe the matter thoroughly and to establish the facts. In the meantime, Edward’s office contacted Alex and asked him to visit the head office after his seminar before going back to Kuala Lumpur. This was designed to keep Gomez occupied and buy time for Watanabe to get some preliminary work done before launching a full-scale investigation.
Michael told Philip he could pick up a copy from the reception desk at around 5:00 PM. Philip did so and passed it on to Rayan. Tan opened the envelope and was astounded to see that Gomez had stamped the design plans under CCL’s name. This was most definitely against CCL’s policies. “What am I going to do with this? Who should I contact? Who should I discuss this matter with? Would the cost of making this information known be too high for me? These questions left him utterly perplexed and unsettled. It was a stressful night for Rayan; he still felt loyal to his boss.
The following morning, mustering up his courage, Rayan called Watanabe on his personal cell phone and said he needed to discuss something urgent and confidential. Watanabe, who was in Singapore, asked Rayan to wait until Gomez returned from Indonesia; Watanabe said Gomez would be the right person for Rayan to speak with. Rayan took a deep breath and managed to utter, “Sir, this matter involves possible wrongdoing by Mr. Gomez, and I feel that his conduct could be damaging for CCL.” Watanabe’s first reaction was of disbelief because he hardly knew Rayan, apart from the fact that he had been Gomez’s subordinate for the past four years. Nonetheless, he could not ignore Tan. Watanabe asked his secretary to book the earliest available flight to Kuala Lumpur and kept his departure confidential. By 1:30 the same afternoon, Watanabe landed in Kuala Lumpur.
As instructed, Rayan was waiting for Watanabe at the airport with documents of CCL’s current and past customers. These confirmed that Michael Wong was not on the customer list. Watanabe alerted his boss, Edward Lim, who instructed Watanabe to probe the matter thoroughly and to establish the facts. In the meantime, Edward’s office contacted Alex and asked him to visit the head office after his seminar before going back to Kuala Lumpur. This was designed to keep Gomez occupied and buy time for Watanabe to get some preliminary work done before launching a full-scale investigation.
You Can’t Hide
I worked as the chief investigator in the forensic accounting division of my own firm; one of our core areas of services was computer forensics and Internet-based investigations. Watanabe consulted with us and requested we look into the matter. He told us that time was of the essence, and he suspected the evidence of Gomez’s actions would be found in his Internet history and e-mail correspondence. To maintain the secrecy of the investigation, Watanabe made special arrangements for us to visit and gather evidence after office hours. Based on the information provided by Rayan, first place we looked was in Alex’s locked wooded cabinet, where we found a stack of rough structural design sheets that were not related to any of CCL’s known clients. Some of the documents we recovered pertained to Michael Wong’s extraordinary house. Then my partner, Samir, and I began a complete and thorough forensic examination of Gomez’s laptop. While we were searching for his office, we found a number of ATM slips from Alex’s bank account, indicating massive withdrawals over a period of seven months. Alex’s salary could not account for such large transactions.
Because Gomez was dealing with outsiders, we assumed he would be communicating with them through the Internet and reasoned that we would find evidence thereof through the forensic review. Other than that, we hoped to find deleted files on the laptop that could explain Gomez’s activity. Our first step was to create a duplicate image of the hard drives to review from our own office.
Based on information gathered during our search, interviews with Rayan and our understanding of the type of the case, we developed a focused search strategy and performed keyword searches. It was not a very complicated investigation because Gomez was not a computer expert, and we knew what evidence we were looking for. Once Samir and I reduced the search space by identifying and filtering known and suspect files through signature analyses, we turned our attention to searching for specific keywords. The words we searched for included: design architect, civil construction, invoice, payment, consultation, fee, architectural design, building, house, structure, commercial complex, villas, bungalow, living area, interiors.
File signatures were examined to evaluate whether the user attempted to hide files in plain sight by changing file extensions. We compared the file extension with its corresponding signature; since thy matched, we were assured that no effect was made to obscure the file type.
As a part of our routine analysis, Samir and I also searched e-mail files; these leave traces on computers that provide vital information and, in this case, they revealed the modus operandi. We found traces of Gomez accessing his private e-mail service, Gmail. We also saw spreadsheet attachments to e-mails that suggested that significant amounts of data had been uploaded and downloaded through Gmail on various dates. We then conducted a series of experiments to determine the names associate with each message in the Gmail account and the result was astonishing. Numerous spreadsheets pertaining to CCL’s debtor’s ledger and other financial accounts were uploaded and downloaded on various occasions in the last three years. The resulting metadata analysis revealed the author as GMZ, which obviously indicated Alex Gomez. This was further confirmed when we discovered the laptop, and its software programs were registered to GMZ. We recovered deleted invoices that were created by the same author. These documents were bookmarked and copied to our evidence folder, as was the metadata analysis. We also bookmarked several Web page entries relating to payments to an account at Bank of Commerce.
Because Gomez was dealing with outsiders, we assumed he would be communicating with them through the Internet and reasoned that we would find evidence thereof through the forensic review. Other than that, we hoped to find deleted files on the laptop that could explain Gomez’s activity. Our first step was to create a duplicate image of the hard drives to review from our own office.
Based on information gathered during our search, interviews with Rayan and our understanding of the type of the case, we developed a focused search strategy and performed keyword searches. It was not a very complicated investigation because Gomez was not a computer expert, and we knew what evidence we were looking for. Once Samir and I reduced the search space by identifying and filtering known and suspect files through signature analyses, we turned our attention to searching for specific keywords. The words we searched for included: design architect, civil construction, invoice, payment, consultation, fee, architectural design, building, house, structure, commercial complex, villas, bungalow, living area, interiors.
File signatures were examined to evaluate whether the user attempted to hide files in plain sight by changing file extensions. We compared the file extension with its corresponding signature; since thy matched, we were assured that no effect was made to obscure the file type.
As a part of our routine analysis, Samir and I also searched e-mail files; these leave traces on computers that provide vital information and, in this case, they revealed the modus operandi. We found traces of Gomez accessing his private e-mail service, Gmail. We also saw spreadsheet attachments to e-mails that suggested that significant amounts of data had been uploaded and downloaded through Gmail on various dates. We then conducted a series of experiments to determine the names associate with each message in the Gmail account and the result was astonishing. Numerous spreadsheets pertaining to CCL’s debtor’s ledger and other financial accounts were uploaded and downloaded on various occasions in the last three years. The resulting metadata analysis revealed the author as GMZ, which obviously indicated Alex Gomez. This was further confirmed when we discovered the laptop, and its software programs were registered to GMZ. We recovered deleted invoices that were created by the same author. These documents were bookmarked and copied to our evidence folder, as was the metadata analysis. We also bookmarked several Web page entries relating to payments to an account at Bank of Commerce.
Gee, Look at This Gmail!
A detailed study and correlation of the evidence took hundreds of hours and revealed the followings facts about the fraud perpetrated by Gomez against CCL:
- At least 37 different individual customers were serviced by Gomez in the last 41 months.
- The customers were invoiced through Gomez’s Gmail account but payments were received in the name of CCL.
- A parallel spreadsheet with detailed accounting information above various customers of CCL was maintained by Alex. Some of these customers’ ledgers were affixed with the code “GMZ” in front of their name.
- A comparison of the ledgers with the GMZ code confirmed that these names did not appear in CCL’s books of accounts.
- To hide the transactions, the accounts of the GMZ customers were stored and maintained on Gmail in the name of customergone@gmail.com
- The invoices we retrieved were created by Gomez or through his laptop; the author of the invoices was “alexgmz”.
- Gomez e-mailed his individual client’s instructions to transfer payments online to a bank account at Bank of Commerce and attached invoices supposedly from CCL.
Watanabe contacted Bank of Commerce because CCL did not have an account at that financial institution. The bank gave us its records, which indicated Gomez had opened the account using a board of directors’ resolution granting him the authority as the sole signatory. The bank’s compliance officer told us she accepted an e-mailed copy of the resolution – not the original – because Gomez was on the board of directors. She assumed he was trustworthy. We later found a bogus, reprinted copy of the resolution with directors’ signatures pasted onto it, shoved in the back of one of Gomez’s desk drawers. This was the copy he had scanned and emailed to the bank. During the course of four years Gomez had earned almost 0,000 by providing services to clients under the guise of CCL. As investigators, Samir and I were left out of discussions regarding what actions CCL would take against Gomez. We later found out from Watanabe that the board of directors fired Alex Gomez immediately and gave our evidence to the local police. However, after months of indecision, the police decided the case was not large enough to warrant pursuing criminal charges. CCL did not press the matter with police because management did not want to attract the negative press.
*******************************************************************************************
US 16672 
GB 12457 
CA 10483 
AU 8061 
IE 4386 
BR 2034 
NZ 1756 
IN 985 
