Air Canada IT worker traced gold heist data trail at Pearson Airport trial

An Air Canada IT specialist testified he analyzed over 400,000 lines of computer logs to reconstruct how thieves stole $22M in gold and cash from Pearson Airport.

Air Canada tech specialist pieced together $22M Pearson gold heist from 400,000 lines of data

Joshua Priebe, a program manager at Air Canada, was poolside in Jamaica with dozens of airline colleagues when news broke of a spectacular gold theft at the company's Toronto cargo warehouse.

"When we were down there we all got a message," Priebe told the Ontario Superior Court of Justice in Brampton on Tuesday. "We were talking about it at the pool, in the pool, and speculating on what could have happened."

According to National Post Crime, the trial is proceeding against Parmpal Sidhu, a 56-year-old former Air Canada cargo warehouse employee accused of conspiring to steal a crate containing gold and foreign currency valued at more than $22 million — the largest gold heist in Canadian history. The theft took place on April 17, 2023, at Air Canada's cargo facility at Pearson International Airport.

Priebe, who at the time held the role of manager of application development and maintenance at the Pearson cargo facility, was asked by corporate security to preserve computer logs and assist Peel Regional Police with the investigation after returning from the Jamaica trip, which was an employee award prize.

'I tried to put myself in the mindset'

Priebe told Judge Gordon Cudjoe he approached the data with a deliberate investigative posture.

"I'm a curious fellow by nature and I like to understand things. My mind automatically jumped into how I would have done it," he said from the witness stand.

Sifting through more than 400,000 lines of computer activity logs spanning one week before and one week after the heist, he searched for patterns consistent with how he believed the crime had been planned and executed.

"I tried to put myself in the mindset of how I would have done something like this. I hope I'm not criminally minded, but I find it interesting. So that's why I delved into the data," Priebe testified.

"I started to piece together the story of what happened."

Searches from home, credentials for a fugitive

Priebe told court that whoever carried out the heist appeared to have deep familiarity with Air Canada's cargo procedures and held credentials allowing access to its internal computer systems.

He focused first on off-site activity — reasoning that someone plotting a heist would likely conduct reconnaissance searches from home, where privacy was greater. Filtering out in-office inquiries, he identified a pattern of repeated remote searches over several days, apparently targeting incoming flights from Zurich, a financial hub known for shipping precious metals, foreign currency, and luxury watches. Such shipments arrive at Pearson on a regular basis, he said.

The login credentials used for those searches belonged to Simran Preet Panesar, an Air Canada manager to whom Sidhu reported. Panesar is currently considered a fugitive and is wanted by police on charges related to the heist.

Crate reclassified mid-flight, security bypassed

A separate set of credentials — belonging to a different Air Canada employee — was then used to alter the designation of a specific crate aboard a flight from Zurich. While the aircraft was still in the air, a change was made to the shipping record that stripped the crate of its high-value classification.

That change had a direct consequence: instead of being routed to the airport's locked and guarded secure storage area, the crate would be sent to general storage, accessible to any employee.

Priebe said the timing of the alteration was a clear red flag.

"It was suspicious for me because it bypasses the automatic lockdown" on shipment data that takes effect once a plane lands and unloading begins. "It looks like it's trying to bypass the security elements that we had in place."

Mobile phone on guest Wi-Fi raises alarm

A third change, made through yet another employee's credentials, ensured the crate would not be unpacked and divided among its two intended recipients — TD Bank, collecting the gold, and a Vancouver foreign exchange firm, collecting the foreign banknotes. Instead, the crate was flagged to be kept intact, ensuring the full load of gold and cash remained together.

That modification was made on a mobile phone connected to the cargo warehouse's guest Wi-Fi network, rather than on one of the staff desktop computers — a detail Priebe flagged as highly irregular.

"This is unionized work that they're doing and a unionized person would have no reason to go on a mobile device on the guest Wi-Fi to perform their duties. They're provided with a computer at their desk."

Air waybill linked to Sidhu's credentials

Priebe also traced the login credentials used to print an air waybill — a shipping document establishing ownership of cargo — that a driver later used to collect the diverted crate. Those credentials, court heard, belonged to Sidhu.

The digital logs thus connected a sequence of actions: the initial targeting of a high-value Zurich shipment, the mid-flight reclassification of the crate, the consolidation of its contents, and the printing of documents used to remove it from the facility — each step tied to a different set of employee login credentials.

Priebe's testimony came on the second day of the trial for Sidhu before Judge Cudjoe. The case marks a significant proceeding in one of Canada's most high-profile cargo thefts, with the court continuing to hear evidence about the digital footprints left behind in Air Canada's cargo management system.

Source: National Post Crime