Summary of Complaint to NZ Police with respect to actions taken relating to the private and confidential client information contained in USGTLs databases.
Parties – accused.
- David Tzimenakis
- Matthew Twine
Parties – Plaintiff
- US Global Tax (including all entities)
- Lance William Morris, Shareholder and Managing Director
General
I have complete certainty that David Tzimenakis is the primary party involved as he has the most extensive knowledge of our systems, the access and the opportunity, and they have the motive. In addition it is Davids username that was used to create, run and delete the reports within a very short space of time. However, I have equal certainty that they both colluded in this process.
Both were employed by US Global tax Limited at the time of the alleged offences:
- 22 August 2023
- 1 September 2023 (one working day prior to their resignation on Monday 4th September 2023)
David Tzimenakis was employed as the client services manager and Matthew Twine as a Senior US tax specialist.
Both tendered their resignation on 4 September 2023 stating their intention to establish a competing US tax preparation and consulting service.
Actions with respect to the client contact list.
David has a limited report writing capability. He can write simple queries and create simple reports such as the reports here. He does have access to our full reporting suite as a consequence of his senior position.
We have extensive security measures in place with respect to external cyber-crime. We also have very strong access controls in place with respect to internal access to core systems.
David is very conscious of data security and has played a key role in ensuring the data security systems of USGTL are to a high level.
David ensures that all of his passwords and personal access to systems are very well controlled and demands all others do the same.
No-one knows his password to his computer.
No-one knows his password to SugarCRM (the system the reports were run from. As the system administrator I can access his system instance but I would have to change the passwords). This did not happen.
To access and run these reports you would need access to David’s computer (password protected) and/or his SugarCRM instance username and password (password protected). You would then need to know how to create and run the reports.
David is aware that there are report activity logs and this is likely why he created the reports and deleted them so quickly, also he may have assumed I wouldn’t notice if they were deleted. What David is not aware of is that I run a tracker system in the background as another layer of security.
Davids SugraCRM ID is : 8136224f-5222-e7e0-a472-5b1480871d43
There are a total of four reports created, run and deleted by David:
- 22 August 2023 at 12.13pm
- 22 August 2023 at 12.16pm
- 22 August 2023 at 13.29pm
- 1 September 2023 15.57pm (The last work day before they tendered their resignation).
These reports can serve no other purpose than to be a client contact list (see below for detail).
I engaged Optimate the SugarCRM provider to roll back to the appropriate dates and extract the information as provided. This can all be independently verified.
Detail of reports run. (note: all information provided has been created by the SugarCRM supplier technical team, Optimate, based in Takapuna).
Data extracted from “Reports – deleted by user” attached
Full report output is also included for each report
- 22 August 2023 at 12.13pm
|
Query name |
User |
Created date |
Modified date |
Created by |
Deleted by |
|
NZ Clients – From Nov 2022 |
David Tzimenakis |
22/08/2023 12:13:00 pm |
22/08/2023 12:13:00 pm |
David Tzimenakis |
David Tzimenakis |
Content
- 1700 lines of transactions
- Columns of output
- First name
- Name (Full name)
- Email address
- 22 August 2023 at 12.16pm
|
Query name |
User |
Created date |
Modified date |
Created by |
Deleted by |
|
NZ Clients – From Nov 2022 |
David Tzimenakis |
22/08/2023 12:16:00 pm |
22/08/2023 12:17:00 pm |
David Tzimenakis |
David Tzimenakis |
Content
- 4151 lines of transactions
- Columns of output
- Billing country
- First name
- Name (Full name)
- Email address
- 22 August 2023 at 13.29pm
|
Query name |
User |
Created date |
Modified date |
Created by |
Deleted by |
|
NZ Clients – From Nov 2022 |
David Tzimenakis |
22/08/2023 13:29:00 pm |
22/08/2023 13:30:00 pm |
David Tzimenakis |
David Tzimenakis |
Content
- 753 lines of transactions
- Columns of output
- Billing country
- First name
- Name (Full name)
- Email address
- 1 September 2023 15.57pm (The last work day before they tendered their resignation).
|
Query name |
User |
Created date |
Modified date |
Created by |
Deleted by |
|
NZ Clients |
David Tzimenakis |
1/09/2023 15:47 |
1/09/2023 3:47:00 pm |
David Tzimenakis |
David Tzimenakis |
Content
- 1855 lines of transactions
- Columns of output
- First name
- Name (Full name)
- Email address
Copies of the actual information in the reports and multiple activity logs have been included in this submission.
The actions of David and Matthew in addition to my required actions has the potential to cause serious harm to the people on this list, to my business and me personally.
Action will need to be taken very quickly to minimize this.
I swear the above is a true and accurate account of what has occurred.
Lance William Morris
Managing Director, US Global Tax