Office of the Integrity Commissioner

2020 LORAINE AVENUE, WINDSOR, ON N8W 1P4 519-996-9272

MUNROSTRATEGY.COM

Report and Recommendations

DATE: March 15, 2017

TO: Mayor and Council, County of Brant
FROM: Melinda Munro, Integrity Commissioner
SUBJECT: Complaint 1002-17: Bartscher v. Cardy

Table of Contents
Complaint .............................................................................................................................................. 2
Request for Recusal ........................................................................................................................... 3
Standard and Burden of Proof ............................................................................................................... 3
Evidence ................................................................................................................................................ 4
Establishing the Times on the Facebook Posts ................................................................................ 5
Technical Evidence ............................................................................................................................. 5
The Physical Evidence .................................................................................................................... 5
The Hypothetical Evidence ........................................................................................................... 10
Summary of Technical Evidence ................................................................................................... 12
Behavioural Evidence ....................................................................................................................... 13
Behaviour of the Alleged Hacker .................................................................................................. 13
Behaviour of Councillor Cardy ...................................................................................................... 14
The Law of Spoliation ................................................................................................................... 17
Conclusions as to the Facts .................................................................................................................. 18
Application of the Code of Conduct to the Facts .................................................................................. 19
Are Posts to Social Media Covered by the Code of Conduct ............................................................. 20
Are the Words “Fucking Raghead” a Violation of the Code? ............................................................. 20
Did Councillor Cardy Violate Section 21.1 of the Code by Destroying Evidence? .............................. 21
Recommendations ............................................................................................................................... 22
Appendix A: Complaint 1002-17 .......................................................................................................... 24
Appendix B: Affidavit of Don Cardy, September 25, 2017 .................................................................... 34
Appendix C: Screenshots Provided by Mr. Russ Bishop ....................................................................... 39
Appendix D: Facebook Posts in Order with Times of Posting ............................................................... 50
Appendix E: Email from Michael Hobin to Robert Deutschmann Dated September 25, 2017 .............. 55
Appendix F: Screenshot of Councillor Cardy’s Facebook Device Authentication History dated September
18th, 2017 ............................................................................................................................................ 56
Appendix G: Extra Security Features Facebook Help Centre ................................................................ 57

Complaint
On September 5, 2017, Jeff Bartscher, of Paris, Ontario, filed a complaint with the Integrity
Commissioner against Councillor Don Cardy alleging that Councillor Cardy had violated sections 5.13(e),
19.4, 19.6(a) and 19.6(b) of the County of Brant Code of Conduct [the “Code”] by posting a racial slur
on his on his Facebook account, specifically Mr. Bartscher complained that:

On August 29, 2017 Councillor Cardy, in response to a video he disagreed with on Facebook,
used the term “Fucking Raghead” to describe someone from the middle east.

Councillor Cardy then claimed his Facebook account was hacked, and that someone else wrote
the message.

Unfortunately, Councillor Cardy has a history of similar social media posts, which to me, makes
his “hacking” excuse unbelievable.

The complete complaint is attached as Appendix A to this report.

As per the requirements of section 24.5 of the Code I reviewed the complaint, determined that it met
the formal requirements to be accepted as a complaint to be investigated and delivered it to Councillor
Cardy.

On September 12, 2017, the complaint was received by Councillor Cardy by Canada Post and signed
for. Councillor Cardy swore an affidavit on September 25 in response to the complaint. Councillor
Cardy’s affidavit in response is attached as Appendix B to this report.

After reviewing the complaint and the affidavit in response, I determined that there was insufficient
information based on the complaint and affidavit to determine the facts clearly enough to make a
recommendation and commenced my investigation through additional information requests and
interviews of witnesses. I received a reply from Mr. Bartscher in response to Councillor Cardy’s
affidavit, I requested additional information from Councillor Cardy in writing, and I interviewed Jeff
Bartscher, Russ Bishop, Kari Raymer Bishop, Michael Hobin and Don Cardy.

Page 2 of 58
By letter of December 12, 2017, I provided Councillor Cardy and his lawyer all of the evidence I had
reviewed in the case to that point.

Request for Recusal

Council is aware that in January, Councillor Cardy requested that Council have me recused as Integrity
Commissioner on this investigation due to an apprehension of bias. He provided Council with a lengthy
submission to which I replied. Council sought legal advice and decided to take no action. As a result, I
have remained as the Integrity Commissioner for the investigation and am providing this report to you
as required under the Code and the Municipal Act, 2001.

Standard and Burden of Proof

The standard of proof for professional discipline cases and Code of Conduct complaints in Ontario is
that of the ‘balance of probabilities’. This means that proof must be examined to determine whether it
is “more likely than not that an alleged event occurred.”1

The burden of proof refers to the responsibility of a party to prove on a balance of probabilities that an
event occurred. Typically, the burden of proof is carried by the person alleging wrongdoing, in this
case the Complainant who must establish a prima facie case that the events occurred as described in
the complaint. Once the prima facie case is established the burden is shifted to the other party to
disprove the allegations on a balance of probabilities. The burden of proof may also shift between
parties in a situation in which one party is in possession of most or all of the evidence that can prove
that an alleged event occurred.

In this complaint, Mr. Bartscher has alleged based on publicly available Facebook posts that Councillor
Cardy made comments that he believes violate the Code. Based on that information, a reasonable
person would conclude that Councillor Cardy was the author of the comments. The existence of the
Facebook posts meets the first requirement that Mr. Bartscher establish a prima facie case that
Councillor Cardy actually made the posts on a balance of probabilities. Councillor Cardy for his part has
alleged his Facebook account and / or his computer were hacked. Councillor Cardy, as the party with
exclusive access to both the Facebook account and the computer on which the posts are alleged to
have been made, is the sole party in a position to prove whether or not there was a hack. Therefore,
Councillor Cardy has the burden to establish on a balance of probabilities that his Facebook account
was hacked and the comments posted there were posted by someone other than him. If Councillor
Cardy can present sufficient evidence to establish that a hack took place on a balance of probabilities,
Mr. Bartscher would be obliged to present contradicting evidence otherwise, Councillor Cardy will have
discharged the burden of proof.

This legal issue is of critical importance in this case as will be seen as I set out the evidence presented
by Mr. Bartscher and Councillor Cardy. Councillor Cardy has mistakenly taken the position throughout
this investigation that Mr. Bartscher and I must prove that Councillor Cardy was not hacked. But this is

1
F.H. v. McDougall, 2008 SCC 53 at paragraphs 31 and 49.

Page 3 of 58
not correct in law. Councillor Cardy as the party in possession of the evidence and the party alleging
events that cannot be proved except by access to that evidence must prove that his Facebook account
was hacked, and that the hacker posted comments to that account.

Evidence
There is no dispute that at 11:31 pm on August 29, 2017 the words “Fucking Raghead” were posted to
the Facebook account belonging to Councillor Cardy. A screenshot of the posting was attached as
Exhibit A, page 1 of 3 to Mr. Bartscher’s affidavit and is included in Appendix A at pages 26-28.

Mr. Bartscher alleges that Councillor Cardy is not telling the truth when he says that he was hacked
because in November 2016, a post with similar language was also made on Councillor Cardy’s
Facebook page.

Councillor Cardy, in his affidavit of September 25, 2017 stated:

4. Mr. Bartscher cites comments that appeared on my Facebook page on August 29, 2017.
I did not create the Facebook posts attributed to me that Mr. Bartscher has noted in
Exhibit A of the Complaint.

5. I believe that the offending Facebook posts were created late in the evening of Tuesday
August 29, 2017, by someone, likely a hacker while I was asleep. I am not sure when my
account was hacked, but the post was created by an unidentified person or hacker. I
have no information with respect to the origin of this post, how it occurred or who
caused the offending messages to be posted to my Facebook account.

6. I first learned of the offending Facebook messages in the morning of August 30, 2017.
Upon learning of the offending messages, I immediately wrote on Facebook that the
offending messages of August 29, 2017, were not from me but from some identified [sic]
person and that my Facebook account was hacked. I also posted that I had been in
contact with Facebook about security issues.

7. Similarly, with respect to the Facebook post of November 9, 2016, referenced in page 1
of 4 in Exhibit C of the Complaint, I deny that I created that post. I believe that post was
the work of an unidentified hacker.

After the original comments were posted on August 29, there were several posts in response posted by
members of the community as well as by a person purporting to be Councillor Cardy between August
29 and August 31. Copies of these screenshots were provided to me by Mr. Bartscher and by Mr. Russ
Bishop, a resident of Brant County, who was one of the participants in the Facebook discussion on
August 30. Copies of the screenshots provided by Mr. Bishop are attached as Appendix C to this
report.

Page 4 of 58
The screenshots appear repetitive, but they are all necessary to establish the timeline of when posts
were made. In order to make the contents more readable, I have attached a typed version of the posts
and threads at Appendix D at page 50. The times shown in this typed version were established by
comparing the times of the screenshots to the time stamps created by Facebook. This process is
explained below. The process of establishing the times of the various posts was put to Councillor Cardy
during his interview and it is not disputed. As will be noted below, Councillor Cardy destroyed his
Facebook account and therefore the posts related to this investigation, very early in this investigation.
If I had been permitted to have access to that account it would have been very easy to prove the
timeline of the posts as it would be possible to ‘hover’ a mouse over the posts and determine exactly
when they were posted.

Establishing the Times on the Facebook Posts

Facebook creates time stamps on every post made. During the first hour from the time a post is made,
Facebook will display the time in minutes relative to the time that a person is looking at the page.
After the first hour until the end of the first 24 hours, Facebook displays the time in hours relative to
the time of the person looking at the page. After the first 24 hours, Facebook displays the text “1d” to
identify a post as made on the previous day. After 48 hours, the actual time and date of the post are
shown. The table below illustrates this effect.

Time Post Made Time Person A Looks at the Post Time Person A sees on the Post
January 1, 2018 10:00 am January 1, 2018, 10:30 am 30 minutes
January 1, 2018, 8:30 pm 10 hours
January 1, 2018, 8:45 pm 10 hours
January 2, 2018, 9:00 am 23 hours
January 2, 2018, 11:00 am 1d
March 30, 2018, 9:00 am January 1, 2018, 10:00

Technical Evidence

Because the allegations and response relate to an alleged hack of a Facebook account, the quality of
the technical evidence is critical to establishing the facts. Unfortunately, the technical evidence in this
matter is of very low quality where it exists at all. As a result, a great deal of time and some expense
has been spent trying to establish whether or how such a hack may have happened, rather than
examining physical evidence which would have been more conclusive in determining what actually did
happen. The destruction of evidence is a very serious matter and will be discussed later in this report,
suffice to say for this portion of the report, it has been very difficult to establish exactly what
happened.

The Physical Evidence

On August 29, 2017 at 11: 31 pm, the comments “Fucking Raghead” appeared on Councillor Cardy’s
Facebook page. I interviewed Mr. Jeff Bartscher, Mr. Russ Bishop and Ms. Kari Raymer Bishop in
relation to this complaint. All three stated that they were made aware of the presence of the

Page 5 of 58
comments because they were Facebook friends of Councillor Cardy and saw the comments appear in
their ‘newsfeeds’.

As set out in the typed version of the Facebook posts and thread at Appendix D, on August 30 at
approximately 10:30 am, Mieke Schroeder responded to the original post. Throughout the morning
and early afternoon of August 31, Ms. Schroeder and someone posting as Councillor Cardy exchanged
comments. That exchange ended at approximately 12:39 pm on August 30.

Councillor Cardy says that he was at the Brantford Air Show most of the day on August 30 and
therefore unable to post on Facebook. However, he has admitted through a letter from his lawyer on
October 25, 2017 and during his interview with me, that he would sometimes post to Facebook from
his Samsung Galaxy S7 Smartphone. We can see in Appendix F, a screenshot of the device
authentication history of Councillor Cardy’s Facebook account, that a Samsung Galaxy S7 smartphone
was active on his Facebook account in September 2017. Councillor Cardy argues that the posts on
August 30 are unreasonably long for someone to post from a smartphone. There were two posts from
Don Cardy’s Facebook account during the day on August 30. They are each less than 200 words or 800
characters (which includes punctuation and spaces). They are not long or complex posts.

Later that day, at approximately 9:30 pm on August 30, Mr. Russ Bishop joined the conversation. In his
evidence to me, Mr. Bishop stated that he did so because he was concerned about the content of the
posts and that Councillor Cardy was a member of his church. Someone posting as Councillor Cardy
exchanged comments with Mr. Bishop until approximately 12:31 am on August 31.

Councillor Cardy says that he was at home and not using his computer in the evening of August 30 and
could not have made these posts.

On August 31, at approximately 1:25 pm, Councillor Cardy posted on his Facebook page as follows:

To my FB friends at approx. 11 pm on Tuesday night of this week I was in a private conversation

with a person I did not know in the Middle East. After our brief conversation I went to bed.
Today I check my FB account to find a chain of messages that were not from me and my account
had been hacked. Since seeing this I have made inquiries to FB who have told me to re set my
account and they would monitor.

I assure you and those who know me that I am not the creator of the comments. It is not of my
nature to make comments of this kind. I have just learned that nothing is safe and secure.

Councillor Cardy cannot produce correspondence with Facebook or screenshots of the actions he took
with respect to his Facebook account on August 31.

Over the next hour after that post there were a number of replies to Councillor Cardy some of which
challenged his assertion of having been hacked, including from Mr. Bartscher and Ms. Bishop. At least
one poster suggested that Councillor Cardy have a full virus scan on his computer.

Page 6 of 58
As noted above, Councillor Cardy received the within complaint on September 12, 2017 after which
point he retained legal counsel.

I examined Councillor Cardy under oath on February 22, 2018. Councillor Cardy testified that between
August 31 and September 12, 2017 he did not take his computer to a technician to have the hack
confirmed nor did he take any action taken to cleanse his computer of the source of the hacking.

After September 12, Councillor Cardy contacted Michael Hobin, an employee of the County of Brant to
help him with his computer. Mr. Hobin wrote an email to Councillor Cardy’s legal counsel, Mr.
Deutschmann, a copy of which is attached as Appendix E to this report at page 55.

Mr. Hobin wrote that he believed that Councillor Cardy’s computer had been compromised over
several months. He found “remote control software” and explained a method by which it is possible
that the software had been installed on Councillor Cardy’s computer. He also explained how “remote
control software” could have been used to compromise Councillor Cardy’s Facebook account. Mr.
Hobin did not provide any screenshots or other physical evidence showing the presence of the “remote
control software” or any evidence of specific activity which had been engaged in using that software.

I interviewed Mr. Hobin on December 8, 2017. I asked Mr. Hobin whether or not he had examined the
Facebook account and the posts in question and he told me that his sole interest was in ensuring that
no County data had been breached as a result of the presence of the “remote control software”. I
specifically asked if he had reviewed the Facebook posts and he said he had not. I asked Mr. Hobin
whether he could say that the “remote control software” was responsible for the posts to Facebook.
He specifically said that based on what he saw there is no way to say that the software installed had
anything to do with the Facebook comments.

I asked Mr. Hobin how the “remote control software” would work. He told me that this kind of
software would be installed on a computer and a person at a remote location could operate the
computer as if they were the owner including accessing data, websites, bank accounts and social
media. In the third paragraph of his email, Mr. Hobin stated that this would happen after hours. When
I asked Mr. Hobin to clarify, he said that the kind of software on Councillor Cardy’s computer would
have been very easy to detect during ordinary usage hours because it would be opening and closing
windows and competing for use of the keyboard and mouse. Someone sitting in front of this computer
would have seen this software at work in plain sight. This is important because most of the disputed
posts to Councillor Cardy’s Facebook account happened between 9 am and midnight on August 30.
Any person using that computer during those times would have seen the alleged hacker at work.

Mr. Hobin further stated in his email to Mr. Deutschmann that there was one Facebook authentication
detected from a device that did not belong to Mr. Cardy. In a written request for follow up
information, I asked Mr. Hobin how he knew that the device that was authenticated did not belong to
Mr. Cardy. The question and answer are set out below:

Page 7 of 58
 In Michael Hobin’s review, he indicated that there was a single Facebook authentication from a
device that did not belong to Councillor Cardy. Please provide the date and time of that
authentication and any other information to confirm the ownership of the device in question.
I believe the questionable access was on Tuesday September 12 in the evening from
Orillia. Councillor Cardy indicated that he had not been there, and all the logs of access were
deleted prior to that entry. Councillor Cardy indicated he changed the password at that time.

I asked Mr. Hobin if this was evidence that the “remote control software” had accessed Facebook. He
confirmed that it was not. If the “remote control software” had been used to hack the Facebook page
it would show up in the device authentication history as Councillor Cardy’s own computer. This is
important because the device authentication and the “remote control software” are unrelated to each
other. The issue of device authentication does not support that the “remote control software” was
used to hack the computer and vice versa. Mr. Hobin’s evidence here is suggesting two separate and
unrelated types of hacking. Further, as will be discussed below, the geo-location of device
authentication on Facebook is of limited value in establishing a hack on its own.

Mr. Hobin told me in his interview that he had seen screenshots of the “remote control software” login
and some screenshots of “auto logins” to Facebook and a bank. He did not keep copies of these
screenshots. Given the significance and seriousness of the alleged hack and the Code of Conduct
complaint, I find it very surprising that Mr. Hobin would not keep records of his forensic analysis if it
had uncovered anything that conclusively supported Councillor Cardy’s claim that his Facebook
account was hacked. I requested that Councillor Cardy produce copies of these documents and he
produced a single page which appears to be a screenshot of the Facebook device authentication
history from September 18th. When Councillor Cardy’s lawyer produced it, he advised me that
“Councillor Cardy and myself have no idea how to interpret that information.”2 That screenshot is
attached as Appendix F (page 56) to this report and will be discussed in detail later in this report. I
believe that this is the device authentication which Mr. Hobin was referring to in his email and his
evidence above. Councillor Cardy testified that there were other screenshots, but his printer jammed
up and he couldn’t print them before he had to go to a meeting. I asked him whether the screenshots
had been saved on his computer and he said he didn’t know.

I wrote to Councillor Cardy’s lawyer in October and requested that he produce all evidence that they
had of the presence of a hacker on the computer and information about any experts that had looked at
the computer to determine whether there was a hacker. Councillor Cardy’s lawyer wrote back as
follows:

Mr. Cardy did not seek the assistance of any other technical support provider. He has not
received the assistance of any other technical support provider. Mr. Cardy received the
assistance of Mr. Hobin only and no other technical support.

2
Comment by Robert Deutschmann during interview with Councillor Cardy on February 22.

Page 8 of 58
When I questioned Councillor Cardy on February 22, he advised, contrary to the assertion above, that
two other computer technicians had looked at his computer after September 12; IBC Computers and
Mr. Andy Bell. I contacted IBC Computers by phone and email and requested that they speak to me in
relation to this complaint. They have not responded to my requests. I have not issued a Summons to
IBC Computers as it is Councillor Cardy’s responsibility to produce evidence which supports his claim.
Councillor Cardy advised that IBC recommended that he ask Mr. Andy Bell, an independent computer
business owner to help him. Mr. Bell is a friend of Councillor Cardy. I spoke to Mr. Bell on February 26,
2018. Mr. Bell confirmed that there was some kind of “remote control software” on the computer and
said he believed it may have been from China. He provided a number of different speculations about
what may have happened from whether it was Teamviewer (a brand of remote control software), a
social engineering attack or a script. He was not able to provide any certainty as to what actually
happened and like Mr. Hobin, did not have any records of a forensic examination of the computer
showing the steps he took and what he saw that he interpreted as evidence of a hacker actually
posting the comments to Facebook. Mr. Bell did confirm that if “remote control software” had been
used to perpetrate the hack, a person using the computer at the same time would have seen the
software in action unless there was a special ‘script’ written to hide it.

Between September 12 and October 2, 2017, Councillor Cardy deleted his Facebook account and
destroyed his computer. In his interview with me, Councillor Cardy stated that after September 12, his
computer began to behave strangely and became unusable. When Michael Hobin examined the
computer on September 18 it was still usable, and he told me that nothing he had done to the
computer that day should have caused the computer to become unusable. Nevertheless, Councillor
Cardy believed his computer had become unusable and on or before September 25, prior to swearing
his affidavit in response to this complaint, he asked Mr. Bell to remove his personal and business
information from the computer and then asked Mr. Bell to physically destroy the hard drive. Mr. Bell,
in his conversation with me, confirmed that it was Councillor Cardy who asked that the hard drive be
destroyed. Mr. Bell explained that he had used special software to remove the business information
from the computer before he destroyed it which means it was still capable of being accessed and
analyzed as of that date.

In a letter to Councillor Cardy’s lawyer of October 4, 2017, I wrote to inquire about the steps Councillor
Cardy took with respect to his Facebook account after he detected the alleged hack. Councillor Cardy’s
lawyer wrote as follows: “ Mr. Cardy followed the steps provided on the Facebook website to
deactivate his information on Facebook. The step by step process is provided on the settings screen
within Facebook”. At first blush, this suggests that Councillor Cardy deactivated his account
immediately. However, based on the evidence of Michael Hobin and the Screenshot at Appendix F, it
appears that the Facebook account was active as of at least September 18, 2017.

Councillor Cardy wrote an email to me dated October 2, 2017 in which he described his shock at the
number of hacks on Facebook. “So much so that I have removed myself altogether from it.”

As a consequence, as of September 25, 2017, when Mr. Cardy first formally responded to me as
Integrity Commissioner, in relation to this complaint, all physical evidence, namely the computer and
its contents, which might have established with clarity whether or not hack had occurred, had been

Page 9 of 58
permanently destroyed. In the same time frame and before October 2, 2017, Councillor Cardy
destroyed his Facebook account. Together the result of these two actions is that after the complaint
had been served but before any investigation could commence, Councillor Cardy destroyed all
evidence that could be used to establish the facts in this complaint.

The above actions by Councillor Cardy are sufficient to find against him in this complaint as he
rendered himself unable to discharge the burden of proving on a balance of probabilities that there
was a hack to his computer which caused offending posts to be made to his Facebook account.
However, as Integrity Commissioner, I believed it was necessary to investigate the various hacking
methods which Councillor Cardy had speculated about to determine whether they could assist in
supporting his claim to have been hacked. To that end, I retained Mr. Doug Sartori of Parallel 42
Systems Inc.

The Hypothetical Evidence

Mr. Sartori has worked in information technology for 17 years and is a certified expert in application
development, database administration and business intelligence. He has worked in network security
and built and deployed intrusion-detection applications. He has also provided ‘penetration testing’ to
companies including “white-hat hacking”.

I asked Mr. Sartori whether “remote control software” could be used to perpetrate the kind of hack
alleged by Councillor Cardy. He agreed that it could but it would be an unlikely method of doing so due
to the ease of this type of hack being detected.

Q: In your experience is the use of Remote Control Software on its own a common way breach
social media security? Please explain.

A: I would not say so for off-the-shelf remote control software, mainly because it would be
resistant to automation and thus inefficient. Custom software for accessing social media accounts
on an exploited system would be more likely but then it is getting into the category of more generic
malware than remote control software.

As there is no evidence of the type of “remote control software” which was present on Councillor
Cardy’s computer due to the failure to keep records of the computer scans and the destruction of the
computer it is impossible to follow up on Mr. Sartori’s response to my question as to the possibility of
customization of the “remote control software”.

I also asked Mr. Sartori to comment on the screenshot at Appendix D showing the device
authentication history of Councillor Cardy’s Facebook account. The device authentication history is
one way that Facebook provides security to users. By logging into the settings of a Facebook account,
the user can see whether there were devices logged in that did not belong to the user. Appendix F
shows two logins from a Windows PC in Brantford and two logins from a Samsung Galaxy S7 phone.
One of the phone logins is from Brantford (6 hours prior to the time the screenshot was taken on

Page 10 of 58
September 18th) and one is from East Gwillimbury on September 12th. Above the login from East
Gwilliumbury is a black box containing an IP address.

There are three issues to consider in reading this document. First, does the geo-location of the login
from East Gwillumbury prove that Councillor Cardy’s Facebook account had been hacked between
September 12 and September 18? Second, does the IP address prove the Councillor Cardy’s Facebook
account had been hacked between September 12 and September 18? Third, does this evidence prove
that Councillor Cardy’s Facebook account was hacked on August 29 and 30?

Does the geo-location of the login from East Gwillumbury prove that Councillor Cardy’s Facebook
account had been hacked between September 12 and September 18? On Facebook’s Help Centre
there is an explanation of how to determine login locations. Facebook itself explains the lack of
accuracy in IP address and location in its own materials. Attached as Appendix G is a print out of the
information at the Facebook Help Center. Facebook advises users that “Often, when signing in
through a mobile device, you’re routed through an IP address that doesn’t actually reflect your actual
current location.” Facebook provides three explanations for why a user may not identify a location,
the first of which is “We have inaccurate information: Sometimes we can only provide an approximate
location that may appear inaccurate compared to your actual current location.” Facebook does also
indicate that the inaccuracy could also be due to the possibility that someone else has logged into the
account. Therefore, the fact that a Samsung Galaxy S7 is showing as logged in in East Gwillumbury
does not prove that the account was hacked on September 12, it simply raises this as a possibility and
not the first most likely possibility according to Facebook.

Does the IP address prove the Councillor Cardy’s Facebook account had been hacked between
September 12 and September 18? Councillor Cardy confirmed that he was using a Samsung Galaxy S7
phone in the relevant time period for this complaint and provided me with the IP address of the phone
as 2605:8d80:623:Fdaf:7705:cf40:od3:ca90. It appears that the IP address of the phone and the device
using Facebook are different. However, the IP address which appears on the Facebook device
authentication history is not necessarily the same IP address for the same device every time that
device is logged in. According to Mr. Sartori, IP addresses are assigned to devices dynamically meaning
that most phones will not have the same IP address all the time or even for a very long period of time.
IP addresses are assigned to internet service providers (ISPs) in blocks and will be assigned to devices
when they are needed to connect to the internet. IP addresses are also assigned to devices like Wi-Fi
routers and servers. If a smart phone connects to the internet through a Wi-Fi router or a network
server, it will have a different IP address in the Facebook device authentication history. Facebook itself
notes this in the explanation at Appendix G, when it stated “Often, when signing in through a mobile
device, you’re routed through an IP address that doesn’t actually reflect your actual current location.”
The IP address used for geo-location may be a router through which the device is being routed and not
the device itself.

Therefore, while the different location and IP address on Councillor Cardy’s Facebook device
authentication history might possibly be evidence that someone other than he was logged into his
account on September 12, without more they are not proof on a balance of probabilities that
Councillor Cardy’s Facebook account was systematically breached over a 24-hour period between

Page 11 of 58
August 29 and August 31, 2017. Unfortunately, any ability to do a forensic analysis on the computer or
the Facebook account is no longer possible due to Councillor Cardy’s decision to destroy both.

Councillor Cardy has provided me with two articles from the internet on the prevalence of Facebook
hacking. One is an article from the NY Daily News from October 29, 2011 which says that Facebook
hacks occur 600,000 times each day. The other is a blog post from a company called Zerofox which
provides internet security. The blog refers to a ‘white paper’ produced by Zerofox called “Hacking a
Corporate Social Media Page”. I downloaded the report by Zerofox and reviewed it as part of this
investigation. Neither of these two articles is evidence that Councillor Cardy was hacked. However,
they are an effort by Councillor Cardy to suggest that Facebook hacking may be sufficiently prevalent
to argue, even without physical evidence, that such a hack happened on a balance of probabilities.

Both the NY Daily News article and the Zerofox white paper cite the statistic that Facebook is
compromised 600,000 times a day, though neither confirm how many of those compromises result is a
series of hacked posts being made over a 24-hour period, as were done in this case. Though the
number 600,000 is large, there were, in the fall of 2017, 2.2 billion active Facebook accounts. This
attack rate represents only 1 in 5,000 chances of any individual Facebook account being hacked on a
particular day. Therefore, this speculation does not meet the standard of a balance of probabilities
that Councillor Cardy was hacked. Rather, on its own, it is evidence of how unlikely it was that he was
hacked.

Summary of Technical Evidence

As noted at the beginning of this section, there is little to no technical evidence available for forensic
examination due to Councillor Cardy’s decision to destroy it. What can be established is as follows:

a) Councillor Cardy’s computer had some unidentified “remote control software” present on it in
the fall of 2017. According to the two experts who say they saw this software, someone using
this software would have been apparent to anyone using the computer at the same time.
b) Councillor Cardy’s Facebook account posted the words “Fucking Raghead” on August 29 at
11:31 pm.
c) A number of posts are made to Councillor Cardy’s Facebook account between August 29 and
August 31, many of which were posted by Councillor Cardy’s account during daylight and
evening hours.
d) Councillor Cardy was served with this complaint on September 12, 2017.
e) Between September 12 and September 25, 2017, Councillor Cardy physically destroyed his
computer and any evidence of the presence of a hacker.
f) Between September 12 and October 2, 2017, Councillor Cardy physically destroyed the
Facebook account in question.
g) A Samsung Galaxy 7 phone, the same type of phone used by Councillor Cardy, accessed
Councillor Cardy’s Facebook account between September 12 and September 18 but it is not
possible to determine whether that phone belonged to Councillor Cardy or someone else.
h) Based on information provided by Councillor Cardy, there is only a 1 in 5,000 chance that any
individual Facebook account will be hacked on any particular day.

Page 12 of 58
Behavioural Evidence

Given the paucity of physical and digital evidence in this case, I am left to consider the behavioural
evidence to see if it can be established on a balance of probabilities that the posts to the Facebook
account were made by a hacker or by Councillor Cardy. Most of the evidence produced by Councillor
Cardy is related to his behaviour and I was asked to accept based on his behaviour that he would not or
could not have made these posts.

Behaviour of the Alleged Hacker

The behaviour of the alleged hacker and the nature of the alleged hack may provide some insight into
what actually happened.

Councillor Cardy alleges that the Facebook post of November 2016 (Appendix A, page 30) and all of the
Facebook posts of August 29 and 30 referred to in this complaint were the result of being hacked.
However, he cannot point to any hacking behaviour between November 2016 and August 2017. He
stated in his interview with me that he did not know that the post of November 2016 had been made
until this complaint was made in September 2017. It seems unusual that a hacker who was
determined to interfere with Councillor Cardy’s Facebook account would post something in 2016 and
then stand dormant for almost a year. However, it is possible that there were other hacked posts of
which Councillor Cardy was unaware.

The alleged hacker then posted the comments which are complained of at on August 29 at 11:31 pm.
After Mieke Schroeder commented on August 30 between 10:31 and 11:31 am, the alleged hacker
posted several times throughout the day and into the night. As noted in the Technical Evidence section
of this report, had the hacker done this using the “remote control software” it would have been
obvious to anyone sitting at the computer. Councillor Cardy says that he was not at his computer that
day, but at the Brantford Air Show. I have no reason to doubt that, but the alleged hacker, working
from a remote site would not have any reason to believe that Councillor Cardy’s business computer
was unattended during the day on a weekday. Perpetrating a hack in this way is very risky.

The alleged hacker then continued to post until the late evening on August 30. These are also hours
during which it is reasonable to expect someone to be at work on the computer and also, therefore, a
very risky time to perpetrate this attack using “remote control software”.

The hack would also have been apparent to anyone looking at Councillor Cardy’s Facebook account
from an alternative source like his smartphone. Perpetrating a Facebook attack repeatedly over
several hours further increases the risk of detection.

The alleged hacker posted comments in a style similar to comments that Councillor Cardy admits were
made by him on August 31. The alleged hacker at one point apologized to Russ Bishop for offending
him (Appendix A, page 28). When I interviewed Mr. Bishop on December 8, 2017, I asked him whether

Page 13 of 58
he had considered the possibility that he was corresponding with an imposter during the exchange on
August 30. He said that he always believed that the person with whom he was corresponding was
Councillor Cardy.

Had the posts to Facebook all been in the middle of the night or the wee hours of the morning, it
would be easier to believe that they were the work of a hacker. Posting repeatedly during the day and
evening using tools that are easy to detect is either the work of an unsophisticated hacker or a person
who wanted to be found out. Since the alleged hacker had to be sufficiently skilled to know how to get
Councillor Cardy to unwittingly install the “remote control software”, to use the software once
installed, and post in Councillor Cardy’s style, it is unreasonable to assume that they were so sloppy or
unskilled as to perpetuate the hack in a way that could be so easily detected.

Behaviour of Councillor Cardy

The hack alleged by Councillor Cardy is a very serious one. According to him an unknown person
gained access to his business computer and installed “remote control software” giving them
unimpeded access to his business information, his financial information and bank accounts, his
personal email and his social media accounts. This unknown person then posted comments to
Facebook which paint Councillor Cardy in a very poor light and undermine his reputation as a public
official. He also speculates that the same hacker or another one was accessing his Facebook account
using other devices.

Councillor Cardy’s response to this alleged hack is therefore somewhat curious.

First, Councillor Cardy did not seem to have a firm grasp of the details of what he knew and when he
knew it about the nature of the hack. According to Councillor Cardy’s affidavit, sworn on September
25, 2017 he said:

6. I first learned about the offending Facebook messages in the morning of August 30, 2017. Upon
learning about the offending messages I immediately wrote on Facebook that the offending
messages of August 29, 2017, were not from me but from some identified [sic] person and that
my Facebook account was hacked. I also posted that I had been in contact with Facebook about
security issues.

On February 22, 2018, Councillor Cardy’s lawyer confirmed that the date of August 30, 2017 in the
affidavit was incorrect and should have been August 31, 2017. Councillor Cardy’s lawyer confirmed on
the record that they only became aware that the date in the affidavit was wrong after meeting with me
and reviewing the evidence in the case.

In his interview with me, Councillor Cardy also confirmed that he didn’t post his comments to
Facebook in the morning but in the afternoon, which is also different from his affidavit. While it is true
that sometimes affidavits are incorrect due to inadvertence, Councillor Cardy swore that the contents
of the affidavit were true only a few weeks after the alleged hack. Therefore, it appears that he was
somewhat indifferent to the date upon which he discovered a very serious hack to his computer and

Page 14 of 58
his Facebook account as he did not take the time to ensure that the affidavit he swore was correct at
the time.

Second, after Councillor Cardy posted to his Facebook account on August 31 that he believed he had
been hacked, in the subsequent exchange between himself and various other people, he lied twice
about the nature of the hack. Referring to Appendix C, pages 46 and 47, Councillor Cardy posted the
following comments in reply to Kari Raymer Bishop and Jeff Bartscher:

Don Cardy: Sorry you feel this way Kari, but it wasn’t me and my IT department has found it to
be from a sight [sic] in Europe. So please be careful what is said.

Don Cardy: My IT guy I just spoke to and he did it remotely. 6 viruses.

In his interview with me on February 22, 2018, Councillor Cardy admitted that these statements were
not true.

Q 124: So, you posted that your IT department found it to be from a site in Europe. Is that true?
A: No.
Q 125: So, why did you say it?
A: To put Mrs. Bishop off because we have history.
Q 126: I see. But, that statement’s not correct. You didn’t have a site, an IT department look at
it as of August the 31?
A: No.
Mr. Deutschmann: Because as he said, they have history and Ms. Bishop does not care for Mr.
Cardy.
…

Q 128: So, on Page 7, we have the same conversation. And, if we turn to page 8, we see again
the same conversation starting sort of two thirds of the way down, “Sorry, Don” by Ms. Bishop.
And, we continue to turn the page over, and on page 9, there’s posts by Mr. Bartscher, who is
the complainant in this matter, and then another comment that’s, appears to be from Don
Cardy that says, “My IT guy, I just spoke to and he did it remotely, six viruses.” Do you
remember posting that on August 31?
A: Yes
Q 129: And is that true, that your IT guy told you that something had been done remotely to fix
[sic] viruses?
A: I had talked to Andy Bell, who is a computer guy, and he say that they weren’t viruses,
they were six …
Mr. Deutschmann: When did you have that conversation with Mr. Bell? Because remember –
what’s the date of this entry?
Ms. Munro: The date of that is also August 31.
Mr. Deutschmann: It’s August 31.

Page 15 of 58
 Mr. Cardy: No, I didn’t say, talk to Mr. Bell then. No, I, I had put that in there the same way I
wanted to, what I had said to Carrie [sic] earlier just to get rid of this thing and make it go away,
because I have other things to do besides talk to people about something I didn’t do.
Ms. Munro: All right.
Q 130: So, that statement there, then is not correct? It wasn’t an IT guy who had looked at it on
August 31?
A: That’s correct.

Councillor Cardy admits that he lied when he posted that he had details about the hack on August 31
and says that he did so because he wanted Ms. Bishop to ‘go away’ and stop questioning him about it.
Given the very serious nature of what he is alleging happened, a reasonable person would have replied
that he was in the process of finding out what had happened rather than make two different and
untrue statements.

Third, despite the very serious nature of what is alleged to have happened, Councillor Cardy did not
take his computer to be examined by an expert until after I delivered this complaint to him on
September 12. That is, almost two weeks went by during which the alleged hacker could have
continued to have access to his business and personal information, yet he did not see fit to obtain any
assistance to deal with the issue. The following is taken from the transcript of my interview with
Councillor Cardy on February 22, 2018

Q 148: Between August the 29, or the 31, rather, when you say you found the Facebook posts
were there, and September 18th when Mr. Hobin looked at the computer, did you take it to any
other expert for a security review or a scan to help you understand how the hack took place?
A: No.
Q 149: And that includes Mr. Bell and it includes IBC Computers?
A: Yes
Q 150: Did you ask Mr. Hobin or Mr. Bell or IBC Computers to keep any records of the work that
they did to illustrate how the hack took place?
A: No.

Had no complaint been filed, it is reasonable to assume that Councillor Cardy may never have taken his
computer in to be examined to understand what had happened and how he had been allegedly
hacked.

I also asked Councillor Cardy whether he had taken any steps to find out whether there were other
hacked comments on his Facebook account between November 2016 and August 2017.

Q 65: So, after you discovered this alleged hack in August 2017, did you go back through your
Facebook conversations to find out if there had been other instances like that?
A: No.

Finally, between September 12, when he was served, and September 25, when he submitted his first
response to this complaint, Councillor Cardy permanently destroyed the only physical evidence of the

Page 16 of 58
presence of a hack to his computer. At the same time or very shortly afterwards, he destroyed the
Facebook account which had been allegedly hacked and which contained the only digital evidence of
the presence of a hacker, both acts which rendered it impossible for me, as Integrity Commissioner to
find out what had actually happened.

At his interview, Councillor Cardy presented me with two letters from people he described as character
witnesses. I reviewed these letters. Neither of these two people commented on the specific details of
the Facebook posts or the hack and neither appears to be a technical expert in computer security.
They were proffered to me as evidence that Councillor Cardy is not the sort of person who says things
like “Fucking raghead” on Facebook. I have no doubt that Councillor Cardy believes himself to be a
good person and that he has friends who also support him. However, these letters do not provide me
with any evidence that establishes the facts of what happened on August 29 and 30.

Taken together, the actions taken by Councillor Cardy do not demonstrate the behaviour of a person
who truly believes that his personal and business information as well as his political reputation are at
serious risk of being harmed by a hacker. Rather this is the behaviour of a person who, perhaps in a
moment of anger or frustration, posted inappropriate language to Facebook, was unable to defend his
actions to members of his community and Facebook friends and so manufactured a ‘hacker’ to try to,
in his own words, make it “go away.” If he truly believed that he had been hacked, he would have
immediately had his computer examined by experts and provided me with forensic evidence
establishing, on a balance of probabilities, at the least, that the Facebook account had been hacked.

The Law of Spoliation

The above analysis is sufficient, in my view, to establish, on a balance of probabilities, that Councillor
Cardy, himself, posted the original comment “Fucking Raghead” to his Facebook account, along with all
of the other subsequent comments. However, in case there remains any ambiguity, there is also an
evidentiary principle in law called ‘spoliation’. Spoliation occurs when “a party has intentionally
destroyed evidence relevant to ongoing or contemplated litigation in circumstances where a
reasonable inference can be drawn that the evidence was destroyed to affect the litigation.”3 If
spoliation is present, then it is appropriate to draw an inference that the evidence that was destroyed
was unfavourable to the person who destroyed it. In other words, if the elements of spoliation are
present in this case with respect to Councillor Cardy, it is reasonable to infer that the Facebook account
and the computer would not have shown evidence that the comments on August 29 and 30 were the
work of a hacker. According to Nova Growth Corp. et al. v. Andrzej Roman Kepinski et. al., the elements
of spoliation which must be present, on a balance of probabilities, in order to make that inference are:

1. the missing evidence must be relevant;

2. the missing evidence must have been destroyed intentionally;
3. at the time of destruction, litigation must have been ongoing or contemplated; and
4. it must be reasonable to infer that the evidence was destroyed in order to affect the outcome
of the litigation.

3
Nova Growth Corp. et al. v. Andrzej Roman Kepinski et al. 2014 ONSC 2763

Page 17 of 58
In the Nova Growth case, data stored on a computer was highly relevant to the case. The party with
possession of the computer saved the data he believed to be relevant and took the computer to a
computer company who removed the information on the hard drive and then reformatted it. This
resulted in some data being lost. The court examined the facts and found that the parties had done
their best to preserve the data and had made everything that they had available to the other side. The
judge found that the actions of the parties did not show on a balance of probabilities that there had
been an attempt to destroy information relevant to the litigation.

In this matter, I believe that all four elements of spoliation are present.

1. The Facebook account and Councillor Cardy’s computer are highly relevant, in fact central to
the issue of whether there was a hack. They are also the only evidence that could be used to
demonstrate whether there was a hack.
2. The evidence was destroyed intentionally, not accidentally. Councillor Cardy destroyed his
Facebook account and he asked that the hard drive on his computer be permanently destroyed.
Even if, as he says, the computer was ‘unusable’, that does not make it impossible for a forensic
examination to be conducted. However, by the date that Councillor Cardy swore his affidavit in
response to this claim, the computer had been physically rendered into a condition that
prevented forensic examination.
3. The destruction of the evidence happened after Councillor Cardy was served with this
complaint. According to his own evidence, he did not undertake any expert or forensic
examination of the hack until after the complaint began. Councillor Cardy was in the process of
retaining or had already retained a lawyer at the time that he took these actions. There is no
doubt that his decision was taken with the investigation in mind.
4. It is reasonable to infer that the evidence was destroyed to affect the outcome of this
investigation. If Councillor Cardy truly believed he had been hacked, the evidence of the
Facebook account and the computer would have been proffered to support his case. However,
contrary to the behaviour of a reasonable person, they were destroyed instead.

Given the above, I believe it is appropriate to make the evidentiary inference that Councillor Cardy
destroyed the Facebook account and the computer because they would not support his allegation that
he was hacked, and that the hacker had posted the offending comments.

Conclusions as to the Facts

On the basis of the review of the Technical Evidence, limited as it is, and the Behavioural Evidence, I
find that Councillor Cardy failed to discharge the burden of proving on a balance of probabilities that
he did not post the words “Fucking Raghead” to his Facebook account. Therefore, I conclude that he
did, in fact, post the words “Fucking Raghead” to his Facebook account on August 29, 2017.

I also find that Councillor Cardy intentionally destroyed evidence relevant to this complaint.

Page 18 of 58
Application of the Code of Conduct to the Facts
Having found that Councillor Cardy did commit the act complained of in the complaint, I must consider
whether it is a violation of the Code of Conduct.

The sections which are relevant and identified in the complaint are set out here:

5.13 Members of Council:

e) Must seek to advance the public interest with honesty, and treat members of the public
and staff with dignity, understanding and respect;

19.4 In accordance with the Ontario Human Rights Code, as amended, members shall not discriminate
against anyone on the basis of their race, ancestry, place of origin, colour, ethnic origin,
citizenship, creed, sex, sexual orientation, age, record of offences, marital status, family status, or
disability.

19.6 Without limiting the generality of the foregoing, members shall not:

a) Speak in a manner that is discriminatory to any individual, based on that person’s race,
ancestry, place of origin, creed, gender, sexual orientation, age, colour, marital status, or
disability.

b) Make indecent, abusive, insulting or inappropriate comments or gestures to or about an

individual where such conduct is known or ought reasonably to be known to be offensive
to the person(s) to whom they are directed or are about;

It is also important to consider whether the destruction of evidence is also a breach of the Code. The
relevant section is set out below (emphasis added):

Section 21: Reprisals and Obstruction

21.1 Members of Council shall respect the integrity of the Code of Conduct, and inquiries and
investigations conducted under it and shall co-operate in every way possible in securing
compliance with its application and enforcement. Any reprisal or threat of reprisal against a
complainant or anyone for providing relevant information to the Integrity Commissioner is
therefore prohibited. It is also a violation of the Code of Conduct to obstruct the Integrity
Commissioner in applying or furthering the objectives or requirements of this Code or in the
carrying out of his or her responsibilities (as, for example, providing inaccurate or misleading
information to the Integrity Commissioner, refusing to answer inquiries or by the destruction of
(records) documents or the erasing of electronic communications).

In his submission requesting that I be recused of this investigation, Councillor Cardy’s lawyer made a
spirited argument that the posting words “Fucking Raghead” to Facebook was not a violation of the
Code.

Page 19 of 58
Are Posts to Social Media Covered by the Code of Conduct

First, Councillor Cardy argues that the Facebook post was not made while he was conducting the
ordinary business of the County and that the Code should not apply to non-official duties.

The Code opens with a statement of principles which includes this statement (emphasis added):

A written Code of Conduct helps to ensure that the members of Council, Local Boards and
Advisory Committees share a common basis of acceptable conduct. These standards are
designed to supplement the legislative parameters within which the members must operate.
These standards are intended to enhance the public’s confidence that the County of Brant’s
elected and appointed officials operate from a basis of integrity, justice and courtesy.

The Code is a mechanism by which Council has sought to bind its members to behave in a way which
promotes public confidence. While it refers to ‘official duties’, it cannot be the case that the Council
intended that its members would be free to behave in an outrageous manner outside the Council
chambers such as to undermine public confidence in the office. There is limited case law from other
Integrity Commissioners to turn to, but the law of employment has long established that ‘off-duty’
conduct can be cause for discipline and dismissal where it is done in such a way as to damage the
reputation or work environment of the employer. I submit that this case law is applicable to the
current set of facts.

It is well-established that inappropriate Facebook postings can result in discipline or discharge,

depending upon the severity of the postings. The nature and frequency of the comments must
be carefully considered to determine how insolent, insulting, insubordinate and/or damaging
they were to the individual(s) or the company. In some cases, the issue is whether the
comments were so damaging or have so poisoned the workplace that it would no longer be
possible for the employee to work harmoniously and productively with the other employees or
for the company.4

I venture to suggest that had an employee of the County of Brant made the comments that Councillor
Cardy made, the administration and Council would consider them very serious. It is not reasonable to
suggest that a Councillor can post inappropriate language to Facebook due to a very narrow reading of
the term ‘official duties’. It can reasonably be suggested that once elected as a public official, all public
activities are ‘official duties’ for the purpose of behaving in a manner consistent with the Code.

Are the Words “Fucking Raghead” a Violation of the Code?

Having found that the Code applies to the use of social media, I must consider whether the words in
question were themselves a violation of the Code.

4
Bell Technical Solutions v. Communications, Energy and Paperworkers Union of Canada, 2012 CanLII 51468 (ON LA) at
paragraph 112.

Page 20 of 58
Councillor Cardy, in his Facebook post of August 31, attempted to distance himself from the
comments, suggesting that he found them distasteful. In his affidavit of September 25, 2017, he
several times refers to the comments as ‘offending’.

Certainly, the use of a profanity in public discourse stands on its own as offensive. Coupled with the
use of a well know racial slur, no argument can be made that the Facebook post was not offensive.

Councillor Cardy has argued, through his lawyer that if no specific member of the public or staff were
targeted and if no specific member of the public or staff was offended then the comments are not a
violation of the Code. As the comments were made in a public forum, they can be considered directed
to the public in general. That, itself, is sufficient to make them a violation of the Code. However, the
Code has several provisions that speak to the general nature of Council behaviour rather than require
narrow particularization of the person being addressed. Section 5.13, identified by the Complainant as
a section which he believes was violated requires Council members to treat the public with dignity,
understanding and respect. Certainly, a member of the Islamic faith or anyone who believes in the
respectful treatment of others will find the term “Fucking Raghead” used by a County Councillor to be
highly disrespectful and could be concerned that they would be subject to unfair regard by Brant
County Council. Further, the words plainly violate the requirement in section 19.6 (a) to not speak in a
manner which is discriminatory to a person’s race or creed and they plainly violate 19.6 (b) by being
indecent and abusive. It would undermine the effectiveness of the Code if a Councillor could make
racial slurs without consequence as long as he or she was careful not to address them to any specific
person.

The Complainant identified section 19.4 as having been violated by Councillor Cardy’s actions. It is
possible to argue that this section is intended to address the more particular case of actions involving a
specific named person. It is not necessary for me to express an opinion on that as I have already found
Councillor Cardy in violation of three other sections of the Code.

I find that Councillor Cardy violated sections 5.13 (e) and 19.6 (a) and (b) when he posted the terms
“Fucking Raghead” to his Facebook account on August 29, 2017.

Did Councillor Cardy Violate Section 21.1 of the Code by Destroying Evidence?

As has been noted several times throughout this report, Councillor Cardy’s decision to destroy the
Facebook account and his computer have made this investigation longer and more difficult that it
ought to have been. It also violated the right of the Complainant to a fair investigation by removing
the ability to properly review the only evidence of Councillor Cardy’s speculation about hacking.

I noted earlier that I believe that the decision to destroy the evidence was an act of spoliation or
intentional destruction of evidence relevant to a matter in litigation.

I find that Councillor Cardy violated section 21.1 of the Code when he destroyed his Facebook account
and computer thus rendering all physical and digital evidence of the presence of a hacker permanently
unavailable for examination by this investigation.

Page 21 of 58
Recommendations
I am required under section 26.3 of the Code to recommend a penalty to Council when I find that there
has been a violation of the Code.

With respect to the matter of the posting of the words “Fucking Raghead” on Facebook, in making my
recommendation, I am considering both the nature of the words and the unwillingness of Councillor
Cardy to admit his mistake and show remorse for his actions. There is limited precedent in Integrity
Commissioner cases in Ontario for this kind of action. The one somewhat similar case available is
Integrity Commissioner Report Regarding Conduct of Then-Mayor Rob Ford5. A complaint was filed
against former Mayor Ford for using racist language and obscenities, some of which were in the
presence of staff and others when with personal friends. When presented with the complaint, Mr.
Ford immediately apologized and cooperated with the Integrity Commissioner. The Integrity
Commissioner found the comments to be in violation of the Code of Conduct. She did not recommend
a financial penalty, however, because Mr. Ford did not dispute or defend his actions, rather he
apologized and took responsibility for his actions, including apologizing for embarrassing members of
Toronto City Council. There is also precedent in employment law. The case cited previously, Bell
Technical Solutions cites several precedents on inappropriate Facebook posts and the discipline ranges
from short suspensions to termination depending on the degree of vulgarity of the comments and the
number of times they were posted.

In this case, Councillor Cardy attempted for a full day to defend his use of the inappropriate language
but finally concluded the thread of posts with an attempt at an apology. It is my view that he
understood the severity of what he had said. He also did not go on at length repeating the comments
or exacerbating them with worse comments as happened in the Bell Technical Solutions situation.
Therefore, I would recommend a penalty on the lower end of the scale.

I recommend that Council impose a penalty on Councillor Cardy of a two (2) day suspension of
remuneration for the posting of inappropriate language on Facebook.

The matter of the destruction of evidence however is a much more serious offence. While the use of
offensive language is, of course, serious, it does not undermine the very integrity of the Code itself.
The deliberate destruction of evidence and the resulting interference with the right of the complainant
to a fair investigation does. This violation of the Code must merit a serious penalty to ensure that no
other member of Council believes that taking this kind of action will be treated lightly.

I can understand how a person accused of violating the Code may feel threatened and anxious and find
it hard to take steps to preserve the very evidence that may be used against them. However, it is a
principle in law and in this Code that parties to litigation are obligated to defend the right to a fair
investigation. The section itself uses strong language to get that point across: “Members shall respect

5
This decision of Valerie Jepson, Integrity Commissioner for Toronto is available at
https://www.toronto.ca/legdocs/mmis/2015/cc/bgrd/backgroundfile-78467.pdf

Page 22 of 58
the integrity of the Code of Conduct, and inquiries and investigations conducted under it and shall co-
operate in every way possible in securing compliance with its application and enforcement.”

I recommend that Council impose a penalty on Councillor Cardy of a thirty (30) day suspension of
remuneration for the destruction of evidence in this investigation.

Respectfully Submitted:

March 15, 2018

Page 23 of 58
Appendix A: Complaint 1002-17

Appendix "4" to the Council Code of Conduct Policy

Formal Gomplaint Form / Affidavit

t, (full name) of the
I c-¡À,n of County of Brant, in the Province of Ontar¡o do solemnly swear/(affirm
and declare) that the following contents of this affidavit as subscribed are true and correct:

Permanent place
of residence:
g ct^ì.Âr i,i'I. s{ ù.;s, cN N3L lM<ì
Mailing address (if
different from
above):

I have personal knowledge of. the facts as set out in this Affidavit because
I ¡prA {ko^ ,r.,1,^r ( F.'.. [l.k\
(insert reasons e.g. lwork for.. I attended a meeting at which. .. etc.) I have reasonable and probable grounds
to believe that i)., n C,r r.\'., (specify name of member) has contravened section 1s) 5. r3(< ), tq. {,
of the Mun of duct for the County of Brant. The particulars which are as follows: t9.\¡ (")
{" tq. þ (h)

(Set out the statements of fact in consecutively numbered paragraphs in the space below, with each paragraph
being confined as far as possible to a particular statement of fact. lf you require more space please use the
attached Schedule A form and check the appropriate box below. lf you wish to include exhibits to support this
, please refer to the exhibits as Exhibit A, B etc. and attach them to this affidavit.
'fu¡

,4 Please see the attached Schedule A

This affidavit is made for the purpose of requesting that this matter be reviewed by the County of Brant
appointed lntegrity Commissioner and for no other purpose.

ldentification # (of ldentification provided)

ü 7-
at in the County of Brant, in the Province of Ontario on the
.Jc;¡7

of Gomplainant (fo by
A etc.
L Corrtm

Note: This is a sworn (affirmed) affidavit of the deponent only. No investigation has been conducted by this authority to confirm or
verify the above swom information. THE CRIMINAL CODE OF CANADA provides that: everyone commits perjury who, with intent
to mislead, makes before a person who is authorized by law to permit it to be made before him a false statement under oath or
solemn affirmation by aff¡davit, solemn declaration or deposition or orally, knowing that the statement is false, is guilty of an
indictable offence and liable to a term of imprisonment not exceeding fourteen years (Section 131, 132), or by summary conviction
(Section 134). Signing a false affidavit may expose you to prosecution under Sections 131 and 132 or 134 of the Criminal Code,
R.S.C. 1985, c. C-46 and also to civil liability for defamation.

19 of21

Page 24 of 58
 Page _ of _
Schedule A
(Additional lnformation)

To the affidavit required under subsection 24.5 of the Procedure - Formal Complaint of the Council Code
of Conduct.

(lf more than one page is required, please photocopy this blank page and mark each additional page as 2
of 2,2 of 3, etc. at the top right corner.)

I d

{
I
i(

un Lc

This Schedule A referred to in the Affidavit of

name)
Sworn (or before me on this day
of

A taking etc.

20 of21

Page 25 of 58
 {tlr,l''/ A R l"{3

t Hassan Abdu¡ l(ad¡r

r¡ rr !!!! 'u-¡( s

Lke Repry Q
, þ ç

5
..,.ï+ .g.;¡ .t'..ì¡.1

Juiy 24 at 8:1Spm
r .rJ t: ¡lÊ <Jr.,¡¡- J ! jqa g¡-'J t . r¡ + l.;'l r¡ el
1llll,.r.¡5 ¡r
c¡¡¡; .¡ I ri ,l e. s'rf ur"¡ .5:
fr1 J¡ a-$rÀ \r+ aS t *S ¿i¿t

\) 4 Replies

ffi+;i-
Õ
{rt
Lil{e Repty August 9 at 2 17am
.\ H¡de 14 Replþs

I O* Cardy Fudring raghead

Lke R€ply Augusl 29 at 11.31pm
¡ú¡eke Schro€der A ragneed tyficaly reÞfg to e Musliír, tuab, Saltt, or mernber of any group thal
tad¡lirnary tyears a headdress sudr as e turbil, lc{ny€ñ or heeGcarf. I h$e hat's not what yoü meafll to
s3y.
Like Reply 23 h¡s

tlon Cardy Ælyone of those wodd accuralely desqibe who I m spealdng úotd. Any humil beilg who
pcts the erival they did should nol be respeded in any'vray. I heve (þen wilh Arabs, Sikñ 3nd lrttrslirns
arrund ütey world,,vtþ ¡ consid€r frÉnds and good fiends. BUt n(e any nalionality we ai heve our itiots
$rho heve no resped lor lle of any kintl. túy dæe Mus[m triend in Branford arÉ I saw lhts togelter end he
|Gt nb mind as I did. He sped(s the þnguage andthe world end commeftts rvere disgusthg to say üle
least. FB shor¡ld rþt dlotv lhese ;dots lo po6l sudl crap on ib si¡ht. So because I heve treedorn of speecfi
as ll¡ese ¡mbec¡les do I wií sp€ek my m¡nd. l'm nol e paciñslh Ca¡ndian and tñese type of di¡ns shot¡ltt
be dealt with.
L¡ke Reply 22 hrs

Sciroeder I agree thal the behav¡our b despicable. I just hete lo see a whoþ group of peopþ
t¡laeke
lâmbhêd by tie ed¡ms of e t€n.
Like Reply 22 hrs

Don Cardy My cornment was dûected et ttìe people or peßon wlro happened to be of e difrerenl etluic
(rrnure from lhe mktrlþ east Nd the wlìoþ dtù¡re.
Like' Reoly 22 h¡s

Page 26 of 58
 ?5
.eJs

n Don Cardy I also believe that our cunent Provicial and federal govemments are destroying our country and
by not doing their ú¡e dlkJence ¡n allsning so rnany immþranls ftom the middle East region. This in time
rvillcreate many issie in the shorl and fong term for Canada and the peopte. I fear my children and
someday grandchildren wi[ reap rvñat whal the Trudeau governmenl is cunenlly sorving!
As has been seen in N.J., mass. Pails of N.Y. and oher areas in North America.
When I hear conversations l¡ke" one day we Muslims will be the power here and yon wíü have lo amwer to
us". Then ìrve have a serio¡s problem. I I have no issue with ¡mmigrat¡on but the \rray (xrr govemment is
doing il il wouldnl even call it immigralion its an opsl door policy and we will end up paying tur il ¡n the
loflg run. Thafs iust my op{nbn but as a local pol¡lician who follows Politics on ail levds we will pay for tiis
LÍke Reply 22 hrs

I Russ Blshop Don Cartly How can you say to yotlr brother, 'Brother, let me take the speck out of your eye.'
when you yourself fail lo see lhe plank in your $,yn eye? You hypocrite, frst lake the plank out of your eye,
and then you ryill see dearly to remove the spect( from your brothe/s eye. Luke 6:42. Don. I confess to you
lhal I have my own preludhes. I tend lo discflJnt the opinions of peçle who adopl right wrng political
positions. I go to herapy on Thursday nrghts lo deal with the anxiety I feel in a world run by people whose
op¡n¡ons I can'l comprehend. I lalk ebout my feelings and lry lo come to tems wilh how I mþht better
understand people rvhose life experiences are very dfierenl from my o$rn. Having shared hat. Oon, I have
to tell you thal you need help. Why are you up at 2:17Alr¡l folling Kurdistan and utlering ethnic slurs? I had
t0 look at this loday Don. So rfid my kids, so did Mieke, so did ALL of your FaceBook peeps. I was appalÞd
Oon. Now you ere deþndlng yanr untenable posit¡on. You need lo get some heþ man.
Lrke Repty O 1 13 hrs

n Don Cardy Russ hanlG for your çinion Lilre you I have one as well.
Unl¡ke yqrrself I o¡¡n a business and I'm up at 2am spealdng wih my suppliers on the dher sftle of the
planet- As far as you trolling csrirpnt , I c¡nI respond lo that until I ask one of my children what il means!
This pÞce of gaôage video was brought to my attention by a very good Muslim fiend of mine who himself
cailed tne idiot who Srtthb on FB hlm the same thirg.
Why would you defend someone vrfio puts that crep on FB?
As I said in an earlier messege, every raee and cullure has its idiots who put crep like that on forums like
thas.
I dont lmow if you follo$/ global ne|s and the the ¡mmigrat¡on issues we as a counlry are experienc¡ng.
But yu¡ should read up on it and gpt the facts of what is adually happening. Have you seen the on gBC tv
lhe rapes by grouF of Sydan men againsl $ñite women! Fact!
So Russ before you paint me witi the same brush because I believe there are major concems in wñat is
happening and tel[ng me to gel help.
Teke a look around üe world and tell me that you don't have concems for your family and ch¡ldfen wilh
$/hal as happenirE!
I rvillnot be a paciñstic Canaclian! There are 3 types of peopþ in the woflrl, æople who watch hings
happen, people who wonder what the heck just happen and those who make things happen. Whidr one
are you!?
lnstead of me seekhg hdp I would ralher our troops wlro defend our rights use llæm, becâuse
unfortunately lhey are the ones coming home with PTSD
Let's pray lor thern and heir families.
You may want to gel some of their opinioos. I can share that with you if yæ have time for I haye some good
Irie¡dsstho hâva heên lhe¡e and dnne lhel ac well

Page 27 of 58
 f3 3"1 3

r Don Cårt Oh and Russ

Lke Reply 13 hrs
I m at my ofice nowl But who's counting he hoursf

I Russ Elishop Yow fue colors, flon, paint a very ugly pcù¡re.
Like ' Reply 12 hrs

T Don Cardy Thats the greatthhg about our democracy Ræs ne can agree to tfisagree.
Some æopþ Russ canT harúle lhe real worltl. As Pþne Trudeau ooce said in Parlameril " ifs nol afl a
bed oî ræes q¡t &ere in üle u¡orlf
tike Reply 12 hrs

Dm Cardy I hope ¡n 20 years of l'm sül alive. Gorl wiling we can have lhis co'nversation agah. Then we
can see where we are.
Lke RepV 12 hrs
Don Cardy Rr¡ss if I have offended you I apoþgÞe.
Yes I was Harsh wih my commenl r€gerdiru ttÞ video I was giyen to view.
l'mþst sick an<l tlred of tlÞ crap that geb $rt 0n here.
Lke Reply 11 hrs

I nuss Flishop Yes, I was ofended, hrt I acced your apdogy. We both have cÍferent opûrions on certah
iÍForlanl ¡ssues. I also get sick and lired of diferent cræ. I trrd that therepy hdps me process my crap
- cottstructivery, instead of by lashing q¡l at people on FaceBook- lf you are hteresled we can taü< abqrt our
crap h a more approøble selling.
Lilte Reply 11 hrs

Page 28 of 58
 8t3'112017 IMG-9O88.JPG
É*f.;t;{ ß R.f,(
Don Carúy
.S
; 15 mins

To my FB frlends at approx llpm on Tuesday n¡ght ol lhis week I was ¡n a

prtuate conv€rsaüon with a person I d¡d not know in tie miJdle Ea$. Aner
our brief conversatlon I $€nt to bed. Today I check my FB account to find a
cfialn of rEssages thât $€re not from me and my account had been hacked.
Since seelng thß I have made inqu¡ries to FB who have told me to re set rry
acooünt and lhey woukl mon¡tor.
¡ assure yq¡ and those who know rne lhat I am not tne creator otthe
crmmenB. lt is not of rry nature to make comments ot lhb k¡nd. I have just
leamed lhat nothing b safe and secure.

6þ ure Ç conrment
*1

T Davkl trrôrlr Oh sure D,on, wê be¡eve you - LOL

Lke'RepV

I
11 mrns

Kevin S¡mant trs sa{üless Don

LRe Rêply 5 m¡ns

Oon CeraV Tel më about ill

f Lke RepV 2 mins

I tltrile â comment.. o@@@

httpe://mail.google.com/mail/u/0/#inbox/15e3a'|60e3429cA1?projector=1 1t1

Page 29 of 58
 Çl,;1,1 c w t"{1

a
g Donald J. T,?ump * ^*

Hey Canada. You're getting ä wäll too you Snow

Mexicans.

å8 'rÉ(tüU "
lr

. -,., a ., .:: I ,.tl

0u$ r:r* 4ii1{ *ç*-ri¡"¡s¡ltç l¡?i{ $hr:r*s

¡f ure I Comment t share

Don cardY
Ño'r $ 'Zotv (vi""á)
Thank you räg head Americanl
We will build our own wall so that when the
riots in America get worse we can show our
children and say this is why we are the True
north strong and FRËE.
What you see is a or what was a country with
no identity the called in America. Now they
don't know who they are. That's why we built a
wall until they find themselves" So son keep
throwing the guns over the wall and eventually

Page 30 of 58
 ?t
.2"( 4

E9 #
on lnternationãl
www.cbc"ca/1 .

80É_S t"ti¡n I "1K ûart"¡mrcnts ?-.1K Shar*s 'T'l7K Vicws

¡f ure I comment f share

Don Cardy l4-o[ 8{t' 2o'ì (v "-td)

Canada you will rep what you sow. When you
integrate races Colors and creeds there has
always are issues. That is a fact. To be
arrogent to think that we have a counlry that
welcomes all is a state that creates exactly
what you don't want. For all races have beliefs

Page 31 of 58
 ?o{'l
t3

*ffi åic ffi *;:rærne*l $ S*;xr*

ffi Don commented on an article.

,lijl l: ;;Ì ;' r''{,tii "å.ç

Maybe we should take a page from the terrorist book

and start torturing them on TV and really piss them
off so they come out a frght like men and not like
cowards! They stand for no religion but are self
serving p¡gs.

PM is right: This means war

SunNewsNetwork.ca uses
video, photos, and interactive
tools to cover Canada's
national and international...
wv..l1¡1.5i liìtÌ'¡t\r;:; ì lu,:l.,.çlrl k. {:¿;

Cll'r
.ìg

e&, i""*k¿: ffi ü*ixue*r'rt @ Sharr*

Ann Marie ) Don Cardy

.)itr;'i.'¡:i"1'îi ilL 1;:.11i;-?tït ' ¡'tr

Page 32 of 58
 P3
4,Ê I

SeP*'^t'r tô{h (vi"-uÅ)

Cardy
ffi Don
Over paid GAME PLAYERS don't live in the
real world. Should get their shit together
and remember who pays their sad
salaries !! Bitches
iiil:r:Ìiil¡ilfi iir.;:; Like ' Reply

John Gunderson
These immature police are kind of proving
the protester's point, aren't they? Clearly
the police don't feel the need to serve and
protect EVERYONE.
'i :',
¡, ¡jit*¡l:ti ii*; j Like . Reply

Sean Mitchell
#Ë, Jeff Bell makes a contradictory statemenT
- I guess he doesn't respect their right.
',' i1{}¡.1;::i i::¿í.:í:i Likg . Reply

ff'l * James presufii *t

rri^r'
.,., Kills us now you want to take our civil
rights n freedom of speech too. Keep yo
punk asses at da donut shops.
?:t_;ril:ì iì j: :
'.;t.
Likg . .,' , 'l . Repf y
r

Nick Loewenstein
Police union is not mature.
Just sad.

Page 33 of 58
Appendix B: Affidavit of Don Cardy, September 25, 2017

Page 34 of 58
Page 35 of 58
Page 36 of 58
Page 37 of 58
Page 38 of 58
Appendix C: Screenshots Provided by Mr. Russ Bishop

Page 39 of 58
Page 40 of 58
Page 41 of 58
Page 42 of 58
Page 43 of 58
Page 44 of 58
Page 45 of 58
Page 46 of 58
Page 47 of 58
Page 48 of 58
Page 49 of 58
Appendix D: Facebook Posts in Order with Times of Posting
August 29 and August 30

Name Comment Date/Time stamp

Don Cardy Fucking raghead August 29 at 11:31pm

Mieke A raghead typically refers to a Muslim, Arab, Sikh, or member of August 30 10:31am-
Schroeder any group that traditionally wears a headdress such as a turban, 11:31pm
keffiyeh or headscarf. I hope that’s not what you meant to say.

Don Cardy Anyone of those would be accurately described who I’m speaking August 30 11:31am -
about. Any human being who posts the arrival they did should not 12:31pm
be respected in any way. I have dealt with Arabs, Sikh and
Muslims around the world who I consider friends and good friends.
But like any nationality we all have our idiots who have no respect
for life of any kind. My close Muslim friend in Brantford and I saw
this together and he lost his mind as I did. He speaks the language
and the world and the comments were disgusting to say the least.
FB should not allow these idiots to post such crap on its sight. So
because I have freedom of speech as these imbeciles do I will
speak my mind. I’m not a pacifistic Canadian and these type of
actions should be dealt with.

Mieke I agree that the behaviour is despicable. I just hate to see a whole August 30 11:31am -
Schroder group of people tarnished by the actions of a few. 12:31pm

Don Cardy My comment was directed at the people or person who happened August 30 12:31pm
to be of different ethnic culture from the middle east. Not the
whole culture

Don Cardy I also believe that our current Provicial and federal governments August 30 12:39pm
are destroying our country and by not doing their due diligence in
allowing so many immigrants from the middle East region. This in
time will create many issie in the short and long term for Canada
and the people. I fear my children and someday grandchildren will
reap what the Trudeau government is currently sowing!

As has been seen in N.J., mass. Parts of N.Y. and other areas of
North America. When I hear conversations like “one day we
Muslims will be the power here and you will have to answer to us”.
Then we have a serious problem. I have no issue with immigration
but the way our government is doing it wouldn’t even call it
immigration it’s an open door policy and we will end up paying for
it in the long run. That’s just my opinion but as a local politician
who follows Politics on all levels we will pay for this.

Page 50 of 58
 Name Comment Date/Time stamp

Russ Bishop Don Cardy How can you say to your brother, ‘Brother, let me take August 30 9:31pm-10:31pm
the speck out of your eye,’ when you yourself fail to see the plank
in your own eye? You hypocrite, first take the plank out of your
eye, and then you will see clearly to remove the speck from your
brother’s eye. Luke 6:42. Don, I confess to you that I have my own
prejudices. I tend to discount the opinions of people who adopt
right wing political positions. I go to therapy on Thursday nights to
deal with the anxiety I feel in a world run by people whose
opinions I can comprehend. I talk about my feelings and try to
come to terms with how I might better understand people whose
life experiences are very different from my own. Having shared
that, Don, I have to tell you that you need help. Why are you up at
2:17AM trolling Kurdistan and uttering ethnic slurs? I had to look
at this today Don. So did my kids, so did Mieke, so did ALL of your
FaceBook peeps. I was appalled Don. Now you are defending your
untenable position. You need to get some help man.

Don Cardy Russ thanks for your opinion. Like you I have one as well. Unlike August 30 9:31pm -
yourself I own a business and I’m up at 2am speaking with my 10:31pm
suppliers on the other side of the planet. As far as you trolling
comment, I can’t respond to that until I ask on my children what it
means! This piece of garbage video was brought to my attention
by a very good Muslim friend of mine who himself called the idiot
who put this on FB him the same thing.
Why would you defend someone who puts that crap on FB?
As I said in an earlier message, every race and culture has its idiots
who put crap like that on forums like this.
I don’t know if you follow global news and the the immigration
issues we as a country are experiencing. But you should read up
on it and get the facts of what is actually happening. Have you
seen the on BBC tv the rapes by groups of Syrian men against
white women! Fact!
So Russ before you paint me with the same brush because I
believe there are major concerns in what is happening and telling
me to get help.
Take a look around the world and tell me that you don’t have
concerns for your family and children with what is happening!
I will not be a pacifistic Canadian! There are 3 types of people in
the world, people who watch things happen, people who wonder
what the heck just happen and those who make things happen.
Which one are you!?
Instead of me seeking help I would rather our troops who defend
our rights use them, because unfortunately they are the ones
coming home with PTSD.
Let’s pray for them and their families.
You may want to get some of their opinions. I can share that with
you if you have time for I have some good friends who have been
there and done that as well.

Page 51 of 58
 Name Comment Date/Time stamp

Don Cardy Oh and Russ I’m at my office now! But who’s counting the hours! August 30 9:31pm -
10:31pm

Russ Bishop Your true colours, Don, paint a very ugly picture August 30 10:31pm -
11:31pm

Don Cardy That’s the great thing about our democracy Russ we can agree to August 30 10:31pm -
disagree. Some people Russ can’t handle the real world. As Pierre 11:31pm
Trudeau once said in Parliament “it’s not all a bed of roses out
there in the world”

Don Cardy I hope in 20 years of I’m still alive. God willing we can have this August 30 10:31pm -
conversation again. Then we can see where we are. 11:31pm

Don Cardy Russ if I have offended you I apologize. Yes I was Harsh with my August 30 11:31pm -
comment regarding the video I was given to view. I’m just sick and 12:21am
tired of the crap that gets put on here.

Russ Bishop Yes, I was offended, but I accept your apology. We both have August 30 11:31pm -
different opinions on certain important issues. I also get sick and 12:21am
tired of different crap. I find that therapy helps me process my
crap constructively, instead of lashing out at people on FaceBook.
If you are interested we can talk about our crap in a more
appropriate setting.

Page 52 of 58
August 31

Facebook 15 mins (August 31,

Post by Don 2017 1:25pm-2:25 pm)
Cardy

To my FB friends at approx 11pm on Tuesday night of this week I was in a private conversation with a
person I did not know in the middle East. After our brief conversation I went to bed. Today I checked
my FB account to find a chain of messages that were not from me and my account had been hacked.
Since seeing this I have made inquiries to FB who have told me to re set my account and they would
monitor.

I assure you and those who know me that I’m not the creator of the comments. It is not of my
nature to make comments of this kind. I have just learned that nothing is safe and secure.

Name Comments Time Stamp

David Wark Oh sure Don, we believe you. - LOL 11 mins

Kevin It’s sadness Don 5 mins

Smanta

Reply to 2 mins
Kevin’s Tell me about it!
comment
from:
Don Cardy

Gene Wight So you’re saying it wasn’t you that liked my cbc shirt? 1 hr
Provided by Russ Bishop
(page 8 is continuation
from above)

David Wark And it wasn’t you that told me I was good looking and a 1 hr
better golfer than you?

Don Cardy Yep that was me brother. 1 hr

Kevin I suggest changing your passwords and running a full virus 1 hr

Samanta scan

Page 53 of 58
 Name Comments Time Stamp

Kari Raymer I’m sorry Don. I really wish this was true, but you and I and 1 hr
Bishop others know it isn’t the case. You cannot make hateful,
racist comments, then defend them to friends who call you
on it, then argue for free speech and then suddenly claim
that you were hacked and it wasn’t you at all. Your
comments were actually fairly consistent with other
comments you have made on facebook in the past. I’m
sorry but this is not ok.

Don Cardy Sorry you feel this way Kari, but it wasn’t me and my IT 1 hr
department has found it to be from a sight in Europe. So
please be careful on what is said!

Don Cardy We may have difference and I’m sure they have been 1 hr
noticed by make no mistake I would never speak to anyone
on any media in the manner that was shown on my FB
page.

Jeff (posted screenshot of comments) 14 mins

Bartscher

Jeff Unfortunately, Don Cardy, this is not the work of a hacker. 13 mins
Bartscher You know it ,and I know it. This is someone knowingly and
willingly using racist vulgar language directed at another
person, and then defending it 24 hours later. Someone
who represents his neighbors, his family, his friends and his
town. You should be ashamed of yourself. And today’s
“Hackgate” excuse is even more shameful.

Don Cardy My IT guy I just spoke to and he did it remotely. 6 viruses 1 hr

Don Cardy (Image of an elf) Santa! I know him! 58 mins

Page 54 of 58
Appendix E: Email from Michael Hobin to Robert Deutschmann Dated
September 25, 2017

Page 55 of 58
Appendix F: Screenshot of Councillor Cardy’s Facebook Device Authentication
History dated September 18th, 2017

WBfllrT

.!r?1

fi 'a
,.,* h tsG

ilrrl
Wndows PC ' tsrantford, ON. Canada

srl
rl Hndows PC ' Brantford. ON. Canada

:r-
Samsung Oalaxy 57 . Brantford, ON, Canada

lP 2605 tldll0 ti? I 91iat: ca92 clbat tl4Ofi c 1 i a

gflttlltg Oalexy 57 . East Gwitlimbury, ON, Canada

nt l a,.-.'ta,.ir\ ;41-:;r sei'.

* tx L*t i-cg 9r

a stlr"x'rg pa:.,slvcrd that you're nol trstng els*vliere

b plc'tnru
prcture to log rn, rnste:xi of usrng a pa:.slor$

deyae or b,roW$er yOU don't usually ustr

lit ltt41r yiru l,:i; Lr.rr'h 'tt

Page 56 of 58
Appendix G: Extra Security Features Facebook Help Centre

Page 57 of 58
 I turned on two-factor authentication but now I've lost my phone.

I have to enter a security code every time I log in.

Why am I being asked to review my recent logins?

Login Notifications
How do I get alerts about unrecognized logins?

I turned on login alerts but I'm getting asked to name the same device every time I log in.

One-Time Passwords
What's a one-time password and how do I get one?

Trusted Contacts
How can I choose friends to help me log in if I ever get locked out of my account?

How can I contact the friends I've chosen as trusted contacts to get back into my account?

Can someone use trusted contacts to access my account?

Mobile Security
How do I log out of my mobile account if I don't have my phone?

Facebook © 2018 About Ad Choices Terms & Policies

English (US) Privacy Create Ad Cookies
Careers Create Page

Page 58 of 58