Hacking the Malta Gaming Authority

The Malta Gaming Authority (MGA)  is in the news again.  And once more, it’s for the wrong reasons.

On 17 March, the MGA revealed its “systems” had been breached. Somebody hacked the MGA, but the Authority wouldn’t reveal what information had been compromised or which clients’ data had been stolen. The MGA simply reassured the public that “the Authority has dedicated all relevant technical and operational resources to a thorough investigation”.

The hacker was German researcher Lilith Wittmann, who said on social media app X, “Yes, I hacked you and the data obtained has been shared with media partners, authorities – and yes, we will expose the organised crime enablement schemes you created while presenting yourselves as a legitimate public service”.

That’s a shocking accusation. What’s also shocking is that Wittman found it easy to access the MGA’s data.

Gaming is massive for Malta.  Malta is home to roughly 10% of all the gambling companies in the world. As of 2022, the gaming industry contributed 12% of Malta’s GDP.  That’s almost as much as tourism, which accounts for 15%.

Gaming generated over €1.5 billion in Gross Value Added. The industry employs over 10,000 professionals.

The news that the regulatory authority’s “systems” were hacked is a disaster.  Accusations that the MGA was involved in “organised crime enablement schemes” should send alarm bells ringing.  That must be seriously damaging for that key industry.

Yet Minister Silvio Schembri hasn’t issued any statement.  He hasn’t demanded a full explanation from the MGA about what’s going on or what data was stolen. Malta’s reputation was already in the muck when it came to gaming. Scandals have dogged the MGA for years.

Whistleblower Valery Atanasov showed Reuters email exchanges showing that the MGA had broken its own rules, and that Malta’s lax supervision of betting companies “creates conditions that allow suspicious financial operations, money laundering and other criminal practices”.

Bloomberg reported that the EU was furious with Malta and considered it “a cryptocurrency and online gambling hub plagued by allegations of corruption and money laundering”.

In Italy, the Anti-Mafia Directorate’s ‘Operation Double Game‘ revealed that millions of dollars laundered by criminal organisations passed through Maltese betting companies, Forbes reported.

RaiseBet24.com, which had been granted an MGA licence, operated as a laundromat for one of the most feared families in Italian organised crime, Cosa Nostra.

Other probes revealed the same pattern of Malta-based companies, particularly linked to Italian Mafia families, acquiring MGA licences and using them to run illegal betting operations and then laundering proceeds through property, companies and cross-border transfers.

The MGA should have spotted the warning signs and acted. Several red flags were missed, including unusually high betting volumes from specific regions, complex ownership structures, and links to individuals previously investigated in Italy. But the MGA didn’t trigger enhanced scrutiny or move to suspend licences.

Meanwhile, the MGA renewed a gaming licence for Portomaso Casino without a public call, in breach of European regulations.  Edwina Licari, the MGA’s legal counsel drafted the application for Portomaso casino to have its licence renewed in September 2015.  Her draft was simply copied onto a Tumas letterhead and sent to the notorious Joseph Cuschieri, who was then heading the MGA.  Within a week Cuschieri wrote back confirming that the licence had been renewed.

MGA CEO Healthcliff Farugia was convicted of colluding with Yorgen Fenech to conceal money laundering issues at the Portomaso Casino.  The breaches uncovered at the casino were kept hidden from the public. Farrugia resigned from his position after being charged. Yet that did little to repair the MGA’s reputation.

The latest developments will only reignite those international concerns about Malta and its MGA. The reasons for the Authority’s repeated failures and its terrible reputation couldn’t be clearer.

First, MGA is severely under-resourced. It can’t possibly handle the massive number of companies it should be regulating and the complex, high-volume global flows they generate.

Secondly, there is political and economic pressure to limit enforcement to avoid scaring companies away. Those pressures will only increase as the global financial climate deteriorates.

But the most worrying reason for the MGA’s deficiencies is Labour’s choice of key personnel at the Authority.

Labour appointed Charles Mizzi as MGA CEO despite having absolutely no experience in gaming. Mizzi served in communications for the 2015 Valletta Summit on Migration and at the Commonwealth Heads of Government meeting. He was then appointed Executive Director of Malta’s EU Council Presidency.  He then moved into the role of Communications Officer for Labour’s golden passport scheme.  For five years prior to his appointment at the MGA, he ran Malta’s residency programme by investment – Labour’s golden passport scheme 2.0.

Labour appointed as MGA Chair, Ryan Pace, a young, inexperienced lawyer who worked at Robert and Lydia Abela’s private legal firm. He was still in his 20s when Abela made him deputy chairman at MGA and just months later promoted him. In addition to his role at the MGA, Pace has some 11 other separate appointments with various government entities, drawing an income of at least €129,000.

He is a director at Arms Ltd, Gozo Heliport Ltd, Malta Government Investments Ltd, Malta Investment Mgt Co Ltd, and at the Malta Film Commission. No wonder the MGA is hacked.  How can Pace possibly focus on the MGA when he has so many other entities to deal with, in addition to running his private practice?

You’d think there might be other experienced professionals doing the real work at the MGA. Assisting the chairman and the CEO of the MGA is Lyndsey Gambin, the former ONE TV reporter and Konrad Mizzi’s former communications coordinator.  She sits on the MGA Audit Committee, which is responsible for ensuring good corporate governance and risk management.

Well, her ONE TV experience must have fully equipped her for the complex task of audit, internal controls and investigations into the recent MGA hacking.