Joshua Priebe, an IT specialist at Air Canada, testified at the trial of Parmpal Sidhu, who is accused of being involved in a $22 million gold heist at Pearson Airport’s cargo warehouse. After hearing about the incident during a company trip to Jamaica, Priebe analyzed over 400,000 lines of corporate computer logs to trace potential patterns used by the thieves. He suspected inside knowledge and access to Air Canada’s systems were key, as the perpetrator appeared capable of searching for high-value shipments from outside the office, likely from home.
Written locally by qwen2.5:14b on 2026-10-07,
using this article's own text rather than the other coverage of the
same event (that is the story summary below).
Air Canada technology specialist Joshua Priebe was on a trip to Jamaica with dozens of airline colleagues when he heard about the spectacular gold heist at Air Canada’s Toronto cargo warehouse.
asserted
he → hear → warehouse
“When we were down there we all got a message,” Priebe told court Tuesday at the trial for one of the men accused of pulling off the largest gold heist in Canadian history.
asserted
Priebe → get → history
“We were talking about it at the pool, in the pool, and speculating on what could have happened.”
Once Priebe got back from the trip, which was a prize in the airline’s employee awards program, and returned to work at the scene of the crime, he heard more about the high-profile heist in which thieves mysteriously made off with a shipment of gold and cash worth more than $22 million.
uncertain
thieves → talk → gold
“I’m a curious fellow by nature and I like to understand things.
asserted
I → ’m → things
My mind automatically jumped into how I would have done it,” he said from the witness stand.
asserted
he → jump → stand
It seemed like an inside job.
asserted
It → seem → job
At the time of the gold heist — April 17, 2023 — he was manager of application development and maintenance at Air Canada, an IT job at the airline’s large cargo facility at Pearson airport, where he helped keep the airline’s cargo management system running.
asserted
system → keep → airport
As an IT worker, he was asked by corporate security to preserve the corporate computer logs and to help Peel Regional Police investigate the heist, he said.
asserted
he → ask → heist
Analyzing more than 400,000 lines of code that documented employee computer usage from a week before the heist to a week afterwards, he looked for patterns matching the way he figured the heist could have been pulled off.
uncertain
heist → analyze → way
“I tried to put myself in the mindset of how I would have done something like this.
asserted
I → try → this
I hope I’m not criminally minded, but I find it interesting.
asserted
it → hope → ?
So that’s why I delved into the data,” Priebe testified.
asserted
Priebe → ’ → data
“If I wanted to plan this out, how would I have done it?
asserted
I → want → it
And looking at the data, I looked at the transactions that I would have done leading up to something like this,” he said.
asserted
he → look → this
“I started to piece together the story of what happened.”
asserted
what → start → story
Priebe described for Judge Gordon Cudjoe of the Ontario Superior Court of Justice in Brampton the suspicious data trail at the second day of the trial for Parmpal Sidhu, a 56-year-old former Air Canada cargo warehouse employee who is one of the men accused of conspiring to steal the valuable crate.
asserted
who → describe → crate
Sidhu has pleaded not guilty.
asserted
Sidhu → plead → ?
Priebe said whoever was involved in the heist appeared to have deep knowledge of Air Canada’s shipping and cargo procedures and had credentials with access to its computer systems.
asserted
involved → say → systems
He looked for online activity in the logs for someone using Air Canada’s systems to search incoming air traffic for arriving shipments.
asserted
He → look → shipments
He said that’s where a heist plot would likely start, trying to identify a specific high-value shipment as a target.
asserted
plot → say → target
An employee with credentials could do that search remotely, from anywhere, not just in the office.
uncertain
employee → do → office
Priebe figured the person would probably do it from home, where they had more free time and greater privacy, and so Priebe filtered out in-office inquiries and found a profile fitting that pattern — repeated searches over a couple of days made off-site, apparently of flights from Zurich, a financial centre in Switzerland known for shipping high-value precious metals, currency and luxury watches.
asserted
Priebe → figure → metals
Such shipments can be a daily occurrence at Pearson, he said.
asserted
he → say → Pearson
The login credentials used for those searches, court heard, were for Simran Preet Panesar, who was an Air Canada manager who Sidhu reported to, and who is considered a fugitive wanted by police on charges of being part of the gold heist.
asserted
who → use → heist
Priebe also found the credentials of a different Air Canada employee were then used to log into the system to change the designation of a specific crate on a flight from Zurich by deleting its code that it was a high-value shipment.
asserted
it → find → code
This was done while the plane was in the air.
asserted
plane → do → air
That change meant the crate would not be sent to a secure storage area at the airport, which is locked and guarded, but instead sent to general storage, where any employee could access it.
uncertain
employee → mean → it
The timing of the change was a red flag, Priebe said.
asserted
Priebe → say → change
“It was suspicious for me because it bypasses the automatic lockdown” on a shipment’s data that kicks in once it touches down and unloading begins.
asserted
unloading → bypass → data
“It looks like it’s trying to bypass the security elements that we had in place.”
asserted
we → look → place
Another login, using yet another employee’s computer credentials, made a different but important change to the shipping data for the crate.
asserted
login → use → crate
This change made it so the crate would not be unpacked by warehouse staff and divided for the two different customers picking up the contents — TD Bank collecting the gold and a Vancouver foreign exchange picking up the foreign banknotes — but rather kept intact.
asserted
crate → make → banknotes
That made sure the entire load of gold and cash stayed together.
asserted
load → make → gold
That was suspicious to Priebe because he saw the change was made on a mobile phone using the cargo warehouse’s guest Wi-Fi, rather than one of the desktop computers used by staff.
asserted
change → see → staff
“That is not normal,” he said.
asserted
he → say → ?
“This is unionized work that they’re doing and a unionized person would have no reason to go on a mobile device on the guest Wi-Fi to perform their duties.
asserted
person → do → duties
They’re provided with a computer at their desk.”
asserted
They → provide → desk
Priebe also described how the corporate digital logs also traced the login credentials used to print off an air waybill — a shipping contract that shows ownership of cargo — that was used by a driver to collect the diverted crate.
asserted
that → describe → crate
The access was in the credentials for Sidhu, court heard.
asserted
court → hear → Sidhu
Court heard from the second and third employees whose credentials were used to set up the heist.
asserted
credentials → hear → heist
…and 8 more, not listed.
The Aporia
