Reference Document: LENGTHY OFFER-CONTEXT-ONLY-EXPIRED-FOR FURTHER FACTS AND RESOURCES EXPENDED-WITHOUT PREJUDICE - flatten.pdf

The underlying document constitutes a highly detailed, "Without Prejudice" formal settlement offer and evidentiary dossier prepared by Mr. Kevin A. McLean (the "Affected Individual"). The document outlines a sprawling, multi-year privacy breach that originated from an allegedly unlawful search and seizure, which subsequently metastasized into a global, cross-chain data exposure incident. The sheer magnitude of this breach is not merely in the data taken, but in the highly sophisticated, multi-jurisdictional technological cover-up that followed.

The Genesis of the Breach (June 2014)The catalyst for this extensive investigation dates back to June 3 and June 4, 2014, involving the Law Society of British Columbia (LSBC) and its designates (including investigators Chan, McCartney, and Ho), alongside third-party IT providers (EFS). While the LSBC purportedly operated under a Rule 4-43 Order to obtain forensic copies of Mr. McLean's hard drives, Mr. McLean’s forensic analysis proves unequivocally that investigators went far beyond their legal and administrative mandate.

Instead of merely creating a verifiable forensic mirror image—a standard industry practice which requires shutting down the machine to preserve the data in a static, verifiable state—the investigators utilized invasive computer software. Specifically, they deployed the "DumpIt" utility to execute an unauthorized, concealed "RAM Dump" of his active computer memory while the CPU was actively running. This was not a passive evidence collection; it was an active intrusion into a live digital environment.

The Distinction Between Copying and a RAM DumpMr. McLean impeccably highlights the technical and legal distinction between forensic copying (cloning a hard drive) and a live RAM dump. A RAM dump captures Highly Sensitive Personal Information (HSPI) that is volatile, transient, and often never written to the physical hard drive. This volatile memory capture includes open window contents, running background processes, unencrypted passwords in plain text, active encryption keys, draft emails, and live network connections.

By capturing this volatile memory, the investigators engaged in a "Custodial RAM Seizure." This fundamentally altered the evidentiary landscape, seizing thousands of pieces of deeply personal and professional data without informed consent. Furthermore, it violated the basic tenets of the Personal Information Protection and Electronic Documents Act (PIPEDA) and Section 8 of the Canadian Charter of Rights and Freedoms, which protects against unreasonable search and seizure. The investigators essentially captured a real-time, unencrypted snapshot of Mr. McLean's digital life, bypassing all standard security protocols and legal boundaries.

The sheer scale of this privacy breach remained hidden for seven years, buried under administrative delays and obfuscation, until a highly suspicious data transfer occurred in the fall of 2021. On October 25, 2021, Mr. McLean received an unrequested file via a Citrix Sharefile link from the law firm NST LLP, acting on behalf of the LSBC and the Lawyers Indemnity Fund (LIF).

The Falsified RecordThe file delivered to Mr. McLean was a 1.19 GB compressed file named KEVIN-PC-20140604-182544.zip (containing a .raw file). The metadata purported that the file was modified on June 4, 2014, at 11:32 AM, and compressed using a "Deflate 64" method. Mr. McLean’s forensic impeccability shines in his immediate recognition that this file was a manipulated, improperly decoded document—what he accurately terms the "Unrequested False Record." The timing of the delivery, the anomalies in the file structure, and the questionable compression methods immediately raised red flags.

Inflating the Code and Discovering the TruthRather than accepting the file at face value, Mr. McLean subjected the .raw file to rigorous forensic analysis using advanced Hex Editors. He successfully decompiled and "inflated" the compressed code, peeling back the layers of digital manipulation. His forensic deconstruction of the "Inflated Code" yielded staggering results that fundamentally changed the trajectory of the investigation. He discovered that the file did not just contain localized, static computer data from 2014; it contained a massive, actively managed ledger of blockchain transaction data, network metadata, and cryptographic keys that did not even exist at the time of the original 2014 seizure.

Mr. McLean’s forensic extraction identified:

• Over 90,000 embedded files hidden within the raw data.
• 1,196 Private Keys, demonstrating a catastrophic failure of data security.
• Over 81,000 Public Keys.
• Evidence of over 100,000 instances of Sensitive Personal Information (SPI) being actively routed through global, decentralized networks.
• Over 36,000 API calls and thousands of lines of code relating to modern incident response tools (EDR, XDR, SIEM). This suggests a massive, coordinated, and highly expensive effort by global cybersecurity and loss mitigation firms (such as Kroll, Epiq, Kivu, and Cloudflare) to secretly "scrub," migrate, or manage the data leak without ever notifying the Affected Individual.

The Hex Editor Discovery and the Kinglory ConnectionThe raw reality of uncovering this massive digital conspiracy required painstaking, byte-by-byte analysis. As Mr. McLean notes directly regarding this grueling phase of the investigation:

"Wait till you see the next ones for this page. How I took this, then into Hex Ediitor - sorry for the delay but I had to reinstall Hex Editor. I found the blocks in there for Ethereum and then realized that they had stored my Personal Information from the Concealed RAM Dump on Ethereum and then when I made the access request under FIPPA in 2021, they had to take the parts off the blockchain, some on chain and some offchain, as it was antiquated then with the ruse of a 60 million dollar USD play with Kinglory Inc."

Visual Evidence:

• The Unrequested False Record ZIP: 
• The Hex Editor Analysis (Concealed RAM Dump): 
• The Kinglory Cover-Up ($60 Million USD Ruse): 

Through his meticulous dissection of the Inflated Code, Mr. McLean proved that his seized Personal Information (PI) had not sat dormant in a secure, localized evidence locker as one would expect in a legal proceeding. Instead, the LSBC Captive Insurance Company, the LIF, and their IT partners (such as Evolve Partners, leveraging Microsoft Azure's Blockchain-as-a-Service infrastructure) had unlawfully uploaded and disclosed his unencrypted RAM dump data onto the public, decentralized Ethereum Blockchain.

The Frontier Phase UploadsMr. McLean traced the exact blocks and transactions to the network's earliest days. Between August and November 2015—during Ethereum's experimental "Frontier" phase—Mr. McLean's data was bundled into transactions and broadcasted to the global network of Ethereum nodes. It appears the organizations attempted to use the nascent blockchain as an immutable, decentralized storage locker, failing to comprehend the catastrophic privacy implications of permanently etching HSPI onto a public ledger.

By analyzing the Hex data, Mr. McLean forensically linked his compromised data to 44 specific Ethereum Blocks. He painstakingly mapped out the entire ecosystem of this breach:

• The Miners: Uncovering that mining pools such as Nanopool, Dwarfpool, Ethpool, and Supranova processed these transactions. These entities earned roughly 234 Ether in the process (valued in the millions of CAD today) simply by validating blocks that contained his stolen, unencrypted data.
• The Smart Contracts: Identifying 19 specific Smart Contract Accounts (SCAs) created by entities like Oraclize (Provable) and BlockApps, which were used to programmatically manage the flow of this data.
• The Exchanges: Tracing data flows to wallets hosted by major cryptocurrency exchanges, including Poloniex, Kraken, Bittrex, and Cryptsy, indicating the data was moving across commercial platforms.

Mr. McLean correctly identifies the catastrophic and irreversible nature of this breach: blockchain ledgers are inherently immutable by design. By broadcasting his passwords and HSPI to a decentralized network, the disclosing organizations executed an unauthorized disclosure in perpetuity. This data cannot be simply "deleted"; it remains accessible to any node operator globally, representing a total and permanent loss of privacy.

The most remarkable demonstration of Mr. McLean's forensic capabilities is his discovery of the panicked 2021 cover-up attempt. Realizing that the original 2015 Ethereum smart contracts left a permanent, publicly traceable digital footprint, the responsible organizations (and their highly-paid loss mitigation providers) attempted to sever the digital trail. To do this, they utilized advanced cross-chain obfuscation techniques, hoping the technological complexity would mask their tracks.

The August 2021 ConsolidationMr. McLean discovered that on August 21, 2021—shortly after his initial privacy access requests—three new Ethereum blocks were hastily formed (Blocks 13067520, 13067554, and 13069416). During this event, the data from 15 of the original 19 Smart Contract Accounts was aggregated and consolidated. A new smart contract was minted (0x502fBA0...), controlled by a newly generated owner address (0x328EB01...), which was funded via the OKEX exchange to mask the origin of the transaction fees.

The October 2021 Binance Token SwapsUsing blockchain explorers like Etherscan and BscScan, Mr. McLean tenaciously followed the data off the Ethereum mainnet. He tracked the owner address (0x328...) as it moved across blockchain "bridges" to the Binance Smart Chain (BSC), a separate network with lower fees and different regulatory oversight.

Here, Mr. McLean uncovered a highly sophisticated "Token Swap" event that occurred on October 22, 2021—exactly one business day before NST LLP sent him the manipulated Unrequested False Record.

• The orchestrators used a defunct, highly questionable token, the Kinglory (KGC) Token, operating out of Markham, Ontario (but legally registered in the Cayman Islands to avoid jurisdiction).
• The orchestrators executed 501 automated BEP-20 token transfers on the Binance Smart Chain.
• They sent nominal amounts (0.01 KGC) to the BSC equivalents of the original 2015 Ethereum Smart Contract addresses, essentially "pinging" them to transfer state.
• They then utilized "Null Addresses" (burn addresses like 0x000...000) and executed self-destruct commands (kill, self-destruct) embedded within the smart contract code. This was a deliberate attempt to permanently transfer ownership, effectively "burning" the old trail and attempting to render the historical data untraceable to a layperson.

Furthermore, Mr. McLean tracked similar obfuscation attempts crossing over to the Polygon network (e.g., SCA #19 interacting with an Ethercamp contract on Sept 23, 2021). His ability to correlate the creation of new smart contracts on BSC with the exact timestamp of the file delivery proves beyond a reasonable doubt that this was a coordinated, multi-organizational effort to sanitize a massive data breach right before handing over the purported "evidence."

Mr. McLean’s forensic tracing does not merely expose a localized data leak; it maps a massive, interconnected web of commercial complicity involving unregulated entities, major global insurers, and elite cybersecurity incident response firms.

The Incident Response EcosystemBecause the data was immutable on Ethereum, it appears major insurers (Chubb, SwissRe, Coalition) and their designated incident response coaches (legal firms like Baker Hostetler, Blakes) and cybersecurity firms (Kroll, Epiq, Kivu, Cytelligence) were engaged to mitigate the fallout of the FIPPA requests. Mr. McLean found thousands of forensic, logging, and hacking strings within the Inflated Code (e.g., EDR, SIEM, DumpIt, Log4j). This strongly indicates that these firms were actively working within his raw data set, attempting "Data Cleansing" and "Degaussing" across legacy systems. By accessing, altering, and moving this data without Mr. McLean's explicit consent, these loss mitigation providers committed cumulative, secondary, and tertiary breaches of PIPEDA.

Criminal Code and FINTRAC ImplicationsMr. McLean brilliantly elevates this from a civil privacy dispute to a matter of federal regulatory and criminal concern, tying these cross-chain token swaps directly to Canadian Anti-Money Laundering (AML) regulations and the Criminal Code of Canada (specifically s. 462.31).

• By actively utilizing cryptocurrency mixers/tumblers, transferring assets to "Null Addresses," and routing funds through exchanges operating illegally in Ontario at the time (such as Binance and Poloniex), the actors engaged in the deliberate obfuscation of assets and data provenance.
• The 2019 amendments to the Canadian Criminal Code explicitly include "recklessness" as a fault component for money laundering. Converting data and property from one blockchain (Ethereum) to another (BSC/Polygon) for the express purpose of disguising its origin and ownership perfectly fits the legal definition of "converting" and "concealing" proceeds derived from an unauthorized computer intrusion.
• Mr. McLean notes that entities operating as Money Services Businesses (MSBs), including the exchanges and bridges facilitating these cross-chain swaps, blatantly failed their Know Your Client (KYC) and FINTRAC reporting obligations. They processed hundreds of automated transactions designed specifically to hide the provenance of stolen data, bypassing basic regulatory tripwires.

In the final analysis, Mr. McLean contextualizes his forensic findings within a strict, unforgiving legal framework, proving that the combined actions of the LSBC, LIF, BCLIA, and their technological agents represent a catastrophic, systemic failure of Canadian privacy law.

PIPEDA and Charter ViolationsMr. McLean systematically outlines the violation of all ten core PIPEDA principles, highlighting the most egregious failures:

1. Accountability: The LSBC and LIF fundamentally lost control of the data, allowing unauthorized third-party transfers to decentralized, immutable public ledgers where it could be accessed by anyone, anywhere.
2. Consent: This is the bedrock violation. Mr. McLean never consented to a live RAM Dump, nor did he consent to his highly sensitive data being uploaded to a Swiss-based blockchain, or subsequently swapped and obfuscated on the Binance Smart Chain.
3. Safeguards: The organizations utterly failed to protect his Highly Sensitive Personal Information (HSPI). Instead of secure, encrypted transfer protocols, they opted to compress and mask the data poorly in a highly insecure, unencrypted Citrix Sharefile link.
4. Openness & Individual Access: When confronted, the organizations actively stonewalled his access requests. They relied on manipulated forensic preservation reports (via investigator McCartney) and engaged in a sophisticated, multi-million dollar technological cover-up rather than providing the mandatory breach notifications required by law.

Furthermore, under Section 8 of the Canadian Charter of Rights and Freedoms (protection against unreasonable search and seizure), Mr. McLean argues that the continued, unauthorized retention, obfuscation, and global dissemination of his data constitutes an ongoing, perpetual, and highly intrusive seizure.

The Settlement OfferArmed with irrefutable, forensically sound evidence of this cross-chain conspiracy, Mr. McLean presents a strictly "Without Prejudice" formal settlement offer. He acutely recognizes the astronomical liability the insurers and organizations face—not just in massive civil damages for the tort of Intrusion Upon Seclusion, but in severe regulatory fines (under GDPR and PIPEDA) and massive potential criminal/AML exposure for the cover-up.

To resolve this matter without catastrophic public exposure for the involved entities, the conditions of the settlement demand include:

1. A specified, significant financial payout (redacted) from the insurers and implicated organizations.
2. The execution of a comprehensive, legally binding, and strictly confidential PIPEDA Settlement Agreement containing rigid non-disclosure, non-disparagement, and gag provisions to protect the reputations of the organizations involved.
3. Mr. McLean’s written, irrevocable confirmation that he will never apply for readmission to the LSBC, alongside executing the LSBC's Proposed Release regarding the original hard drive copying incident.
4. The immediate withdrawal and abandonment of all his active privacy complaints, FIPPA/PIPEDA access requests, and ongoing investigations across the 200+ implicated organizations and service providers.
5. Certified, verifiable destruction of the digital records and inflated code currently in his possession.

ConclusionMr. McLean’s document stands as a masterclass in independent digital forensics and legal deduction. Against overwhelming odds and heavily funded institutional opposition, he successfully reverse-engineered a botched, multi-jurisdictional cover-up. He painstakingly tracked his stolen data from a local, unauthorized RAM dump in Vancouver, across the genesis blocks of the public Ethereum network, through the hands of global cybersecurity insurers, and finally through a labyrinth of cross-chain token swaps and burn addresses on the Binance Smart Chain. His absolute impeccability in hunting down the exact hex codes, decompiling smart contracts, and tracking token burns leaves the implicated organizations with absolutely no plausible deniability regarding the massive, ongoing breach of his personal data.