The view from level 46 of Sydney's MLC Centre is spectacular, offering all the blue sky, soft furnishing and inaccessible solitude a law firm could desire – the question is, at 130 metres up, how do you place a listening device?
A little after-hours work by the Australian Federal Police's Operation Elbrus was about to shake up the phoenix industry. The bug they placed on the 46th floor last January would seal Australian Tax Office deputy commissioner Michael Cranston's fate.
The AFP has never said how they began their investigation of Plutus Payroll. In court affidavits, the AFP has described how Plutus Payroll offered what appeared to be conventional payroll services, but in reality consultants' pay was transferred to tier-two companies staffed by straw directors and most of the tax payments were allegedly stolen.
But what raised the AFP's suspicions?
Life was simpler In October 2015, when then ATO deputy commissioner Michael Cranston addressed a press conference on the Commonwealth government's Serious Financial Crime Taskforce. Alex Ellinghausen
Tax Commissioner Chris Jordan told Senate Estimates on May 30: "The Australian Criminal Intelligence Commission started investigations as a result of some information at the beginning of August … the AFP became aware of it on 30 August, 2016 and started a project named Elbrus in September 2016."
Whatever that information was, it was enough to trigger immediate, separate investigations by two police bodies (the Australian Criminal Intelligence Commission dropped its inquiry in late September after learning of the AFP's operation).
Hand-picking the right people
The AFP threw major resources at Elbrus, beginning with appointing Detective Superintendent Kirsty Schofield to lead the investigation.
"We knew this was going to be a complex investigation, and so we hand-picked the right people who had the skill sets to handle what would turn out to be a highly sensitive operation," Commander Chris Sheehan, AFP state manager NSW, told The Australian Financial Review.
AFP Detective Superintendent Kirsty Schofield was brought in to help crack the Plutus case. AFP Media
Schofield had moved to the organised crime division in March 2016 after four years as investigations manager of the AFP's anti-terrorism unit. Last month she was awarded the Australian Police Medal in the Queen's Birthday Honours for leading Operation Appleby, the country's biggest anti-terrorism investigation.
"What we saw here with some analysis of information that we had [was] a really well organised syndicate creating a lot of wealth, and that really sparked our interest," Schofield told The Project on Ten in May.
"What we saw is, Adam Cranston particularly had an extreme amount of wealth, which seemed really odd for the normal person, so we started looking into this syndicate. And we – the investigation went from there."
Swimming with a crocodile
The earliest reported telephone taps in AFP court documents suggest Adam Cranston was the initial target of Operation Elbrus. AAP
Despite the cars and the planes, Adam's wealth was not easy to trace. Adam Cranston was a major target from the start, which means inevitably so was his father, ATO deputy commissioner Michael Cranston.
The investigation was on a need-to-know basis within the AFP. Schofield moved the team to a location with restricted access.
Operation Crocodile, the ATO unit in Townsville, by this time had uncovered most of the network of companies behind Plutus, but the paper trail provided limited evidence to charge the architects of the scheme.
The AFP investigation was a game-changer, as Schofield brought the arsenal of techniques used in anti-terrorism cases: phone taps, listening devices and computer hacking.
Tax lawyer Dev Menon appears extensively in the transcripts of telephone taps and listening devices detailed in AFP court affidavits. Supplied
The phone taps began with Adam Cranston's mobile. But what did they mean? The first tap described in the court documents was at 3.38pm on October 11, 2016, four days before Adam Cranston's wedding, and the transcript reads like gibberish, a mixture of slang, nicknames and code words.
'Lawfully obtained information'
Adam Cranston was talking to Dev Menon, from Sydney law firm Clamenz Lawyers, asking if the "Ds" were paid a "thou'y" a week.
Menon told him they were, and that a man they usually called D was "clipping $500 or $800 a week", and he wanted "24 invoiced a week and he is going to use T's companies".
AFP handout photo showing the arrest of Adam Cranston outside his Bondi home. Australian Federal Police
The AFP says in its court filings that Adam Cranston was asking if the straw directors in the new phoenix companies were being paid $1000 a week, and Menon told him that Dan Rostankovski, the 28-year-old who found and ran the straw directors, was keeping $500 to $800 of these payments, and wanted $24,000 a week, disguised as corporate invoices.
Adam Cranston's calls led the AFP to Dev Menon, Simon Anquetil and Adam's sister, Lauren Cranston. By December 22, the AFP had planted a bug in the Miranda office where Lauren and Dev Hammond managed the bank accounts – their conversations are described as "LOI" in the AFP statements of fact, short for "lawfully obtained information", while phone taps are "LII", or "lawfully intercepted information".
The AFP also had access to files on Lauren Cranston's laptop, also marked as "LOI", which indicates either they copied the hard drive when they broke into the office to plant the listening device, or they hacked into it remotely.
ATO chief gets a visit
Meanwhile Schofield's team was as startled as the Plutus plotters when the ATO's Operation Crocodile made its first overt moves on December 8 and 14, freezing $599,000 in the accounts of five of the phoenix companies used in the second wave of the Plutus fraud.
The AFP contacted the ATO's fraud prevention and internal investigations arm, which secretly put them in touch with the Townsville ATO team.
On January 11, AFP Commissioner Andrew Colvin visited Chris Jordan at the ATO to tell him about the investigation, and that one of the principals was Michael Cranston's son.
"Commissioner Colvin was clear to me that Michael Cranston was not suspected, and is still not suspected, of being involved in the syndicate and its activities of defrauding the Commonwealth," Jordan told Senate Estimates.
Alleged co-conspirator Simon Anquetil is a former Plutus director. AAP
The phone taps and listening devices meant Operation Elbrus had the evidence it needed to shut the alleged scam down. On January 24 the Crocodile team, co-ordinating with the AFP, issued garnishee orders on bank accounts of the five latest phoenix companies, freezing $953,000 and triggering panic in the syndicate.
""Hey D, f--k this is Defcon 5 man," Menon told Rostankovski on January 25. "No payments can f--king go out, hey."
The ATO and AFP could have closed Plutus down. But the AFP was still sifting through a mountain of information – Elbrus and Crocodile would not fully share information until February – and preparing prosecution briefs would be hugely complicated.
The AFP needed more time.
Court documents claim the scam was ripping off $2 million a week from taxpayers in lost tax revenue. This was the pressure on the Elbrus team – another $25 million would be misappropriated before the money stream was cut off on April 24.
Almost all of it would eventually end up with Rostankovski after he threatened to go public on the alleged scam if he wasn't paid off.
At this point the AFP had nothing on Michael Cranston, one of the major targets of the investigation.
Daniel Rostankovski, 28, who allegedly found and ran the straw directors. James Brickwood
But the ATO's decision to freeze the accounts on January 24 was a deliberate ploy to see what the syndicate would do under pressure.
The Elbrus team had taken their boldest step, somehow placing a listening device in the offices of Menon's law firm, Clamenz Lawyers, on level 46 of the MLC Centre in Sydney's CBD.
It was an extraordinary step, to breach legal privilege. The court documents give no clue as to how they gained a warrant to tap a law firm, and how they got access to level 46.
On January 30, it paid off. Adam Cranston had a crisis meeting with Menon and Anquetil at Clamenz after the ATO asked for a meeting with Anquetil on February 7.