Imagine your boss — the company president — asks you to transfer files from one company computer to a new one. As the work is underway, sexually explicit photos start popping up on the screen from files he has been storing.

Human resources is alerted and an investigation takes place. You and two colleagues from the IT department are fired. The boss continues in his job.

That’s what happened at the Canadian Internet Registration Authority (CIRA) — the federally created agency that sells Canada’s “.ca” internet domain, and offers cybersecurity and other programs nationally.

After an in-house investigation in 2016, president and CEO Byron Holland continued in his job at CIRA.

Three computer staff members were fired, given payouts and told never to speak of the matter.

While this happened more than three years ago, it is coming to the surface now because people with knowledge of the matter expressed concern to the Toronto Star that CIRA mishandled the allegations against Holland. The Star investigated.

CIRA has almost three million internet names under its control. During Hockey Night in Canada you have likely seen the agency’s campy ads, with actors dressed to look like Mounties, sometimes on skates, cross-checking and “arresting” people who chose a “.com,” not a Canadian branded “.ca” domain. “Don’t be a traitor,” is the CIRA tag line on the commercials.

CIRA chairperson Helen McDonald, presented with detailed allegations by the Star, would not answer specific questions, but said the matter the Star was inquiring about was “appropriately resolved” and “CIRA’s board has taken and continues to take a variety of appropriate steps to ensure that it delivers a safe and respectful workplace to its employees.”

McDonald refused requests for an interview. She wrote in a letter (emailed to the Star by the agency’s lawyer) that no employee was “let go for an improper purpose” and that her agency “conducted a complete review with the benefit of outside advice” and the “Board was fully satisfied that the matter was appropriately resolved.”

Holland, the CIRA president, was provided with detailed allegations, and said through his lawyer that he would not comment.

“Mr. Holland will not engage with you regarding the content of any personal and private information he may possess. He will not confirm or deny anything you have said in that respect,” said Peter Downard, Holland’s lawyer.

Headquartered in Ottawa, this little-known agency has annual revenues of $27 million, funded by Canadian individuals and corporations. Its website states that CIRA is “building a better online Canada” and “creating a secure, accessible and resilient internet, for all Canadians.”

The Star’s investigation is based on interviews with four CIRA insiders (former and current employees) who have been granted confidentiality by the Star because they fear economic reprisals, as well as an examination of documents and photographs.

In 2015, the longtime president and chief executive officer of CIRA (appointed in 2008), Byron Holland, wanted a new computer. In addition to his office desktop on the fourth floor of the Bank Street offices of the agency, he had a CIRA desktop at home. It was an iMac and he wanted, according to insiders, a new Windows-based machine at home.

“Byron wanted a new computer and the IT (information technology) staff were asked by Byron to transfer all of the data on his CIRA iMac to a new computer purchased by CIRA,” one insider told the Star.

Two corporate IT employees were involved in the transfer. It took longer than expected and the reason, insiders say, was the large number of photographic images on the iMac that had to be converted to images on Holland’s new Windows-based machine. At times during the transfer, photos appeared on the screen for an instant.

Loading... Loading... Loading... Loading... Loading... Loading...

The images were sexually explicit, insiders say. The Star has seen more than 1,000 of these photos which were copied at the time of the discovery. The images show Holland with other people, often naked or partially clothed, sometimes either performing or simulating sex acts. People in the photos appear to be consenting. Some of the photos appear to have been taken at boozy parties; some are taken at a Caribbean resort, Hedonism II.

The images were stored in various folders, sometimes mixed in with CIRA work product. One folder, an insider said, was named “Naughty Pics.”

This presented the IT team with a serious issue involving what struck them as a potential misuse of CIRA property by the top official at the agency. What to do? The IT employees completed the transfer of legitimate CIRA materials, but only partially completed the transfer of explicit images. Holland was given his new Windows-based computer, and his iMac was put in storage. The majority of the images were now on two CIRA computers. For a time, nothing happened.

After a few months, Holland approached the IT team and asked them to complete the transfer. The employee tasked with the work was uncomfortable making the transfer due to the content of the images and discussed the matter with colleagues. At this point, one member of the IT department told the human resources department.

The human resources department began an investigation under the direction of Paul Havey, a senior executive at CIRA. Insiders say that some members of the board of directors were notified. A decision was made to take the hard drive of one of the computers involved to a forensic data company in Barrhaven, a suburb of Ottawa. An insider said that CIRA wanted to see if images that had been deleted prior to the investigation commencing could be retrieved. The Star has viewed correspondence indicating investigative work was done and that a lawyer from CIRA’s law firm was involved in organizing this part of the probe.

Another hard drive involved (the original iMac) was ordered destroyed. A CIRA employee, acting on instructions from a manager, used a drill and hammer to destroy the hard drive.

In the aftermath, at least three IT employees were fired, and several others left CIRA of their own volition, insiders say. The employees who were terminated had to sign nondisclosure agreements in return for their severance pay.

According to board chair McDonald (she was not the chair at the time of the events), an outside agency advised on the review of the entire matter. CIRA would not identify the agency.

In her response to the Star’s numerous questions, McDonald listed a number of initiatives she said CIRA “has taken and continues to take” to deal with issues such as those raised by the Star. Among them:

“CIRA has a whistleblower policy which encourages employees to report any issues or incidents of concern to their managers in confidence, or if the issue involves that person, CIRA has partnered with a third party supplier to receive and review complaints on an anonymous basis.”

The federal government, which created CIRA, said it would not comment on the matter. “It would be inappropriate for the department to comment on confidential board discussions of any kind,” said a spokesperson for the federal Innovation, Science and Economic Development department.

CIRA would not reveal information related to salaries of top executives, including Holland. The agency’s financial statements record overall annual salaries of $12.3 million (number of employees and executives not listed), and payments of $249,665 annually to the agency’s 12 board members.