IDPC Tribunal expert misinterpreted HTML data to sustain allegation that MFSA document was published on OffshoreAlert.com a week before it was published on the MFSA website

One of the world’s leading financial crime journalists has provided a sworn affidavit and documentary evidence showing how a Maltese ‘digital forensic expert’ gave the IDPC appeals tribunal incorrect evidence that led to “a grave miscarriage of justice.”

David Marchant, owner and editor of OffshoreAlert, says that Keith Cutajar, who was appointed as a ‘digital forensic expert’ by the Information and Data Protection Appeals Tribunal, misread and ignored his own HTML data in a case brought by Maltese businessmen Christian Ellul and Karl Schranz, of E&S Group, against the Malta Financial Services Authority.

Relying solely on Cutajar’s evidence, the IDPC Appeals Tribunal incorrectly determined that OffshoreAlert had published a copy of an MFSA regulatory action against E&S Consultancy Ltd. on 18 November 2019 – one week before it was published on the MFSA’s own website.

In February 2025, the decision was upheld by Malta’s Court of Appeal.

Incensed at learning of the two rulings, Marchant provided the MFSA with a 4,000-word affidavit – sworn under oath – and 18 exhibits demonstrating Cutajar’s mistakes and showing beyond any reasonable doubt that OffshoreAlert published the document after it was published by the MFSA, not before.

“I am in disbelief that Christian Ellul and Karl Schranz made an allegation for which there is not – and cannot be – a scintilla of credible evidence to support and a ‘digital forensic expert’ provided the Tribunal with incorrect information that purports to corroborate it,” Marchant said.

“It is a clown-show of the highest order. If this wrong is not righted, it will be a severe blight on Malta’s justice system,” Marchant added.

“Cutajar ignored self-explanatory HTML data in his own report  that literally gave the ‘datePublished’ and ‘article:published’ date as 25 November 2019. It defies belief.

“Instead, he relied on a class of HTML data that he clearly did not understand, which has nothing to do with the publication date and simply shows a date I had manually entered to reflect when the MFSA actually took the action, which was 18 November 2019.”

Among other things, OffshoreAlert publishes actions taken by financial regulators in dozens of countries around the world, including Malta, using the Distill software monitoring tool to track changes on publicly-available pages of regulatory websites that deal with penalties. Marchant received an email from Distill on 25 November 2019 that the MFSA had published an action against E&S Consultancy Limited. He saved the information as a PDF file, which clearly shows the information was saved from the MFSA site on 25 November 2019, as does the automatically-generated ‘Creation’ date in the ‘Document Properties’ of the pdf file.

Marchant then uploaded that document (“E&S Document”) to OffshoreAlert’s WordPress content management system, manually backdating it to 18 November, to reflect the date the MFSA itself assigned to the action.

This is still verifiable at the MFSA website where the action is dated ‘18/11/2019’ even though it was not published on the MFSA’s website until seven days later.

Marchant also wrote an article (“E&S Article”) that was also published on 25 November 2019.

Apart from OffshoreAlert’s HTML data confirming that both E&S Document (the MFSA website document) and E&S Article were both published on “2019/11/25” (Exhibits D, E, F), an automatic Mailchimp newsletter sent out by OffshoreAlert for all website uploads from the last 24 hours, shows the E&S Document appearing in the digest on Monday, 25 November but not in the digests of 18 or 19 November. Even on X.com (formerly Twitter) platform, the historical records still publicly available show that E&S Document was published on 25 November, 2019 (Exhibit N).

In his affidavit to the MFSA, Marchant provides extensive documentation that disproves contentions made by Keith Cutajar.

The E&S allegation

Originally, Ellul and Schranz alleged that the regulatory action on OffshoreAlert was published a week before the official notification on the MFSA website. The IDPC, examining their complaint against the MFSA, found no grounds for their complaint: Marchant himself had been asked by the IDPC’s office in 2020 as to when he had published the information.

But this decision was overturned by the IDPC’s appeals tribunal, solely on the basis of Cutajar’s inaccurate submissions, and upheld by an Appeals Court in 2025.

Alerted to the spurious ‘findings’ by the court expert, a disbelieving Marchant tried to contact Keith Cutajar through his Malta company CY4 Ltd and his LinkedIn profile (Exhibits L, O).  Cutajar never responded. After making contact with the MFSA, Marchant was provided with a copy of the Cutajar’s Appeals Tribunal report (Exhibit P) in May 2025.

“I analysed Mr Cutajar’s report and discovered that he had misread HTML data, which caused him to incorrectly determine that E&S Document was published by OffshoreAlert on November 18, 2025, and ignored HTML data in his report that unequivocally showed E&S Document was published on November 25, 2019,” Marchant said.

“Any claim that the E&S Document was published on November 18, 2019 or any date other than November 25, 2019 is provably false and, frankly, ridiculous. There is, and cannot be, any credible evidence that the E&S Document was published on any date other than November 25, 2019. There is, however, overwhelming evidence that E&S Document was published on November 25, 2019, which is not surprising because that is when it was indeed published.

“It is obvious that Mr Cutajar, upon whose evidence the Tribunal relied, did not analyse E&S Document’s HTML data competently or correctly, and later compounded his conduct by not responding when I sent him evidence proving his conclusions were incorrect.

“Mr Cutajar’s analysis regarding E&S Document is strange and worthy of independent examination.”

ABOUT David Marchant

David Marchant is a journalist of over 40 years’ experience whose work has been featured in U.S. government reports and in countless articles by major news organisations, including the BBC, The Wall Street Journal, The Economist, Reuters, Associated Press, and Bloomberg, apart from regular appearances on BBC and CNN shows. He is the author of the ‘Money Laundering’’ chapter for the journalists’ training book Covering Globalization – A Handbook for Reporters (Columbia University Press, New York City).

Marchant is he owner of OffshoreAlert, which operates www.OffshoreAlert.com, which was formed in 1996 and publishes articles and documents concerning participants in international business. OffshoreAlert has also held over 30 conferences on intelligence, investigations, and recovery in high-value international finance in Miami, Bangkok, London, São Paulo, and Marbella.

What follows is an analysis by David Marchant of Cutajar’s 2023 report to the Appeals Tribunal, explaining what Cutajar got right and what he got wrong, supported by documentary evidence. 

In his analysis of the Cutajar report, Marchant, inter alia, shows:

1.  Cutajar relied on a class of HTML data called “article:published_time” to correctly determine that E&S Article was published on 25 November 2019. However, he inexplicably ignored the very same class of HTML data for E&S Document showing it was published on the same date. Instead, he relied on five classes of HTML data that he misinterpreted to incorrectly conclude that E&S Document “was published on the 18th November 2019”, specifically “pagePostDate”, “pagePostDateYear”, “page PostDateMonth”, “pagePostDateDay”, and “pagePostDateiso”. In reality, none of these five classes of HTML data shows the date that E&S Document was published by OffshoreAlert. Instead, they show the date that Marchant manually assigned to E&S Document in OffshoreAlert’s customised WordPress content management system to reflect when the regulatory action was actually taken by the MFSA. In WordPress, ‘Post’ and ‘Published’ do not mean the same thing, as Cutajar seemingly believes. It’s a rookie mistake. In WordPress, the word ‘Post’ refers to the actual document, not to an action.

2.    Had Cutajar relied on the same class of HTML data for E&S Document that he had correctly relied on for E&S Article, which literally gives the “published_time”, he would have concluded that it too was published on November 25, 2019. His own data shows this. But, incredibly, he ignored it. Why?

3.    To demonstrate Cutajar’s mistakes, Marchant conducted an experiment on 1 June 2025, temporarily changing the date he had originally manually assigned to E&S Document when publishing it in OffshoreAlert’s WordPress system on 25 November, 2019, changing it from 18 November 2019 to 18 November 2050. The HTML data called “article:published_time” remained unchanged at “2019-11-25”, reflecting the fact that the November 25, 2019 published date was still the same. The “pagePostDate”, however, had changed to “November 18, 2050”, reflecting the new date (Exhibit M). Marchant can literally assign any date he wants to a document, past, present, or future. The ‘Post’ date, which is manually assigned by Marchant, and ‘Published’ date, which is automatically-generated by WordPress, are not the same. It’s remarkable that Cutajar – a purported ‘Expert’, no less – seemingly does not know something as simple as this.

As featured in

The Times of Malta ‘Clown show’: US-based website slams Malta’s IDPC appeals tribunal

BusinessToday Incorrect findings by Maltese court expert caused miscarriage of justice, says US journalist