Carlos Cordero, treasurer of Python NZ, stole money from the high-profile society over several years, putting it at risk of liquidation

The trusted treasurer of Python New Zealand, a volunteer-run society set up to promote one of the world's most popular programming languages, has admitted to stealing $70,000 over several years to fund personal spending.

Carlos Bavastrello Cordero who was the Python NZ treasurer, confirmed to interest.co.nz that he had pleaded guilty at the Invercargill District Court to the theft that took place between February 2019 and October 2023 when he was caught out.

In stealing the money, the 51 year old Cordero racked up debt for Python New Zealand and put the society and its annual conference in jeopardy. Cordero was also the director of the annual Kiwi PyCon conference.

On top of helping himself to money from the society's bank account, Cordero also applied for a government Small Business Cashflow Scheme (SBCS) loan for Covid-19 support, without the knowledge of Python New Zealand.

Tom Eastman, the president of Python New Zealand, spoke to Interest.co.nz about the case, and how the massive breach of trust shocked the society and its members. There is a silver lining in the case, which is how the open source movement rallied behind Python NZ and helped it survive the crisis.

Eastman explained that Python is one of the world’s most popular programming languages in web development, data science, and education, as well as many other fields. Python is very high-profile currently, and it is used by large enterprises like Google and individual users alike.

"Python NZ is a volunteer-run incorporated society and registered charity, founded in 2009, with the mission of fostering an inclusive community to discuss and learn about all things Python. We do this through our conference, Kiwi PyCon, as well as meetups and events throughout the country," Eastman said.

Offending started slowly but ramped up and become more complex

When the fraud unravelled, Python NZ went through several years' worth of bank statements, and it is confident that the amount misappropriated is around the $70,000 mark.

"There were 1674 transactions entirely unrelated to Python NZ business. Consisting of $66,051.15 in debits and $17,202.18 in credits. Netting $48,849.23 in unauthorised and non-society related transactions," Eastman said.

"It seems like it started slowly. A transaction here or there, but accelerated over time. The spending ranges from fast food to computer equipment. Over $10,000 at Starbucks. Tickets to Hamilton Zoo. Seven thousand dollars specifically on fast food franchises. Eight thousand dollars at supermarkets," Eastman said.

Corderos succeeded in hiding the theft for years, but was caught out after he got his excuses wrong and his stories fell apart.

"Carlos got tangled in his lies and revealed one lie while lying about something different. In the aftermath of Kiwi PyCon XII [conference] in Invercargill, we were astonished to discover we were still deeply in debt," said Eastman.

"By this time we’d largely lost confidence in Carlos as a conference director and as treasurer but he was angrily defending his performance and his position. I was arranging for someone else to stand for election.

Eastman thought Cordero was burnt out, and struggling and that the society could do with fresh blood in the role. It was at this time another sizeable financial discrepancy came to light, which in turn revealed that Cordero had applied for a Covid-19 SBCS loan, unbeknownst to the society.

Cordero tried to explain away the $8000 discrepancy by saying it was due to an automatic weekly payment to repay a reimbursable $21,800 portion of what the society had received in Covid-19 support. The $170 a week repayments added up to $8840 for the past financial year, Cordero claimed.

"The news that there was a loan and that it was almost 18 months old was astonishing and dismaying to us. It is explicitly stated in our rules that the society can only undertake a loan after a general meeting and two separate rounds of majority votes from our membership," Eastman said.

What's more, it turned out that there was no $170 a week repayment set up, and nothing had been paid towards the loan amount outstanding while Cordero was the society's treasurer.

Deceiving the society about the Covid-19 cashflow loan was the final straw and Eastman demanded that Cordero step down, or face a more public expulsion for breaching Python NZ's rules.

"We no longer trusted him but I, at least, was still under the impression that he had made some kind of mistake and was trying to cover it up out of pride or shame," Eastman said.

Covering his tracks

Forced out of his role at Python NZ, Cordero did one final thing to hide his theft: he closed the society's bank accounts on his last day as treasurer, before the society's annual general meeting.

"He called Danny [Adair, Python NZ co-founder] and apologised with a patently absurd excuse. Something along the lines of; “I was angry with the bank and started the process of changing banks but then forgot to stop it," Eastman said.

Python NZ wanted Cordero out of the picture so that the society could investigate the matter by itself, as it was apparent that the former treasurer was trying to cover things up.

While the society held its AGM which Cordero didn't attend, as he had left for a pre-planned holiday in his native Peru, Eastman and others at Python NZ were starting to wonder if their former treasurer had literally fled the country.

At the AGM, Adair assumed the role of treasurer and set up an appointment with the bank. Python NZ reopened the bank accounts and requested digital statements for the previous five years. With the statements in hand, on November 10 2023, it became immediately apparent what Cordero had done.

At no stage of the tortuous unravelling of his fraud did Cordero fully admit to what he had done however. Eastman said the only thing Cordero expressed contrition for was for forgetting to tell the society about the Covid-19 cash flow loan.

Theft put existence of Python NZ in jeopardy 

The aftermath of what Cordero had done went beyond the financial loss. It threatened the existence of Python NZ, and affected the society's members deeply.

On the money side, Python NZ owed around $55,000 to conference suppliers as well as the $21,800 loan which IRD had not received a single repayment for.

"We had $26 in the bank accounts. The committee spent hundreds of person-hours over November-January just analysing the damage: the bank statements, Slack conversations, emails, gathering the evidence we had to hand," Eastman said.

"Those of us who could afford to pooled together a donation to the society so the society could engage a lawyer and get legal advice. We knew the society faced liquidation and we didn’t know how at risk we were of personal liability. It was an incredibly stressful time and I think it’s cost some of us some friendships/relationships," he said.

What made the difference in that grim situation was the solidarity of the free and open source movement, with the Linux Australia community organisation stepping in to help out Python NZ. 

"Our options were all bleak, until Linux Australia started collaborating with us on a sponsorship and a “rescue” package. We told Linux Australia the whole story, and they quickly convened a meeting to discuss how they could help," Eastman said.

"They agreed to both a sponsorship package to help us pay our outstanding creditors and a support package to help us run Kiwi PyCon under their auspices while we got the Society back on its feet again," Eastman said.

At a personal level, Cordero's theft took a heavy toll on the society with volunteers who were accustomed to an atmosphere of trust, openness and helping each other out.

"We were all shocked. We were all anxious about what it meant for our own futures, and the future of the society," Eastman said.

Despite one bad piece of news after the other as the extent of Cordero's fraud became known, the society showed resilience and fought back.

"I’m so incredibly proud of the committee though – by and large they showed an extraordinary determination to not let this be the end of what we had built. Danny [Adair] in particular was vehement in his determination to not let one person destroy the organisation he had founded almost 15 years ago," Eastman said.

"The idea of liquidation was morally distasteful, especially because it would have left our suppliers in the lurch, some of whom we’d collaborated with for many years. Thankfully, people showed extraordinary compassion when we explained as much as we could of the circumstances and everybody asked how they could help," he added.

"The wider open-source community and tech community rallied around us in a way I’d never before seen, it gave us so much hope. Our friends at Linux Australia and at the Python Software Foundation went well above and beyond to support us, and save us," Eastman said.

Eastman learnt a harsh personal lesson from the experience.

"Speaking for myself, I was weirdly impressed with how effectively my compassion for someone I considered a friend had been used against me. I’m angry about it, but almost only in kind of an 'academic' way," Eastman said.

To avoid a repeat of the near-disastrous experience with Cordero, Python NZ has put in several new measures and strengthened others to ensure transparency and accountability. This includes improving processes, ensuring that those who need it have access to financial tools, better documentation and actually testing that safeguards put into place work - similar to how software is developed.

"It took a few tries until it was *correctly* impossible for the treasurer to perform banking transactions without the co-signing of the secretary. We learned that we had to *test* the safeguards to prove they work," Eastman said.

One thing that won't happen again is Python NZ compassionately accepting excusing as to why issues of transparency aren't dealt with in a timely manner however.

The popular PyCon conference is safe and will continue next under the auspices of Linux Australia. That arrangement will continue until Python NZ is on a comfortable enough financial footing to resume the conferences by itself.

Python NZ will continue to rebuild itself and to host other smaller events and meetups in cities around Aotearoa and online as well.

Eastman hopes the court will impose restitution from Cordero. However, expects most of the money is gone, as it wasn't cleverly exfiltrated but just spent, profligately and seemingly compulsively.

Cordero would not comment further on the matter. He will be sentenced on October 10.

Update Cordero was sentenced at the Invercargill District Court to 10 months home detention. He is not to undertake any position involving cash or electronic funds type employment, voluntary work or training without the prior written approval of a Probation Officer.

A fine of $49,870 was issued by the court. Furthermore, due to his conviction, the Charities Commission said Cordero is no longer eligible to be an officer of any registered charity for seven years, as per section 36B of the Charities Act 2005.