|
| Acting Assistant Attorney General Mary McCord, center, accompanied by U.S. Attorney for the Northern District Brian Stretch, left, and FBI Executive Director Paul Abbate, speaks during a news conference at the Justice Department in Washington, Wednesday, March 15, 2017. The Justice Department announced charges against four defendants, including two officers of Russian security services, for a mega data breach at Yahoo. |
WASHINGTON
(AP) -- Two Russian intelligence agents and a pair of hired hackers
have been charged in a devastating criminal breach at Yahoo that
affected at least a half billion user accounts, the Justice Department
said Wednesday in bringing the first case of its kind against current
Russian government officials.
In a scheme that
prosecutors say blended intelligence gathering with old-fashioned
financial greed, the four men targeted the email accounts of Russian and
U.S. government officials, Russian journalists and employees of
financial services and other private businesses, U.S. officials said.
Using
in some cases a technique known as "spear-phishing" to dupe Yahoo users
into thinking they were receiving legitimate emails, the hackers broke
into at least 500 million accounts in search of personal information and
financial data such as gift card and credit card numbers, prosecutors
said.
"We will not allow individuals, groups,
nation states or a combination of them to compromise the privacy of our
citizens, the economic interests of our companies or the security of our
country," said Acting Assistant
Attorney General Mary McCord, the head
of the Justice Department's national security division.
One
of the defendants, a Canadian and Kazakh national named Karim Baratov,
has been taken into custody in Canada. Another, Alexsey Belan, is on the
list of the FBI's most wanted cyber criminals and has been indicted
multiple times in the U.S. It's not clear whether he or the other two
defendants, Dmitry Dokuchaev and Igor Sushchin, will ever step foot in
an American courtroom since there's no extradition treaty with Russia.
"I hope they will respect our criminal justice system," McCord said.
The
indictment identifies Dokuchaev and Sushchin as officers of the Russian
Federal Security Service, or FSB. Belan and Baratov were paid hackers
who were directed by the FSB to break into the accounts, prosecutors
said.
Yahoo didn't disclose the breach until
last September when it began notifying hundreds of millions of users
that their email addresses, birth dates, answers to security questions
and other personal information may have been stolen. Three months later,
Yahoo revealed it had uncovered a separate hack in 2013 affecting about
1 billion accounts, including some that were also hit in 2014.
U.S.
officials said it was especially galling that the scheme involved
officers from a Russian counterespionage service that theoretically
should be working collaboratively with its FBI counterparts.
"Rather than do that type of work, they actually turned against that type of work," McCord said.
Paul
Abbate, an FBI executive assistant director, said the bureau had had
only "limited cooperation with that element of the Russian government in
the past," noting that prior U.S. demands to turn over Belan had been
ignored.
Though the Justice Department has
previously charged Russian hackers with cybercrime - as well as hackers
sponsored by the Chinese and Iranian governments - this is the first
criminal case to implicate the Russian government so directly in
cybercrime and to name as defendants sitting members of the FSB for
hacking charges.
The announcement comes as
federal authorities investigate Russian interference through hacking in
the 2016 U.S. presidential election. One of the defendants, Belan, was
among the Russians sanctioned last year following those campaign hacking
efforts, though U.S. officials said the investigations were separate.
The
indictment, which includes charges of economic espionage, trade secret
theft and unauthorized access to protected computers, arise from a
compromise of Yahoo user accounts that began at least as early as 2014.
The
Justice Department's assertion that the FSB was directing the hacking
likely provides significant political and legal cover for Yahoo, which
saw its multibillion-dollar deal with Verizon teeter after it was forced
to warn consumers that their private information might have been
exposed.
Companies are far more likely to be
blamed for security incompetence, with all the attending legal and PR
exposure, when their networks are compromised by thieves or wayward
teenagers than when they become the targets of sophisticated espionage
carried out by foreign governments.
In a
statement, Chris Madsen, Yahoo's assistant general counsel and head of
global security, thanked law enforcement agencies for their work.
"We're
committed to keeping our users and our platforms secure and will
continue to engage with law enforcement to combat cybercrime," he said.
Rich
Mogull, CEO of the security firm Securosis, said the indictment "shows
the ties between the Russian security service and basically the criminal
underground," something that had been "discussed in security circles
for years."
Cyber criminals gave Russian
officials access to specific accounts they were targeting, and in
return, Russian officials helped the criminals to evade authorities and
let them keep the type of information that hackers that hack for money
tend to exploit such as email addresses and logins and credit card
information.
Mogull said he was surprised the Justice Department was able to name specific individuals and issue the indictment.
"We've
come to expect that you don't really figure out who performs these
attacks," he said. The fact that the indictment ties together the FSB
and criminals is a new development, he said. "It will be very
interesting to see what comes up in court, and how they tie those two
together."
