DOJ indicts 7 Iranians for hacking U.S. dam, banks
- By Sean Lyngaas
- Mar 24, 2016
The Justice Department on March 24 announced the indictment of seven Iranian hackers for attacking several U.S. banks and accessing a computer at a New York dam.
The hackers did the bidding of the Iranian government, including the Islamic Revolutionary Guard Corps, while employed for two Iran-based computer firms, ITSecTeam and Mersad Co., DOJ alleged.
The relentless distributed denial of service attacks against U.S. banks began around December 2011 and intensified in September 2012, U.S. authorities said. At its height, the DDOS campaign disrupted online access for hundreds of thousands of bank customers, according to DOJ. Bank of America and JPMorgan Chase were among those hit, according to multiple news reports.
The alleged breach of a computer at a Rye, N.Y., dam took place in 2013, but was made public only in late 2015, reviving longstanding concerns about the vulnerability of such systems.
The defendants "intended New York to be the epicenter of harm because New York is the financial capital of the world," Preet Bharara, U.S. attorney of the Southern District of New York, said in a press conference.
The Iranian indictments are part of a concerted campaign by the Obama administration to deter nation-state backed hacking of U.S. assets, even if there is slim chance a given hacker will be extradited to the United States to face charges. Attorney General Loretta Lynch and FBI Director James Comey were also at the press conference as a public show of resolve.
The charges are perhaps the most momentous U.S. action against foreign hackers since DOJ charged five members of China's People's Liberation Army in May 2014, the first such state-backed espionage charges brought by the department.
"When there is no penalty, there's no motive to stop," James Lewis, senior fellow at the Center for Strategic and International Studies, told FCW. "DOJ is trying to motivate our opponents to realize that attacking the U.S. is no longer penalty-free," he said, adding, "we should have done this long ago."
When asked about the efficacy of bringing charges against hackers who are very unlikely to be extradited, Lynch said, "We do not let that be a barrier to bringing the charges."
"It is so important to let the world know that we are aware of their actions," she added.
Robert M. Lee, an industrial control systems security expert, credited DOJ for talking about the issue publicly, but said some of the indictment's details on the New York dam were inaccurate, highlighting the "technical deficiencies of the government bureaucratic process."
Lee, who has studied the breach in detail, contested DOJ's claim that the dam had a supervisory control and data acquisition system, and the department's assertion that the Iranian hacker behind that attack would have had the ability to manipulate the dam's water level.
Cyberspace has in recent years played a consistently prominent role in the geopolitical tussle between Iran and the United States.
Among those freed in a January prisoner swap was an Iranian hacker accused of breaching a Vermont-based defense firm to steal software. Iranian hackers have also broken into the email and social media accounts of State Department officials focused on the Middle East, according to a New York Times report.
Washington, meanwhile, has reportedly conducted its own computer operations against Iran by working with Israel to develop the Stuxnet worm to destroy centrifuges used in Iran's nuclear program, according to multiple news reports.
The indictments come a day after a Chinese national pleaded guilty to conspiracy to stealing data related to U.S. military fighter jets and a Boeing Co.-made transport aircraft.
The indictments serve "as a warning to U.S. companies and individuals that the threats we face online are pervasive and potentially devastating," said Rep. Adam Schiff (D-Calif.), ranking member of the House Permanent Select Committee on Intelligence.
Sean Lyngaas is an FCW staff writer covering defense, cybersecurity and intelligence issues. Prior to joining FCW, he was a reporter and editor at Smart Grid Today, where he covered everything from cyber vulnerabilities in the U.S. electric grid to the national energy policies of Britain and Mexico. His reporting on a range of global issues has appeared in publications such as The Atlantic, The Economist, The Washington Diplomat and The Washington Post.
Lyngaas is an active member of the National Press Club, where he served as chairman of the Young Members Committee. He earned his M.A. in international affairs from The Fletcher School of Law and Diplomacy at Tufts University, and his B.A. in public policy from Duke University.
Click here for previous articles by Lyngaas, or connect with him on Twitter: @snlyngaas.