[BreachExchange] US charges Swiss ‘hacktivist’ for data theft and leaks

[Destry Winant]

https://apnews.com/article/business-washington-switzerland-hacking-identity-theft-b657992e12f42880283cfe2c96cfb3bc

The Justice Department has charged a Swiss hacker with computer intrusion
and identity theft, just over a week after the hacker embarrassed a U.S.
security-camera startup and its clients by showing how easy it was to spy
on the cameras watching over hospitals, schools and corporate offices.

An indictment against 21-year-old Tillie Kottmann was brought Thursday by a
grand jury in the Seattle-based Western District of Washington.

Federal prosecutors said Thursday that Kottmann, of Lucerne, Switzerland,
was initially charged in September. The range of allegations date back to
2019 and involve the alleged theft of credentials and data and publishing
source code and proprietary information from more than 100 entities,
including companies and government agencies.

Kottmann has described the most recent leak of camera footage taken from
customers of California security-camera provider Verkada as part of a
“hacktivist” cause of exposing the dangers of mass surveillance. Kottmann
told The Associated Press in an online chat last week that they found the
credentials needed to enter the site exposed on the open internet.

In conversations with other reporters last year, Kottmann, who uses
they/them pronouns, said data they obtained and posted online had been
exposed by poor security practices and they sought to shame organizations
into buttoning up their networks.

Acting U.S. Attorney Tessa Gorman rejected that approach in a statement
Thursday.

“These actions can increase vulnerabilities for everyone from large
corporations to individual consumers,” Gorman wrote. “Wrapping oneself in
an allegedly altruistic motive does not remove the criminal stench from
such intrusion, theft, and fraud.”

Kottmann didn’t return an online request for comment. Swiss lawyer Marcel
Bosonnet said he is representing Kottmann but declined further comment
Friday.

Bosonnet at one time represented Edward Snowden, the former National
Security Agency contractor who was charged in 2013 with disclosing details
of highly classified government surveillance programs. Snowden had
considered seeking asylum in Switzerland.

Swiss authorities said they had raided Kottmann’s home in Lucerne late last
week at the request of U.S. authorities. Prosecutors said the FBI recently
seized a website domain that Kottmann used to publish hacked data online.

It’s not clear if U.S. prosecutors will to try to extradite Kottmann, who
remains in Lucerne and was notified of the pending charges. Swiss law
limits certain forms of extradition, especially when the charges could be
prosecuted in local courts. The public prosecutor’s office in Lucerne
declined comment Friday, deferring to U.S. authorities.

Kottmann expressed confidence in the online chat with the AP last week that
the U.S. “cannot extradite me even though they know exactly who I am.”

Thursday’s indictment ties a number of hacks to Kottmann over the past
year, including one targeting an unnamed security device manufacturer based
in the Seattle region and another affecting a maker of tactical equipment.

In several cases, prosecutors said Kottmann improperly used valid employee
credentials to gain access to source code databases. The indictment says
Kottmann also hacked the Washington state Department of Transportation, an
automobile manufacturer and a financial investment company.

The indictment doesn’t specifically mention last week’s high-profile hack
of Verkada, which drew attention because it exposed live camera feeds and
archived video footage from schools, jails, factories, gyms and corporate
offices.

Kottmann told the AP last week they belonged to a group nicknamed APT-69420
Arson Cats, a small collective of “primarily queer hackers, not backed by
any nations or capital but instead backed by the desire for fun, being gay
and a better world.”

Kottmann has previously attracted attention for leaking hacked material to
expose security flaws, including from U.S. chipmaker Intel last year.

The indictment does not accuse Kottmann of trying to extract money from
hacking victims — a typical motive for many cyber crimes. But prosecutors
do attempt to tie Kottmann’s efforts at self-promotion, including the
design and sale of clothing related to hacking and
“anti-intellectual-property ideology,” into part of a broader conspiracy to
commit computer fraud.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20210323/aec5933a/attachment.html>