Police blotter: Best Buy 'hacker' loses in court

By Declan McCullagh
Staff Writer, CNET News.com

Published: December 2, 2005, 6:24 AM PST

TalkBack E-mail Print TrackBack

"Police blotter" is a weekly report on the intersection of technology and the law. This episode: Best Buy is threatened with electronic vandalism unless it coughs up cash.

What: Thomas Eli Ray was convicted of attempting to extort $2.5 million from Best Buy by threatening to exploit a breach in its computer security. He appealed the conviction, saying someone else sent the e-mails.

When: Appeals ruling on Nov. 22.

Outcome: Conviction upheld by a three-judge panel of the 8th Circuit Court of Appeals.

What happened: Best Buy received a series of e-mail messages in October 2003 demanding $2.5 million to prevent its computers from being trashed. The company called the FBI.

Federal agents traced the e-mail messages to three different accounts, one belonging to Ray.

They also found portions of three of the extortion letters on his computer, and its logs indicated that Ray had been using the machine at the time the e-mail messages were sent. Finally, the FBI argued, Ray had the knowledge necessary to handle the clandestine monetary transactions, had he been successful.

The U.S. Department of Justice indicted Ray in December 2003, executed multiple search warrants. A federal jury convicted him of two counts of extortion in October 2004.

Ray claimed that someone had broken into his computer and used it to send the extortionate messages. During the trial, he tried to finger two people who he said were the likely culprits.

The jurors didn't buy that explanation, and a government witness testified that there was no evidence of remote access to Ray's computer.

In his appeal to the 8th Circuit Court of Appeals, Ray raised those arguments again and also said the prosecutor should not have pointed out his propensity for "cybersquatting"--that is, obtaining domain names to which he was not entitled.

The appeals court rejected his arguments and upheld an 18-month prison sentence and restitution to Best Buy of $87,398. Ray also is sentenced to a three-year supervised release, which includes no possession of any "electronic device with access to any online computer service" without explicit permission.

Excerpt from appeals court's opinion: (PDF) "An FBI computer forensic expert found three of the e-mails and other incriminating documents on the hard drive of Ray's computer. The expert testified the e-mails and documents were created by someone typing on that computer and that someone had logged onto the Internet from that computer using the screen name and password used to send the e-mails. The expert also stated there was no evidence of any type of remote access or hacking found on Ray's computer. In addition, the evidence showed Ray had the knowledge and ability to process the monetary transactions he demanded in the extortion e-mails.

"Without identifying specific evidence he sought to introduce, Ray next asserts the district court should have allowed him to explore the FBI's efforts to connect the crimes to two other suspects. Ray was allowed to present evidence of the possibility that another person hacked into his computer and committed the charged offenses, however. The material that was not admitted into evidence was hearsay and merely cumulative. At trial, the other initial suspects, two of whom had been eliminated by the FBI after brief investigation, were not called to the stand as witnesses by Ray. Having carefully reviewed the issue, we conclude the district court did not abuse its discretion in ruling on the admissibility of evidence."

TalkBack E-mail Print TrackBack

Read more on this story's topics and companies

• Add to My News | Create an alert Consumer technology
• Add to My News | Create an alert IDS (Intrusion Detection Systems)
• Add to My News | Create an alert Security
• Add to My News | Create an alert Personal computers
• Add to My News | Create an alert Federal government

TalkBack

Did you know?

Select a tab below to set your default view.