The Southern District of New York unsealed a seven-count indictment against Behzad Mesri, an Iranian national and member of an Iranian hacking group. The indictment alleges that Mr. Mesri hacked into HBO's computer systems to steal proprietary data, including unaired episodes of the HBO shows "Curb Your Enthusiasm" and "Game of Thrones," cast and crew contact lists, company emails, and HBO financial data. Mr. Mesri, who has not been arrested, demanded $6 million worth of bitcoin to keep the data secret. The Southern District charged Mr. Mesri with computer fraud, wire fraud, extortion and identity theft.
The indictment alleges that between May and August of 2017, Mr. Mesri, a "self-professed expert in computer hacking techniques" who has worked for the Iranian military to perform computer attacks of military systems, gained unauthorized access to HBO's network via remote access points that HBO employees used to log into the company's computer system. The indictment states that HBO learned of Mr. Mesri's activities in a series of emails beginning in July 2017. In those emails, Mr. Mesri wrote to network employees that, "in a complicated cyber operation, infiltration into [HBO's] network [was] accomplished and we obtained most valuable information." Mr. Mesri also promoted the cybersecurity attack through Twitter and additional emails to the media.
Commentary/ Todd Blanche
HBO's cybersecurity breach underscores a company's need to defend itself from digital thieves. Companies large and small use different technologies to network their businesses. Greater user connectivity, however, creates greater vulnerability to hackers. Companies should encrypt data at multiple levels. A multi-level data security program thwarts ex-filtration software — and users of that software — because it protects information at the highest and most granular levels. Such file-level protection, although more costly and time consuming, mitigates risk because it protects software and supplements the hardware encryption that a company likely already implements. The Mesri case demonstrates the government's intention to prosecute hackers for violating the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, and the Economic Espionage Act, in addition to a host of other federal statutes that apply to hackers that infiltrate protected networks and steal proprietary data.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
