Local hacker faces big bill

By RYAN KEEN and PETER GRIFFIN

A Dunedin man has pleaded guilty to charges of hacking into the computer systems of a United States e-commerce operator in what is believed to be the first case of the New Zealand police working with US authorities to prosecute a hacker.

The hacker, who has been granted name suppression, will now fight demands by the US company for reparations totalling US$458,000 ($700,000).

Yesterday, he was in the dock at the Dunedin District Court as his lawyer, Judith Ablett-Kerr, QC, pleaded guilty on his behalf to three charges of damaging a computer system and unlawful access.

But Ablett-Kerr said her client would fight the damages claim.

" ... There's a dispute both as to damage that was done and the number of times on which [the defendant] ... attacked the computer system of the company concerned," she said, adding that she might seek a discharge without conviction for her client.

While full details are yet to come to light, the hacking appears to be part of a revenge attack on a former employer.

Last November, Oregon-based BuyMusicHere found the computer servers on which it runs its business were not working. Over six hours it managed to get the servers back online, but police prosecutor Steve Armitage said "attacks" during the next three weeks emptied 400,000 items from the electronic stores that BuyMusicHere hosts for its customers and reduced its database to a crawl, stopping business and causing customers to get wrong products.

BuyMusicHere was claiming US$157,000 in lost sales and US$156,000 as the cost of replacing computer code that the defendant had written when employed at the company. Legal bills, delayed product releases and personnel fees topped the bill up to US$458,000.

BuyMusicHere was able to trace the attacks to the defendant in December and New Zealand police seized his computer. He confessed in January.

BuyMusicHere's chief technology officer, Eimar Boesjes, would not comment on the case but he said the authorities had co-ordinated the prosecution well.

"We're very happy with the way the New Zealand authorities have handled it and so is the Department of Justice and the FBI."

Such prosecutions have been made easier to bring by new provisions covering computer crime in the Crimes Amendment Act that carry a maximum penalty of seven years in jail.

Those provisions extend anti-hacking law to damage that is carried out from New Zealand but which occurs in other countries. They also clear up confusion on which authorities have jurisdiction on such crimes.

Judge Gary MacKaskill continued suppression of the hacker's name and current employer until a hearing scheduled for April 5, when a date will be set for considering the issue of damages.

The head of the police e-crimes unit, Martin Kleintjes, said the police became involved in the case through an international network set up by a G8 sub-committee.

He said that one other such investigation on an international level was currently under way.