Syrian Electronic Army Hacker Pleads Guilty

Peter Romar, 37, a Syrian national affiliated with the Syrian Electronic Army (SEA), pleaded guilty today to felony charges of conspiring to receive extortion proceeds and conspiring to unlawfully access computers.  Romar was previously extradited from Germany on request of the U.S.

Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Dana J. Boente for the Eastern District of Virginia, Assistant Director James Trainor of the FBI’s Cyber Division and Assistant Director in Charge Paul M. Abbate of the FBI’s Washington Field Office, made the announcement after the sentencing by U.S. District Judge Claude M. Hilton.

“Today’s guilty plea is by the latest international offender who believed that he could operate from abroad, behind the perceived veil of anonymity offered by the Internet, and use computers to threaten the security of our citizens and their property,” said Assistant Attorney General Carlin. “It shows that the Department of Justice and the FBI stand behind their pledge to hold accountable foreign actors who assist in the hacking of U.S. victims.”

According to the statement of facts filed with the plea agreement, beginning in approximately 2011, co-defendant Firas Dardar, known online as “The Shadow,” and other members of the SEA engaged in a multi-year criminal conspiracy to conduct computer intrusions against perceived detractors of Syrian President Bashar al-Assad, including media entities, the U.S. government and foreign governments.  Dardar remains at large.

Beginning in approximately 2013, Romar and Dardar engaged in an extortion scheme that involved hacking online businesses in the U.S. and elsewhere for personal profit. Court documents further allege that the conspiracy gained unauthorized access to the victims’ computers and then threatened to damage computers, delete data, or sell stolen data unless the victims provided extortion payments to Dardar and/or Romar.  If a victim could not make extortion payments to the conspiracy’s Syrian bank accounts due to sanctions targeting Syria, Romar acted as an intermediary in Germany to evade those sanctions.

“Cybercriminals cannot hide from justice,” said U.S. Attorney Dana J. Boente for the Eastern District of Virginia. “No matter where they are in the world, the United States will vigorously pursue those who commit crimes against U.S. citizens and hold them accountable for their actions.”

Romar faces a maximum penalty of five years in prison and will be sentenced on October 21. The maximum statutory sentence is prescribed by Congress and is provided here for informational purposes, as the sentencing of the defendant will be determined by the court based on the advisory Sentencing Guidelines and other statutory factors.

The case was investigated by the FBI’s Washington Field Office, with assistance from the NASA Office of the Inspector General, the Department of State Bureau of Diplomatic Security and other law enforcement agencies.

The case was prosecuted by Assistant U.S. Attorneys Maya D. Song and Jay V. Prabhu and Special Assistant U.S. Attorney Brandon L. Van Grack of the Eastern District of Virginia, and Trial Attorneys Scott McCulloch and Nathan Charles of the National Security Division’s Counterintelligence and Export Control Section.  The Justice Department’s Office of International Affairs also provided significant assistance.

California Man Sentenced to 30 Years for Conspiring to Join ISIL and Engaging in Fraud

WASHINGTON – Nader Elhuzayel, 25, of Anaheim, California, was sentenced to 30 years in prison with a lifetime of supervised release for conspiring and attempting to provide material support to the Islamic State of Iraq and the Levant (ISIL), a designated foreign terrorist organization, and other federal offenses.

Assistant Attorney General John P. Carlin and U.S. Attorney Eileen M. Decker for the Central District of California made the announcement after Elhuzayel was sentenced by U.S. District Judge David O. Carter.

“Nader Elhuzayel was arrested while attempting to travel overseas to join ISIL.  With this sentence, he is being held accountable for conspiring and attempting to provide material support to the designated terrorist organization, and other federal offenses,” said Assistant Attorney General Carlin. “The National Security Division’s highest priority is countering terrorist threats, and we will continue to work to stem the flow of foreign fighters abroad and bring to justice those who attempt to provide material support to designated foreign terrorist organizations.”

On June 21, 2016, a federal jury convicted Elhuzayel and co-defendant Muhanad Badawi, 24, also of Anaheim, of conspiring to provide material support to ISIL.  Elhuzayel was also found guilty of attempting to provide material support and Badawi was found guilty of aiding and abetting the attempt to provide material support to ISIL.  In addition to the terrorism-related counts, Elhuzayel was found guilty of 26 counts of bank fraud and Badawi was found guilty of one count of federal financial aid fraud.  Judge Carter is scheduled to sentence defendant Badawi on October 17.

“Today’s sentence reflects the gravity of the defendant’s plan to betray his country and join a terrorist organization dedicated to the murder of innocent individuals,” said United States Attorney Eileen M. Decker. “As this case shows, the ability of individuals with the desire to support ISIL to use the Internet and social media to conspire with each other poses a grave threat to our national security. So-called ‘foreign fighters’ like this defendant pose a serious danger both overseas and here at home.  There can be no doubt that law enforcement’s disruption of their plans saved lives, both in the United States and abroad.”

The evidence at trial showed Badawi and Elhuzayel used social media to discuss ISIL and terrorist attacks, expressed a desire to die as martyrs, and made arrangements for Elhuzayel to travel abroad to join ISIL. In recorded conversations, Badawi and Elhuzayel discussed how “it would be a blessing to fight for the cause of Allah, and to die in the battlefield,” and they referred to ISIL as “we.”

Badawi also had a Facebook account where he made posts that supported ISIL and violence aimed at non-Muslims, and indicated that he intended to join the terrorist organization. Elhuzayel used social media to communicate with ISIL supporters and operatives, to disseminate pro-ISIL information and to assist ISIL supporters by distributing social media information to those whose accounts had been suspended. Elhuzayel also maintained a Facebook account with the ISIL flag as his profile picture. He used the account to ask Allah to grant him martyrdom and success in leaving U.S. to fight for his cause and to ask Allah to “destroy your enemies and give the Islamic state victory.”

According to the trial exhibits, on Oct. 21, 2014, Badawi made a video of Elhuzayel swearing allegiance to the leader of ISIL, Abu Bakr al-Baghdadi. In the video, Elhuzayel pledged to travel to join ISIL to be a fighter for the terrorist organization.

Evidence at trial also showed that on May 3, 2015, the day of the attack in Garland, Texas, Elhuzayel received social media communications from Elton Simpson, one of the perpetrators of the attack, and that Elhuzayel wrote to Simpson “I love you for the sake of Allah brother may Allah grant you Jannat al ferdaus [the highest level of Paradise reserved for martyrs].”

In addition, Elhuzayel received and disseminated social media communications from ISIL operative Abu Hussain al Britani, also known as Junaid Hussain, including communications trumpeting the Garland, Texas, shootings. On May 7, 2015, four days after the Garland shootings, Elhuzayel and Badawi made travel arrangements and purchased Elhuzayel’s plane ticket to join ISIL.

Both Elhuzayel and Badawi were arrested on May 21, 2015, as Elhuzayel attempted to board a plane at Los Angeles International Airport to travel to Turkey to join ISIL. Badawi had purchased a one-way ticket on Turkish Airlines for Elhuzayel to travel to Israel, with a layover in Istanbul. In an interview with the FBI, Elhuzayel admitted that he intended to deplane in Turkey and seek contacts to facilitate joining ISIL.

Elhuzayel was also convicted of obtaining cash through a scheme to defraud three different banks by depositing stolen checks into his personal checking accounts and then withdrawing cash at branch offices and ATMs in Orange County. The money generated from the bank fraud was intended to finance his travel to Syria to join ISIL. Both men have been held in federal custody without bond since their arrests.         

Badawi is scheduled to be sentenced on October 17 at which time he will face a statutory maximum sentence of 35 years in federal prison.

The investigation in this case was conducted by the FBI’s Joint Terrorism Task Force in Orange County, which includes the following agencies: the Anaheim Police Department, the California Highway Patrol, the Orange County Sheriff’s Department, the Orange County Intelligence Assessment Center, U.S. Immigration and Customs Enforcement’s Homeland Security Investigations, the U.S. Secret Service, IRS – Criminal Investigation, the City of Orange Police Department, the Irvine Police Department, the Naval Criminal Investigative Service, the Orange County Regional Computer Forensics Laboratory, the U.S Attorney’s Office, and the FBI. The Department of Education’s Office of Inspector General provided significant assistance in the investigation and at trial.

The case was prosecuted by Assistant U.S. Attorneys Judith A. Heinz, Deirdre Z. Eliot and Julius J. Nam of the Central District of California, with substantial assistance from Trial Attorney Michael Dittoe of the National Security Division’s Counterterrorism Section.

ISIL-Linked Kosovo Hacker Sentenced to 20 Years in Prison

WASHINGTON – Ardit Ferizi, aka Th3Dir3ctorY, 20, a citizen of Kosovo, was sentenced today to 20 years in prison for providing material support to the Islamic State of Iraq and the Levant (ISIL), a designated foreign terrorist organization, and accessing a protected computer without authorization and obtaining information in order to provide material support to ISIL.

Assistant Attorney General for National Security John P. Carlin, U.S. Attorney Dana J. Boente for the Eastern District of Virginia, Assistant Director in Charge Paul M. Abbate of the FBI’s Washington Field Office and Special Agent in Charge Charles P. Spencer of the FBI’s Jacksonville Field Office made the announcement after the defendant was sentenced by U.S. District Judge Leonie M. Brinkema.

"This case represents the first time we have seen the very real and dangerous national security cyber threat that results from the combination of terrorism and hacking,” said Assistant Attorney General Carlin. “This was a wake-up call not only to those of us in law enforcement, but also to those in private industry. This successful prosecution also sends a message to those around the world that, if you provide material support to designated foreign terrorist organizations and assist them with their deadly attack planning, you will have nowhere to hide.  As this case shows, we will reach half-way around the world if necessary to hold accountable those who engage in this type of activity. I want to thank the corporation that worked with law enforcement to solve this crime, and the agents, analysts and prosecutors who worked on this groundbreaking case."

Ferizi, who was detained by Malaysian authorities on a provisional arrest warrant on behalf of the U.S., was charged by criminal complaint on Oct. 6, 2015. The criminal complaint was unsealed on Oct. 15, 2015. Ferizi subsequently consented to extradition.

Ferizi pleaded guilty on June 15. According to court documents, Ferizi admitted that on or about June 13, 2015, he gained system administrator-level access to a server that hosted the website of a U.S. victim company. The website contained databases with personally identifiable information (PII) belonging to tens of thousands of the victim company’s customers, including members of the military and other government personnel. Ferizi subsequently culled the PII belonging to U.S. military members and other government personnel, which totaled approximately 1,300 individuals. That same day, on June 13, Ferizi provided the PII belonging to the 1,300 U.S. military members and government personnel to Junaid Hussain, a now-deceased ISIL recruiter and attack facilitator. Ferizi and Hussain discussed publishing the PII of those 1,300 victims in a hit list.

According to court documents, on Aug. 11, 2015, in the name of the Islamic State Hacking Division (ISHD), Hussain posted a tweet that contained a document with the PII of the approximately 1,300 U.S. military and other government personnel that Ferizi had taken from the victim company and provided to Hussain. The document stated, in part, that “we are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!” Ferizi admitted that he provided the PII to ISIL with the understanding that ISIL would use the PII to “hit them hard.”

This case is being prosecuted by Special Assistant U.S. Attorney Brandon Van Grack of the Eastern District of Virginia and Trial Attorney Gregory Gonzalez of the National Security Division’s Counterterrorism Section. The Malaysian authorities and the Justice Department’s Office of International Affairs also provided significant assistance.