Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 1 of 22 PageID: 14 UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY UNITED STATES OF AMERICA Hon. Crim. No. V. LAURILOVE, a/k/a "nsh," a/k/a "route," a/k/a "peace" ~~- r;;~(sowj 18 U.S.C. §§ 371, 1030, and 2 INDICTMENT The Grand Jury, in and for the District ofNew Jersey, sitting at Newark, charges: COUNT I BACKGROUND Defendant and Others 1. At all times relevant to this Indictment: a. Defendant LAURI LOVE, a/k/a "nsh," a/k/a "route," a/k/a "peace" ("LOVE"), resided in or near Stradishall, England. As set forth more fully below, defendant LOVE was a sophisticated and prolific computer hacker who specialized in gaining access to the computer networks of large organizations, including government agencies, collecting confidential data including personally identifiable information (PII) from within the compromised networks, and exfiltrating the data out of the compromised networks. b. Co-conspirator-! ("CC# 1"), a co-conspirator who is not charged as a defendant herein, resided in or near New South Wales, Australia. c. Co-conspirator-2 ("CC#2"), a co-conspirator who is not charged as a defendant herein, resided in or near Australia. Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 2 of 22 PageID: 15 d. Co-conspirator-3 ("CC#3"), a co-conspirator who is not charged as a defendant herein, resided in or near Sweden. Overview of the Hacking Conspiracy 2. From at least as early as approximately October 1, 2012, through in or about October 2013, defendant LOVE and others (collectively, the "Co-Conspirators") hacked into thousands of computer systems in the United States and elsewhere. Once inside the compromised computer systems, the Co-Conspirators placed hidden "shells" or "backdoors" within the networks, which allowed the Co-Conspirators to return to the compromised computer systems at a later date and steal confidential data. 3. The Co-Conspirators' victims included the United States Army and numerous other agencies of the United States, including the United States Missile Defense Agency, Environmental Protection Agency, and the National Aeronautics and Space Administration (collectively the "Government Victims"). The data stolen from the Government Victims included PII of military servicemen and servicewomen and current and former employees of the federal government. The attacks collectively resulted in millions of dollars in damages to the Government Victims. Definitions and Selected Methods of Hacking Utilized by the Co-Conspirators 4. At times relevant to this Indictment: a. An Internet Protocol ("IP") address was ·a unique numeric address used by a computer on the internet. An IP address is a series of four numbers, each in the range of0-255, separated by periods. Every computer connected to the internet is assigned an IP address. b. "Structured Query Language" ("SQL") was a computer programming language designed to retrieve and manage data on computer databases. 2 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 3 of 22 PageID: 16 c. "SQL Injection Attacks" were methods of hacking into and gaining unauthorized access to computers connected to the Internet. d. "SQL Injection Strings" were a series of instructions to computers used by hackers in furtherance of SQL Injection Attacks. e. "HTML" was a computer programming language used to design websites. f. "Malware" was malicious computer software programmed to, among other things, identify, and export information from computers that were hacked as well as to evade detection by anti-virus programs running on those computers. g. "ColdFusion" was the name of a commercial web application development platform created by Adobe and designed to make it easier to connect simple HTML pages to a back -end database. h. "Proxy servers" were computer systems or applications that acted as intermediaries for requests from clients seeking resources from other servers. A proxy server has a large variety of potential uses, one ofwhich is to attempt to hide one's true IP address from others, and to thereby remain anonymous. 1. An Internet Relay Chat ("IRC") was an online medium through which multiple people could gather together in a "chat room" or "channel" and discuss topics of mutual interest. Similar to a telephone conference call, it allowed multiple people to participate in and communicate within one "conversation," but words were typed not spoken. The Government Victims 5. At all times relevant to this Indictment: 3 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 4 of 22 PageID: 17 a. The Engineer Research and Development Center ("Engineer R&D Center") was an agency of the United States government, and was a research facility owned and operated by the U.S. Army Corps of Engineers ("Army Corps") in Vicksburg, Mississippi. b. The Plans and Analysis Integration Office ("PAlO") was an agency of the United States government, and was a component of the United States Military ("USM") responsible for gathering and analyzing data, tracking the implementation of policies and overseeing long-range plans. The PAIO maintained a Research, Development and Engineering Command located in or around Aberdeen Proving Ground, Maryland. c. The Strategic Studies Institute ("SSI'') was an agency of the United States government, and was a branch of the U.S. Army War College that published national security and strategic research and analysis. The SSI was located in Carlisle, Pennsylvania. d. The Army Network Enterprise Technology Command ("NETCOM") was an agency of the United States government, and planned, installed, integrated, protected and operated computer networks of the U.S. Army, and maintained a Network Enterprise Center located in or around Aberdeen Proving Ground, Maryland. e. The Army Contracting Command ("ACC") was an agency of the United States government, and provided contracting support to the U.S. Army throughout the United States and abroad. The ACC maintained the Army Materiel Command in or around Redstone Arsenal, Alabama. f. The Missile Defense Agency ("MDA") was an agency of the United States government, and a research, development and acquisition agency within the United States Department of Defense and was responsible for, among other things, establishing a ballistic missile defense system. 4 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 5 of 22 PageID: 18 g. The Federal Facilities Environmental Stewardship and Compliance Assistance Center ("FedCenter") was a joint initiative ofthe United States Environmental Protection Agency's Office ofEnforcement and Compliance Assurance ("EPA-OECA"), the Army Corps' Construction Engineer Research Laboratory, and the Office of the Federal Environmental Executive to create an all-services technical compliance assistance center to assist federal environmental officials in addressing environmental needs. h. The National Aeronautics and Space Administration ("NASA") was an agency of the United States government responsible for the nation's civilian space program and for aeronautics and aerospace research. THE CONSPIRACY 6. Between in or about October 2012 and in or about October 2013, in the District of New Jersey and elsewhere, defendant LAURILOVE, a/k/a "nsh," a!k/a "route," a/k/a "peace" did knowingly and intentionally conspire and agree with others to commit an offense against the United States, that is, to intentionally access a computer without authorization, and to exceed authorized access, and thereby obtain information from a department or agency of the United States, namely, the United States Army, the Missile Defense Agency of the United States Department of Defense, the Environmental Protection Agency, and the National Aeronautics and Space Administration, the value of which exceeds $5,000, contrary to Title 18, United States Code, Sections 1030(a)(2)(B) and 1030(c)(2)(B)(iii). 5 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 6 of 22 PageID: 19 OBJECT OF THE CONSPIRACY 7. It was the object of the conspiracy for defendant LOVE and others to hack into the computer networks of the Government Victims and steal large quantities of non-public data, including PII, to disrupt the operations and infrastructure of the United States government. MANNER AND MEANS OF THE CONSPIRACY 8. The manner and means by which defendant LOVE and others sought to accomplish the conspiracy included, among other things, the following: Searching for Potential Victims a. It was part of the conspiracy that defendant LOVE and other Co- Conspirators would search for vulnerabilities in the websites of various United States Army installations and other government agencies to identify potential hacking victims. b. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would use an automated process to scan IP address ranges to identify computer systems vulnerable to cyber attacks. c. It was further part of the conspiracy that the defendant LOVE and other Co-Conspirators would share information about potential hacking victims through online IRC communications, including sharing links that could be used to access compromised computer systems. For example, in an IRC communication on or about January 3, 2013, defendant LOVE, using the online moniker "peace," stated: 1 peace: so can pivot and scan for other vulns [vulnerabilities] peace: we might be able to get at real confidential shit 1 The text of the chats is reproduced in this Indictment as it appears in the chat logs; errors in spelling and punctuation have not been corrected. 6 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 7 of 22 PageID: 20 peace: blow this year wide open Executing the Attacks d. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would hack into the Government Victims' networks using various techniques, including, among other things, SQL Injection Attacks and exploitation of vulnerabilities in Coldfusion applications, to access PII of current and former United States government employees and other information located on government victim networks. e. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would provide each other and others with SQL Injection Strings, Coldfusion vulnerabilities and malware that could be used to gain unauthorized access to the Government Victims' networks to locate, transmit and store confidential data from those networks. f. It was further part of the conspiracy that once they hacked into the Government Victims' computer networks, defendant LOVE and other Co-Conspirators would place malware on the Government Victims' networks that would enable them to access these networks at a later date ("Back Doors" or "Shells''). Defendant LOVE and other CoConspirators placed thousands of shells on computer networks. g. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would communicate in IRC channels while their unauthorized access was taking place in order to advise each other as to how to navigate the Government Victims' networks and how to locate confidential data and other information. The Co-Conspirators also communicated in IRC channels about how they would export or exfiltrate stolen government data, and what they could do with the data. For example, on or about July 31, 2013, defendant LOVE, using the 7 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 8 of 22 PageID: 21 online moniker "peace," discussed in an IRC communication the data that he had stolen during a recently-committed hack of a United States government agency: peace: [CC#2], you have no idea how much we can fuck with the us government if we wanted to. peace: this ... stuff is really sensitive CC#2: ooh nice peace: it's basically every piece of information you'd need to do full identity theft on any employee or contractor for the [government agency] Publicizing the Attacks h. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would use various forms of social media, including Twitter, to announce and publicize the attacks against the Government Victims. For example, in an IRC communication on or about January 24, 2013, defendant LOVE, using the online moniker "route," discussed the timing of disclosing through social media a cyber attack against a United States government agency: CC#2: do it friday ngiht CC#2: dont rush Route: mm CC#2: well friday night still friday CC#2: give ur sel the extra few hours to get set CC#2: self route: yeah 8 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 9 of 22 PageID: 22 route: aiming for SAM EST== lOAM UTC [Universal Coordinated Time]== 9PMAUS route: so it rolls along the morning news in US route: and gets europe for the afternoon and evening Concealing the Attacks 1. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would conceal their attacks by disguising, through the use of Proxy Servers, the IP addresses from which their attacks originated. Defendant LOVE and the other Co-Conspirators further used the Tor network, which was an anonymizing proxy service, to hide their activities. J. It was further part of the conspiracy that defendant LOVE and other Co- Conspirators would communicate about their hacking activities in secure IRC channels. The CoConspirators would use more than one message screen name and would often change names to further conceal their identities. For example, in an IRC communication on or about January 24, 2013, LOVE, using the online moniker "route," discussed his efforts to conceal his identity and hacking activities, and to avoid detection: route: consideration 1: behaviour profile should not change route: public side i mean route: so whatever "normal" activities we do route: should continue route: but we move from this ire to better system route: also 9 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 10 of 22 PageID: 23 route: these nicks should change route: i think route: when we get on new communications route: all new names 10 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 11 of 22 PageID: 24 OVERT ACTS 9. In furtherance of the conspiracy, and to effect its unlawful object, the Co- Conspirators committed and caused to be committed the following criminal acts, among others, in the District ofNew Jersey and elsewhere: Engineer R&D Center Attack 10. Beginning on or about October 2, 2012, and continuing through on or about October 6, 2012, defendant LOVE and other Co-Conspirators attacked one of the Engineer R&D Center's servers, and compromised that server, by exploiting a vulnerability in its ColdFusion application to unlawfully access an Army database. 11. After accessing these forbidden areas of the Engineer R&D Center's server, the Co-Conspirators obtained a copy of the password properties file. This file enabled the CoConspirators to determine the administrator password for the Engineer R&D Center's website. Using the stolen administrator's password, the Co-Conspirators obtained data belonging to the Army Corps, including information regarding the planned demolition and disposal of certain military facilities. The attack was launched from a computer server located in or around Romania, which was leased by defendant LOVE. The Army Network Enterprise Technology Command ("NETCOM") Attack 12. Beginning on or about October 6, 2012, and continuing through on or about October 9, 2012, defendant LOVE and other Co-Conspirators carried out a SQL Injection attack and unlawfully accessed and stole data from NETCOM servers which included PII of over 1,000 individuals, including military personnel stationed at Fort Monmouth, a military installation in Monmouth County, New Jersey. 11 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 12 of 22 PageID: 25 13. On or about October 6, 2012, defendant LOVE, using the online moniker "nsh," discussed this hack with CC#1 in an IRC chat, including some of the data that the CoConspirators had accessed from the NETCOM servers: 14. nsh: [CC#1] nsh: you hexing mil? CC#1: Yes CC#1: sure am! CC#1: Via my new vps CC#1: lol CC#1: hmm, have a look at some of the passwords, hmm nsh: okais Also on or about October 6, 2012, defendant LOVE stated in an IRC chat simply "hacking the army." Later in the chat, the Co-Conspirators discussed other military-based computer systems that they claimed to have compromised, or "owned": CC#2: kewl so we have a few mil dbs now CC#2: now all we need is army CC#2: lol nsh: well, on army site atm The Army Contracting Command Attack 15. Beginning on or about October 7, 2012, and continuing through on or about October 8, 2012, the Army Contracting Command's Army Materiel Command ("ACC") located in or around Redstone Arsenal, Alabama was the victim of a SQL Injection Attack through 12 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 13 of 22 PageID: 26 which defendant LOVE and other Co-Conspirators unlawfully accessed nonpublic data from an ACC database, including competitive acquisition bids and related attachments. 16. On or about October 10, 2012, in an IRC chat, defendant LOVE indicated that he had hacked the ACC website. The Army Corps Attacks 17. On or about October 6, 2012, defendant LOVE and other Co-Conspirators attacked an Army Corps' computer server, and compromised that server, by exploiting a vulnerability in its ColdFusion application to unlawfully access an Army database. The data exposed as a result of the intrusion included natural resource management data. On or about the same date, defendant LOVE, using the online moniker "nsh," CC#l, CC#3, and others, discussed this hack in an IRC chat, including sharing the "shell" that the Co-Conspirators used to access the compromised database: 18. CC#1: nsh CC#1: We can upload a shell on this .mil CC#3: nsh CC#1: there's lots of pdf documents here CC#3: mmmmm CC#3: download them all Additionally, beginning on or about October 7, 2012 and continuing through October 9, 2012, defendant LOVE and other Co-Conspirators carried out a SQL Injection attack against the Army Corps in Vicksburg, Mississippi to gain unlawful access to nonpublic data from an Army Corps database and steal that data. 13 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 14 of 22 PageID: 27 19. On or about October 7, 2012, defendant LOVE, again using the online moniker "nsh," discussed this hack in an lRC chat. Specifically, defendant LOVE and CC#1 discussed the data that they stole from the Army Corps database, including email addresses of military personnel: CC#1: 400K email log? CC#1: The other army one is almost completely dumped:) nsh: mcee CC#1: Oh CC#1: Wow CC#1: We're going to have 400k emails. nsh: can you grab one email for curiosity nsh: to see who from to about The Plans and Analysis Integration Office Attack ("PAlO") 20. On or about October 9, 2012, defendant LOVE and other Co-Conspirators compromised a computer server owned and operated by PAlO's Research, Development and Engineering Command, located in or around Aberdeen Proving Ground, Maryland by exploiting a vulnerability in the system's Coldfusion platform. The Co-Conspirators unlawfully accessed defense program budgeting data, among other information. 21. On or about the date ofthe hack, defendant LOVE and others discussed the attack in an lRC chat, including the vulnerability in the PAlO's computer system that the CoConspirators exploited. 14 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 15 of 22 PageID: 28 The December 23, 2012 Engineer R&D Center Attack 22. On or about December 23, 2012, defendant LOVE and other Co-Conspirators again attacked a computer server located at the Engineer R&D Center. This intrusion continued through on or about January 2, 2013. 23. As with previous attacks, the Co-Conspirators exploited a vulnerability in the server's ColdFusion platform and to unlawfully access several databases. 24. In executing this attack, the Co-Conspirators used a compromised computer server located in Parsippany, New Jersey, to temporarily store the malware that they then used to carry out the intrusion. The Strategic Studies Institute Attack ("SSI'') 25. On or about January 11, 2013, the Co-Conspirators compromised a server owned and operated by SSI by exploiting a vulnerability in the network's ColdFusion platform. 26. On or about January 11, 2013, defendant LOVE, using the online moniker "peace," discussed this hack in an IRC chat. Among other things, defendant LOVE posted a link to the shell that the Co-Conspirators had used, and could continue to use, to access SSI's server. The Missile Defense Agency ("MDA") 27. In or around October 2012, LOVE and other Co-Conspirators unlawfully accessed a database owned and operated by the MDA by exploiting a vulnerability in the MDA's computer system's Coldfusion platform. The database that the Co-Conspirators compromised stored, among other things, PII of over four thousand individuals. 28. On or about October 9, 2012, defendant LOVE, using the online moniker "nsh," discussed this hack in an IRC chat, including data that the Co-Conspirators stole: nsh: got a list of emails with clearance levels 15 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 16 of 22 PageID: 29 nsh: one table is 4k wordlist nsh: must be codewords nsh: this data only up til 2007 nsh: at least, that table nsh: other tables are update 2012 Defendant LOVE then pasted into the chat log samples of the stolen data, including account user names, email addresses, and telephone numbers of various individuals. The FedCenter 29. On or about January 3, 2012, defendant LOVE and other Co-Conspirators compromised a FedCenter computer server that the EPA-OECA owned and operated, which was located in or around Newark, Delaware. The Co-Conspirators exploited a vulnerability in the system's Coldfusion platform and to unlawfully access and steal hundreds of megabytes of personnel information relating to federal government employees, among others. 30. Defendant LOVE, CC#3 and others coordinated the attack in an IRC chat as it took place, including sharing some of the stolen FedCenter data. LOVE and CC#3 also discussed their use of a "data dumper" to exfiltrate the stolen data: peace: fedcenter. gov CC#3: aight, lemme fix my dumper CC#3: lol peace: :) CC#3: my dumper is ready 16 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 17 of 22 PageID: 30 CC#3: uploaded to fedcenter peace: nice peace: Iemme try CC#3: u try or me? CC#3: seems to me it is working CC#3: in 50min i have 250MB plain text data CC#3: partitial of 2GB National Aeronautics and Space Administration 31. On or about July 10, 2013, defendant LOVE and other Co-Conspirators unlawfully accessed a database owned and operated by NASA by exploiting a vulnerability in the system's Coldfusion platform. The database that the Co-Conspirators compromised stored, among other things, PII of numerous NASA employees. 32. On or about July 10 and July 11,2013, defendant LOVE, using the online moniker "peace," discussed this hack in an IRC chat: peace: lol NASA ... peace: ahaha, we owning lots of nasa sites peace: including nasajobs peace: [CC#2], we own nasa CC#2: he he CC#2: sup a 17 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 18 of 22 PageID: 31 33. peace: like 10 subdomains of nasa.gov :) peace: i think we can do some hilarious stuff with it During these communications, the Co-Conspirators also discussed the importance of concealing their unlawful activities: 34. CC#2: but server must have no link to you or us peace: :) CC#2: when done we kill it CC#2: for this plan CC#2: we can reopen another one for other ongoing stuff CC#2: but once this plan done we need to make sure they cannot all trace it back to us Collectively, the hacks described herein substantially impaired the functioning of dozens of computer servers and resulted in millions of dollars of damages to the Government Victims. All in violation ofTitle 18, United States Code, Section 371. 18 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 19 of 22 PageID: 32 COUNT2 1. The allegations of paragraphs 1 through 5 and 8 through 34 of Count 1 of this Indictment are realleged and incorporated herein. 2. Between on or about December 23, 2012 and January 2, 2013, in Morris County, in the District ofNew Jersey and elsewhere, defendant LAURILOVE, a/k/a "nsh," a!k/a "route," a!k/a "peace" did knowingly and intentionally access a computer without authorization, and exceeded authorized access, and thereby obtained information from a department or agency of the United States, namely, the Engineer R&D Center, the value of which exceeds $5,000, in violation of Title 18, United States Code, Sections 1030(a)(2)(B) and 1030(c)(2)(B)(iii). 19 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 20 of 22 PageID: 33 FORFEITURE ALLEGATION 1. The allegations contained in this Indictment are hereby realleged and incorporated by reference for the purpose of alleging forfeiture pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030(i). 2. Upon conviction ofthe conspiracy offense in violation of Title 18, United States Code, Section 371 set forth in of this Indictment, defendant LAURI LOVE shall forfeit to the United States of America: a. pursuant to Title 18, United States Code, Sections 982(a)(2)(B) and 1030(i), any property, real or personal, constituting, or derived from, proceeds obtained directly or indirectly as a result of such conspiracy offense; and b. pursuant to Title 18, United States Code, Section 1030(i), any personal property that was used or intended to be used to commit or to facilitate the commission of such conspiracy offense. 3. If any of the property described above, as a result of any act or omission of the defendant: a. cannot be located upon the exercise of due diligence; b. has been transferred or sold to, or deposited with, a third party; c. has been placed beyond the jurisdiction of the court; d. has been substantially diminished in value; or e. has been commingled with other property which cannot be divided without difficulty, 20 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 21 of 22 PageID: 34 4. The United States of America shall be entitled to forfeiture of substitute property pursuant to Title 21, United States Code, Section 853(p), as incorporated by Title 18, United States Code, Sections 982(b) and 1030(i). All pursuant to Title 18, United States Code, Sections 982(a)(2)(B), 982(b) and 1030(i), and Title 21, United States Code, Section 853. A TRUE BILL ) / PAUL J. FISHM United States ~~mey 21 Case 2:13-cr-00712-SDW Document 5 Filed 10/23/13 Page 22 of 22 PageID: 35 CASE NUMBER: 13- ~/?-7/j.,~O{,t)) United States District Court District of New Jersey UNITED STATES OF AMERICA v. LAURI LOVE INDICTMENT FOR 18 u.s.c. 371, 1030 & 2 §§ ~==========~======================= PAUL J. FISHMAN U. S. ATTORNEY NEWARK I NEW JERSEY NICHOLAS P. GRIPPO ASSISTANT U.S. ATTORNEY (973) 645-2915