Sentencing delayed for FSB’s email-popping hacker pawn
Sentencing was delayed in the case against Karim Baratov, the hacker who broke into 11,000 email accounts including targeting specific individuals’ email accounts for the Russian intelligence agency FSB.
Baratov, a 23-year-old born in Kazakhstan, pleaded guilty last year to helping hack into Yahoo and Gmail accounts. Prosecutors described Baratov’s actions as directions from Russian intelligence officers Dmitry Dokuchaev and Igor Sushchin to target specific accounts of interest to the FSB.
Dokuchaev paid Baratov to hack into at least 80 email accounts, including that of journalists, lawyers and senior government officials in Russia and its border countries, as well as “prominent leaders in the commercial industries” like banking and transportation, according to court documents. U.S. government officials and tech company employees were also targeted.
Baratov, who was arrested in March 2017 at his adopted home in Canada, argues that he never knew the identities of the people he was working for.
Judge Vince Chhabria began the hearing by saying the government’s sentencing request of eight years struck him as extraordinary and “way out of whack compared to most hackers.” In response, prosecutors argued that the specific targeting of victims is unparalleled and worse than the kind of bulk financial theft seen in federal hacking cases.
Even before 2014, Baratov admits he was paid to hack into over 11,000 email accounts — at a price of as much as $100 eac —- as part of a business he ran from his home in Ontario, Canada. He worked primarily by spearphishing victims so that they mistakenly gave away their username and credentials to Baratov.
The case against Baratov is inextricably linked to the unclear fates of Dokuchaev and his superior, Sergei Mikhailov, who both worked in FSB’s Center for Information Security. Both were arrested in December 2016 by Russia on charges of treason. While Dokuchaev is on the FBI’s most wanted list, the Russians accuse of him and Mikhailov of spying for the United States.
The U.S. government accuses the FSB of playing a major role in hacking aimed at U.S. political institutions, including the Democratic National Committee, during the 2016 election.
Among Baratov’s numerous targets were the email inboxes of a managing director, sales director and researcher at a “prominent Russian cybersecurity company.” The biggest Russian cybersecurity firm by far is Kaspersky Lab, a company facing increasing hostility and possible sanctions from the U.S. for alleged cooperation with Russian intelligence. Kaspersky has steadfastly denied all accusations of wrongdoing.
Another of Baratov’s co-defendants is Alexey Belan, a Latvian native charged with hacking Yahoo in 2014 to compromise over 500 million accounts in what’s become one of the biggest data breaches in history. One of only data breaches that clearly tops that 2014 incident is a separate 2013 breach that compromised over 3 billion accounts and Yahoo’s infrastructure. The FBI says Belan, who is also believed to be responsible for breaches at the U.S. firms Evernote, Scribd and Zappos, has at various times acted as an agent of the FSB, according to the FBI.
Prosecutors in the case against Baratov sought a prison sentence of over seven years (94 months) leading up to Tuesday’s hearing due to “the pressing need to deter international cybercriminals from providing hacker-for-hire services that facilitate additional criminal activity including acts for foreign intelligence services.”
Baratov’s lawyers requested a sentence of over three years (45 months). They insisted he “bore no intent to cause harm” and “sincerely regrets his actions.” The lawyers point to Baratov moving to Canada at 12 and, unable to speak English well, gravitating toward computers. By age 14 he was a hacker-for-hire who eventually built a profitable business.
You can read the full original indictment against Baratov below.
[documentcloud url=”http://www.documentcloud.org/documents/4445990-Baratov.html” responsive=true]
