What happens if you catch a hacker and must deal with the FBI?

After writing an article about a Department of Justice report, stating the FBI focuses on catching kiddie porn perps and many agents lack the know-how to work on national security issues, I was contacted by a man who says he’s worked with the FBI to catch hackers. You might be surprised at how hard it can be for an IT professional to work with the FBI on a hacker case. This is one IT professional’s story. His name is Scott Johnson and this particular story recounts his third time catching a hacker.

For starters, if you work with the FBI, Johnson says don’t expect to get any credit or a public thank you. This case involved a man who hacked into his neighbor’s Wi-Fi and attempted to frame his neighbor, a lawyer, by e-mailing child porn to the neighbor’s co-workers as well as sending threats to elected officials.

Johnson, a private IT contractor with over 30 years experience, recounts:  “In the beginning of the case I was hired by the neighbor’s law firm to find out if he [the innocent neighbor] was the one to blame. There had been a couple of emails sent out at this point and if he had flipped out, the law firm wanted to cut ties with him as fast as possible. I was able to quickly prove that it was not likely the partner in the law firm sending the emails.  I also saw that whomever was doing this was also making some fairly big mistakes. If they continued down this path I would have a good chance to catch them. We also had a great honey pot at this time since the hacker felt comfortable using this connection to send the emails.”

Because the hacker seemed to want to get the neighbor into trouble, Johnson didn’t stop the activity immediately. “If we had locked things down at this point the hacker probably would have tried other ways to get at him and the chances of nailing him would be greatly minimized so I proposed watching the traffic for a while.” Johnson says that the FBI agents weren’t happy at that thought and let Johnson know, he says. After an unpleasant exchange with the agents, Johnson began to realize that they didn’t understand networking technology well enough to understand how Johnson was proposing to catch the hacker. “What I did wasn’t rocket science, anyone that understands how information travels from point A to B could have done what I did.”

The honeypot method was successful, and the hacker was arrested and later, indicted. Johnson offered to help the FBI with more cases. He didn’t get the open-armed response he had hoped for and a conversation with the agents lead him to believe that the FBI was rejecting his offer to become a contractor because he was older than 40.

Johnson said, “You don’t, and can’t, get my level of knowledge in college or classes. You get it over a long period of time working with the systems.”

The experience left him feeling that the FBI Department of Cyberterrorism isn’t prepared to do its part to prevent a sophisticated cyber attack. “When I hear about our power plants, the military, and NASA getting hacked I’m not surprised whatsoever,” he says. “They can write up success after success because these people are typically not that sophisticated and the data is easily gathered with the pre-canned utilities that they have been provided and trained on.”

Johnson also notes that he wasn’t mentioned in the FBI press release and felt the lack of public acknowledgement for the part he played was a “slap in the face.” He now feels that he should speak out and express his concerns that the Cyberterrorism unit isn’t staffed with a high enough level of expertise in the hope that the situation will improve. “We need seasoned IT pros to protect us and the really good people work in the private sector. They need to find a way to tap into the experts that have the knowledge to protect us.”

After conversing with Johnson, I came to believe that working with the FBI to catch a hacker is not all sunshine and chocolate roses. When we contacted the public affairs officer listed on one of the press releases involving this case, Jeanne Cooney from the U.S. Attorney’s Office responded, “The FBI is a federal investigative agency. When they find evidence of federal criminal wrongdoing, they refer the case to us for prosecution. Even though we are not the investigative agency, I can tell you that federal law enforcement (the FBI and our office among them) are prohibited from talking about the details of any investigation, including who made or might of made statements.”

Like this? Here’s more posts:

• Microsoft Approves Cybersecurity Plan, PC Health Certificate Plan Gains Support
• PBS hacked by LulzSec: Lulz Boat Sailed, PBS Failed
• IE Flaw Could Allow Hackers Access to your Facebook, Gmail, Twitter Accounts
• ‘Secret Law’ of Patriot Act: Geolocation Tracking & Domestic Spying on Steroids?
• Having private parts is not probable cause for TSA to grope or body scan you
• FaceNiff Android App Allows the Clueless to Hack Facebook in Seconds Over Wi-Fi
• American Express Call Centers Open Door for Warrantless Surveillance by Gov’t?
• Former FBI Agent Turned ACLU Attorney: Feds Routinely Spy on Citizens
• Microsoft’s automated Future Home, what can go wrong?

Follow me on Twitter @PrivacyFanatic