A gang of hackers has been sentenced following a string of high-profile attacks

16 May 2013

Ryan Cleary

Four British men involved in a string of cyber attacks on high-profile organisations in the UK and US have been jailed today, 16 May, following a joint operation by the MPS Police Central e-Crime Unit and FBI.

Southwark Crown Court heard how [A] Ryan Cleary, [B] Mustafa Al-Bassam, [C] Jake Davis and [E] Ryan Ackroyd - all members of hacking group Anonymous - met online and created offshoot group LulzSec with a fifth man living in the US and a number of other unidentified people. All appeared at court on bail, except for Cleary who appeared in custody.

Together they launched a series of hacking and "distributed denial of service" (DDoS) attacks. DDoS attacks involve often thousands of malware-infected computers simultaneously sending countless requests to a single computer hosting a website, so that it is overloaded and is effectively removed from the web. Their hacks usually involved confidential data being extracted and published online for others to access.

While [E] Ackroyd was responsible for researching and executing many of their hacks, [A] Cleary assisted by allowing the use of his Botnet - a system of malware-infected computers he controlled - to coordinate DDoS attacks. [B] Al-Bassam assisted in discovering and exploiting online vulnerabilities, and also created and controlled LulzSec's website. [C] Davis was their spokesperson, managing their Twitter account and press releases.

Their first victim was a major security firm in the US, whose website pages they replaced with their own. They also accessed personal email accounts of employees, extracting personal data which they published online between 4 February and 6 February 2011. Subsequently, the firm was dissolved.

Over the next five months, they carried out hacks and DDoS attacks on organisations causing significant reputational damage and financial loss estimated to be in excess of £20 million. The prosecution also argued that they put lives at risk when they extracted and published the names and contact details of employees of a police force in the US.

On 20 June officers from the MPS PCeU arrested Cleary at his home address, where they found him mid-DDoS attack on SOCA's website. They seized numerous pieces of equipment, including Cleary's computer - a subsequent forensic examination of which uncovered indecent images of children.

Just five days later, the group announced their disbandment via a press release on their website. However, on 18 July the remaining members, excluding Al-Bassam and Cleary, regrouped to launch an attack on a UK newspaper's website. They re-directed users to a fake article - written by Davis - claiming that News International's Rupert Murdoch had died.

Al-Bassam was arrested on 19 July, Davis was arrested on 27 July and Ackroyd was arrested on 1 September. All four members subsequently pleaded guilty and were today sentenced as follows:

[A] Ryan Cleary (16.11.91 - 21 ys) of South Beech Avenue, Wickford, Essex was sentenced to 32 months for:

= Two counts of Unauthorised acts with intent to impair the operation of a computer
= Supplying articles for use in an offence under the Computer Misuse Act
= Two counts of conspiracy to do an unauthorised act with intent to impair the operation of a computer
= Causing a computer to perform a function with intent to secure unauthorised access to computer material

He was also issued with a serious crime prevention order for five years.

He was found not guilty of two counts of encouraging or assisting offences at the direction of the judge.

[B] Mustafa Al-Bassam (03.01.95 - 18ys) of Peckham Park Road, SE15, was given a 20-month suspended sentence, 300 hours unpaid work and a six-month supervision order for:

= Two counts of conspiracy to do an unauthorised act with intent to impair the operation of a computer

He will be subject to a five-year serious crime prevention order, with the details to be determined at a later date.

He was found not guilty of two counts of encouraging or assisting offences at the direction of the judge.

[C] Jake Davis (16.10.92 - 20ys) of Hoofields, Lerwick, Shetland, was sentenced to 24 months in a young offenders institiute for:

= Two counts of conspiracy to do an unauthorised act with intent to impair the operation of a computer.

He is subject to a five-year serious crime prevention order.

He was found not guilty of two counts of encouraging or assisting offences at the direction of the judge.

[E] Ryan Ackroyd (30.01.87 - 26ys) Oak Road, Mexborough, Doncaster was sentenced to 30 months for:

= Conspiracy to do an unauthorised act with intent to impair the operation of a computer x 1

He was found not guilty of two counts of encouraging or assisting offences and one count of conspiracy to do unauthorised acts with intent to impair the operations of a computer, at the direction of the judge.

Detective Superintendent Charlie McMurdie, head of the Police Central e-Crime Unit, said: "This has been a long and complex investigation conducted with the assistance of our international partners. After initially being alerted by the FBI to criminal activity on British soil, we came to arrest Ryan Cleary and quickly began unpicking LulzSec, who had been running riot, causing significant harm to businesses and people.

"Theirs was an unusual campaign in that it was more about promoting their own criminal behaviour than any form of personal financial profit. In essence, they were the worst sort of vandal - acting without care of cost or harm to those they affected, whether that was to cause a company to fold and so costing people their jobs, or to put at threat the thousands of innocent internet users whose logins and passwords they made public. In the case of the police force whose employee details they revealed, the group's reckless publication of confidential material could very well have threatened lives.

"They claimed to be doing it for 'a laugh' but real people were affected by their actions. Today's convictions should serve as a deterrent to others who use the internet to commit cyber attacks."

+ [A] Cleary pleaded guilty to two counts of making indecent images of children and one count of possession of indecent images of children, for which he will be sentenced at Southwark Crown Court on 12 June.

+ Three others - [D/F/G] - were arrested and later released with no further action.