DOJ indicts 7 Iranians for hacking U.S. dam, banks

The Justice Department on March 24 announced the indictment of seven Iranian hackers for attacking several U.S. banks and accessing a computer at a New York dam.

The hackers did the bidding of the Iranian government, including the Islamic Revolutionary Guard Corps, while employed for two Iran-based computer firms, ITSecTeam and Mersad Co., DOJ alleged.

The relentless distributed denial of service attacks against U.S. banks began around December 2011 and intensified in September 2012, U.S. authorities said. At its height, the DDOS campaign disrupted online access for hundreds of thousands of bank customers, according to DOJ. Bank of America and JPMorgan Chase were among those hit, according to multiple news reports.

The alleged breach of a computer at a Rye, N.Y., dam took place in 2013, but was made public only in late 2015, reviving longstanding concerns about the vulnerability of such systems.

The defendants "intended New York to be the epicenter of harm because New York is the financial capital of the world," Preet Bharara, U.S. attorney of the Southern District of New York, said in a press conference.

The Iranian indictments are part of a concerted campaign by the Obama administration to deter nation-state backed hacking of U.S. assets, even if there is slim chance a given hacker will be extradited to the United States to face charges. Attorney General Loretta Lynch and FBI Director James Comey were also at the press conference as a public show of resolve.

The charges are perhaps the most momentous U.S. action against foreign hackers since DOJ charged five members of China's People's Liberation Army in May 2014, the first such state-backed espionage charges brought by the department.

"When there is no penalty, there's no motive to stop," James Lewis, senior fellow at the Center for Strategic and International Studies, told FCW. "DOJ is trying to motivate our opponents to realize that attacking the U.S. is no longer penalty-free," he said, adding, "we should have done this long ago."    

When asked about the efficacy of bringing charges against hackers who are very unlikely to be extradited, Lynch said, "We do not let that be a barrier to bringing the charges."

"It is so important to let the world know that we are aware of their actions," she added.

Robert M. Lee, an industrial control systems security expert, credited DOJ for talking about the issue publicly, but said some of the indictment's details on the New York dam were inaccurate, highlighting the "technical deficiencies of the government bureaucratic process."

Lee, who has studied the breach in detail, contested DOJ's claim that the dam had a supervisory control and data acquisition system, and the department's assertion that the Iranian hacker behind that attack would have had the ability to manipulate the dam's water level.

Geopolitical tussle

Cyberspace has in recent years played a consistently prominent role in the geopolitical tussle between Iran and the United States.

Among those freed in a January prisoner swap was an Iranian hacker accused of breaching a Vermont-based defense firm to steal software. Iranian hackers have also broken into the email and social media accounts of State Department officials focused on the Middle East, according to a New York Times report.

Washington, meanwhile, has reportedly conducted its own computer operations against Iran by working with Israel to develop the Stuxnet worm to destroy centrifuges used in Iran's nuclear program, according to multiple news reports.

The indictments come a day after a Chinese national pleaded guilty to conspiracy to stealing data related to U.S. military fighter jets and a Boeing Co.-made transport aircraft.

The indictments serve "as a warning to U.S. companies and individuals that the threats we face online are pervasive and potentially devastating," said Rep. Adam Schiff (D-Calif.), ranking member of the House Permanent Select Committee on Intelligence.