[ISN] Suit filed against unknown computer hacker

[InfoSec News]

http://www.ecnnews.com/cgi-bin/15/etstory.pl?-sec-News+fn-computersuit.0115

By Stephanie Akin 
Staff Writer 
January 16, 2006 

NORTH ANDOVER - A North Andover businessman is suing someone he says
hacked into his e-mail account and sent defamatory messages to his
personal and business associates.

John Schroeder, president of the North Andover software company Ontar
Corp., says in the suit that the e-mails held up a contract with the
U.S. Navy and prompted his daughter's middle school teacher to report
him to North Andover police.

But the only clue he has on the identity of the hacker is the number
the hacker's computer left behind when he or she sent the e-mails.  
Since Schroeder does not know the identity of the defendant, the case
is filed against "John or Jane Doe."

Experts on computer crimes said the case draws into focus a growing
legal and academic debate about how far the legal system can go to
investigate computer fraud and how well a computer can protect a
person's privacy.

Schroeder declined comment on the suit. But in documents filed at
Essex County Superior Court, his lawyers called the e-mails "extreme
and outrageous, beyond all possible bounds of decency, and utterly
intolerable in a civilized community."

Schroeder's first indication that someone was breaking into his
accounts came last summer when two employees asked about e-mails he
had not sent to them. About three months later, Schroeder was
considering two candidates for the same job. When Schroeder sent an
e-mail to offer the position to one of them, the hacker sent an
identical e-mail to the other, court documents say.

The e-mails then became more malicious. In December, a representative
from the Naval Warfare Center called and e-mailed Schroeder to tell
him Ontar, based at 9 Village Way, had won a contract to provide
software to train Navy pilots.

The next day, Sam Napier, a representative from the center, e-mailed
Schroeder in response to an e-mail sent from Schroeder's business
account.

"I'm not sure what to make of this," he wrote. "Is someone in your
computer messing around?"

Napier attached a copy of the e-mail signed by Schroeder.

"We are still in shock that you would select us for Phase II award,"  
the e-mail read in part, "considering how much we lie, cheat and try
to steal from the government."

The same day Schroeder received the e-mail about the Navy contract,
North Andover police told him they were investigating an e-mail sent
from his America Online account to his daughter's teacher at North
Andover Middle School.

North Andover police Detective Lt. Paul J. Gallagher said the case was
originally assigned to an investigator in charge of sexual assault
before it was moved to the computer crimes unit.

Schroeder's suit asks the defendant to pay for unspecified losses he
and Ontar suffered because of the e-mails, including the costs of a
lost or delayed contract from the Naval Warfare Center, which has
asked Ontar to secure its computer system before finalizing the deal.

Experts in computer law say lawsuits against anonymous Internet users
can also force Internet service providers to cooperate with an
investigation.

Police told Schroeder that all the suspect e-mails sent from his
accounts came from the same computer, a computer registered with the
Internet service provider Comcast that left the same 10-digit Internet
address behind every time it hacked into Schroeder's accounts. The
computer's user breached Ontar's system throughout 2005, opening and
sometimes deleting, and replying to and forwarding Schroeder's
messages.

Gallagher said North Andover police are still investigating and he
could not comment on the case.

John Palfrey, professor of Internet law at Harvard Law School and
executive director of the Berkman Center for Internet & Society at
Harvard, a think tank that studies Internet law, said lawsuits against
anonymous or pseudonymous Internet users became popular about 2002
when the entertainment industry started using them to try to prosecute
people pirating music and videos online.

Palfrey said the cases have become so common that lawyers refer to
them as "John Doe" lawsuits. Palfrey said Schroeder's suit sounds like
one of the more straightforward John Doe cases because the person
Schroeder said hacked into his account clearly defamed him.