Canadian Mounties nab "MafiaBoy"

By Brian Sullivan
Computerworld, 04/19/00

A 15-year-old hacker from Montreal, known as MafiaBoy, was charged in connection with February's denial-of-service attacks, which struck well-known Web sites such as CNN.com, Yahoo Inc., eBay Inc., Amazon.com Inc., Excite Inc. and ETrade Group Inc.

The statement was made by the Royal Canadian Mounted Police (RCMP) this afternoon.

The boy was arrested Saturday, April 15, and charged in Canadian juvenile court with two counts of data mischief for the attacks against Atlanta-based Cable News Network's Web sites. Under Canadian law, the boy's name has been withheld.

The arrest followed a joint investigation by the RCMP's Computer Investigation and Support Unit , the FBI's National Infrastructure Protection Center and the U.S. Department of Justice.

"International cooperation is fundamentally vital to success against this new criminal phenomenon," said FBI Agent Bill Lynn, who is the assistant legal attache in Canada. "The arrest being announced here once again demonstrates not only the skill of the RCMP investigators but also the unparalleled commitment to the Canadian/U.S. partnership against cybercrime."

The RCMP said the boy strung together a series of slave computers and used them to send vast amounts of data to the CNN site - and more than 1,200 other sites CNN hosts worldwide - for more than four hours on Feb. 8. The RMCP charged that those attacks caused the CNN system to fail.

In February, two California security analysts, working with the FBI, said they believed that the attack was made through a hole in the WU-FTP file exchange software at the University of California, Santa Barbara.

Investigators said that as early as Feb. 15, they had identified MafiaBoy's home, but they didn't specifically identify the 15-year-old as MafiaBoy until two weeks later. Police made that discovery by analyzing the records of Internet Direct Business Solutions, a Canadian Internet service provider based in Toronto.

In addition to the cybertracks the boy left, he evidently also helped investigators track him down by repeatedly going on Internet Relay Chat forums and bragging that he launched the attacks.

Under Canadian law, a conviction for a count of data mischief can carry a sentence of up to 10 years in prison. In addition, if it can be proved that the attacks endangered people's lives, the sentence could be life in prison.

A Canadian judge has ordered that boy be confined to his home and be accompanied by an adult as part of his bail conditions. In addition, the boy is forbidden to go near a computer, a library, a university or anyplace that sells online services, computers or computer parts.

An RCMP spokesman said the investigation is ongoing and additional charges and arrests may be made at a later date.

DeWayne Lehman contributed to this report.