International Effort Busts Phone Hacking Ring

Stolen Service Valued at $55 Million, Some Money May Have Been Used to Fund Terrorism

A federal grand jury in New Jersey has indicted a group of people for allegedly breaking into the phone systems of more than 2,500 firms in the U.S., Canada, Australia and Europe in order to route calls through the hacked networks.

In conjunction with the indictment, Italian law enforcement conducted searches of approximately 10 locations in four regions of Italy and arrested the financiers of the hacking activity. Five individuals, all Pakistanis, were arrested.

From about October 2005 through December 2008, the hackers sold telephone service to customers of call centers and then placed the calls over the compromised networks. According to the indictment, the hackers stole 12 million minutes of telephone service, valued at $55 million. Italian news reports said some of the money was used to fund terrorist activities, but the indictment and the U.S. Attorney’s office could not confirm that.

According to the indictment, the group used a “brute force attack” – breaking computer codes by systematically attempting a large number of telephone extensions and corresponding passcodes in the hope that eventually the proper combination would be used.

The hackers used a combination of “loop-back” and “passcode” methods.

In the loopback method, the hackers and their clients would place a phone call into a hacked telephone system and then used the hacked system to dial back to a second number that the hackers controlled, resulting in the call being charged to the hacked system. The hackers then manipulated the compromised system to place calls to third parties while maintaining an open phone line, causing the company that owned the hacked system to incur the full cost of the call.

In the passcode method, the hackers and their clients would place a call through the hacked system and then - using the passcode stolen via the brute force attack - manipulate the hacked system to dial codes to third parties located in dialing areas with significantly more expensive dialing rates than those of the initial calls placed to the hacked system.

The hackers would still pay their own long distance carriers for the initial calls, but the rate for those calls would be far less than the rates to the ultimate call destination. The higher rate was charged to the owners of the hacked systems.

The indictment alleges that three hackers, Mahomoud Nusier, 40, Paul Michael Kwan, 47, and Nancy Gomez, 24, all residents of the Philippines, were working in conjunction with call centers in Italy and Spain. Unlike in the U.S., where call centers are predominantly used by large companies to field customer service and other calls, in Italy there are call centers that provide the public with local and long-distance service in addition to the more well-known corporate call centers.

Whatever method was used, the hackers would transmit the hacked numbers, extensions and passcodes to operators at the Bresica call center, who would then wire payments to the hackers via Western Union, Ria Financial Systems and MoneyGram. The hackers – Nusier, Kwan, Gomez and others – were then paid approximately $100 per hacked telephone system.

The Brescia call center operators, in turn, transmitted the hacked phone numbers, extensions and passcodes to operators of other call centers, including Spain, in return for payment.

“This was an extensive and well-organized criminal network that worked across continents,” said Ralph J. Marra, Jr.,  acting U.S. Attorney for New Jersey, whose office handled the case. “The hackers we’ve charged enabled their conspirators in Italy and elsewhere to steal large amounts of telecommunications capacity, which could then be used to further or finance just about any sort of nefarious activity here or overseas.”

The defendants face maximum prison sentences of five years on the conspiracy count, five years on each of the two respective unauthorized computer access counts, and 10 additional years on the access device count. In addition, each is subject to a maximum fine of $250,000 on each count for which they are named, or twice the gain resulting from the offense, whichever is greater.