

Ask HN: I was the victim of a targeted cybercrime and found the perpetrator - whitehat2k9

I'm a student at the University of Chicago. On May 29, 2013, a large number of people on campus (including faculty) received several unsolicited emails claiming to be from me, asking them to visit the website http://UChicagoAnon.com (now down.) At least one faculty member directly complained to me, claiming that she had encountered sexual content. These emails were sent through MailChimp, and signed with my name in an attempt to impersonate me. Thankfully MailChimp has shut down the account involved.<p>Through some sleuthing I was able to determine from WHOIS / DNS records who runs the server running UChicagoAnon.com. This person lives in East Brunswick, New Jersey. I was able to make contact with said person on Facebook, where he admitted to running the server but claimed that a friend of his with access to the server is responsible for the emails and the website. Of course, I am unable to verify any of these claims myself.<p>I've already filed a report with the local university police department (unable to follow up due to jurisdiction), and I've also tried to follow up with the East Brunswick PD, but they refuse to file reports over the phone. Finally, I've also reported the incident through http://ic3.gov.<p>What are my options at this point? Right now I've only been playing defense, and I'd like to go on the offensive and go after this guy to make sure this doesn't happen again. Is there anyone else I can contact? Needless to say, this is very frustrating since I have a name, address, and phone number that can be investigated, but it seems that most agencies in the United States are reluctant to investigate cybercrimes.
======
thesmileyone
<http://www.justice.gov/criminal/cybercrime/reporting.html#C4> \- FBI Local
Office \- US. Secret Service (can't see how much use they would be for this \-
Internet Crime Complaint Centre

Also, a lot of detailed information on the relative departments here
<http://listcrime.com/reportcybercrime.html>

------
gregcohn
You could sue the guy for damages, if you believe there are some that would be
valued by a court.

~~~
tptacek
I agree, civil suit seems like the way to go here. If I can ever kick in a
couple bucks to help you make this happen, let me know!

~~~
whitehat2k9
How do I go about filing a civil suit? I'm sure I can "google it" but I'd like
to hear more from someone who knows what they're talking about.

~~~
tptacek
I have filed one suit, a landlord-tenant dispute. I found a local lawyer,
almost literally from the yellow pages, showed up for a consult, and then paid
them to file the suit.

The best next step here would be to ask people for recommendations for a
lawyer to pursue the case. What you'll learn is that different lawyers handle
different kinds of things; most lawyers do things like contract review or
mergers and not litigation.

If you have any kind of rapport with any lawyer, they should be able to refer
you to someone.

When you talk to the lawyer, you should make it clear that your interest in
the case is in stopping ongoing fraud and abuse, and not in getting any kind
of payout, because otherwise lawyers will probably be at pains to tell you how
your case isn't lucrative. But of course that's not the point!

There are a couple really smart lawyers (and hackers with legal training) on
HN who might be able to recommend people to talk to.

From my very limited experiences with law enforcement: they are overwhelmed
and unlikely to pursue a case in which no clear damages occurred. But the same
thing is not true of civil litigators!

------
nickff
Have you tried reporting this to the FBI? It seems like this would fall under
interstate fraud; though I am not sure if this damage is sufficient to provoke
an investigation.

