Acting Assistant Attorney General Mary McCord (center), accompanied by U.S. Attorney for the Northern District Brian Stretch (left) and FBI Executive Director Paul Abbate, speaks during a news conference at the Justice Department in Washington on Wednesday, March 15. (AP Photo/Susan Walsh)

Acting Assistant Attorney General Mary McCord (center), accompanied by U.S. Attorney for the Northern District Brian Stretch (left) and FBI Executive Director Paul Abbate, speaks during a news conference at the Justice Department in Washington on Wednesday, March 15. (AP Photo/Susan Walsh)

US charging Russian spies and hackers in Yahoo intrusion

By Ellen Nakashima / The Washington Post

WASHINGTON — The Justice Department is set to announce Wednesday the indictments of two Russian spies and two criminal hackers in connection with the heist of 500 million Yahoo user accounts in 2014, marking the first U.S. criminal cyber charges ever against Russian government officials.

The indictments target two members of the Russian intelligence agency FSB, and two hackers hired by the Russians.

The charges include hacking, wire fraud, trade secret theft and economic espionage, according to officials, who spoke on the condition of anonymity because the charges have not yet been announced. The indictments are part of the largest hacking case brought by the United States.

The charges are unrelated to the hacking of the Democratic National Committee and the FBI’s investigation of Russian interference in the 2016 presidential campaign. But the move reflects the U.S. government’s increasing desire to hold foreign governments accountable for malicious acts in cyberspace.

The FBI and the Justice Department declined to comment.

The United States does not have an extradition treaty with Russia, but officials have said that taking steps such as charges and imposing sanctions can have a deterrent effect. People also sometimes slip up and travel to a country that is able and willing to transfer them to the United States for prosecution.

Yahoo reported the 2014 hack last fall — in what was then considered the largest data breach in history. The firm later disclosed another intrusion affecting more than 1 billion user accounts in 2013, far surpassing the 2014 event. Officials have not determined whether there is a link between the two.

The twin hacks clouded the prospects for the sale of Yahoo’s core business to telecommunications giant Verizon. The deal is proceeding after Verizon negotiated the price down in the wake of the data breaches.

The compromised accounts may have affected more than just email. Breaking into a Yahoo account would give the hackers access to a user’s activity on Flickr, Tumblr, fantasy sports and other Yahoo applications.

In the 2014 hack, the FSB — Russia’s Federal Security Service, and a successor to the KGB — sought the information for intelligence purposes, targeting journalists, dissidents and U.S. government officials, but allowed the criminal hackers to use the email cache for the officials’ and the hackers’ financial gain, through spamming and other operations.

The charges “illustrate the murky world of Russian intel services using criminal hackers in a wide variety of ways,” said Milan Patel, a former FBI Cyber Division supervisory special agent who is now a managing director at K2 Intelligence, a cyber firm.

Although FBI agents have long suspected that the Russians have used cyber mercenaries to do their work, this case is among the first in which evidence is offered to show that.

The indicted FSB officers are Dmitry Dokuchaev and Igor Sushchin, his superior. Particularly galling to U.S. officials is that the men worked for the cyber investigative arm of the FSB — a rough equivalent of the FBI’s Cyber Division. That the agency that is supposed to investigate computer intrusions Russia is engaged in hacking is “pretty sad,” one official said.

Dokuchaev, whose hacker alias was “Forb,” was arrested in December in Moscow, according to the news agency Interfax, on charges of state treason for passing information to the CIA. He had reportedly agreed to work for the FSB to avoid prosecution for bank card fraud.

Another man indicted in the case is Alexsey Belan, who is on the most-wanted cyber list and has been charged twice before, in connection with intrusions into three major tech firms in Nevada and California in 2012 and 2013. He was in custody in Greece for a time, but made his way back to Russia, where he is being protected by authorities, officials said.

The other hacker-for-hire is Karim Baratov, who was born in Kazakhstan but has Canadian citizenship. He was arrested in Canada on Tuesday.

The indictments grew out of a nearly two-year investigation by the San Francisco FBI with the aid of international law enforcement, officials said. Sanctions and criminal charges are two tools that the Obama administration began using to punish and deter nation state hackers.

“They have the effect of galvanizing other countries that are watching what’s happening,” said Luke Dembosky, a former deputy assistant attorney general for national security. “They show that we have the resources and capabilities to identify the people at the keyboard, even in the most sophisticated cases.”

Three years ago, the United States brought charges against five Chinese military hackers for economic espionage, marking the first time cyber-related charges were levied against foreign government officials.

After the Chinese military hackers were indicted, officials said their activity seemed to dwindle. And the indictments, Dembosky said, helped wrest a pledge in 2015 from the Chinese to stop economic cyber espionage against U.S. firms.

In early 2015, the Obama administration imposed economic sanctions on North Korea for its cyber attack on Sony Pictures’ systems.

And in late December, the Obama administration levied economic sanctions on Moscow for its election-year meddling. At the same time, the government sanctioned two Russian criminal hackers with no apparent connection to the Kremlin’s interference campaign. They included Belan, who is one of the four indicted in the Yahoo case.

The Washington Post’s Brian Fung contributed to this report.

Talk to us

> Give us your news tips.

> Send us a letter to the editor.

> More Herald contact information.

More in Local News

Kim Skarda points at her home on a map on Thursday, June 20, 2024 in Concrete, Washington. A community called Sauk River Estates has a very steep slope above it. There is a DNR-approved timber sale that boarders the estate properties, yet they were not consulted about the sale before approval. The community has already appealed the sale and has hired their own geologist to conduct a slope stability report at the site. (Annie Barker / The Herald)
Beneath steep slope, Concrete neighbors fear landslides from logging above

Nielsen Brothers plans to cut 54 acres of timber directly behind the community of 83 homes. Locals said they were never consulted.

Law enforcement respond to a person hit by a train near the Port of Everett Mount Baker Terminal on Thursday, June 27, 2024 in Mukilteo, Washington. (Annie Barker / The Herald)
2 killed in waterfront train crashes were near Mukilteo ‘quiet zone’

In June, two people were hit by trains on separate days near Mukilteo Boulevard. “These situations are incredibly tragic,” Everett’s mayor said.

Rob Plotnikoff takes a measurement as a part of the county's State of Our Waters survey at Tambark Creek in Bothell, Washington on Monday, July 1, 2024. (Annie Barker / The Herald)
Snohomish County stream team bushwhacks a path to healthier waterways

This summer, the crew of three will survey 40 sites for the State of Our Waters program. It’s science in locals’ backyards.

Logo for news use featuring the municipality of Mountlake Terrace in Snohomish County, Washington. 220118
4th suspect arrested after Mountlake Terrace home robbery

Police arrested Taievion Rogers, 19, on Tuesday. Prosecutors charged his three alleged accomplices in April.

A 10 acre parcel off of Highway 99, between 240th and 242nd Street Southwest that the city of Edmonds is currently in the process of acquiring on Monday, July 10, 2023 in Edmonds, Washington. (Olivia Vanni / The Herald)
Edmonds ditches $37M Landmark public park project off Highway 99

The previous mayor envisioned parks and more in south Edmonds, in a historically neglected area. The new administration is battling budget woes.

Edmonds school official sworn in as Mount Vernon supe

Victor Vergara took his oath of office last week. He was assistant superintendent of equity and student success in Edmonds.

A photo of "Tazz," an Argentine white Tegu still missing near Granite Falls. (Provided photo)
Tazz the missing tegu reunited with owner in Granite Falls

The 4-foot lizard went missing Friday evening. Searchers located him in a barn, 1 mile away from his home.

A closing sign hangs above the entrance of the Big Lots at Evergreen and Madison on Monday, July 22, 2024, in Everett, Washington. (Ryan Berry / The Herald)
Big Lots announces it will shutter Everett and Lynnwood stores

The Marysville store will remain open for now. The retailer reported declining sales in the first quarter of the year.

President Joe Biden speaks at North Carolina Agricultural and Technical State University, in Greensboro, N.C., on April 14, 2022. Biden plans to nominate Michael Barr  to be the Federal Reserve's vice chairman of supervision. The selection of Barr comes after Biden's first choice for the Fed post, Sarah Bloom Raskin, withdrew her nomination a month ago (AP Photo/Carolyn Kaster)
Washington Democrats voice support for Biden’s decision to drop out of presidential race

Some quickly endorsed Vice President Kamala Harris to replace him on the ballot.

Everett
Teenager in stable condition after Everett drive-by shooting Saturday

Major Crime Unit detectives were looking for two suspects believed to have shot the teenager in the 600 block of 124th Street SW.

Miners Complex tops 500 acres in Mount Baker-Snoqualmie National Forest.

Nine lightning-caused fires force trail closures and warnings 21 miles east of Darrington. No homes are threatened.

FILE — President Joe Biden arrives for a Medal of Honor ceremony in the East Room of the White House in Washington, July 3, 2024. Biden abandoned his campaign for a second term under intense pressure from fellow Democrats on Sunday, July 21, upending the race for the White House in a dramatic last-minute bid to find a new candidate who can stop former President Donald Trump from returning to the White House. (Doug Mills/The New York Times)
Biden drops out of race, endorses vice president Kamala Harris

The president announced the decision on social media Sunday.

Support local journalism

If you value local news, make a gift now to support the trusted journalism you get in The Daily Herald. Donations processed in this system are not tax deductible.