Utah law agencies say January attacks on websites cost them $180K
An alleged computer hacker facing federal charges for tampering with two law enforcement websites wants proof it cost the agencies nearly $180,000 to bring the systems back online.
In court documents newly filed in U.S. District Court, John Anthony Borell III claims he had to hire an expert witness to evaluate the financial loss claims because of the slim evidence provided by Salt Lake Police Department and the Utah Chiefs of Police Association.
"The defense's expert has indicated that the claimed loss amounts are excessive but cannot form an opinion of what reasonable loss amounts would be without further information," Borell states. He is being represented by the Federal Public Defender's Office.
Borell allegedly hacked into the Salt Lake Police Department and the Utah Chiefs of Police Association websites in January. An indictment alleges he publicly posted confidential information about informants and police officers after breaking into the department's online tip system. He also allegedly posted private information about police chiefs on the association's website.
Prosecutors say Borell was associated with a group of hacker activists known collectively as "Anonymous" who targeted law enforcement agency websites.
The FBI arrested Borell in his hometown of Toledo, Ohio, in March after tracking him through the Twitter account he used to boast about hacking into the two accounts.
The association's website came back online within a few days; the Salt Lake City Police Department relaunched its site in April, nearly three months after the cyberattack.
Borell pleaded not guilty to two counts of computer intrusion in April. He is set for a 10-day jury trial in January.
Salt Lake City Police provided a single-page sheet to show the financial expense it incurred after the attack; that shows some 38 different employees spent a total of 383.25 hours, at the rate of $77.42 per hour, to bring the website back in service. The association provided 12 pages of weekly time sheets indicating hours spent to restore its site and monitor security.
In a letter to the agencies and in a court document, Borell's attorney says loss amounts should be limited to restoring the websites to their original condition, not to make them more secure or, as billed by the chief's association, for "reputation control."
Assistant federal defender Jamie Zenger said in one filing that the agencies have ignored requests for more detailed information, including about what work the department's staff did over the 400 hours claimed and the basis for the hourly rate charged. He wants the association to detail, among other things, what staff did during the "security audits," "online support" and "telephone support" for which it is billing.
In the event Borell is convicted, he faces a maximum penalty of 10 years on each count and a maximum fine of $500,000. The loss amounts will be crucial in determining his sentence and how much restitution he must pay, a court document states.