A 20-year-old Kosovar hacker pleaded guilty in U.S. federal court on June 15 to providing material support to the Islamic State terrorist group by hacking into a U.S. company's networks and releasing names, address and financial information on hundreds of government employees and active military personnel.
Ardit Ferizi — who goes by the handle Th3Dir3ctorY online — admitted to providing the stolen information to the terrorist organization with the understanding it would be used to harm federal employees feds and servicemembers, in both the virtual and physical realms.
According to the Department of Justice, Ferizi offered ISIS the hacked data "with the understanding that ISIL would use the [personally identifiable information] to 'hit them hard.'"
Assistant Attorney General John Carlin noted this is the first time a hacker has been prosecuted on charges of terrorism.
"Ferizi admitted to stealing the personally identifiable information of over 1,000 U.S. servicemembers and federal employees and providing it to [ISIS] with the understanding that they would incite terrorist attacks against those individuals," he said after the guilty plea was entered. "The case against Ferizi is the first of its kind, representing the nexus of the terror and cyber threats."
According to the indictment unsealed in October, Ferizi hacked into an online retailer's database in June 2015 and stole records on more than 100,000 customers. From those records, he was able to cull personally identifiable information on 1,351 federal employees and active military personnel.
Ferizi provided this information to members of ISIS in August, who then posted the information online with a call for members to take action against those people, including perpetrating fraud using their personal information, as well as physical attacks.
A 30-page document posted online in August was accompanied by the following message:
We have your names and addresses. We are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands.
Federal investigators were able to follow a digital trail linking Ferizi with known terrorist Tariq Hamayun and two Arizona men who attempted an attack on attendees at the "Draw Mohammad Contest" held in Garland, Texas, in May 2015. Investigators leveraged this into an indictment, leading Malaysian officials to arrest Ferizi and extradite him to the U.S.
"This case demonstrates the importance of strong partnerships with law enforcement agencies worldwide," said FBI Special Agent in Charge Michelle Klimt. "Cybercrime knows no boundaries and our efforts to dismantle these operations would be impossible without international collaboration."
Ferizi was arraigned before a U.S. judge in January and entered a guilty plea in the Eastern District of Virginia on June 15.
He is scheduled for sentencing in September, where he faces a maximum of 20 years for providing support to a terrorist group and an additional five years for accessing a protected computer.
"Ferizi endangered the lives of over 1,000 Americans," U.S. Attorney Dana Boente said. "Cyber terrorist are no different from other terrorists: No matter where they hide, we will track them down and seek to bring them to the United States to face justice."
Aaron Boyd is an awarding-winning journalist currently serving as editor of Federal Times — a Washington, D.C. institution covering federal workforce and contracting for more than 50 years — and Fifth Domain — a news and information hub focused on cybersecurity and cyberwar from a civilian, military and international perspective.
