SUMMARY OUTCOMES U.S.-CHINA DIALOGUE ON CYBERCRIME

FROM:  U.S. JUSTICE DEPARTMENT 

Wednesday, December 2, 2015

First U.S.-China High-Level Joint Dialogue on Cybercrime and Related Issues Summary of Outcomes

On Dec. 1, 2015, in Washington, D.C., Attorney General Loretta E. Lynch and Department of Homeland Security Secretary Jeh Johnson, together with Chinese State Councilor Guo Shengkun, co-chaired the first U.S.-China High-Level Joint Dialogue on Cybercrime and Related Issues.  Under the commitments made by U.S. President Barack Obama and Chinese President Xi Jinping during the state visit in September 2015, the primary objectives of the dialogue were to review the timeliness and quality of responses to requests for information and assistance with respect to cybercrime or other malicious cyber activities and to enhance cooperation between the United States and China on cybercrime and related issues.  In addition to members of the Departments of Justice and Homeland Security, representatives from the Department of State, National Security Council and Intelligence Community participated for the United States, while the Chinese delegation included representatives from the Committee of Political and Legal Affairs of CPC Central Committee, the Ministry of Public Security, the Ministry of Foreign Affairs, the Ministry of Industry and Information Technology, the Ministry of State Security, the Ministry of Justice and the State Internet Information Office.

During the dialogue, both countries discussed ways to enhance cooperation within the bounds of each nation’s legal framework and assessed progress made on cases identified during their discussions in September 2015.  They reached the following specific outcomes:

1. Guidelines for Combatting Cybercrime and Related Issues.  Attorney General Lynch, Secretary Johnson and State Councilor Guo reached agreement on a document establishing guidelines for requesting assistance on cybercrime or other malicious cyber activities and for responding to such requests.  These guidelines will establish common understanding and expectations regarding the information to be included in such requests and the timeliness of responses.

2.Tabletop Exercise.  Both sides decided to conduct a tabletop exercise in the spring of 2016 on agreed-upon cybercrime, malicious cyber activity and network protection scenarios to increase mutual understanding regarding their respective authorities, processes and procedures.  During the tabletop exercise, both sides will assess China’s proposal for a seminar on combatting terrorist misuse of technology and communications, and will consider the U.S.’s proposal on inviting experts to conduct network protection exchanges.

3. Hotline Mechanism.  Pursuant to the commitment between the two presidents to establish a hotline for escalation of issues that may arise in the course of responding to cybercrime and other malicious cyber activities, both sides decided to develop the scope, goals and procedures for use of the hotline before the next High-Level Dialogue.

4. Enhance Cooperation on Combatting Cyber-Enabled Crime and Related Issues.  Both sides decided to further develop case cooperation on combatting cyber-enabled crimes, including child exploitation, theft of trade secrets, fraud and misuse of technology and communications for terrorist activities, and to enhance exchanges on network protection.  Both sides decided to improve cooperation among the relevant agencies, within the framework of the high-level dialogue, on network protection issues. U.S. and Chinese cyber incident and network protection experts will meet on Dec. 3, 2015, and will continue to meet regularly during future dialogues.

5. Second U.S.-China High-Level Joint Dialogue on Cybercrime and Related Issues.  Attorney General Lynch, Secretary Johnson and State Councilor Guo decided to schedule the second U.S.-China High-Level Dialogue on Combatting Cybercrime and Related Issues in June 2016.  The dialogue will take place in Beijing, China.

VIETNAMESE NATIONAL SENT TO PRISON FOR ROLE IN INTERNATIONAL HACKING AND IDENTITY THEFT SCHEME

FROM:  U.S. JUSTICE DEPARTMENT 

Tuesday, July 14, 2015

Vietnamese National Sentenced to 13 Years in Prison for Operating a Massive International Hacking and Identity Theft Scheme

A Vietnamese national was sentenced to 13 years in prison for hacking into U.S. businesses’ computers, stealing personally identifiably information (PII), and selling to other cybercriminals his fraudulently-obtained access to PII belonging to approximately 200 million U.S. citizens.

Assistant Attorney General Leslie R. Caldwell of the Justice Department’s Criminal Division, Acting U.S. Attorney Donald Feith of the District of New Hampshire and Director Joseph P. Clancy of the U.S. Secret Service made the announcement.

Hieu Minh Ngo, 25, was sentenced today by U.S. District Court Judge Paul J. Barbadoro of the District of New Hampshire.  Ngo previously pleaded guilty to federal charges brought in the District of New Hampshire and the District of New Jersey, including wire fraud, identity fraud, access device fraud and four counts of computer fraud and abuse.

“From his home in Vietnam, Ngo used Internet marketplaces to offer for sale millions of stolen identities of U.S. citizens to more than a thousand cyber criminals scattered throughout the world,” said Assistant Attorney General Caldwell.  “Criminals buy and sell stolen identity information because they see it as a low-risk, high-reward proposition.  Identifying and prosecuting cybercriminals like Ngo is one of the ways we're working to change that cost-benefit analysis.”

“This case demonstrates that identity theft is a worldwide threat that has the potential to touch every one of us,” said Acting U.S. Attorney Feith.  “I want to acknowledge the excellent work of the United States Secret Service in identifying and capturing Mr. Ngo.  This case proves that the United States Attorney’s Office for the District of New Hampshire will work with law enforcement to investigate and prosecute identity thieves, even if they are halfway around the world.”

“The sentencing of this transnational cybercriminal illustrates another example of Secret Service success in the disruption and dismantling of global criminal networks,” said Director Clancy.  “This investigation and the resulting prosecution and sentencing should serve as a warning to criminals that we will relentlessly investigate, detect, and defend the Nation’s financial infrastructure.  This sentencing joins a long list of successes in combating financial crimes over our 150 year history.”

According to admissions made in connection with his guilty plea, from 2007 to 2013, Ngo operated online marketplaces from his home in Vietnam, including “superget.info” and “findget.me,” to sell packages of stolen PII.  These packages, known as “fullz,” typically included a person’s name, date of birth, social security number, bank account number and bank routing number.  Ngo also admitted to acquiring and offering for sale stolen payment card data, which typically included the victim’s payment card number, expiration date, CVV number, name, address and phone number.  Ngo admitted that he obtained some of the stolen PII by hacking into a New Jersey-based business and stealing customer information.

In addition to selling the “fullz,” Ngo admitted to offering buyers the ability to query online databases for the stolen PII of specific individuals.  Specifically, Ngo admitted that he offered access to PII for 200 million U.S. citizens, and that more than 1,300 customers from around the world conducted more than three million “queries” through the third-party databases maintained on his websites.

Ngo made nearly $2 million from his scheme.  The Internal Revenue Service has confirmed that 13,673 U.S. citizens, whose stolen PII was sold on Ngo’s websites, have been victimized through the filing of $65 million in fraudulent individual income tax returns.

The case was investigated by the U.S. Secret Service’s Manchester Resident Office.  The case is being prosecuted by Senior Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Arnold H. Huftalen of the District of New Hampshire.

The case out of the District of New Jersey was investigated by the FBI, and is being prosecuted by the U.S. Attorney’s Office of the District of New Jersey.