Two Polish criminals who unleashed a sinister cyber attack to blackmail a multi-million pound Manchester-based internet company have been jailed.
In its first prosecution of its kind, Greater Manchester Police caught the pair after setting up a sting operation at a plush Heathrow Airport hotel.
Piotr Smirnow, born 22/3/82, of Tawerny, Warsaw, Poland, and Patryk Surmacki, born 7/1/78, of Szezecin, Poland, pleaded guilty at Manchester Crown Court to two offences each of blackmail and one offence of unauthorised acts on computers (under Computer Misuse Act 1990).
Both men were sentenced today, Wednesday 18 December 2013 at Manchester Crown Court, Crown Square, to five years and four months in prison.
The case centres on two victims, one of which owns a Manchester-based on-line marketing company and the other a USA-based CEO of an internet software platform that hosted a multitude of on-line companies.
The Manchester victim’s company has an annual turnover of nearly £30m and employs 65 staff. He had known Smirnow and Surmacki for four years prior to the scam as they also worked in the same line of business.
On 23 July 2013 Smirnow contacted the victim and asked to meet him as he had a business proposition for him.
He initially declined but Smirnow persuaded him to meet both him and Surmacki at Heathrow Airport Terminal 5.
The Polish pair opened the meeting by immediately demanding a 50 per cent share in the company. They then told him they intended to ‘take down’ the software platform on which his company operates, effectively stopping his website from operating.
Smirnow and Surmacki said they knew a notorious computer hacker and they fully intended to perform a DDOS (Distributed Denial of Service) attack on the company servers.
DDOS is a method of overloading servers, preventing them from working, through the unauthorised remote access given the thousands of computers worldwide. These machines are sent commands to attack the targeted server.
To do this only requires the criminal to have the expertise, a computer and internet access - the defendants had all three.
They threatened the Manchester business with total on-line shutdown if they didn’t comply with their demands, saying they would move their business to a separate server, attack the platform server, leaving the original firm to corner the market and make millions.
During the meeting the victim started to record audio on his mobile and, in order to buy his company time, he agreed to meet their computer hacker.
Fearing for his company’s future, he called the police to report the blackmail. Police, supported by National Crime Agency, then started a proactive investigation, which included GMP officers helping direct events which ultimately led to the arrests.
Over the next few days Smirnow offered him a meeting with the hacker in Kiev, Ukraine.
During a final call with Smirnow he admitted being scared of flying to Kiev, and declined the offer.
Several days later, on 2 August, Smirnow and Surmacki carried out their threat and unleashed the DDOS attack, resulting in the company’s servers going down, preventing any customers using the site for five hours. It cost the company around £15,000.
The second victim, the CEO of the US-based platform server, then became involved in an attempt to mediate between the two parties.
He spoke to Smirnow over Skype and the Pole admitted they carried out the DDOS attack because another customer has failed to pay him as promised and he felt entitled to take down the platform unless they handed over operations to him.
The American asked why he hadn’t contacted him before they carried out the attack and he replied he wanted to show everyone how strong he was and he had the power to take down every single site on the platform if they didn’t cave in to his demands.
He told him via Skype: “We offered him something that would keep his business alive and he refused the deal. He has problem now.
“You have to understand last time we tried diplomacy, we talked, did call, meet, etc. After that we understand only power talks in this world, now we have enough power so people can’t try to push us around anymore.”
As the threats continued he agreed to meet Smirnow and Surmacki at the luxury Sofitel hotel at Heathrow Airport. They met the CEO as arranged at the hotel on 7 August, went to a room, and they again admitted being responsible for the DDOS attack.
They told him they were willing to attack further online businesses until they got what they wanted.
The pair claimed they’d shown their power and it wouldn’t stop until the internet source codes for his business were handed over. The CEO refused to provide them so they both became annoyed and said they were now ‘going to war’.
At that point the CEO asked for a break, the two Polish men left the room and were arrested by police who had been listening to the entire conversation and lying in wait.
GMP was assisted by the National Crime Agency and the Crown Prosecution Service throughout the operation.
Detective Inspector Chris Mossop, of the Serious Crime Division, said: “This was a very complex, dynamic investigation that centred on an emerging global cyber-threat.
“Denial of service attacks have become increasingly common offences in recent years and can have a devastating effect on the victim’s on-line business.
“With millions of pounds and potentially dozens of jobs involved, Smirnow and Surmacki were playing for incredibly high stakes and clearly knew what they were doing.
“They used their intimate, expert knowledge of on-line business to attempt to bully the victims into submission. But make no mistake, they may have been using the latest technology, but this was simply good old-fashioned blackmail.
“They behaved like a couple of sinister playground bullies who thought they could use the threat of financial annihilation to extort compliance from these companies.
“But their greed was ultimately their downfall as they failed to reckon with the victims’ bravery in the face of extreme intimidation.
“The moment our officers arrested them will no doubt live long in their memories as it as at that point they must have realised the game was up.”
Ben Southam, Senior Crown Prosecutor for CPS North West Complex Casework Unit said:
“These defendants sought to use their expertise and in depth knowledge of online business to gain control over their victims’ companies.
“They thought that by threatening to carry out an online attack, the damage of which would cost millions of pounds and jeopardise a large number of jobs, they could force the victims into giving into their demands.
“The victims showed enormous bravery in reporting the blackmail to the police and thankfully the pair were stopped in their tracks before their threats came to fruition.
“We have worked hard alongside the police to present strong cases against both defendants and they were left with no other option but to enter guilty pleas. This case demonstrates the close partnership between the CPS, police and other agencies when it comes to tackling cyber crime.”
Gary Chatfield, Director of Operations from the National Crime Agency said:
“NCA officers provided a high-level of operational support in respect of this complex investigation, resulting in the jailing of criminals who used threats and intimidation for nothing more than greed.
“This verdict demonstrates the strength of response that those engaging in this type of organised crime can expect. It is an excellent example of the NCA's partnership with the Greater Manchester Police. We will continue to work with our colleagues, both nationally and internationally, to deliver results and interrupt criminal activity.”
The Manchester victim welcomed the decision of the court to sentence Mr Smirnow and Mr Surmacki to a lengthy term of imprisonment. He said: “I am grateful for the assistance to me provided by the police in this matter. This case made me fear for my personal safety as well as for the future of my business, which is why I felt compelled to take action against the perpetrators of this crime. No one should have to succumb to blackmail and this sentence should act as a warning to those involved in cyber-extortion that the police and the courts will view this type of conduct very seriously.”