By Brian Krebs
washingtonpost.com Staff Writer
Friday, June 30, 2006 6:01 PM
Federal authorities last week arrested five men in connection with a 2005 database breach at LexisNexis Group that the database giant said led to the theft of personal records on more than 310,000 individuals.
Some of the accused individuals, who range in age from 19 to 24, were also involved in the theft last year of revealing photos and other information from hotel heiress Paris Hilton's cell phone, and in using stolen or illegally created accounts at LexisNexis subsidiaries to look up Social Security numbers and other personal information on dozens of other Hollywood celebrities.
Copies of the indictments filed against two of the men and reviewed by a washingtonpost.com reporter indicate the government plans to charge all five suspects with "aggravated identity theft," which is defined as the use of a stolen identity to commit other crimes. Under a law passed in July 2004, persons found guilty of aggravated identity theft receive a mandatory two-year prison sentence in addition to any penalties for related crimes.
The indictment names Jason Daniel Hawks, 24, of Winston Salem, N.C.; Zachary Wiley Mann, 19, of Maple Grove, Minn.; Timothy C. McKeage, 21, of Woonsocket, R.I.; Justin A. Perras, 19, of New Bedford, Mass.; and Jeffrey Robert Weinberg, 21, of Laguna Beach, Calif. The men also face charges of conspiracy and computer fraud.
The government alleges that on two dates in January and March 2005, McKeage (known online by the hacker alias "Krazed") compromised a computer belonging to an officer in the Port Orange (Fla.) Police Department and used the department's credentials to access records at Accurint, a database service for law enforcement and legal professionals offered by Seisint, a Florida-based subsidiary of LexisNexis. The indictment charges that McKeage used that access to create even more user accounts, which he then allegedly shared with the other co-defendants.
The complaint also alleges that at that same time, Perras --- online alias "Null," --- gained access to an Accurint account belonging to a police department in Denton County, Texas, by impersonating a LexisNexis employee.
The government charges that the five men used the stolen Accurint accounts to look up sensitive data on a number of individuals. The victims are named only by their initials in the indictment.
But according to interviews washingtonpost.com had with at least three of the accused, the group accessed information on Hilton, California Gov. Arnold Schwarzenegger (R), and actors Laurence Fishburne and Demi Moore.
Perras said Friday that he admitted to U.S. Secret Service agents last February that all of the charges against him in the government's complaint were true. But he said no one in the group used the information obtained through Accurint for illegal purposes.
Reached by phone at the home of a friend in New Bedford, Mass., Perras said, "There was never any malicious intent. We were just a bunch of kids goofing around. No one was planning on stealing anyone's identities."
In May 2005, washingtonpost.com reported on the role of one of Perras's friends -- a minor -- in the hacking of Paris Hilton's cell phone. That individual -- whom washingtonpost.com is not naming because he is still a minor -- is currently serving an 11-month sentence in a Massachusetts juvenile detention center after pleading guilty to his role in the Hilton phone hack, among other charges.
Zach Mann, another one of the young men arrested last week, said he attended Central Lakes College in Minnesota last semester but said he doesn't plan to return to school next year, regardless of the outcome of his trial. In a phone interview with washingtonpost.com, Mann admitted that he looked up the personal information of several celebrities -- including Fishburne's. But he denied that anyone in the group ever tried to profit from any of the information they looked up using the stolen Accurint accounts.
But when asked whether he had any regrets or misgivings about his actions, Mann --- known in hacker circles by the online handle "Majy" --- was defiant.
"I'd do it safer, because way too many people involved were talking about it," Mann said. "I don't think what we did was that bad. We never used anyone's identity. Besides, don't you think it's wrong that a company like that has all this information that's available to anyone who's willing to pay for it?"
The five men are ordered to appear in a West Palm Beach, Fla., courtroom for a pre-trial hearing on July 12, and all are currently free on bond.
A spokesperson for the Secret Service declined to comment, referring inquiries to the U.S. Attorney's office for the Southern District of Florida, which could not be reached for comment as of press time. LexisNexis officials did not return calls seeking comment.