A Romanian woman pleaded guilty Thursday in a cyber attack that took control of two-thirds of D.C. police surveillance cameras days before President Trump’s presidential inauguration in January 2017.
Eveline Cismaru, 28, admitted conspiring to access 126 outdoor police cameras in a far -reaching extortion scheme. Prosecutors said Cismaru was part of a group of hackers who aimed to take over the D.C. government computers and use them to email ransomware to 179,600 accounts, defrauding the owners while hiding their own digital tracks.
U.S. prosecutors in the District said the case “was of the highest priority” because of its potential to disrupt security plans for the 2017 presidential inauguration. They found the timing appeared to be a coincidence, however, because the hackers probably did not know the computers were used by police.
Cismaru pleaded guilty to two of 11 counts and agreed to cooperate against a co-defendant. Prosecutors said if she provides substantial help, they will seek less than the 24 to 30 months in prison she faces under federal guidelines for conspiracy to commit wire fraud and computer fraud.
U.S. District Judge Dabney L. Friedrich of the District set sentencing for Dec. 3.
Cismaru and co-defendant Mihai Alexandru Isvanca, 25, were arrested Dec. 15 at the Henri Coanda International Airport in Romania before boarding a flight for London.
In a statement signed by Cismaru and prosecutors, Cismaru characterized her role as far less significant than Isvanca’s, saying “ ‘99%’ of what she knows about computer crime and computer credit card fraud [is] from Isvanca.”
Cismaru fled Romania while appealing her extradition to the United States, but authorities tracked her to London, where she was arrested and brought to Washington in July. She has since been held in detention.
U.S. prosecutors continue to seek to extradite Isvanca from Romania.
Each was charged in January with an 11-count indictment on charges carrying a statutory maximum of up to 20 years in prison.
Cary Citronberg, Cismaru’s attorney, said she has a 2-year-old son in Europe and, “with this plea agreement, we are hopeful she will be able to put this ordeal behind her quickly so she can be reunited with her family.”
According to a statement, Cismaru said while she was on home detention in Romania, Isvanca contacted her via an encrypted web chat program using an alias, telling her not to talk to investigators. She said Isvanca asserted U.S. agents could not prove he committed a crime and threatened Cismaru, who took “extensive” images of the conversations, the court filing said.
Isvanca also lied to Cismaru’s parents in an effort to keep her silent, telling them he had spoken with prosecutors, “admitted to everything and that everything would be OK,” the filing said.
The intrusion occurred from Jan. 9-12, 2017, causing 126 of the police department’s 187 surveillance cameras to go dark eight days before Trump’s swearing-in.
D.C. police said a city employee discovered the hack when her attempt to access the system launched a warning that said, “Your documents, photos, databases and other important files have been encrypted!” The message also demanded a Bitcoin payment of $60,800 to unlock the cameras.
In an affidavit, a U.S. Secret Service agent said two versions of malicious computer code — one known as “cerber” and the other known as “dharma” — had been placed on three police computers that run the camera system.
Investigators traced emails routed by hackers through police servers to a Gmail domain called “vand.suflete,” Romanian for “selling souls,” and linked IP addresses and email accounts found in the attack to several suspects, including the two defendants.
Authorities said they uncovered a separate scheme run by the same people: a fraudulent business that tricked Amazon.com’s offices in the United Kingdom into sending money to the Romanians. (Amazon’s chief executive, Jeffrey P. Bezos, owns The Washington Post.)
Prosecutors said the group stole banking credentials and account passwords to commit “fraud schemes with anonymity.”