Wednesday 14 December 2016

Talktalk Hacker Granted With Rehabilitation Order


A 17-year-old who admitted hacking offences linked to the TalkTalk data breach has been given a 12-month youth rehabilitation order and had his iPhone and computer hard drive confiscated.

The teenager, who cannot be named for legal reasons, found a vulnerability in the website using "legitimate software" and shared details of this online, an earlier hearing at Norwich Youth Court was told.

While he did not exploit the information for gain, the TalkTalk website was targeted more than 14,000 times after the boy exposed the vulnerability.

He told magistrates "I was just showing off to my mates" as he admitted seven hacking offences.

Sentencing him on Tuesday over the multimillion-pound data breach in October 2015, chairman of the bench Jean Bonnick said: "Your IT skills will always be there - just use them legally in the future."

Two of the charges related to the TalkTalk hack, and the boy admitted targeting other websites including Manchester University, Cambridge University and that of Merit Badges, a small family company which supplies martial arts badges.

Telecoms giant TalkTalk fell victim to what it described as a ''significant and sustained'' attack on its website on October 21 2015, and the firm said the fallout from the cyber attack had cost it £42 million.

After the hearing Laura Tams of the Crown Prosecution Service Organised Crime Division said: "This case involved the deliberate exposure of a security issue on the Talk Talk website which is used by thousands of people every day.

"Through analysis of online chats and other digital footprints, prosecutors were able to demonstrate exactly how the defendant found this weakness and shared the details online."

Chris Brown, mitigating, said the 12-month order would help rehabilitate the youth, who was likely to be back in education next year.

He said its purpose was to "draw him from the lonely confines of a bedroom and that lonely world of computing to a family where his knowledge and skills could be put to good use and to project that out to the wider world".

"His family have been supportive and encouraging him to look at new options," he said.

"There are many, many positives about this young man that lay behind the case."

He said the teenager was from a supportive family but the "one place you can't be so protective these days is online".

The teenager, who sat with his mother in court, spoke only to confirm that he understood the proceedings.

Ms Bonnick told him he must complete 24 hours of activities as part of the 12-month youth rehabilitation order.

His iPhone and a computer hard drive were forfeited to police, and he was ordered to pay £85 court costs and a £15 victim surcharge.

An application to lift reporting restrictions on the case and identify the teenager was refused.

Ms Bonnick said: "It's the bench's view that this application was not made in a timely fashion."

Opposing the application to name the teenager, Mr Brown said "the only grounds that could apply in this situation" were if it were in the public interest to do so.

He noted the application's case that naming the youth would serve as a deterrent to others committing similar hacking offences.

But he said: "There has been significant reporting of the full extent of what went on.

"I can't see how the addition of a name makes any difference to the deterrent element."

He added that naming the teenager could harm his rehabilitation.

"Part of the work that's ongoing is to draw him out of his bedroom and into the family and properly into the public arena, to someone who doesn't hide behind a computer for nefarious purposes," he said. "He has already committed an offence that has changed his life within his family, his home, his future prospects.

"I would ask you don't expose that to the world for him to continue to bear that burden through his young life.

"The public interest is very adequately served by knowing the facts of this case."

He added that the application should have been made sooner.



Etiam at libero iaculis, mollis justo non, blandit augue. Vestibulum sit amet sodales est, a lacinia ex. Suspendisse vel enim sagittis, volutpat sem eget, condimentum sem.