Financial data stolen via file-sharing, prosecutors say

SEATTLE – A Seattle man has been arrested in what the Justice Department described as its first case against someone accused of using file-sharing digital data to commit identity theft.

Gregory Thomas Kopiloff primarily used Limewire’s file-sharing program to troll other people’s computers for financial information, which he used to open credit cards for an online shopping spree, federal prosecutors said Thursday.

Kopiloff was arrested Wednesday at his government-subsidized apartment a few blocks from the federal courthouse here. According to a four-count indictment, he bought at least $73,000 worth of goods online – including iPods and laptop computers – then resold those items at half-price and kept the proceeds. Investigators said he blew through most of the money supporting a gambling habit.

Authorities said they have identified at least 83 victims – most of whom have teenage children and did not know the file-sharing software was on their computer. But investigators also said they believe the number of people affected was in the hundreds – and that in all they lost hundreds of thousands of dollars.

Kopiloff did not enter a plea during an appearance Thursday in U.S. District Court, and his court-appointed lawyer said she had not had time to review the charges. A detention hearing was set for Monday.

Though people have been prosecuted for using networks to illegally share copyrighted music, movies and software, the Justice Department called this the first version of an equally – if not more – troubling matter.

Each day, computer users inadvertently share hundreds of thousands of sensitive files through such programs, such as banking statements, medical records and tax returns, according to Robert Boback, chief executive of Tiversa Inc., a Pennsylvania firm that monitors file-sharing.

Typically the mistakes occur when a user downloads file-sharing software and accidentally allows it to share all files on a computer, rather than just music files, for example.

“If you are running file-sharing software, you are giving criminals the keys to your computer,” said Assistant U.S. Attorney Kathryn Warma. “Criminals are getting access to incredibly valuable information.”

When other users might search on Limewire for “Madonna,” Kopiloff would search for “federal tax return,” or for student financial aid forms or other financial information, Warma said. And instead of getting access to a few hundred files containing “Like a Virgin” or “Papa Don’t Preach,” he would get a few hundred files containing tax returns.

He would vet his victims before opening accounts in their name, ensuring they earned at least $150,000 a year and had good credit, she said.

Boback conducted a frightening demonstration during a news conference at the U.S. attorney’s office. Using his company’s technology, he showed – in real time – searches being conducted on peer-to-peer networks. As the searches were entered, they scrolled rapidly along the screen of his laptop. Many clearly concerned music files and pornography, but interspersed were scores looking for files that contained terms such as “password” and “medical billing.”

“There are tens of thousands of individuals who make a living doing this,” Boback said.

The issue also has national security implications, he noted. In July, the company found more than 200 classified documents available by searching a peer-to-peer network, including one that concerned troop movements in Iraq.

Boback testified before the House Oversight Committee on the issue July 24. He noted that among the files his company found was a confidential document addressed to Rep. Henry Waxman, the committee’s chairman, concerning a pharmaceutical company’s drug trials.

A Limewire representative could not immediately be reached for comment, but at the same congressional hearing, the chairman of Lime Wire LLC, Mark Gorton, said the company warns its users about the dangers posed by the software and instructs them on how to use it safely.

“We continue to be frustrated that despite our warnings and precautions, a small fraction of users override the safe default setting that comes with the program and end up inadvertently publishing information that they would prefer to keep private,” Gorton said.

Kopiloff was arrested after one of his alleged victims, a Texas resident, told his company’s security officer about how his bank account had been compromised, with someone in Western Washington passing bad checks on his account. The agent forwarded the information to Secret Service agents and police in Seattle, Warma said.