U.S. charges 21-year-old Swiss "hacktivist" for security-camera theft and leaks
The Justice Department has charged a Swiss hacker with computer intrusion and identity theft, just over a week after the hacker took credit for helping to break into the online systems of a U.S. security-camera startup. An indictment against 21-year-old Till Kottmann was brought Thursday by a grand jury in the Seattle-based Western District of Washington.
Federal prosecutors said Thursday that Kottmann, of Lucerne, Switzerland, was initially charged in September. The range of allegations date back to 2019 and involve stealing credentials and data and publishing source code and proprietary information from more than 100 entities, including companies and government agencies.
Kottmann had described the most recent hack and leak of camera footage from customers of California security-camera provider Verkada as part of a "hacktivist" cause of exposing the dangers of mass surveillance.
Acting U.S. Attorney Tessa Gorman rejected those motives in a statement Thursday.
"These actions can increase vulnerabilities for everyone from large corporations to individual consumers," Gorman wrote. "Wrapping oneself in an allegedly altruistic motive does not remove the criminal stench from such intrusion, theft, and fraud."
Kottmann provided CBS News with a 5 gigabyte archive containing video and images from the hack, and described the attack as "non-technical" and not difficult to pull off.
Kottmann said that her group discovered a Verkada administrator username and password stored on an unencrypted subdomain. The company, she said, exposed an internal development system to the internet, which contained hard coded credentials for a system account which she said gave them full control over their system with "super admin" rights.
"We do scans for very broad vectors looking for vulnerabilities. This one was easy. We simply used their web app the way any user would, except we had the ability to switch to any user account we desired. We did not access any server. We simply logged into their web UI with a highly privileged user [account]," Kottmann said.
Kottmann didn't immediately return an online request from the AP for comment Thursday.
Swiss authorities said they had raided Kottmann's home in Lucerne late last week at the request of U.S. authorities. It's not clear if U.S. prosecutors intend to extradite Kottmann, who remains in Lucerne and was notified of the pending charges. Prosecutors say the FBI recently seized a website domain that Kottmann used to publish hacked data online.
The indictment ties a number of hacks to Kottmann over the past year, including one targeting an unnamed security device manufacturer based in the Seattle region and another affecting a maker of tactical equipment.
In several cases, prosecutors said Kottmann improperly used valid employee credentials to gain access to source code databases. The indictment says Kottmann also hacked the Washington state Department of Transportation, an automobile manufacturer and a financial investment company.
The indictment doesn't specifically mention last week's high-profile hack of Verkada, which drew attention because it exposed live camera feeds and archived video footage from schools, jails, factories, gyms and corporate offices.
Kottmann, who uses they/them pronouns, told The Associated Press last week they belonged to a group nicknamed APT-69420 Arson Cats, a small collective of "primarily queer hackers, not backed by any nations or capital but instead backed by the desire for fun, being gay and a better world."
Kottmann has previously attracted attention for leaking hacked material to expose security flaws, including from U.S. chipmaker Intel last year.
The indictment attempts to tie Kottmann's efforts at self-promotion, including designing and selling clothing related to hacking and "anti-intellectual-property ideology," into part of a broader conspiracy to commit computer fraud.
