DDoS attacks rarely result in prosecution; however, this week the hacktivist allegedly behind a series of major hospital DDoS attacks in 2014 has been indicted on charges of conspiracy and intent to cause damage to a protected computer. If convicted of he hospital DDoS attacks, the hacktivist faces up to 15 years in jail.
Martin Gottesfeld from Somerville, Mass., is alleged to have been involved in a series of DDoS attacks on Boston Children’s Hospital. The hospital experienced a number of DDoS attacks over a period of one week in April, 2014. The attacks resulted in patient services and healthcare operations being disrupted. One of the attacks coincided with an important fund raising campaign and was conducted to cause major financial harm. Boston Children’s Hospital claims it was forced to pay around $300,000 to deal with the attacks, while a similar amount was lost due to the disruption of services during its fundraising event.
The DDOS attacks were conducted following alleged mistreatment of a patient of Boston Children’s hospital – Justina Pelletier. The child’s parents had lost custody of their daughter following allegations of medical abuse by the hospital. As a result of the actions of hospital staff, the Massachusetts DCF took custody of the girl.
The DDOS attacks on Boston Children’s Hospital and the Wayside Youth and Family Support Network – which took custody of the child during the dispute – were conducted in retaliation for the girl’s treatment. The attacks on Wayside Youth and Family Support Network continued for more than a week. Those attacks required the facility to spend more than $18,000 on its response and mitigation efforts.
Martin Gottesfeld was arrested after being picked up off the coast of Cuba after experiencing difficult while sailing. A passing Disney cruise ship collected Gottesfeld and his wife and notified the coastguard. When the ship made port, Gottesfeld was arrested.
A search was conducted of Gottesfeld’s home by the FBI and equipment suspected of being used in the attack was seized. Gottesfeld admitted playing a role in the attacks and allegedly also discussed the DDoS attacks on Twitter with a co-conspirator. A video was also published on YouTube – in the name of the hacking group Anonymous – claiming Boston Children’s Hospital would be punished for mistreating Pelletier. Gottesfeld is suspected of uploading the video. Shortly after the video of was uploaded the hospital DDoS attacks commenced.
The case, which is likely to go to trial, is one of the few prosecutions for DDoS attacks. Prosecutions are rare as it is difficult to identify the individuals responsible and many of the attacks are conducted from outside the United States. Given the rarity of prosecutions, and the current wave of DDoS attacks being conducted, it is likely the Department of Justice will want to make an example of Gottesfeld in an effort to deter other players from performing DDoS attacks. A lengthy jail term is therefore likely if Gottesfeld is convicted.