‘Ottawa’ Canada Revenue Agency Hacker Pleads Guilty, Says He Had Best of Intentions
Stephen Solis-Reyes is one of those brainiac computer whiz kids who, it seems, was a little too smart for his own good.
Two years ago, when the London, Ont. man was just 19, and with what he maintains were the best of intentions, he was able to steal 900 social insurance numbers from the files of the Canada Revenue Agency. He says he wanted to demonstrate its online vulnerability to the Heartbleed computer bug.
The result was a sudden, panicked shutdown of the agency’s website for four days that sent techno-fear shivers about online security across Canada and prompted the CRA to extend Canadians’ tax-filing deadline by a week.
On Friday, now a top-notch computer science student at Western University, the 21-year-old pleaded guilty in an Ottawa courtroom to four charges.
Two were for mischief — one for the Canada Revenue breach, another for exposing security breaches in JerseyMail, the now-defunct online arm of the postal service in Jersey, one of the Channel Islands off the coast of Great Britain.
The two other guilty pleas were to one count each of unauthorized use of a computer and obstructing a police officer by swiping information off a computer at his arrest.
“I want to express to Your Honour my most sincere regret and remorse for the wide-reaching effects of damage and harm my actions have caused to many different people and organizations,” he wrote in a letter to the court.
“I truly understand the severity and gravity of the situation. I want to say that I never had any malicious intent and I never intended to cause harm or damage to anyone in any way.”
The Crown dropped 13 other charges that, had be been convicted, could have sent him to prison for as long as 10 years.
For all of the national hubbub surrounding his activities in April 2014, Solis-Reyes was sentenced to an 18-month conditional sentence — the first four months under house arrest, the rest under supervision.
The defence gave the judge more than 20 reference letters from professors, teachers, friends and family who spoke of Solis-Reyes’ intellect and quiet, sensitive and respectful nature.
He’s carrying a 98.6 per cent grade average in his fourth year and has already been named to the dean’s honour list three times.
Assistant Crown attorney James Cavanaugh read an agreed statement that outlined how Solis-Reyes was able to breach the computer systems from his laptop computer.
Defence lawyer Faisal Joseph told the judge Solis-Reyes was able to get into the CRA system in “six seconds.”
Central to the case, was Solis-Reyes’ intentions. Joseph told the judge it would have been easy for Solis-Reyes to sell the information or make money off it. None of that happened.
“He did it because he could, because he was capable of breaking into these national security places,” Joseph said, and that Solis-Reyes “has done the country a service” by exposing the flaws in the system.
One professor referred to him as “not only one of the smartest students around, but he is also one of the nicest, friendliest and most honest.”
“His code is a thing of beauty,” another wrote.
His father, Roberto Solis-Oba, the graduate chairman of Western’s computer science department, wrote it was his son’s “insatiable curiosity that led him to perform the actions that got him in trouble with the law.
The defence was harshly critical of what he alleges were the interrogation methods the RCMP put Solis-Reyes through after his arrest at his London home.
He said his client was questioned for six hours without a lawyer present. He was accused of being a terrorist and was asked “what would Jesus think” about his activities, Joseph said.
Joseph pointed out an RCMP corporal suggested Solis-Reyes’s father’s job could be in jeopardy and how, in France, it’s not illegal to tie somebody up in a hot water tank until he speaks.
“In over 30 years of practising law as a prosecutor and a defence lawyer I have never met a better family or a more respectful, loving, intelligent boy as my client,” Joseph said. “Murderers and rapists haven’t expereinced what my 19-year-old client received at the hands of the RCMP’s investigating officer for hours on end.”
Reached for comment late Friday, the RCMP had not yet responded to the lawyer’s characterization.
Solis-Reyes must serve two years of probation, with 200 hours of community service ordered.
He said in his letter he “will never again be in trouble with the law.”
“This situation has taught me the importance of thinking before acting and I know every action I take has consequences.”