Teamwork lands team in U.S. court

TALLINN - Accusations of stealing more than 9.4 million U.S. dollars from more than 2,100 ATM terminals in 280 different cities has gotten 26-year-old Sergei Tsurikov, from Tallinn, and his seven accomplices extradited to the U.S. for trial. Tsurikov has been charged with wire fraud, computer fraud, as well as aggravated identity theft and is said to be involved in a criminal ring all around the world.
ATMs were hacked into in Ukraine, Italy, Hong Kong and the U.S. as the crime was committed in a duration of 12 hours on Nov. 8, 2008.

According to the U.S. Embassy in Estonia, Embassy and U.S. Justice Department officials successfully concluded arrangements with Estonian authorities, in particular the Estonian Criminal Police and Prosecutor’s Office, for the extradition on Aug. 5 of Tsurikov to the United States. He was arrested by local authorities last year and was initially handed over to the Russian Federal Security Service (FSB) for questioning. At the time the FSB already had two other suspects indicted in the same case in their custody – Viktor Pleshchuk, 28, of St. Petersburg, Russia and Oleg Covelin, 28, of Chisinau, Moldova.
Since the Russian constitution specifically prohibits the extradition of its citizens, it meant that Pleshchuk would face charges in his home country. However, the U.S. authorities pushed forward to extradite Tsurikov, who was subsequently brought into the country and appeared in federal court in Atlanta on Aug. 6, where, according to the Associated Press, he pleaded not guilty (to charges that included conspiracy, wire fraud, computer fraud, and aggravated identity theft).

The money was stolen from the RBS WorldPay Network, the payment processing division of the Atlanta-based unit of the Royal Bank of Scotland, in a process of hacking the data of 44 payment cards. The money was transacted by a clone of the employee’s payroll debit cards on payday. Subsequent to the hacking, the accused allegedly tried to destroy the data in an attempt to cover up the whole fraud.

The 16-count indictment also accused an unidentified individual with the same offenses. Igor Grudijev, 32; Ronald Tsoi, 32; Evelin Tsoi, 21; and Mihhail Jevgenov, 34; each of Tallinn, Estonia, were also charged with access device fraud.
Prosecutors say that Tsurikov was one of the leaders of a gang that managed to hack into the RBS WorldPay network. 
Sally Quillian Yates, the U.S. Attorney, described the hack as “the most sophisticated and organized computer fraud attack ever conducted.” The federal prosecutor stated that the accused will face more than 40 years in incarceration and a fine of more than 3.5 million U.S. dollars.

FBI officials said that they weren’t so much drawn to the case by the dollar amount of the RBS heist, but by the coordination of the effort. It exemplified the international scope and increasing acumen of cyber attacks. “As people become more technically proficient and get access to the Internet, we see this crime showing up in more and more places,” said Pat Carney, who supervised the RBS case at the FBI’s headquarters.

According to officials, the increasing scope of foreign attacks comes as college students around the world are focusing heavily on technology degrees only to emerge into a difficult job market with low pay. “When you can’t find a legitimate job making big money, you find some [other] way to make money,” said Colleen Moss, the head of the FBI’s Cyber Crime Squad in North Carolina. “There’s a lot of high-tech trained folks out there who either don’t have a job or aren’t making what they’d like to.”

“What made this case different was the scope, the timing and the coordination,” said Doris Gardner, an FBI special agent who worked on the case. “It was very sophisticated.”
Just as this criminal activity was global in its scale, so too was the level of cooperation that lead to the arrest and extradition of Tsurikov.  In addition to Estonian authorities, the U.S. Federal Bureau of Investigation and Secret Service worked together with law enforcement in Hong Kong and the Netherlands to bring Tsurikov to justice.

If convicted, Tsurikov faces 20 years for conspiracy to commit wire fraud; up to five years for conspiracy to commit computer fraud; up to five or 10 years for each count of computer fraud; a two-year mandatory minimum sentence for aggravated identity theft; and fines of up to 3.5 million dollars. Prosecutors are also seeking forfeiture of the 9.4 million dollars in proceeds from the alleged crimes.