Holding Passwords Hostage – International Extortion Foiled

In a case recently filed by a Swiss company in federal court in Florida, the company alleged in its complaint that Jerome Westrick, its former computer programmer and minority shareholder, stole a company laptop, hacked into the company’s computer system, changed access codes and passwords, and locked out the company and its customers from getting into its enterprise content management software. WIT Walchi Innovation Technologies, GMBH v. Westrick, 2012 WL 33164 (S.D. Fl. Jan. 6, 2012).

Then, Westrick allegedly sought a $300,000 payment to reveal the changed access codes and new passwords.

The Court Said, “No!”

The ploy did not work. The court issued a temporary restraining order requiring the immediate return of the laptop and directing Westrick to maintain its integrity, and directed him not to disclose the passwords and access codes to third parties.

What to Do to if This Happens to You

There are a couple of ways to handle this type of theft. One approach is to go to the Department of Justice or the FBI and file a criminal complaint. No guarantees – there is no way to predict whether the criminal authorities will investigate and prosecute the case because of competing priorities and limited resources. If they do, there is no way to predict when they will do it. In short, you have no control over what, if anything, happens.

Another approach is to do what this company did. It wisely filed its complaint alleging various violations of the Computer Fraud and Abuse Act (“CFAA”). By doing so, it exercised self-help under a law designed to protect against computer crimes, including extortion in relation to computers. Rather than dealing in a protracted court proceeding, it brought a laser directed court action that resulted in the return of its property and the end to the extortion. This of course does not mean that while you are prosecuting your CFAA action, you should not file a complaint with the authorities. Just understand that what you and your attorney do may likely result in quicker and more efficient justice.

Act Fast

Employees have access to the keys to your kingdom. Most, when terminated or leave, do the right thing. When they do not, you need to recognize it and act fast. A court will not grant emergency relief such as a temporary restraining order unless you treat the matter as the emergency it is. You need to be prepared immediately to —

• Investigate and gather admissible evidence to prove the theft of the data and the extortion that can be presented to a court to justify the entry of an immediate injunction.

• Hire expert counsel who is familiar with the CFAA who can coordinate the investigation with an eye to filing the appropriate court papers.

In many instances, as demonstrated by the Westrick case, taking the civil route as opposed to the criminal route is the best course of action.