Former State Department Employee Pleads Guilty to Computer Hacking and Sexual Extortion of Women
ATLANTA—Michael C. Ford, a former U.S. State Department employee, has pleaded guilty to perpetrating a widespread, international e-mail phishing, computer hacking, and cyberstalking scheme against hundreds of women in the United States and abroad. Using e-mail passwords obtained by phishing, he hacked into hundreds of victims’ e-mail and social media accounts, stole thousands of sexually explicit photographs, and threatened at least 75 victims that he would release their photos and other personal information unless they agreed to his “sextortionate” demands.
“Ford engaged in an international sextortion campaign,” said U.S. Attorney John Horn. “He tormented numerous women by threatening to humiliate them unless they provided him with sexually explicit photos and videos, and in some cases, he followed through on his threats. This case demonstrates the need to be careful in safeguarding personal information and passwords, especially in response to suspicious e-mails.”
“With nothing more than a computer and a few keystrokes, modern predators like Michael Ford can victimize hundreds of people around the world,” said Assistant Attorney General Caldwell. “While this criminal prosecution may never return the victims’ sense of security, I hope that today’s guilty plea brings them some peace of mind.”
“The allegations contained in this federal indictment portray an individual consumed with sexually themed cyber-stalking and exploitation as well as an individual who felt he was beyond detection and grasp of authorities. The FBI is proud of the role it played in working with our law enforcement partners to bring Mr. Ford in for prosecution,” said J. Britt Johnson, Special Agent in Charge, FBI Atlanta Field Office.
“When a public servant in a position of trust commits any form of misconduct, to include federal crimes such as cyberstalking and computer hacking, we vigorously investigate such claims,” said Director Miller. “The Diplomatic Security Service is firmly committed to investigating and working with the Department of Justice, U.S. Attorney’s Office and our other law enforcement partners to investigate criminal allegations and bring those who commit these crimes to justice.”
According to U.S. Attorney Horn, the charges and other information presented in court: From January 2013 and May 2015, he used various aliases that included “David Anderson” and “John Parsons” and engaged in a widespread, international computer hacking, cyberstalking and “sextortion” campaign designed to force victims to provide Ford with personal information as well as sexually explicit videos of others. Ford targeted young females, some of whom were students at U.S. colleges and universities, with a particular focus on members of sororities and aspiring models.
Ford posed as a member of the fictitious “account deletion team” for a well-known e-mail service provider and sent phishing e-mails to thousands of potential victims, warning them that their e-mail accounts would be deleted if they did not provide their passwords. Ford then hacked into hundreds of e-mail and social media accounts using the passwords collected from his phishing scheme, where he searched for sexually explicit photographs. Once Ford located the photos, he then searched for personal identifying information (PII) about his victims, including their home and work addresses, school and employment information, and names and contact information of family members, among other things.
Ford then used the stolen photos and PII to engage in an ongoing cyberstalking campaign designed to demand additional sexually explicit material and personal information. Ford e-mailed his victims with their stolen photos attached and threatened to release those photos if they did not cede to his demands. Ford repeatedly demanded that victims take sexually explicit videos of “sexy girls” undressing in changing rooms at pools, gyms and clothing stores, and then send the videos to him.
When the victims refused to comply, threatened to go to the police or begged Ford to leave them alone, Ford responded with additional threats. For example, Ford wrote in one e-mail “don’t worry, it’s not like I know where you live,” then sent another e-mail to the same victim with her home address and threatened to post her photographs to an “escort/hooker website” along with her phone number and home address. Ford later described the victim’s home to her, stating “I like your red fire escape ladder, easy to climb.” Ford followed through with his threats on several occasions, sending his victims’ sexually explicit photographs to family members and friends.
Ultimately, Ford sent thousands of fraudulent “phishing” e-mail messages to potential victims, successfully hacked into at least 450 online accounts belonging to at least 200 victims, and forwarded to himself at least 1,300 stolen e-mail messages containing thousands of sexually explicit photographs. Ford sent threatening and “sextortionate” online communications to at least 75 victims.
During the relevant time period, Ford was employed by the U.S. Embassy in London. The majority of Ford’s phishing, hacking and cyberstalking activities were conducted from his computer at the U.S. Embassy.
Ford was initially charged by criminal complaint and arrested on May 17, 2015 at the Hartsfield-Jackson International Airport in Atlanta, Georgia.
Sentencing for Michael C. Ford, 36, of Atlanta, Georgia, is scheduled for February 16, 2016, before U.S. District Judge Eleanor L. Ross.
The case is being investigated by the U.S. Department of State, Diplomatic Security Service and the Federal Bureau of Investigation.
The case is being prosecuted by Assistant U.S. Attorney Kamal Ghali of the Northern District of Georgia, Senior Trial Attorney Mona Sedky of the Criminal Division’s Computer Crime and Intellectual Property Section, and Trial Attorney Jamie Perry of the Criminal Division’s Human Rights and Special Prosecutions Section. Assistance was provided by the Criminal Division’s Office of International Affairs and the U.S. Embassy in London.
Anyone who believes that they are the victim of hacking, cyberstalking, or “sextortion” should contact law enforcement. Resources regarding hacking and other cybercrimes can be found at: https://www.fbi.gov/about-us/investigate/cyber.