Tower Hamlets (Parliament Politics Magazine) – Two teenagers, Thalha Jubair, 19, and Owen Flowers, 18, from Tower Hamlets appeared at Westminster magistrates’ court over a major cyber attack on Transport for London.
This comes after the National Crime Agency looked into the August 31 incident last year, which they suspect was committed by members of the online criminal collective Scattered Spider.
Owen Flowers, 18, of Walsall, West Midlands, and the two youths from Tower Hamlets were before Westminster magistrates’ court on Thursday afternoon.
Following a cyberattack that revealed the email and residential addresses of over 5,000 passengers, TfL was compelled to shut down its own IT systems.
Due to the inability to issue or renew Zip cards and 60+ Oyster cards, thousands of travelers who were eligible for travel concessions experienced severe inconvenience and additional costs.
The NCA and City of London Police arrested Jubair and Flowers at their residences on Tuesday.
Therefore, Flowers has also been charged with planning with others to breach and harm SSM Health Care Corporation’s networks and trying to do the same to Sutter Health’s networks, both of which are located in the United States.
Jubair has also been accused of not disclosing the passwords or pin codes of gadgets that were taken from him.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said:
“Today’s charges are a key step in what has been a lengthy and complex investigation.
This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.
Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider isa clear example.
The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
The Standard reported in December of last year that TfL had lost almost £30 million as a result of the cyberattack.
In order to assist it respond to and recover from the disaster, £5 million was spent on “external support.” A year later, TfL still hasn’t been able to fully restore all of its systems, and the live feed that was formerly accessible through its “jam cams” is still not accessible.
A “large number” of Londoners were left out of pocket after having to pay increased fares due to the cyberattack, as London Mayor Sadiq Khan acknowledged last year.
A TfL spokesperson said:
“We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year, and continue to support them with their ongoing law enforcement investigation.
The security of our systems and customer data is extremely important to us. We continually monitor our systems to ensure only those authorised can gain access and continue to take the necessary actions to protect TfL.”
Hannah Von Dadelszen, chief crown prosecutor for the Crown Prosecution Service, said:
“The Crown Prosecution Service has decided to prosecute Thalha Jubair and Owen Flowers with computer misuse and fraud related charges.
Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.”
According to the charges, the two conspired with “persons unknown” to “commit knowingly unauthorised acts against computer systems belonging to Transport for London causing or creating a significant risk of serious damage to human welfare and intending or being reckless as to whether such damage was caused” between August 29 and September 6 of last year.
What penalties do teens face for cyberattacks on public infrastructure?
Young people can be charged with offenses under the Computer Misuse Act 1990, which includes unauthorized access to computer material, unauthorized act with intent to impair operation of a computer, and unauthorized act to cause damage or impairment to a computer.
For the most serious cases where criminal intent is established to inflict serious damage or cause bodily harm, penalties can be up to 10 years imprisonment. In cases that do not involve damage or damage to systems the sentences may be much shorter custody sentences or community orders.
The courts can also impose fines on the offender, and compensation orders for giving money to the victim to help with costs incurred and damages. If the offenders are convicted, they will have a criminal record which may affect their ability to apply for jobs, education or travel.