I never meant harm, says student who hacked Canada Revenue to show vulnerability to Heartbleed virus

 Jane Sims, The London Free Press, Postmedia News | May 7, 2016 

LONDON — A student computer whiz who stole 900 social insurance numbers from the files of the Canada Revenue Agency to demonstrate its online vulnerability pleaded guilty and apologized on Friday.

Two years ago, when Stephen Solis-Reyes of London, Ont., was 19, he stole the files to demonstrate the agency’s online vulnerability to the Heartbleed computer bug.

The result: a sudden, panicked shutdown of the CRA’s website for four days, which in turn lead to the extension of its tax-filing deadline by a week.

Dave Chidley /The Canadian PressA 2014 high school yearbook photograph of Stephen Solis-Reyes.

Related

• Facebook pays 10-year-old Finnish hacker $10,000 for exposing flaw in Instagram’s comments
• Google Inc threatens to expose competitors’ security flaws
• “I want to express to Your Honour my most sincere regret and remorse for the wide-reaching effects of damage and harm my actions have caused to many different people and organizations,” Solis-Reyes, now a top-notch computer science student at Western University in London, wrote in a letter to the Ottawa court.
  “I truly understand the severity and gravity of the situation. I want to say that I never had any malicious intent and I never intended to cause harm or damage to anyone in any way.”
  Assistant Crown attorney James Cavanaugh read an agreed statement of facts that outlined how Solis-Reyes was able to breach the CRA systems from his laptop.
  The student’s lawyer, Faisal Joseph, told the judge that Solis-Reyes was able to get into the CRA  in “six seconds.”
  Central to the case was Solis-Reyes’ intentions. Joseph told the judge it would have been easy for Solis-Reyes to sell the information or make money off it. None of that happened.
  “He did it because he could, because he was capable of breaking into these national security places,” Joseph said, adding that Solis-Reyes “has done the country a service” by exposing the flaws in the system.His father, Roberto Solis-Oba, the graduate chairman of Western’s computer science department, wrote that it was his son’s “insatiable curiosity that led him to perform the actions that got him in trouble with the law.
  “He used available code to test computer systems for a software vulnerability,” he wrote. “He never intended to cause any harm and he did not try to sell, damage or misuse any of the information obtained from these computer systems.”
  The defence provided the judge more than 20 reference letters from professors, teachers, friends and family who all spoke of Solis-Reyes’ high intellect and respectful nature.
  One professor referred to him as “not only one of the smartest students around, but he is also one of the nicest, friendliest and most honest.”
  
  

  Dave Chidley /The Canadian PressRCMP investigators canvass the neighbourhood around the home of Stephen Solis-Reyes in London, Ont., on April 16, 2014.
  Another wrote that he expected Solis-Reyes “to be a scientist of exceptional merit and remarkable abilities, who will make excellent contributions to the field of computer science.”
  “His code is a thing of beauty,” wrote a third.
  Solis-Reyes is carrying a 98.6-per-cent grade average in his fourth year of university and has already been named to the dean’s honour list three times.
  Of the four charges to which the student pleaded guilty, two were for mischief — one for the Canada Revenue breach, and another for exposing security breaches in JerseyMail, the now-defunct online arm of Jersey’s postal service, one of the Channel Islands off the coast of Great Britain. 

  
  

  Postmedia NewsA notice on the Canada Revenue Agency website April 9, 2014, concerning a shut-down due to the Heartbleed computer bug.

  The other two guilty pleas involved the unauthorized use of a computer and obstructing a police officer by swiping information off a computer at his arrest.

  The Crown dropped 13 other charges that, had he been convicted, could have sent the student to prison for as long as 10 years.

  He was sentenced to an 18-month conditional sentence — the first four months under house arrest, the rest under supervision. He also must serve two years of probation, with 200 hours of community service ordered.

  “Stephen and his family are elated the matter is over and he can get on with an extremely promising career,” his lawyer said.

  
  

  Dave Chidley /The Canadian PressThe family home of Stephen Solis-Reyes, 19, in London, Ont., is shown on April 16, 2014.

  Soles-Reyes was charged by the RCMP’s integrated technological crime unit, which the Mounties described as a unit that probes computer crimes in which critical Canadian infrastructure is damaged.

  Joseph was especially critical of the interrogation methods Solis-Reyes was subjected to after his arrest at his London home by an RCMP corporal, who questioned him for six hours without his lawyer present.

  He was accused of being a terrorist and was asked “what would Jesus think” about his activities, Joseph said.

  The investigating officer was “unprofessional, disrespectful, bullying and threatening,” the lawyer alleged.

  The corporal suggested Solis-Reyes’ father’s job could be in jeopardy, Joseph said, and told the student that in France, it’s not illegal to tie someone up in a hot water tank until he speaks.