Yesterday, Frederick Eugene Wood of Seattle was sentenced to 39 months in prison for using LimeWire peer-to-peer (P2P) software to obtain Social Security numbers, bank and financial records and tax returns, which he then used to commit identity theft. The complaint (.pdf) filed in federal court for the Western District of Washington in March alleged that Wood took advantage of the fact that users sometime install LimeWire or other peer-to-peer software on computers without limiting the directories and files made available to the peer-to-peer network.
Especially when a household computer is shared between parents and children, the installation of peer-to-peer software may make tax returns, bank statements and other personal information saved on that computer available to everyone else on the peer-to-peer network. During questioning by state and federal investigators, Wood explained that "kids put Limewire on the computer and the parents don’t know." As a result, Wood was able to obtain personal information from approximately 120 different individuals from Massachusetts, New York, Georgia, Florida, Ohio, Iowa, Louisiana, Oregon and California. He then used this information to create counterfeit checks and driver’s licenses and to open credit accounts in the victim’s names.
Note that failing to limit the files shared by peer-to-peer software is not just a problem for household computers. In an earlier post, we discussed the problems caused when an employee installed LimeWire at work. Also note that LimeWire’s user guide and FAQ provide directions on how to make sure you are not sharing personal or sensitive information with the world.
Wood’s scheme was discovered after he posted an ad on Craigslist.com purporting to sell a "brand new" Apple MacBook Pro for $1,500 and instead shipped a box containing a book and a glass vase instead of a computer. Working with Seattle Police, the victim set up a meeting with Wood and he was arrested. Upon investigation, Seattle Police discovered that Wood possessed a number of counterfeit driver’s licenses and sought the assistance of the Social Security Administration’s Office of Inspector General. The Kings County Sherriff’s Office, FBI, U.S. Postal Inspection Service and U.S. Secret Service’s Electronic Crimes Unit also assisted in the investigation.
Wood pled guilty to violations of federal laws governing identity theft (18 U.S.C. sec. 1038(A)), wire fraud (18 U.S.C. sec. 1343) and the Computer Fraud and Abuse Act (18 U.S.C. sec. 1030(a)(4)). He is also required to pay over $25,000 in restitution to a number of parties, including Bank of America, American Express and other financial institutions (for the complete list, see the judgment filed in court earlier this week (.pdf)).