Computer Attacks—Jason Salah Arabo

The owner of two web-based companies (www.customleader.com and www.jerseydomain.com) has pleaded guilty “to conspiring to conduct highly destructive computer attacks on competitors of his online sportswear business.”^[1] One of the victims of Jason Salah Arabo, a 19-year-old Michigan man, was a web-based New Jersey company, Jersey-Joe.com.^[2] Mr. Arabo’s websites sold sports apparel, “including reproductions of sports uniforms, popularly known as ‘retro’ or ‘throwback’ jerseys.”^[3]

In his guilty plea, Mr. Arabo admitted that he met a New Jersey resident, 16-year-old Jasmine Singh, through the use of an instant message service; Mr. Singh was known online as “Pherk.”^[4] Mr. Singh told Mr. Arabo that he had “covertly infected some two thousand personal computers with programs that enabled him to remotely control them, [and] that he could command these computers to conduct attacks, known as distributed denial of service, or ‘DDOS’ attacks, on computer servers and disable websites supported by those servers.”^[5]

In exchange for merchandise, such as designer sneakers, Mr. Arabo asked Mr. Singh to ”take down” his competitors, one of whom was Jersey-Joe.com.^[6] The attacks began in July 2004, and continued until December 2004 “when FBI agents and New Jersey State Police investigators conducted a search of Singh’s Edison, New Jersey home and seized his computer.”^[7] Mr. Singh pleaded guilty as an adult in August 2005 in New Jersey State Superior Court, where he received a five-year prison sentence.^[8]

Mr. Arabo was charged by criminal complaint in March, 2005, under 18 U.S.C. § 1030(a)(5)(A)(i), which carries a potential punishment of a fine, imprisonment for up to ten years or both.^[9] At sentencing, one of the factors that will be considered is the amount of loss caused by the individual’s actions.^[10] From the press release, it seems that the government is trying to show that far more than just Mr. Arabo’s competitors were affected by the DDOS attacks. “The attacks caused widespread harm and disruption to Internet and computer services far beyond the online businesses that [Mr.] Arabo targeted,” it says.^[11] The ISPs that hosted the targeted websites hosted other businesses which were affected, and the government claims “that the attacks affected businesses as far away as Europe, and caused disruption to the operations of major online retail businesses, banks, and companies that provide communications, data backup, and information services to the medical and pharmaceutical industries.”^[12] Thus, rather than the loss equaling $35,000, which Mr. Singh was ordered to pay as restitution and which would raise the offense level by only 6 levels,^[13] the government would no doubt like to claim that the losses amounted to millions of dollars, which could raise the offense level by 16 levels or more. That could mean that rather than receiving, say, 10-16 months in prison, he could receive 41-51 months.^[14]

---

[1] US Attorney’s Office, Michigan Man Admits Conspiracy to Order Destructive Computer Attacks on Business Competitors, Apr. 12, 2006.
[2] Id.
[3] Id.
[4] Id.
[5] Id.
[6] Id.
[7] Id.
[8] Id.
[9] 18 U.S.C. § 1030(c)(4)(A).
[10] See US Sentencing Guidelines § 2B1.1(b)(1).
[11] USAO, supra note 1.
[12] Id.
[13] See USSG, supra note 10, § 2B1.1(b)(1)(D).
[14] See id. § 2B1.1.(b)(1)(I).