Boy 'faces custody' over Twitter airline bomb hoaxes
A 16-year-old boy has been warned he faces custody after being convicted of sending bomb hoaxes to American Airlines and Delta Air Lines via Twitter.
The teenager, who cannot be named for legal reasons, previously admitted carrying out cyber attacks around the world, including on his local police force and SeaWorld.
He targeted websites in Africa, Asia, Europe and North America from his laptop in the bedroom of his home in Plympton, near Plymouth, Devon.
Devon and Cornwall Police's website was affected for 45 minutes while SeaWorld suffered disruption and a loss of earnings, Plymouth Youth Court heard.
The boy admitted carrying out the denial of service attacks but denied two offences under Section 51 of the Criminal Law Act, relating to bomb hoaxes.
But District Judge Diane Baker found the boy had sent tweets to American Airlines, the White House and Delta Air Lines on February 13 last year.
One posted at 6.46pm to American Airlines read: "One of those lovely Boeing airplanes has a tick, tick, ticking in it. Hurry gentlemen, the clock is ticking."
Another, sent six minutes earlier to Delta Air Lines, read: "There's a nice tick, tick in one of those lovely Boeing planes, high quality."
The judge warned the boy, who has no previous convictions, that he could receive a custodial sentence when he is dealt with later this month.
"You may be a young man but you are a clever young man," she told the teenager, who sat next to his mother in the court.
"It is the level of detailed planning, the level of sophistication that there was to hide what had happened and the fact that there were two bomb hoaxes.
"I am aware from the denial of service attacks there was quite a lot of disruption for Devon and Cornwall Police's site.
"There was disruption and loss of earnings in relation to the SeaWorld site.
"It clearly passes the custody threshold and that is something I have to look at."
The boy was charged with the five offences in November and initially admitted the allegations before later insisting he had not tweeted the threats.
He suggested that a remote access trojan (RAT) - in which an attacker controls a computer remotely - could be responsible.
But computer experts found Skype conversations between the boy and an online contact named Whitehat discussing how to carry out the hoaxes.
The judge described Whitehat as "a relatively sophisticated computer operator" who regularly discussed illegal computer misuse.
"I am sure that it was you personally, on the encouragement of Whitehat, who sent both bomb hoaxes," she told the boy.
"You did so knowing how serious such actions would be. The planning involved was both detailed and sophisticated."
The judge adjourned the case until July 20 to allow for reports to be carried out.
Giving evidence during his one-day trial, the boy said: "A large part of the websites that I had taken down were to do with dolphin-hunting.
"I have always been for animal rights and I am really into computers and things so I thought, in protest, and to see what I could do, I would do it.
"I joined up with other people who were doing it. I was fighting for animal rights. I was 14 and 15 then."
He denied sending the tweets, telling the judge: "I feel I could have been stitched up by, I don't know, but I think I could have been disliked by someone in the past and they have done it to me."
The court heard that the teenager had sent tweets to the Operation Zephyr Regional Cyber Crime Unit and an email to the investigating police officer following his interviews.
One tweet said: "To be fair, they caught me red-handed", while a second added: "I still maintain the utmost respect for Zephyr."
The email read: "I can't bear this any longer. I would prefer if you didn't discuss this with my Mum please.
"I have messed up, I know that and I won't do anything so stupid ever again."
Prosecuting, Ben Samples said the FBI was notified of the boy's tweets and senior management at the airlines investigated them.
The threats were viewed as "unspecific" and the matter was referred to the UK authorities, with no further action taken by the airlines.
Investigations from the Operation Zephyr Regional Cyber Crime Unit traced the tweets to a computer used solely by the teenager.
Analysis found he had committed distributed denial of service attacks, which involve sending large quantities of data to specific websites - causing them to crash.
Devon and Cornwall Police's website was attacked on January 26 last year, while SeaWorld in Florida was targeted between October 29 and November 24 in 2014.
The boy carried out attacks on a number of foreign governmental and non-governmental sites between October 12 2014 and January 27 last year.
Detective Sergeant Aled Jones, from the South West Regional Cyber Crime Unit, said the conviction was "the result of a lengthy and wide-ranging investigation" into the boy.
"This result demonstrates that these types of offences are taken seriously and that we do have the capability to identify arrest and prosecute those responsible," he said.
"In this case we worked closely with law enforcement colleagues both in Devon and Cornwall Police and the USA, as well as with the Crown Prosecution Service, to present a compelling case to the court.
"I hope that this case will serve to dissuade other like-minded people from engaging in similar criminal activity."
Speaking after the case, Mr Samples said: "The defendant knew what he was doing was wrong and deliberately targeted a number of websites, causing them to crash temporarily.
"One of those websites was that of Devon and Cornwall Police, making it much harder for the public to access the help and support they needed.
"I hope this will send a message to anyone who thinks they can hide online or use social media to create a climate of fear that they will have to face the consequences of their actions."