PHOENIX – In Arizona, an IT contractor has been sentenced to four years of federal probation after pleading guilty to wire fraud as part of an attempt to extort a former client, using a gay porn site as the vehicle of his unsuccessful extortion.
Tavis Tso, a 40 year-old resident of Tempe, was originally charged with 11 counts, including one count of “fraud and related activity in connection with computers” and ten counts of wire fraud. In exchange for a guilty plea, prosecutors agreed to drop all but a single wire fraud charge.
According to court documents, the company (which is not identified in the documents) originally had Tso set up its GoDaddy account in June 2011. In May 2015, the company wanted to update its contact information with GoDaddy and got in touch with Tso to request login information for the account.
Tso then “falsely told the company’s staff members that he did not have the account login information” for the account and was unable to access it.
Evidently seeing an opportunity for a quick and easy scam, Tso subsequently accessed the company’s account and changed the contact information “in order to defraud the company.” A few days after he’d altered the account information, Tso turned the company’s site into a blank page. Tso then contacted staff members of the company and told them he could return site to normal in exchange for a payment of $10,000.
According to the indictment, and as Tso admitted in his plea agreement, “the company refused the offer, and the company’s website was subsequently redirected to www.teengaydick.com.”
It’s not clear how the company regained control of the site, but according to the sentencing memorandum filed by the prosecutor handling the case, the redirection didn’t last long.
“Customers who attempted to visit the company’s website were redirected to the pornography website for several days before the company was able to regain control of its account,” the memorandum states.
As noted by prosecutors, the damage done to the company wasn’t merely a reputational hit stemming from briefly having its URL point to a gay porn site; there were direct, quantifiable costs, as well.
“During the incident, employees at the company had no access to email, significantly impacting business operations,” the memorandum states. “Additionally, following the incident, the company was forced to purchase a new domain name and order new business cards, among other expenses.”
Given the number and nature of the counts in the initial indictment, Tso could have faced severe punishment for the crime, but the prosecutors seem to have been inclined to cut him a break, in large part because this is Tso’s first serious brush with the law.
“Tso is a college educated, gainfully employed, 39-year-old, with no prior criminal convictions,” prosecutors wrote in the sentencing memorandum. “The conduct here is serious and troubling, but it appears to be out of character for Tso. Given the fact that this appears to be a one-time lapse in judgment, a term of probation is the best way to address the seriousness of this offense, while affording adequate deterrence to future criminal conduct and protecting the public from future crimes.”
Beyond serving as an object lesson in how not to conduct an extortion attempt (let alone how to offer IT services), Tso’s case presents a compelling reason for companies to not over-rely on outside contractors when it comes to things like maintaining accounts with registrars.
While it might not be realistic to expect company executives or ownership to always have a solid handle on technical issues, they should at least have the foresight to make sure accounts which are mission-critical to the operation of the company’s online properties are accessible by someone in-house, even if that person isn’t fully IT-capable.
Presumably, rogue IT contractors like Tso are rare, but to leave something like access to your company’s GoDaddy account entirely in the hands of an outside contractor is still a facepalm-worthy oversight.
