University Times

The second of two Ohio men who were convicted of posting on YouTube threats to release sensitive Pitt computer data has been sentenced in federal court on a conspiracy charge.

Judge Joy Flowers Conti on July 8 sentenced Brett Hudson to a split sentence of three months of incarceration in a community confinement center, followed by three months of home detention as part of two years of supervised release for his role in the April 2012 cyberthreats.

Conti on May 28 sentenced co-conspirator Alexander Waterland to one year and one day in federal prison, followed by two years of supervised release on one count of extortion. (See May 30 University Times.)

The two former co-workers pleaded guilty in separate hearings for their roles in posting a video “Anonymous Message to the University of Pittsburgh” on YouTube that purported to be from the hacktivist group Anonymous.

The YouTube post claimed that data had been taken from University servers and threatened to release it unless the chancellor posted an apology for not caring for students’ data. (See May 3, 2012, University Times.) The threats also included additional posts in response to comments on the original YouTube video, plus Twitter messages and emails to University officials repeating the men’s demands.

No sensitive data actually were taken, but the threats diverted IT staff time and upset members of the University community who feared that sensitive information would be released.

In handing down the sentence, the judge referenced the victim impact statement submitted by Ted P. Fritz, Pitt’s associate general counsel. It stated, in part, “When the University was starting to feel some relief from bomb threats that appeared to have ended in late April, these new cyberthreats occurred and swung the general emotions at the University to ones of alarm and concern that the University was under a new type of cyberattack.”

Conti told Hudson, “It’s very clear it wasn’t just the University and the University officials that were put out by what happened here,” noting the effect on students who may have feared personal data had been stolen.

“It can’t be tolerated,” she said. “That’s why it’s a criminal offense and it’s a serious criminal offense.”

Although the judge said Hudson and Waterland were “completely equal in the execution of the events” with one not more culpable than the other, she said Hudson’s lighter sentence was based largely on a motion filed on his behalf by the government.

The judge also took note of a letter filed with the court on Hudson’s behalf in which Stephen Scott, manager of the mobile phone shop where Hudson is employed, described Hudson as a hard worker and good father to his two daughters.

Conti told Hudson she found his involvement in the threats inexplicable. “I couldn’t really see anything in your background why you would have engaged in this conduct,” she said, adding that some period of incarceration was required to send the message “You’re going to get some time in jail” to anyone considering similar acts.

The sentence was more lenient than the 18-24 months jail time provided for in federal sentencing guidelines. In addition, due to Hudson’s inability to pay, the judge waived fines that could have been as high as $40,000. Instead she levied only a $100 required assessment.

Hudson’s attorney, Werner Mariani, requested his client have work release while in the community confinement center.

As with Waterland, the provisions of Hudson’s supervised release include permission to have access to a computer and the Internet, subject to monitoring of his computer, cellphone and electronic communication or electronic storage devices.

—Kimberly K. Barlow