A man was charged on Tuesday with felony computer hacking for a phishing scheme that allegedly gave him illegal access to more than 100 email accounts, including those belonging to members of the entertainment industry in Los Angeles.
In a plea agreement also filed today, Ryan Collins, 36, of Lancaster, Pennsylvania, agreed to plead guilty to violating the Computer Fraud and Abuse Act, specifically, one count of unauthorized access to a protected computer to obtain information, according to the U.S. Attorney’s Office.
The names of the victims were not made public.
Although Collins has been charged in Los Angeles, the parties have agreed to transfer the case to Harrisburg in the Middle District of Pennsylvania, near Collins’ home, for the entry of his guilty plea and sentencing.
Collins faces up to five years in federal prison, but both sides have agreed to recommend a prison term of 18 months, according to the U.S. Attorney’s Office.
“Today, people store important private information in their online accounts and in their digital devices,” said Eileen M. Decker, the U.S. attorney in Los Angeles.
“Lawless unauthorized access to such private information is a criminal offense,” she said. “My office remains committed to protecting sensitive and personal information from the malicious actions of sophisticated hackers and cyber criminals.”
According to the plea agreement, from November 2012 until the beginning of September 2014, Collins engaged in a phishing scheme to obtain user names and passwords for the victims, sending email messages that appeared to be from Apple or Google.
When they responded, Collins then had access to the victims’ email accounts, from which he obtained personal information including nude photographs and videos, according to his plea agreement.
In some instances, Collins would use a software program to download the entire contents of the victims’ Apple iCloud backups, prosecutors said.
The charge against Collins stems from the investigation into the leaks of photographs of numerous female celebrities in September 2014 known as “Celebgate” — which even has its own Twitter account.
However, investigators have not uncovered any evidence linking Collins to the actual leaks, or that Collins shared or uploaded the information he obtained.
By illegally accessing the email accounts, Collins accessed at least 50 iCloud accounts and 72 Gmail accounts, most of which belonged to female celebrities, according to the U.S. Attorney’s Office.
“By illegally accessing intimate details of his victims’ personal lives, Mr. Collins violated their privacy and left many to contend with lasting emotional distress, embarrassment and feelings of insecurity,” said David Bowdich, the assistant director in charge of the FBI’s Los Angeles field office.
“We continue to see both celebrities and victims from all walks of life suffer the consequences of this crime and strongly encourage users of Internet-connected devices to strengthen passwords and to be skeptical when replying to emails asking for personal information,” he said.
No court dates were immediately set.
