Edwin Andres Pena, Extradited Hacker Sentenced for Masterminding First-Ever Hack Into Internet VoIP Phone Networks

September 27, 2010

The first individual ever charged with hacking into the networks of Voice over Internet Protocol (VoIP) providers and reselling hacked VoIP services for a profit was sentenced today to 120 months in prison. Edwin Andres Pena, 27, transmitted over 10 million minutes of unauthorized telephone calls over the victims' networks.

Pena, a Venezuelan citizen, fled the United States after his arrest in 2006. The ensuing chase across South and Central America ended on February 6, 2009, when Pena was apprehended in Mexico. Following his extradition to the United States, Pena pleaded guilty before United States District Judge Susan D. Wigenton to one count of conspiracy to commit computer hacking and wire fraud and one count of wire fraud on February 3, 2010. Judge Wigenton also imposed the sentence today in Newark federal court.

United States Attorney Fishman stated: "Theft is theft whether you rob a bank or hack into somebody else's network and steal their services. Hackers attacking new and emerging technologies should not assume that law enforcement cannot keep up with them, even when they operate from the shadows or from other countries."

According to documents filed in this case and statements made in court: Pena was the mastermind behind a scheme to defraud VoIP telephone service providers, purporting to be a legitimate wholesaler of Internet-based phone services and selling discounted service plans to his unsuspecting customers. He was able to offer such low prices because he would secretly hack into the computer networks of unsuspecting VoIP providers, including one Newark-based company, to route his customers' calls. Through this scheme, Pena sold more than 10 million minutes of Internet phone service to unknowing telecom businesses at deeply discounted rates, causing a loss of more than $1.4 million in less than a year. The victimized Newark-based company, which transmits VoIP services for other telecom businesses, was billed for more than 500,000 unauthorized telephone calls routed through its calling network that were "sold" to the defendant's unwitting customers.

Pena enlisted the help of others, including a professional "hacker" in Spokane, Washington. The hacker, Robert Moore, was previously sentenced to 24 months for his role in the conspiracy. Moore admitted at his plea hearing to conspiring with Pena and to performing an exhaustive scan of computer networks of unsuspecting companies and other entities in the United States and around the world, searching for vulnerable ports to infiltrate their computer networks to use them to route calls. As an example, according to records obtained from AT&T, between about June 2005 and October 2005, more than six million scans were initiated by Moore in search of vulnerable network ports. During the same period, AT&T records reveal only two other users with a greater number of scans on its entire global network.

After receiving information from Moore, Pena reprogrammed the vulnerable computer networks to accept VoIP telephone call traffic. He then routed the VoIP calls of his customers over those networks. In this way, Pena made it appear to the VoIP telephone service providers that the calls were coming from a third party's network. As a result, the providers were unable to identify the true sender of the calls for billing purposes. Consequently, individual VoIP telecom providers incurred aggregate routing costs of up to approximately $300,000 per provider without being able to identify or bill Pena.

Pena purchased real estate, new cars, and a 40-foot motor boat in order to disguise the money obtained from the hacking scheme—putting all that property except for one car in the name of an individual identified in court documents as "A.G." Following his June 2006 arrest, federal agents executed a seizure warrant for Pena's 2004 BMW M3, which was purchased and significantly customized with proceeds from his scheme.

In addition to the prison term, Judge Wigenton sentenced Pena to three years of supervised release, but noted he would be deported following the conclusion of his sentence. Pena was also ordered to pay restitution in the amount of $1,012,311.

The government is represented by Assistant U.S. Attorney Erez Liebermann in the U.S. Attorney's Office Computer Hacking and Intellectual Property Section, within the Office's Economic Crimes Unit.