US charges Swiss ‘hacktivist’ for data theft and leaks

The Justice Department has charged a Swiss hacker with computer intrusion and identity theft, just over a week after the hacker took credit for helping to break into the online systems of a U.S. security-camera startup.

An indictment against 21-year-old Tillie Kottmann was brought Thursday by a grand jury in the Seattle-based Western District of Washington.

Federal prosecutors said Thursday that Kottmann, of Lucerne, Switzerland, was initially charged in September. The range of allegations date back to 2019 and involve stealing credentials and data and publishing source code and proprietary information from more than 100 entities, including companies and government agencies.

Kottmann had described the most recent hack and leak of camera footage from customers of California security-camera provider Verkada as part of a “hacktivist” cause of exposing the dangers of mass surveillance.

Acting U.S. Attorney Tessa Gorman rejected those motives in a statement Thursday.

“These actions can increase vulnerabilities for everyone from large corporations to individual consumers,” Gorman wrote. “Wrapping oneself in an allegedly altruistic motive does not remove the criminal stench from such intrusion, theft, and fraud.”

Kottmann didn’t return an online request for comment. Swiss lawyer Marcel Bosonnet says he is representing Kottmann but declined further comment Friday.

Swiss authorities said they had raided Kottmann’s home in Lucerne late last week at the request of U.S. authorities. It’s not clear if U.S. prosecutors intend to try to extradite Kottmann, who remains in Lucerne and was notified of the pending charges. Prosecutors say the FBI recently seized a website domain that Kottmann used to publish hacked data online.

The indictment ties a number of hacks to Kottmann over the past year, including one targeting an unnamed security device manufacturer based in the Seattle region and another affecting a maker of tactical equipment.

In several cases, prosecutors said Kottmann improperly used valid employee credentials to gain access to source code databases. The indictment says Kottmann also hacked the Washington state Department of Transportation, an automobile manufacturer and a financial investment company.

The indictment doesn’t specifically mention last week’s high-profile hack of Verkada, which drew attention because it exposed live camera feeds and archived video footage from schools, jails, factories, gyms and corporate offices.

Kottmann, who uses they/them pronouns, told The Associated Press last week they belonged to a group nicknamed APT-69420 Arson Cats, a small collective of “primarily queer hackers, not backed by any nations or capital but instead backed by the desire for fun, being gay and a better world.”

Kottmann has previously attracted attention for leaking hacked material to expose security flaws, including from U.S. chipmaker Intel last year.

The indictment attempts to tie Kottmann’s efforts at self-promotion, including designing and selling clothing related to hacking and “anti-intellectual-property ideology,” into part of a broader conspiracy to commit computer fraud.

Matt O’Brien, The Associated Press