US charges 17 Iranians for alleged cyber theft of university data

DOJ says group stole 31 terabytes, compromised 8,000 professor emails

The US Department of Justice charged 17 Iranian nationals Tuesday for their alleged role in a years-long cyber theft campaign that prosecutors say compromised computer systems at 144 American universities, 178 international academic institutions, and at least five US federal and state government agencies.

According to the indictment, returned by a federal grand jury in the Southern District of New York, members of the Iran-based Mabna Institute carried out a coordinated campaign of intrusions that began in approximately 2013 and continued until at least December 2017. The DoJ said the operation stole more than 31 terabytes of academic data and intellectual property worth approximately $3.4bn.

FBI Assistant Director in Charge James C Barnacle Jr described the attacks as “a serious threat to our national security,” according to a department statement. Many of the operations were conducted on behalf of Iran’s Islamic Revolutionary Guard Corps, as well as for “other Iranian government and university clients,” the DoJ said.

“Backed by the IRGC, this operation reflects a broader, organised effort to target US institutions and global partners,” Barnacle said.

US Attorney for the Southern District of New York Jamie McDonald, whose office is handling the prosecution, framed the alleged conduct in strategic terms. Cyber operations have “become a central instrument of national power,” McDonald said, warning of what he called the dangerous impact cyber attacks have on US security and the economy.

Beyond the academic targets, the indictment alleges the Mabna Institute compromised employee email accounts at at least five US federal and state government agencies, according to the DoJ. At least 42 US-based private companies and 11 foreign companies based in Germany, Italy, Switzerland, Sweden, and the United Kingdom were also targeted, the department said.

The Mabna Institute was founded in 2013, according to the indictment, with the stated mission of assisting Iranian academic organizations in “stealing access to non-Iranian scientific resources,” the DoJ said.

The charges announced Tuesday build on earlier prosecutorial action. Nine of the 17 individuals named in the new indictment were previously charged in a seven-count indictment unsealed in March 2018, the department said.

The DoJ also announced a $10m (£7.3m) reward for information leading to the location of five of the charged individuals.

The intrusions targeted roughly 100,000 academic accounts worldwide and successfully compromised around 8,000 professor email accounts across the 144 US universities and 178 international academic institutions, prosecutors alleged.