Two members of Anonymous Cambodia, an arm of the global hacking group, were arrested this month on charges of infiltrating government websites and stealing sensitive data, following an eight-month operation by local authorities and the U.S. Federal Bureau of Investigation (FBI), according to a statement posted Tuesday on the National Police website.
Bun Khing Mongkul Panha, 21, who goes by the online names Sex Machine and Black Cyber, and Chou Songheng, 21, who goes by Zoro, were arrested on April 7 for hacking a total of 30 government websites, including those of the National Election Committee (NEC), Ministry of Foreign Affairs, Ministry of Defense, Anti-Corruption Unit and Phnom Penh Municipality, as well as some private sector sites, according to the statement.
Mr. Panha confessed to hacking the sites, while Mr. Songheng said he was only Mr. Panha’s student, the statement said.
“He just wanted to learn about it. That is why he decided to join the hacker group,” the statement said of Mr. Songheng.
Both men were third-year students at the SETEC Institute, a Phnom Penh-based university offering degrees in information technology.
The two were arrested under articles 427, 428 and 429 of the Cambodian Criminal Code, which relate to information technology.
They are unauthorized access to an automated data processing system; obstructing the functioning of an automated data processing system; and the fraudulent introduction, deletion or modification of data.
The offenses each carry a fine between $500 and $1,000 along with a jail term of between one and two years.
Cambodia currently has no cyber crime law.
The attacks on government websites were Distributed Denial of Service (DDoS) attacks, in which the sites were taken offline and data was stolen from them.
The release offers few details about the investigation, but says the National Police are continuing to work with the FBI “to get more hackers.”
Dim Chaoseng, the lawyer for Mr. Panha and Mr. Songheng, said Tuesday that the Phnom Penh Municipal Court has questioned his clients and sent them to Prey Sar prison.
“The suspects are still under investigation by the court, so they have detained them for trial,” he said.
The arrests came a few days before a draft copy of Cambodia’s cybercrime law was made available online. The law has harsher penalties than the Cambodian Criminal Code for similar crimes relating to information technology.
“These are not considered major crimes,” Mark Rasch, the former head of the U.S. Department of Justice Computer Crime Unit, said about Mr. Panha and Mr. Songheng. “Since [Cambodia] doesn’t have a cybercrime law, they can’t charge them with more serious crimes.”
Mr. Rasch, who now is chief privacy and data security officer for the U.S. government contractor Science Applications International Corp., said that although it is possible that Cambodia’s government asked the FBI for help in tracking down the hackers, a more likely scenario is that the FBI discovered information about Anonymous Cambodia in their transnational investigation of the group, and handed that information off to Cambodian authorities.
Lieutenant General Chhay Sinarith, director of the Ministry of Interior’s internal security department, said authorities arrested Mr. Panha and Mr. Songheng as part of an ongoing joint investigation by the National Police and the FBI.
“The National Police were cooperating with the FBI to conduct an investigation on [hacking] when we found out these two suspects hacked the NEC…and other government institutions,” he said.
U.S. Embassy spokesman Sean McIntosh declined to comment when asked about the FBI’s assistance with the case. “We do not comment on ongoing investigations,” he said.
In July 2013, three members of Anonymous Cambodia took credit for sabotaging two NEC websites. In the attack on the NEC’s voter list website, the hackers posted a photo of Guy Fawkes masks, the final scene of Charlie Chaplin’s 1940 anti-fascist film “The Great Dictator” and a letter to Cambodians written by King Norodom Sihamoni.
In the months that followed, the group claimed responsibility for dozens more hacks, mostly of government websites, including the Council of Ministers’ Press and Quick Reaction Unit, the Council of Legal and Judicial Reform and state-run television station TVK.
In September 2013, the global group Anonymous posted a video online under the title “Operation Freedom,” saying it had “declared war” on the ruling CPP in response to clashes with political protesters that left one person dead.
In a face-to-face interview last year with a man who identified himself as Black Cyber, he said hacking Cambodian government websites was easy.
“We’ve hacked the NEC websites, the Ministry of Foreign Affairs…and now I hacked into the Anti-Corruption Unit [ACU] and I am watching them,” he said. “Their password was as simple as 1, 2, 3, 4, 5.”