Two hackers charged with making false bomb threats to hundreds of schools

Two computer hackers have been charged with sending false bomb and mass shooting threats to hundreds of schools in Britain and the U.S., including dozens in southern California, according to a federal indictment unsealed Tuesday.

The defendants are members of the Apophis Squad, a worldwide collective of computer hackers intent on using the internet to sow chaos, the indictment says.

Timothy Dalton Vaughn, 20, of Winston-Salem, North Carolina — who according to the indictment used online handles that include “WantedbyFeds” and “Hacker_R_US” — was arrested Tuesday by FBI agents.

The second defendant named in the indictment — George Duke-Cohan, 19, of Hertfordshire, United Kingdom, who used online handles that included “DigitalCrimes” and “7R1D3N7” — is currently serving a prison sentence in Britain for making a hoax threat targeting an airliner.

The indictment alleges that Apophis Squad targeted several individuals, businesses, and institutions in the U.S. and the United Kingdom, employing tactics such as “swatting,” in which a false report is made to trigger the deployment of emergency response teams. Members made threats of bombs and school shootings that were “designed to cause fear of imminent danger and did cause the closure of hundreds of schools on two continents on multiple occasions,” the indictment says.

According to the indictment, the conspiracy spanned the first eight months of 2018, during which members of Apophis Squad communicated various threats sometimes using “spoofed” email addresses to make it appear the threats had been sent by innocent parties, including the mayor of London, the indictment says.

They also allegedly defaced websites and launched denial-of-service attacks, a technique in which a hacker disables a computer network by flooding it with large amounts of data.

Vaughn carried out one such attack that took down the website of a Long Beach motorsport company, Hoonigan, for three days, the indictment says. He also sent extortionist emails to the company demanding a Bitcoin payment to cease the attack, according to the indictment.

The indictment alleges that Duke-Cohan called the FBI field office in Omaha on multiple occasions, discussed the deployment of deadly pathogens in the office, and threatened to rape and kill the wife of the FBI personnel who answered the phone. The British national also called the FBI Omaha office claiming he was going to set off a pipe bomb at Los Angeles International Airport, the indictment says.

Vaughn bragged in an online forum that Apophis Squad had targeted over 2,000 schools in the United States and more than 400 in the United Kingdom, according to the indictment, which details threats about imminent shootings and bombs being sent to school districts across Southern and Central California. Duke-Cohan allegedly posted a message on Twitter taking credit for the hoax emails on behalf of Apophis Squad in which he said, “We are OPEN for request for school lockdowns / evacs.”

The indictment says the Apophis Squad also took credit for hacking and defacing the website of a university in Colombia, resulting in visitors to the site seeing a picture of Adolf Hitler holding a sign saying, “YOU ARE HACKED,” alongside the message, “Hacked by APOPHIS SQUAD.”

The 11-count indictment charges Vaughn and Duke-Cohan with conspiracy and eight additional felony offenses, including making threats to injure in interstate commerce and making interstate threats involving explosives. Vaughn is additionally charged with intentionally damaging a computer and interstate threat to damage a protected computer with intent to extort.

Vaughn is expected to appear in a North Carolina court Tuesday afternoon. If convicted of all 11 charges in the indictment, he faces up to 80 years in federal prison. His lawyer was not immediately available for comment.

Duke-Cohan faces up to 65 years in federal prison if convicted of the nine charges in the indictment in which he is named.

The FBI led the investigation, with assistance from the U.S. Secret Service as part of the Electronic Crimes Task Force.