An indictment charging a former U.S. Department of Energy (DOE) and U.S. Nuclear Regulatory Commission (NRC) employee with an attempted spear phishing attack was unsealed last week.
Charles Harvey Eccleston, 62, allegedly sent dozens of spear phishing emails in January 2015 to DOE employees' emails, the Department of Justice (DOJ) wrote in a press release. He faces four felony offenses, including three counts of crimes involving unauthorized access of computers and a wire fraud charge.
Eccelston allegedly wanted to cause damage to the department's network and infect it with a virus that would extract nuclear weapons information for a foreign country.
Although a U.S. citizen, Eccleston had been living in Davos City in the Philippines since 2011 following his termination from the NRC in 2010. He was detained in Manila at the end of March and deported to the U.S. to face criminal charges.
The FBI apparently noticed Eccleston after he went to a foreign embassy and offered to provide classified U.S. government information. He then met with FBI undercover employees who pretended to represent this foreign country. They said they'd be interested in paying him to design and send spear phishing emails. No virus or malicious code was actually transmitted, the DOJ wrote.
Eccleston allegedly “prepared lists of email addresses of employees of the DOE to whom emails containing malicious computer code should be sent,” the arrest warrant stated. He also allegedly prepared the text for the email which appeared as “innocuous announcements for nuclear training and education conferences.”
His wire fraud charge faces a fine or jail sentence of up to 20 years, and the unauthorized access of computers charges face a fine or imprisonment for up to 10 years.
