White hat hackers should heed caution when thinking about whose information they chose to tinker with while researching security flaws. While many Americans and security researchers alike do want to see the tax returns of President Trump, few would risk going to jail to get their hands on the documents.
But to jail private investigator Jordan Hamlett will go. Last week the Sunset, Louisiana, native was convicted for false representation of a social security number. In addition to being ordered to pay $14,794.96 in restitution to the U.S. Department of Education, Hamlett has been sentenced to 18 months in federal prison, with an additional two years of supervised release.
In September 2016, Hamlett, who has a history of reporting security flaws, attempted to use the president’s social security number to file a Free Application for Federal Student Aid (FAFSA), a crime to which he pleaded guilty in December 2017. The charges had many in the security industry concerned about the limitations of what ethical hackers were permitted to do within the confines of the law.
Federal law enforcement agencies argue that Hamlett committed a serious crime when he used a data retrieval tool of the IRS and made six unsuccessful attempts to access the president’s federal tax information, though the accused said he had no intention to deceive.
In a memo submitted to the U.S. District Court's Middle District of Louisiana on October 26, 2017, Hamlett's attorney wrote, "Hamlett attempted to call the IRS and provide notice of his belief that the FAFSA Data Retrieval Tool contained major vulnerabilities...[and] investigative resources of the federal Government have been unable to produce one shred of evidence that Hamlett was intending to do anything other than his stated intent."
Forbes Magazine reported that after Hamlett had pleaded guilty, “the DRT was made unavailable on student financial aid websites, fafsa.gov and StudentLoans.gov. At the time, the IRS noted that it was working to resolve a security issue but 'the online data tool will be unavailable for several weeks.'"
The case involved several federal agencies, from the FBI to the Department of Education, all of whom agree that Hamlett’s sentencing underscores the severity of the crime and that serious crimes beget hefty consequences. U.S. Attorney Brandon J. Fremin said the sentence “should send a strong signal to those who would misuse the identities of others.”
“Attempts to obtain federal tax information of any American through fraudulent or deceptive practices by illegally using personal identifying information will not be tolerated," Fremin said. "Every American up to and including the President of the United States should enjoy a certain level of comfort knowing that his personal identifying information is not being used for illicit purposes."
FBI Special-Agent-in-Charge Eric J. Rommal said, “The FBI will vigorously investigate criminals who exploit government information systems using other’s personally identifiable information, in full cooperation with our law enforcement stakeholders."