By JONAH LOSSIAH
ONE FEATHER STAFF
The attorney representing Benjamin Cody Long, who has been accused of a December 2019 cyber-attack against the Eastern Band of Cherokee Indians (EBCI), has put forth three motions to reopen the defendant’s detention hearing since Jan. 2. After date changes, the Court reconvened just after 9:30 a.m. on Thursday, Feb. 6, with the judge hearing Long’s case first.
Long, a member of the EBCI, has been charged with Felony Tampering with Public Records (In violation of Section 14-70.12(a)(3)) and Felony Obstructing Government Functions (In violation of Section 14-70.14 (a)(2)).
Before hearing the motion to reopen the detention hearing, Judge Thomas Cochran said he received a motion to quash from the Attorney General yesterday. As of this morning, he granted that motion.
Judge Cochran also stated the basis for which a detention hearing would be reopened, and CC (Cherokee Code) 15-14(b) states:
“A detention hearing may be reopened after the first determination made by a Cherokee Court Judge at any time before trial only if such Judge finds that information exists that was not known to the movant at the time of the prior hearing and that has a material bearing on the issue of whether there are conditions of release that will reasonably assure the appearance of such persona as required and the safety of any other person and the community.”
Brent Smith, who has been representing Long, focused on a few issues in his argument.
Smith brought forth that the impact of the testimonies given by William Travitz and Atreyu Queen has changed since the initial detention hearing held on Dec. 11, 2019.
He pointed to the fact that Travitz testified that there were only three people (including Long) that had access to the ‘servadmin’ account used to reactivate Long’s credentials. Since that date, it has been discovered that there were more than three, though a specific figured has not been released.
Tribal prosecutors responded by saying that they have spoken to Travitz. At the time of the testimony, he did believe there were only three. He does know now that there are more that had access.
Smith also said that in the testimony of Queen, it was implied that the death of a tribal member could have been helped had it not been for delays to the Tribal dispatch systems. Since this testimony, the medical examiner of this individual indicated that they would not have survived regardless of the response time.
Prosecutors responded to this, agreeing that this is the information they shared with Smith. However, they followed that with the fact that there were over 100 emergency calls to dispatch, all of which would have been impaired by the cyberattack.
The other piece that Smith focused on was the email negotiations between the Tribe, Coveware (Ransomware Recovery Business the Tribe hired), and a third party who claimed responsibility for the attack. All of these communications were done after Long was detained with no access to electronics.
In this string of emails, the ‘hacker’ said that they acquired access to the tribal network from a Russian language hacker forum and had used those bought credentials to launch the attack. They claimed to have purchased access for just $30.
The hacker said that they had unlocked Long’s account for convenience and used it the most, but that they used all of the admin accounts in the process.
The hacker had first contacted Principal Chief Richard G. Sneed and Vice Chief Alan B. Ensley, who then turned it to Travitz. Within a week, Coveware took control of all communication with the supposed hacker.
Through Coveware, payment has been to this party, and the Tribe has received the codes to unlock the information held by the ransomware. Smith said that he believes the amount paid to be around $375,000.
Judge Cochran pointed to a specific email and read aloud the following:
“I personally bought access to your company, and I know where the attack came from. In addition, the network has been well studied by us for more than one week. I know everything that has happened since the infection. This is the negligence of the entire IT department, not one person.”
Cochran said that while this shows that there is another party involved, this does not clear the name of Long. He said that there is a possibility that Long knows this third party and has instructed them to perform these tasks if he was arrested.
The tribal prosecutors began their statements by saying that they did offer the defendant a chance to go home during the lead up to the trial.
Smith responded to this by saying, “It wasn’t much of an offer” – stating that conditions would revoke the defendant’s constitutional rights, including consent to sell all future motions.
The tribal prosecutors said they believe that there has been nothing offered since the initial detention hearing that would warrant reopening it. They also stated that they have more evidence that points toward the defendant once it is time to go to trial.
Cochran finished his questioning by asking the prosecutors if they have an idea of how vulnerable the current tribal Network is, and if they believe that Long could still cause damage if released. The prosecutors said that they would need to speak with the IT Department and could not offer a valid update of the strength of the network.
Smith’s last statements came regarding the hindrance that detention has had on his ability to work with his client. He said that without the internet, Long is losing significant money trying to maintain communications with him. Smith also spoke to the lack of precedence in the case, and that it has been difficult to research another ransomware case that has gone to trial.
Cochran said while that he felt for the position the defense was in, that he would deny all three motions to reopen the detention hearing.
Cochran also denied the Tribe’s motion to seal the case, which would prevent public access to evidence, transcripts, and other documents.
However, he finished by saying that he wished to craft an order to increase communication between the defendant and his attorney. He wanted to allow Long necessary access to technology to make this possible.
He then instructed that the prosecutors had until Friday, Feb. 14 to file the Tribe’s position of this order. Then, with that position received, they would reconvene on Thursday, Feb. 20 to work out the specifics of such an order.
Important Upcoming Dates of this Case:
- Friday, Feb. 14 – Tribe’s deadline to file their position of Cochran’s technology order.
- Thursday, Feb. 20 – Hearing to discuss technology order.
- Wednesday, March 11 – Status hearing regarding physical evidence.
- Wednesday, April 8 – Scheduled date for trial.
