The Department of Justice on Friday booked two alleged criminals extradited from Cyprus, a judicial first.
The first, Ghassan Diab, a Lebanese, was accused of laundering drug trafficking proceeds in support of Hezbollah’s global criminal-support network through the use of the black market peso exchange.
The second, Joshua Polloso Epifaniou, a Cypriot, stole personal identifying information from websites in order to extort the website owners into paying ransoms under threat of public disclosure of the sensitive data.
Cyprus amended its Constitution in 2013 to allow for the extradition of Cypriot nationals to a European country or to a third country on the basis of a European arrest warrant. The warrant can also be on the basis of a bilateral or multilateral treaty that the Republic of Cyprus has signed. This comes with the understanding that the corresponding country would extradite its citizens as well.
In 2003, the United States and the European Union entered into an extradition agreement. The articles of the U.S.-E.U. agreement were incorporated into the pre-existing bilateral treaty to create a new bilateral treaty with Cyprus that was signed in 2006.
“These successful extraditions demonstrate the commitment of the Department of Justice to support local, state and federal law enforcement agencies throughout the United States and our strong working relationship with dedicated foreign partners who assist in apprehending foreign fugitives wherever they may be hiding. Thanks to the efforts of our law enforcement partners in Cyprus, Ghassan Diab and Joshua Polloso Epifaniou will now be held accountable in the United States for their alleged crimes,” said Brian C. Rabbitt, Acting Assistant Attorney General of the Justice Department’s Criminal Division.
Diab, 37, was previously identified as an alleged Hezbollah associate and charges against him were announced in October 2016 by the Miami-Dade State Attorney’s office. At that time his whereabouts were unknown.
The Hezbollah organization and its military wing are known as a terrorist organization in 18 countries, the Arab League and the European Union.
Diab is charged in the State of Florida, Circuit Court of the Eleventh Judicial Circuit in and for Miami-Dade County. He has two counts of money laundering over $100,000, two counts of conspiracy to launder over $100,000, two counts of unlicensed transmission of currency over $100,000. There are also two counts of unlawful use of a two-way communications device to further the commission of money laundering, all felonies under Florida law.
On March 9, 2019, Diab was provisionally arrested in Cyprus for purposes of extradition at the Larnaca International Airport upon his arrival from Beirut, Lebanon. This was based on a request from the United States in accordance with the U.S.-Cyprus Extradition Treaty. The court in Cyprus found him extraditable to the United States on September 27, 2019.
Epifaniou, 21,arrived at John F. Kennedy Airport in New York on Friday, after being extradited from the Republic of Cyprus. He was originally arrested in February 2018. Epifaniou is the first Cypriot national extradited by Cyprus to the United States.
A five-count indictment filed in the Northern District of Georgia charges Epifaniou with conspiracy to commit wire fraud, wire fraud, conspiracy to commit computer fraud and identity theft, and extortion related to a protected computer.
According to the indictment, between approximately October 2014 and November 2016, Epifaniou worked with co-conspirators to steal personal identifying information from user and customer databases at victim websites in order to extort the websites into paying ransoms under threat of public disclosure of the sensitive data.
The indictment alleges that Epifaniou obtained confidential personal identifying information from these websites including from a free online game publisher based in Irvine, California; a hardware company based in New York, New York; an online employment website headquartered in Innsbrook, Virginia; and an online sports news website owned by Turner Broadcasting System Inc. in Atlanta, Georgia.
This was done either by directly exploiting a security vulnerability at the websites and stealing user and customer data, or by obtaining a portion of the victim website’s user data from a co-conspirator who had hacked into the victim network.
Epifaniou allegedly used proxy servers located in foreign countries to log into online email accounts and send messages to the victim websites threatening to leak the sensitive data unless a ransom was paid. He is alleged to have defrauded the entities of $56,850 in bitcoin, and two victims incurred losses of over $530,000 from remediation costs associated with the incident.
Epifanou is scheduled for his arraignment on Monday, July 20, before U.S. Magistrate Judge Alan J. Baverman in the Northern District of the State of Georgia.
In the District of Arizona, Epifaniou is charged in a 24-count indictment with conspiracy to commit computer hacking, obtaining information from a protected computer, intentional damage to a protected computer, and threatening to damage a protected computer.
The indictment alleges that on Oct. 30, 2016, Epifaniou obtained unauthorized access to the database of Ripoff Report (ROR), a company located in Phoenix, Arizona, through a brute force attack. A brute force attack is a trial-and-error method used to obtain information, such as a user password or personal identification number.
Epifaniou allegedly used the attack to successfully override ROR’s login and password protection to access its database through an existing account for a ROR employee. On Nov. 18, 2016, Epifaniou emailed ROR’s CEO using an email address, threatening to publicly disseminate stolen ROR data unless the company paid him $90,000 within 48 hours.
According to the indictment, Epifaniou emailed again the following day with a hyperlink to a video recording demonstrating Epifaniou’s unauthorized access to the ROR CEO’s account. The indictment additionally alleges that between October 2016 and May 2017, Epifaniou worked with an associate at “SEO Company,” which was a search engine marketing company based in Glendale, California, to identify companies that might be interested in paying for removal of complaints posted on ROR’s website, which Epifaniou would then illegally remove through unauthorized access to the ROR database. Epifaniou and his co-conspirator removed at least 100 complaints from the ROR database, charging SEO Company’s “clients” approximately $3,000 to $5,000 for removal of each complaint.
The Diab case was investigated by DEA’s Miami Field Division and Special Operations Division. Assistant State Attorney Adam C. Korn, Executive Director of the South Florida Financial Crimes Strike Force of the Miami-Dade State Attorney Katherine Fernandez Rundle Office is prosecuting the case.
The Epifaniou case was investigated by the FBI Atlanta and Phoenix Field Offices. Assistant U.S. Attorney Nathan Kitchens of the Northern District of Georgia is handling the prosecution in that District and Assistant U.S. Attorneys James Knapp and Andrew Stone are handling the prosecution in the District of Arizona.