RICHMOND, Va -- A former special education teacher at Lee-Davis High School has admitted to hacking into the online accounts and emails of more than 200 people, including celebrities and non-celebrities, according to a federal plea agreement.
A CBS 6 investigation reveals that Ex-teacher connected to 'Celebgate' hacking scandal; local students targeted was connected to the 2014 "Celebgate" hacking, in which nude and sexually explicit photographs of movie stars and models were leaked on the internet.
In September 2014, headlines around the world reported on a hacker who gained access to online accounts of celebrities like Jennifer Lawrence, Kate Upton, Kirsten Dunst, and others. At the time, Lawrence called the hack and subsequent leaking of personal files "a sexual violation" and "disgusting."
In the months that followed, the FBI tracked down and arrested four men in connection to the "Celebgate" scandal. All four suspects either admitted guilt or took plea deals. This past August, the last of the four suspects - a Connecticut man named George Garofano - was sentenced to 8 months in prison after pleading guilty to one count of unauthorized access to a protected computer to obtain information.
Although it seemed like the "Celebgate" case had come to a close, CBS 6 discovered the name of a new defendant in a footnote at the bottom of page seven of Garofano's sentencing memorandum: Christopher Brannan.
Brannan was initially charged in California in April, but after agreeing to a plea deal with federal prosecutors, the case was moved to the U.S. District Court in Richmond, records show.
"The government has agreed to let the case transfer to the Eastern District of Virginia, which is near where Mr. Brannan lives," prosecutors write in a case transfer notice.
Property records show Christopher Brannan owns a home in eastern Henrico County. He is a licensed realtor, according to state records, but that was not his only job. From August 2013 to June 2015, Brannan was a special education teacher at Lee-Davis High School, Hanover school officials confirm.
"However, [Brannan] was immediately put on administrative leave in January 2015 upon being notified by the FBI of an investigation. We were not informed of the specific reason for or nature of the investigation. He remained on administrative leave for the duration of his employment. We did not renew his contract for the following school year," said Chris Whitley with Hanover County Schools.
Federal court documents state that Brannan intentionally hacked the internet accounts of more than 200 people between August 2013 and October 2014. The victims were not just the celebrities that were widely reported. Brannan targeted his own sister-in-law, who was a minor at the time, in addition to numerous students and teachers at Lee-Davis, court documents say.
Brannan was able to access the full iCloud backups of at least 18 people using a publicly available forensic software, and documents say the backups contained "sensitive and private photographs and videos." Brannan intended to keep the photographs and videos permanently, prosecutors wrote.
Investigators say Brannan was able to hack the accounts through a phishing expedition. By using bogus email addresses that appeared to come from Apple security, Brannan would get the victims to provide him with information on their usernames and passwords. According to investigators, Brannan also surveyed the social media accounts of his victims to help him answer their security questions.
Brannan's plea agreement recommends the judge sentence him to 34 months in prison on two counts of unauthorized access to a computer to obtain information from a protected computer and aggravated identity theft.
Emails and phone calls to Brannan's attorney were not returned. CBS 6 made contact with Brannan at his home in Henrico, and he declined to comment. An email to the U.S. Attorney's Office for the Eastern District of Virginia was not returned.
A number of questions remain unanswered in the case. Why wasn't Christopher Brannan named with the original four suspects, and what is the connection between the men outside of their involvement in the hacking operation?
In Brannan's plea agreement, government prosecutors say Brannan assisted them with their investigation. Legal analysts said that could be a big clue.
Christopher Brannan
"The fact that the first court entry that you see is one where they agree to send it here to Virginia and plead guilty to a criminal information suggests that there was a long history of something prior to that, and a lot of times that means cooperation," said CBS 6 legal expert Todd Stone.
Experts of all stripes agreed that hacking and phishing cases are only going to get worse as people move more and more of their personal, financial, and social lives online.
"There’s really no privacy when you’re on your computer, and if you think there is, you’re probably a fool," Stone said.
"The bad guys are really persistent, and they only have to get lucky. We have to be 100% perfect," said Peter Aiken, a professor of data and computer security at VCU. "Technology’s always neutral, but if you use it badly, it can be very, very powerful."
Aiken said you do not have be a computer wiz to pull off the type of hacking described in Brannan's case, making it all the more important to be guarded with your personal information online.
"If all I need is that [social media] information to find you, and then I can look around and do this, it’s called social engineering, and it does not take a lot of time," Aiken said.
Taylor Warren is a local financial adviser who works on his laptop at the Urban Farmhouse in Scott's Addition several days a week. Warren said he thinks about cybersecurity all the time, and "Celebgate" resonated with him.
"I mean, that is no different to me than somebody breaking and entering into my house, going through my property," Warren said of the men charged in the case. "It just emphasized the importance of not doing anything on an online device that you wouldn’t want brought up a couple years down the road."
To better protect his personal information, Warren said he now uses more complicated passwords for any online account because he knows he is vulnerable when logging on either at home or away.
"I went with the recommended thing, and it was like 16 or 20 different letters, numbers, and signs," Warren said. "The fact that I’m on my computer here in a public location, means I’m assuming the risk that somebody could somehow gain access to my computer."
Brannan is scheduled to make his initial court appearance October 22nd at the federal courthouse in Richmond where he is expected to enter his guilty plea.
CBS 6 News is working for you. Click here to email a tip to the CBS 6 Problem Solvers. Be sure to leave us your name, phone number and detailed description of the problem. You can also leave a message by calling 804-254-3672.
Need help? Contact the CBS 6 Problem Solvers.
