- Martin Gottesfeld of Somerville, Massachusetts, was convicted by a federal jury of carrying out a DDoS attack against Boston Children’s Hospital and against Wayside Youth and Family Support Network, the Department of Justice (DoJ) announced August 1.
Gottesfeld, who identified himself as a member of Anonymous, said he was protesting the treatment of a teenager in a custody dispute between her parents and the state of Massachusetts.
The teenager, Justina Pelletier, was taken into state custody after a dispute over her diagnosis between her parents and Boston Children’s Hospital, which diagnosed her health problems as psychiatric and argued that her parents were interfering with her treatment, according to a Reuters report.
In retaliation for Pelletier’s treatment, Gottesfeld conducted a DDOS attack against Wayside Youth and Family Support Network, a Framingham-based residential mental health treatment facility where Pelletier was being treated following her discharge from Children’s Hospital.
The March 2014 attack crippled Wayside’s network for more than a week and caused the facility to spend $18,000 on response and mitigation efforts, the DoJ related.
Following the attack on Wayside’s computer network, Gottesfeld launched a massive DDOS attack against the computer network of the Boston Children’s Hospital in April of that same year. He developed the malware that he installed on 40,000 network routers, which he controlled from his home computer.
Gottesfeld was able to knock Boston Children’s Hospital and several other hospitals in the Longwood Medical Area off the internet. He flooded 65,000 IP addresses used by Boston Children’s Hospital and several other area hospitals with data intended to make those computers unavailable for legitimate communications.
The attack disrupted the Children’s Hospital network for at least two weeks, interrupting access to internet services used by Boston Children’s Hospital staff to treat patients.
The hospital’s day-to-day operations and its research capabilities were disrupted. The attack cost the hospital more than $300,000 and caused an additional estimated $300,000 loss in donations, as the attack disabled the hospital’s fundraising portal, DoJ explained.
In October 2014, federal law enforcement searched Gottesfeld’s home and confiscated computers, servers, and hard drives. Gottesfeld, however, was not formally charged with a crime at the time the search warrant was executed.
In February 2016, local police conducted a wellness check at Gottesfeld’s apartment after relatives and his employer grew concerned about his whereabouts. When police arrived at his home, no one was there.
That same month, Gottesfeld and his wife made a distress call from a small boat off the coast of Cuba. A nearby Disney Cruise Ship responded and rescued the couple. The ship returned to Miami and Gottesfeld was arrested.
Gottesfeld was convicted of one count of conspiracy to damage protected computers and one count of damaging protected computers.
The charge of conspiracy provides for a sentence of no greater than five years in prison, three years of supervised release, a fine of $250,000 and restitution, the DoJ related. The charge of damaging protected computers provides for a sentence of no greater than 10 years in prison, three years of supervised release, and a fine of up to $250,000, according to the DoJ.
Gottesfeld's sentencing by US District Court Judge Nathaniel Gorton is scheduled for November 14.
Gottesfeld said he plans to challenge the verdict and accused prosecutors of ignoring what happened to the teenager at the center of the case and of “not telling you the full truth,” according to Reuters. “I’m going to keep fighting,” he said. “I’m not going to give up.”
Assistant US Attorneys David J. D’Addio and Seth Kosto of US Attorney Andrew Lelling’s Cybercrime Unit prosecuted the case.