Convicted Hacker Sentenced To 3 Years For Attack On Grainger

CHICAGO — A federal judge Wednesday sentenced a Chicago man convicted of hacking into the computers of a Lake Forest company to three years in prison. Edward Soybel, 35, of the 5000 block of North Marine Drive, has been jailed since a judge revoked his bond on the eve of his trial in December after the FBI received a profanity-filled, livestreamed video showing him drinking, driving around and making death threats against witnesses and prosecutors. A jury subsequently convicted Soybel of 10 counts of intentionally causing damage to protected computers, one count of attempting to cause damage to protected computers and one count of attempting to access a protected computer without authorization.

In February 2016, the Uptown resident was fired from a job working as an information technology contractor at the W.W. Grainger, Inc. facility in Niles due to "unprofessional conduct and punctuality issues," according to the government's sentencing memorandum. In retaliation, Soybel used his former co-workers usernames and passwords to delete millions of the company's files and caused hundreds of thousands of dollars of damages between July and November 2016, according to the pre-sentence investigative report.

Over the course of his four-month campaign, prosecutors said Soybel attacked Grainger's KeepStock inventory management servers thousands of times. Soybel had apparently been unable to get over the anger he felt over getting terminated by Insight Global, the staffing firm that placed him at the KeepStock IT support desk.

"He essentially declared cyber war on Grainger, not out of principle or for financial gain, but out of spite," Assistant United States Attorney Nicholas Eichenseer argued in court.

After being was told he was banned, Soybel sent a series of texts and voicemails to the manager who fired him: "I helped allot of folks at Grainger and they know that you [expletive] up for firing me and what goes around comes around I heard pretty soon Grainger is going to cancel your [expletive] contract it's the beginning of the end for insight global at Grainger. So start looking for a new job you [expletive]."

Before he began his cyber attacks, prosecutors said Soybel submitted a fake tip to the FBI from his home internet address, which he used for most of the cyber attacks. The tip claimed that an employee at the Grainger facility in Niles "talked about owning gun and that he is a Muslim and that he because he owns guns and he is a Muslim that something is gonna happen I feel he needs to be investigated because he could be a threat to public safety i never trusted this guy who worked with us he was always acting unfriendly un-american."

The FBI went to interview an employee at the KeepStock help desk based on the tip, who recalled Soybel's firing. Prosecutors said the fact that Soybel would lie to federal agents to try to ruin the life of a former supervisor showed how far he would go in his "quest for revenge."

Soybel's initial attacks caused Grainger's system to go offline completely, stopping customers from accessing tools and safety equipment inside. At one point, the company set up a decoy system to designed to lure and capture information about its attacker. The dedicated network security team set up by the company also tried to stop him by blocking his home internet address, but Soybel was able to hack into his neighbor's wireless router and managed to get back into the company's networks during a period the decoy server was not operating, according to the sentencing memo.

"[Soybel] was likewise unable to get over the anger he felt toward those responsible for bringing him to justice. Instead, on the eve of trial, he threatened the lives of witnesses, agents and prosecutors. His threats were vivid and chilling, regardless of whether defendant was prepared to act on them," Eichenseer argued in his request for a 78-month sentence followed by three years probation.

A few days after a pretrial conference where Soybel heard the names of those who would be called as witnesses against him, he used a cell phone to broadcast a series of death threats to an internet chat room. The video was recorded by one of the viewers and sent to the FBI on Dec. 2, 2018, by a tipster who said Soybel had been threatening to kill witnesses and prosecutors with an AK-47 and "regularly drives under the influence whilst on cam in this chatroom (which is his phone, so he's also driving without due care and attention) and he is seen there drinking more days than not," according to an application for a search warrant of Soybel's apartment.

"Lord if he loses that case, that [expletive] prosecutor, I am going to [expletive] kill that [expletive] I am going to run his ass over with a Jaguar man," Soybel said, according to a transcript of the video. "I know where he lives, I am going to catch him outside I am going to run his ass over with a Jaguar man. And the other [expletive] witnesses, I am going to burn their houses and [expletive.] All their houses are going to burn up in a fire, like in California type [expletive.] I am going to light their [expletive] houses on fire, man. I hope they have fire insurance."

Seen in the video behind the wheel of his Jaguar drinking beer and displaying a pocket knife he said he stole from a dollar store, Soybel said it is easy to get guns and that he would "go to the gangsters" and buy an AK-47 before camping outside prosecutor's home.

"And I'll be hiding out in his block, when he comes outside in the morning before court, I'll [expletive] shoot that [expletive], make his head explode all over the street," Soybel said, according to the transcript.

One witness, Soybel added, "ain't gonna survive," and as for the FBI agents who investigated him: "I'm gonna line them up, face the flag, and die."

Vadim Glozman, Soybel's defense attorney, said it was "farfetched" to suggest the video was an attempt to obstruct justice.

"Aside from engaging in drunken banter and venting, Mr. Soybel took no affirmative steps to threaten or intimidate anyone," Glozman argued. "Soybel did not have the specific intent to hinder the proceedings; Mr. Soybel merely went on a drunk rant that got recorded unbeknownst to him and without his permission."

In requesting a sentence below federal guidelines, Glozman said Soybel suffered from undiagnosed mental problems and needed further evaluation and substance abuse treatment.

"He is not a career criminal who depends on his criminal activity to support himself or his family," Glozman said. Instead, his crimes were "rooted deeply in a mental condition that is yet to be professionally addressed."

Soybel was born in the Soviet Union in 1983 to parents who would divorce less than two years later. He was able to move to the United States with his mother's side of the family and was granted refugee status in 1989, according to Glozman. Soybel dropped out of high school and lived a sheltered life, unable to create meaningful relationships with his peers and was drawn to relationships with older people, his defense attorney also argued. Several letters in support of Soybel described him helping seniors in the Russian community.

Glozman said tension in Soybel's relationship with a boyfriend of his mother's led to "intensely heated arguments" that caused neighbors and his mother's boyfriend to contact the police and resulted in a domestic violence-related arrest in Soybel's past.

"Soybel was understandably stressed, anxious and scared as his federal criminal trial loomed in front of him," Glozman continued. "With the assistance of some alcohol, Mr. Soybel went on an ill-advised venting spree by way of a live video stream to a select group of individuals. It was never meant to be any more than that."

Although the sentence was ultimately less than half of what prosecutors had requested, U.S. District Judge Matthew F. Kennelly said the recorded threats were still a significant aggravating factor in his decision.

"The video is equally consistent with just plain old bad judgment and too much beer as it is with mental illness," Kennelly said during the pretrial hearing on revoking Soybel's bail. He said there was "certainly no question that the person in the video ... is doing some venting," according to a transcript.

Intentionally causing damage to protected computers is punishable by up to 10 years in prison, while attempting to access a protected computer can be punished by one year imprisonment.

"Yeah, he was drunk. Yeah, maybe he didn’t really mean it," Kennely said at the sentence hearing, the Chicago Tribune reported. "But the fact of the matter is that it illustrates a willingness that has actually shown up in other times in Mr. Soybel’s life to act on his anger and to do that in a way that causes harm to other people."

Before his sentence was issued, Soybel wept as he read a statement to the court apologizing to the judge, his family, prosecutors and Grainger, according to the Tribune.

"I was under a lot of stress, [but] I was never intending to do anything," he said. "Please give me a second chance so I can prove my worth to you. I am not worthless."

Earlier: Ex-Contractor Charged With Hacking Into W.W. Grainger Computers