Russian agent hired alleged Yahoo hacker, Canadian Karim Baratov

The Hamilton man accused of being a co-conspirator in the Yahoo data breach had already been advertising that he was a hacker for hire when he was directly retained, via e-mail, by an officer of the Russian security service, new court documents allege.

The documents, produced in support of a bid by the U.S. government to extradite Karim Baratov, also allege the 22-year-old resident of the Hamilton suburb of Ancaster has been a hacker-for-hire for years, breaching thousands of accounts outside of the Yahoo case and earning $211,000 during a three-year period.

Among the documents filed at the Hamilton courthouse is an affidavit by Detective Constable Burak Inal of the Toronto Police fugitive squad, which arrested Mr. Baratov on Tuesday morning. The affidavit reveals that, after a request from U.S. officials, the RCMP had placed Mr. Baratov under surveillance for at least six days before he was taken into custody.

The court documents state that Mr. Baratov, a Canadian citizen who was born in Kazakhstan, was first contacted in late 2014 by Dmitry Dokuchaev, identified in a U.S. indictment as an officer of Russia’s Federal Security Service (FSB), working in the agency’s Center 18, its centre for information security.

According to recent Russian media reports, Mr. Dokuchaev was a hacker using the alias Forb until he was coerced into working as a computer specialist for the FSB. He was one of four cybersecurity experts Russian authorities arrested in December and accused of treason.

The latest court files do not detail why Mr. Dokuchaev is alleged to have picked Mr. Baratov, who had a highly visible social-media footprint through which he displayed a flashy lifestyle of cigars, fancy cars and Rolex watches.

Mr. Dokuchaev is alleged in the court documents to have used a Yahoo e-mail account to contact Mr. Baratov and hire him to get the log-in information for about 80 accounts belonging to victims of the Yahoo hack.

The victims included a prominent Kazakh banker, Russian government officials and even Russian cybersecurity company officers, the court filings allege.

It is not clear whether police believe Mr. Baratov knew he was communicating with a Russian intelligence agent. Mr. Baratov is alleged to have created phishing e-mails designed to lure the targets into clicking on bogus links and then providing their log-in credentials.

Mr. Baratov would then send a screenshot of the account to his Russian handlers once he had gained access, the documents state, and provided the full log-in to the Russian FSB only after securing payment.

The payments are alleged to have travelled through Web accounts including a PayPal account that links to a Royal Bank chequing account in Mr. Baratov’s name. Between February, 2013, and October, 2016, Mr. Baratov received more than $211,000 via that PayPal account, the court records say, adding, however, that the amounts he is alleged to have earned from the Yahoo scheme are smaller.

The court documents also allege Mr. Baratov shared images of other people’s passport photos, “which triggers the FBI’s concern that Baratov may be trafficking in personally identifiable information harvested from his hack of his victims’ e-mail accounts.”

In describing him as a flight risk, the police affidavit states that Mr. Baratov had been engaged in alleged criminal activity for several years, and allegedly hacked thousands of other accounts unconnected to this case since 2012.

It states that his activities are Web-based and could be taken up anywhere if he went on the run.

“Given the serious nature of his conduct, the public impact of his hacking for hire conduct, his substantial earnings as a result of unlawful hacking, and his ties to foreign intelligence officers with nation state resources at their disposal, he should be arrested on an urgent basis and detained,” the U.S. extradition request says.

“Baratov’s skills are especially concerning. Given the vast scope of his hacking, Baratov has access to the contents of an enormous number of email accounts, not just his own. Accordingly, given his international ties, the international locus of his assets and the portability of his business, Baratov presents a significant flight risk.”

Allegations in the court documents match reports by The Globe and Mail and others that Mr. Baratov operated several Web pages advertising hacking services.

Mr. Baratov appeared in Hamilton court via video on Friday. He was dressed in an orange shirt and stood silently listening to proceedings. The judge turned down a request from his lawyers for a publication ban. Mr. Baratov will have a bail hearing on April 5.

Amedeo Dicarlo, one of Mr. Baratov’s lawyers, said the allegations against his client are unfounded.

“This is an attack by the U.S. government, it’s a challenge by the U.S. government. We are fighting that challenge,” he told reporters outside court before the hearing, The Canadian Press reported.