September 17, 2013

News Release

For Immediate Release

Man who breached City of Springfield website ordered to serve time; pay for damages

John Anthony Borell III of Toledo, Ohio, was sentenced to three years in federal prison for breaking into the City of Springfield's website and others in spring 2012.

Borell pleaded guilty to computer fraud in April and agreed to pay $227,000 in damages. Springfield is in line to receive a payment of $30,850.41.

The 22-year-old, who was linked to the hacker collective Anonymous, was sentenced Thursday, Sept. 12, 2013 for breaking into police and other websites across the country. In early 2012, Borell broke into the City's website, www.springfieldmo.gov and a server for Utahchiefs.org; a website for Syracuse, N.Y., police; and a site for the Los Angeles County Police Canine Association, according to a signed plea agreement.

The breach in Springfield occurred Feb. 17, 2012, exposing the personal information of about 2,100 local residents who had primarily filed online police reports.

City staff temporarily disabled access to 31 online services allowing search and interactive capabilities, as soon as the City became aware of the breach. City Manager Greg Burris sent a letter to all individuals whose information was accessed by the hacker. Some employees had utilized those web services, so they may have also received a letter notifying them of this breach. To reduce the risk of harm from this incident, the City offered the potentially affected individuals a one-year subscription with Trusted ID, an identity theft protection company. About 400 individuals accepted that offer.

Information Systems and Police Department staff members worked with state and federal law enforcement agencies to analyze the breach and take corrective action and the City's site was fully functional again in March 2012, after significant security enhancements.

Several changes to the site both enhanced security and helped to prevent future breaches. These changes included: dropping the requirement for social security number entry in the online police reporting section; building in automatic data transfers out of the system on a weekly basis; and in certain sections, such as online building permits, limiting the amount of records returned during a search, while still allowing a citizen to find the information that they need.

"We systematically went through every table of content on our public site and thoroughly analyzed both the functionality and security of the site. We think the improvements we made strike an appropriate balance in providing the public access to the information and online capabilities they desire with the need to protect information," said Jeff Coiner, Director of Information Systems.

During sentencing in U.S. District Court in Salt Lake City, the defendant was ordered to accept mental health treatment and stay away from drugs. He will spend three years on supervised release after he serves his prison sentence.

For more information, contact Cora Scott at the City of Springfield, 417-864-1009 or cscott@springfieldmo.gov or Melodie Rydalch, U.S. Attorney's Office in Utah, 801-325-3206 or Melodie.Rydalch@usdoj.gov.

city of springfield

Department of Public Information

840 Boonville Avenue • P.O. Box 8368 • Springfield, MO 65801
417-864-1010 • Fax: 417-864-1114 • springfieldmo.gov