Former UI student arrested in computer incidents, building damage
URBANA — An investigation that involved bomb squads, falsified emails, computer hacking and damage to a campus building resulted in the arrest of a former University of Illinois engineering student over the weekend.
Daniel Beckwitt, 21, of Bethesda, Md., was arrested by University of Illinois Police on Friday for computer tampering and taken to the Champaign County Jail. He was released Sunday after posting $1,000 bond and is scheduled to appear in arraignment court Tuesday afternoon.
Beckwitt was enrolled in the UI Department of Electrical and Computer Engineering last fall but is not a registered student this semester, according to UI police.
Police suspect he is responsible for tampering with campus email accounts, damaging locks at one computer lab and installing "key loggers" on keyboards at another engineering building to access sensitive information, for motives that aren't yet clear.
Beckwitt has refused to talk to police without a lawyer, said UI Police Sgt. Tom Geis.
"We're not really sure why he was doing it," Geis said Monday, though there were indications he was able to access test questions for his courses in the department.
Led by Detective James Carter, UI police have been working on the case for several months with investigators from the UI Campus Information Technologies and Educational Systems, or CITES.
The case was triggered by two incidents last fall at the Coordinated Science Lab, 1308 W. Main St., U, where locks were damaged on Nov. 6 and Dec. 14. Someone was able to get inside the building and spray a super glue-like substance with metal chips into multiple interior and exterior locks, making them inoperable, Geis said.
After the first incident, where one lock was damaged, an e-mail was sent out from a professor's account with information about the vandalism, but the professor hadn't authored the email, Geis said.
"Somebody was sending emails out professing to be him," he said.
Then, earlier this month, CITES investigators found key loggers attached to three keyboards in two computer labs at Everitt Lab, 104 S. Wright St., U. Key loggers can record all the keys a user hits when accessing a bank account, for example, gaining access to passwords and other information, Geis said.
"There were several accounts that had been compromised," he said, though police are still investigating the extent of the computer hacking.
Investigators were able to identify Beckwitt by checking websites and blogs about computer security, then linked that information with two other incidents at his apartment last spring, Geis said.
Someone claiming to be the "ECE hacker" posted information about the hacking at the Coordinated Science Lab on Reddit, a social news and entertainment site, Geis said.
On other sites, investigators found someone using the alias "Skunkworks" who talked about hacking teaching assistant accounts. They then found videos and photos online where Beckwitt was identified as "Skunkworks," Geis said.
CITES brought that information to UI police, who remembered Beckwitt from two April 2012 incidents when police, firefighters and the Champaign-UI bomb squad were called to his apartment at Hendrick House, 904 W. Green St., U.
On April 6, Beckwitt had ordered some material that can be used to make thermite, which is used to destroy computer hard drives, Geis said. Beckwitt raised suspicions because he had the materials delivered to a neighbor's room, then went there to retrieve the package, Geis said.
Beckwitt told police he was using the material to enter a contest for Schmoocon, an annual hacker convention, to destroy hard drives most efficiently. Police found he had entered the contest, and the material he had was legal, so no charges were filed, Geis said.
On April 10, authorities returned after a report of a suspicious device at Beckwitt's apartment, he said. It turned out to be PVC pipe fashioned into a self-contained breathing apparatus (known as an SCBA), similar to what firefighters use during a fire, Geis said. The bomb squad examined it and determined it was "benign," he said.
With the new information from CITES in hand, police were able to get a search warrant last week for Beckwitt's house in the 400 block of West Elm Street in Urbana.
On Friday afternoon, they seized all the electronic devices from the home — cell phones, laptops, notepads, etc. — including those belonging to the other five residents there, Geis said. Those are being examined for further evidence, Geis said.
"It's going to take probably another month or so until all the dust has settled and we figure out what we've got," he said.
Police also seized packing material in the house that appears to be from the key loggers found on the keyboards at Everitt Lab, he said.
The other residents of the house are cooperating with the investigation, and it doesn't appear they were aware of any of the activity in question, Geis said.
Beckwitt was arrested Friday evening on campus. He was ordered to stay off UI property through a no-trespass letter because he is no longer affiliated with the university, Geis said.
CITES, meanwhile, is contacting computer users whose accounts may have been compromised, asking them to change their passwords and other sensitive information, Geis said.
Mike Corn, the UI's chief information security officer, declined comment on the investigation Monday, saying he hadn't talked with police since Friday's arrest.
Champaign County State's Attorney Julia Rietz said she hadn't had a chance to review the case and would make a decision about formal charges on Tuesday.