Singaporean jailed for deceiving Amazon, Google into providing S$7.6 million worth of cloud services

SINGAPORE: A man was sentenced to 10 years' jail on Thursday (Jun 23) for impersonating two others to deceive Amazon Web Services (AWS) and Google into providing about US$5.4 million (S$7.6 million) worth of cloud computing services.

Ho Jun Jia, 32, also known as Matthew Ho, used personal and credit card information of two men that he got from a Dark Web forum to cheat both companies.

One of his victims was Marc Merrill, the co-founder of video game developer Riot Games.

Ho, who was unemployed at the time, used this computing power to mine about 1,468 units of the cryptocurrency Ether between Nov 21, 2017, and Mar 1, 2018.

He later sold about 203 units of the illegally acquired Ether, making more than S$347,000, which he spent on personal expenses.

In March, he pleaded guilty to 12 charges, including offences under the Computer Misuse and Cybersecurity Act and cheating by personation.

His total sentence includes three years and five months in prison for consuming methamphetamine and another drug-related charge.

Another 14 charges were considered for sentencing.

The court previously heard arguments from the prosecution and defence on the sentence to be imposed on Ho.

Deputy Public Prosecutor Ryan Lim had asked for at least 10 years' jail for what he called a highly sophisticated scheme carried out entirely through the Internet, enabling Ho to hide his identity during the offences.

"It is crucial that would-be criminals are strongly deterred from using the Internet as a cheap, convenient and effective means to commit crime," he said last month.

Mr Lim also highlighted the transnational nature of Ho's offences, arguing that they threatened to undermine Singapore's reputation as a financial and commercial hub.

Defence lawyer S S Dhillon had said that while the amount involved in the offences was high, there were no "actual physical monies" lost.

He argued that AWS and Google suffered a loss of revenue in the form of fees for the cloud computing services, but that the two men Ho impersonated did not lose any money.

He also highlighted Ho's diagnosis of adjustment disorder from around the end of 2017 to August 2018, and his mental health history that saw him spend time as a patient at the Institute of Mental Health (IMH) in the past.

In her judgment on Thursday, District Judge Brenda Tan highlighted the magnitude and sophistication of Ho's offences and the extent of harm his actions caused.

"Through his deceptions, Mr Ho fraudulently obtained services worth a massive value of more than US$5.4 million, of which there has been no restitution or compensation," she said.

She granted a one-month deferment of the sentence for Ho to attend medical appointments at IMH and for a check-up, and to see to his work commitments.

Ho is currently out on bail of S$180,000.

WHAT HE DID

In 2017, Ho forged US driving licences on a Dark Web forum that styled itself as "#1 Fraud Community". In exchange, he was given access to a "VIP" section of the forum that contained people's names, addresses and credit card details.

Around Oct 19, 2017, he obtained the information of 70 people including Marc Merrill, the co-founder of video game developer Riot Games, and another man named Harold Borland.

Ho gained access to Mr Merrill's AMEX bank account and linked it to an email address he created. He then registered a new AWS user account using Mr Merrill's AMEX credit card number and the email address he created.

While in Singapore, Ho deceived AWS into believing that he was Mr Merrill and delivering cloud computing services on at least 40 occasions between Nov 4, 2017, and Jan 28, 2018.

Ho also did this with a Google Cloud Platform account registered in Mr Merrill's name around Nov 3, 2017, and deceived Google into providing cloud computing services up to Feb 23, 2018.

The AWS and Google accounts were eventually suspended by the companies after failed attempts to process payment. Both companies refunded any payments that did go through to AMEX.

Ho went on to run the same scheme with AWS using Mr Borland's details. Between Nov 19, 2017, and Apr 18, 2018, he deceived AWS into providing US$21 worth of cloud computing services.

He also used Mr Merrill's details to register an account with Namecheap, which provided domain-hosting and other services, ringing up a bill of about US$900 between October 2017 and August 2018.

On Sep 24, 2019, officers from the Technology Crime Investigation Branch raided Ho's home and arrested him.

In October 2019, Ho was also charged with identity theft and wire fraud in the US.