DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Update: David Kee Crees, aka “DR32,” in U.S. custody, trial scheduled for August

Posted on April 1, 2024 by Dissent

In September 2022, DataBreaches reported that Australian national David Kee Crees was going to be extradited from Australia to the U.S. to stand trial on hacking charges. Crees, now 25, has used a number of aliases. DataBreaches had first known him back when he was calling himself “Abdilo,” but he was also known as “DR32,” “Notavirus,” “Surivaton,” and “Grey Hat Mafia’s Bitch.”

Facebook photo from some point prior to the microchipping in his hand that he pursued in 2020. Image: The Advertiser.

DataBreaches expected that the extradition would be completed within 30 days of the Adelaide Magistrate Court’s order. But Australian law gives their attorney general the right to review the situation even after a court has ordered extradition. DataBreaches does not know why Australia’s  Attorney General chose to hang on to him for a year and a half, but Crees finally arrived on U.S. soil in February. By then, he had spent two years in detention in Australia awaiting his extradition trial there and then extradition.

Crees made his first appearance in federal court in Denver, Colorado on February 8, 2024. He is being represented by Richard L. Tegtmeier of Sherman & Howard. In a subsequent hearing on February 13, the government sought his detention while awaiting trial, and the defense did not object. Crees is being detained at FCI-Englewood, a low-security federal correctional institution with an adjacent minimum-security satellite camp and a detention center. The terms of his detention are not publicly available on the docket. DataBreaches emailed the prison to ask if he will have access to the internet while in detention awaiting trial. In January 2023, The Advertiser reported that the microchips in his hands had caused security problems within the Australian prison that resulted in his being detained in a high-security prison there.  DataBreaches does not know whether he still has microchips in his hands.

As previously reported, Crees was indicted in December 2021 on a 22-count indictment:

Counts Description
Counts 1-7 Fraud and related activity in connection with computers, and aiding and abetting, in violation of Title 18, United States Code (U.S.C.), Sections 1030(a)(2)(C), 1030(b), 1030(c)(2)(B)(i), and 2, which carries a maximum penalty of five years in prison for each count;
Counts 8-14 Fraud and related activity in connection with computers, and aiding and abetting, in violation of 18 U.S.C. Sections 1030(a)(5)(A), 1030(b), 1030( c )( 4)(A)(i)(I),20 and 2, which carries a maximum penalty of five years in prison for each count;
Count 15 Money laundering, in violation of 18 U.S.C. Section 1956(a)(I)(B)(i), which carries a maximum penalty of 20 years in prison;
Count 16 Fraud and related activity in connection with identification documents, in violation of U.S.C. Sections 1028(a)(7) and 1028(b)(2)(B), which carries a maximum penalty of five years in prison;
Count 17 Fraud and related activity in connection with access devices, in violation of 18 U.S.C. Sections 1029(a)(2), 1029(b )(1 ), and 1029( c )(1 )(A)(i), which carries a maximum penalty of 10 years in prison; and
Counts 18-22 Aggravated identity theft, in violation of 18 U.S.C. Section 1028A, which carries a maximum penalty of two years in prison for each count, to be served consecutively to any other prison term imposed.

He was caught, in part, because he sold data to and communicated with an undercover FBI agent. DataBreaches previously reported details of his alleged crimes and interactions with the undercover agent based on filings by the U.S. to the Australian court. Those filings, obtained from the court by DataBreaches, do not appear in the public docket in the U.S.

The indictment in United States of America v. David Kee Crees, 21-cr-00402-DDD, lists seven U.S. victims.

All of the alleged crimes occurred between July 2020 and July 2021. None of the victim entities or businesses appear to be headquartered in Colorado, but the indictment alleges that Crees’s criminal activities involved the personal information of Colorado residents, indicated by their initials.

A seven-day jury trial is scheduled to begin on August 12, 2024, but it would not be surprising if that changes.


Related:

  • Maintenance Note
  • FCC Enforcement Bureau Settles With Liberty Latin America for Data Breach Notification Violations
  • Blackbaud settles California charges over 2020 data breach for $6.75 million
  • More arrests stemming from Desjardins data breach
  • Christie's discloses cyberattack in May
  • Germany’s Christian Democratic party hit by ‘serious’ cyberattack
Category: Blog

Post navigation

← More than two years after a breach, AT&T resets account passcodes after customer records leak online
Israeli LGBTQ App Atraf Faces Data Leak, 700,000 Users Affected →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Washington Post hack exposes personal data of John Bolton, almost 10,000 others
  • Draft UK Cyber Security and Resilience Bill Enters UK Parliament
  • Suspected Russian hacker reportedly detained in Thailand, faces possible US extradition
  • Did you hear the one about the ransom victim who made a ransom installment payment after they were told that it wouldn’t be accepted?
  • District of Massachusetts Allows Higher-Ed Student Data Breach Claims to Survive
  • End of the game for cybercrime infrastructure: 1025 servers taken down
  • Doctor Alliance Data Breach: 353GB of Patient Files Allegedly Compromised, Ransom Demanded
  • St. Thomas Brushed Off Red Flags Before Dark-Web Data Dump Rocks Houston
  • A Wiltshire police breach posed possible safety concerns for violent crime victims as well as prison officers
  • Amendment 13 is gamechanger on data security enforcement in Israel

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Maryland Privacy Crackdown Raises Bar for Disclosure Compliance
  • Lawmakers Warn Governors About Sharing Drivers’ Data with Federal Government
  • As shoplifting surges, British retailers roll out ‘invasive’ facial recognition tools
  • Data broker Kochava agrees to change business practices to settle lawsuit
  • Amendment 13 is gamechanger on data security enforcement in Israel

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net
Security Issue: security[at]databreaches.net
Mastodon: Infosec.Exchange/@PogoWasRight
Signal: +1 516-776-7756
DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.