Security

Cyber-crime

Privacy expert put away for 9 years after 'grotesque' cyberstalking campaign

Scumbag targeted many victims – and those who tried to help them


A scumbag who used to work as a privacy consultant has been put behind bars for nine years for a "grotesque" cyberstalking campaign against more than a dozen victims.

Sumit Garg, 33, of Seattle, was indicted [PDF] in March 2021 and has been held in a US federal prison in Washington state. He was convicted in March this year of conspiracy to engage in cyberstalking, three counts of cyberstalking in violation of a criminal order, and three counts of cyberstalking.

Garg's former roommate, identified as "victim 1" in court documents, received thousands of threatening emails, phone calls, texts, and social media messages in which Garg threatened to murder, torture, and rape her. She eventually obtained a civil protection order against Garg, which he ignored.

Garg then targeted that victim's uncle - the attorney who represented her in obtaining the protection order - plus her boyfriend, a Seattle police detective who investigated the threats, and the deputy prosecuting attorney working on Garg's stalking case.

At a sentencing hearing on Tuesday, US District Judge John Coughenour told Garg's victims: "I can't give you the level of protection for the length of time that you deserve…I can't give you blanket protection for 30 to 40 years."

The case dates back to 2019 when Garg shared a two-bedroom apartment in Seattle with his wife and victim 1. While the three shared housing, Garg snuck into the victim's room, stole her diary, left his fingerprints on "multiple pages," and read private details about her previous relationships.

Garg then started calling the roommate by a nickname Spicy, and sent her texts, emails, and online messages of a sexual nature, some referencing details from her diary.

In July 2019, the roommate reported the harassment to the police and sought a protective order against Garg, after which he and his wife tried to blame the victim and accused her of making false police reports, according to prosecutors.

Garg and the victim eventually reached a settlement agreement. The conditions of that deal included an agreement not to have direct or indirect contact with the victim.

Garg instead escalated his campaign of abuse by establishing thousands of internet accounts for the sole purpose of stalking and harassing the victim. According to prosecutors, Garg used his computer skills to try to hide his identity as he was sending the threats and making posts.

One of these included an email sent to the victim with the subject line: "Don't be scared." It read, in part:

Spicy,

Do you really think a few days in jail was going to scare me?

Don't be scared. I won't kill you.

It is too easy and not nearly enough punishment for your crimes.

I have other ideas to take care of you.

Garg also snuck into the victim's apartment building in October 2020 after sending her a text that contained threats of sexual violence.

According to court documents [PDF]:

At 1911 hours, Victim-1 received an email from sumitgargied92[@]gmail.com with the subject "Hey babe", which had three photographs attached to it. The photographs were of the building's lobby fireplace, seating area, and a deli connected to the building. The Exchangeable Image File (EXIF) data for the photos indicate that the photos were taken by a Google Pixel 3a phone on October 10, 2020, on or about the time the man entered the lobby. Google records indicate that a Google Pixel 3a phone was associated with Garg's personal email account (SUBJECT ACCOUNT 4), and -- as discussed below -- SPD later seized a Google Pixel 3a phone (SUBJECT CELLPHONE 1) from Garg.

The apartment building's surveillance cameras caught Garg on video, in the lobby, at the same time the photos were taken.

On November 1, 2020, Garg was arrested and charged with one count of felony cyberstalking. He was also issued a no-contact order prohibiting Garg from having any contact with the victim, her uncle, and her boyfriend.

His victims – and there are overall more than just described here – did get a brief respite from Garg while he was in jail for about two weeks. "Notably, the harassing messages to many of the victims stopped up until the day before Garg was released from custody," according to the court documents.

However, when Garg was released on November 13, 2020, the threatening messages resumed, despite the perp being subject to electronic monitoring.

"While Garg appears to have delighted in his victims' suffering, he appears to be utterly incapable of empathizing with others," prosecutors noted in their sentencing memo.

They continued: "With an apparently insatiable desire to even the score, Garg took a simple rent dispute between roommates, and escalated it into a massive cyberstalking campaign against an ever-growing number of victims, making grotesque and violent threats that are almost impossible to fathom." ®

If you or anyone you know needs help, the US Center for Victims, the UK’s Victim support resources list and Australia’s Lifeline may be able to offer assistance.

Send us news
64 Comments

Alleged Karakut ransomware scumbag charged in US

Plus: Microsoft issues workaround for dual-boot crashes; ARRL cops to ransom payment, and more

Volt Typhoon suspected of exploiting Versa SD-WAN bug since June

The same Beijing-backed cyber spy crew the feds say burrowed into US critical infrastructure

Iran's Pioneer Kitten hits US networks via buggy Check Point, Palo Alto gear

The government-backed crew also enjoys ransomware as a side hustle

Transport for London confirms cyberattack, assures us all is well

Government body claims there is no evidence of customer data being compromised

Planned Parenthood confirms cyber-attack as RansomHub threatens to leak data

93GB of info feared pilfered in Montana by heartless crooks

Cicada ransomware may be a BlackCat/ALPHV rebrand and upgrade

Researchers find many similarities, and nasty new customizations such as embedded compromised user credentials

White House seizes 32 domains, issues criminal charges in massive election-meddling crackdown

Russia has seemingly decided who it wants Putin the Oval Office

North Korean scammers plan wave of stealth attacks on crypto companies, FBI warns

Feds warn of 'highly tailored, difficult-to-detect social engineering campaigns'

Novel attack on Windows spotted in phishing campaign run from and targeting China

Resources hosted at Tencent Cloud involved in Cobalt Strike campaign

Iran hunts down double agents with fake recruiting sites, Mandiant reckons

Farsi-language posts target possibly-pro-Israel individuals

Feds claim sinister sysadmin locked up thousands of Windows workstations, demanded ransom

Sordid search history 'evidence' in case that could see him spend 35 years for extortion and wire fraud

Seattle airport 'possible cyberattack' snarls travel yet again

No word yet on if ransomware is to blame