A 19-year-old Western University student has been charged with using the Heartbleed bug to allegedly steal taxpayer data.
Stephen Arthuro Solis-Reyes, also known as Stephen Solis, was arrested at his home Tuesday (April 16) without incident. The RCMP charged him with one count of Unauthorized Use of Computer and one count of Mischief in Relation to Data.
The charges have not been proven in court. Solis-Reyes is scheduled to appear in court in Ottawa on July 17.
Police claim Solis-Reyes was able to extract private information held by the Canada Revenue Agency by exploiting the security vulnerability known as the Heartbleed bug.
A search was conducted at Solis-Reyes’ residence and computer equipment was seized. According to the RCMP, London police assisted by standing by during the search.
“The RCMP treated this breach of security as a high priority case and mobilized the necessary resources to resolve the matter as quickly as possible. Investigators from National Division, along with our counterparts in “O” Division have been working tirelessly over the last four days analyzing data, following leads, conducting interviews, obtaining and executing legal authorizations and liaising with our partners,” Assistant Commissioner Gilles Michaud said in a news release.
The investigation is ongoing. The RCMP said it is “committed to advising Canadians of any significant developments.”
Solis-Reyes graduated from Mother Theresa Catholic Secondary School in 2012, the same year he took part in the Canadian Computing Competition at the University of Waterloo. After graduation, he enrolled in the computer science program at Western University, where his father, Roberto Solis-Oba is a professor, also of computer science.
Home to Western’s computer science program, Middlesex College like most of campus was a relative ghost town on Wednesday afternoon as students hunker down to prepare for exams.
Two fourth year computer science students studying at the college said they may have shared a class with Solis-Reyes but they didn’t know him personally.
They were curious about the charges and what penalty might be attached. One, who said she plans to enter medical school next year and is taking computer science “for fun,” wondered whether Solis-Reyes had any malicious intent.
“For me, I don’t feel that big a deal,” she said. “It depends on intent. He’s a 19-year-old kid, what could he have done with them? He could have just been doing it to see if he could.”