DA Vance: Two Arrested Overseas in Vevo Hacking Case


May 25, 2018

Manhattan DA’s Office Provided Investigative Support through Personnel Exchange Program with Paris Prosecutor’s Office

Music Videos Affected by Hack Include “Despacito,” YouTube’s Most-Watched Video of 2017

Manhattan District Attorney Cyrus R. Vance, Jr., today announced that two French citizens, NASSIM B., 18, and GABRIEL K.A.B., 18, have been arrested in Paris, France, and charged by the Office of Paris Prosecutor François Molins (Procureur de la République de Paris) with crimes related to unlawfully accessing and tampering with digital content hosted and promoted by Vevo, a music video hosting platform based in New York.[1] Through its formal partnership with the Paris Prosecutor’s Office, the Manhattan District Attorney’s Office provided critical investigative support in the case.

“Since 2010, my Office has honed its expertise and invested in the resources needed to take on complex cyber investigations,” said District Attorney Vance. “Moreover, our secondment program with the Paris Prosecutor’s Office enables embedded prosecutors to provide on-the-ground support when it comes to malicious cyber activity that affects individuals and organizations in New York and Paris alike. I thank our international partners for their collaboration and extraordinary work on this case, and look forward to more and more investigations benefitting from this type of seamless, cross-border coordination.”

According to the Paris Prosecutor’s Office and as alleged in this case, in April 2018, NASSIM B. and GABRIEL K.A.B., who also went by their respective online handles “Prosox” and “Kuroi’ish,” gained access to the YouTube account maintained by Vevo, a content hosting company that is headquartered in Manhattan. NASSIM B. and GABRIEL K.A.B. then proceeded to alter the content of multiple music videos, including “Despacito” by Luis Fonsi and Daddy Yankee, and other videos by Selena Gomez, Taylor Swift, Katy Perry, Chris Brown, and Shakira.

The affected music videos have since been corrected and reinstated by Vevo.

Cross-Border Collaboration

In November 2016, District Attorney Vance announced a partnership with the Paris Prosecutor’s Office to share intelligence and collaborate on joint investigations involving transnational crimes. Beginning in 2017, participating staff members from the Manhattan District Attorney’s Office and Paris Prosecutor’s Office became fully embedded in each of the partner offices as part of a reciprocal secondment program.

The exchange of personnel is modeled on an earlier partnership between the Manhattan District Attorney’s Office and the City of London Police, which contributed to the takedown of an international cybercrime and money laundering ring operating out of the U.S., U.K., and Canada.

Assistant D.A. James Vinocur provided assistance with the investigation on behalf of the Manhattan District Attorney’s Office, with the assistance of Cybercrime Analyst Kristen Spaeth, also of the Manhattan District Attorney’s Office.

District Attorney Vance thanked the Paris Prosecutor’s Office, and in particular, Alice Cherif, Chief of the Cyber Section of the Paris Prosecutor’s Office, for their collaboration and leadership with respect to the matter.

Defendant Information:

GABRIEL K.A.B.
Charged:
• French Penal Law Article 323-1: Two counts of the act of fraudulently accessing or staying within all or part of an automated data processing system
• French Penal Law Article 323-3: The act of fraudulently modifying data contained in an automated data processing system
• French Penal Law Article 323-3: The act of fraudulently deleting data contained in an automated data processing system
• French Penal Law Article 323-2: The act of hindering an automated data processing system’s normal functioning

NASSIM B.
Charged :

• French Penal Law Article 323-1: Two counts of the act of fraudulently accessing or staying within all or part of an automated data processing system
• French Penal Law Article 323-3: The act of fraudulently modifying data contained in an automated data processing system
• French Penal Law Article 323-3: The act of fraudulently deleting data contained in an automated data processing system
• French Penal Law Article 323-2: The act of hindering an automated data processing system’s normal functioning
• French Penal Law Article 323-3 : The act of fraudulently extracting data out of an automated data processing system