He warned that “this is just the beginning” before “potentially putting lives at risk”

Ehtosham Javed warned ‘this is just the beginning’ as he bombarded Merseyside Police with thousands of emails

A cybercriminal was left with scars after being doused with boiling water and sugar in prison. Ekhtosham Javed warned that “this is just the beginning” as he flooded Merseyside Police accounts with more than 10,000 emails in less than four hours, “crippling” critical services and “potentially endangering lives”.

This was after he complained following an earlier police raid on his home. He described his actions as a “minor matter” but told an online contact: “I’m going to set an example for Merseyside that no police force will forget.”

Liverpool Crown Court This week heard that officers from Merseyside Police’s cyber crime unit visited Javed’s address in Priory Road, Bowdon, Greater Manchester, on August 31 last year “as part of an investigation into the activities of an online group”. A 34-year-old man was taken into custody and arrested, but later appealed his arrest and “stated that he wished no further contact” with the force.

READ MORE: Mom bragged she was “the best in the Northwest” at smuggling drugs into prisonREAD MORE: Screams of “love you bro” and “keep your head up boy” in court as man admits killing his girlfriend

Charles Lander, defending, described how the matter was subsequently referred to the Professional Standards Division and an update on the matter was provided to the defendant through his solicitors. Then, between 4.59pm and 8.47pm on April 7 this year, Merseyside Police was the target of a cyber attack which saw 12,304 emails sent to addresses across nine departments.

These included the police and crime commissioner’s office, the serious collision and safer roads units, rural wildlife heritage, the staff union and police cadet volunteers. Shortly after 5.30pm that day, Javed called the station and told the operator: “You may notice an influx of emails to Merseyside Police.

“Basically, I send your email addresses about a few million emails until your email addresses are completely useless. I’ve been trying to get your attention for a while now and it seems the only way I seem to get any attention is if I just completely cut off your services.

“Ten of your police officers came to my house, did an illegal raid. The Information Commission told me to email your data protection and for some reason they decided not to reply to me. They just chose to ignore me completely. I sat here for weeks and waited patiently for the answer”.

When told he was committing a criminal offence, Javed replied: “I don’t think it’s a big deal.” During the four-minute conversation, he said: “The problem is that the police officer that I’ve been trying to contact for the last three months, the reason this is happening is that he really ignored me for a few months. This is just the beginning.

One post box is said to have been used by other forces and agencies to contact Merseyside Police, including “important information which is sometimes critical and may contain life or death information”. Javed’s emails started out at a rate of four per minute, but “they got faster and bigger over time.”

Numerous IT specialists had to be brought in to deal with the cyber attack, as it was impossible to predict how long the incident would last. Officers from Greater Manchester Police attended Javed’s home at 7pm and arrested him.

A “half-packed suitcase” was discovered at the premises and it was believed he may have been planning to leave the UK for Pakistan. He made no comment during the interview, “except to deny that he was going to Pakistan and that the suitcase was from a recent trip.”

Although there was no computer in Javed’s home, his Samsung mobile phone contained the Team Viewer application. This was claimed to allow “remote control of other computers” and was shown to have access to two other devices.

Meanwhile, he was found to have performed a number of Google searches since the morning of April 7, researching how to carry out a denial-of-service attack “designed to flood a web server with enough traffic to cause that server to become overloaded and affect its ability to function.” Javed went on to search for “Merseyside Police email” and “how much damage millions of emails will do to an organisation” and visited the police website.

The day before he also sent a message to another user on Discord saying: “Funny how Greater Manchester Police made the same mistake a few years ago and Merseyside Police made the same mistake, only I didn’t go on to sue I’m going to make an example of Merseyside , which no police will forget.”

Javed was previously convicted of assault in 2008 and obstructing a railway in 2021. Ronan Maguire, defending, told the court his client had suffered from “social communication and interaction difficulties” throughout his life and added: “I understand there are elements that may be of concern to your honor about the comments he made during of these events, I ask for judgment consider the words he said in the context of his condition.

“Given his anger at Merseyside Police, it appears to have been relatively short-lived. It seems that he investigated this act only on the day of the offense itself.

“Obviously he was disappointed. The complaint to Merseyside Police was not without some legitimacy in itself. He felt as if he was being ignored. Of course, that doesn’t give him any excuse for what he did.

“But your honor has to look at his reaction, I think, in the context of his condition. You could say, given his diagnosis, that the way he reacted was perhaps quite predictable.

“His time in custody was very difficult. He was subject to constant abuse. He suffered quite serious attacks twice when boiling water was thrown at him. He literally bears the scars of his detention.

“He complained about it to the authorities. He understands that prison is not a holiday, but it was especially difficult for him.

“This is a person who is easily condemned for his age. Given that his condition has affected him throughout his life, it’s clear that he’s been dealing with it for a long period of time.”

Javed admitted to unauthorized modification of computer materials. He appeared via video link from HMP Liverpool on Wednesday wearing a black jumper and glasses and was jailed for a year.

However, he has already served 33 weeks in custody and will therefore be released in the near future. Sentencing, Judge David Potter said: “It is clear that you were very unhappy with the information you were given and the way your complaint was handled.

“After doing your research online, you knew that some of the inboxes you targeted were critical to the work of Merseyside Police. By effectively destroying them for several hours, lives were potentially at risk.

“During this ambush you contacted Merseyside Police yourself and explained to the operator that you were spamming them with several million emails. You tried to get their attention and believed that this was the only way to do it. was to disrupt their services.

“You didn’t think spamming Merseyside Police like that was a big deal, quote unquote. You thought more of the fact that you were being ignored than the damage you were doing to the systems of Merseyside Police.

“The consequences of what you did were serious. The police could not predict how and when it would end, and were forced to prepare for the worst. It took many specialists to repair the damage you caused.

“There was an element of revenge. You are clearly a very intelligent person who had the ability to carry out this cyber attack.

“There must be an element of deterrence. Those tempted to attack vital government services through a denial of service could face jail time.

“I give you this solemn promise. If you go online again and try to disrupt any government service or any other service through a denial of service, the next sentence will be much longer than today.”