Print      
Sailing mishap gives FBI a cyberattack suspect
Stranded off the coast of Cuba, Somerville man is rescued by a Disney cruise ship then arrested on charges he disrupted Children’s Hospital’s operations
The authorities say Martin Gottesfeld is connected to the hacking group Anonymous, whose icon is the Guy Fawkes mask. (Tom Pennington/Getty Images/File 2012)
Gottesfeld’s Facebook photo. He will be arraigned in Boston. (Facebook photo)
By Brian MacQuarrie
Globe Staff

In October 2014, Martin Gottesfeld of Somerville spoke with the FBI about a cyberattack launched against Boston Children’s Hospital to protest its care of Justina Pelletier, a Connecticut teenager involved in a bitter dispute over her medical treatment.

Gottesfeld admitted he had posted a YouTube video that called for the attack, authorities said, but he denied participating in the weeklong assault in April 2014 that crippled the hospital’s website, disrupted its day-to-day operations, and affected its research.

Gottesfeld was not charged at the time, and the cyberattack receded into memory. But last week, spurred by concerns from Gottesfeld’s relatives and employer, Somerville police knocked on his door for a wellness check.

They should have been looking elsewhere.

On Tuesday, Gottesfeld and his wife were plucked from a disabled sailboat bobbing in the warm waters off Cuba, federal prosecutors said. Their rescuers? A Disney cruise ship that responded to the small boat’s distress signal.

Gottesfeld, 31, was arrested Wednesday when the cruise ship pulled into Miami. Soon, he will appear in a less tropical destination: US District Court in Boston, where Gottesfeld is scheduled to face a charge of conspiring to damage the computers of Children’s Hospital and a Framingham treatment center where Pelletier had lived.

The US attorney’s office did not confirm that Children’s and Wayside Youth and Family Support, in Framingham, had been targeted. However, Children’s officials and another person with direct knowledge of the case confirmed that Gottesfeld’s arrest was connected to attacks on computers at the two institutions.

Conviction carries a sentence of up to five years in prison and a fine of $250,000.

The trail that led to Gottesfeld’s arrest, detailed in an affidavit, took an FBI cyber-sleuth through a maze of computer messages and arcane identifying clues.

The detective work connected Gottesfeld with the hacking group Anonymous, which used the YouTube video to call on Children’s to fire the head of its child-abuse prevention unit.

If the hospital failed to comply, Anonymous warned in a manifesto, “you too shall feel the full unbridled wrath of Anonymous. Test us and you shall fail.’’

The reason that Gottesfeld’s arrest did not occur before his ill-fated sailing adventure is unclear. But when an FBI agent in the Bahamas alerted a US-based agent that Gottesfeld and his wife had been picked up at sea, American authorities moved quickly.

When rescued, Gottesfeld and his wife had some luggage and three laptop computers, FBI Special Agent Michael W. Tunick wrote in the affidavit.

Children’s Hospital in a statement expressed its gratitude to the FBI and the US attorney’s office “for apprehending the hacker who led the attack and holding him accountable.’’

“We also want to thank our employees who assisted the FBI throughout its investigation and who helped build the comprehensive systems and procedures that were able to thwart the attack and protect confidential information,’’ said Kristen Dattoli, the hospital’s spokeswoman. “We are pleased that these measures have since been adopted throughout the Longwood hospital and research community.’’

The hackers at Anonymous — which has confronted such corporate giants such as Mastercard and Visa, as well as the FBI and CIA — became involved in the Pelletier case after the teenager was placed in state custody after her parents threatened to remove her from Children’s, following a bitter disagreement over her treatment.

In 2014, Anonymous also is believed to have attacked the computers at Wayside Youth and Family Support Network, where Justina had been living under state custody. Gottesfeld’s conspiracy charge includes the cyberattack there, which court documents said “lasted for more than a week, crippled the treatment center’s website during that time, and caused it to spend more than $18,000 on response and mitigation efforts.’’

The controversy over Justina’s care began in 2013, when Lou and Linda Pelletier of West Hartford, Conn., brought their daughter to Children’s for severe intestinal problems, among other issues. However, physicians there said the child’s problems were primarily psychiatric, and that her parents were requesting unnecessary medical procedures.

The hospital filed medical child-abuse charges, which were supported by the state Department of Children and Families. Eventually, a Juvenile Court judge concluded that Justina’s parents were unfit to care for their child’s complex medical and psychiatric needs and ordered that the state take permanent custody of her.

The Pelletiers fought back and took their campaign public. The effort rallied support from activists who accused Massachusetts officials of violating the rights of parents to control their child’s medical care. A Suffolk Juvenile Court judge restored custody to the parents in June 2014, after Justina had spent 16 months in the state’s care.

Linda Pelletier did not comment directly Wednesday on Gottesfeld’s arrest. However, she said: “I’m not involved in the Anonymous group. I don’t know who they are or what they are.’’

Justina, 17, is improving but her progress is a long succession of “baby steps,’’ Linda Pelletier said. “I just don’t understand why this all happened.’’

Last week, Justina and her parents filed a malpractice lawsuit in Suffolk County Superior Court against Children’s Hospital Integrated Care Organization and four doctors who diagnosed or treated the teenager during her monthslong stay starting in the winter of 2013.

Patricia Wen and Steve Annear of the Globe staff contributed to this report. Brian MacQuarrie can be reached at brian.macquarrie@globe.com.