Federal Pretexting Prosecutions Post-2006: Bunch and Anderson Charged Under New Anti-Pretexting Statute (2008)

What happened

In late 2008, federal prosecutors brought what the Department of Justice described as the first-ever criminal charges under 18 U.S.C. Section 1039, the pretexting statute Congress created via the Telephone Records and Privacy Protection Act of 2006 (signed into law January 12, 2007) as a direct legislative response to the 2006 Hewlett-Packard boardroom spying scandal, in which HP-hired investigators had used victims' Social Security numbers and impersonation to obtain journalists' and directors' phone records. Two unrelated defendants were charged: Nicholas Shaun Bunch, accused in the Northern District of Alabama (via criminal information) of using a T-Mobile customer's name and the last four digits of that customer's Social Security number to obtain the customer's confidential phone records; and Vaden Anderson, indicted by a federal grand jury on December 30, 2008 in the Northern District of Ohio (Case No. 1:08CR528) for serving Sprint/Nextel with a fictitious U.S. District Court civil subpoena to obtain a customer's confidential call records. Both cases turned on the same underlying vulnerability the 2006 law targeted: telecom carriers' processes for verifying who was entitled to receive a customer's call detail records were exploitable either through weak identity-verification scripts (name plus a partial SSN) or through insufficiently scrutinized legal-process paperwork.

How it worked

Bunch was charged with using a T-Mobile customer's name and the last four digits of that customer's Social Security number to obtain confidential phone records. Anderson used a different vector: he served Sprint/Nextel with what the indictment described as a fictitious U.S. District Court civil subpoena. The cited evidence does not establish the carriers' internal handling or verification steps.

The lure and the tell

Bunch's alleged method was social engineering aimed at a customer-service authentication process: presenting the subscriber's name and last four Social Security number digits as identity verification. The "tell" was that neither item is a strong secret. Anderson's method leaned on institutional trust in the form of legal process: he used a fictitious U.S. District Court civil subpoena to obtain confidential Sprint/Nextel records.

Outcome

Vaden Anderson, 28, was indicted by a federal grand jury on December 30, 2008 in the Northern District of Ohio for violating 18 U.S.C. Section 1039(a)(3) by providing Sprint/Nextel a fictitious civil subpoena to obtain confidential phone records. DOJ characterized this as the first indictment under the statute. Anderson pleaded guilty on March 11, 2009 and was sentenced on June 3, 2009 to 21 months in prison, two years of supervised release, and a $100 special assessment. Nicholas Shaun Bunch was separately reported by Wired as charged in November 2008 with using a T-Mobile customer's name and the last four digits of that customer's Social Security number to obtain confidential phone records. TLJ's report of an unnamed Northern District of Alabama information is not used to identify that matter as Bunch's case.

Why it matters

These cases matter as an early real-world test of the law Congress passed after the HP boardroom pretexting scandal. They pair two methods aimed at the same goal: the name-and-partial-SSN technique alleged in the charge against Bunch and the fictitious legal process underlying Anderson's conviction. For an education audience, the pairing illustrates that pretexting is a category rather than one technique: an attacker may target a support interaction or counterfeit institutional paperwork, so defenders must secure both channels.

Defenses

The two alleged methods illustrate distinct verification risks: reliance on static personal identifiers and reliance on an official-looking document. Carriers should use stronger account verification and independently confirm legal process with the purported issuing court through independently sourced contact information before releasing records.