Michael Clapsis: Alleged WiFi hacker fronts court for first time accused of multiple cyber crimes

A Palmyra man accused of setting up “evil twin” WiFi networks to collect swathes of personal data from unsuspecting users has faced court for the first time. Michael Clapsis appeared in Perth Magistrates Court on Friday, charged with nine offences in relation to allegations he created the fake WiFi access points and allegedly used them at airports in two states as well as on a number of flights. During the brief hearing, the 42-year-old only spoke to confirm he understood the charges against him with his lawyer asking for his matter to be adjourned for two months pending further legal advice. Mr Clapsis was arrested by the Australian Federal Police following an investigation in April. It was alleged an airline reported concerns about a suspicious WiFi network identified by its employees during a flight from Adelaide on April 19. When the accused arrived in Perth, AFP officers searched his luggage and seized a portable wireless access device, a laptop and a mobile phone from his hand luggage. A search was then carried out on his Palmyra home, where it was alleged officers found and seized devices which contained swathes of personal information that belonged to other people and fraudulent WiFi pages. Police claimed Mr Clapsis used a portable wireless access device to create “evil twin” free WiFi networks, which he used at multiple locations to lure unsuspecting users into believing they were legitimate services. When people tried to connect their devices to the free WiFi networks, they were taken to a fake webpage requiring them to sign in using their email or social media logins and those details were then allegedly saved to the man’s devices, police said. The harvested email and password details could be used to access more personal information, including a victim’s online communications, stored images and videos or bank details, it was alleged. Outside of court, the Australian Federal Police said they had also uncovered data they believed related to the use of the fraudulent WiFi pages at Perth, Melbourne and Adelaide airports, on domestic flights and at locations linked to the man’s previous employment. An analysis was ongoing to determine the extent of the alleged offending. Bail was not opposed with a Commonwealth prosecutor requesting strict conditions be imposed including that he not have access to the internet, social media or any online service unless it was for medical, work, banking, or My Gov purposes, as well as for anything to do with his children. He was also allowed to use streaming services, but was restricted to one mobile phone as well as one email account. He was released on $20,000 personal bail and $20,000 surety. AFP Western Command Cybercrime Detective Inspector Andrea Coleman said the case was a timely warning to be cautious about logging on to any public WiFi networks. “To connect to a free WiFi network, you shouldn’t have to enter any personal details, such as logging in through an email or social media account,” she said. “If you do want to use public WiFi hotspots, install a reputable virtual private network (VPN) on your devices to encrypt and secure your data when using the internet. “When using a public network, disable file sharing, don’t do anything sensitive, such as banking, while connected to it and once you finish using it, change your device settings to ‘forget network’. “We also recommend turning off the WiFi on your phone or other electronic devices before going out in public, to prevent your device from automatically connecting to a hotspot.” Det-Insp. Coleman encouraged people to increase their online security by replacing passwords with passphrases, never using the same passphrase for multiple accounts, using an online password manager and installing all software updates. Anyone who is connected to free WiFi networks in airport precincts and on domestic flights was recommended to change their passwords and report any suspicious activity on their accounts via cyber.gov.au. Anyone who believes they are a victim of cybercrime, should report it to police using Report Cyber at cyber.gov.au. If you are concerned that your identity has been compromised, contact the national identity and cyber support service IDCARE.