Bomb threats to Jewish centers & schools were really a dark web moneymaking scheme ‒ FBI

Federal authorities believe the American-Israeli teen charged with making more than 100 bomb threats to Jewish community centers (JCCs) in the US was selling his services on the dark web for as little as $30 a job.

Michael Ron David Kadar, 19, was arrested in March and later charged in Israel with 28 counts of threatening calls and false information. Israeli prosecutors said he was behind more than 100 bomb threats to JCCs and more than 2,000 threatening calls to schools, airports, police stations, malls and other targets over a span of two years.

According to a newly unsealed search warrant, Israeli National Police found a 128GB thumb drive attached to Kadar’s computer in his room that allegedly contained “files indicating Kadar’s knowledge of and involvement in the threatening email and telephone call scheme.”

Read more

US-Israeli man indicted in Israel for threatening Jewish centers, airlines & politician

Along with recordings of threatening phone calls and screenshots of threatening emails, police found a text file copied from a vendor listing page, where Kadar allegedly made a business of making bomb threats on the dark web.

Going under the name Darknet_Legend, police said Kadar advertised a “School Email Bomb Threat Service” on his vendor account on AlphaBay, an underground marketplace for illicit goods and services on the dark web that was shut down by the US federal government last month.

Authorities previously found a vendor page in February, which they said was “nearly identical” to the one on Kadar’s thumb drive.

On the vendor page, Kadar would allegedly charge $30 to email a bomb threat to any school and $90 for an “emailed bomb threat to a school district\multiple schools + framing someone for it.” However, the posting warned that there was “no guarantee that the police will question or arrest the framed person.”

“I just add the [person’s] name to the email. In addition in my experience of doing bomb threats putting someones name in the emailed threat will reduce the chance of the threat being successful,” the vendor page read. “But it’s up to you if you would like me to frame someone.”

While the vendor pages only sold threats by email, the warrant said police also found vendor pages that offered to call schools with bomb threats.

At least one customer posted a comment on Kadar’s vendor profile, according to the warrant.

"Amazing on time and on target. We got evacuated and got the day cut short,” the warrant quotes an anonymous user.

Police used the date and time stamp to trace the posting to a threat made to Rancho Cotate High School in California that caused the school to evacuate and release the students early.

There is no other indication of who may have used Kadar’s services to call in threats to JCCs. There is no mention of JCCs in either version of the vendor pages listed in the warrant.

Between January and March, Jewish establishments in the US received more than 70 bomb threats by phone and more than 50 threats by email. While none of those threats were ever realized, they caused schools to evacuate

ProPublica’s tracker records as many as 146 bomb threats made against JCCs since January 1, 2017.

Kadar, a dual American-Israeli citizen, remains in custody in Israel pending trial.