Stephen Arthuro Solis-Reyes charged in Heartbleed-related SIN theft

The lawyer of a 19-year-old London, Ont., man charged with exploitingthe Heartbleed bug to steal over 900 SIN numbers says his client has been devastated by the arrest.

Stephen Arthuro Solis-Reyes, a student at Western University and the son of Roberto Solis-Oba who teaches computer science at Western, was arrested late Tuesday afternoon. The RCMP says Solis-Reyes is charged with one count of unauthorized use of a computer and one count of mischief in relation to data.

"He is an Astudent and a very, very bright young man," Solis-Reyess lawyer,Faisal Joseph, said.

• NDP want answers on timing of CRA website shutdown
• Heartbleed bug: What you need to know
• Heartbleed bug shows governments slow to react

Joseph said his client was too emotional to speak about the charges against him on Tuesday, and police havent told him anything, either.

"I dont have any evidence," he said.

Joseph said Solis-Reyes voluntarily turned himself in to police on Tuesdayafter officers threatened to arrest him in the middle of one of his classes. Days earlier, Joseph said, RCMP officers served a warrant at Solis-Reyess house at around 1 a.m., but left without advising of a charge.

"He didnt hear anything until yesterday," Joseph said, adding his client feels "sucker-punched."

Joseph also alleges police kept Solis-Reyes in custody for over five hours without access to a lawyer on Tuesday, something he said hell file a complaint about.

Solis-Reyes is set to appear inan Ottawa court on July 17, when the RCMP is set to lay out its case against him.

Until then, Joseph said, Solis-Reyess family has been "absolutely devastated" by the charges.

The RCMP allege that Solis-Reyes was able to extract the private information from the CRA by exploiting the Heartbleed security vulnerability in the OpenSSL encryption software used by many internet servers.

Computer equipment was seized from Solis-Reyess home, the RCMP said.

Website shutdown

The CRAtemporarily shut down some access to its website late on April 8 in response to security concerns aboutthe Heartbleedbug. This security flaw in its website encryption left itvulnerable to hackers.

The CRA says it realized last Friday that 900 social insurance numbers hadbeen stolen during a six-hour attack. The agency notified the privacy commissioner on Friday and referred the matter to the RCMP. But the breach was only made public on Monday.

On Wednesday, Communications Security Establishment Canada, the government agencyresponsible for cybersecurity, told CBC News it learned of the Heartbleed bug when a global security alert went out a full day before the federal government issued a public warning and parts of the Canada Revenue Agency website were temporarily shut down.

• RCMP asked Revenue Canada to delay news of SIN thefts

The RCMP said this week it had asked the CRA not to tell Canadians on Friday about the breach so the force could look into a "viable"lead in their investigation.

"The RCMP treated this breach of security as a high-priority case and mobilized the necessary resources to resolve the matter as quickly as possible,"Assistant CommissionerGillesMichaudsaid in a statement released Wednesday to announce the arrest.

Solis-Reyes could face a maximum of 10 years in prison if found guilty.

The RCMPsaid the investigation is ongoing.