Tenn. techie denies being hacker in Romney tax returns case

• Michael Brown says he is not the hacker who claimed to access Mitt Romney's tax returns
• This is the second time Brown has been investigated in a computer hacking case
• Two months after a raid of his home, Brown has not been charged with a crime

FRANKLIN, Tenn. -- Michael Brown, a self-employed "computer guy," said he read the reports in early September of an anonymous computer hacker claiming to have copies of presidential candidate Mitt Romney's tax returns.

His knowledge of computers, Brown said, made him curious how such a stunt may have been managed.

A couple of weeks later, the Secret Service, acting on a search warrant, smashed through his front door and spent the next 18 hours pulling laptops, hard drives and all manner of digital storage devices from his Franklin home.

Now, almost two months since his home was searched, Brown has not been charged with a crime.

Brown, who offers a wireless Internet service, is a target of an investigation into an apparent attempt to to extort money by claiming to have the former GOP nominee's tax returns. The purported heist was announced in a letter posted online that solicited $1 million either to release the information or to keep it from the public. That same letter, along with supposedly encrypted flash drives containing the tax returns, was delivered to county Democratic and Republican offices in Williamson County.

The Secret Service isn't saying whether someone actually downloaded Romney's tax filings, but Brown is now going public with his denial of having any role in the plot. He even created a website, mbdonationfund.com, drawing attention to the case.

"If there was anything they could use," Brown said of the items seized from his home, "I wouldn't be here."

David Boling, a spokesman for the U.S. Attorney's Office in Nashville, said he could not comment on whether charges are expected. The federal judge who granted the search warrant for Brown's home ordered the documents sealed, but Brown posted them online.

"We've taken the unusual step of confirming an investigation by the Secret Service," Boling said. "The matter is under investigation, so there's nothing really we could say."

Computer clues

Though investigators won't talk about the case, the search warrant offers a glimpse into how they might connect Brown to the caper.

Craig Ball, an attorney and certified computer forensic examiner in Austin, Texas, noted that authorities can use the serial numbers from the two flash drives left at the political offices in Williamson County. The drives themselves won't likely reveal much, but computers keep a log of all the external storage devices ever plugged into them. That means, Ball said, that investigators are looking for a record of those flash drives having been used on the machines confiscated from Brown's home.

The search warrant also lists several IP addresses that could be used to identify which machines posted the apparent extortion letter onto the website, Pastebin.com. Similarly, authorities are looking for connections to a digital currency site, Bitcoin, through which the money was to be paid.

Several years ago Brown paid $5,000 to acquire about 371,000 bitcoins and, according to a 2011 article in Wired magazine, was the "richest man in in the bitcoin realm."

Brown acknowledged the circumstantial connection but said that, after the value of bitcoins tanked, he created another form of digital currency to compete with bitcoin. Why would he demand payment in a digital currency that competes with his own? Brown countered.

A quick perusal of the search warrant led Ball to conclude that investigators have leads in the case, though it is not clear what led them to Brown.

"Short of an abacus and a stone tablet, there's nothing they can't take from this person's home," Ball said. "They're not fishing."

Brown said he could not explain why the Secret Service is targeting him, but he noted that in 2009 the same agency came to his house looking for evidence tying him to the alleged theft of thousands of Social Security numbers held by an insurance company. He was never charged, and Brown said he met with federal agents four times to answer questions; he even agreed to a polygraph, he said.

"I'm pretty sure I'm profiled as a computer guy, and not just a layman at Best Buy," Brown said.

Critical of agents

Brown, a husband and father, said he isn't too worried about antagonizing federal authorities in talking about the case. That said, he has a few pointed criticisms of the agents who searched his home.

Authorities missed at least four flash drives that were sitting on a desk in his office, he said, and left behind some forensic software they were using to examine his machines. Brown said he's familiar with the brand and was surprised at the simplicity of the program, describing it as "'forensics for dummies' kind of software."

The agents also were clumsy in their removal of his equipment, Brown said.

"They left me with the impression of a bunch of apes with screwdrivers punching away at stuff."

Another element of this case is that the author of the letter claims to have visited the Franklin office of PricewaterhouseCoopers, the accounting firm that handles Romney's taxes, and hacked into the company's network. PricewaterhouseCoopers has repeatedly denied that any such thing occurred.

"At this point there's nothing to suggest our systems were tampered with," Chris Atkins, a spokesman for the company in New York City, said last week.

Ball, the forensics examiner in Texas, said that, in his experience, the claim of having been to the accounting firm's office could make it easier for investigators to confirm various facts of the case. Setting aside any video surveillance of the property, the firm's computer network probably monitors user logins and could show when files were accessed.

"It's probably premature to treat this guy as anything but a hapless innocent," Ball said of the raid on Brown's home. "The Secret Service also deserves the benefit of the doubt that they haven't tried to pin this on somebody."