$27K in restitution ordered for man who hacked Palo Alto Online

Hacker claims he committed the crime at the request of a convicted felon and former Menlo Park resident, Hiruy Amanuel

The 36-year-old man who hacked and temporarily shut down Palo Alto Online and other Embarcadero Media websites nearly four years ago was sentenced Wednesday in San Jose federal court to time already served, one-year of home incarceration with electronic monitoring, three years of supervised release and $27,130 in restitution to the company.

Ross Colby was indicted on April 6, 2017, following an investigation by the Federal Bureau of Investigation of the Sept. 17, 2015, crime, which took down five news sites owned and operated by Palo Alto-based Embarcadero Media: Palo Alto Online, Mountain View Online, Almanac Online, and

Colby is a software engineer who at one time was a security officer and IT administrator for Earnest, a student-loan company in San Francisco, where he reviewed data-compliance contracts with major clients such as Goldman Sachs and Verizon.

A federal jury convicted Colby of all charges on June 6, 2018 after a six-day trial: one felony count of transmitting a program, code, command or information to a computer, intending to cause damage; one felony count of attempting to do the same; and three misdemeanors of unlawfully obtaining information from a protected computer.

For each felony, he faced a fine of up to $250,000, a prison term not to exceed 10 years, or both, and a maximum of one year in prison and up to $100,000 in fines for each misdemeanor.

Colby's sentencing was delayed for a year, however, after his defense attorney, Vicki Young, asked on the day he was originally scheduled to be sentenced — Oct. 31, 2018 — that he be evaluated for mental competency. (This despite the fact that he had been evaluated and found competent prior to his trial.) Young's request took place after Colby, without Young's knowledge, emailed U.S. District Court Judge Lucy Koh on Oct. 30 a surreptitious recording he had made of a proffer interview with the FBI in May 2016. Koh questioned whether Colby's actions were a stunt to delay his sentencing but agreed to the evaluation.

Colby, who had been out on $50,000 bail, was taken into custody for the mental competency evaluation and spent nearly six months in custody, first in Santa Rita Jail in Dublin, then in a federal prison in Texas, while he received two separate mental health evaluations. Koh ruled him competent for sentencing this past May 10.

Federal prosecutors sought during the trial to prove through evidence from the FBI investigation that Colby planned the hack over a series of months. The FBI tracked IP addresses that identified and linked electronic devices and their whereabouts to Colby, creating a timeline of the surveillance of and intrusion into Embarcadero Media's computer systems. The defense sought unsuccessfully to discredit the prosecution's evidence but presented no affirmative defense.

A motive emerges

Colby did not testify at the trial and had no known connection to Embarcadero Media, and neither government prosecutors nor his defense counsel offered a motive for the hacking. However, after the jury began its deliberations in June 2018, prosecutors told Embarcadero that Colby had admitted to the crime in the May 2016 FBI proffer interview. According to court documents, Colby told prosecutors he hacked the system at the request of a convicted felon and former Menlo Park resident, Hiruy Amanuel, who wanted him to remove two stories written about him on the Almanac website, a sister publication of Palo Alto Online, and in the print edition of the Almanac.

The stories, published in December 2013, reported on a lawsuit Amanuel had filed against the city of Menlo Park and a Menlo Park police officer for violating his civil rights during a January 2013 traffic stop. Both stories referenced the fact that Amanuel had previously pleaded guilty to federal drug-trafficking charges in 2009 in exchange for two other charges being dropped. He was sentenced to a 21-month prison term.

Embarcadero Media was able to confirm while the jury was deliberating that one of the stories had been removed from the Almanac's online archives and another had been altered to change all names in the story. (The stories have since been restored by the company.)

The civil suit was settled on July 28, 2015, just six days after Colby first accessed Embarcadero's servers in preparation for the hacking that took down all Embarcadero websites less than two months later, according to evidence obtained by the FBI. Amanuel received $500 from the city of Menlo Park and his attorney recovered $49,400, according to the settlement agreement.

Assistant U.S. Attorney Susan Knight told Koh that the FBI and U.S. Attorney didn't pursue Amanuel and didn't share Colby's story with Embarcadero Media during the two-year long investigation because they didn't believe Colby, who could offer no hard evidence for his assertions. Amanuel, who currently resides in Ethiopia, issued a statement through his attorney on Dec. 17, 2018, to Embarcadero Media President Bill Johnson stating that the FBI "never" contacted him "during the course of their investigation in these matters whatsoever" and "adamantly denies that he ever paid Ross Colby or anyone in his behalf to hack any website, or anything of the sort."

Knight told the court that the FBI was unable to locate or talk with Amanuel during the investigation.

During the trial, a former roommate of Colby testified the hacker revealed to him he had been paid to attack the news sites, but neither Colby's attorney nor federal prosecutors asked for details.

Colby deleted the content of all of Embarcadero's websites and replaced it with an image of Guy Fawkes, the icon of the activist group Anonymous, and posted a message stating: "Greetings, this site has been hacked. Embarcadero Media Group (Alamanac) (sic) has failed to remove content that has been harmful to the wellbeing and safety of others. Failure to honor all requests to remove content will lead to the permanent shutdown of all Embarcadero Media websites." Each website's URL was replaced with the text "Unbalanced journalism for profit at the cost of human right, Brought to you by the Almanac."

Embarcadero IT Director Frank Bravo testified at trial that the hack appeared designed to inflict significant financial damage to the news group.

Factors in his sentencing

At Wednesday's sentencing, Knight argued that Colby had not accepted responsibility for his actions and should serve time in prison rather than receive a split sentence that would give him credit for time served and allow him to serve any additional time wearing an electronic monitor. She also defended not investigating the alleged role of Hiruy Amanuel, saying that Colby was not able to provide any evidence of his involvement. She acknowledged, however, that the FBI should have asked Embarcadero Media to look into whether stories about Amanuel had been removed from its website.

"I apologize for that," Knight told the court in a May 10 hearing.

Before rendering her sentencing decision, Koh expressed her concern that Colby had not been completely honest in hearings before and after the trial and had sought to manipulate the court. As an example of his unreliability, she pointed to Colby's withholding of the surreptitious recording of his proffer session with the FBI until the night before the scheduled Oct. 31 sentencing and failing to divulge its existence during pretrial hearings.

Although Colby might have been afraid of Amanuel, as he stated during interviews with prosecutors and in pre-trial hearings, Koh said his story kept growing over a three-year period, giving her pause about his credibility.

In a victim statement, Johnson said the hacking had a significant effect on the company, both operationally and emotionally. But citing Colby's health problems (he suffers from Lyme disease) requiring complicated drug treatments, the fact that Colby had already been in custody for almost six months and the lack of any further benefit other than retribution to his serving another six or more months in prison, Johnson urged the court to sentence Colby to the time he had already served plus a period of supervised release.

Of greater concern to Embarcadero Media, Johnson said, was the government's failure to follow up on Amanuel's alleged involvement in the crime, which Johnson called "the elephant in the room," even as he acknowledged the work of the FBI.

Koh said she had many of the same questions about the investigation and its failure to pursue Colby's assertions.

In sentencing Colby to no additional prison time, Koh said she was persuaded that additional incarceration would serve little purpose. She cited Colby's brain injury from a motorcycle accident, his chronic Lyme disease, PTSD and other complications as factors in not sending him back to prison.

Colby declined to make a statement before the court. But Koh had a parting admonition.

"Mr. Colby, please do not disappoint me. You are so talented. Do not waste it on things like this," she said.

In addition to his sentence, Colby cannot contact Embarcadero Media, can't use a computer or mobile device without the prior approval of a probation officer, must enroll in a computer-monitoring program and can't use the internet without approval of his probation officer. He must also submit to a monitoring device on his electronic equipment.

Johnson said he was very satisfied and pleased with Koh's sentencing decision and that he and Embarcadero Media staff members are happy to finally have closure with the case.

Hear Weekly journalists discuss the Colby case on an episode of "Behind the Headlines," now available on our YouTube channel and podcast page.


Follow the Palo Alto Weekly/Palo Alto Online on Twitter @PaloAltoWeekly and Facebook for breaking news, local events, photos, videos and more.

What is community worth to you?
Support local journalism.


Like this comment
Posted by resident
a resident of Downtown North
on Jun 12, 2019 at 5:33 pm

What is the PTSD from? Is he a military veteran?

Like this comment
Posted by Sue Dremann
Palo Alto Weekly staff writer
on Jun 12, 2019 at 6:39 pm

Sue Dremann is a registered user.

The exact cause of his PTSD was not specified in court. As far as we know, he was never identified as a veteran.

4 people like this
Posted by Duh
a resident of Downtown North
on Jun 12, 2019 at 6:48 pm

"She cited Colby's brain injury from a motorcycle accident" = PTSD

8 people like this
Posted by Curious
a resident of Duveneck/St. Francis
on Jun 12, 2019 at 6:51 pm

> What is the PTSD from? Is he a military veteran?

> The exact cause of his PTSD was not specified in court. As far as we know, he was never identified as a veteran.

Can one acquire PTSD without ever having served in the military?

I knew someone once who had periodic anxiety attacks whenever he heard thunder but to my knowledge, he was never active in the armed forces.

He said they were cannons in the rain.

2 people like this
Posted by Les
a resident of College Terrace
on Jun 12, 2019 at 7:53 pm

“In sentencing Colby to no additional prison time, Koh said she was persuaded that additional incarceration would serve little purpose. . .”

How about plain old punishment?

Like this comment
Posted by Kenny
a resident of University South
on Jun 12, 2019 at 10:00 pm

"What is the PTSD from?"

Maybe airplane noise?

2 people like this
Posted by PTSD
a resident of Old Palo Alto
on Jun 12, 2019 at 11:38 pm

It's from the motorcycle crash....Post-traumatic stress disorder (PTSD) is a mental health condition that's triggered by a terrifying event — either experiencing it or witnessing it. Symptoms may include flashbacks, nightmares and severe anxiety, as well as uncontrollable thoughts about the event.

4 people like this
Posted by Other PTSD Causes
a resident of Midtown
on Jun 13, 2019 at 8:53 am

[Post removed.]

Like this comment
Posted by Reader
a resident of Another Palo Alto neighborhood
on Jun 13, 2019 at 9:43 am


The title says: "$27K in restitution ordered for man who hacked Palo Alto Online"

So, while one usually does say: "Fines [punishment] ordered for [perpetrator]..." or "Community service ordered for [perpetrator]...", it's awkward using the word "restitution" as the punishment, because "restitution for [an entity]" usually means restitution for the entity mentioned, not FROM the entity. The double meaning is that the court ordered restitution for HIM because of a miscarriage of justice in the process, for example, which is not what the title is supposed to mean.

I had to do a double-take, thinking the court ordered someone to pay the perp something ---

Perhaps a little word-smithing on the title might be in order...

3 people like this
Posted by Sentencing discrepancy??
a resident of South of Midtown
on Jun 13, 2019 at 10:59 am

Wait... this guy gets one year home incarceration, 3 years monitoring, + a $27k fine and the sailing team coach at Stanford who made off with $800k in bribes in the admissions scandal gets only a $10k fine?? What?

2 people like this
Posted by YSK
a resident of Crescent Park
on Jun 13, 2019 at 11:24 am

[Post removed.]

3 people like this
Posted by Let's double the take
a resident of another community
on Jun 13, 2019 at 2:42 pm

How much is democracy worth to you? Do you support our local community? If those answers are yes, then let's double the 27k with donations from our loyal readers, otherwise we will have a hard time giving away our product for free. Donate now

Like this comment
Posted by Reader
a resident of another community
on Jun 13, 2019 at 3:25 pm

"Can one acquire PTSD without ever having served in the military?"

Yes, via rape.

Moreover, some rape victims suffer from more severe PTSD than that suffered by frontline veterans.

Like this comment
Posted by PTSD
a resident of Another Palo Alto neighborhood
on Jun 13, 2019 at 3:59 pm

Lots of things can cause PTSD, and unfortunately since it's so hard for people to acknowledge and get help in the military, which is bad enough, people think their problems must be less by comparison.

Sexual assault can cause PTSD. Organizational abuse can cause PTSD. Any serious trauma or abuse. Remember Harvey Weinstein's victims reported him hiring people to insinuate themselves into her life in order to spy on and manipulate her? That can destroy someone's trust in the world forever.

The dirty secret is that insurance companies do that kind of stuff to people all the time, they're probably going to permanently mess up some poor people who lost everything in the Paradise fires if they haven't already. They might surveil someone, even make very clear to the person they are being watched, or they might try to get them to answer a supposedly random survey about an unrelated issue. They might even get a seat on a plane right next to some poor person who had to sue to get their coverage, and chat them up. Or jury tamper (spend some time reading the court cases that result from just the situations people discover, where the insurance company had someone go into an elevator to tamper with a jury when some poor person who lost a loved one or everything in a disaster had to sue to get their coverage -- those are just the ones people discover and feel they can even sue after all that). The point is, after living through a traumatic situation already, insurance companies do exactly what Weinstein's lawyer did to his victim, revictimize them in a way that isolates them and makes them feel they can't trust anyone. I don't know if anyone ever gets over that (it ought to be SO illegal and punishable by jail and huge restitution fines, but...)

PTSD can happen because of serious accidents, near death incidents, any serious trauma, really. The sad part is that people just don't know they deserve help if it wasn't something we all know from the news, like war.

Like this comment
Posted by Expatriate Dreamer
a resident of College Terrace
on Jun 13, 2019 at 8:47 pm

> Organizational abuse can cause PTSD.

Can this occur from a hostile work environment as well? I would like to take some time off if this is a viable reason. I have bad dreams about work and perhaps a sabbatical would be of benefit. I was thinking of maybe renting a small cottage in France along the coast and living there for awhile.

Can you sue your employer for causing PTSD?

Don't miss out on the discussion!
Sign up to be notified of new comments on this topic.


Post a comment

Posting an item on Town Square is simple and requires no registration. Just complete this form and hit "submit" and your topic will appear online. Please be respectful and truthful in your postings so Town Square will continue to be a thoughtful gathering place for sharing community information and opinion. All postings are subject to our TERMS OF USE, and may be deleted if deemed inappropriate by our staff.

We prefer that you use your real name, but you may use any "member" name you wish.

Name: *

Select your neighborhood or school community: * Not sure?

Comment: *

Verification code: *
Enter the verification code exactly as shown, using capital and lowercase letters, in the multi-colored box.

*Required Fields

Don't be the last to know

Get the latest headlines sent straight to your inbox every day.

Nationally renowned Indian restaurant expanding to Palo Alto
By Elena Kadvany | 3 comments | 2,985 views

Cap On? Cap Off? Recycling Bottles is Confusing
By Laura Stec | 34 comments | 1,350 views

Summer travel: Is anything changing?
By Sherry Listgarten | 14 comments | 1,341 views

Premarital and Couples: "Our Deepest Fear" by Marianne Williamson
By Chandrama Anderson | 0 comments | 1,238 views