Van Su Tran was arrested after he allegedly decimated dozens of Sprint sites by stealing their routers. The above Bridge Street, Fort Worth site proved to be his undoing as police were able to track him almost in real time.
A Texas man, possibly a Cisco certified technician, who appeared to have codes to enter cell tower sites and keys to access Sprint equipment that permitted him to steal routers from dozens of compounds was arrested Monday in Fort Worth and is currently in jail awaiting a detention hearing this morning.
Fort Worth Police Detective Stephanie Phillips, assigned to the Federal Bureau of Investigation, said in the FBI’s criminal complaint that Van Su Tran, 44, was charged with injuring, interfering and hindering communications systems. If found guilty he could be steeply fined and imprisoned for up to ten years.
Used routers have fingerprints and are difficult to peddle
It’s likely that Tran was stealing Cisco network routers that can be found on eBay for $595 or less.
The routers that Tran stole are most likely manufactured by Cisco which Sprint is probably buying for just north of $1,000, according to a Cisco CCNA certified technician that requested anonymity.
“You’ll see them – onesies and twosies – on eBay, but if you’re going to try to sell a number of them it’s almost like putting out a warning flag embroidered with ‘I did it’,” he said, noting that the config files can be reset for personal use, but Cisco would have documentation that it is a Sprint router.
“They’re password-protected, but there’s an easy workaround to that,” he said, stating that the thief might have been Cisco certified and knew the aftermarket, although he said it’s not profitable since legitimate companies are offering 60% or more off on used Cisco routers.
Site alarm breadcrumbs led to his arrest
Beginning in or around June 2020, Sprint cell phone towers in the San Antonio, Austin, Houston, San Marcos and Abilene areas began to suffer outages as a result of the routers being stolen from tower compounds.
When a router begins to fail, the carrier will get an alert and is able to manage the problem, but when it is removed all spectrums are taken down and an entire neighborhood will lose service.
Based on the timing of the outages, Sprint believed that an individual or individuals were going from tower to tower and stealing their router, often in quick succession within the same day in a particular area, causing serious customer service issues.
Sprint’s investigation found that a suspect vehicle – a silver-colored Toyota Tundra – had been captured by a surveillance camera near a router theft site that occurred in San Marcos on July 3, 2020.
On July 15, 2020, Sprint’s regional security manager contacted Phillips for assistance in locating someone that might be in the process of stealing routers from 18 towers in the area.
The Fort Worth Police Department was alerted and began looking for the Tundra while being guided by a list of the towers that had reported alerts along with the time that each alert was received, according to court documents.
An alert was received from a multi-tenant monopole site located off East Rosedale Street. Police were then able to retrieve a photo of the Tundra from a City of Fort Worth camera located in the area.
Shortly thereafter, Sprint provided a real-time alert to the officers for a router theft at 5201 Bridge Street.
Five minutes later, police located the Tundra about a mile away and saw Tran get out of his truck and throw something into a dumpster. When they approached his truck they were able to identify through a probable cause search his haul of 16 routers, one later being identified as coming from the Bridge Street tower. The truck was registered to Tran.
Following his arrest, Tran filed that he was indigent and was appointed a Federal public defender.
Three industry insiders Wireless Estimator spoke with said that it’s feasible that the FCC and Homeland Security might take an interest in how easy it was for Tran to disrupt carrier service on a large scale, and possibly reassess safety measures at cell sites.
