The mayor of a small New Jersey hamlet has been arrested, along with his son, on federal charges that they shut down a website advocating the mayor's recall after breaking into the online accounts of political foes.

According to federal officials, Felix Roque, the 55-year-old mayor of West New York, New Jersey, and his son, Joseph Roque, 22, were arrested early Thursday morning by FBI agents. In February, the pair planned and executed the silencing of www.recallroque.com by gaining unauthorized access to the GoDaddy account used to control the domain name. An FBI special agent filed documents with these allegations in a New Jersey federal court. The father-and-son team also obtained e-mails and messages sent among opponents after gaining unauthorized access to e-mail and Facebook accounts.

"I have always treated you with respect and courtesy, but I have copies of everything sent to the website and communications with names," Mayor Roque wrote in an e-mail to one of the opponents, whose identity had remained unknown to the Roques until they gained illegal access to the accounts. "Remember, I am in the Army with many friends."

Hacking for amateurs

According to the account of FBI Special Agent Ignace Ertilus, Felix and Joseph Roque took a keen interest in the recall site as early as February. In an attempt to learn the identity of the person behind the site, the younger Roque set up an e-mail account under a fictitious name and contacted an address listed on the website. He offered some "very good leads" if the person would agree to meet him. When the requests were repeatedly rebuffed, Joseph Rogue allegedly tried another route. He pointed his browser to Google and typed the search strings "hacking a Go Daddy Site," "recallroque log-in," and "html hacking tutorial."

He eventually figured out how to reset the e-mail account that was used to register recallroque.com domain with GoDaddy, according to Ertilus. On February 8 at 4:49 pm, after gaining control of the GoDaddy account, he allegedly cancelled the domain name. This caused the recall website to go dark. Records of calls sent to and received by the cellphones of the two Roques indicated the two were in frequent contact during the eight hours when the son took over the accounts, Ertilus alleged.

Following the shutdown, Mayor Roque used the messages retrieved from the compromised accounts to identify the people who ran and supported it. On February 9, he used his iPhone to call the Hudson County (New Jersey) government official, identified in the criminal complaint as Victim 1, who had anonymously established the recall website. The older Roque then claimed to have proof that the official was involved with the site.

"Mayor Roque stated that he, the Mayor, had a friend in high levels of government who had shut the Recall Website down," the complaint alleged. "According to Victim 1, Mayor Roque stated that everyone would pay for getting involved against him."

The complaint was unsealed Thursday morning. It's the latest reminder that even in a world of sophisticated hacks and James Bond-style espionage malware, the most effective attacks often rely on trickery that is considerably more low-tech. Account takeovers affecting then-vice presidential candidate Sarah Palin, celebrity Xbox gamers, and ISP Comcast have all been pulled off by exploiting weaknesses in the way Yahoo, Microsoft, and other services go about resetting passwords reported as forgotten. To combat the practice, Google, Facebook, and a variety of other companies have begun using one-time passwords sent to cell phones or other "out-of-band" devices when performing sensitive account changes such as password resets.

The Roques are both charged with three counts of intentionally accessing computers without authorization or intentionally causing damage to a protected computer. They are scheduled to appear in court on Thursday afternoon. They have not yet entered a plea in the case. West New York is located about seven miles west of Manhattan and has a population of about 50,000, according to US census data. Ironically, Mayor Roque reportedly came to office after leading a successful recall against the previous mayor, Sal Vega. A press release from the US attorney's office in New Jersey is here.