PLATTSBURGH — Two former SUNY Plattsburgh students who have admitted to stealing nude photos and videos from students celebrated their crimes by calling them “wins,” court documents obtained by the Press-Republican said.

Records show that Nicholas Faber and Michael Fish were able to gain access to female Plattsburgh State students’ nude photos and videos without their consent through their student email accounts between 2017 and 2019.

According to records from the U.S. District Court for the Northern District of New York, Faber, a class of 2017 Plattsburgh State alumnus, admitted he was able to get into more than a dozen student email accounts, some of which were owned by people he knew, through a variety of means. One included using the password reset feature and then correctly answering security questions.

From their email accounts, court papers said, Fish and Faber, both 25, were able to get into Snapchat, Facebook, Google and iCloud accounts, where they then downloaded nude and explicit photos and videos.

Fish and Faber traded what they stole with each other and with others online, according to Faber’s plea agreement, the records show.

Faber’s plea agreement also included snippets of conversations between him and Fish as they planned to get into a student’s Snapchat account.

“Hey man any snapchats you want me to try to get into?” Faber asked Fish on or about Jan. 12, 2019. He went on to say that he will ask a friend, “how he does it if you want to try.”

Faber went on to explain: “Basically he texts them off a fake number with some story of how he accidentally signed up for snap with their phone number, and needs a code to change it. Then they give him the code which really lets him reset their [password.]”

Faber also cautioned Fish in that conversation, the records show.

“If you do sorority girls you gotta do it smart cause they talk. You know?”

Later in the conversation, Fish shared a photo. Fish responded with, “Damn bro good shit! So you think it’d be worth it to try n get more?”

Other conversations, according to the records, included them celebrating how they stole photos and described them as “wins,” and how Faber had a preference for “new” photos and videos of “athletes.” Faber was a member of Plattsburgh State’s track and field team for the 2014-15 and 15-16 seasons.

The court documents also said Faber also created collages using the stolen photos. He would place nude photos along with benign photos of the students, such as graduation pictures. He and Fish would then distribute them, according to the plea agreement.

Plattsburgh State’s University Police started the investigation into Fish in spring of 2019. They were able to track Fish’s IP address when he attempted to access a student’s email from his cell phone, UP Chief Pat Rascoe said.

A dozen officers made up of federal, state and university police later executed a search warrant on Fish’s Albany residence, Rascoe said.

Faber was named a co-conspirator after a Federal Bureau of Investigation probe that included interviews and examination of Fish’s personal devices, Rascoe said.

Between April 2018 and April 2019, Plattsburgh State spent at least $35,430.85 “remedying and investigating account lock outs” caused by unauthorized password resets, implementing measures to prevent Faber and Fish from accessing its network through virtual private networks, which were used to conceal their IP addresses, conducting a damage assessment, notifying victims, consulting with experts and attorneys and restoring compromised data, the agreement said.

“We are pleased to see these cases brought and the guilty pleas filed,” Plattsburgh State President Alexander Enyedi told students in an email Wednesday.

SUNY Plattsburgh did not offer any further comments.

Plattsburgh Sate has since implemented multi-factor authentication to all of its email accounts. It hasn’t received similar break-ins since its implementation, Plattsburgh State’s Library and Information Technology Services said.

Faber faces up to 12 years in prison, a $250,000 fine and three years of supervised post-imprisonment release. He pled guilty to computer fraud and aggravated identity theft. He also agreed to pay $35,430 in restitution to Plattsburgh State.

Fish pleaded guilty to computer hacking, aggravated identity theft and child pornography offenses. He is scheduled to be sentenced March 19.