Jeremy Hammond is in really big trouble. Or, perhaps, the government is just trying to "scare the (expletive) out of him," in the words of Kevin Mitnick, formerly known as the world's "most-wanted hacker" and now a security consultant.
Either way, a potential sentence of 30 years to life for alleged hacking crimes is probably enough to get the attention of most 27-year-olds. And that is what U.S. District Judge Loretta Preska told Hammond last week that he could face if he is convicted on all counts.
Hammond, much better known in the world of hactivism by various online aliases including "Anarchaos," "sup_g," "burn," "yohoho," "POW," "tylerknowsthis," and "crediblethreat," has been held without bail since his arrest in March on charges connected with last year's hacking of Strategic Forecasting, or Stratfor, an Austin, Texas-based international intelligence broker, by AntiSec, an offshoot of LulzSec, which is in turn an offshoot of the hacktivist collective Anonymous.
The three-count federal indictment, brought in the Southern District of New York, charged him with conspiracy to commit computer hacking, computer hacking and conspiracy to commit access device fraud.
More specifically, the government alleges that starting last December, Hammond and others from AntiSec stole information from about 860,000 Stratfor subscribers, including emails, account information, and data from about 60,000 credit cards. The government alleges that he published some of that information online, and used some of the stolen credit card data to run up at least $700,000 in unauthorized charges.
He is also accused of giving about five million internal emails to WikiLeaks, which were published under the name The Global Intelligence Files.
Apparently unknown to Hammond, however, was that the then-leader of AntiSec, Hector Xavier Monsegur, a New York hacker known by the alias "Sabu," had been arrested the previous June and agreed to cooperate with the FBI. So, at least some of the Stratfor information Hammond uploaded was to a honey pot server maintained by the FBI.
At a hearing last week, Hammond was denied bail, based on Judge Preska's determination that he was both a danger to the community and a flight risk. He had also recently been added to the Terrorist Watch List, said Sue Crabtree, a member of the Jeremy Hammond Solidarity Network and a spectator at his bail hearing. Crabtree said Hammond didn't even have a passport.
The bail denial sparked another round of protest from Hammond's supporters. Anonymous published a message on Pastebin demanding that Preska recuse herself for conflict of interest. The group said her husband, Thomas J. Kavaler, was among Stratfor's clients, and therefore one of the alleged victims of the hack. Kavaler is a partner at Cahill Gordon & Reindel LLP in New York City.
"Judge Preska by proxy is a victim of the very crime she intends to judge Jeremy Hammond for," Anonymous wrote in a message posted last Friday. "Judge Preska has failed to disclose the fact that her husband is a client of Stratfor and recuse herself from Jeremy's case, therefore violating multiple Sections of Title 28 of the United States Code."
Beyond that, a writer identified only as "NA" on the website FreeHammond.com, argued thatÃ'Â "Hacktivists are not criminals! Jeremy is alleged of a crime that has exposed the corruption and exploitation of the very State prosecuting him," and suggested entrapment by the FBI as well.
"A time line published only days after Jeremy's arrest suggests that Operation AntiSec [the Stratfor hack] was orchestrated by the FBI through the agency of FBI informant Hector Monsegur," NA wrote.
Hammond himself, in a posting last July on YourAnonNews, claimed that "even the warden of MCC New York has in surprising honesty admitted that, 'the only difference between us officers here and you prisoners is we just haven't been caught.' The(y) call us robbers and fraudsters when the big banks get billion dollar bailouts and kick us out of our homes ... And they call us cyber criminals when they themselves develop viruses to spy on and wage war against infrastructure and populations in other countries."
Chester Wisniewski, senior security adviser at Sophos, said while he is no legal expert, he thinks the Hammond supporters have a valid point about a possible conflict of interest for Judge Preska, although he thinks the claim that hacktivists are, by definition, not criminals is absurd. But he also said the potential sentence looks to be out of proportion to the crime.
"If you physically broke into Stratfor and stole all of that information, you'd get 90 days maybe," he said. "But when it becomes a computer crime, suddenly it goes way up. I don't understand why electronic crimes are getting so much longer sentences than physical crimes."
Kevin Mitnick, noting that the crimes with which he was charged during his hacking career could have brought 400 years in prison, said he expects Hammond's case will be settled by a plea agreement for much less than the possible maximum.
"But what concerns me is even if they drop some counts, the sentence for most federal crimes can range from 10 to 20 years," he said. "How they come up with 30 years to life is beyond me."
Mitnick said it is possible that the government is trying to scare Hammond to get him to cooperate. Or, it could be designed to send a message to Anonymous members that what they view as sticking it to the man could yield some very serious consequences.
Wisniewski said that while the vast majority of those affiliated with Anonymous are not skilled, the members of Lulzsec generally were. "They were talented, and then they got busted," he said. "So, the average Joe is saying, 'Look what happened. Maybe I shoud get out of this."
Hammond is scheduled to go to trial sometime next year.
Read more about malware/cybercrime in CSOonline's Malware/Cybercrime section.