Module 1N — Foundational Criminal Prosecutions: The Cases That Made the Law

Non-Lawyers Summary

Six prosecutions shaped every legal rule that applies to hackers and security researchers today. They established what "damage" means under the CFAA, whether operators of illegal marketplaces go to prison even if they never touched the contraband, why Bitcoin is not anonymous, and what happens to researchers who wrote malware before they became heroes. Understanding these cases is not optional background — they are the foundation of every charging decision, every plea negotiation, and every supervised release condition that will touch you if something goes wrong.

What This Module Answers Fast

• I ran a network scan that caused unexpected load — am I exposed under CFAA? → Start with Morris. Damage does not require intent.
• My research involves accessing systems without explicit written authorization — what's the worst-case sentencing ceiling? → Morris (3 years probation, $10K) to Gonzalez (20 years) depending on scope and harm.
• I cooperate with law enforcement — does that protect me if I keep hacking on the side? → Gonzalez says no. Snitching while continuing the scheme is obstruction and more charges.
• I helped build a platform where others did the illegal thing — am I liable? → Ulbricht. Operator liability is real, brutal, and carries life.
• An FBI informant asked me to hack a target — is that entrapment? → Hammond. Courts reject entrapment when the defendant was predisposed. The Sabu lesson is hard.
• I wrote malware years ago but now do legitimate security work — will past authorship kill me at sentencing? → Hutchins. It won't immunize you, but extraordinary post-offense conduct matters to the right judge.
• Can I attend DEF CON safely if I have prior malware charges pending? → Hutchins says DEF CON can be an arrest venue. Know your exposure before you travel.
• The government is restricting my internet access as a release condition — is that even constitutional? → Mitnick. Courts have been doing this since 1999, and it has survived every challenge.

Overview

In 1986, Congress quietly slipped an amendment into the federal code. It was called 18 U.S.C. § 1030. The drafters imagined foreign spies. What they got instead was everything that came after.

Within two years, a Cornell graduate student turned it into the foundational statute for criminal prosecution of computer intrusion. From the Morris Worm in 1988 through the Hutchins prosecution in 2017, each major case answered a question the prior generation of prosecutors had no roadmap for. Does damage require intent? No (Morris). Can a judge strip a released defendant of internet access as a condition of supervised release? Yes (Mitnick). Can coordinated payment card fraud at the nine-figure scale be prosecuted under access device statutes? Yes, and at 20 years it will set sentencing records (Gonzalez). Can running an online marketplace immunize you from liability for what users do on it? Absolutely not (Ulbricht). Does a cooperating FBI informant directing your hacks create an entrapment defense? Courts say no (Hammond). Does saving the internet from a global ransomware worm offset earlier malware authorship? Partially — if the judge is paying attention (Hutchins).

The arc of these prosecutions is not linear. Morris got probation in 1990; Ulbricht got two consecutive life sentences in 2015. The difference is not just scale — it is the legal theories available at the time, the sentencing guidelines in effect, and the degree to which the defendant's conduct was treated as organized criminal enterprise versus reckless experimentation. Security researchers who dismiss these cases as "ancient history" or as prosecutions of obviously guilty parties miss the point: the doctrines created in each case are still alive, still being applied, and still determining the outer edges of what you can and cannot do without risking federal charges.

The one consistent lesson across all six: the government's theory of harm is almost always broader than the defendant's theory of their own conduct. Morris thought he was doing an experiment. Hutchins thought he'd left malware authorship behind. Hammond thought he was doing political activism. The DOJ charged them for what the statute said, not what they intended. Know the statutes. Know the cases. Know the gap between what you think you're doing and what a prosecutor will say you did.

Start Here If Your Issue Is...

Issue Map

flowchart LR
  A["Security research or hacking activity"] --> B["What did the conduct touch?"]
  B --> C1["Unintended damage to third-party systems"]
  B --> C2["Payment card data / financial fraud"]
  B --> C3["Platform operated for others' crimes"]
  B --> C4["Malware authorship / tool creation"]
  B --> C5["Informant-directed intrusions"]
  B --> C6["Pre-offense malware, post-offense heroism"]
  C1 --> D1["Morris doctrine: intent irrelevant to damage"]
  C2 --> D2["Gonzalez: §1029 + §1030 stack, 20yr ceiling"]
  C3 --> D3["Ulbricht: operator = co-conspirator, life possible"]
  C4 --> D4["Hutchins: authorship is chargeable; good works help sentencing only"]
  C5 --> D5["Hammond: predisposition defeats entrapment"]
  C6 --> D6["Hutchins: judge's discretion at sentencing is real"]
  D1 --> E["Mitigations: cooperation, restitution, no-prior-intent evidence"]
  D2 --> E
  D3 --> E
  D4 --> E
  D5 --> E
  D6 --> E

Timeline Overview

timeline
  title Foundational hacker criminal prosecutions 1988–2019
  1988 : Morris Worm released Nov 2 — 6,000 machines infected
  1990 : Morris convicted — first CFAA felony; 3yr probation
  1991 : First Circuit affirms Morris conviction
  1995 : Mitnick arrested after 3yr manhunt; held pre-trial
  1999 : Mitnick pleads guilty; 5yr total; internet-restriction release condition
  2008 : Gonzalez indicted in D. Mass. and D.N.J.
  2010 : Gonzalez sentenced 20yr + 1day — longest hacking sentence at time
  2011 : Silk Road launched by Ross Ulbricht
  2011 : Jeremy Hammond joins LulzSec/AntiSec operations under Sabu
  2012 : Sabu (Hector Monsegur) revealed as FBI informant; Hammond arrested
  2013 : Silk Road seized; Ulbricht arrested at SF Public Library
  2013 : Hammond sentenced 10yr under plea
  2015 : Ulbricht convicted; sentenced to two consecutive life terms + 30yr
  2017 : WannaCry ransomware global attack — Hutchins finds killswitch
  2017 : Hutchins arrested at DEF CON; Kronos charges unsealed
  2019 : Hutchins pleads guilty; sentenced to time served + supervised release

Key Facts

• The CFAA has been amended at least seven times since 1986; the core criminal provisions at §§ 1030(a)(2) and (a)(5) have expanded with each major prosecution cycle.
• "Damage" under § 1030(e)(8) means any impairment to the integrity or availability of data, a program, a system, or information — there is no intent-to-damage element in the statutory definition.
• Supervised release conditions restricting internet access are standard in CFAA convictions and have been affirmed by every circuit that has reviewed them, though courts have occasionally trimmed overbroad blanket restrictions.
• The Sentencing Guidelines' Computer Fraud section (U.S.S.G. § 2B1.1) applies loss enhancements, victim count multipliers, and sophisticated means enhancements that routinely push guidelines ranges into decades even for first-time offenders.
• All six defendants in this module were U.S. citizens or permanent residents, prosecuted in U.S. federal courts, and either convicted at trial or pled guilty — this module is about domestic prosecution, not international attribution cases.
• Bitcoin's pseudonymity, not anonymity, was definitively demonstrated in the Ulbricht prosecution: on-chain transaction tracing identified Ulbricht's wallets without breaking any cryptography.
• The FBI's use of Sabu as an active confidential informant directing hacks against foreign government targets while he was cooperating remains one of the most legally and ethically contested law enforcement operations in cybercrime history.

United States v. Robert T. Morris (1991) — "The Kid Who Broke the Internet Before the Internet Had a Name"

Citation: 928 F.2d 504 (2d Cir. 1991); affirmed United States v. Morris, 991 F.2d 1566 (1st Cir. 1993) Statutes charged: 18 U.S.C. § 1030(a)(5)(A) — unauthorized access causing damage Sentence: 3 years probation, 400 hours community service, $10,050 fine Primary source: 1st Cir. opinion

The Night the Internet Went Dark

It was November 2, 1988, and Robert Tappan Morris — a Cornell University computer science graduate student, son of NSA chief scientist Robert Morris Sr. — sat down at an MIT terminal and released something the world had never seen.

He called it an experiment. He wanted to measure the internet's size, probe its vulnerabilities, demonstrate what was possible. He was twenty-two years old and almost certainly the most technically sophisticated person in any room he had ever entered.

By morning, roughly 6,000 machines — approximately 10 percent of the entire internet at the time — had seized up. Universities, research institutions, military contractors: all grinding to a halt as the same rogue process replicated itself again and again, consuming every cycle of processing power it could find.

But that wasn't the real story. The real story was the line of code Morris had written to protect himself from detection — the one that backfired.

The Bug That Changed Everything

Morris designed a self-replication check: the worm would ask a running copy if it should replicate, and if yes, replicate anyway one in seven times, to prevent a lying instance from blocking its spread. The logic was clever. The result was catastrophic. Machines re-infected themselves repeatedly, locked in an endless loop, until they became unusable. Damage estimates ranged from $100,000 to $10 million, primarily measured in the staff hours it took to scrub each machine clean.

Morris was identified within 24 hours through code forensics and MIT connection logs. He was indicted in 1990. When the jury returned its verdict, he became the first person ever convicted under the 1986 Computer Fraud and Abuse Act.

He hadn't meant to crash anything. That was the point — and the paradox.

Then the Judge Dropped the Ruling That Changed Everything

On appeal, Morris made the argument that anyone in his position would make: I never intended to cause damage. It was an experiment. The First Circuit rejected it without hesitation.

The court held that § 1030(a)(5) requires only:

1. intentional unauthorized access (or access exceeding authorization), and
2. damage resulting from that access.

Intent to cause the damage is not required. The statute is satisfied when the defendant intentionally accessed a computer without authorization and damage resulted from that access, regardless of whether the damage was the defendant's goal.

This is the Morris Doctrine: damage under CFAA does not require intent to damage.

What This Means for You — Right Now

The Morris Doctrine is not historical curiosity — it is the live rule. If you run a network scan, deploy a fuzzer, test an endpoint, or release a tool that causes unintended system instability on a machine you were not authorized to access, you have potentially satisfied every element of § 1030(a)(5). "I didn't mean for it to crash" is not a defense to the damage element.

Practical implications for researchers:

• Authorization scope is everything. Morris accessed MIT's systems to launch from, and he accessed third-party machines to exploit. He had no authorization for the third-party machines. Scope documents, bug bounty rules, and written authorization letters exist precisely to prevent your experiment from becoming a Morris-style prosecution.
• Collateral damage is your legal problem. If your exploit code spreads laterally beyond the authorized scope — even unintentionally — you own the resulting damage. Lateral movement must be explicitly in scope and controlled.
• The "$5,000 threshold" matters. § 1030(c)(4)(A)(i)(I) makes intentional unauthorized access causing damage a felony when the loss exceeds $5,000 in a one-year period. Staff time spent cleaning up a botched test easily clears this threshold.

Morris was eventually pardoned — by his own subsequent career. He became a MacArthur Fellow, co-founded Y Combinator's predecessor Viaweb, and is now a tenured professor at MIT. The pardon was reputational, not legal. The conviction stands.

United States v. Kevin Mitnick (1999) — "The Most Wanted Hacker in America"

Citation: No. CR-96-0396 (C.D. Cal. 1999); CR 99-0057 (C.D. Cal. 1999) Statutes charged: 18 U.S.C. § 1030 (computer fraud), 18 U.S.C. § 1343 (wire fraud) — 4 counts wire fraud, 2 counts computer fraud Sentence: 5 years total (46 months credit for pre-trial detention); supervised release with conditions including no internet access for 3 years Primary source: DOJ press release July 9, 1999; sentencing transcript C.D. Cal.

The Three-Year Chase

By the time the FBI closed in, Kevin Mitnick had been a ghost for three years.

He'd compromised Nokia, Motorola, Sun Microsystems, Novell, and Fujitsu. He'd stolen source code valued at hundreds of millions of dollars. He'd maintained access through false identities, insider manipulation, and an almost supernatural awareness of how investigators thought — which allowed him to stay one step ahead, month after month, year after year.

His most powerful tool wasn't code. It was a telephone. Mitnick could call an employee, sound exactly like someone they trusted, and walk away with passwords, credentials, and internal access that no exploit could have delivered. He was, by any honest accounting, the most dangerous social engineer in American history.

But the most wanted man in the United States made one mistake: he went after the wrong target.

The Fall

Tsutomu Shimomura was a security researcher. Mitnick had compromised him. Shimomura took it personally. In what became one of the most celebrated manhunts in hacker history, Shimomura helped the FBI track Mitnick to Raleigh, North Carolina, where agents arrested him in February 1995.

What happened next was not justice. It was theater.

Mitnick spent 4.5 years in pre-trial detention — including eight months in solitary confinement — after prosecutors successfully argued that he could launch nuclear missiles by whistling phone tones into a handset. The claim was absurd. It was effective. Courts had no framework for assessing the danger posed by a man who could make any phone call and extract any secret. They deferred to the government, and Mitnick sat in a cell.

The Verdict — and the Conditions That Followed

In 1999, Mitnick pled guilty to two counts of computer fraud and four counts of wire fraud. The plea acknowledged unauthorized access to Nokia, Motorola, Fujitsu, Sun Microsystems, and Novell networks, and interstate transportation of stolen property. He'd already served most of the sentence.

But the judge imposed something unprecedented: a condition of supervised release prohibiting Mitnick from using computers, cellular phones, or internet services for three years after release.

This established the supervised release internet restriction as a legitimate sentencing tool. Courts have applied it in nearly every significant CFAA conviction since.

What This Means for You — Right Now

Mitnick's prosecution created the template that every subsequent major hacker prosecution has followed:

The pre-trial detention fight is the real fight. If you're arrested on CFAA charges and the government argues you are a flight risk or a danger to the community, expect the government to characterize your technical skills as the danger. The court is unlikely to have the technical sophistication to push back on those characterizations. Bail in CFAA cases is contested and often lost.

Supervised release conditions will restrict your life after prison. The internet restriction imposed on Mitnick was for three years. Modern conditions in CFAA cases commonly include: no internet access without probation officer approval, warrantless search of all devices, prohibition on encryption, prohibition on using any device that obscures location or identity, and prohibition on employment involving computer access. If you are convicted, assume these conditions will govern your life for years after release.

Social engineering is wire fraud, not just CFAA. Mitnick's most effective technique was talking his way into access. The wire fraud charges under § 1343 covered the telephone calls he made using false identities to extract credentials and access. CFAA is not the only statute in the charging document. Wire fraud carries up to 20 years per count. Social engineering by phone or email in the course of unauthorized access is almost certainly wire fraud in addition to CFAA.

The source code theft theory is still alive. Mitnick stole source code. The government valued it at hundreds of millions of dollars. Modern security researchers who exfiltrate source code during testing — even with the intent of responsibly disclosing — face the same theory: you took proprietary code you had no right to possess. The damage valuation for source code is enormous and highly favorable to prosecutors.

United States v. Albert Gonzalez (2010) — "The Informant Who Kept Hacking"

Citations: No. 08-CR-10223 (D. Mass.); No. 09-CR-626 (D.N.J.) Statutes charged: 18 U.S.C. § 1029 (access device fraud), 18 U.S.C. § 1030 (computer fraud), 18 U.S.C. § 1343 (wire fraud), conspiracy counts Sentence: 20 years + 1 day (concurrent from two districts, with D.N.J. running consecutively to D. Mass. for the extra day) — longest hacking sentence at the time of imposition Restitution: Over $200 million (mostly uncollectable) Primary source: DOJ press release March 25, 2010

170 Million Cards

Between 2005 and 2008, Albert Gonzalez ran the largest coordinated payment card theft operation in U.S. history. He and his co-conspirators stole over 170 million payment card numbers. The targets: TJX Companies (TJ Maxx, Marshalls), Heartland Payment Systems, 7-Eleven, Hannaford Bros., Dave & Buster's.

The methodology was industrial in its precision. They wardrove retail parking lots, found vulnerable wireless networks, SQL-injected their way into point-of-sale systems, and deployed packet sniffers that silently captured live payment card data as it streamed through. The stolen numbers were exfiltrated to servers in Eastern Europe and sold to carders globally in bulk. This was not crime. It was a supply chain.

But there was a twist that no jury could have invented.

The Twist No One Could Have Invented

While Gonzalez was conducting these operations, he was simultaneously a paid Secret Service informant. He was a key source in Operation Firewall, a 2004 investigation that led to 28 arrests of carders operating through Shadowcrew.com. The Secret Service paid him. Gave him access to investigative information. And he used that access to protect his own operations — the very operations he was feeding intelligence about others to stop.

He wasn't cooperating. He was running a counterintelligence operation against the people paying him to cooperate.

Twenty Years

Gonzalez faced indictments in two districts simultaneously. D. Mass. covered the TJX/Heartland breach. D.N.J. covered Dave & Buster's. The sentences ran concurrently, except D.N.J. added an extra day, running consecutively — producing 20 years + 1 day as the functional sentence. It set the ceiling for what a CFAA-adjacent hacking prosecution could achieve under the guidelines as they existed in 2010.

§ 1029 access device fraud as the primary vehicle. When payment card numbers are involved, § 1029 is the government's preferred statute. It specifically addresses unauthorized use of access devices — credit and debit cards, card numbers, PINs, and authentication codes all qualify. The statute carries up to 10 years for a first offense involving fraud over $1,000. Combined with conspiracy counts and wire fraud, the exposure stacks rapidly.

Cooperation while hacking is not cooperation. Gonzalez's continued criminal activity while serving as a paid Secret Service informant was treated as aggravating, not mitigating. Cooperation credit requires genuine cessation of the criminal conduct. Continuing to hack while feeding the government information about other hackers is not protected by any cooperation agreement.

What This Means for You — Right Now

§ 1029 is the charging engine for anything involving payment systems. If your research involves payment card systems — even authorized PCI DSS testing — the government's charging options extend well beyond CFAA. SQL injection into a POS system, even during a pentest, triggers § 1029 if card data is accessed. Scope documentation for payment system pentests must be explicit, preserved, and unambiguous.

The sentencing guidelines loss calculation will not match your intuition. Gonzalez was responsible for 170 million card numbers. The government did not establish that 170 million cards were actually used fraudulently. The loss calculation uses a formulaic per-card value ($500 per compromised account under the guidelines at the time, with adjustments for actual demonstrated fraud). The resulting guidelines loss figure bears little relationship to what was actually stolen but drives an enormous guidelines range.

Wardriving is not harmless. The initial vector in several of the Gonzalez breaches was identifying vulnerable retail wireless networks by driving through parking lots. This is § 1030(a)(2) unauthorized access even if the network has no WPA2 password. Open networks accessed for the purpose of gaining entry to a connected corporate network are accessed without authorization. "It was an open network" is not a defense.

Restitution orders are entered even when collection is impossible. The $200M+ restitution order against Gonzalez will never be collected. He has no assets. Courts enter these orders anyway because they preserve the victim's legal right to collect if Gonzalez ever comes into money, and because they serve as a statement of accountability. Don't assume that your inability to pay means restitution won't be ordered.

United States v. Ross William Ulbricht (2015) — "The Man Who Built a Kingdom and Called It Freedom"

Citation: No. 14-CR-68 (S.D.N.Y. 2015), aff'd 858 F.3d 71 (2d Cir. 2017) Statutes charged: 21 U.S.C. § 841 (drug trafficking conspiracy), 18 U.S.C. § 1962(d) (RICO conspiracy), 18 U.S.C. § 1956(h) (money laundering conspiracy), 18 U.S.C. § 1030(a)(2) (computer hacking), 18 U.S.C. § 1028A (aggravated identity theft) Sentence: Life without parole (two concurrent life sentences) + 30 years (consecutive) on the remaining counts — no possibility of parole under federal sentencing (federal parole was abolished in 1987) Primary source: DOJ press release May 29, 2015

The Library Arrest

October 2, 2013. The Glen Park branch of the San Francisco Public Library. Ross Ulbricht — 29 years old, no prior criminal history, known to neighbors as quiet and intellectual — was at a table near the science fiction section, his laptop open, logged into the administrative interface of Silk Road.

FBI agents moved fast. The goal was to prevent him from closing the lid. An encrypted laptop, powered off, is an evidence problem. An open session is a prosecution gift.

They got the session. And on that laptop: the full Silk Road server infrastructure code, private keys, a personal diary, and complete transaction logs for the most sophisticated criminal marketplace the internet had ever produced.

The Marketplace

Ulbricht, operating under the pseudonym "Dread Pirate Roberts," had founded and run Silk Road from January 2011. It was a Tor-based dark web marketplace operating exclusively in Bitcoin. At its peak: approximately 950,000 registered users. Over $1.2 billion in transactions — approximately 9.5 million Bitcoin. Ulbricht's personal take: an estimated $80 million in commissions.

The primary commerce was illegal drugs. Heroin, cocaine, MDMA, LSD, cannabis, prescription medications — sold by approximately 3,900 vendors, mostly shipped through USPS. The marketplace also offered hacking services, counterfeit currency, and false identity documents.

Ulbricht never personally sold a single drug. He built the marketplace. He maintained it. He managed vendor disputes, quality reviews, and customer service policies. In the government's framing, he was the CEO of a criminal enterprise — and under 21 U.S.C. § 841, that was more than enough.

Bitcoin Tracing — The Myth Dies

The prosecution definitively established what cryptography enthusiasts had refused to accept: Bitcoin is not anonymous.

Prosecutors identified Ulbricht's personal Bitcoin wallets through blockchain analysis, correlating his wallet addresses with identifiable transactions on the public ledger. This was 2013. The blockchain forensics available today are orders of magnitude more sophisticated.

Ulbricht had been identified years earlier through operational security failures so basic they read like cautionary folklore: a forum post linking his real email to the Silk Road launch announcement. A Google Groups post using his real name. The same person who built a fortress of encryption had left the front door open.

Two Life Sentences — For a Man Who Never Touched the Drugs

Judge Katherine Forrest sentenced Ulbricht to two concurrent life terms explicitly as a deterrence statement. She stated in her sentencing remarks that no prison term short of life would adequately deter others from creating similar platforms. Ulbricht had no prior criminal history. The sentence is harsher than those given to many murderers.

The doctrine this established: You do not have to personally commit the underlying crime to be convicted of the conspiracy. The operator of a system that knowingly and intentionally facilitates illegal activity is part of the conspiracy. The RICO enterprise theory — charged under 18 U.S.C. § 1962(d) — made Ulbricht the organizer and leader of an enterprise, triggering severe sentencing enhancements that stacked on top of the drug trafficking conviction.

What This Means for You — Right Now

Platform operator ≠ platform immunity. 47 U.S.C. § 230 provides civil immunity for platforms hosting third-party content. It provides zero criminal immunity. If you build a platform, service, or tool where a primary use is illegal activity, and you know about that use and continue operating the platform, you are a co-conspirator in the criminal activity. The technical sophistication of the platform — Tor, Bitcoin, encryption — is treated as evidence of intent, not as a mitigating factor.

Pseudonymity on Tor + Bitcoin is not protection. Tor does not hide you from a determined adversary with traffic correlation capabilities. Bitcoin transactions are permanently and publicly recorded. The combination of on-chain transaction forensics and subpoenaed records from exchanges will destroy pseudonymity. Assume both.

The laptop seizure model is the prosecution template. The FBI's technique — approach while logged in, prevent encryption — is the standard playbook for live computer seizures. Full-disk encryption protects you only if the device is powered off at the moment of seizure. A running session with an open terminal or browser means the agents have access to everything in memory and every open file.

Sentencing for running a criminal marketplace has no floor. Gonzalez got 20 years for being a sophisticated fraudster. Ulbricht got life for running a platform. The theory that platform operation multiplies culpability by the entire scope of the platform's activity is now established doctrine. There is no ceiling on how this scales.

United States v. Jeremy Hammond (2013) — "The Hacktivist and the Informant Who Betrayed Him"

Citation: No. 12-CR-185 (S.D.N.Y. 2013) Statutes charged: 18 U.S.C. § 1030(a)(2)(C) (unauthorized access to obtain information), 18 U.S.C. § 1030(a)(5)(A) (intentional damage) Sentence: 10 years (statutory maximum under the plea agreement) + 3 years supervised release Primary source: DOJ press release November 15, 2013

The Man Inside

Jeremy Hammond believed he was fighting a war. He was a Chicago-based hacktivist, a member of the AntiSec movement — a loosely coordinated effort by Anonymous and LulzSec participants to expose what they saw as the surveillance state and its corporate partners. He wasn't in it for money. He was in it for the fight.

In late 2011, Hammond and other AntiSec members breached Strategic Forecasting Inc. — STRATFOR — a private intelligence and geopolitical analysis firm. What came out: approximately 60,000 credit card numbers belonging to STRATFOR subscribers, including government employees and military personnel. Over 5 million internal emails. The credit card data was used to fraudulently donate approximately $700,000 to charities. The emails went to WikiLeaks, published as the "Global Intelligence Files."

But the real story wasn't the hack. It was who was watching.

Hector Monsegur — "Sabu"

Hector "Sabu" Monsegur was a senior LulzSec/AntiSec figure. Respected. Trusted. A name in the community that opened doors.

He was also, since June 2011, working for the FBI.

Under FBI direction, Sabu continued operating as an active participant in AntiSec — directing Hammond and others toward specific targets. Several of those targets were foreign government websites: Greece, Turkey, Syria, Brazil, Nigeria, Iran, and others. Hammond hacked those sites at Sabu's direction. The FBI watched. For the foreign government site hacks, the FBI's theory was that they were gathering intelligence on foreign cybersecurity vulnerabilities — making them legally authorized law enforcement activity.

For Hammond, they were additional § 1030 violations.

The Entrapment Defense — and Why It Failed

Hammond's legal team argued the obvious: Sabu, as an FBI informant, had induced him to commit crimes he would not otherwise have committed. The classic entrapment defense.

The court rejected it under the Jacobson v. United States (1992) framework. Entrapment requires the government to induce an otherwise innocent person. A defendant who is predisposed to commit the offense cannot claim entrapment. Hammond's documented history of prior computer intrusions and his enthusiastic participation in AntiSec established predisposition. The fact that Sabu provided specific targets did not create entrapment when the defendant was already committed to the enterprise.

Hammond pled guilty to a single count of § 1030 conspiracy in exchange for dismissal of additional counts. The statutory maximum — 10 years — was the agreed sentence. He got every day of it.

What This Means for You — Right Now

If an informant asks you to hack something, that is not a safe harbor. The entrapment defense exists on paper. In practice, it is almost never successful when the defendant has any prior criminal history or any prior participation in the relevant type of activity. If someone in your community is encouraging specific attacks against specific targets, and you comply, the fact that they were working with law enforcement at the time does not protect you. The question is your predisposition, not their conduct.

"Hacktivism" does not create a political defense. Hammond's legal team made arguments grounded in his political motivations — exposing private intelligence contractors, corporate surveillance, government wrongdoing. Courts are indifferent to political motivation in criminal prosecutions. The political content of the exfiltrated data, and the political purpose of the hacker, are legally irrelevant to § 1030 liability.

The FBI uses confidential informants to direct attacks it then prosecutes. The Sabu operation is the clearest documented example of this: an FBI informant directed attacks against foreign government sites while the FBI watched, gathered the intelligence, and used Hammond's participation as additional evidence against him. The legal and ethical dimensions of this remain contested. The practical lesson: the operational security risk inside your trusted community is as high as the technical security risk. Informants operate in hacktivist communities.

Publication of stolen data compounds sentencing. Hammond's STRATFOR data went to WikiLeaks and was published. The government treated this as an aggravating factor — not just theft, but distribution. The combination of exfiltration plus public release is treated as a more serious offense than exfiltration alone.

United States v. Marcus Hutchins (2019) — "The Man Who Saved the Internet, Then Got Arrested at the Airport"

Citation: No. 17-CR-124 (E.D. Wis. 2019) Statutes charged: 18 U.S.C. § 1030(a)(2)(C) (unauthorized access), 18 U.S.C. § 2512 (possession of illegal interception devices), 18 U.S.C. § 1956 (money laundering) — 2 counts of § 1030 and related counts under initial indictment; plea to 2 counts Sentence: Time served (approximately 1 year) + 1 year supervised release (no internet restriction) Primary source: DOJ press release July 26, 2019; Sentencing memorandum

May 12, 2017 — The Worst Day on the Internet

Without warning, hospitals across the United Kingdom began losing access to patient records. Telefónica's offices in Spain went dark. Deutsche Bahn's train departure boards stopped working. FedEx's systems locked. Within hours, the attack had hit 150 countries. The UK's National Health Service was turning patients away from emergency wards.

WannaCry had arrived.

It was a ransomware worm that used EternalBlue — an NSA exploit leaked by the Shadow Brokers — to self-propagate across unpatched Windows systems at catastrophic speed. No one had a weapon against it.

Except a 23-year-old British researcher named Marcus Hutchins, watching from his bedroom.

He found something odd in the malware code: a domain name that didn't exist. A killswitch, maybe — the kind a careful malware author buries as an emergency brake. He registered the domain for $10.69.

The worm died. Hutchins had stopped a global catastrophe for ten dollars and sixty-nine cents.

Then the FBI Came to Las Vegas

Three months later. DEF CON 2017. Hutchins was preparing to fly home to the UK when FBI agents appeared at the airport.

The charges had nothing to do with WannaCry.

They related to conduct between 2014 and 2015 — before his legitimate security career, before the malware analysis, before the killswitch. Hutchins had created and sold the Kronos banking trojan, a credential-harvesting malware targeting online banking sessions. He had sold it to a co-conspirator who distributed it commercially.

The government's theory was airtight in its simplicity: creating and selling malware is a federal crime regardless of what you do afterwards.

The Verdict That Surprised Everyone

After two years of legal proceedings, Hutchins pled guilty to two counts: one count of § 1030 (unauthorized access by deploying a computer program) and one count of § 2512 (possession of an illegal interception device — the banking credential harvester).

Judge Joseph Stadtmueller's sentencing remarks were extraordinary. He noted that Hutchins had "matured" from his earlier conduct, that his post-offense security contributions were "truly extraordinary," and that the WannaCry killswitch had saved the NHS and countless organizations. The judge sentenced Hutchins to time served — no internet restriction, no additional prison, no supervised release conditions that would have ended his security career.

But here's the paradox that left the community shaken: the sentence was an act of mercy, not a rule. A different judge, on different facts, might have given him years. Prior malware authorship is chargeable even after rehabilitation. The statute of limitations for § 1030 is 5 years; the Kronos conduct fell within that window. Prior rehabilitation — even celebrated, documented, publicly verified rehabilitation — is not a defense to the underlying charges. It is relevant only to sentencing.

What This Means for You — Right Now

Your past as a blackhat does not disappear when you go whitehat. If you wrote malware, built exploit kits, participated in carding operations, or sold hacking tools — even years ago — the statute of limitations may still cover that conduct. Post-offense legitimate work does not erase criminal liability. The government knows who wrote Kronos, who built Blackhole, who operated various exploit-as-a-service operations. If they want to charge you, and the window is open, your current employment at a security firm does not close the case.

Prior legitimate security work can meaningfully influence sentencing. Hutchins's case is the first major instance where a federal judge explicitly and publicly credited the defendant's security community contributions at sentencing. This creates a reference point for future defendants arguing for downward departures based on extraordinary post-offense rehabilitation. It is not precedent in the binding legal sense — district court sentencing rulings aren't binding — but it is a template for defense advocacy.

Bug bounty participation and public security research builds a documented record. One reason Hutchins's post-offense rehabilitation argument was compelling is that it was extensively documented: public research blog posts, WannaCry killswitch documentation, employer statements, CVEs filed, talks given. Security researchers who participate visibly and verifiably in the legitimate security ecosystem have a documented record to draw on if they ever need it at sentencing.

Conference travel to the U.S. is a risk calculation. If you have prior exposure — whether charged or uncharged — traveling to the United States for security conferences is a decision that requires legal counsel, not just a flight booking. DEF CON, Black Hat, RSA, and others are regular arrest venues for individuals with open exposure. The U.S. arrest of Hutchins at an airport was completely foreseeable once the investigation was active.

Chilling effect is real. The security community's reaction to the Hutchins arrest was visceral. Researchers who had prior activity they considered minor reconsidered travel to U.S. conferences. The arrest of someone who had just prevented a global catastrophe — for pre-rehabilitation conduct — sent a message about how the government views the hacker-to-researcher career transition: with skepticism, and through the lens of what statutes the prior conduct violated, not what the defendant became.

Practical Takeaways

For active security researchers:

• Written authorization is your only real protection. Before any test, have explicit, preserved, unambiguous written authorization that covers your specific methodology. "They have a bug bounty program" is not sufficient if your methodology exceeds what the program covers.
• Damage without intent is still damage. If your tooling causes unintended load, data corruption, or system unavailability on any system — even during an authorized test — you have a CFAA exposure if the scope documents don't cover the collateral impact.
• Your handling of discovered data is as legally significant as your discovery of it. Exfiltrating proof of a vulnerability, retaining card numbers to demonstrate a breach, or providing raw PII to a journalist all create independent criminal liability beyond the access itself.

For tool builders:

• If your tool's primary or foreseeable use is to access systems without authorization, you have Hutchins-style exposure. Dual-use is not a defense — intent and actual use matter. Document your tool's defensive purpose extensively.
• Selling a tool that others use to commit crimes makes you a co-conspirator in those crimes if you know about the criminal use. Kronos's criminal exposure was not limited to Hutchins using it himself.

For platform operators:

• The Ulbricht doctrine has no civil equivalent in criminal law. § 230 immunity, DMCA safe harbors, and platform neutrality arguments are irrelevant in criminal prosecutions. If your platform knowingly facilitates a criminal enterprise, you are part of the enterprise.
• Monitor your platform's use. Willful blindness — deliberately avoiding knowledge of how your platform is being used — is treated as knowledge for criminal conspiracy purposes.

For anyone with prior exposure:

• Know your statute of limitations. § 1030 is 5 years from the date of the offense. For wire fraud and money laundering, it is also 5 years. Some offenses have 10-year limitations under specific circumstances.
• Travel to the U.S. is a risk event if you have prior exposure. Consult legal counsel before attending any U.S. conference or transiting any U.S. airport.
• If you're cooperating with law enforcement, stop the conduct. Gonzalez's cooperation-while-hacking produced devastating aggravation at sentencing. Cooperation credit requires genuine cessation.

What This Module Does Not Cover

• Civil CFAA claims (covered in Module 1D and Module 1M)
• International and extradition cases involving state-sponsored hackers or foreign nationals prosecuted in absentia (covered in Module 1D)
• Post-Van Buren CFAA scope limitations — how these cases might be charged differently today under the narrowed "exceeds authorized access" standard (covered in Module 1A)
• Sentencing guidelines mechanics — the U.S.S.G. § 2B1.1 loss table, victim enhancement, and sophisticated means enhancement calculations (covered in Module 1F)
• The Mitnick pardons debate — Mitnick was never officially pardoned; he served his sentence and built a legitimate security consulting career. This module addresses the legal record only.
• Current Silk Road II, AlphaBay, Hansa, and successor marketplace prosecutions — the Ulbricht doctrine governs all of them; their individual case records are beyond this module's scope.
• Bug bounty legal safe harbors and DOJ prosecutorial guidelines for security research — covered in Module 1J.

For Non-Technical Readers

These six cases are the story of how the law learned — slowly and imperfectly — to handle computer crime. In 1988, a graduate student released an experiment that crashed 10 percent of the internet. The judge gave him probation. By 2015, a man who ran an online store was sentenced to two consecutive life terms — more than most murderers receive. In between, the law established rules that still govern every security researcher, every platform operator, and every person who touches a computer system they don't own.

The rules are not always intuitive. You can go to prison for causing damage you didn't intend. You can spend years restricted from using the internet after you're released. You can be prosecuted for a platform you built even if you never personally committed the crimes users committed on it. And you can discover a global malware killswitch — saving millions of computers — and still be arrested at the airport for malware you wrote before you became a hero.

The common thread across all six cases is this: the legal system has no accurate model for the difference between a security researcher and a criminal. It uses the same statutes, the same charging theories, and the same sentencing guidelines for both. The difference in outcome — probation versus life — comes down to scale, intent evidence, cooperation, and which judge you draw. Understanding how these cases were decided is the first step to understanding why authorization, documentation, and legal counsel are not optional for anyone doing serious security work.