Longform

Hack Pack

Page 4 of 7

By 2002, Albert had become one of the site's administrators, operating under the name "cumbajohny." Soon ShadowCrew had garnered more than 4,000 subscribers who traded more than a million stolen cards. But then the operation imploded.

In late 2003, Albert walked up to an ATM on a quiet New Jersey side street to test fraudulent cards. Local detectives happened to be staking out a grand theft auto ring nearby. They watched the then-23-year-old, who sported long, scraggly hair and a scruffy beard, feeding card after card into the machine. After stopping him, they discovered more than 75 cards in his pockets.

They passed Albert onto the Secret Service, which decided to use him to bring down the ShadowCrew.

Yet again, Albert seems to have set up a two-faced personality. For the federal agents, he played the part of a repentant hacker — sparing no effort to bring down his criminal coconspirators and pleading he'd joined them only out of curiosity.

But online, as investigators would learn years later, Albert was still "soupnazi," the kid who couldn't stop hacking for fun, for profit, and for the sheer joy of breaking the rules.

Days after his arrest at the ATM, "cumbajohny" was back at work at ShadowCrew. He encouraged site members to log into a secure network to sell the cards, supposedly for their privacy — but really so he could feed their identities to the feds.

On October 26, 2004, Albert organized an online meeting of top users. By the end of the day, "Operation Firewall" had ensnared 28 ShadowCrew members. The feds turned up more than 1.7 million stolen card numbers.

And Albert had found a new career. The Secret Service agreed to pay him $75,000 annually as a hacker/consultant. "He was doing what he loves to do," Palomino says. "And he was doing it legally with the government's consent."

Back in Miami, Jonathan James was struggling to readjust to life after serving six months of house arrest for hacking NASA.

At least one computer company offered employment afterward. But Jonathan wasn't interested. "That would have required actually, you know, showing up for work," Bobby says.

Soon after, the boy violated his probation by smoking pot. That earned him a four-month term in a Liberty City halfway house.

On February 10, 2002, breast cancer killed Joanne James. Jonathan, always moody, became depressed. In late March 2002, after violating probation again, he was sentenced to a six months at Three Springs, a youth facility outside Tuskegee, Alabama, where he was kept away from newspapers, books, and computers. The 19-year-old clashed regularly with guards. He was one of two white inmates in the facility, his dad says.

On New Year's Eve 2003, he was walking home from a party when a cop stopped him, suspecting he might have drugs. He didn't, but a speeding ticket had lapsed while he was in the halfway house, and he was booked overnight into Miami-Dade County Jail.

When Bobby picked him up at 10 the next morning, the young man said, "Dad, I'm never going to jail again. Never."

After his prison term, Jonathan grew closer to Chris Scott, who had earned a GED after dropping out of Palmetto Senior High. The pair drank, played Ping-Pong, and hacked. They also stayed in touch with Albert, who had bought a $118,500 condo off Bird Road.

Albert had already re-entered the world of illegal hacking — even as he infiltrated online gangs for the Secret Service. It wasn't long before he talked the two friends into helping him.

Their first big hack for Albert came in 2003, when Chris helped him break through an unprotected wireless system at BJ's Wholesale Club.

The next year, according to one federal indictment, Chris and "J.J." — probably Jonathan James — began "wardriving," as hackers call it, up and down U.S. 1 in Kendall. They looked for big companies' wireless systems on the thoroughfare and then hacked in to steal credit card data. On one of these tours, they hacked the OfficeMax on SW 109th Street.

Albert, meanwhile, recruited an itinerant hacker named Damon Patrick Toey to move into his condo. Damon had begun stealing credit cards online as an 18-year-old in Virginia, where he lived with ten other relatives in a tiny apartment. His mother was absent, "out partying every night and drinking," according to court documents. Albert offered Damon free room and board in exchange for help stealing data; his attorney later said the younger man was a virtual slave, trapped in the condo with no car or money.

By 2007, Albert, Chris, Jonathan, and Damon — with the help of a "sniffer" program, written by Stephen, that found weaknesses in security systems — had hacked a staggering array of companies: TJX Companies, which owns the T.J. Maxx and Marshalls chains; Dave & Buster's; Sports Authority; Citibank; a corporate payroll company called Heartland Payment Systems; and others. They worked with two mysterious, powerful hackers in Russia who helped direct them to targets.

KEEP MIAMI NEW TIMES FREE... Since we started Miami New Times, it has been defined as the free, independent voice of Miami, and we'd like to keep it that way. With local media under siege, it's more important than ever for us to rally support behind funding our local journalism. You can help by participating in our "I Support" program, allowing us to keep offering readers access to our incisive coverage of local news, food and culture with no paywalls.
Tim Elfrink is a former investigative reporter and managing editor for Miami New Times. He has won the George Polk Award and was a finalist for the Goldsmith Prize for Investigative Reporting.
Contact: Tim Elfrink