Longform

Hack Pack

Page 6 of 7

Jonathan leaped to a quick — and tragically mistaken — conclusion: Albert had offered up Chris Scott to get out of the latest charges, and Chris, inevitably, would give prosecutors an even bigger morsel: Jonathan James, the young hacker they'd already sent to the slammer once before.

Jonathan grabbed a sheet of lined notebook paper and wrote in uneven but unrushed cursive strokes. "Story Time," he penned at the top.

"When I Googled 'cumbajohny,' what I saw blew my mind. Albert had been working with the feds since 2003. That means that for five years, he had been having people like Chris hack credit cards for him while he made money selling them over the Internet and then at the same time has his buyers arrested to please the feds," he wrote. "Talk about entrapment!"

Jonathan continued, "I honestly, honestly had nothing to do with [the TJX break-in]. Unfortunately, I don't picture the feds caring all too much.

"So despite the fact that [Chris] and Albert are the most destructive, dangerous hackers the feds have ever caught, they'll let them off easy because I'm a juicier target."

A few minutes later, Jonathan picked up a handgun and sat on the floor in the corner of his bathroom. He signed the letter: "Remember, it's not whether you win or lose, it's whether I win or lose, and sitting in jail for 20, 10, or even 5 years for a crime I didn't commit is not me winning. I die free."

Jonathan nestled the gun against his head, just over his right ear, aimed upward and to the left, and pulled the trigger.


Albert Gonzalez stood before a judge in a Boston courthouse on March 25. Maria and Alberto Sr. cried audibly in the front row. He wore olive-green prison garb and spoke in an even tone. "I stand before you humbled by these past 22 months," he said. "I'm guilty not only of exploiting computer networks, but of exploiting personal relationships."

It was the last day in a 22-month legal process — one of three criminal cases Albert faced in Massachusetts, New Jersey, and New York for the thefts he orchestrated in "operation get rich or die tryin." He faced 15 to 25 years in federal prison, and he pleaded with the judge for mercy.

He'd betrayed the Secret Service and cost U.S. companies and credit card users big money. TJX alone lost 46.5 million credit card numbers and spent more than $132 million paying back customers, fixing security flaws, and defending itself in lawsuits. Banks, retailers, and payroll companies racked up "hundreds of millions" in expenses, prosecutors said.

"He knowingly victimized a group of people whose population exceeded that of many major cities and some states," prosecutors wrote in a sentencing memo. 

But Albert pleaded with the judge that he didn't do it out of avarice.

"I didn't throw it away because of egotism or greed," he said. "I threw it away because of my inability to stop my pursuit of curiosity and my addiction."

The month before, a psychologist named Barry Roth had testified that Albert might suffer from Asperger's disorder, which is similar to autism. He noted the hacker was "possessed by a twisted genius."

Palomino, in part, blames the Secret Service for not monitoring Albert more closely. "Sending him home with a laptop would be like a DEA agent sending a cokehead informant home with a kilo for the weekend and expecting him to come back with the whole thing on Monday," he says. "The guy had an addiction."

But the prosecution's psychologist, Mark J. Mills, argued that Internet addiction isn't recognized by mainstream medicine and that Albert clearly knew what he was doing when he stole.

The truth, perhaps, lies somewhere in the middle. Going back to his earliest days as a hacker, it's clear that Albert never really stopped breaking the law online — he just got better at pretending that he had reformed himself. And if his hacking was rooted in intellectual curiosity, by the end it was also driven by naked greed.

This past March 25, U.S. District Judge Patti B. Saris sentenced Albert to 20 years in prison, much of it to be served in isolation because of his role as an informant. He was also ordered to repay $69,143,862.80. Another restitution hearing is set for June. It was the stiffest sentence ever handed down to a cybercriminal.

Chris Scott received a seven-year federal sentence. Stephen Watt got two years and was required to pay $171.5 million in restitution. Damon Toey earned five years in prison. Yastremskiy was hit with a 30-year prison sentence by Turkish courts.

KEEP MIAMI NEW TIMES FREE... Since we started Miami New Times, it has been defined as the free, independent voice of Miami, and we'd like to keep it that way. With local media under siege, it's more important than ever for us to rally support behind funding our local journalism. You can help by participating in our "I Support" program, allowing us to keep offering readers access to our incisive coverage of local news, food and culture with no paywalls.
Tim Elfrink is a former investigative reporter and managing editor for Miami New Times. He has won the George Polk Award and was a finalist for the Goldsmith Prize for Investigative Reporting.
Contact: Tim Elfrink