Hector Xavier Monsegur, who by the US government’s calculations participated in computer hacker attacks on more than 250 public and private entities at a cost of up to $50m in damages, was released from a Manhattan courtroom on Tuesday after the judge saluted his “extraordinary cooperation” with the FBI.
Monsegur, or “Sabu” as the celebrated hacker was known, was sentenced to time served – equivalent to the seven months he spent in prison last year – plus a year’s supervised release, in reward for having spent much of the past three years working as a federal informant. He had been facing a maximum sentence according to official guidelines of more than 26 years.
His lenient sentence seals his reputation as one of the hacker world’s most hated figures, a skilled technician who turned from having been a leading figure of the Anonymous and LulzSec collectives into what was in effect an undercover FBI agent. Dressed in grey trousers and a loose black shirt, Monsegur told the court: “I’m not the same person I was three years ago. I’ve come a long way. I’ve had to do a lot of thinking and soul-searching.”
As she announced her decision, Loretta Preska, the chief judge of the federal district court for the southern district of New York, repeatedly praised what she called his “truly extraordinary cooperation”. She said he had provided “sophisticated and complex assistance to the government allowing them to pierce the secrecy surrounding LulzSec and successfully prosecute its members”.
Preska added that his work as an informant was all the more exceptional because it was carried out at considerable personal risk, federal officials having revealed that Monsegur was working for them early on in the operation. “There is no question that Mr Monsegur and his family were subject to threats and assaults,” she said.
But condemnation from those who Monsegur had betrayed was swift and strong. A spokesperson for Anonymous told the Guardian that “Monsegur is, first and foremost, a criminal; the FBI’s cyber crime task force are his co-conspirators. While operating under their supervision, Monsegur committed numerous felonies which should in no way be excused due to his protected informant status.”
Anonymous added: “The FBI continues to use captured informants, who commit egregious crimes in pursuit of reduced sentences, for the sole purpose of creating ‘examples’ to frighten the public. They do this with the hope of pacifying online dissent and snuffing out journalistic investigations into the US government’s misconduct.”
In a sentencing memorandum released by Preet Bharara, the US attorney for the southern district of New York, on Friday the government revealed that Monsegur had directly helped to identify and convict eight of his peers in the Anonymous and LulzSec hacker collectives. Most notably, he was seminal in nailing Jeremy Hammond, who at the time was the FBI’s number one most wanted cybercriminal in the world, for his role in hacking into the private intelligence firm Stratfor.
Hammond was sentenced to 10 years in prison last November for his role in the computer breach. What was not discussed during Monsegur’s sentencing on Tuesday was that when he was convicted, Hammond claimed that Monsegur himself had directed much of his criminal activity, including attempts to break into the websites of foreign governments.
Hammond said that Monsegur, operating as “Sabu”, had supplied him with lists of foreign countries vulnerable to attack including Brazil, Iran and Turkey. Hammand went so far as to suggest that the FBI had been using him to launch cyber-attacks around the world, with Monsegur acting as the coordinator.
Hammond told Preska – the same judge who let Monsegur walk free on Tuesday – as she sentenced him to 10 years: “The government celebrates my conviction and imprisonment, hoping that it will close the door on the full story. I took responsibility for my actions, by pleading guilty, but when will the government be made to answer for its crimes?”
In addition to Hammond, Monsegur was also key to the convictions of other LulzSec members, including in the UK Jake Davis, who went by the internet handle “Topiary”, who was sentenced to two years in a young offender institution; Ryan Ackroyd, aka “Kayla”, sentenced to 30 months’ imprisonment; Ryan Cleary, sentenced to 32 months in prison; and Mustafa Al-Bassam, aka “T-Flow”, sentenced to 20 months suspended for two years. LulzSec members in Ireland, Darren Martyn and Donncha O’Cearrbhail, were also caught in the Sabu net.
One defendant, Matthew Keys, a former Reuters journalist, is awaiting trial in the US on charges that he permitted unauthorized access to the computer systems of an old employer, the Tribune Company.
The sentencing hearing and memorandum have opened a window into the extent that the FBI will go in turning prominent hackers into informants. Monsegur’s defence attorney, Peggy Cross-Goldenberg, told the court that a camera had been installed in his apartment in a public housing project in Manhattan so that his computer activities could be monitored 24 hours a day. “For nine months, he gave everything he had,” she said.
The memorandum discloses that in order to catch Hammond, Monsegur had been put at the hub of a vast web of surveillance. During the Hammond investigation, it says, Monsegur in New York “engaged in online chats with Hammond (who was then in Chicago), while coordinating with FBI agents in New York, physical surveillance teams deployed in Chicago, and an electronic surveillance unit in Washington DC.”
Monsegur began hacking computers in 2003, and by 2006, the government says, he was engaged in criminal hacking for his own personal gain. His first act of political “hacktivism” appears to have been with Anonymous when he took part in distributed denial of service DDoS attacks on PayPal, Mastercard and Visa in protest at the companies’ refusal to handle donations to the free information group WikiLeaks.
In May 2011 he became a founder member of LulzSec, a splinter of Anonymous, that operated as a tight team of highly skilled hackers in the US, UK and Ireland. Together they went on an audacious spree of attacks, ranging from the internet security firm HB Gary, the website of X-Factor on Fox Television, Nintendo’s computer system and the website of the US senate. An FBI affiliate in Atlanta, Infragard/Unveillance, was also breached.
On 7 June 2011, FBI agents knocked on Monsegur’s door in Manhattan. His transformation from a hacker legend into an informant was instantaneous – he agreed to cooperate with the government immediately. The speed of his conversion was significant, and praised by Preska during her sentencing on Tuesday, as it prevented a security mechanism kicking in among LulzSec members who had agreed to destroy all their files should any of them go offline for any length of time.
As Monsegur begins his year’s supervised release, including close monitoring of his computer use, questions are likely to remain over the nature of his lenient sentence, and particularly his alleged role in spearheading attacks on foreign governments while acting on behalf of the FBI.
Professor Ahmed Ghappour of UC Hastings college of the law, an expert in computer law, said it was one thing to help the FBI in a sting operation on perpetrators of a crime already in motion, another “when you contribute to the creation, inducement and execution of a crime that never was. Particularly when those crimes may very well affect our foreign policy.”