Attacks/Breaches
10/3/2013
10:45 AM
50%
50%

Stratfor Hacker: FBI Entrapment Shaped My Case

Hacker Jeremy Hammond asks for leniency before sentencing, citing the role of FBI informant Sabu in his case. How far can the FBI go with suspected computer criminals?

Is the FBI allowed to entrap suspected computer criminals? That question is at the heart of a request for leniency by Jeremy Hammond, who's due to be sentenced on November 15 for hacking private intelligence contractor Stratfor, among other business and government sites.

Hammond, appearing in a Manhattan federal courtroom in May, pleaded guilty to one related count of computer fraud and abuse, as part of a plea agreement. "For each of these hacks, I knew what I was doing was wrong," Hammond told judge Loretta Preska, the Chicago Sun-Times reported. He now faces up to 10 years in jail, and the prospect of paying up to $2.5 million in restitution to Stratfor.

But in advance of his upcoming sentencing by Judge Preska, Hammond's supporters are asking for leniency, noting that Hammond hacked for ethical reasons, rather than to make a profit. They've also accused the FBI of entrapment, referring to tricking someone into committing a crime for the purpose of then arresting them. Hammond, notably, has accused former LulzSec leader turned FBI informant "Sabu" -- real name: Hector Xavier Monsegur -- of inciting participants of the Anonymous Operations (AnonOps) IRC channel, including himself, to hack into a number of systems, including Brazilian government servers for which Sabu reportedly distributed stolen access credentials.

[ Take heed of the security warnings that seem to pop up every day. Read WordPress Attacks: Time To Wake Up. ]

"Sabu was used to build cases against a number of hackers, including myself. What many do not know is that Sabu was also used by his handlers to facilitate the hacking of targets of the government's choosing -- including numerous websites belonging to foreign governments," Hammond said in an August statement.

What proof can Hammond offer? Attorney Margaret Ratner Kunstler, who's a member of Hammond's defense team, told me via email that "all but publicly filed documents are covered by [a] protective order," meaning related evidence has been sealed, at the request of prosecutors. Accordingly, "proof is only in the form of failure of government to deny" Hammond's allegations, she said.

An FBI spokeswoman, reached by phone, declined to comment on Hammond's allegations.

This wouldn't be the first time that the bureau's computer crime investigators have been accused of employing these types of tactics. "The FBI intended to entrap me via Sabu for as long as possible to incriminate my activities at the highest level," said former LulzSec participant Jake Davis last month, in an ongoing Q&A session on the Ask.fm website. Davis, who used the handle "topiary," handled the LulzSec's PR, but didn't take part in any of its actual hacking activities. He was arrested by British police in July 2011.

"One week I told Sabu that I had no intention of involving myself in any more crime -- organized by him -- and that I wanted to switch to helping the activist movement solely through art and writing," said Davis, who's now served related jail time in the United Kingdom and been released. "That same week my home was raided. It's nothing new, we were just another set of pawns in the FBI's strategy."

If that was the FBI's strategy, however, what may surprise is that the bureau wouldn't have broken any laws or investigation guidelines. "Unfortunately, there are numerous cases holding that this type of scenario -- very common in child pornography cases where agents pose as either children or brokers of child pornography -- does not constitute impermissible entrapment," sentencing expert Jeff Ifrah, an attorney who's previously chaired American Bar Association criminal justice and white collar crime committees, told me via email.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
10/8/2013 | 12:54:40 PM
re: Stratfor Hacker: FBI Entrapment Shaped My Case
While I agree with you ... yeesh, I really wish the government didn't align itself with people like Sabu.
GAProgrammer
50%
50%
GAProgrammer,
User Rank: Guru
10/7/2013 | 5:34:12 PM
re: Stratfor Hacker: FBI Entrapment Shaped My Case
Based on his supporter's arguments, if you rob a bank to give money to the less fortunate, you should not be charged. Ludicrous.
Laurianne
50%
50%
Laurianne,
User Rank: Apprentice
10/4/2013 | 6:15:41 PM
re: Stratfor Hacker: FBI Entrapment Shaped My Case
Like John McAfee's recent exploits, Sabu's story still sounds like an unbelievable novel.
majenkins
50%
50%
majenkins,
User Rank: Apprentice
10/4/2013 | 5:47:56 PM
re: Stratfor Hacker: FBI Entrapment Shaped My Case
Whether there was entrapment or not this time, these were not his first hacking crimes. Of course even if it was entrapment the fact that evidence doesn't exist to prosecute him for the other crimes of course doesn't make it right to falsely convict him in this case but it does seem to achieve a little justice.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-1449
Published: 2014-12-25
The Maxthon Cloud Browser application before 4.1.6.2000 for Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses the history API.

CVE-2014-2217
Published: 2014-12-25
Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 allows remote attackers to write to arbitrary files, and consequently execute arbitrary code, via a full pathname in the UploadID metadata value.

CVE-2014-3971
Published: 2014-12-25
The CmdAuthenticate::_authenticateX509 function in db/commands/authentication_commands.cpp in mongod in MongoDB 2.6.x before 2.6.2 allows remote attackers to cause a denial of service (daemon crash) by attempting authentication with an invalid X.509 client certificate.

CVE-2014-7193
Published: 2014-12-25
The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web site ...

CVE-2014-7300
Published: 2014-12-25
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.