Former security researcher Max Butler has been sentenced to 13 years in federal prison for hacking financial firms and stealing nearly two million credit card numbers from banks, businesses and other hackers. The judgement is the longest sentence for a hacker in US history.
Max Butler, who used the hacker pseudonym Iceman, was sentenced Friday morning in US District Court in Pittsburgh on charges of wire fraud and identity theft. In addition to his 13-year sentence, Butler will face five years of supervised release and must pay US$27.5 million in restitution to his victims, according to Assistant U.S. Attorney Luke Dembosky, who prosecuted the case for the federal government.
Dembosky believes the 13 year sentence is the longest-ever handed down for hacking charges.
Butler, also known as Max Ray Vision, pleaded guilty to wire fraud charges in June last year.
He gained notoriety for hacking into carder forum websites, where stolen credit card numbers are bought and sold, and forcing members to conduct their business through his own site - CardersMarket.com. Criminals used the stolen credit card numbers to create fake debit and credit cards that were then used to steal money or merchandise.
This isn't Butler's first time facing a federal hacking sentence.
After a promising start as a security consultant who did volunteer work for the US Federal Bureau of Investigation, Butler was arrested for writing malicious software that installed a back-door program on computers - including some on federal government networks - that were susceptible to a security hole.
Butler served an 18-month prison term for the crime and fell on hard times after his 2002 release, he said in a sentencing memorandum filed Thursday. "I was homeless, staying on a friends couch. I couldn't get work," he wrote. In desperation, he turned again to cybercrime. By the time of his arrest in September 2007, he had built the largest marketplace for stolen credit and debit card information in the world.
"It is a shame that someone with so much ability chose to use it in a manner that hurt many people," Dembosky said in an e-mail message. "This sentence sends a message that cyber crime is taken very seriously."
Butler's public defender, Michael Novara, could not immediately be reached for comment.
The court is recommending that Butler be incarcerated at the minimum-security Federal Prison Camp in Sheridan, Oregon.