8 ms·

Malware researcher Marcus Hutchins, known as ’MalwareTech’, pleads guilty

103 points by whyleyc 7y ago

ccnafr 7y ago
Duplicate: https://news.ycombinator.com/item?id=19702872 https://news.ycombinator.com/item?id=19702872
lachlan-sneff 7y ago
This is too bad, Malwaretech does really good work; his blog is excellent. We've all done stupid things when we were young, myself included.
- 420codebro 7y ago
  Yeah I fucked around with random internet-accessible systems (late 90s, early 2000s). However, I never wrote malware to steal credentials or the like. That strikes me as fairly targeted.
jlgaddis 7y ago
A few friends and myself chipped in some money for his legal defense, taking hin at his word when he said he was innocent. Lesson learned, I suppose.
- mchannon 7y ago
  I wouldn't hold it against him that he pled guilty. The government has unlimited resources, and he didn't. Innocent people plead guilty every day.
  - mises 7y ago
    This is absolutely a problem. America has a system which incites prosecutors to "win" in court rather than actually trying to serve justice, because that is how they advance. Plea bargains are a perverse way to keep this up. Plea bargain here: https://www.documentcloud.org/documents/5972658-Marcus-Hutchins-plea-agreement.html https://www.documentcloud.org/documents/5972658-Marcus-Hutch... From the deal: "The government agrees to make no recommendation regarding the ultimate sentence to be imposed; however, the government remains free to take a position with respect to any fact or factor pertinent to the sentencing decision consistent with this agreement and to advise the court that the government's failure to make a sentencing recommendation should not be construed as a recommendation for leniency or severity." The guy got screwed.
    - tptacek 7y ago
      What is it that you think that quote means? That's boilerplate language. The plea agreement is in fact very detailed and precise about the sentencing range Hutchins faces (it's relatively low).
      - mchannon 7y ago
        Prosecutors sometimes offer 11(c)(1)(C) plea agreements, where the sentence is defined exactly and the judge can only agree or refuse. This was definitely not that. It is the very opposite of precise. The PSR will be generated, and the judge will decide on the sentence, ranging from deportation without incarceration to 5 years. If your doctor told you you had 0-5 years left to live, inclusive, you wouldn’t call that detailed and precise, would you?
        stordoff 7y ago
        Realistically, can they avoid criticism here? They offer a sentence -> they're only offering a high sentence/they are forcing him to accept a longer sentence. They don't offer him a sentence -> they should have offered him a sentence.
        mises 7y ago
        No, I would actually have been more okay with a sentence. It might have been a little more straightforward.
        tptacek 7y ago
        That's not how this works. The prosecution and the defendant can agree to about what they'll ask for, but it's ultimately up to the judge to sentence. Prosecutors can't "offer him a sentence".
        mchannon 7y ago
        Yes they can. It’s called an 11(c)(1)(C) plea agreement. Most don’t or won’t.
  - Waterluvian 7y ago
    The government absolutely does not have anything near unlimited resources. I've been listening to the Ken White podcast All the President's Lawyers and something he repeatedly says is just how shockingly few criminals, especially white collar criminals, actually get prosecuted because there's simply no budget to go after them.
    - mchannon 7y ago
      With respect to Ken White, that’s a load of crap. Between AUSA’s, FBI, CJA’s, FD’s, and judge’s office, at least $0.3M in my case and counting.
      - Waterluvian 7y ago
        That's kind of the point. When they go after someone they're going to spend the money. No point spreading resources so thinly that they can't prosecute anyone properly.
        mchannon 7y ago
        That’s the opposite of your first point. When they have no trouble spending the money, they have no trouble spending the money.
        jstarfish 7y ago
        Yes and no. White collar crimes are very expensive to investigate, prosecute, and keep the attention of the jury. High-profile clients and attorneys invite a lot of red tape, expensive to cut through, so they don't bother unless conviction is certain. Failure is embarrassing and makes the State look weak. But Ken White is living in a bubble if he thinks the State won't spend the money to go after any low-hanging fruit it can reach.
        tptacek 7y ago
        He said exactly that: it's shocking how few criminals get prosecuted. Like, at all.
  - fortenforge 7y ago
    He's also posted a statement on his website admitting to the crime. https://www.malwaretech.com/public-statement https://www.malwaretech.com/public-statement
    - vichu 7y ago
      It's likely part of his plea bargain is that he needs to publicly admit to the crimes.
- deleted 7y ago
  [deleted]
- lfam 7y ago
  I don't know anything about this case but innocent people plead guilty all the time in the USA. It's a much safer choice than going to trial where the sentence may be much much longer.
- caprese 7y ago
  wait, your opinion actually changed? you should take what is said in US/any courts with a grain of salt don't trust testimonies, don't trust statements, or at LEAST recognize their infallibility just understand the decision tree and how they change the options available during the legal process in this case, we have: - duress - a short remorseful statement that is hoping to get his sentence reduced or even nullified - no room for appeals court due to the plea agreement the saying goes "remorse is for the courts", and unfortunately this will be used against me if I am ever indicted for something
- meowface 7y ago
  I directly knew, from being in some IRC channels he and I frequented ages ago, that he was absolutely guilty of the charge. But I also knew (as far as I could tell) that he genuinely turned over a new leaf a while ago, left that life behind, and is trying to do good now. This is a pretty common story for whitehats; many of their hats weren't quite so white in their pasts, whether people around them are aware or not. People make mistakes, and people can change. Don't feel too bad for contributing to his defense. He fucked up and is trying to make up for the damage he caused by sincerely helping people.
  - zeraphim 7y ago
    The plea agreement he signed says he was still selling malware until late 2015 at least, and was arrested in 2017. If he had turned over a new leaf, it wasnt for very long. I think he probably had stopped, but only because of the attention he received from the strings wannacry.exe thing.
    - phaus 7y ago
      So you're saying he continued to commit crimes up until May 2017? That's when WannaCry happened. His fame came on pretty quickly after that and it didn't take long for him to get arrested. Edit: The source code leaked at some point so its hard to tell when he stopped selling it based on available malware samples. New variants were detected at least as late as 2018. He was accused of selling it in 2014 and 2015 though, so there's a decent chance that he stopped a couple of years before his arrest.
    - deleted 7y ago
      [deleted]
  - MRD85 7y ago
    My general rule for judging adults is to not judge them based on dumb decisions they made while young. Young adults do dumb things and will continue to do so. If you're still doing dumb things 30+ then that's probably you.
AndrewKemendo 7y ago
I wouldn't automatically take this at face value. Hutchins took a plea deal. It's well known that there is rampant abuse of the plea deal in the US justice system [1]. That's not to say he's totally innocent of everything but that him pleading guilty to this single count may not be as straight forward as the article would make it seem. [1] https://www.theatlantic.com/magazine/archive/2017/09/innocence-is-irrelevant/534171/ https://www.theatlantic.com/magazine/archive/2017/09/innocen...
- loeg 7y ago
  We don't know his actual sentence yet, do we? The article says "up to 10 years" but the actual duration will be suggested by the prosecution based on the plea, no?
  - tptacek 7y ago
    His defense and the prosecutors have stipulated to two counts, each of which has a maximum sentence of 5 years. The norm is for like crimes to be sentenced concurrently, so "up to 10 years" does not seem accurate. The plea agreement itself stipulates to the sentencing level. Assuming all charges group, the maximum proposed sentencing level is 13, with the caveat that the agreement allows prosecutors to argue for an adjustment of as many as 8 sentencing levels. With no previous criminal history, a level 13 offense is 12-18 months. Late edit I missed that he also loses 3 levels for accepting responsibility. At level 10, his guideline range would be 6-12 months. For more detail on how this works, Google [popehat whale sushi].
    - loeg 7y ago
      Right; the probable sentence is much lower, but how much lower is to a large extent up to prosecutorial discretion (8 levels), no? Levels 2-8 (taking 2-8 levels off 10), with no priors, would be guideline 0-6 months, if I'm reading this table correctly. (I also read Popehat.)
- BLKNSLVR 7y ago
  I'm not sure if there are many people that will immediately and totally disagree with the above, but here's some sad historic context: https://www.boston.com/uncategorized/noprimarytagmatch/2013/01/14/mit-hacking-case-lawyer-says-aaron-swartz-was-offered-plea-deal-of-six-months-behind-bars https://www.boston.com/uncategorized/noprimarytagmatch/2013/...
mmaunder 7y ago
Plea bargained. That's how its done in the USA folks. At least in over 90% of cases. The concept of having a fair trial and your day in court is a thing of the past. Amazing it took so long.
- wrinkl3 7y ago
  I've been following Marcus on Twitter for the last couple of years, and he's been sounding increasingly desperate lately. Regardless of whether he actually authored Kronos, I could easily see him taking the plea bargain as a way out. I strongly feel that a malware researcher who stopped WannaCry and spends his free time making reverse engineering tutorials shouldn't go to prison because of a trojan he wrote as a teenager (assuming he really did write it).
  - tptacek 7y ago
    He's charged with a money-making scheme he ran into his early 20s.
  - meowface 7y ago
    He not only wrote the malware but personally sold it for $7000 per copy to botnet operators and other kinds of cybercriminals to facilitate bank account theft and fraud. He's changed now and is trying to be a force for good, but he definitely made mistakes in his past.
- lloydde 7y ago
  Not having grown up in the US, I listened in fascination to the first episodes of Serial season 3, “... Cleveland. Not for one extraordinary case; instead, Serial wanted to tackle the whole criminal justice system. To do that we figured we’d need to look at something different: ordinary cases.” After a few episodes I had to take a break. It is so upsetting. Justice is not a reality. https://serialpodcast.org/season-three/about https://serialpodcast.org/season-three/about ““Charge stacking” is a process by which police and prosecutors create a case with numerous charges or numerous instances of the same charge to convince the defendant that the risk of not pleading guilty is intolerable. The defendant may be convinced to plead guilty to a few of the charges in return for not being prosecuted for the remaining charges.“ https://en.m.wikipedia.org/wiki/Courtroom_Workgroup https://en.m.wikipedia.org/wiki/Courtroom_Workgroup
chx 7y ago
This doesn't make the fundamental problem here go away: they arrested someone who was not in the United States when allegedly violated a law of the USA. The USA does not have jurisdiction over the entire world. If they thought they had a case, the right way to do this is to issue an arrest warrant and ask the UK to arrest and extradite him. If this was a thing, international travel would halt because you would need to countercheck everything you've ever done online with the laws of the country you are flying to. Consider this fictionary tale: you fly to Budapest for a fun trip. You are jailed for posting the Soviet hammer and sickle on your Facebook two years ago -- it's a crime under Hungarian law to use that symbol. Do you think this is right? Here's the law: Any person who: a) distributes, b) uses before the public at large, or c) publicly exhibits, the swastika, the insignia of the SS, the arrow cross, the sickle and hammer, the five-pointed red star or any symbol depicting the above so as to breach public peace - especially in a way to offend the dignity of victims of totalitarian regimes and their right to sanctity - is guilty of a misdemeanor punishable by custodial arrest, insofar as the did not result in a more serious criminal offense.
- marnett 7y ago
  american global hegemony is a thing. fair or not, it exists. if you want out of the purview of the US you have to go to one of its enemy superstates, Russia or China. Even small neutral/hostile nations are not safe forever (eg Assange in Ecuador).
  - ninth_ant 7y ago
    It’s not really about hegemony at all. The US does extradite people but this isn’t about that. He was arrested in the US for his impact to people and companies inside the US.
  - foobarbazetc 7y ago
    Not really. He travelled to the US. Assange was using Ecuador’s protection and resources for free. At that point you’re at the whim of the Ecuadorian people and their elections. Nothing is forever.
- jlarocco 7y ago
dsr12 7y ago
Statement from Markus: https://www.malwaretech.com/public-statement https://www.malwaretech.com/public-statement
usahatecrime 7y ago
FTP://
rubyfan 7y ago
What law did he break? Was he actually breaking into computers which is against the law? Or is there some other law that makes the tech illegal?
s3arch 7y ago
>He also agreed to plead guilty to a second count of conspiracy. Can someone elaborate what that conspiracy is?
jaclaz 7y ago
There is something I don't understand. From the contents of the "attachment A" it seems like the FBI (or whatever other US agency) "sat" on the code they indirectly purchased for 2-3 years (the UPAS) and for several months (the KRONOS), observing the behaviour of Hutchins and "Vinny" and collecting evidence against them. Shouldn't they have somehow acted to prevent the spreading of the malwares?

103 points by whyleyc 7y ago

Duplicate: https://news.ycombinator.com/item?id=19702872 https://news.ycombinator.com/item?id=19702872

This is too bad, Malwaretech does really good work; his blog is excellent. We've all done stupid things when we were young, myself included.

420codebro 7y ago
Yeah I fucked around with random internet-accessible systems (late 90s, early 2000s). However, I never wrote malware to steal credentials or the like. That strikes me as fairly targeted.

jlgaddis 7y ago

A few friends and myself chipped in some money for his legal defense, taking hin at his word when he said he was innocent. Lesson learned, I suppose.

mchannon 7y ago
I wouldn't hold it against him that he pled guilty. The government has unlimited resources, and he didn't. Innocent people plead guilty every day.
- mises 7y ago
  This is absolutely a problem. America has a system which incites prosecutors to "win" in court rather than actually trying to serve justice, because that is how they advance. Plea bargains are a perverse way to keep this up. Plea bargain here: https://www.documentcloud.org/documents/5972658-Marcus-Hutchins-plea-agreement.html https://www.documentcloud.org/documents/5972658-Marcus-Hutch... From the deal: "The government agrees to make no recommendation regarding the ultimate sentence to be imposed; however, the government remains free to take a position with respect to any fact or factor pertinent to the sentencing decision consistent with this agreement and to advise the court that the government's failure to make a sentencing recommendation should not be construed as a recommendation for leniency or severity." The guy got screwed.
  - tptacek 7y ago
    What is it that you think that quote means? That's boilerplate language. The plea agreement is in fact very detailed and precise about the sentencing range Hutchins faces (it's relatively low).
    - mchannon 7y ago
      Prosecutors sometimes offer 11(c)(1)(C) plea agreements, where the sentence is defined exactly and the judge can only agree or refuse. This was definitely not that. It is the very opposite of precise. The PSR will be generated, and the judge will decide on the sentence, ranging from deportation without incarceration to 5 years. If your doctor told you you had 0-5 years left to live, inclusive, you wouldn’t call that detailed and precise, would you?
      - stordoff 7y ago
        Realistically, can they avoid criticism here? They offer a sentence -> they're only offering a high sentence/they are forcing him to accept a longer sentence. They don't offer him a sentence -> they should have offered him a sentence.
        mises 7y ago
        No, I would actually have been more okay with a sentence. It might have been a little more straightforward.
        tptacek 7y ago
        That's not how this works. The prosecution and the defendant can agree to about what they'll ask for, but it's ultimately up to the judge to sentence. Prosecutors can't "offer him a sentence".
        mchannon 7y ago
        Yes they can. It’s called an 11(c)(1)(C) plea agreement. Most don’t or won’t.
- Waterluvian 7y ago
  The government absolutely does not have anything near unlimited resources. I've been listening to the Ken White podcast All the President's Lawyers and something he repeatedly says is just how shockingly few criminals, especially white collar criminals, actually get prosecuted because there's simply no budget to go after them.
  - mchannon 7y ago
    With respect to Ken White, that’s a load of crap. Between AUSA’s, FBI, CJA’s, FD’s, and judge’s office, at least $0.3M in my case and counting.
    - Waterluvian 7y ago
      That's kind of the point. When they go after someone they're going to spend the money. No point spreading resources so thinly that they can't prosecute anyone properly.
      - mchannon 7y ago
        That’s the opposite of your first point. When they have no trouble spending the money, they have no trouble spending the money.
        jstarfish 7y ago
        Yes and no. White collar crimes are very expensive to investigate, prosecute, and keep the attention of the jury. High-profile clients and attorneys invite a lot of red tape, expensive to cut through, so they don't bother unless conviction is certain. Failure is embarrassing and makes the State look weak. But Ken White is living in a bubble if he thinks the State won't spend the money to go after any low-hanging fruit it can reach.
        tptacek 7y ago
        He said exactly that: it's shocking how few criminals get prosecuted. Like, at all.
- fortenforge 7y ago
  He's also posted a statement on his website admitting to the crime. https://www.malwaretech.com/public-statement https://www.malwaretech.com/public-statement
  - vichu 7y ago
    It's likely part of his plea bargain is that he needs to publicly admit to the crimes.
deleted 7y ago
[deleted]
lfam 7y ago
I don't know anything about this case but innocent people plead guilty all the time in the USA. It's a much safer choice than going to trial where the sentence may be much much longer.
caprese 7y ago
wait, your opinion actually changed? you should take what is said in US/any courts with a grain of salt don't trust testimonies, don't trust statements, or at LEAST recognize their infallibility just understand the decision tree and how they change the options available during the legal process in this case, we have: - duress - a short remorseful statement that is hoping to get his sentence reduced or even nullified - no room for appeals court due to the plea agreement the saying goes "remorse is for the courts", and unfortunately this will be used against me if I am ever indicted for something
meowface 7y ago
I directly knew, from being in some IRC channels he and I frequented ages ago, that he was absolutely guilty of the charge. But I also knew (as far as I could tell) that he genuinely turned over a new leaf a while ago, left that life behind, and is trying to do good now. This is a pretty common story for whitehats; many of their hats weren't quite so white in their pasts, whether people around them are aware or not. People make mistakes, and people can change. Don't feel too bad for contributing to his defense. He fucked up and is trying to make up for the damage he caused by sincerely helping people.
- zeraphim 7y ago
  The plea agreement he signed says he was still selling malware until late 2015 at least, and was arrested in 2017. If he had turned over a new leaf, it wasnt for very long. I think he probably had stopped, but only because of the attention he received from the strings wannacry.exe thing.
  - phaus 7y ago
    So you're saying he continued to commit crimes up until May 2017? That's when WannaCry happened. His fame came on pretty quickly after that and it didn't take long for him to get arrested. Edit: The source code leaked at some point so its hard to tell when he stopped selling it based on available malware samples. New variants were detected at least as late as 2018. He was accused of selling it in 2014 and 2015 though, so there's a decent chance that he stopped a couple of years before his arrest.
  - deleted 7y ago
    [deleted]
- MRD85 7y ago
  My general rule for judging adults is to not judge them based on dumb decisions they made while young. Young adults do dumb things and will continue to do so. If you're still doing dumb things 30+ then that's probably you.

AndrewKemendo 7y ago

I wouldn't automatically take this at face value. Hutchins took a plea deal. It's well known that there is rampant abuse of the plea deal in the US justice system [1]. That's not to say he's totally innocent of everything but that him pleading guilty to this single count may not be as straight forward as the article would make it seem. [1] https://www.theatlantic.com/magazine/archive/2017/09/innocence-is-irrelevant/534171/ https://www.theatlantic.com/magazine/archive/2017/09/innocen...

loeg 7y ago
We don't know his actual sentence yet, do we? The article says "up to 10 years" but the actual duration will be suggested by the prosecution based on the plea, no?
- tptacek 7y ago
  His defense and the prosecutors have stipulated to two counts, each of which has a maximum sentence of 5 years. The norm is for like crimes to be sentenced concurrently, so "up to 10 years" does not seem accurate. The plea agreement itself stipulates to the sentencing level. Assuming all charges group, the maximum proposed sentencing level is 13, with the caveat that the agreement allows prosecutors to argue for an adjustment of as many as 8 sentencing levels. With no previous criminal history, a level 13 offense is 12-18 months. Late edit I missed that he also loses 3 levels for accepting responsibility. At level 10, his guideline range would be 6-12 months. For more detail on how this works, Google [popehat whale sushi].
  - loeg 7y ago
    Right; the probable sentence is much lower, but how much lower is to a large extent up to prosecutorial discretion (8 levels), no? Levels 2-8 (taking 2-8 levels off 10), with no priors, would be guideline 0-6 months, if I'm reading this table correctly. (I also read Popehat.)
BLKNSLVR 7y ago
I'm not sure if there are many people that will immediately and totally disagree with the above, but here's some sad historic context: https://www.boston.com/uncategorized/noprimarytagmatch/2013/01/14/mit-hacking-case-lawyer-says-aaron-swartz-was-offered-plea-deal-of-six-months-behind-bars https://www.boston.com/uncategorized/noprimarytagmatch/2013/...

mmaunder 7y ago

Plea bargained. That's how its done in the USA folks. At least in over 90% of cases. The concept of having a fair trial and your day in court is a thing of the past. Amazing it took so long.

wrinkl3 7y ago
I've been following Marcus on Twitter for the last couple of years, and he's been sounding increasingly desperate lately. Regardless of whether he actually authored Kronos, I could easily see him taking the plea bargain as a way out. I strongly feel that a malware researcher who stopped WannaCry and spends his free time making reverse engineering tutorials shouldn't go to prison because of a trojan he wrote as a teenager (assuming he really did write it).
- tptacek 7y ago
  He's charged with a money-making scheme he ran into his early 20s.
- meowface 7y ago
  He not only wrote the malware but personally sold it for $7000 per copy to botnet operators and other kinds of cybercriminals to facilitate bank account theft and fraud. He's changed now and is trying to be a force for good, but he definitely made mistakes in his past.
lloydde 7y ago
Not having grown up in the US, I listened in fascination to the first episodes of Serial season 3, “... Cleveland. Not for one extraordinary case; instead, Serial wanted to tackle the whole criminal justice system. To do that we figured we’d need to look at something different: ordinary cases.” After a few episodes I had to take a break. It is so upsetting. Justice is not a reality. https://serialpodcast.org/season-three/about https://serialpodcast.org/season-three/about ““Charge stacking” is a process by which police and prosecutors create a case with numerous charges or numerous instances of the same charge to convince the defendant that the risk of not pleading guilty is intolerable. The defendant may be convinced to plead guilty to a few of the charges in return for not being prosecuted for the remaining charges.“ https://en.m.wikipedia.org/wiki/Courtroom_Workgroup https://en.m.wikipedia.org/wiki/Courtroom_Workgroup

chx 7y ago

This doesn't make the fundamental problem here go away: they arrested someone who was not in the United States when allegedly violated a law of the USA. The USA does not have jurisdiction over the entire world. If they thought they had a case, the right way to do this is to issue an arrest warrant and ask the UK to arrest and extradite him. If this was a thing, international travel would halt because you would need to countercheck everything you've ever done online with the laws of the country you are flying to. Consider this fictionary tale: you fly to Budapest for a fun trip. You are jailed for posting the Soviet hammer and sickle on your Facebook two years ago -- it's a crime under Hungarian law to use that symbol. Do you think this is right? Here's the law: Any person who: a) distributes, b) uses before the public at large, or c) publicly exhibits, the swastika, the insignia of the SS, the arrow cross, the sickle and hammer, the five-pointed red star or any symbol depicting the above so as to breach public peace - especially in a way to offend the dignity of victims of totalitarian regimes and their right to sanctity - is guilty of a misdemeanor punishable by custodial arrest, insofar as the did not result in a more serious criminal offense.

marnett 7y ago
american global hegemony is a thing. fair or not, it exists. if you want out of the purview of the US you have to go to one of its enemy superstates, Russia or China. Even small neutral/hostile nations are not safe forever (eg Assange in Ecuador).
- ninth_ant 7y ago
  It’s not really about hegemony at all. The US does extradite people but this isn’t about that. He was arrested in the US for his impact to people and companies inside the US.
- foobarbazetc 7y ago
  Not really. He travelled to the US. Assange was using Ecuador’s protection and resources for free. At that point you’re at the whim of the Ecuadorian people and their elections. Nothing is forever.
jlarocco 7y ago

dsr12 7y ago

Statement from Markus: https://www.malwaretech.com/public-statement https://www.malwaretech.com/public-statement

usahatecrime 7y ago

FTP://

rubyfan 7y ago

What law did he break? Was he actually breaking into computers which is against the law? Or is there some other law that makes the tech illegal?

s3arch 7y ago

>He also agreed to plead guilty to a second count of conspiracy. Can someone elaborate what that conspiracy is?

jaclaz 7y ago

There is something I don't understand. From the contents of the "attachment A" it seems like the FBI (or whatever other US agency) "sat" on the code they indirectly purchased for 2-3 years (the UPAS) and for several months (the KRONOS), observing the behaviour of Hutchins and "Vinny" and collecting evidence against them. Shouldn't they have somehow acted to prevent the spreading of the malwares?