4 ms·

What kind of jail time these people looking at?

jacquesm 4y ago
Not enough...
tptacek 4y ago
The sentence will scale with the money they made added to the amount of damage attributed to the victims; they're in essentially the same boat as SBF with respect to sentencing, albeit with lower numbers. If they made + caused more than six figures, they'll be looking at multiple years; over a million, something in the vicinity of 5-6 years. (I'm not a lawyer, I've just got the sentencing guidelines hotkeyed).
- joshmn 4y ago
  They are not in the same boat in terms of sentencing whatsoever. SBF's guidelines are going to be maxed because of the loss amount. His criminal history score will be 0, yes, but I imagine a few of these young men will have a criminal history score of 0 as well. The scale for financial loss is really weird. $150k will get you 10 points. $1.5MM will get you 16 points. $550MM will get you 30 points. https://guidelines.ussc.gov/gl/%C2%A72B1.1 https://guidelines.ussc.gov/gl/%C2%A72B1.1
  - tptacek 4y ago
    We are saying the same thing. I agree, of course, that SBF's sentence will be much higher than these dipshits. But the mechanism by which they're calculated is basically the same --- SBF will have some level accelerators that the DDoS'ers don't have, and the DDoS'ers will have some 18 USC 1030 accelerators (circumvention devices, domain names, maybe PII) that SBF doesn't. If you do the actual exercise of picking out a realistic loss number and doing the calculation, you'll find that the 2B1.1 loss table dominates the sentence.
    - joshmn 4y ago
      Circumvention is just 1 point, is it not? Domain names I don't think count? But you could use that as total number of victims (usually they just wing it — the calculation, the feds); PII I didn't see mentioned. I think SBF is in deep shit and I think the world is better for it. These guys? I don't know, probably not as deep as it looks; certainly not the 10 years that another poster was saying, though.
      - tptacek 4y ago
        It's 2 points (pretty much everything is 2 or 4 points). But it doesn't matter, really: the accelerators are nothing compared to the loss table. Again, I think we're saying the same thing! I deliberately tripped as many of the 18 USC 1030 enhancements as I could just to demonstrate to myself that it didn't much matter. SBF will serve something close to life if convicted because the losses he incurred blow out the guidelines table. The DDoS'ers will serve something scaled to the amount of losses they actually caused. I think $1MM is a reasonable ballpark, which gets you into the high single digit years.
  - tbrownaw 4y ago
    > The scale for financial loss is really weird. That table looks like an attempt at a log scale, that's been distorted by wanting round numbers.
paulpauper 4y ago
A long time potentially. 10-20 years likely. Computer crime tends to be punished very severely, also includes wire fraud.
- joshmn 4y ago
  Based on what? I can pull up a dozen computer crime acts (that aren't targeted towards children) and find much less. They're probably going to plea, and their plea will probably not be to wire fraud. They probably all have low criminal history scores. Here's a similar situation where the guy lost at trial: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/ https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-b... If these kids plea — and they probably will — they'll probably get 1-2 years + 3 years probation if that. Their lawyer will bring up the comparable at sentencing and the judge will consider it.
  - paulpauper 4y ago
    They probably all have low criminal history scores. This obviously did not help Ross Ulbricht.
    - joshmn 4y ago
      He lost at trial on all counts.
      - paulpauper 4y ago
        sentencing is not the same as the trial
mikeyouse 4y ago
Depends specifically what they're charged with and their role in the org, but last summer, after a short trial a similar operator was sentenced to 24 months. One of his coconspirators pled guilty and received 5 years probation; https://www.justice.gov/usao-cdca/pr/illinois-man-sentenced-2-years-federal-prison-operating-subscription-based-computer https://www.justice.gov/usao-cdca/pr/illinois-man-sentenced-... Actually Krebs wrote about his sentence at the time: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/ https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-b...
- xmichael999111 4y ago
  That sounds unreasonably short, they've made a fair bit of money and done a fair bit of damage.
- joshmn 4y ago
  Reminder that in the federal system, the judge can ultimately decide what happens. If you are charged by complaint and plea, that'll play better than being indicted and losing at trial. You generally don't get more favorable sentences when you lose at trial, though.

Not enough...

The sentence will scale with the money they made added to the amount of damage attributed to the victims; they're in essentially the same boat as SBF with respect to sentencing, albeit with lower numbers. If they made + caused more than six figures, they'll be looking at multiple years; over a million, something in the vicinity of 5-6 years. (I'm not a lawyer, I've just got the sentencing guidelines hotkeyed).

joshmn 4y ago
They are not in the same boat in terms of sentencing whatsoever. SBF's guidelines are going to be maxed because of the loss amount. His criminal history score will be 0, yes, but I imagine a few of these young men will have a criminal history score of 0 as well. The scale for financial loss is really weird. $150k will get you 10 points. $1.5MM will get you 16 points. $550MM will get you 30 points. https://guidelines.ussc.gov/gl/%C2%A72B1.1 https://guidelines.ussc.gov/gl/%C2%A72B1.1
- tptacek 4y ago
  We are saying the same thing. I agree, of course, that SBF's sentence will be much higher than these dipshits. But the mechanism by which they're calculated is basically the same --- SBF will have some level accelerators that the DDoS'ers don't have, and the DDoS'ers will have some 18 USC 1030 accelerators (circumvention devices, domain names, maybe PII) that SBF doesn't. If you do the actual exercise of picking out a realistic loss number and doing the calculation, you'll find that the 2B1.1 loss table dominates the sentence.
  - joshmn 4y ago
    Circumvention is just 1 point, is it not? Domain names I don't think count? But you could use that as total number of victims (usually they just wing it — the calculation, the feds); PII I didn't see mentioned. I think SBF is in deep shit and I think the world is better for it. These guys? I don't know, probably not as deep as it looks; certainly not the 10 years that another poster was saying, though.
    - tptacek 4y ago
      It's 2 points (pretty much everything is 2 or 4 points). But it doesn't matter, really: the accelerators are nothing compared to the loss table. Again, I think we're saying the same thing! I deliberately tripped as many of the 18 USC 1030 enhancements as I could just to demonstrate to myself that it didn't much matter. SBF will serve something close to life if convicted because the losses he incurred blow out the guidelines table. The DDoS'ers will serve something scaled to the amount of losses they actually caused. I think $1MM is a reasonable ballpark, which gets you into the high single digit years.
- tbrownaw 4y ago
  > The scale for financial loss is really weird. That table looks like an attempt at a log scale, that's been distorted by wanting round numbers.

paulpauper 4y ago

A long time potentially. 10-20 years likely. Computer crime tends to be punished very severely, also includes wire fraud.

joshmn 4y ago
Based on what? I can pull up a dozen computer crime acts (that aren't targeted towards children) and find much less. They're probably going to plea, and their plea will probably not be to wire fraud. They probably all have low criminal history scores. Here's a similar situation where the guy lost at trial: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/ https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-b... If these kids plea — and they probably will — they'll probably get 1-2 years + 3 years probation if that. Their lawyer will bring up the comparable at sentencing and the judge will consider it.
- paulpauper 4y ago
  They probably all have low criminal history scores. This obviously did not help Ross Ulbricht.
  - joshmn 4y ago
    He lost at trial on all counts.
    - paulpauper 4y ago
      sentencing is not the same as the trial

mikeyouse 4y ago

Depends specifically what they're charged with and their role in the org, but last summer, after a short trial a similar operator was sentenced to 24 months. One of his coconspirators pled guilty and received 5 years probation; https://www.justice.gov/usao-cdca/pr/illinois-man-sentenced-2-years-federal-prison-operating-subscription-based-computer https://www.justice.gov/usao-cdca/pr/illinois-man-sentenced-... Actually Krebs wrote about his sentence at the time: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/ https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-b...

xmichael999111 4y ago
That sounds unreasonably short, they've made a fair bit of money and done a fair bit of damage.
joshmn 4y ago
Reminder that in the federal system, the judge can ultimately decide what happens. If you are charged by complaint and plea, that'll play better than being indicted and losing at trial. You generally don't get more favorable sentences when you lose at trial, though.