A former security researcher turned criminal hacker has been sentenced to 13 years in federal prison for hacking into financial institutions and stealing credit card account numbers.
Max Ray Butler, who used the hacker pseudonym Iceman, was sentenced Friday morning in U.S. District Court in Pittsburgh on charges of wire fraud and identity theft. In addition to his 13-year sentence, Butler will face five years of supervised release and must pay US$27.5 million in restitution to his victims, according to Assistant U.S. Attorney Luke Dembosky, who prosecuted the case for the federal government.
Dembosky believes the 13 year sentence is the longest-ever handed down for hacking charges.
Butler, also known as Max Vision, pleaded guilty to wire fraud charges in June last year.
He gained notoriety for hacking into carder forum Web sites, where stolen credit card numbers are bought and sold, and forcing members to conduct their business through his own site — CardersMarket.com. Criminals used the stolen credit card numbers to create fake debit and credit cards that were then used to steal money or merchandise.
This isn't Butler's first time facing a federal hacking sentence.
After a promising start as a security consultant who did volunteer work for the U.S. Federal Bureau of Investigation, Butler was arrested for writing malicious software that installed a back-door program on computers — including some on federal government networks — that were susceptible to a security hole.
Butler served an 18-month prison term for the crime and fell on hard times after his 2002 release, he said in a sentencing memorandum filed Thursday. “I was homeless, staying on a friends couch. I couldn't get work,” he wrote. In desperation, he turned again to cybercrime. By the time of his arrest in September 2007, he had built the largest marketplace for stolen credit and debit card information in the world.
“It is a shame that someone with so much ability chose to use it in a manner that hurt many people,” Dembosky said in an e-mail message. “This sentence sends a message that cyber crime is taken very seriously.”
Butler's public defender, Michael Novara, could not immediately be reached for comment.
The court is recommending that Butler be incarcerated at the minimum-security Federal Prison Camp in Sheridan, Oregon.
