Marcus Hutchins spared US jail sentence over malware charges

https://www.bbc.co.uk/news/technology-49127569

by timthorn • 7 years ago

140 63 7 years ago

bbc.co.uk

andremat• 7 years ago

In spite of the district court's merciful sentence, he has committed an aggravated felony in the eyes of immigration law and so is barred from ever entering the US again. For life.

mieseratte2• 7 years ago

he has committed an aggravated felony in the eyes of immigration law and so is barred from ever entering the US again. For life.

IANAL but it sounds like he may be able to appeal based on a recent SCOTUS ruling[0].

The result is that people convicted of certain crimes -- such as the California crime of burglary -- that are not by definition necessarily violent, may not be deportable.

[0] https://www.shouselaw.com/immigration/aggravated-felonies

skissane3• 7 years ago

IANAL but it sounds like he may be able to appeal based on a recent SCOTUS ruling[0].

For entry into the US on visa-waiver (ESTA) or visas (without a green card), you generally can't appeal to the courts, and court rulings about deportation aren't really relevant.

It is up to the discretion of CBP (and also the State Department for visa issuance). They can decide to disregard a criminal conviction - they are more likely to do that if it is relatively minor, if there are some unusual/special circumstances, if it is from many years ago, if a person shows evidence of being of good character since then. But it is totally up to their discretion.

If they rule against you, there is no formal right of appeal. You can talk to your own country's government, ask them to make diplomatic representations. If your own government decides to do so (they are under no obligation to do so), there is some chance they might change the US government's mind, but no guarantee.

jessaustin• 7 years ago

He's already here, and sentenced to a year of supervised release. ISTM he can file whatever papers he needs to while he's physically present?

scandox• 7 years ago

Most people in the world will never be able to visit the United States but they seem somehow to survive.

travmatt• 7 years ago

Is that really unusual for countries to ban travel to foreigners with criminal records? I was under the impression most countries had similar laws.

wp381640• 7 years ago

I've looked into this an the USA is uniquely strict in their standards amongst western nations. Most countries give people a second chance in cases except for very serious crimes.

qwsxyh• 7 years ago

I didn't realise the US court gave out rewards.

failrate• 7 years ago

Finally!

komali2• 7 years ago

I'm having a hard time finding out why they actually arrested him - for a long time it seemed that they were kangaroo-accusing him of somehow being responsible for wannacry because he registered the domain it pointed to. This article is saying it's because of malware he created in 2014?

Andoryuuta• 7 years ago

AFAIK, they arrested him because of the creation and sale/distribution of the Kronos and "UPAS Kit" malware [1].

[1] https://www.justice.gov/usao-edwi/pr/marcus-hutchins-pleads-...

hannob• 7 years ago

for a long time it seemed that they were kangaroo-accusing him of somehow being responsible for wannacry because he registered the domain it pointed to.

That certainly wasn't a long time. As far as I remember it was very shortly after his arrest (maybe a day or so) when it became public that it was for the Kronos malware and unrelated to the wannacry incident.

Derek_MK2• 7 years ago

It was definitely for the banking trojan he created and sold, that would later become Kronos. That said, he also became sort of a public figure in the field due to stopping the initial strain of Wannacry, so news articles were popping up talking about how he was at least tangentially related to Wannacry, and was recently arrested for malware charges. People saw that and started drawing the false conclusion that he created Wannacry.

atsushin3• 7 years ago

Hutchin's contributions to information security have definitely benefited many. While it was "good" that he faced responsibility for his actions (well, not really -- a forced extended stay in the U.S. away from his family and dealing with X months of court bullshit is horrendous and should not happen), I'm glad he was spared from a decade in the U.S. prison system.

loteck• 7 years ago

extended stay in the U.S. away from his family and dealing with X months of court bullshit is horrendous and should not happen

Curious, how do you think we should deal with crimes of this type, if not (at minimum) restraining suspects from leaving the country and having a judge preside over the legal proceedings?

viraptor2• 7 years ago

Have a framework of handing over cases like that and the person back to their country of residence. Unless the case can be handled in less than a week.

Otherwise it's basically: Have you got access to lots of money, or are you going to spend years in prison? He was really lucky that he knew people who could offer him place to stay, contact lawyers, help with bail. Majority of people would be completely screwed in that situation.

atsushin3• 7 years ago

That's a great question that I don't have a solid answer to. But one change that I think could be beneficial is at least an expedited judicial process for foreigners like Hutchins, visitors that only intended to stay in the United States for a short period of time before being arrested on suspicion of a crime.

Hutchins was fortunate that he had some money and a sort of safety net in the form of donations, a network of people who knew him, etc. For most people without that type of support, I would imagine being prevented from leaving the States for an extended amount of time would be nothing less than devastating.

pjc50• 7 years ago

In other circumstances countries are very keen to deport people who are suspected of being foreign criminals as soon as possible.

kccqzy• 7 years ago

Clearly he didn't think this is horrendous himself. He was out on bail, living in an apartment in LA, a place with better weather and a better infosec community than his native Britain. He clearly enjoyed his time here.

Source: his own twitter.

atsushin3• 7 years ago

He made the most out of his situation, and was lucky that he was even afforded the chance to. But there clearly was a lot going on behind the scenes.

Additionally, he was quite open about his depressive episodes and legal frustrations on Twitter.

Derek_MK2• 7 years ago

TLDR/Background:

* Hutchins (MalwareTech on social media) used to be a black hat, and developed/sold a banking trojan that would become Kronos.

* Since then, he's given up black hat activity and began reverse-engineering malware and providing educational material along the same lines.

* He came into the spotlight when he realized that the Wannacry ransomware was attempting to contact a particular web domain that was unregistered. He registered it to see what they were trying to send and why, and found out that it was a global killswitch, fully shutting down the initial strain of the malware.

* After Def Con 2017, he was arrested at the airport when attempting to leave the US. He was being charged with devleoping Kronos, and prosecutors were effectively adding new charges in retaliation every time he refused to plead guilty.

* He eventually caved and plead guilty, and today was sentenced to a year of supervised release, with no jail time (Though he likely won't be able to enter the US again). The judge strongly indicated that the lenient sentence was due to the fact that he stopped breaking the law of his own volition, and started using his skills to better the world.

* This article doesn't mention it, but the judge also suggested that he and his legal counsel seek a pardon, which could potentially allow him to enter the US again. They are planning to go forward with that path.

lawnchair_larry2• 7 years ago

That wasn’t quite how it went.

He initially told everyone that he was peripherally involved in writing some code as a teenager that, unbenknownst to him, ended up in some malware.

The feds unraveled his lies and showed beyond a doubt that not only did he work on that into his 20s, but he and his partner were actively involved in the business of selling a purpose-built banking trojan. They had logs of a “business dispute” between him and his parter from only 2 years prior to his arrest.

He had bad opsec, and many folks online exposed a lot of this. The feds had chat logs showing he was directly involved. It’s all in the court documents. He had no choice but to plea guilty.

https://www.courtlistener.com/recap/gov.uscourts.wied.77855/...

sq_2• 7 years ago

In my mind, it does count for something that he seems to have turned everything around from being a black hat towards doing proper security research and generally trying to work towards the common good.

lone_haxx0r• 7 years ago

What's the thought process for writing/selling malware to be illegal? What if the buyers wanted to test their own systems? What if they simply bought it to study it? Hutchins didn't necessarily know that it was going to be used illegaly. Should nmap, aircrack-ng et al be illegal too?

rayiner• 7 years ago

It is, in general, not illegal to write/sell something that can be used to commit a crime. What’s illegal is creating or selling tools to knowingly knowingly facilitate crimes. (Selling guns isn’t illegal, and indeed is constitutionally protected. Selling a gun to known mobsters under circumstances where one can reasonably conclude you knew they were going to use it to commit crimes, that’s illegal.)

In this case, Hutchins created Malware capable of stealing banking information and worked with a friend to market it to people who would use it to steal banking information: https://arstechnica.com/tech-policy/2019/07/wannacry-slayer-....

pvg• 7 years ago

Maybe the cases of the secret car compartment makers are a good example as well - the 'tool' there is thoroughly harmless in itself.

tedunangst• 7 years ago

We might consider where tools like nmap are advertised. The language used.

ratsmack• 7 years ago

It seems that sensible judgements in cases like are few and far between. Hopefully we will see a trend in this direction instead of the hysteria usually surrounding hacking where the perpetrator is viewed in the same category as a mass murderer.

stebann• 7 years ago

He helped with the building of a banking trojan, that's not mass murder, but it is a big crime...

ggg3• 7 years ago

to sum it up, the US jails teenagers who deface websites (and foreigner journalists because why not). But if you created hacking tools specifically to steal money and provided support for those tools, you are in the clear?

Marcus Hutchins spared US jail sentence over malware charges

Related Stories