JUSTICE IS SERVED

The National Law Journal
March 26, 2010


Computer hacking mastermind Albert Gonzalez was sentenced in Boston federal court on Thursday to 20 years in prison for two cases that charged him with stealing 40 million debit and credit card numbers from national retailers and a restaurant chain.

The 28-year-old Gonzalez, a former Secret Service informant from Miami, received two concurrent 20-year sentences, one for each of the two cases, plus three years of supervised release without any access to computers and a total $25,000 fine.

Judge Patti Saris of the District of Massachusetts set a hearing on restitution for June 25 to give the government time to find individuals, not just corporations, who lost money, and sort out the various companies' losses.

In one case, which originated in the District of Massachusetts and involved hacking of retail company networks, Gonzalez was charged with damage to computer systems, wire fraud, access device fraud, aggravated identity theft and conspiracy. The sophisticated scheme targeted national retailers, including Barnes & Noble Inc., BJ's Wholesale Club Inc., Boston Market Corp., DSW Inc., OfficeMax Inc., The Sports Authority Inc. and discount retailer The TJX Cos. Inc., which owns T.J.Maxx and other stores. Gonzalez pleaded guilty on Sept. 11, 2009, to 20 counts of conspiracy, computer fraud, wire fraud, access device fraud and aggravated identity theft.

Early in the hearing on Thursday, Saris noted that Gonzalez could have received a life sentence for the crimes he was charged with, but the government and Gonzalez agreed to a 15- to 25-year sentencing range through a binding plea agreement.

"It's important to punish what you did and to send a message," Saris told Gonzalez.

Saris said she was reluctant to opt for the absolute low end of the agreed-upon range because "there's a huge number of corporate victims." Another factor, she told Gonzalez is that he "two-timed the government agency you were cooperating with and essentially a government agent."

On the other hand, Saris said, the case didn't involve "devastating identity theft" of individuals and he "did seem remorseful."

"You did give up $1 million buried in your parents' backyard, which you didn't have to do, Saris said.

In a statement just before Saris sentenced him, Gonzalez told the judge that he was "humbled" by his 22 months in prison to date. "I'm guilty of not only exploiting computer networks but exploiting personal relationships," Gonzalez said. "I had a government agency that believed in me. I threw it away, not because of egoism or greed, but because of my inability to stop my curiosity and my addiction. I have no one to blame but myself."

Gonzalez was also sentenced for conspiracy to commit mail fraud for an Eastern District of New York case that was transferred to the Massachusetts federal court last September. In that case, Gonzalez and two co-conspirators gained unauthorized access to computer servers with customers' credit and debit card data at 11 Dave & Buster's Inc. restaurants.

During the hearing, Gonzalez's attorney Martin Weinberg, a Boston solo practitioner, argued for the 15-year sentence. Weinberg said Gonzalez deserved less time in prison because he disgorged his profits, a 15-year sentence would deter other young people inclined to computer hacking and his crimes were less harmful to individuals than many other white-collar crimes.

Even with the 15-year sentence and time already served, Gonzalez wouldn't get out of prison until just before his 40th birthday, Weinberg said.

"It's an enormous devastating sentence to Gonzalez and a very clear, compelling message to anyone looking at this case," Weinberg said.

When arguing for a 25-year sentence, Stephen Heymann, the chief of the computer crimes unit for the U.S. Attorney's Office for the District of Massachusetts, said Gonzalez's victims and the "unprecedented amount of devastation" he caused are deeply consequential.

"What matters is that he shook a portion of our financial system," Heymann said. "What matters is that teenagers and young adults not look up to Albert Gonzalez and not think 'Gonzalez got away with millions and millions of dollars -- I could too.' Harm is no less real than when it is committed anonymously over the Internet rather than in person. Teenagers need to know they will be caught and punishment will be severe."

On Friday, Gonzalez is slated to face sentencing by Judge Douglas Woodlock in a third case, which was transferred to Massachusetts from the District of New Jersey. That case involved hacking attacks on 7-Eleven Inc., the Hannaford Bros. Co. supermarket chain, credit and debit card processor Heartland Payment Systems Inc. and two unnamed retailers.

In that case, Gonzalez pleaded guilty on Dec. 29, 2009, to two counts of conspiracy to gain unauthorized access to the payment card networks.

Saris also said that, although she didn't consider the crimes in the case before Woodlock when deciding on a sentence, her intent was for her sentence to run concurrently with any prison sentence imposed by Woodlock.