AT&T iPad Security Breach Hacker Sentenced to 41 Months in Prison

[MacRumors]

Andrew Auernheimer, one of the hackers behind the release of email addresses of 114,000 iPad users back in 2010, has been sentenced to 41 months in prison following his conviction on one count of identity fraud and one count of 'conspiracy to access a computer without authorization'.

In November, Auernheimer was found guilty on one count of identity fraud and one count of conspiracy to access a computer without authorization. Following his release from prison, Auernheimer will be subject to three years of supervised release. Auernheimer and co-defendant Daniel Spitler were also ordered to pay $73,000 in restitution to AT&T. The pre-sentencing report prepared by prosecutors recommended four years in federal prison.

There is quite a bit of consternation among tech commentators about the appropriateness of a sentence of more than three years in prison for accessing AT&T servers without actually entering a password or directly compromising a system.

Instead, Auernheimer and his partner Daniel Spitler (who pled guilty and received a 12-18 month sentence) wrote a script to guess the identifying numbers of the iPad's SIM card and faked out AT&T's website until it returned the email address connected to said SIM cards. The email addresses of thousands of high-profile iPad users were leaked, including private addresses of Mayor Michael Bloomberg, then White House Chief of Staff Rahm Emanuel, and ABC News journalist Diane Sawyer.

It appears that Auernheimer's antagonistic attitude and lack of contrition contributed to the lengthy sentence, including running a Reddit Ask Me Anything thread the night before his sentencing where he said he wanted to get elected to Congress because Congressional Immunity would allow him to release hacks on the floor of Congress with no repercussions.

Article Link: AT&T iPad Security Breach Hacker Sentenced to 41 Months in Prison

[Brian Y]

Shows how far into the government's pockets these large corporations are. You would likely get less time for burglary or GBH. Heck, some rapists have gotten less time over here .

[Doc750]

Selling crack to junior high school kids gets you less time.

[SandboxGeneral]

Despite the consternation over the appropriateness of the sentence length, I bet the prosecution wanted to set a precedent in this case to others who may want to try similar things - discouraging them from trying.

[indychris]

Originally Posted by Brian Y

Shows how far into the government's pockets these large corporations are. You would likely get less time for burglary or GBH. Heck, some rapists have gotten less time over here .

Sounds like you have sympathy for a guy who could wreck peoples' lives via identity theft. I have no sympathy whatsoever for this twerp. While I would love nothing more than to see bureaucratic nannies like Bloomberg and Emanuel taken down a notch, the truth is people like Auernheimer are a huge threat to all of us, and it needs to be demonstrated that identity theft simply can not be tolerated and will be punished harshly.

Personally, I hope during his stay at the Gray Bar Hotel, they completely eliminate any and all access to computer technology so that he can't find ways to continue to invoke havoc on others.

[phillipduran]

So being an a hole gets you a longer sentence? Isn't that like revenge from the bench or something?

And querying servers can get you 3 1/2 years jail time. That's just silly.

[vsighi]

NICEEE !!
I don't care about any hacker as long they do time

[krye]

Hacking is hacking. Whether or not he entered a password or compromised another machine is irrelevant. May this serve as a lesson to all the other hackers that try to do stuff with other people's computers.

This is the cyber version of breaking and entering. You can't just walk into someone's house and have a look around. You can't use the argument that they left the front door open either. You just don't do it.

[Nightarchaon]

I want him in congress too, someone needs to keeps rocking the system and showing that there are security flaws, too many big flaws get left until someone like this shows them to exist, just imagine if this was your banks details he pulled, sure, its would be annoying to have the details leaked, but id damn well know that the bank would plug that hole for next time.

[melgross]

Not only do I like this sentence, but I would like it even more if it were longer. I don't understand the attitude here of some people who think this is no big deal. It IS a big deal.

[Mr. Retrofire]

Originally Posted by Doc750

Selling crack to junior high school kids gets you less time.

OK, thanks for the tip!

;-)

[Sayer]

So he spoofed info to gain access to info otherwise not available. And he acts like an entitled a-hole.

Yeah 41 months should be good for this guy.

[Sideonecincy]

Originally Posted by SandboxGeneral

Despite the consternation over the appropriateness of the sentence length, I bet the prosecution wanted to set a precedent in this case to others who may want to try similar things - discouraging them from trying.

Like they did with Aaron Swartz? That really worked out well...

The sentences for computer crimes are ridiculous and needs to be changed.

[topgunn]

Originally Posted by MacRumors

It appears that Auernheimer's antagonistic attitude and lack of contrition contributed to the lengthy sentence, including running a Reddit Ask Me Anything thread the night before his sentencing where he said he wanted to get elected to Congress because Congressional Immunity would allow him to release hacks on the floor of Congress with no repercussions.

Congress, huh? He'd fit right in.

[DipDog3]

Should have robbed a bank instead, would have gotten less time.

[melgross]

Originally Posted by Nightarchaon

I want him in congress too, someone needs to keeps rocking the system and showing that there are security flaws, too many big flaws get left until someone like this shows them to exist, just imagine if this was your banks details he pulled, sure, its would be annoying to have the details leaked, but id damn well know that the bank would plug that hole for next time.

Everyone knows there are major flaws. We have people who do this legally, and they do testify, and are hired by firms to check security.

Seriously, if security were as easy as some think, it wouldn't be a problem. But it isn't, and so it is a problem.

[FrizzleFryBen]

Originally Posted by vsighi

NICEEE !!
I don't care about any hacker as long they do time

What's your definition of a hacker? I consider him a good samaritan.

[Medic311]

hacking email addresses of iPad owners - 41 months of hard prison
destroying people's lives by lying about AAA ratings on junk mortgage securities and plunging this country into a recession we have yet to fully recover from...priceless.

heck, those 2 Ohio teens who raped that 16 yr old girl only got 1 year.

the punishment does not fit the crime. if anything, this guy did AT&T a favor. imagine if it was the Chinese government who hacked the system. they would have exposed A LOT more than just an email list. let's face it - the only reason why the sentence was longer was b/c he happened to expose the email addresses of the rich and powerful elite. if he only exposed regular joe-shmoe's like all of us here we wouldn't even hear about it in the news and minimal effort would be spent on the prosecution. it's like that state-wide manhunt for Christopher Dorner. if cops weren't injured or killed, not even a fraction of the effort would have been spent to look for him. but as soon as cops are involved, they use more resources than otherwise.

look - the guy was in the wrong. hacking and obtaining information that is not your's is stealing. however his theft did not result in anything except inconvenience for these high profile elitists. he did not obtain information that resulted in a security threat, nor did he obtain information that could be used to create a security threat. knowing the email address of Bloomberg doesn't give you the ability to hack him - heck his friends and coworkers have his email address.

this is absolutely ridiculous. no wonder he doesn't give a ***** about the system and said the things that he said. there is no way he will actually serve the full 41 month sentence either. this was just a publicity stunt for the prosecution to show the elitists and the news media that if you inconvenience them you will get the maximum sentence. once the spotlight moves onto the next big thing, this guy will get out very early

[KdParker]

Originally Posted by phillipduran

So being an a hole gets you a longer sentence? Isn't that like revenge from the bench or something?

And querying servers can get you 3 1/2 years jail time. That's just silly.

Wouldn't call it querying servers. He was still stealing from AT&T and should get jail time like any other crime.

[melgross]

Originally Posted by DipDog3

Should have robbed a bank instead, would have gotten less time.

Yeah, like ten to twenty.

[zeeklancer]

Originally Posted by indychris

Sounds like you have sympathy for a guy who could wreck peoples' lives via identity theft. I have no sympathy whatsoever for this twerp. While I would love nothing more than to see bureaucratic nannies like Bloomberg and Emanuel taken down a notch, the truth is people like Auernheimer are a huge threat to all of us, and it needs to be demonstrated that identity theft simply can not be tolerated and will be punished harshly.

Personally, I hope during his stay at the Gray Bar Hotel, they completely eliminate any and all access to computer technology so that he can't find ways to continue to invoke havoc on others.

You are right. Why should we tolerate people who could wreck peoples ives with identity theft. AT&T is the one who had poor practices and left the door open. In fact, the guy did not do anything other than "create a url". I mean, if you typed the wrong info into your address bar at the time you too would have accessed somebody else info.

AT&T should be the one on the line here. They are the ones with the responsibility to not allow others to access your information. And until we stop allowing companies to be reckless with our data more holes like these will found and accessed.

[Small White Car]

Originally Posted by phillipduran

So being an a hole gets you a longer sentence? Isn't that like revenge from the bench or something?

Judges have always had the ability to take a defendant's sorrow into account. The murderers who say "she deserved it and I'd do it again!" generally get treated harsher than folks who seem legitimately sorry.

Can't say I see anything wrong with that.

[DriveByPoster]

In other news, if you rape and photograph an unconscious teenager, you get 1-2 years.

[Medic311]

Originally Posted by DriveByPoster

In other news, if you rape and photograph an unconscious teenager, you get 1-2 years.

YEP.

more like 1 year dude. unreal....

[LuxoJunior]

Inmate 1: What are you in for?
Inmate 2: I killed a guy...
Inmate 1: Oh, hey you, what are you in for?
Inmate 3: I robbed a bank.
Inmate 1: Nice. Yo, what are you in for?
Inmate 4: I hacked iPad accounts.
Inmate 1: What's an iPad. Whatever. How much time you doin'?
Inmate 4: almost 4 years.

Inmates 1-3: WTF!?