Hackers' mind-set: They've done nothing wrong

SAN FRANCISCO -- Albert Gonzalez appeared to be a reformed hacker. But the onetime government informant was a central character in what Justice Department officials claim was an international cybercrime syndicate that ripped off tens of millions of credit and debit card numbers from large U.S. retailers.

Irving Jose Escobar seemed nothing more than a tough Miami kid with a long rap sheet. Yet last year, he pleaded guilty to his role in a multimillion-dollar scam in Florida tied to Gonzalez's exploit.

What they shared, based on indictments in their separate cases, are key roles in the massive cyberheist at TJX, parent of retailers T.J. Maxx and Marshalls, and the credit card scams that resulted. First disclosed by TJX in January 2007, it is believed to be the largest such theft.

It is unclear whether Gonzalez and Escobar know each other. But each was involved in different scams tied to TJX, according to their respective indictments. The divergent sagas of the hacker Gonzalez and streetwise Escobar represent bookends of the vast digital crime. According to psychiatrists, hackers and computer-security experts, they represent the vanguard of cybercrooks: young, misguided males who rationalize that they've done nothing wrong.

Like Escobar and Gonzalez, many are adamant they are innocent. "These are rattlesnakes without the rattles," says Greg Saathoff, a psychiatry professor at the University of Virginia who is one of the world's foremost profilers of criminals. "The movie portrayal is they are evil geniuses who are absolutely controlling and calculated, but they can be impulsive and grandiose."

A 27-year-old Cuban American, Gonzalez had been arrested in 2003 on credit card fraud charges in New Jersey and agreed to cooperate with authorities to avoid jail time. According to the Secret Service, Gonzalez helped agents infiltrate Shadowcrew, an online ring of credit card thieves.

But that didn't stop him from later heading a ring that stole more than 40 million credit and debit card numbers from TJX and eight other major U.S. retailers, according to a federal indictment. He faces life in prison if convicted on charges of computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, a Justice spokeswoman says. Gonzalez pleaded not guilty at a Sept. 11 arraignment in a Boston federal court.