Albert Gonzalez appeared to be a reformed hacker. But the onetime government informant was a central character in what Justice Department officials claim was an international cybercrime syndicate that ripped off tens of millions of credit and debit card numbers from large U.S. retailers.
Irving Jose Escobar seemed nothing more than a tough Miami kid with a long rap sheet. Yet last year, he pleaded guilty to his role in a multimillion-dollar scam in Florida tied to Gonzalez's exploit.
What they shared, based on indictments in their separate cases, are key roles in the massive cyberheist at TJX, parent of retailers T.J. Maxx and Marshalls, and the credit card scams that resulted. First disclosed by TJX in January 2007, it is believed to be the largest such theft.
It is unclear whether Gonzalez and Escobar know each other. But each was involved in different scams tied to TJX, according to their respective indictments. The divergent sagas of the hacker Gonzalez and streetwise Escobar represent bookends of the vast digital crime. According to psychiatrists, hackers and computer-security experts, they represent the vanguard of cybercrooks: young, misguided males who rationalize that they've done nothing wrong.
Like Escobar and Gonzalez, many are adamant they are innocent. "These are rattlesnakes without the rattles," says Greg Saathoff, a psychiatry professor at the University of Virginia who is one of the world's foremost profilers of criminals. "The movie portrayal is they are evil geniuses who are absolutely controlling and calculated, but they can be impulsive and grandiose."
A 27-year-old Cuban American, Gonzalez had been arrested in 2003 on credit card fraud charges in New Jersey and agreed to cooperate with authorities to avoid jail time. According to the Secret Service, Gonzalez helped agents infiltrate Shadowcrew, an online ring of credit card thieves.
But that didn't stop him from later heading a ring that stole more than 40 million credit and debit card numbers from TJX and eight other major U.S. retailers, according to a federal indictment. He faces life in prison if convicted on charges of computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, a Justice spokeswoman says. Gonzalez pleaded not guilty at a Sept. 11 arraignment in a Boston federal court.
Through his digital crime spree, according to the indictment, Gonzalez amassed more than $1.65 million — including about $22,500 in cash — a condo in Miami, a BMW 330i and a stash of high-tech equipment, including laptops and a cellphone.
Some of the stolen TJX data were magnetically encoded on bogus credit cards and eventually made their way to Escobar, convicted last year on charges of credit card fraud. Escobar led a group of six street-level "mules" in Florida that included his wife and mother, according to a criminal complaint by the Florida Department of Law Enforcement. They took the plastic to Wal-Mart stores in Florida to buy gift cards that could be used like cash. They then used the gift cards to purchase more than $1 million worth of PCs, big-screen TVs, jewelry and other expensive items, state officials said.