Hackers' mind-set: They've done nothing wrong

SAN FRANCISCO -- Albert Gonzalez appeared to be a reformed hacker. But the onetime government informant was a central character in what Justice Department officials claim was an international cybercrime syndicate that ripped off tens of millions of credit and debit card numbers from large U.S. retailers.

Irving Jose Escobar seemed nothing more than a tough Miami kid with a long rap sheet. Yet last year, he pleaded guilty to his role in a multimillion-dollar scam in Florida tied to Gonzalez's exploit.

What they shared, based on indictments in their separate cases, are key roles in the massive cyberheist at TJX, parent of retailers T.J. Maxx and Marshalls, and the credit card scams that resulted. First disclosed by TJX in January 2007, it is believed to be the largest such theft.

It is unclear whether Gonzalez and Escobar know each other. But each was involved in different scams tied to TJX, according to their respective indictments. The divergent sagas of the hacker Gonzalez and streetwise Escobar represent bookends of the vast digital crime. According to psychiatrists, hackers and computer-security experts, they represent the vanguard of cybercrooks: young, misguided males who rationalize that they've done nothing wrong.

Like Escobar and Gonzalez, many are adamant they are innocent. "These are rattlesnakes without the rattles," says Greg Saathoff, a psychiatry professor at the University of Virginia who is one of the world's foremost profilers of criminals. "The movie portrayal is they are evil geniuses who are absolutely controlling and calculated, but they can be impulsive and grandiose."

A 27-year-old Cuban American, Gonzalez had been arrested in 2003 on credit card fraud charges in New Jersey and agreed to cooperate with authorities to avoid jail time. According to the Secret Service, Gonzalez helped agents infiltrate Shadowcrew, an online ring of credit card thieves.

But that didn't stop him from later heading a ring that stole more than 40 million credit and debit card numbers from TJX and eight other major U.S. retailers, according to a federal indictment. He faces life in prison if convicted on charges of computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, a Justice spokeswoman says. Gonzalez pleaded not guilty at a Sept. 11 arraignment in a Boston federal court.

Through his digital crime spree, according to the indictment, Gonzalez amassed more than $1.65 million — including about $22,500 in cash — a condo in Miami, a BMW 330i and a stash of high-tech equipment, including laptops and a cellphone.

Some of the stolen TJX data were magnetically encoded on bogus credit cards and eventually made their way to Escobar, convicted last year on charges of credit card fraud. Escobar led a group of six street-level "mules" in Florida that included his wife and mother, according to a criminal complaint by the Florida Department of Law Enforcement. They took the plastic to Wal-Mart stores in Florida to buy gift cards that could be used like cash. They then used the gift cards to purchase more than $1 million worth of PCs, big-screen TVs, jewelry and other expensive items, state officials said.

Escobar, 20, has steadfastly professed his innocence. In a letter to USA TODAY in July, he said he was eager to offer a rare, first-person account into his experience. He is serving five years in a Florida prison. "There are to (sic) many errors going in my case, things that the secret service agents didn't bring out to the light," Escobar wrote. "The only person that knows all the truth is me, and I'm willing to let it out to the light so society could realize how corrupt it (sic) this world we're living in."

But shortly before a scheduled prison interview at the Brevard Correctional Institution in Cocoa, Fla., Escobar abruptly declined.

Profile of cybercriminals

Many cybercrooks are young men in the U.S. and Eastern Europe who think they're doing the system a favor by exposing flaws and have no qualms about opportunities to exploit rich Westerners, according to police, researchers and hackers.

Their motivation is "money, money, money," says Dan Kaminsky, director of penetration testing for security firm IOActive, who in July discovered a huge vulnerability in the Internet's design that lets cybercrooks silently redirect traffic to websites under their control.

Most hackers do not see themselves as criminals, says David Perry,who as global director of education at computer-security giant Trend Microhas interviewed cybercrooks for more than a decade. "They simply believe they are showing vulnerabilities in the system."

The TJX cell's loose confederation of individuals — each contributed a unique felonious skill from different parts of the world — is a blueprint for organized crime in the digital age, says Mark Rasch, a former Justice Department cybercrime prosecutor.

Federal prosecutors portray the 6-foot, 190-pound Gonzalez as the chief organizer in the TJX case, a charge his attorney, Rene Palomino, disputes.

Gonzalez is a self-taught computer consultant who first met several of the other defendants online, says Palomino, who says the charges against his client have stunned Gonzalez's parents in Miami.

"This is a hardworking, churchgoing family," he says. "There is a lot of so-called evidence from people trying to wash off their bad acts. When the truth surfaces, it will surprise a lot of people, including the government."

The Justice Department alleges that in 2003, Gonzalez began hacking the computer networks of TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21, DSW and Dave & Buster's.

Millions of stolen credit and debit card numbers were allegedly stored on computer servers in the United States, Latvia and Ukraine. The stolen data were sold, via the Internet, to other criminals in the U.S. and Eastern Europe, the indictment says.

Escobar's criminal endeavor was a family affair.

His wife, Zenia Llorente, 25, got probation for fraud for her part in the scam. His mother, Nair Zuleima Alvarez, 42, was given a jail sentence for fraud and later deported to her native Venezuela last year, says John Wethington, assistant prosecutor for Florida Attorney General Bill McCollum.

The 5-foot-10, 211-pound Escobar, who was sentenced to five years in prison and faces deportation to Venezuela upon his scheduled release in 2012,has maintained he is a victim of a corrupt system.

Florida court records show Escobar had several scrapes with the law in Miami-Dade County before he was busted for his role in TJX. From 2003 to 2007, Escobar was charged at least eight times, the charges ranging from "home-invasion robbery" to illegal use of a credit card. Those charges were dropped or abandoned. He was arrested and charged with cocaine possession and placed in a drug-diversion program in 2007.

"To this day, he thinks he is the only victim," says Amy Osteryoung, the former Florida assistant prosecutor in charge of Escobar's case.

"The thousands and thousands of people who had their personal information stolen were just collateral damage to him."