Would you like to inspect the original subtitles? These are the user uploaded subtitles that are being translated:
1
00:00:01,960 --> 00:00:04,440
This is the CNBC Original.
2
00:00:11,300 --> 00:00:16,799
In this episode of American Green, a
crime spree on the Internet using stolen
3
00:00:16,800 --> 00:00:22,499
information. It's basically a
supermarket of cybercrime. Where
4
00:00:22,500 --> 00:00:24,580
trade your financial life story.
5
00:00:24,581 --> 00:00:26,439
This is not a victimless crime.
6
00:00:26,440 --> 00:00:28,900
They may think it is, but I was the
victim.
7
00:00:29,320 --> 00:00:31,160
Billions of dollars are at stake.
8
00:00:31,840 --> 00:00:33,520
They followed the money all along.
9
00:00:33,740 --> 00:00:35,300
Fraud migrates to opportunity.
10
00:00:35,660 --> 00:00:39,400
And an unlikely computer genius fights
to control it all.
11
00:00:39,620 --> 00:00:41,880
This was spy versus spy.
12
00:00:42,120 --> 00:00:43,660
It was quite an ego boost.
13
00:00:58,890 --> 00:01:04,069
One evening in November 2009, Julie is
working late in her home office.
14
00:01:04,629 --> 00:01:08,970
Her concentration and focus are
shattered by a disturbing phone call.
15
00:01:09,370 --> 00:01:14,269
So I asked my husband to get the phone,
and it happened to be the manager of a
16
00:01:14,270 --> 00:01:15,710
big box store up in Wisconsin.
17
00:01:16,190 --> 00:01:20,749
And she said, I know this might seem
like a strange call, but there's a woman
18
00:01:20,750 --> 00:01:25,790
the store who says she's you, and she's
opening up a line of credit.
19
00:01:26,410 --> 00:01:30,769
The store is calling because the woman
seems to be buying as many high -priced
20
00:01:30,770 --> 00:01:32,130
items as she possibly can.
21
00:01:34,430 --> 00:01:38,110
Julie's mind is racing. Who is this
woman in the store?
22
00:01:38,630 --> 00:01:40,800
How did she get her personal
information?
23
00:01:41,250 --> 00:01:43,370
And how much damage has she done?
24
00:01:43,730 --> 00:01:49,549
So when she was about the $4 ,700 mark,
she said to them, how many more iPods
25
00:01:49,550 --> 00:01:53,010
can I get before I hit the line of
credit?
26
00:01:53,960 --> 00:01:59,099
Julie is the latest victim of identity
theft, joining the 10 million Americans
27
00:01:59,100 --> 00:02:03,240
whose lives have been turned upside down
by this crime every year.
28
00:02:03,540 --> 00:02:08,359
I was exposed in a way that I've never
been exposed before, and I've worked a
29
00:02:08,360 --> 00:02:13,359
long time to have good credit, and I've
worked a long time to have financial
30
00:02:13,360 --> 00:02:19,119
security for my family, and suddenly
it's out there, and I have no idea who
31
00:02:19,120 --> 00:02:21,530
it, and I have no idea how they're going
to use it.
32
00:02:22,360 --> 00:02:28,359
In 2009, identity thieves cost U .S.
businesses and individuals an estimated
33
00:02:28,360 --> 00:02:29,410
billion.
34
00:02:30,100 --> 00:02:34,619
Credit card numbers and identities like
Julie's are bought and sold by the
35
00:02:34,620 --> 00:02:38,560
thousands on websites called Carter's
Forums.
36
00:02:39,000 --> 00:02:44,399
It's an underground economy run by gangs
that are global, sophisticated, and
37
00:02:44,400 --> 00:02:45,450
highly organized.
38
00:02:46,180 --> 00:02:51,080
At the top of the pyramid are the
godfathers, people like Max Ray Butler.
39
00:02:51,600 --> 00:02:53,440
also known as Iceman.
40
00:02:54,240 --> 00:02:56,980
Butler is a brilliant computer hacker.
41
00:02:57,400 --> 00:03:02,600
His theft ring traffics an estimated 1
.8 million stolen credit cards.
42
00:03:03,000 --> 00:03:06,420
And he leads the feds on a year -long
game of cat and mouse.
43
00:03:07,060 --> 00:03:11,150
In an exclusive interview with American
Greed before entering federal prison,
44
00:03:11,420 --> 00:03:13,720
Butler explains his scheme.
45
00:03:14,120 --> 00:03:17,850
From law enforcement's perspective,
these carding forums are probably...
46
00:03:17,930 --> 00:03:24,129
Another paradigm of crime, like you have
individuals, street gangs, mafias, and
47
00:03:24,130 --> 00:03:28,749
now you've got this open source mafia
where people just go on the Internet and
48
00:03:28,750 --> 00:03:31,790
form little ad hoc collectives and plan
who knows what.
49
00:03:32,570 --> 00:03:35,760
Most people think of a hacker as a
person working by themselves.
50
00:03:36,370 --> 00:03:41,709
Keith Malarski is a special agent with
the FBI who spends years undercover as a
51
00:03:41,710 --> 00:03:45,510
hacker, working to bring down cyber
criminals like Max Butler.
52
00:03:46,250 --> 00:03:50,169
In my own experience, I would always
think back to the movie War Games. And
53
00:03:50,170 --> 00:03:54,109
think of Matthew Broderick sitting in
his room with a computer trying to hack
54
00:03:54,110 --> 00:03:59,270
into something with a modem. But really,
over the years, that's changed now,
55
00:03:59,370 --> 00:04:01,230
where this is really organized crime.
56
00:04:01,630 --> 00:04:05,910
Carter's forums traffic in millions of
stolen identities every year.
57
00:04:06,350 --> 00:04:09,230
It's a multi -billion dollar business
worldwide.
58
00:04:14,790 --> 00:04:20,289
Before he becomes a Don of the digital
underworld, Max Butler grows up near
59
00:04:20,290 --> 00:04:21,340
Boise, Idaho.
60
00:04:21,709 --> 00:04:23,510
I was a computer geek from a young age.
61
00:04:24,150 --> 00:04:28,849
My father worked with computers. He
worked at IBM, and then he worked at a
62
00:04:28,850 --> 00:04:31,229
computer store, and then he started his
own computer store. So I always had
63
00:04:31,230 --> 00:04:32,280
access to machines.
64
00:04:32,350 --> 00:04:37,189
And I started programming when I was
eight and was into video games, and I
65
00:04:37,190 --> 00:04:38,310
quite a geek, really.
66
00:04:39,050 --> 00:04:41,690
Butler begins hacking in his teens.
67
00:04:42,520 --> 00:04:46,190
My colleague, he's breaking into the
network of Boise State University.
68
00:04:46,880 --> 00:04:51,220
Butler says that at this stage, his
hacking is just for kicks.
69
00:04:51,221 --> 00:04:55,359
The administrators that were watching me
and watching my activities, because I
70
00:04:55,360 --> 00:04:58,550
was a very curious person, I would go
into the binary directory.
71
00:04:58,551 --> 00:05:01,459
Well, that caught their attention. Like,
what's this guy doing?
72
00:05:01,460 --> 00:05:04,699
As they started paying attention to me,
I started paying attention to them. We
73
00:05:04,700 --> 00:05:07,699
were kind of watching each other, and
that was like an early sparring match
74
00:05:07,700 --> 00:05:08,729
happened.
75
00:05:08,730 --> 00:05:12,870
But behind the geeky demeanor, there
lurks a history of violence.
76
00:05:13,330 --> 00:05:17,789
In his freshman year in college, Butler
is arrested for choking and threatening
77
00:05:17,790 --> 00:05:19,110
to kill his girlfriend.
78
00:05:19,570 --> 00:05:24,310
He is convicted of aggravated assault
and receives a stiff five -year
79
00:05:27,050 --> 00:05:33,309
In 1995, his prison stint over, the 22
-year -old Butler tries to build a new
80
00:05:33,310 --> 00:05:34,790
life in San Francisco.
81
00:05:35,910 --> 00:05:37,370
Friends told me that...
82
00:05:37,371 --> 00:05:41,079
You can just move computers around
physically and make $30 an hour, let
83
00:05:41,080 --> 00:05:44,939
you actually knew how to use one. And I
did, and I was good, and so I moved
84
00:05:44,940 --> 00:05:45,990
down.
85
00:05:46,020 --> 00:05:48,820
As a teenager, Butler hacked for fun.
86
00:05:49,880 --> 00:05:52,400
Now he can turn hacking into a lucrative
career.
87
00:05:53,220 --> 00:05:56,400
He goes to work as a computer security
consultant.
88
00:05:57,200 --> 00:05:59,190
He was what they call a white hat
hacker.
89
00:05:59,840 --> 00:06:02,220
In fact, he epitomized it.
90
00:06:02,660 --> 00:06:05,010
He made a lot of money doing penetration
tests.
91
00:06:05,011 --> 00:06:09,099
You would pay him to break into your
computer to test your security, but at
92
00:06:09,100 --> 00:06:12,350
same time, he donated his services for
free to nonprofit groups.
93
00:06:13,260 --> 00:06:17,000
Soon, Butler is commanding a fee of more
than $100 an hour.
94
00:06:17,780 --> 00:06:23,539
He goes by the name Max Vision and
enjoys an almost celebrity status among
95
00:06:23,540 --> 00:06:24,590
hacking elite.
96
00:06:24,591 --> 00:06:28,339
I had a really good reputation for
always finding the hold because I was
97
00:06:28,340 --> 00:06:33,879
good at what I did. Then I set up a
website, Max Vision, network security,
98
00:06:33,880 --> 00:06:34,960
whitehats .com.
99
00:06:35,470 --> 00:06:41,269
In fact, he's so good that the FBI
office in San Francisco asks for his
100
00:06:41,270 --> 00:06:45,110
hacking into systems and pointing out
weak spots in security.
101
00:06:45,690 --> 00:06:46,870
I got to do what I loved.
102
00:06:47,250 --> 00:06:52,489
I was already spending most of my waking
hours doing security research. Now I
103
00:06:52,490 --> 00:06:55,680
can actually apply it and give a nice
written report to someone.
104
00:06:56,550 --> 00:07:00,969
Made me feel good. It was a very useful
service. I really helped a lot of
105
00:07:00,970 --> 00:07:02,020
people.
106
00:07:02,130 --> 00:07:04,390
But life is a white hat hacker.
107
00:07:04,860 --> 00:07:06,540
isn't exciting enough for Butler.
108
00:07:06,740 --> 00:07:09,960
He starts to break into private networks
without permission.
109
00:07:10,860 --> 00:07:16,000
He thrived on the ego of it, of beating
these defense systems.
110
00:07:16,340 --> 00:07:20,779
A couple things were really wrong about
that. One, I thought I didn't get
111
00:07:20,780 --> 00:07:23,539
permission. I didn't have permission
from any of the people who I actually
112
00:07:23,540 --> 00:07:26,099
and fixed their systems. I didn't have
permission from the FBI. They didn't
113
00:07:26,100 --> 00:07:27,319
hey, this is a Nokia project.
114
00:07:27,320 --> 00:07:29,490
They didn't actually respond to the
email.
115
00:07:29,491 --> 00:07:33,109
The next time I had contact with him, it
was in person, like, hey, what's going
116
00:07:33,110 --> 00:07:36,480
on? The Air Force, off to a special
investigation in my living room.
117
00:07:37,710 --> 00:07:40,150
Butler is charged with computer fraud.
118
00:07:41,130 --> 00:07:45,310
In May 2001, he is sentenced to 18
months in federal prison.
119
00:07:46,970 --> 00:07:49,190
It is his second time behind bars.
120
00:07:49,770 --> 00:07:51,590
He's only 28 years old.
121
00:07:53,450 --> 00:07:55,570
While Butler sits in prison...
122
00:07:55,900 --> 00:07:58,840
Hacking culture undergoes a dramatic
transformation.
123
00:07:59,500 --> 00:08:05,259
The real migration that we saw beginning
around 2000 was hackers getting into
124
00:08:05,260 --> 00:08:09,639
systems for profit. So their targets are
all monetary, and they're making
125
00:08:09,640 --> 00:08:11,480
enormous amounts of money off of it.
126
00:08:11,840 --> 00:08:14,920
Law enforcement also undergoes a
transformation.
127
00:08:15,540 --> 00:08:21,319
In 2002, in an effort to combat
cybercrime, the National Cyber Forensics
128
00:08:21,320 --> 00:08:25,220
Training Alliance, or NCFTA, is created.
129
00:08:25,700 --> 00:08:28,680
Among its top targets are the Carter's
Forums.
130
00:08:29,000 --> 00:08:34,179
American Greed has given special access
to NCFTA's headquarters in Pittsburgh.
131
00:08:34,900 --> 00:08:39,058
This here is a screenshot of Carter
Planet, which was one of the original
132
00:08:39,059 --> 00:08:40,109
carding forums.
133
00:08:40,110 --> 00:08:44,139
Anything you want to know about credit
cards, social security numbers, dumps or
134
00:08:44,140 --> 00:08:45,520
cashing, you can go in there.
135
00:08:45,770 --> 00:08:50,569
There's a thread here for IDs, so
anything you want to know about
136
00:08:50,570 --> 00:08:53,450
kind of for driver's licenses, you can
go into that form.
137
00:08:53,850 --> 00:08:59,729
As the world of hacking evolves in the
outside world, on the inside, Max Butler
138
00:08:59,730 --> 00:09:02,250
is forging new relationships with
criminals.
139
00:09:03,190 --> 00:09:09,769
We would just walk the yard. As
exercise, we talk about, well,
140
00:09:09,770 --> 00:09:12,300
about what we did and talk about what
could be done.
141
00:09:12,510 --> 00:09:16,060
So we talk about it in a sort of
fanciful way, like, oh, wouldn't that be
142
00:09:17,250 --> 00:09:22,749
Next on American Greed, prison yard
scheming goes active, costing victims
143
00:09:22,750 --> 00:09:23,800
than $80 million.
144
00:09:24,550 --> 00:09:28,010
And Max Butler is reborn as Iceman.
145
00:09:28,570 --> 00:09:32,350
He's this elite hacker, and he's making
over $1 ,000 a day.
146
00:09:43,340 --> 00:09:49,019
In 2002, computer hacker Max Butler is
released from prison, having served 18
147
00:09:49,020 --> 00:09:50,580
months for computer fraud.
148
00:09:51,020 --> 00:09:56,699
Butler used to work as a white hat
hacker, identifying and fixing security
149
00:09:56,700 --> 00:09:58,200
in computer networks.
150
00:09:58,540 --> 00:10:04,519
But now, he's a twice convicted felon.
And, as Max Butler says in an exclusive
151
00:10:04,520 --> 00:10:09,160
interview with American Greed, that
white hat isn't looking so good.
152
00:10:09,161 --> 00:10:14,009
I got desperate and I actually started
going and looking for minimum wage work.
153
00:10:14,010 --> 00:10:18,309
I went to those places where you show up
at 5, 6 o 'clock in the morning and you
154
00:10:18,310 --> 00:10:22,949
do manual labor, move boards around,
whatever, and I couldn't get placed
155
00:10:22,950 --> 00:10:26,349
because there would be a queue, a
seniority, and so I would just end up
156
00:10:26,350 --> 00:10:29,060
there all morning and nobody would even
hire me there.
157
00:10:31,150 --> 00:10:36,069
Former hacker Kevin Polson knows how
hard it can be to rebuild a life after
158
00:10:36,070 --> 00:10:37,120
years in prison.
159
00:10:37,570 --> 00:10:42,559
As a 25 -year -old, Polson was arrested
for computer intrusion and money
160
00:10:42,560 --> 00:10:48,140
laundering. Now he's a husband and
father and senior editor at Wired .com.
161
00:10:48,560 --> 00:10:50,700
Polson is writing a book on Butler.
162
00:10:51,500 --> 00:10:53,020
He was ready to make some money.
163
00:10:53,300 --> 00:10:54,420
He needed the money.
164
00:10:54,860 --> 00:10:57,320
Butler soon finds a way to make some
cash.
165
00:10:57,780 --> 00:11:01,720
Through an old prison buddy, he is
introduced to Christopher Aragon.
166
00:11:02,300 --> 00:11:06,719
Aragon is a former bank robber who is
now learning the dark art of making
167
00:11:06,720 --> 00:11:08,200
counterfeit credit cards.
168
00:11:08,840 --> 00:11:12,660
Aragon tells Butler that they have
complementary skill sets.
169
00:11:13,300 --> 00:11:18,519
Butler was the hacker extraordinaire who
could obtain access to computer
170
00:11:18,520 --> 00:11:24,939
systems. Aragon, who was also quite
computer savvy, was very adept at social
171
00:11:24,940 --> 00:11:25,990
manipulation.
172
00:11:26,200 --> 00:11:28,060
The initial plan is simple.
173
00:11:28,360 --> 00:11:33,279
Butler will target Carter Forums, the
black market websites that traffic in
174
00:11:33,280 --> 00:11:35,690
stolen identities and financial
information.
175
00:11:36,490 --> 00:11:41,409
He'll hack into their computer systems,
steal credit card numbers, and sell them
176
00:11:41,410 --> 00:11:44,230
to Chris Aragon, who will make fake
credit cards.
177
00:11:44,710 --> 00:11:49,109
It's a scam that Keith Malarski, an FBI
special agent who has gone undercover on
178
00:11:49,110 --> 00:11:52,170
Carter forums, has seen many times
before.
179
00:11:53,470 --> 00:12:00,069
So what we have here is a MSR -206,
which is the most popular magnetic
180
00:12:00,070 --> 00:12:01,810
and reader that's out on the market.
181
00:12:02,050 --> 00:12:03,430
A simple laptop.
182
00:12:04,030 --> 00:12:09,669
And the bad guys have designed a program
called The Germ, which will enable you
183
00:12:09,670 --> 00:12:13,890
to take the credit card number and write
it onto the magnetic strip on the back.
184
00:12:14,070 --> 00:12:18,429
So what you do is you take the card, and
then you just swipe it, and it's as
185
00:12:18,430 --> 00:12:19,480
easy as that.
186
00:12:19,610 --> 00:12:22,050
The fake credit cards look legitimate.
187
00:12:22,760 --> 00:12:27,959
You can see the quality on the card here
is very good. The hologram, the
188
00:12:27,960 --> 00:12:32,200
MasterCard hologram is good. And even on
the back, he had raised numbers here,
189
00:12:32,220 --> 00:12:36,000
so when you would feel that as a
security measure, it would pass that.
190
00:12:36,420 --> 00:12:39,420
But the hackers won't use the credit
cards themselves.
191
00:12:40,240 --> 00:12:46,659
Chris Aragon hires teams of young girls
called cashiers, or sometimes mules, to
192
00:12:46,660 --> 00:12:48,640
go on a high -end shopping spree.
193
00:12:49,130 --> 00:12:53,229
you know, girls that he'd met in clubs
or friends of friends and say, hey,
194
00:12:53,230 --> 00:12:56,709
you like to go shopping and show them,
you know, credit cards that you could
195
00:12:56,710 --> 00:12:59,790
just use for whatever, they would all be
excited about it.
196
00:12:59,791 --> 00:13:03,729
Eventually, he would get an organized
team together of false IDs, go into a
197
00:13:03,730 --> 00:13:09,949
complex and just go crazy, buy whatever
they could, fill up a SUV, and then they
198
00:13:09,950 --> 00:13:12,089
would try to, you know, go fence that
merchandise.
199
00:13:12,090 --> 00:13:17,009
Arrogant crew would then use online
auction sites to sell some of the stolen
200
00:13:17,010 --> 00:13:18,060
goods.
201
00:13:18,061 --> 00:13:21,069
So it will appear like a legitimate
product, and they could sell it for a
202
00:13:21,070 --> 00:13:24,609
discount, and then that's how the lower
-end people will make their money.
203
00:13:24,610 --> 00:13:29,529
Butler and Aragon figure the scam will
bring in several hundred thousand
204
00:13:29,530 --> 00:13:30,580
a year.
205
00:13:30,710 --> 00:13:34,030
At some point, money would trickle back
to me. It was never half.
206
00:13:34,230 --> 00:13:36,810
It was... Really, I got scraps.
207
00:13:37,290 --> 00:13:42,169
But I kind of had this idea that maybe I
would get half, but that never worked
208
00:13:42,170 --> 00:13:43,149
out.
209
00:13:43,150 --> 00:13:45,170
To make the scheme more profitable...
210
00:13:45,610 --> 00:13:48,270
Butler needs a steady stream of credit
card numbers.
211
00:13:48,910 --> 00:13:54,569
He goes straight to the motherlode, the
Carter's forums, where hackers like him
212
00:13:54,570 --> 00:13:58,010
buy and sell numbers and identities by
the hundreds of thousands.
213
00:13:58,970 --> 00:14:01,390
He'll be a pirate of pirates.
214
00:14:03,310 --> 00:14:07,710
In 2003, Butler and Aragon spring into
action.
215
00:14:08,550 --> 00:14:13,430
The partners set up their hacking
operation in hotel rooms around San
216
00:14:14,060 --> 00:14:16,660
Where the air is thick with Wi -Fi
signals.
217
00:14:17,340 --> 00:14:20,700
We would choose location based on access
to wireless networks.
218
00:14:21,040 --> 00:14:26,279
He would have it packed with computer
equipment, including a high -end antenna
219
00:14:26,280 --> 00:14:29,590
that could be used for interception of
wireless communications.
220
00:14:30,180 --> 00:14:35,839
Using someone else's Wi -Fi network
means Butler can hack away without
221
00:14:35,840 --> 00:14:37,880
trace. He would use a giant...
222
00:14:38,270 --> 00:14:43,289
in order to hack into Wi -Fi signals
from neighboring apartments or from
223
00:14:43,290 --> 00:14:46,849
the street in order to have an anonymous
Internet connection that he felt
224
00:14:46,850 --> 00:14:48,710
couldn't really be traced back to him.
225
00:14:48,810 --> 00:14:53,929
Once he's up and running on a hijacked
Wi -Fi, Butler logs on to Carter's
226
00:14:53,930 --> 00:14:56,870
and looks for weak spots in their
security networks.
227
00:14:57,370 --> 00:15:01,430
So I got into hundreds of their
machines, and I was watching them.
228
00:15:01,990 --> 00:15:05,690
This was by versus by. It was me against
them.
229
00:15:06,960 --> 00:15:10,480
It was quite an ego boost. I got a rush
from it.
230
00:15:11,020 --> 00:15:15,499
When he finally breaks through security,
Butler loots all the financial data
231
00:15:15,500 --> 00:15:17,380
another criminal has already stolen.
232
00:15:17,720 --> 00:15:22,639
He steals thousands of credit card
numbers, passwords, and pins, and
233
00:15:22,640 --> 00:15:24,500
them to his partner, Chris Aragon.
234
00:15:24,501 --> 00:15:28,639
He would kind of set me up, and then I
would just be like an incubator. I would
235
00:15:28,640 --> 00:15:31,920
just try to churn out information to
provide to him.
236
00:15:32,340 --> 00:15:34,540
In time, it's a well -oiled machine.
237
00:15:35,720 --> 00:15:38,680
Butler nets close to $10 ,000 a month.
238
00:15:38,920 --> 00:15:43,699
But the hacking location, or safe house,
has to change every few months to stay
239
00:15:43,700 --> 00:15:44,900
one step ahead of the law.
240
00:15:46,360 --> 00:15:48,760
But law enforcement is close behind.
241
00:15:49,200 --> 00:15:54,379
When American greed returns, a mole has
infiltrated the Carter's forums, and
242
00:15:54,380 --> 00:15:57,900
he's working with the U .S. Secret
Service to bring down Iceman.
243
00:16:09,550 --> 00:16:15,509
In San Francisco in June 2005, computer
hacker Max Butler and his partner Chris
244
00:16:15,510 --> 00:16:20,329
Aragon are stealing credit card numbers
with impunity. And they're leaving a
245
00:16:20,330 --> 00:16:23,510
wake of financial disaster for millions
of Americans.
246
00:16:24,610 --> 00:16:30,969
Butler, who now calls himself Iceman
online, hacks into Carter's forums, the
247
00:16:30,970 --> 00:16:35,510
illegal websites where criminals buy and
sell stolen financial data.
248
00:16:36,790 --> 00:16:38,730
Greed has gotten the best of him.
249
00:16:39,310 --> 00:16:40,360
He wants more.
250
00:16:40,830 --> 00:16:43,790
He's even hacking into banks and credit
unions.
251
00:16:43,791 --> 00:16:47,929
He's in this cyber underground where
he's this elite hacker, and he's making
252
00:16:47,930 --> 00:16:49,270
over $1 ,000 a day.
253
00:16:49,550 --> 00:16:54,170
That's very, very good money, and it's
kind of hard to walk away from that,
254
00:16:54,310 --> 00:16:59,290
especially when your ego gets involved
where you think that you can't be
255
00:16:59,850 --> 00:17:05,529
Butler justifies his criminal acts by
telling himself he's just sticking it to
256
00:17:05,530 --> 00:17:08,150
banks. You know, I made myself feel
better about it.
257
00:17:09,000 --> 00:17:11,240
not actually hurting people,
individuals.
258
00:17:11,760 --> 00:17:17,899
Of course, it turns out I did actually
cause quite a bit of, more than just an
259
00:17:17,900 --> 00:17:20,059
inconvenience, quite an ordeal for a lot
of people.
260
00:17:20,060 --> 00:17:24,040
People like Julie, who asked that her
last name not be used.
261
00:17:24,440 --> 00:17:30,799
In late 2009, someone using stolen
identity information opened up several
262
00:17:30,800 --> 00:17:32,380
of credit at various stores.
263
00:17:32,800 --> 00:17:37,280
They almost get away with charging $11
,000 in her name.
264
00:17:38,030 --> 00:17:39,530
This is not a victimless crime.
265
00:17:39,830 --> 00:17:42,410
They may think it is, but I was the
victim.
266
00:17:42,890 --> 00:17:48,469
Depending on the case, it can take up to
two years of painstaking work to clear
267
00:17:48,470 --> 00:17:50,570
one's name after identity theft.
268
00:17:51,310 --> 00:17:56,870
The countless hours that I've had to put
into this to try to fix.
269
00:17:57,280 --> 00:18:01,399
My credit and the amount of stress
that's gone into this and the amount of
270
00:18:01,400 --> 00:18:07,480
it's taken away from my work schedule
and from my family has been tremendous.
271
00:18:08,420 --> 00:18:13,740
Back in his safe house in San Francisco,
Iceman is not thinking of his victims.
272
00:18:14,740 --> 00:18:18,940
He's thinking about how he can get even
more control and power.
273
00:18:19,420 --> 00:18:24,319
He and partner Chris Aragon decide to
start their own Carter's Forum. They
274
00:18:24,320 --> 00:18:26,020
it Carter's Market.
275
00:18:26,730 --> 00:18:31,289
The name was actually his idea. He
wanted Carter's Market. He felt that
276
00:18:31,290 --> 00:18:33,190
business motive was appropriate.
277
00:18:33,670 --> 00:18:39,069
Both partners see an upside in the
arrangement, an opportunity to greatly
278
00:18:39,070 --> 00:18:40,120
their market.
279
00:18:40,550 --> 00:18:44,100
Max wanted to be able to sell credit
card information to more than just
280
00:18:44,830 --> 00:18:50,369
Aragon wanted to be able to sell
counterfeit credit cards to other
281
00:18:50,370 --> 00:18:54,069
that he wasn't entirely relying on the
purchases that his cashers were making.
282
00:18:54,070 --> 00:18:55,670
So they both had a stake in this.
283
00:18:56,080 --> 00:19:01,019
Butler creates a sliding scale for his
wares, and it may be surprising how
284
00:19:01,020 --> 00:19:03,720
cheaply the market prices a stolen
credit card.
285
00:19:03,960 --> 00:19:10,499
He charges $12 for a Visa Classic, $16
.50 for a MasterCard, $36 for American
286
00:19:10,500 --> 00:19:11,550
Express.
287
00:19:11,840 --> 00:19:15,780
And like any reputable vendor, his
inventory runs deep.
288
00:19:16,280 --> 00:19:21,899
To be a reviewed vendor, for example, of
dumps or credit cards, you need to have
289
00:19:21,900 --> 00:19:25,180
a supply of hundreds of thousands, if
not millions, of cards.
290
00:19:26,320 --> 00:19:30,739
The credit card numbers are coming from
other Carter's forums that Butler has
291
00:19:30,740 --> 00:19:31,790
hacked into.
292
00:19:31,900 --> 00:19:37,659
Every month, Butler is selling more than
250 dumps, the stolen financial and
293
00:19:37,660 --> 00:19:38,710
identity data.
294
00:19:38,740 --> 00:19:41,640
His reputation as master hacker is
sealed.
295
00:19:42,000 --> 00:19:46,199
He definitely became one of the top five
dump spenders in the world. And this
296
00:19:46,200 --> 00:19:49,690
isn't a business that's traditionally
dominated by Eastern Europe.
297
00:19:50,110 --> 00:19:55,629
I really think that Iceman was the first
real elite hacker to run one of these
298
00:19:55,630 --> 00:19:56,680
carding forums.
299
00:19:56,970 --> 00:20:01,350
What's more, Butler and Aragon are
frustrating law enforcement.
300
00:20:01,690 --> 00:20:08,029
The real difficulty with a cybercrime
case is the degree of anonymity that the
301
00:20:08,030 --> 00:20:14,349
Internet affords. It's not the typical
situation where you have something like
302
00:20:14,350 --> 00:20:18,050
DNA or blood evidence. You have to...
303
00:20:18,430 --> 00:20:21,450
amass the proof that puts that person
behind the keyboard.
304
00:20:21,850 --> 00:20:27,410
The Carter's forums are notoriously
tight -knit and suspicious of outsiders.
305
00:20:28,170 --> 00:20:32,650
Prospective members must have an
existing member vouch for their
306
00:20:32,651 --> 00:20:37,049
You need to know another criminal in
there, generally a couple of criminals
307
00:20:37,050 --> 00:20:41,309
where you've done business with them
enough so that they will vouch for your
308
00:20:41,310 --> 00:20:43,720
credibility in order to be a member of
the group.
309
00:20:43,730 --> 00:20:48,210
And that culture of secrecy is bolstered
by high -tech encryption.
310
00:20:49,130 --> 00:20:53,690
Now they've moved to encrypted
communications on encrypted servers.
311
00:20:53,950 --> 00:20:58,429
So it makes it very difficult for law
enforcement. And now we have to find
312
00:20:58,430 --> 00:21:02,609
avenues to get into the group in order
to get into their very secret
313
00:21:02,610 --> 00:21:07,209
communications. So the criminals know
that law enforcement now is looking at
314
00:21:07,210 --> 00:21:11,370
them. So as a result, they're evolving
in their techniques.
315
00:21:12,210 --> 00:21:17,089
Despite their success in making money
and staying ahead of the law, Butler is
316
00:21:17,090 --> 00:21:21,579
worried. For one thing, he thinks his
partner, Chris Aragon, is spending money
317
00:21:21,580 --> 00:21:24,840
too lavishly and drawing too much
attention to himself.
318
00:21:25,800 --> 00:21:30,119
His crew was young, and they liked to
party. So there were nights out, and
319
00:21:30,120 --> 00:21:34,619
they'd go clubbing in Las Vegas, and
he'd spend $1 ,000 on a meal, another $1
320
00:21:34,620 --> 00:21:35,670
,000 on wine.
321
00:21:35,880 --> 00:21:41,439
I wasn't really so much as excited about
that. I wanted to be, you know, working
322
00:21:41,440 --> 00:21:42,680
on the computers.
323
00:21:42,940 --> 00:21:45,110
I wasn't really into that party
lifestyle.
324
00:21:45,200 --> 00:21:46,840
And there's a much bigger worry.
325
00:21:47,560 --> 00:21:53,539
In 2004, a federal dragnet called
Operation Firewall brings down a
326
00:21:53,540 --> 00:21:55,260
Forum called Shadow Crew.
327
00:21:55,900 --> 00:22:00,779
28 people are arrested, ratcheting up
the already fearful and paranoid
328
00:22:00,780 --> 00:22:02,760
atmosphere in the Carter's Forums.
329
00:22:03,060 --> 00:22:08,199
In a world where everyone hides behind a
screen name, no one knows who might be
330
00:22:08,200 --> 00:22:10,060
an undercover FBI agent.
331
00:22:11,630 --> 00:22:16,350
There's a lot of paranoia on the forums,
especially after Operation Firewall.
332
00:22:16,790 --> 00:22:22,389
Nobody really knows who they can trust,
and so a lot of accusations get thrown
333
00:22:22,390 --> 00:22:28,029
around. Iceman begins to obsess that an
FBI mole might penetrate Carter's
334
00:22:28,030 --> 00:22:32,829
market, or even a rival website, and
bring their good times to a screeching
335
00:22:32,830 --> 00:22:36,689
halt. He decided there were too many
competing forums, and it was dividing up
336
00:22:36,690 --> 00:22:37,669
the business.
337
00:22:37,670 --> 00:22:39,230
Vendors were scattered around.
338
00:22:39,870 --> 00:22:41,490
They had poor security.
339
00:22:41,890 --> 00:22:47,849
And that the criminal underground would
be better off under a single board and
340
00:22:47,850 --> 00:22:49,130
under his benign rule.
341
00:22:49,470 --> 00:22:53,769
At one point, I thought it would be
beneficial to just get all the
342
00:22:53,770 --> 00:22:54,820
in one place.
343
00:22:54,930 --> 00:23:00,029
Butler wants to take over and control
the Carter's forums so he can weed out
344
00:23:00,030 --> 00:23:03,400
suspicious characters who might be
working with law enforcement.
345
00:23:03,770 --> 00:23:09,589
He decides to plot a hostile takeover of
his four main rivals, Dark Market, talk
346
00:23:09,590 --> 00:23:15,549
cash, Scandinavian carding, and the
vouched. If he can take all their users
347
00:23:15,550 --> 00:23:20,469
bring them under his umbrella, he
figures he can exercise total control
348
00:23:20,470 --> 00:23:21,930
has access to the site.
349
00:23:22,390 --> 00:23:24,250
He spends two months preparing.
350
00:23:24,950 --> 00:23:29,990
Then in August 2006, Butler locks
himself in his safe house.
351
00:23:30,350 --> 00:23:36,349
And in one spree, a 48 -hour session
where I stayed awake, I went through and
352
00:23:36,350 --> 00:23:37,400
checked them off.
353
00:23:37,401 --> 00:23:41,079
got into the site, copied all their data
out, got a current snapshot of their
354
00:23:41,080 --> 00:23:46,480
database, shut their site down, deleted
their database, imported it into ours,
355
00:23:46,620 --> 00:23:48,180
and built up Carter's Market.
356
00:23:48,940 --> 00:23:51,420
And, I don't know, it seemed fun at the
time.
357
00:23:52,400 --> 00:23:54,780
He looks proud, and he is.
358
00:23:55,820 --> 00:24:00,020
Emails, usernames, passwords of everyone
who bought and sold on the sites.
359
00:24:00,280 --> 00:24:02,320
The information is all his.
360
00:24:02,880 --> 00:24:06,560
It's like a mob boss taking out the
heads of other families.
361
00:24:07,230 --> 00:24:12,369
Iceman is now the undisputed don of the
Carter Forums. It was a huge boost for
362
00:24:12,370 --> 00:24:13,209
Carter's Market.
363
00:24:13,210 --> 00:24:19,110
He went from 1 ,500 users to 6 ,000
users overnight with this hostile
364
00:24:19,410 --> 00:24:24,889
The takeover merits a lengthy article in
USA Today, which dubs Carter's Market
365
00:24:24,890 --> 00:24:27,270
the Walmart of Carter's Forums.
366
00:24:27,271 --> 00:24:30,209
Carter's Market was the only place to do
business now.
367
00:24:30,210 --> 00:24:31,770
When American greed returns,
368
00:24:32,490 --> 00:24:34,690
Iceman seems in total control.
369
00:24:35,200 --> 00:24:38,000
But his arrogance gets the attention of
the feds.
370
00:24:49,460 --> 00:24:55,660
In August 2006, Max Iceman Butler is at
the top of his game.
371
00:24:55,860 --> 00:25:01,539
As founder and administrator of the
illegal website Carter's Market, He and
372
00:25:01,540 --> 00:25:05,840
partner Chris Aragon oversee a
multimillion -dollar black market
373
00:25:06,700 --> 00:25:10,620
Carter's Market is described as the
Walmart of the digital underground.
374
00:25:11,080 --> 00:25:13,660
And Max Butler is its CEO.
375
00:25:14,820 --> 00:25:20,339
Mr. Butler, in running that website, had
complete control of who could access it
376
00:25:20,340 --> 00:25:22,240
and the extent of their access.
377
00:25:23,320 --> 00:25:29,160
But, as the saying goes, power corrupts.
And absolute power corrupts absolutely.
378
00:25:30,350 --> 00:25:34,329
Butler has hacked into the sites of his
main competitors and stolen their
379
00:25:34,330 --> 00:25:35,870
members to create a monopoly.
380
00:25:36,850 --> 00:25:40,090
This hostile takeover has brought a
serious backlash.
381
00:25:40,750 --> 00:25:45,409
What that did was really upset or ticked
off a lot of the other people running
382
00:25:45,410 --> 00:25:52,029
the other sites out there. And the
equivalent of a cyber war broke out or
383
00:25:52,030 --> 00:25:56,490
war broke out between the rival
factions. People were very angry about
384
00:25:56,510 --> 00:25:58,980
especially the people that ran the other
forums.
385
00:25:58,981 --> 00:26:02,719
Didn't know what to think. Right away,
some people accused us of being fed.
386
00:26:02,720 --> 00:26:07,959
There was a well -known forum member
called El Mariachi, who'd been in the
387
00:26:07,960 --> 00:26:12,839
forever, who had already decided that
Iceman was an informant just because he
388
00:26:12,840 --> 00:26:13,890
was so arrogant.
389
00:26:14,200 --> 00:26:19,080
And after the hostile takeover, El
Mariachi started calling out Max online,
390
00:26:19,280 --> 00:26:24,879
saying, you know, you're obviously a
snitch, goading him on, and there were
391
00:26:24,880 --> 00:26:25,930
threats exchanged.
392
00:26:26,270 --> 00:26:28,770
It could be dismissed as hacker's drama.
393
00:26:28,771 --> 00:26:33,249
But for the federal agents who have been
stymied in their efforts to infiltrate
394
00:26:33,250 --> 00:26:36,890
the Carter's forums, this cyber war
presents an opportunity.
395
00:26:37,870 --> 00:26:43,210
FBI agent Keith Malarski works
undercover as a hacker named Master
396
00:26:43,730 --> 00:26:48,849
He sees a chance to boost his undercover
reputation and expand the scope of the
397
00:26:48,850 --> 00:26:49,900
investigation.
398
00:26:50,630 --> 00:26:54,970
There was a lot of warring going on.
People really didn't know who to trust.
399
00:26:55,700 --> 00:27:00,619
So they were looking for names that had
been around for a while, and my name had
400
00:27:00,620 --> 00:27:03,820
been around for a while, the Master
Splinter moniker.
401
00:27:04,180 --> 00:27:08,860
People started coming to me and asking
me, whose side am I on?
402
00:27:09,060 --> 00:27:14,799
And that really opened up the
opportunity for us to take the
403
00:27:14,800 --> 00:27:15,839
the next level.
404
00:27:15,840 --> 00:27:21,239
Agent Malarski creates a legend of
Master Splinter as one of the world's
405
00:27:21,240 --> 00:27:26,759
spammers. What that enabled us to do was
really penetrate a number of different
406
00:27:26,760 --> 00:27:30,739
groups because spamming is really the
backbone that drives the underground
407
00:27:30,740 --> 00:27:31,790
economy.
408
00:27:32,020 --> 00:27:37,679
Before long, Agent Malarski, as Master
Splinter, gets the Carter site Dark
409
00:27:37,680 --> 00:27:42,240
Market up and running again after Butler
has hacked into it and shut it down.
410
00:27:43,020 --> 00:27:47,859
After Dark Market came back up, Mac
continued to hack back into it. It was
411
00:27:47,860 --> 00:27:48,910
ongoing war.
412
00:27:49,669 --> 00:27:53,990
Max and I kind of became enemies, and he
hated me.
413
00:27:55,050 --> 00:27:59,329
There were a lot of people going back
and forth, and they would come to me and
414
00:27:59,330 --> 00:28:03,169
say, do you know what Iceman said about
you, or do you know what Iceman's doing
415
00:28:03,170 --> 00:28:05,220
now, or Iceman's going to try to hack
you.
416
00:28:05,610 --> 00:28:07,790
They're mortal enemies on the Internet.
417
00:28:08,270 --> 00:28:13,829
But in reality, Agent Malarski doesn't
know the true identity of Iceman or have
418
00:28:13,830 --> 00:28:16,240
any idea where in the world he's
operating from.
419
00:28:16,890 --> 00:28:18,570
All that's about to change.
420
00:28:20,080 --> 00:28:23,100
The FBI joins ranks with the U .S.
Secret Service.
421
00:28:23,320 --> 00:28:27,959
And in the spring of 2006, the Secret
Service develops two confidential
422
00:28:27,960 --> 00:28:29,010
informants.
423
00:28:29,640 --> 00:28:34,759
They're both trusted members on Carter's
Market who have decided to work with
424
00:28:34,760 --> 00:28:39,419
law enforcement and provide the federal
agents a glimpse behind the curtain of
425
00:28:39,420 --> 00:28:40,700
this black market.
426
00:28:41,020 --> 00:28:43,060
They had an informant on the site.
427
00:28:43,660 --> 00:28:49,119
who was also an administrator, who was
able to give them information from the
428
00:28:49,120 --> 00:28:52,190
inside as well. So they were working to
find out who Iceman was.
429
00:28:52,540 --> 00:28:58,719
In that fall of 2006, with the Secret
Service at his side, one of the
430
00:28:58,720 --> 00:29:01,340
buys 23 credit card accounts from
Butler.
431
00:29:01,840 --> 00:29:05,659
Max presumably thought he was
corresponding with somebody in Eastern
432
00:29:05,660 --> 00:29:06,710
that he'd be safe.
433
00:29:06,980 --> 00:29:08,980
And in fact, it wound up in Pittsburgh.
434
00:29:09,820 --> 00:29:12,760
It's a small sale worth just $480.
435
00:29:13,380 --> 00:29:16,240
But for the Secret Service, it's a big
moment.
436
00:29:16,560 --> 00:29:18,400
That instantly gives them the case.
437
00:29:18,401 --> 00:29:22,599
When you sell anybody stolen credit card
information, you're automatically a
438
00:29:22,600 --> 00:29:23,650
felon.
439
00:29:24,600 --> 00:29:27,180
Then Butler makes another misstep.
440
00:29:27,440 --> 00:29:32,859
In a brazen move to steal more financial
data, Butler sends a corrupted link to
441
00:29:32,860 --> 00:29:37,040
the e -mail accounts of 500 employees at
Capital One Bank.
442
00:29:38,600 --> 00:29:44,759
So hundreds of people clicked on this
link in Capital One, and they got
443
00:29:44,760 --> 00:29:47,590
with this, giving him access to their
internal network.
444
00:29:47,960 --> 00:29:49,900
But his plan backfires.
445
00:29:50,660 --> 00:29:55,839
Capital One contacts the FBI, who traces
the cyberattack to the same account
446
00:29:55,840 --> 00:29:57,520
that registered Carter's Market.
447
00:29:58,340 --> 00:30:00,900
The case against Butler is building.
448
00:30:01,340 --> 00:30:03,880
But Iceman is a worthy adversary.
449
00:30:04,280 --> 00:30:06,400
He suspects correctly...
450
00:30:06,840 --> 00:30:09,360
that Master Splinter is a federal agent.
451
00:30:09,960 --> 00:30:15,679
Max saw that Master Splinter was logging
on not from Eastern Europe, where he
452
00:30:15,680 --> 00:30:19,110
was supposed to be based, but from an
office building in Pittsburgh.
453
00:30:19,580 --> 00:30:25,399
It's the building that houses the NCFTA,
the National Cyber Forensics Training
454
00:30:25,400 --> 00:30:26,450
Alliance.
455
00:30:26,780 --> 00:30:30,839
So Iceman shouted to the hills that
anybody would listen that Master
456
00:30:30,840 --> 00:30:35,279
was a Fed and a dark market was a sting
operation being run by the FBI or the
457
00:30:35,280 --> 00:30:37,630
NCFDA. He would tell anybody that would
listen.
458
00:30:38,180 --> 00:30:44,399
For Malarski slash Master Splinter,
being outed threatens to kill his
459
00:30:44,400 --> 00:30:45,450
in the cradle.
460
00:30:45,700 --> 00:30:50,059
So we had to do some scrubbing because
we had just taken over this site, and
461
00:30:50,060 --> 00:30:54,380
this was the potential to compromise it
all right in the first couple weeks.
462
00:30:55,160 --> 00:31:01,039
Fortunately for Agent Malarski, Iceman
cries wolf one too many times, having
463
00:31:01,040 --> 00:31:03,840
accused people before of being federal
agents.
464
00:31:04,460 --> 00:31:10,239
Malarski also has a world -class support
team, which scrubs the data of any tie
465
00:31:10,240 --> 00:31:11,560
to the federal government.
466
00:31:11,740 --> 00:31:18,279
So now when Iceman made his big reveal
to the world that Master Flinner was
467
00:31:18,280 --> 00:31:20,800
of the NCFTA, none of that stuff was
there.
468
00:31:21,240 --> 00:31:26,339
So I had convinced the people on Dark
Market that I was legit. So they just
469
00:31:26,340 --> 00:31:28,620
thought that Iceman was throwing dirt at
me.
470
00:31:28,621 --> 00:31:32,699
So there was a lot of allegations where
people were calling one another cops or
471
00:31:32,700 --> 00:31:37,019
feds all the time. And luckily for me, I
was just kind of in that wave of all
472
00:31:37,020 --> 00:31:40,760
this allegation, and I was able to
survive it.
473
00:31:42,460 --> 00:31:46,720
Next on American Greed, authorities are
closing in.
474
00:31:47,500 --> 00:31:50,560
The big break comes when they nab Chris
Aragon.
475
00:31:51,200 --> 00:31:54,560
the only person in the world who knows
Iceman's real name.
476
00:31:54,940 --> 00:31:56,540
Would he give up his partner?
477
00:32:05,520 --> 00:32:07,580
In spring 2007,
478
00:32:08,280 --> 00:32:15,099
Max Butler, a .k .a. Iceman, is living
the hacker's dream, illegally breaking
479
00:32:15,100 --> 00:32:17,960
into systems and getting paid good money
for it.
480
00:32:18,680 --> 00:32:22,869
He and his partner, Chris Aragon,
managed the multi -million dollar
481
00:32:22,870 --> 00:32:25,150
website called Carter's Market.
482
00:32:26,230 --> 00:32:31,129
It's an online bazaar where crooks can
buy and sell stolen credit card and
483
00:32:31,130 --> 00:32:32,270
identity information.
484
00:32:32,910 --> 00:32:37,290
Carter's Market website was founded by
Mr. Butler and a close associate of his,
485
00:32:37,390 --> 00:32:42,069
Christopher Aragon, largely so that they
would have complete control over the
486
00:32:42,070 --> 00:32:44,730
servers and the access to that market.
487
00:32:45,210 --> 00:32:50,769
But in an interview with American Greed,
Max Butler says by spring he was ready
488
00:32:50,770 --> 00:32:55,649
to get out. I had been sort of winding
down, wanting to get out from under the
489
00:32:55,650 --> 00:32:59,850
forum. But it's too late. The feds are
closing in on Iceman.
490
00:33:00,530 --> 00:33:05,210
So things started to unravel for Max
very rapidly.
491
00:33:05,211 --> 00:33:07,189
There were two things that happened.
492
00:33:07,190 --> 00:33:12,210
First, a young charter named Jonathan
Giannone, a .k .a. Zebra.
493
00:33:12,700 --> 00:33:15,180
is arrested for wire fraud and identity
theft.
494
00:33:15,540 --> 00:33:20,459
An early administrator on Carter's
Market, Giannone has an insider's
495
00:33:20,460 --> 00:33:24,360
on Iceman, and he's looking at several
years in prison.
496
00:33:24,361 --> 00:33:29,339
The Secret Service came to him and said,
if you want to help yourself, you're
497
00:33:29,340 --> 00:33:32,899
going to tell us everything you know
about Iceman, the guy that did this
498
00:33:32,900 --> 00:33:36,420
takeover. The zebra has one card to
play.
499
00:33:36,990 --> 00:33:41,469
He didn't know who Iceman was, but he
did know Chris Aragon, and he knew that
500
00:33:41,470 --> 00:33:44,690
Chris Aragon worked closely with Iceman
in real life.
501
00:33:44,930 --> 00:33:50,269
Only one person really on the planet
knew who the Iceman was, and that was
502
00:33:50,270 --> 00:33:51,320
Christopher Aragon.
503
00:33:51,730 --> 00:33:56,529
If the Secret Service can get to Chris
Aragon, there's a good chance they can
504
00:33:56,530 --> 00:33:57,580
stop Iceman.
505
00:33:58,250 --> 00:34:00,050
The opportunity comes quickly.
506
00:34:00,690 --> 00:34:03,190
On May 12, 2007...
507
00:34:03,450 --> 00:34:08,488
Aragon is arrested trying to use one of
his counterfeit cards to buy $13 ,000
508
00:34:08,489 --> 00:34:11,989
worth of luxury purses at
Bloomingdale's.
509
00:34:12,770 --> 00:34:17,709
Following that arrest, police in Newport
Beach did a series of searches of
510
00:34:17,710 --> 00:34:22,129
computer equipment and other electronic
devices in connection with Aragon's
511
00:34:22,130 --> 00:34:24,540
business activities and criminal
activities.
512
00:34:24,989 --> 00:34:29,948
Part of that information was shared with
the United States Secret Service and
513
00:34:29,949 --> 00:34:31,750
was made available to us in our case.
514
00:34:32,429 --> 00:34:37,030
Just like Zebra, Chris Aragon puts self
-preservation above loyalty.
515
00:34:37,710 --> 00:34:42,888
Facing charges of commercial burglary
and identity theft, Aragon decides to
516
00:34:42,889 --> 00:34:48,149
talk. He tells them the addresses of
Iceman's safe houses, though he doesn't
517
00:34:48,150 --> 00:34:49,270
know his current one.
518
00:34:49,690 --> 00:34:54,770
And he tells them something even more
vital, Iceman's true identity.
519
00:34:55,270 --> 00:34:58,670
Chris was really the only one that knew
that Iceman was Max Butler.
520
00:34:59,340 --> 00:35:03,859
For the first time in this
investigation, the feds now know who
521
00:35:03,860 --> 00:35:09,699
for, a 6 '5", brown -haired, white male
who lives in the San Francisco area
522
00:35:09,700 --> 00:35:11,440
named Max Butler.
523
00:35:13,260 --> 00:35:19,239
After Aragon's arrest, Butler is cagey.
He quickly abandons his current safe
524
00:35:19,240 --> 00:35:25,759
house. I was in an apartment that he
provided, so I got out of there. So I
525
00:35:25,760 --> 00:35:26,810
changed location.
526
00:35:27,000 --> 00:35:29,280
I got rid of all my wireless gear.
527
00:35:29,780 --> 00:35:32,180
But the Secret Service has key
information.
528
00:35:32,900 --> 00:35:37,459
They get the name of Butler's girlfriend
from an associate of Aragon's and track
529
00:35:37,460 --> 00:35:38,510
down her address.
530
00:35:39,400 --> 00:35:43,979
It's now a shoe leather investigation as
teams of agents take out the
531
00:35:43,980 --> 00:35:45,030
girlfriend's house.
532
00:35:45,560 --> 00:35:49,660
Once Butler leaves, they follow him
straight to his safe house.
533
00:35:50,220 --> 00:35:55,139
and they followed him as he moved some
of his stuff into his new safe house. So
534
00:35:55,140 --> 00:35:58,339
they just followed him right to the
front door, literally to the front door.
535
00:35:58,340 --> 00:36:00,860
But they don't rush in, not yet.
536
00:36:01,320 --> 00:36:05,639
Aragon had told them that Butler has a
kill switch program that can immediately
537
00:36:05,640 --> 00:36:06,960
destroy evidence.
538
00:36:07,700 --> 00:36:11,579
We knew he had encryption on that
computer, and it was going to be hard to
539
00:36:11,580 --> 00:36:13,480
unless those computers were on.
540
00:36:14,140 --> 00:36:17,900
I had them all locked and encrypted. In
my mind, encryption was...
541
00:36:17,901 --> 00:36:21,969
This blanket that made them not even
real. I didn't see the computers as
542
00:36:21,970 --> 00:36:24,869
computers. When they were encrypted, in
my mind, they're brick.
543
00:36:24,870 --> 00:36:28,249
And it's kind of hard to explain that.
You think, well, are you crazy? But I
544
00:36:28,250 --> 00:36:29,330
really believed that.
545
00:36:29,430 --> 00:36:34,350
They called on the expertise of CERT,
the Computer Emergency Response Team,
546
00:36:34,450 --> 00:36:35,710
based in Pittsburgh.
547
00:36:36,190 --> 00:36:40,929
These are some of the country's foremost
experts in the area of decryption, of
548
00:36:40,930 --> 00:36:45,989
taking an encrypted computer and trying
to figure out ways to get into that
549
00:36:45,990 --> 00:36:47,670
computer and obtain the evidence.
550
00:36:48,220 --> 00:36:49,840
that we're seeking in the search.
551
00:36:51,600 --> 00:36:54,100
The arrest has to go down without a
hitch.
552
00:36:54,560 --> 00:37:00,879
On September 5, 2007, after the 16
-month investigation, the feds are ready
553
00:37:00,880 --> 00:37:01,930
move.
554
00:37:02,400 --> 00:37:07,699
Several Secret Service agents, along
with FBI agent Malarski, charge into
555
00:37:07,700 --> 00:37:08,750
Butler's safe house.
556
00:37:09,180 --> 00:37:13,279
Suddenly there's a football team of
agents between me and the computers, and
557
00:37:13,280 --> 00:37:14,330
just in shock.
558
00:37:14,640 --> 00:37:16,980
The computer experts get to work.
559
00:37:16,981 --> 00:37:20,109
I thought that they were going in and
collecting bricks. I thought they had
560
00:37:20,110 --> 00:37:21,160
nothing.
561
00:37:21,390 --> 00:37:25,110
Of course, that's not the case. They
have some really sharp people.
562
00:37:25,750 --> 00:37:28,100
And they were able to get all that
information.
563
00:37:28,610 --> 00:37:30,490
The takedown is successful.
564
00:37:31,130 --> 00:37:34,710
They get to Butler's computer before any
evidence can be destroyed.
565
00:37:35,630 --> 00:37:39,330
The amount of stolen data in Butler's
possession is staggering.
566
00:37:40,370 --> 00:37:43,010
The total of fraudulent charges.
567
00:37:43,870 --> 00:37:49,469
On the 1 .8 million plus cards in Mr.
Butler's possession as of the date of
568
00:37:49,470 --> 00:37:52,950
search was $86 .4 million.
569
00:37:54,030 --> 00:37:59,169
At the time, it is the largest identity
theft and hacking case in the country's
570
00:37:59,170 --> 00:38:00,220
history.
571
00:38:00,650 --> 00:38:06,429
On September 11, 2007, Butler is charged
with three counts of wire fraud and two
572
00:38:06,430 --> 00:38:07,690
counts of identity theft.
573
00:38:09,520 --> 00:38:14,100
Federal sentencing guidelines can put
him behind bars for 40 years.
574
00:38:14,440 --> 00:38:19,200
The charges reflect a small fraction of
the real cost of Buckner's crimes.
575
00:38:19,640 --> 00:38:25,479
The effect on our economy is huge,
obviously, when you're talking about a
576
00:38:25,480 --> 00:38:26,299
of this size.
577
00:38:26,300 --> 00:38:32,919
Financial institutions are under enough
stress in this country, and the effect
578
00:38:32,920 --> 00:38:37,920
of hacking activity and identity theft
just makes the situation worse.
579
00:38:38,350 --> 00:38:43,809
from everybody, from their employees to
those whose cards are compromised, to
580
00:38:43,810 --> 00:38:47,150
individuals who want to then apply for
credit in this country.
581
00:38:48,030 --> 00:38:53,950
On June 29, 2009, Butler pleads guilty
to wire fraud charges.
582
00:38:54,550 --> 00:38:59,129
His guilty plea, in cooperation with the
feds, helped Butler avoid a possible
583
00:38:59,130 --> 00:39:00,610
sentence of 40 years.
584
00:39:03,080 --> 00:39:09,899
On February 12, 2010, Butler is
sentenced to 13 years in prison and $27
585
00:39:09,900 --> 00:39:11,700
million in restitution.
586
00:39:12,080 --> 00:39:16,820
At the time, it is the longest sentence
for hacking in U .S. history.
587
00:39:17,400 --> 00:39:22,980
With Butler and Aragon behind bars,
Carter's market eventually closes down.
588
00:39:23,460 --> 00:39:28,540
But Dark Market keeps its doors open.
Master Splinter isn't finished yet.
589
00:39:29,000 --> 00:39:34,239
Slowly, one by one, administrators on
Dark Market and other sites begin to be
590
00:39:34,240 --> 00:39:35,290
arrested.
591
00:39:35,620 --> 00:39:38,660
It's a massive sting operation that
spans the globe.
592
00:39:40,380 --> 00:39:44,839
The only high -ranking member of Dark
Market that hasn't been arrested is
593
00:39:44,840 --> 00:39:47,500
Splinter. It's time to close up shop.
594
00:39:48,540 --> 00:39:53,439
I wrote a going -away letter to the
members of Dark Market saying there are
595
00:39:53,440 --> 00:39:56,980
many feds and law enforcement on this
site. It's been penetrated.
596
00:39:57,820 --> 00:40:02,319
Iceman was arrested, all the other
administrators have been arrested, and
597
00:40:02,320 --> 00:40:05,000
not going to suffer the same fate that
they did.
598
00:40:05,360 --> 00:40:11,639
The shutdown of Dark Market prevents
more than $150 million worth of loss for
599
00:40:11,640 --> 00:40:13,660
businesses and individuals worldwide.
600
00:40:14,380 --> 00:40:19,220
Within the cybercrime area, there is a
bit of an arms race that goes on.
601
00:40:19,640 --> 00:40:24,579
Today, law enforcement and business must
wage a full -out assault if they are to
602
00:40:24,580 --> 00:40:26,280
keep ahead of cybercriminals.
603
00:40:26,910 --> 00:40:33,389
There is this constant one -upmanship
that goes on within the hacking
604
00:40:33,390 --> 00:40:38,029
against the security professionals that
are involved in protecting business
605
00:40:38,030 --> 00:40:42,849
networks. This is very important to us
as law enforcement because we also have
606
00:40:42,850 --> 00:40:45,210
to be on the cutting edge of the
technology.
607
00:40:45,870 --> 00:40:50,009
We can get you, so you can't hide from
us. And we have our international
608
00:40:50,010 --> 00:40:54,089
coalitions, and we're working very
closely together with them in order to
609
00:40:54,090 --> 00:40:55,140
this problem.
610
00:40:55,370 --> 00:40:58,790
For victims like Julie, it's too little,
too late.
611
00:40:59,230 --> 00:41:04,349
I will have to pay for my credit report
every two months, check it, and make
612
00:41:04,350 --> 00:41:05,910
sure that there's nothing on it.
613
00:41:05,911 --> 00:41:08,909
And that's really the maddening part.
That's the part that gives me anxiety
614
00:41:08,910 --> 00:41:13,389
attacks. It's like, what else could I be
doing to protect myself here? How can I
615
00:41:13,390 --> 00:41:17,730
stop this from becoming this nightmare
of trying, you know...
616
00:41:18,250 --> 00:41:22,349
Just basically like being the detective
myself and trying to sort this out and
617
00:41:22,350 --> 00:41:25,540
figure out what steps to take. You know,
how do I protect myself?
618
00:41:25,990 --> 00:41:30,849
Chris Aragon is currently awaiting trial
in California for burglary and identity
619
00:41:30,850 --> 00:41:33,070
theft, among several other charges.
620
00:41:33,550 --> 00:41:39,049
Max Butler serves his time in a federal
penitentiary. The Bureau of Prison says
621
00:41:39,050 --> 00:41:43,370
Butler may have limited access to
computers behind bars.
622
00:41:44,230 --> 00:41:46,990
In this case, greed was certainly a
motive.
623
00:41:47,470 --> 00:41:53,469
But what's obvious from the
communications and the risks that Mr.
624
00:41:53,470 --> 00:41:55,630
that ego also played a very big role.
625
00:41:56,170 --> 00:42:02,249
Perhaps the biggest disappointment or
shame of this case is the waste of
626
00:42:02,250 --> 00:42:08,109
here by someone who is very bright, very
creative, and could have used his
627
00:42:08,110 --> 00:42:13,310
talents to benefit society and
ultimately himself, and instead he
628
00:42:13,840 --> 00:42:18,740
a path that would harm many people and
businesses and ultimately harm himself.
629
00:42:19,820 --> 00:42:22,660
Illegal hacking can be seductive.
630
00:42:23,160 --> 00:42:29,599
It's a thrill. It's an ego rush to be
able to get into another computer that
631
00:42:29,600 --> 00:42:31,460
didn't ask for permission to get into.
632
00:42:32,140 --> 00:42:36,560
It's a temptation, but it's worth it to
resist that temptation.
633
00:42:37,680 --> 00:42:42,300
I would say go to school, get an
advanced degree, and stay out of
634
00:42:44,650 --> 00:42:46,250
I wish I had advice back then.
635
00:42:46,300 --> 00:42:50,850
Repair and Synchronization by
Easy Subtitles Synchronizer 1.0.0.0
60852
Can't find what you're looking for?
Get subtitles in any language from opensubtitles.com, and translate them here.