They say crime doesn’t pay, but that’s not necessarily true when you’re a talented Russian hacker. Just ask Roman Seleznev, the 32-year-old master hacker who spent the last several years dividing his time between his homes in Vladivostok, Russia and Bali, Indonesia. In just two of those years, according to federal prosecutors, he made $ 17 million dollars hacking into financial institutions and other businesses and stealing and selling credit card information. All told, he stole and resold at least 2 million credit card numbers, and cost financial institutions a total of $ 169 million.
Seleznev didn’t confine his efforts to large corporations, however. He also stole much of his credit card information from small businesses such as restaurants, and he put many of them out of business, including a popular Seattle eatery. And so, it was in Seattle that a federal judge sentenced him on Friday to a 27-year prison sentence–the longest sentence ever given to a hacker in the United States.
Capturing Seleznev was a rare stroke of luck for U.S. law enforcement. According to The New York Times, the Russian government allows hackers to operate in freedom as long as they don’t hack Russian targets–and are willing to do occasional work for Russian intelligence agencies. So Seleznev, with his millions and no fear of being caught, appeared to be leading a lavish life. Law enforcement officials found pictures of him with sports cars and stacks and stacks of what seem to be 5,000 ruble bills (5,000 rubles is worth about $ 89).
Next time, stay home.
Seleznev maintained his carefree lifestyle through a simple precaution: He never traveled to any country that had an extradition treaty with the U.S. For more than a decade, the Secret Service tracked his movements around the globe but couldn’t do anything about him. Then–in a plot twist worthy of a Hollywood thriller–in the summer of 2014, Seleznev and his girlfriend took a vacation in Maldives, an Asian nation of tropical islands. Maldives doesn’t have an extradition treaty with the U.S. either, but the State Department persuaded local authorities to help capture Seleznev anyway. He was arrested by Malidivian police at the airport on his way home and handed over to U.S. officials, who whisked him by jet to Guam and then to a federal prison in Washington State.
Seleznev’s father, a member of Russia’s parliament and an ally of president Vladimir Putin, denounced the arrest as a kidnapping and claimed the charges against his son were “a monstrous lie.” But Seleznev himself wrote a letter to the court confessing to his hacking and describing his impoverished early life and his mother’s death from alcoholism–and thanking the officials who arrested him for saving him from a potentially deadly life.
This sentence may not be the only punishment Seleznev gets for his crimes. U.S. officials are seeking to seize $ 17 million of his assets, and he also faces hacking-related prosecutions in Nevada and Georgia which could possible result in even more prison time. “Today is a bad day for hackers around the world,” commented Annette Hayes, U.S. attorney for the Western District of Washington.
But if Seleznev is behind bars, a lot of other international hackers are still roaming free. About a month ago, the Justice Department charged two Russian hackers with the breach of 500 million Yahoo accounts discovered last December. There are three more that the DOJ would like to indict as well for that crime. But it will probably never get its hands on them.