Hector Sabu Monsegur Sentencing Order and Background

Federal Defenders Suthern Dis~~t52 Duane Street-10th Floor, New York, NY 10007O F NEW YORK , 1 N C . Tel: (212) 417-8700 Fax: (212) 571-0392David E. PattonExecutive Director

VIA HAND DELIVERY

Honorable Loretta A. PreskaChief United States District JudgeSouthern District of New YorkUnited States District Court500 Pearl StreetNew York, New York 10007

Southern District of New YorkJennifer L. Brown

Attorney-in-ChargeMay 23, 2014

TO BE ~i 19 I~

~ .AL

Re: United States v. Hector Xavier Monsegur11 Cr. 666 (LAP)

Dear Chief Judge Preska:

We write on behalf of our client, Hector Monsegur, thedefendant in the above-referenced case, who is scheduled to besentenced by the Court on May 27, 2014. We join in the government'santicipated request that the Court sentence Mr. Monsegur pursuantto the factors set forth in U. S. S. G. 5K1 . 1 (a) (1) - (5) in light ofhis "extraordinary" assistance. For the reasons set out more fullybelow, we respectfully request that the Court impose a sentence oftime served.

On August 15, 2011, before Your Honor, Mr. Monsegur pledguilty, pursuant to a cooperation agreement, to a twelve-countinformation which charged him with various offenses related tocomputer hacking. He was detained at the MCC from May 25, 2012, untilDecember 17, 2012, at which point he was re-released on bail. Sincethat time, he has complied with all of the conditions of his release.

Asa result of Mr. Monsegur's `extraordinary cooperation, "the government has informed the Court that it will move at sentencingfor the Court to sentence Mr. Monsegur in light of the factorscontained in U.S.S.G. 5K1.1(1)-(5), and, pursuant to 18 U.S.C.3553(e), without regard to any mandatory minimum sentence. See Exh.A at 18 (Gov't Motion, filed May 23, 2014) . In anticipation of thismotion, the Probation Department recommends a sentence of time

Case 1:11-cr-00666-LAP Document 32 Filed 05/27/14 Page 1 of 13

Hon. Loretta A. Preska May 23, 2014.Chief United States District Judge Page 2Re: United States v. Hector Xavier Monsegur11 Cr. 66.6 {LAP)

served.lThis is an extraordinary case in several respects,including the round-the-clock, all-consuming nature.ofMr.Monsegur' s cooperation, the danger it has posed to him and his family,and the enormous benefits - in terms of national security,infrastructure protection, and losses averted - that stemmed fromhis cooperation.

Given the nature, extent, and results of Mr. Monsegur'scooperation, as well as the repercussions he and his family havesuffered as a result, the defense submits that a sentence of timeserved is the just and appropriate sentence in this case. Anyadditional period of incarceration or supervision would be more thannecessary to affect the statutory sentencing goals.

Background

Mr. Monsegur was born in in and wasraised in the Jacob Riis housing project on Manhattan's Lower EastSide. He was raised primarily by his grandmother. His mother hadleft him with his father when Mr. Monsegur was a young boy a.nd, whenhe was his father was sentenced to state prison. Mr.Monsegur's aunt also was sentenced to prison as part of the same case.She later returned to prison, leaving her two young daughters in thecare of her mother, Mr. Monsegur's grandmother, as well.

In .. ~ Mr. Monsegur's grandmother died fromcomplications related to _ Watching hisgrandmother struggle as her health declined was extremely difficultfor Mr. Monsegur. As she got sicker, he withdrew into theirapartment, and became more isolated. When she died, it fell to Mr.Monsegur to care for his two young cousins, then and dearsold. That he would care for the girls wasn't even a question. Ashis father tells the Court, Mr. Monsegur "has always helped the

1 The Probation Department also recommends that the Court impose athree-year term of supervised release. For the reasons discussed more fullybelow, the defense Submits that a term of supervised release is not necessary toaffect the statutory sentencing objectives and, in this case, would expose Mr.Monsegur to additional danger. In light of all of the facts and circumstancesof this case, the defense submits that a sentence of time served is the just andappropriate sentence.


Hon. Loretta A. Preska May 23, 2014Chief United States District Judge Page 3Re: United States v. Hector Xavier Monsegur ~.11 Cr. 666 .(LAP) ~~~family." See Exh. B (Letter from H M ). Hisbrother M explains to the Court that Mr. Monsegur is "the backboneto our family." See Exh. C {Letter from M ).

The girls were the most important thing in his life. Hetook their care and well being very seriously. He was involved intheir education, walking them to and from school and helping withtheir homework. The agency that oversaw the girls' foster careplacement with Mr. Monsegur regularly evaluated their situation andconfirmed that Mr. Monsegur was doing an admirable job as a surrogateparent. He looked out not only for his girls, but for other kidsin the neighborhood. As tells the Court, Mr. Monsegur"always looked out for" her kids and made sure they got to school,too. See Exh. D (Letter from ~) . He struggled, though.His grandmother's death had come close on the heels of him losinghis job. He struggled to pay the rent and to feed and clothe thegirls, and caring for them made it hard for him to look for a job.Tf Mr. Monsegur had lived somewhere else, if he hadattended a well-funded suburban school with a computer scienceprogram or had had the money to attend college, things might havebeen much different. With his self-taught computer skills and acollege degree, he might have maintained a lucrative jQb that wouldhave enabled him to have child care assistance so he could work andcare for the girls.

But Mr. Monsegur was on the Lower East Side, spending hisdays in a run-down apartment while waiting to pick his young cousinsup from schcol . He was angry and frustrated and desperate . He wasalso politicized and extremely talented, and, over time, he got moredeeply involved in online activism. For example, during the ArabSpring, when he learned that governments were cutting off citizens'Internet access, he did what he could to enable access . He was alsocommitted to exposing hypocrisy by uncovering security weaknesses.It frustrated him to see private industries raking in millions ofgovernment dollars while not actually providing the securityservices they boasted about. As he has candidly admitted, scme ofhis online activity was illegal. In his desperation, for example,he paid for household expenses with stolen account information andbroke into websites to purchase items for his family. In an attemptto draw attention to their skills, and an immature attempt to get


Hon. Loretta A. Preska May 23, 2014.Chief United States District Judge Page 4Re: United States v. Hector Xavier Monsegur11~ Cr . 666 (LAP)

~.some laughs, for example, Mr. Monsegur and his group posted a fakenews article on PBS.org asserting that.the rapper Tupac was aliveand well.

On June 7, 2011, almost to the day after hisgrandmother's death, late at night, FBI agents knocked on the doorof his grandmother's apartment on the Lower East Side. As thegovernment has explained to the Court, "Mr. Monsegur admitted hiscriminal conduct and immediately agreed to cooperate with lawenforcement." Exh. A at 6. It was not a difficult choice for him.However strong his political beliefs, his family came first. Hewould do whatever he had to do to protect the girls and avoid theirplacement in the foster care system. After this night, his life,and the lives of his .family members., would never be the same.Mr. Monsegur began working around the clock for the FBI.Sometimes, he would sit in computer rooms with agents for eight, ten,twelve hours at a time, reviewing logs and explaining his methodsof researching vulnerabilities. Other days, he would sit for hourswith prosecutors and agents from around the country, givinginformation he had on past online activity and helping themunderstand what had occurred in various computer intrusions they wereinvestigating. This work not only allowed law enforcement to"resolve open investigations into several computer intrusions," seeExh. A at 9-10, but also taught law enforcement information that wouldassist in future investigations. These full day meetings would endonly when he had to leave to pick the girls up from school.

Ir. addition to providing information about past onlineactivities, Mr. Monsegur worked proactively for the FBI. Becausethe targets of the FBI's investigations often were in othercountries, this proactive work required him to work overnight andthen spend the next .day reviewing the work with agents. The workkept him up at night and bled into every waking hour. He was trulyon the clock 24 hours-a-day. The government installed key-loggingsoftware on his computer so it could monitor every letter he typedand even installed a camera at his apartmen~ to record his activities.For months, he maintained this virtually non-stop activity on behalfof the government, while still trying to maintain some semblance oforder for the girls.


Hon. Loretta A. Preska May 23, 2014Chief United States District Judge Page 5Re: United States v.. Hector Xavier Monse r I~11 Cr. 666 _(LAPj UNDER SEXL

In August, 2011, Mr. Monsegur consented to the filing ofan information that included charges from five districts around thecountry. He waived venue on the out-of-district charges and pled.guilty pursuant to a cooperation agreement. At the time, he waivedindictment, the government informed the Court that Mr. Monsegur had"already incurred a significant amount of personal risk by decidingto cooperate." See Exh. E at 8 (Excerpt from August 5, 2011,Transcript).

Far six months following his plea, Mr. Monsegur kept uphis round-the-clock proactive cooperation. Over the course of hiscooperation, his helped secure evidence that led to theidentification of his co-conspirators. He also helped avertnational and international crises. For example, information heobtained permitted law enforcement officials to avoid a take-overof the water supply, system in a major U . S . city and of a major foreignenergy supply company. He helped law enforcement prevent attackson organizations such as ~ and the as well as the- United StatesCourts anc~ the United States Congress. He also enabled lawenforcement to determine that an alleged take-over of the UnitedStates energy grid was a hoax. His work not only enhanced nationalsecurity, but it prevented millions, if not billions, of dollars inloss.

Then, on March 6, 2012, Mr. Mons~egur's world came crashingdown again. In a multi-national law enforcement effort, based oninformation he had provided, agents affected the arrests of hisLulzSec co-conspirators and others. In part because of the"important deterrent effect" law enforcement hoped to gain throughnews of Mr. Monsegur's arrest and cooperation, the governmentrequested that documents related to Mr. Monsegur's plea be unsealedand "his work as a cooperating witness was made public shortly afterthe arrest of the core LulzSec members." See Exh. A at 17. Thegovernment's press release announcing the arrests also announced Mr.Monsegur's arrest and plea. See Exh. F (USAO Press Release, March6, 2012) . Although the press release did not confirm Mr. Monsegur'sstatus as a cooperator, government officials did so i~ off-the-recordinterviews with the press. Early on the morning of March 6, newspieces that had been prepared in advance,, chronicling Mr. Monsegur'slife and the details from the night of his arrest known only to thosewho were present, appeared online. By the end of the day, news outlets


Hon. Loretta A. Preska May 23, 201. 4Chief United. States District Judge ~ ~g ~,,~~j '^..~Re: United States v. Hector Xavier Monsegur ~B FILED11 Cr . 666 (LAPj UNDER SWAT,

around the caorld had his picture and his story on the front page'.The next day, things got even worse. Mr. Monsegur'scooperation was all over the morning papers . As the government we~_1knows, the scrutiny Mr. Monse~ur and his family were subjected towas something that few cooperating witnesses must cope with untilshortly before trial, if at all. But the scrutiny was not merelyunpleasant. It threatened to have serious consequences for thefamily. Early on the morning of March 7, Mr. Monsegur was- contactedb~ the agency that oversaw the girls' foster care placement. Thiswas his worst nightmare, the very thing he had sought to avoid throughhis cooperation. The agency told him that it was coming to get theg,;_rls and was possibly going tc remove them from his custody and placethem with strangers. The family converged at the Federal Defendersoffice and tc;gether we traveled to the agency to explain the. situationand plead for the girls ~o remain with family. For several frantichours, officials held closed-door and telephone meetings and thegirls were subjected to examinations and evaluations. Finally, thatevening, arrangements were approved that accelerated the return ofthe girls to the custody of their mother, who had recently beenreleased from prison. '

Following the barrage of publicity'; Mr. Monsegur could noteven return home. His face was plastered all over the Internet. Thepersonal information of his family members, including their homeaddresses and social security numbers, were distributed online.While the te^hnical details of his hacking .activities may have passedunder ti~~e radar on the Lower East Side, the concept of "snitching"did not. Shortly after news of his cooperation was made public, theNYPD conducted a drug raid near Mr. Monsegur's home. This NYPDactivity had nothing whatever to do with Mr. Monsegur. But he wasaccused of snitching in relation to.that raid and he and his familywere threatened. Mr. Monsegur's younger brother; who stood by hisside every day throughout the whole ordeal, was threatened andactually physically attacked because of Mr. Monsegur's cooperation.As the government explains to the Court, "the threat to [Mr. ] Monsegurand his family became severe enough that the FBI relocated [Mr.]Monsegur and certain of his family members." Exh. A at 17.His months of round-the-clock work and the crushingpublicity took its toll on Mr. Monsegur. In the spring of 2012, Mr.


Hon. Loretta A. Preska May 23, 20.14Chief United States District Judge Page ~ ~~-:Re: United States v. Hector Xavier Monseaur TL b11 Cr. 66~ (LAP) UNDER SFnT.Monsegur made some unauthorized online posts and the government movedfor his remand. He was detained at the MCC from May 25, 2012, untilDecember 17, 2012, at which point he was re-released on bail. Whileat the MCC, _he tried to make the most of his time. He readvoraciously: He. created and taught afive-week Computing Essentialscourse designed to teach other incarcerated persons the digital toolsneeded to analyze, synthesize and evaluate information. Attachedas Exhibit G is a copy of the syllabus he created.

Since his release in December 2012, Mr. Monsegur has beenfully compliant with the terms of his release . He has spent eighteenmonths waiting in limbo for his sentencing, attending occasionalmeetings with counsel and with law enforcement. He has looked forwork but repeatedly has been rejected, due to lack of job openingsand this open case. When applying for jobs, he has been questionedabout fiis co~~peration. He currently is prohibited by his conditionsof release from using a computer, and this restriction has greatlyhampered hip job search ability.

Mr. Monsegur has incredible computer skills that he canput to good use. He would like to use his skills as both a systemsadministrator and as a teacher. As his friend putsit, Mr. Monsegur is "truly a great asset to the human race as a whole. "See Exh. H (Letter from ).

But he will forever be marred by this case. Even thisweek, while he was at a gas station with a friend, Mr. Monsegur wasidentified by drivers in the next car who called out to him whilelooking at information about him on their smartphones. -Theextraordinary publicity that came along with his cooperation willfollow him forever.

A Sentence of Time Served is AppropriateIn Light of Mr.~Monsegur's "Substantial Assistance"

As the government notes in its May 23, 2014 letter, inarriving at the appropriate sentence fora defendant who has providedsubstantial assistance, Section 5K1.1 of the Sentencing Guidelinesencourages Courts to consider, inter alias the significance andusefulness of a defendant's assistance; the truthfulness,


Hon. Loretta A. Preska May 23, 2014Chief United States District Judge Pa e; ,'~;~!,:~I~

tRe: United States v. Hector Xavier Monsegur ~ ILED11 Cr . .6.66 {I~Ap) UNDER SEALcompleteness and reliability of the information provided; the natureand extent of th:e assistance; any injury or risk of injury sufferedby the defendant or his family; and the timeliness of a defendant'sassistance. The defense submits that an individualized assessmentof these factors counsels in favor of a sentence of time served.

Mr. Monsegur's assistance was significant and useful.Indeed, the government describes it as `extraordinarily valuable andproductive." Exh. A at 13. He provided "unprecedented" access tothe targets of law enforcement investigations through both"historical information and substantial proactive cooperation." Id.His efforts led directly to the identification, prosecution andconvictions of seven individuals as well as the identification andprosecution of an eighth who awaits trial. Id. at 14-15. Whilethese arrests and convictions were "extremely important to theGovernment;" they "..only partially convey[) the significance andutility of [Mr. Monsegur's) cooperation." Id. at 15. By providinginfc~rmation~to laic"enforcement regarding on-.going or threatenedcomputer hacks as well as existing vulnerabilities in computersystems, "the FBI was able to thwart or mitigate at least 300 separatehacks." Id. As the government explains to the Court, "[t)he amountof loss prevented by [Mr. ] Monsegur' s actions is difficult to fullyquantify, but even a conservative estimate would yield a lossprevention Figure in the millions of dollars.." Id. Perhaps moreimportant than the dollar value of Mr. Monsegur's cooperation,information he provided allowed law enforcement to proactivelysecure vulnerabilities in "critical infrastructure," including thewater supply of a major U.S. city and the supply chain of a foreignenergy supply company. Finally, the significance and utility of hiscooperation will last far into the future. For example, the lastpiece of his cooperation involved repeated real-time efforts tosecure evidence that firmly links a subject (whom multiple countrieshave expressed interest in prosecuting) to the solicitation of cyberattacks on foreign government computer systems. Although theseefforts -have not yet led to prosecution of the subject, they yielded`significant and valuable" evidence. Id: at 16.

NIz. Monsegur provided the government with truthful,reliable, and complete information. As the government explains inits letter, ~Mr. Monsegur was "fully candid" with law enforcement andprovided information that was "consistently reliable and complete,


Hon. Loretta A. Preska May 23, - 201,Chief United States District Judge Pa e 9Re: United States v. Hector Xavier Monse ur ~~ILED411 Cr . 666 (LAP) UNDER ST''AT.corroborated by documents and electronic files, as well as bystatements from other witnesses." Exh. A at 16. The candidinformation he provided regarding his own criminal conduct wentbeyond 'information that had been available to the government andincluded information about offenses the government likely would haveremained unable to prove, and may not even have discovered, absenthis candor.

Tie nature of Mr. Monsegur's assistance was varied andextensive, both in time - it lasted three years -and in subject matter- he worked with agents and prosecutor from various districts to closepending investigations, prevent future attacks, and gatherinformation that lead to several arrests and convictions. As thegovernment tells the Court, Mr. Monsegur's "cooperation entailedmany multi-hour meetings with FBI agents that :extended. into the lateevening and early morning hours." Exh. A at 16. As discussed above,he not only sat with law enforcement to review historicalinformation, he engaged in round-the-clock online activity at thedirer_tion of laic enforcement. His activity had to be preciselycoordinated with law enforcement officials in different cities and,at times, different countries. He sat through lengthy proffersessions with law enforcement officials from around the country,often being asked to spend hours and hours reviewing information ryehad previously discussed with officials from other jurisdictions.The defense submits that the publicity surrounding Mr.Monsegur' s cooperation makes the nature and extent of his cooperationunique. Most cooperators in this district have their pleaagreements sealed and their cooperation is not revealed until eitherthe eve of a trial at which their testimony is required or their ownsentencing proceedings. Mr. Monsegur's cooperation was verydifferent. 'More than two years ago, Mr. Monsegur's cooperation waspublicly revealed, not because his testimony was needed or forsentencing purposes, but for law enforcement purposes. As mentionedabove, Exhik~it F is a copy of the press release issued by the UnitedStates Attorney's Office for the Southern District of New York onthe morning of the arrest of several of Mr. Monsegur'sco-conspirators. Although the press release did not name him as acooperator, it did single him out as having pled guilty months earlierand informed the press that the documents related to Mr. Monsegur'splea had been unsealed. These documents, of course, revealed his


Hon. Loretta A. Preska Mar

,Chief United States District Judge4

Re: United States v. Hector Xavier Monsegur TO BE FILED11 Cr. 666.(LAPj UNDER SEALcooperation: This public outing of Mr. Monsegur's cooperation wasunprecedented in our experience. Where generally the governmentdoes all it can to protect the identities of cooperators, here, thegovernment sought a deterrent effect by allowing Mr. Monsegur'scooperation to be publicized. While all cooperators understand thatthere may come a time when their cooperation is no longer secret,this case was unique in that the government itself participated inhis unveiling.

AJ_1 of Mr. Monsegur's cooperation was undertaken at greatrisk to him and his family. 2 All of his family gave up a certainamount of privacy as a result of the camera that was installed atMr. Monsegur` s home. Attached as Exhibit J is an example of the typeof iizformation about Mr. Monsegur's family ..t hat has been publishedonline. Although the information released online has not alwaysbeen accurate, it often has been... Mr. Monsegur's own residence, aswell as the home addresses ofwas released online. His

__

.._ ..

One of was cornered by a reporter andquestioned until caved and gave the reporter what the reportercame for:. information related to Mr. Monsegur and his arrest. Ofcourse, chid not fully understand the details ofMr. Monsegur's case, but still caas subjected to questioning. As thegovernment mentions in its letter to the Court, the girls Mr. Monsegurcared for also iaere approached by the press. A reporter actuallyentered their school and attempted to question them about Mr.Monsegur, in clear violation of the school security policy. Theseevents were traumatic for the whole family, not only for the invasionof privacy they represented, but also for the fear it placed ineveryone: i.f the kids in the family were being hounded in theirelementary schools and iri apartment hallways, no one felt safe.Sadly, it is this fear that deters Mr. Monsegur's family from beingby his side in Court. They don't want to subject the children tofurther publicity.

0f course, the risk to Mr. Monsegur and his family was far2 In light of the continuing risk of retaliation against Mr. Monsegurand his family, including the young children, the defense requests that this letterand the documents associated with Mr. Monsegur's sentencing be filed under seal.


Hon. Loretta A. Preska ~ ~~~~ ~3 r ~~' ~ ~~~Chief Unitea States District Judge ~_ ~.~~Re: United States v. Hector Xavier Monsegiar TO SE FILED11 Cr . 666 (LAFj UNDER SEATmore dangerous than that posed by certain members of the press . Oneof Mr. Monsegur's brothers was physically assaulted at a bar in NewYork in retaliation for Mr. Monsegur's cooperation. Thisretaliation was not on behalf of any particular person against whomMr. Monsegur cooperated, but was retaliation for his role as acooperator in general. And as recently as this spring, front-pagenews coverage has contained erroneous reports regarding Mr. Monsegurand attacks on foreign governments. This type of publicity, evenwhen it is incorrect., exposes Mr. Monsegur to real danger and, sadly,shows no sign of abating. This all underscores the fact that thepublicity surrounding his cooperation placed Mr. Monsegur at unusualrisk.

Finally, Mr. Monsegur's cooperation was timely. 1t beganimmediately after agents approached him, .even before he had a chanceto consult c~~ith an attorney. As the government explains in itsmotion, Mr. Monsegur's timely decision to cooperate prevented thedestruc4ion of evidence, allowed the government to develop theevidence necessary for several successful prosecutions, helpedprevent and mitigate hundreds of hacks, and established proof thata significant subject of global law enforcement efforts had beensoliciting cyber attacks against a foreign government. Exh. A at18. Had he not made the decision to cooperate and resumed his onlineactivities immediately, none of this may have happened. His"immed~.ate decision to cooperate was thus particularly important."Id.

Mr. Monsegur has been punished tremendously for hisoffenses. Next week will mark three years that he has been underlaw enforcement supervision. He served seven months at the MCC. 3 Helived under constant law enforcement surveillance for months. Hisconduct since his release from custody in December 2012 makes clearthat no further period of supervision is necessary. Given thethreatened retaliation he has faced, as well as the relentlesspursuit by the press, requiring Mr. Monsegur to report to probation

3 As the government details in its motion, Mr. Monsegur's LulzSecco-conspiratoxs received sentences ranging from probation to 30 months'incarceration. The individual the government describes as "the FBI's most wantedcybercriminal in the world," who had a similar, prior conviction, received asentence of 120 months' incarceration following a plea to a charge that coveredconduct that cccurred after Mr. Monsegur's arrest.


Hon. Loretta A. Pxeska May~23, 2014Chief United States District Judge Page 12Re: United States v. Hector Xavier Monsegur TO BE FILED11 Cr .' 666 (LAPj tTNI?ER SEALfor supervision would only continue. to place him at risk. It wouldalso be greater punishment than is necessary. He has workedtirelessly to right his wrongs; to repay his debt to society. Nofurther punishment is necessary to, affect the statutory sentencingobjectives..

Given the particular circumstances of this case, and inlight of the factors contained in U.S.S.G. 5K1.1, the defensesubmits that a sentence of tune served is the appropriate sentenceto affect these statutory directives.Conclusion

Mr. Monsegur has provided tremendously valuableassistance to the government. Governments around the world willbenefit from his work for years to come.. He helped avert at leastmillions of dollars worth of damage to computer systems around theworld.' He cave everything he had had - all of his time, all of hisenergy, all of his skills - to righting his wrongs, all whilesubjecting himself and his family to retaliation and publichumiliation that will follow them forever.

He _remains a - very dedicated and loyal man, one who believesthat the Internet can be used to enhance freedoms and share knowledge.He has the skills to help any company or government secure theirsystems and prevent intrusions. His own Life has been on hold forthe three years since his arrest. A sentence of time served willacknowledge the extraordinary substantial assistance Mr. Monsegurprovided and wi1.1 allow him and his family to move on to safer,productive lives.


Hon. Larettu A. Preska May 23, 2014.Chief United States District Judge . Page 13Re: United States v. Hector Xavier Monse ur TO11 Cr. 666 (LAPj UN

In light of all of the facts and circumstances of this case,the defense respectfully requests that the Court sentence Mr.Monsegur to time served.

Respectfully submitted,G~ ____

PEGGY CROSS.-GOLDENBERGPHILIP WEINSTEINAssistant Federal Defenders(212.) 417-$732/8744

cc: AUSA James J. Pastore, Jr.


Exhibit A

Case 1:11-cr-00666-LAP Document 32-1 Filed 05/27/14 Page 1 of 21

UNITED. STATES DISTRICT COURTSOUTHERN DISTRICT OF NEW YORK ~~ ~~ _________________________________ .X ~~.pAUNITED STATES OF AMERICA

- v - 11 Cr. 666 (LAP)

HECTOR XAVIER MONSEGUR,a/k/a "Sabo,"

Defendant.---------------------------- -----x

PREET BHARARA.United States Attorney for theSouthern District of New YorkAttorney far the United States

of,AmericaJAMES J. PASTORS, JR.Assistant United States Attorney

__ Of Counsel _ _ _._ _ ._ __ _ ___ _ _._ . _ _ __ __... _. _ _ __ . __ .__ __.. _


UNITED STATES DISTRICT COURTSQUTHERN DISTRICT OF NEW YORK---------------------------------- x

UNITED STATES OF AMERICA

- v - 11 Cr. 66b (LAP)

HECTOR XAVIER MONSEGUR.,alkla "Sabu,"

Defendant.-------------------- ---- - ---x

Preliminary Statement

The Government respectfully submits this memorandum in connection with the

sentencing of defendant Hector Xavier Monsegur, alk/a "Sabu" (the `defendant", or

"Monsegur"), which. is currently scheduled for May 2'l, 2014 at 11:00 a.m. In.its Presentez~ce

Report ("PSR"), the United States Probation Office {"Probation") correctly calculates that the

defendant's United States Sentencing Guidelines ("U.S.S.G." or "Guidelines") range is 259 to

317 months' imprisonment. Probation recommends a sentence of time served.. As set forth. in

more detail below, Monsegur was an extremely valuable and productive cooperator. Assuming

that the defendant continues to comply with the terms of his cooperation agreement, and

commits no additional crimes before sentencing, the Government intends to move at sentencing,

pursuant to Section SK1.1 of the United States Sentencing Guidelines ("Guidelines" or

"U.S.S.G.") and Section 3553(e) of Title 18, United States Code, that the Court sentence the

defendant in light of the factors set forth in Section SK1.1{a)(1)-(5) of the Guidelines, and

without regard to the otherwise applicable mandatory nr~inirnum sentence in #his case.


Statement of Facts

I. Monsegur's Involvement with Anonymous, LulzSec, and Major Cvber Intrusions

Throughout 2011, hackers affiliated with the "Anonymous" movement targeted hundreds

of computer systems around the world, hacking, disabling and at times ex~iltrating data from

those systems. Victims included news media outlets, government agencies and contractors, and

private entities. In approximately May 2011, Monsegur and five other members of Anonymous

formed Lulz Security, an elite hacking collective or "crew" commonly referred to as "LuizSec:''

Monsegur and the other core members of LulzSec typically worked as a team and had

complementary, specialized skills that enabled them to gain unauthorized access to computer

systems, damage,and exploit those systems, and publicize heir hacking activiries, This core

group, among whom, only Monsegur was. identified prior to the time Monsegur bean.

cooperating in the investigation, included:

Monsegur, a/k/a "Sabu," who served primarily as a "rooter," analyzing

code for vulnerabilities which could then be exploited;

"Kayla," who specialized, among other things, in "social engineering"

that is, manipulating others .into divulging personal information such as login. credentials;

"T-Flow," who served as an organizer, analyzing information provided by

members of the group in order to direct other members what to do next;

"Topiary," who served from time to time as the public face of

Anonymous and LulzSec, giving interviews to media outlets and writing public communications

on LulzSec's behalf;

' "Lulz" is shorthand for a common abbreviation used in Internet communications LOL or "laughing out loud." As explained on LulzSec's website, LulzSec.com, the group's unofficialmotto was "Laughing at your security since 20i 1."

2


servers; and

Kayla.

"AVUnit," who provided computer infrastructure for the group such as

"Pwnsauce," who performed some of the same work as Mansegur and

Monsegur and many of these core LulzSec members were also part of another

Anonymous-affiliated group called. Internet Feds which, like LulzSec, engaged in major criminal

computer hacking activity.

Throughout 2011, Monsegur, through Lu1~Sec and Inter.~et Feds, engaged in several

major hacks into and thefts_ fr~ran tie computer servers. of United States and foreign corporations

and other entities including the fol]owing:

HB Gary.., Monsegur directly participated in the. hack of the computer

system of this Internet security firm in response to the .firm's claim, through one of its

investigators, that it had identified the members of Anonymous. This hack involved the theft of

emails and other company information.

Fox Television.. This hack resulted in the compromise of a database of

contestants of a reality TV show called "X-Factor." Monsegur downloaded data from Fnx that

he was able to obtain through his co-conspirators' unauthorized access to Fox's computer

systems.

Tribune Company. A journalist provided his credentials to Internet Feds

in the hopes he would be invited into private chats. Monsegur used the credentials to login to the

Tribune's systems and confirmed that the credentials could be used to gain.access to Tribune

Company's entire system.

3


~ PBS.org. Monsegur was a direct participant in this hack, which resulted in

the compromise of PBS's servers. and the defacement of its website. Monsegur helped identify a

vulnerability and then installed multiple "back doors" on PBS's system that is, he installed

programs that allowed others to later access the computer system.

Sonypictures.com. Monsegur was a direct participant in this hack, in

which the personal identification infoi~nation of customers was stolen from Sony.

Sony BMG sites in Belgium, Russia, and the Netherlands. Monsegur

accessed and downloaded data from the Belgium and Netherlands sites, including the release

dates of records. Monsegur passed iufarmation about a vulnerability for the Russian. website to

other members ofLulzSec for exploitation..

Nintendo. Mo~segur participated in a hack into Nintendo's cornputex

systems, pursuant to which files regarding the structure of Nintendo's computer systems wexe

downloaded.

Senate.gay. Monsegur had knowledge of, and conducted research for, this

hack of the Senate's website.3

Bethesda(Brink video game. Monsegur helped hack into Bethesda's

system, and downloaded information including a database containing personal identification

information.

In.fragardlCJnveillance. Monsegur was a participant in a hack of an FBI

affiliate in Atlanta, which resulted in the theft of confidential information.

z Following his arrest, Monsegur provided information that helped repair and remediatethis hack.

3 Monsegur provided the FBI with information about the vulnerability, which allowed it tobe repaired or "patched."

4


In addition to Monsegur's direct participation in the criminal hacking acrivity set forth

above, Monsegur had contemporaneous knowledge of other major cxiniinal hacking activity by

his co-conspirators, including hacks :into the computer servers of the Irish political party Fine

Gael; a U.S. online media outlet, a foreign law firm, _; and the Sony.

Playstation Network..

In addition to the six "core" members. identified above, several individuals were loosely.

affiliated with Monsegur and LulzSec, including, significantly, Donncha O'Cearrbha 1, a/k/a

"palladium," and Jeremy Hammond, a/k/a "Anarchaos:' Hammond,_the FBI's number one

cybercriminal target at the time of his arrest in 2012, was a prolific and technically skilled hacker

who launched cyber attacks against scores of governmental institutions, law enforcement.

organizations, and businesses, during a nearly year-fang rampage in which lie broke:intg these

victiu~s' computer systems, stole. data, defaced. websites, destroyed files and published. online the

sensitive personal and financial information of thousands of individuals all with the object of

creating, in Hammond's words, maximum "mayhem."

The hacks identified above constitute only a portion of the significant criminal computer

intrusions conunitted by Internet Fads, LulzSec, and their members, including Monsegur. As the

examples make clear, Monsegur and his co-conspirators indiscriminately targeted government

agencies, private companies, and news media outlets. In many instances, the harms inflicted on

these entities were significant, ranging from defacements of their websites to the exfiltration of

personal identification information of customers or employees of the entities; the costs associated

with repairing these attacks ran into the tens of millions of dollars. Monsegur was a key

participant in these Anonymous hacking crews, providing Yus technical expertise to aid in many

of the hacking operations.

5


II. The Complaint, Monsegur's Guilty Plea. and Subseguent Remandiand theGuidelines Calculation

On or about June 7, 2011, the FBI. approached Monsegur in his home and questioned him

about his online activities. Monsegur admitted his criminal conduct and .immediately agreed to

cooperate with Iaw enforcement. That night, Monsegur reviewed his computer files with FBI

agents and provided actionable infornnaton to law enforcement. The next morning, Monsegur

appeared in court on a criminal complaint charging him with credit card fraud and identity theft,

and was released on bail, whereupon he inunediately continued his cooperation with the

Government, as described fuz-t1~er below. Ott or about August 15, 2011, Monsegur appeared

before Your Honor and entered a guilty plea pursuant to a cooperation agreement with the

Government, Pursuant to.the tens of that agreement, Monsegur pled.,guilty to a 12-count

Supersed~.ng Information, S 1 11 Cr. X66, charging him with nine counts related to computex

hacking; one count related to credit caxd fraud; one count of conspiring to commit bank fraud;

and one count of aggravated identity theft. In addition. to resolving the charges brought against

him in the Southern District of New York, Mansegur's guilty plea also resolved four cases filed

against him in other distaicts (including the Eastern and Central Districts of California, the

Northern District of Georgia, and the Eastern District of Virginia) which were transferred to the

Court under docket numbers 11 Cr. 693-696, respectively.

On ox about May 24, 2012, the. Government. moved to revoke Monsegur's bail because he

made unauthorized online postings. Monsegur was arrested and remanded to custody the

following day. He was released on a revised bail package on or about December 18, 2012, and

has remained at liberty since that date. Accordingly, Monsegur has served approximately 7

months in prison in connection with this case.

6


In the PSR, Probation correctly calculates that the defendant's base offense 1eve1 is 7

pursuant to U.S.S.G. 2B1.1(a)(1) and correctly applies a 22-level enhancement in light of a loss

amount between $Zfl million and $50 million; a 6-level enhancement given that the offense

involved more than 250 victims; a 2-level enhancement for sophisticated means; and a 4-level

enhancement given that the defendant was convicted of violating Title 18, United States Code,

Section 1030(a)(5)(A). The defendant receives athree-level reduction far his acceptance of

resppnsibility, resulting in a total adjusted offense level of 38. (PSR ~ 43-59.) The defendant

has zero criminal _history points, and is therefore in Criminal History Category I. (PSR 60-

66.)

Based on an offense level of 38 and a Cri~unal Hisiory Category of I, the defendant's

advisory Guidelines Range is235 to 293 months' imprisonment. (PSR ~ 96.) In addition, absent

the Court granting the,Government's motion pursuant to Title 18, United States Code, Section

3553(e}, the defendant would face a mandatory consecutive term of two years' imprisonment,

resulting in a total advisory Guidelines range of 259 to 317 months' imprisonment.

III. Monse~ur's Cooperation

Monsegur acknowledged his criminal conduct from the time he was first approached by

agents, before die was charged in this case. Monsegur admitted both to prior ci7minal conduct

about which the Government had not developed evidence, as well as his role in both Internet

Feds and LulzSec. Monsegur subsequently and timely provided crucial, detailed information

regarding computer intrusions con~xnitted by these groups, including how the attacks occurred,

This loss.. figure includes damages caused not only by hacks in which Monsegurpersonally and directly participated, but also damages from hacks perpetrated by Monsegur's ca-conspirators in which he did not directly participate. Monsegur's actions personally and directlycaused between $1,000,000 and $2,500,000 in damages. Had Monsegur not candidlyaclrnowledged his affiliarion with the groups that committed the other hacks, his advisoryGuidelines range likely would have been substantially lower.


which members were involved, and how the computer systems were exploited once breached.

As set forth below, Monsegur's consistent and corroborated historical information, coupled with

his substantial proactive cooperation and other evidence developed. in the case, contributed

directly to the identification, prosecution and conviction of eight of 1us major ca-conspirators,

including Hammond, who at the time of his arrest was the FBI's number one cybercriminal

target in the world. On top of that, Monsegur engaged in additional, substantial proactive

cooperation that enabled,tlie FBi to prevent a substantial number ofplanned cyber attacks, as set,

forth below.

A. Monse~ur's Acceptance of Res~onsibility

To begin, with, Mansegux in:unediately admitted, his role in Internet Feds and LulzSec,

including his role in the majox cyber intrusions. setforth in th,e first section of this memorandum.

In addition, Monsegur admitted to playing a role in cyber.attacks and intrusions with these

groups that the Government had not previously known that he,played. For example, Monsegur

admitted to participating in DDoS (Distributed Denial of Services attacks against the computer

systems of PayPal, MasterCard, and Visa, among other targets. Monsegur also admitted to

hacking certain government websites and taking government servers online, to providing

"security research" (that is, publicizing vulnerabilities in computer systems that others could

exploit), and to using his "celebrity" hacker name "Sabu" in the hopes that it would inspire

others to join certain ci~imival activities of these groups.

In addition to his .admission to these crimes, Monsegur admitted to engaging in hacking

activities about which the Government had. not previously developed evidence. According to

Monsegur, between 1999, when he first began hacking computers, and late 2003/early 2004,

$ DDoS attacks involve the use of several computers to bombard a victim's computersystem with connection requests, thereby overwhelming the victim's system, often resulting inthe temporary shutdown of the victim's website.


Monsegur hacked into thousands of computers. For the next approximately two years, Monsegur

identif ed vulnerabilities in perhaps 200 computer systems in an effort to grow a legitimate

computer security fum. Then, starting around 2006, Monsegur hacked into computer . systems

for personal financial gain, or as part of hacker groups that. broke, into systems for a variety of

reasons, including so-called "hacktivism: ' Monsegur admitted that, before joining Anonymous

hacking crews, he hacked into a variety of websites and computer systems including the websites

of several businesses. Through these hacks, Monsegur was able to steal credit card information,

and then sold the credit caxd numbers, gave them away to family members and friends, anc~ used

them to pay his own bills. On at least one occasion, Monsegur was hired to hack into a

business's computer system. He also ,successfully hacked,into a business's website and had

merchandise delivered to hum free of charge.. .

Finally, Monsegur acknowledged a variety of other criminal conduct including sales and

attempted sales of small .quantities ~ofmarijuana; personal marijuana use; illegally possessing an

unlicensed firearm; and purchasing stolen, goods including electronics and jewelry.

B. Monse~ur Assists Law Enforcement in Identifvinu and Lacatin~ LulzSec

Monsegur's primary substantial, assistance came in the fozm of his cooperation against

significant cybercruiunals affiliated with Anonymous, Internet beds, and LulzSec. He provided

detailed historical information about the activities of Ananymaus, contributing greatly to law

enforcement's understanding of how Anonymous operates. Monsegur also provided crucial and

detailed information about the formation, organization, hierarchy and membership of thase

hacking groups, as well as specific information about their planning and execution of many

major cyber attacks, including the specific roles of his co-conspirators in committix~g those

crimes. He also provided historical information that helped resolve open investigations into

D


several computer intrusions committed by members of Internet Feds and LulzSec, including the

hacks identified.above.

In addition to this crucial historical information, Monsegur proacrively cooperated with

ongoing Government investigatipns. Woxking sometimes literally around tie clock, at the

direction of law enforcerz~ent, Monsegur engaged lus co-conspirators in online chats that were

critical to confirming thee identities and whereabouts. During some of the online chats, at the

direction of law enforcement, Monsegur convinced LulzSec members to proeide him digital

evidence of the hacking activities .they claimed to have pxeviously engaged in, such as logs

regarding particular criminal.hacks. When law. enforcement later searched the computers of

particular LulzSec members, they discovered copies of the same electronic evidence on the

individuals' computers. In this way, the. online nicknames of Lu~zSec members were.definitxvely

linked. to their true identities, providing powerful proof of their guilt. Other times, at the,

direction of law enforcement, Monsegur asked seemingly innocuous questions designed to elicit

information from his co-conspirators that, when coupled with other u~.fonnatian obtained during

the investigation, could be used to pinpoint their exact locations and identities. Moiisegur's

substantial proactive cooperation, as set forth more particularly below, contributed,directly to .the

identification, prosecution, and conviction. of eight of his co-conspu-ators, including Hammond.

As disclosed in their communications, Hammond. and. certain other co-conspirators had

learned how to exploit a particular software application vulnerability that enabled him to hack

into many cornpufier servers. At Iaw enforcement direction, Monsegux attempted to learn how

these targets were able to exploit this vulnerability, but was unsuccessful. At the same rime,

Monsegur was able to learn of many hacks, including hacks of foreign government computer

servers, committed by these targets and other hackers, enabling the Government to notify the

10


victims, wherever feasible, so the victims could engage in remediation efforts and prevent further

damage or intrusions.

Monsegur's cooperation was complex and .sophisticated, and the investigations in which

he participated required close and precise coordination with law enforcement officexs in several

locations. For instance, during tha investigation of Hammond, Monsegur (who was then in New

Yark) engaged in online chats with Hanunond (who was then in Chicago), while coordinating

with FBI agents in New York, physical surveillance teams deployed in Chicago, and an

electronic suveillance unit in Washington, D.C.

Monsegur also engaged in a significant undercover operation in an existing investigation

through which, acting at the du~ection of law enforcement, Monsegur fathered evidence that,

exposed a particular subject's role_ in soliciting cyber attacks on a foreign government. T,he ' .

evidence he enabled the Government to obtain was. extremely valuable, and the Government

could not otherwise have obtained it without his assistance. Although this cooperation has not

resulted in any prosecutions to date, the Gaveriunent believes his inforniation, and the evidence

he helped to obtain in this matter, is extremely significant.

C. Monse~ur Assists Law Enforcement in Preventing Hacks

Notably, during the period of his. cooperation, Monsegur received communications from

hackers about vulnerabilities in computer systems, as well as computer hacks that wexe being

planned ar carried out by them. The FBI used this information, wherever feasible, to prevent or

mitigate harm that otherwise would have occurred. The FBI estimates that it was able to disrupt

ox prevent at least 300 separate computer hacks in this fashion. The vicrims included divisions

of the United States.Governrnent such as the United States Aimed Forces (specifically

~~, the United States Congress, the United States Courts (specifically,

l~


,..._ ), and NASA; international intexgovernmental organizations

{specifically, ); end sevexal private companies including a

television netwo~~k ~), a security firm ~_), a video game manufacturer

~), and an electronics conglomerate ~). Although difficult to quantify, it is likely

that Monsegur's actions prevented at least millions of dollars in loss to these victims.

Monsegur also. provided information about vulnerabilities in critical nfrastruciure,

including at a water utility for an American city, and a foreign energy company. Law

enforcement used the information Monsegur provided to secuxe the water utility, and the

information about the energy company was shaxed witlz appropriate goverment personnel. In

addition, when. Anonymous.claimed to have hacked the electrical grid in the United States,

Monsegur commutucated with certain Anonymous members :who revealed that the. claims. were a

hoax. This saved the Government the substantial tune and resources that otherwise. would have

been deployed in responding to.these bogus claims.

Discussion

I. Applicable Law

The United States Sentencing Guidelines still provide strong guidance to the Court

following United States v. Booker, S43 U.S. 220 (20Q5), and United States v. Crosbv, 397 F.3d

103 (2d Cir. 2005). As the Supreme Court stated, "a district court should begin all sentencing

proceedings by correctly calculating the applicable Guidelines range" that "should. be the

starting point and the initial benchmark." Gall v. United States, 128 S. Ct. 5$6, 596 (20x7).

After that calculation, however, a sentencing judge must consider seven. factors outlined

in Title 18, United States Code, Section 3553(a): "the nature and circumstances of the offense

and the history and cha~acteristics of the defendant," 18 U.S.C. 3553(a)(1); the four legitimate

12


purposes of sentencing, see id. 3553(a)(2); "the kinds of sentences available," id. 3553(a)(3);

the Guidelines xange itself, see id. 3553(a)(4); any relevant policy statement by the Sentencing

Commission, see id. 3553(a)(5); "tlie need to avoid unwarranted sentence disparities among

defendants," id. 3553(a)(6); and "the need to provide restitution to any victims," id.

3553(a)(7). See Gall, 128 S. Ct. at 596 & n.6.

II. Evaluation of Defendant's Cooperation

Section SKl.l of the Guidelines sets forth five non-exclusive factors that sentencing

courts are encouraged to consider in detei7iuning the appropriate sentencing reduction for a

defendant who has rendered substantial assistance, including the significance and usefulness of

the assistance; the truthfulness, completeness and reliability of the defendant's information and

testimony; the nature and extent. of the assistance; any. injury suffered, or any danger or risk of

injury to the defendant or his family resulring from his. assistance; and the timeliness of the

assistance.

As to the significance and usefulness of the defendant's assistance, Monsegur's

cooperation was extraordinarily valuable and productive. Monsegur provided unprecedented

access to LulzSec a tightly knit group of hackers who targeted and successfully breached a

variety of caznputer systems operated by governments, businesses, and news media outlets.

Through Monsegur's historical information and substantial proactive cooperation, the FBI and

international law enforcement were able to pierce the secrecy surrounding the group, identify and

locate its core members, and successfiilly prosecute them. In particular, when Monsegur first

was arrested, he provided the FBI with information about the identities and whereabouts of core

LulzSec members. This information helped focus the investigations being conducted by the FBI

and international law enforcement, allowing them to develop additional evidence against

13


LulzSec members. At the direction of law enforcement, Monsegur then engaged in online chats

with various LulzSec members, .convincing them to disclose details that confin~ied their

identities and whereabouts including, as noted above, digital evidence that later was matched to

files stored on the LulzSec members' connputers. Monsegur also provided in-depth information

regarding many of the computer hacks that LulzSec had perpetrated.

Monsegur's efforts contributed. directly in the identification, prosecution, and convictions

of core members of LulzSec, including:

Ryan Ackroyd, a/l~/a "Kayla," Ackroyd was arrested. by authorities in the

United Kingdom.. He pled_ g~ulty and was sentenced to 30 months' imprisonment.

Jake Davis, a/k/a "Topi~r~~." Davis was arrested by authorities in the

United Kingdom. He filed. guilty and was sentenced to 24 months' cust9dy in a young offender

institution.

~ Mustafa A1-Bassam, aJ~c/a "T-Flow: ' A1-Bassam was arrested by

.authorities in the United Kingdom. He pled guilty and was sentenced to a 20 month term, which

was suspended for two years, as well as 300 hours' community service.

~ Darren Marlyn, a/kla "pwnsauce," was arrested by authorities in Ireland.

He subsequently pled. guilty and received a sentence of probation and a fine.

In addition to these core members of LulzSec, Monsegur's cooperation led to the arrest

and prosecution of others who contributed to LulzSec's hacking efforts, including:

Jeremy Hammond, aJk/a "Anarchaos: ' As the Court is aware, Hammond,

the FBI's most wanted cybercriminal in the world at the tune of his arrest, was prosecuted in the

Southern District of New York, pled guilty, and was sentenced by the Court principally to a term

of imprisonment of 120 months.

14


Ryan Clea~ty. GIeary was arrested by authorities in the United Kingdom..

He pled guilty and was sentenced to 32 months' imprisonment.

Donncha O'Cearrbhail, a/k/a "palladium:' O'Cearrbhail was arrested by

authorities in Ireland, pled guilty, and was sentenced to probation and a fine.

Matthew Keys. Keys is currently charged in the Eastern District of

California in connection with his role in permitting unauthorized access to the Tribune

Company's computer systems.

All of these prosecutions wexe extremely important to the Government. As set forth

above, these hackers engaged insignificant cyber attacks against computer systems .that

belonged to government.. agencies.and contractors, nevys media outlets, non-profit. insritutions,

and private .entities., Some of the attaclzs defaced, news media webs~tes, ot~exs rendered ,

government websites inaccessible, and still othexs resulted in the exfiltration of the personal

identification information of victims.

Yet the number of prosecutions to which Monsegur coniribu~ed only partially conveys

the significance and utility of lus cooperation. On a daily basis throughout the suuuner of 2011,

Monsegur provided, inxeal time, information about then-ongoing computer hacks_ and

vulnerabilities in significant computer systems. Through Monsegur's cooperation, the FBI was

able to thwart or mitigate at least 300 separate. hacks. The amount of lass prevented by

Monsegur's actions is difficult to fu11y quantify, but even a conservative estunate would yield a

loss prevention figure in the millions of dollaxs. Moreover, Monsegur provided information

about actual and purported vulnerabilities in critical infrastructure, allowing law enforcement to

respond appropriately.

15


Finally, as set forth above, Monsegur engaged in a significant undercover operation in

which, acting at the direction of law enforcement, he helped to obtain evidence that exposed a

subject's role in soliciting cyber attacks on the computer systems of a foreign government.

While it has not resulted in prosecutions;to :date, this evidence is significant and va~uab~e to the

Governnrient.

As to Monsegur's truthfulness, completeness and reliability, he presented as fully candid,

and admitted not only to crimes about which the Government had gathered evidence, but also

crimes about which the Government had not previously gathered :evidence. Monsegur's

information was also consistently reliable and complete, corroborated by documents and.

electronic flex, as well as by statements from other witnesses. As noted above, while Monsegur

made certain_ unauthorized online postings that xesulted in the revocation of his. bail. and his

incarceration fox several months, following his release from custody in December 2012,

Monsegur made no fiarther unauthorized postings.

As to the nature and extent of Monsegur's cooperation, as noted above, Monsegur has

been cooperating with law enforcement for approximately three years. His cooperation entailed

many multi-hour meetings with FBI agents that extended. into the late evening and early morning

hours. Monsegur provided substantial historical cooperation, as well as substantial proactive

cooperation, and he was prepared to testify if needed. Hovcrever, to date, every defendant against

whom Mansegur has cooperated has pled guilty with the exception of Keys, Who rs awaiting

trial. Monsegur's cooperation no doubt played a significant role in securing several of these

guilty pleas in that, among other things, acting at the direction of law enforcement, Monsegur

obtained incriminating online chats with most of the defendants that constituted strong proof of

each defendant's guilt.

16


The na#ure of Monsegur's cooperation was also somewhat atypical in that his work as a

cooperating witness was made pulilic shortly after the arrest of the. core LulzSec members. This

revelation in itself served an important deterrent effect throughout the hacking community. At

the same time, it resulted. in significant scrutiny of Mansegur and his family membexs.

As to the danger or risk associated with Monsegur's cooperation, Monsegur faced

hardships because of his cooperation. During the course of lus cooperation, the threat to

Monsegur and his family became .severe enough that t}~e FBI relocated Mansegur and .certain of

his family members, Monsegur repeatedly was, approached on the street and threatened.or

menaced about his cooperation once it became publicly known, Monsegur was also harassed by

individuals who ncor~ectly concluded that he participated iii tl~e Government's prosecution of

the operators.ofrhe Silk Road website. `

Moreover, Monsegur has been vilified ozaline by various groups affiliated with the

Anonymous movement, which pai~icularly affected. him given the central role that his online

activity played in his life prior to his cooperation with the Government. Among other things,

certain groups have sought to release. Moiisegur's personal identification information (such as his

exact address) as well as the.personal identification information of certain of his family

members.

Members of Monsegur's family have been threatened because of his cooperation, and one

of those relatives was involved in a physical altercation regarding Monsegur's cooperation.

Monsegur's family members have also repeatedly been approached by members of the media. In

one instance, a reporter was removed from the school of the children fox whom Monsegur served

as guardian after the reporter entered the school and attempted to interview the children.

17


As to the timeliness of Monsegur's assistance, as noted above, he iznniediately

cooperated with law enforcement. Just hours after being approached by law enforcement, he was

back online cooperating proactively.. His timely decision to cooperate helped prevent or mitigate

hundreds. of hacks; allowed the Government to develop sufficient evidence to charge multiple

individuals with serious computer crimes; and revealed a significant subject's role in soliciting

cyber attacks against a foreign government. Had Monsegur delayed his decision to cooperate,

his efforts would have been far less fruitful. In fact, LulzSec had developed an action plan to

destroy evidence and disband if the group determined that any of its members had been arrested,

or were out of touch with the other group members for an extended period of time. Accordingly,

had Monsegur delayed his decision to cooperate and remained offli~e for azi extended period of

time, it is likely that much of the evidence regarding LulzSec's activities would have been.

destroyed, .and members of the group would have become much moxe difficult to locate.

Monsegur's immediate decision to cooperate was thus particularly important to the ultunate

successes that stemmed from his cooperation.

Conclusion

In light of the foregoing facts, the. Goven~unent respectfully requests that, pursuant to

Section 5K1.1 of the Guidelines, the Court grant the defendant a substantial downward departure

at sentencing. In addition, the Government respectfully moves, pursuant to Title 1$, Section

3553(e), for relief from the otherwise applicable mandatory minimum sentence in this case.

Such a sentence will appropriately account for the defendant's extraordinary cooperation, and be

sufficient, but not greater than necessary, to serve the legitimate goals of sentencing.

18


Re~c uest to Seal

The Government respectfully requests that it be permitted to file limited portions of this

submission under seal to protect the identities of certain victims.

Dated: New York, New YorkMay 23, 2014

`Respectfully submitted,

PREET BHARARA'United States. Attorney

By: /S/James J. Pastore, Jr.Assistant United .States AttorneyTel.:. {212) 637-2418

19


March 15, 2014,

H M_ ~'

NY .,

To Whom It May Concern:,

I H `M- i~. Father of Hector X Monsegur Jr. am writing an behalf ofmy son. He is a wonderful son. He has always helped the family and alwaysbeen there forme. 1 am sickly. I have 3 pace makers and ~n asthma#iG, t needmy son to take care of me, I gladly appreciate if you can :take my health intoconsiders#ion and phase let ;by son stay free to help.me cope with my health.gladly appreciate your help and consideration to give my son his freedom.r

Sincerely yours,

H ~ M~{Signature}


exhibit ~


March 10, 201

M D, - ~r T_ ~~

,, :;, ``NY

To Whom It May Concern:

am writing to you on behalf of my brother to please give him a second chance atlife because he is e~cfremely intellgen# and I look up to him.. If he was, to go backto prison it would re~~ly hurfi me and. mike my famiy depressed and ~o throughchanges. Ne is the back bane of our family. He has (aught me to be patient andtake #kings one, day at.a time.. He explain to me hpw precious life is and tells meto appreciate R~. Please find it in your heart to give my brother a chance end Jethim be free.

Sincerely,

M 'D


March 15, 2014

To whom it may concern,

t ~~ ~ ;ow

three children

r H. Monsegur for many years. He has been a good friend to me and my

~ ~ ind ~. He is such a good person that I even

He has always been kind and understanding and a friend that you can counton. He is also a very intelligent human being who has given me good advice and help during my collegeyear in .. Living here in Jacob Riis Affordable Housing has not been easy. He always lookedout for my kids and make sure they go to school too. if you have any question or would like me to testifyin his behalf please feel free to call me at

Sincerer,

~- _ _~"-~~ STATE ~F-N~1N YORK.' C411tV~'Y E?F NE3IV MURK/ J SYVC?~tN T4 BEFt~RE ME THlS~.

. ~~~ ~~,,. .a Y~i1

3lfota , rua++T ,* ~~K~ ~ork~ No.

Qualified In ~ _ : ; ,', .'~yCertificate file ~~. ,---i~'tmission Expires


Exhibit E


12

3

4

5

6

7

8

9

10

11

12

13

14

15

16

I7

18

19

20

21

22

23

24

25

X185rdoe SEALED

UNITED STATES DISTRICT COURTSOUTHERN DISTRICT OF NEW YORK------------------------------x

UNITED STATES OF AMERICA.

v.

Defendant.

------------------------------x

Before :

HGN . L~i~E'11A 1-~ . ~RESKA

APPEARANCES

PREET BF.~United States Attorney for theSouthern District of New York

JAMES PASTORSAssistant United States Attorney

FEDERAL DEFENDANTS OF NEW YORK, INC.Attorneys for Defendant

BY: PHILIP L. WEINSTEINPEGGY CROSS

11 Cr. 666 (LAP)

Arraignment

New York, N.Y.August 5, 201111:35 a.m.

District Judge

SOUTHERN DISTRICT REPORTERS, P.C.(212) 805-0300


X185rdoe SEALED

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

~~

18

19

20

21

22

23

24

25

interests of justice.

MR. PASTORE:

for a moment .

Your Honor, I did want to address bail

THE COURT: Yes, sir.

MR. PASTORE: This is a defendant v,~ho has been charged

with serious crimes. He is facing a significant amount of jail

time. I wanted to briefly address why the government continues

to believe that the bail conditions set by Magistrate Judge

Colt on June 8th continue to be appropriate.

Since literally the day he was arrested, the defendant

has been cooperating with the government proactively. Those

efforts have involved cooperation against targets of national

and international interests. Some of the groups against whom

the defendant, is cooperating are known to retaliate against

people who cooperate with the goveznment in ways ranging from

the mundane, for example, ordering hundreds of pizzas to

someone's house, to much more serious: Calling in hostage

situations in part by using family information and having a

SV~~AT team show up at that person's home. It's actually called

"swatting." It's fair to say that this defendant has already

incurred a significant amount of personal risk by deciding to

cooperate.

As to the cooperation itself, because it involves

efforts against targets both here and abroad, the defendant has

literally worked around the clock with federal agents. He has

SOUTHERN DISTRICT REPORTERS, P.C.{212) 805-0300


X185rdoe SEALED

1

2

3

4

5

6

7

8

9

10

11

12

13

14

l5

16

1~

l8

~9

20

21

22

23

24

25

been staying up sometimes all night engaging in conversations

with co-conspirators that are helping the government to build

cases against those co-conspirators.

During this time the defendant has been closely

monitored by the government. We have installed software on a

computer that tracks his online activity. There is also video

surveillance in the defendant's residence. So, all of his

activities have been closely monitored, which has obviously

been an imposition not only on him but he also has two

daughters that he takes care of, is the foster parent for them.

The results of this carefully monitored cooperation

have already been quite positive. To give the Court some sense

of it, the defendant receives information about security

vulnerabilities from a network, literally a worldwide netv,~ork

of criminals, cybercriminals. On a day-to-day basis the

defendant can sometimes receive upwards of two dozen

vulnerabilities. Working with the FBI, that information has

been used to patch more than 150 vulnerabilities to date.

tn~hen I say "patch," I mean the FBI has been able to

reach out to victims sometimes before the hack has actually

occurred, other times after the hack has occurred but in an

effort to mitigate the harm from that hack. That is, f rankly,

something that we would probably not have been in a position to

do without the defendant's cooperation.

The defendant's information is also helping the



X1~5raoe SEALED 10

1 government close in on several prominent cybercriminals.

2 So, there is every reason to believe that by

3 continuing the defendant's bail, by allowing him to continue to

4 mitigate harm from cyberattacks, to continue to develop

5 evidence against other targets, that will able to mitigate

6 cybercrime and also apprehend some pretty serious

7 cybercriminals.

8 The defendant has been compliant with his bail

9 conditions for more than two months. I think he has shown that

10 at this point he is not a risk of flight, nor is he presently a

11 danger to the community.

12 For those reasons, the government respectfully submits

13 that bail be continued as set by Magistrate Judge Cott.

14 THE COURT: So ordered.

15 Anything else today, counsel?

16 MR. PASTORS: Nothing further from the government.

17 MS. CROSS: No. Thank you, your Honor.

18 THE COURT: The record remains sealed as we have

19 discussed.

2 0 (Adjourned}

21

22

23

24

25



Exhibit F


~`r jr~,,..~ ~;.,/ ~r..: ~, ~~C~

`~ ~~,~ r~: ,~r

~ iir'i~

FOR IMMEDIATE RELEASE CONTACT: U.S. ATTORNEY'S OFFICETuesday, March b, 2012. Press Officehttp://www justice.gov/usao/nys (21.2) 637-2600.

~'BTPress Office(212) 384-2100

Four Principal Mert~bers of ` 'Anonymous''.'. and "~uZzSec"Are .Charged with Computer Hacking,., and a Fifth Member Pleads Guilty

"AntiSec "Member is Also Arrested and Charged with Stealing Confidential Information From.r~ppr~ximately $6Q QDD Clients and Subscribers of StratforFive computer hackers in the United States and abroad were charged,today, and a sixthpled,guilty~ for computer hacking and other craznes. The six hackers identified themselves asaligned with the group Anonymous, which is a loose confederation.of cnmputerhackers andothers, andlor of~shoc~t groups related to. Anonymous, including "Internet Feds," "LulzSec," andt~AntiSec."

RYAN ACKROYD, alk/a "kayla," ~/k/a "lol," a/kia "lolspoon,":JAKE DAMS, alk/a~~`topiary, alkta atopiary, DARKEN MA.RTYN, afkfa `pwnsauce, alkia `raepsauce, a/k/a"networkkittet~," .and DONNCHA O'CEARI2BHATL, a/k/a "palladium," who identifiedthemselves as members of Anonymous, Internet Fels, andlor LulzSec, were charged in anIndictment unsealed today in Manhat-tazi federal court with computer hacking conspiracyinvolving the hacks of Fox Broadcasting Company, Sony Pictures Entertainment, and the PublicBroadcasting Service..{"PBS"). O'CE~.RRBHAIL is also charged in a separate crimuialComplaint with. intentionally disclosing a~a unlawfulty intercepted wire com~unicatzon.HECTOR XAVIER MONSEGUR, alkla "Sabo,' ~Ik/a "Xavier DeLeon," allcla "Leon," iwho also identified himself as a member of Anonymous, Internet Feds and LulzSec, pled guiltyon August 1S, 2011 in U.S. District Count to a 12-count. information charging him with computer xhacking conspiracies and other crimes. MONSEGUR'S Information and guilty plea wereunsealed today. The crimes to which MONSEGUR pled, guilty include computer hackingconspiracy. charges uutially filed in the Southern District of New York. He Also pled guilty tothe following charges: a substanrive hacking charge initially filed by the U.S. Attorney's Officein the Eastern District of California related to the hacks of HB~iary, Inc. and HBGary FederalLLC; a substantive hacking charge. initially filed by the U.S. Attorney's Office in the CentralDistrict of California related to the hack of Sony Pictures Entertai~unent and. Fox Broadcasting


Company; a substantive hacking charge initially filed by the U.S. Attorney's O#fice in theNorthern Disirict of Georgia x~lateci to the. hack of Infragard. Members Alliance; a substantivehacking charge uutially .filed by the U.S. Attorney's Office in the Eastern District of Virginiarelated .ta the.~hack of PBS, all of which were tr~ns~~rred to the Southern District of New York,pursuant. to Rule 2U. of the Federal Rules of Criminal Procedure, in coordination with theComputer Crime and Intelleci~~l Property Section, ("CLIPS") _in the. Justice Department's.Criminal Division. .

Late yesterday,lEREMY H[~~NIMOND., a/kla "Anarchaos," alk/a "sup_g," a/k!a "burn,"s ~ ~~a/kla `yohoho, a/k/a .POW, alkla `tylerknowsthis, a/kla crediblethre~t, who identifiedhimself as a member of AntiSec, was azrested in Chicago, Illinois and charged in a, crunnalComplaint with crimes relating to the .December 201,1 hack of Strategic Forecasting, Ina("Stratfor"), a global intelligence firm in Austin, Texas, which may. have affected approximately86U,000 .victims. In publicizing the ;Strai~f'or hack, members of AntiSec reaffirmed :theirconnection to Anonymous and other related groups, including LulzSec. For example, AntiSecmembers published a document with ].inlccs to the. stolen Stra#fir data entitled: "Anoz~ymausLulzxmas rooting youproud" on a file sharing website.

The following .allegations are based on the Indictment, the Information, the Complaintsand statements made. at MONSEGUR,'s guilty plea:

Hacks by Anonyrr~ous, l'nternet Feds, and .Lulz$ec.,..Since. at least 200$, Ananympus has been a loose confederation of computer ~iackexs andothers. MONSEGUR.,and other members;af Anonymous took responsibility,for a nwnber ofcyber attacks between _December 201 ~ and June 2011:, including denial of service {"DoS")attacks against the websites of Visa, MasterCard, and PayPa~, as retaliation_ for the refusal ofthese companies to pra~ess donations ~o Wikileaks, as well as hacks. or DoS attacks on foreigngovernment computer systems.

$etween December 2010 and May 2Q l 1, members of Internet Feds sim lazly waged adeliberate;campaign of oziline. destruction, intimidation, .and cririunality. Members of InternetFeds, engaged in a series of cyber attacks :that included breaking into computer systems, stealingconfidential information, publicly disclosing stolen confidential information,,laijacking vict%~ns'email .and Twitter accounts, and defacing victims' Internet websites. Specif cally, .ACKROYD,DAVIS, ~VIARTYN, O'CEARRBHAIL, and MQNSEGUR., as me~bexs of InternetFeds,,.conspired to. commit computer hacks. including: the hack of 1tl~e w~bsit~ of Fine Gael, a pok~icalparty in Ireland; the hack of compu#ex systems used, by security firms. HBGary, Inc..anc~ its_.affiliate HBGary Federal, LLC, from which Internet Feds stole. confidential data pertaining to80,000 user accounts; and the hack of computer systems used by Fox. Broadcasting Company,from which Internet Fed.s stole confidential data. relating to more than 70,000 potentialcontestants on "X-Factor," a ~'ox television. show.

In May 2011, following the publicity that they had generated. as a result of their hacks,including those of Fine Gael and HBGary, ACKROYD, DAVIS, MARTYN, and MONSEGURformed and became tl~e principal members of a new hacking group called "Linz Security" or"LulzSec.' Like Internet Feds, LulzSec undertook a campaign of malicious cyber assaults on thewebsites and computer systems of various business and :governmental entities in the UnitedStates and throughout the world.- Specifically, ACKROYD, DAVIS, MARTYN, and


MI

MONSEGIJR, as members of LulzSec, conspired to commit computer hacks i~cludang the hacksof:computer systems used by the PBS, in retaliation for what LulzSec perceived ta.beunfavorable news coverage in an episode o~the news program, "Frantli~~'.'; Sony Pictures.Entertauunent, in which LulzSec stole confidential data concerning apprpte~y 100,000 usersof Sony's website; and Bethesda Softworks, a video g~,mme company based. in Maryland, in whichLulzSec stole co~dent~al information for approximately 200,OOQ users of B~thesda's webs te. ,

.The Stratfor Hack.

In December 2011, HAMMOND conspired to hack into computer systems. used byStratfor, a private firm that provides_goyernments:and others with independent geopolitic~ianalysis. HAMMOND and his coco~spirators, as members of AntiSec, stole, confidential .;information from those cor~puter systems, including Str~tfor employees' emailsas well as '.account. information. for approximately 860,000 Stratfor subscribers ~r clients. HAMMOND .andlus co-conspirators stole credit card information for approxi.m~ately b0,000 credit cazd users andused some of the stolen data..to make unauthorized charges exceeding $700,000. HAMMONDand his co-conspiratory also publicly disclosed sgrne of the confidential. information they badstolen. _ .

The Hack of International Law Enforcement

In January 2012., O'CEARRBHATL hacked into .the personal email account ~f an officerwith Ireland's nattonal .police service, the An Garda. Siochana (the "Garda'.'). because the .Garda.,officer hall forwarded Work emails to a personal account, O'C~ARRB.HAIL learned informationabout how: to access a conference call that the Garda, the. FBI, and, other law enforcementagencies :were planning to hold on January 17, 2012, regarding international investigatigns ofAnonymous and other hacking groups,. O'.CEARRBHAIL then accessed and secretly recordedthe January 17 international law enforcement conference ca11, and then disseminated theillegally-.obtained recording toothers.

~ ~ ~

IvIONSEGUR, 28, of New York, New York, pled .guilty to three counts of computerhacking conspiracy, five counts of computer hacking,,ane count of computer hacking infurtherance of fraud, one count of co~asp racy to commit access device fraud, one .count ofconspiracy. to commit bank fraud, and one count of aggravated identity theft. He. faces, amaximum sentence of 124 years and six months in prison.

ACKR.OYD, 23, ofDoncaster, United Kingdom, DAVIS, 29, of Lerwick, ShetlandIslands, United Kingdom, MARTYN, 25 of Galway, Ireland, each are charged with two countsof computer hacki~,~ conspiracy, Each conspiracy. count carries a maximum sentence of 1 Q yearsin prison.

O'CEA.RRI3HATL, 19, of Birr, Ireland is charged in the Indicirnent with orie count ofcomputer hacking conspiracy, for which he faces 10 years in prison. He is also charged in theComplaint with one count of intentionally disclosing an unlawfially intercepted wirecommunication, for which he faces a ma~mum sentence of five years in prison.


v~'

HA~MMOND, 27, of Chicago, Illinois, is charged with one count of computer hackingconspiracy, one count of computer hacking, and Qne count. of conspiracy to commit accessdevice fiaud.. Each count carries a ma um sentence, of 1 Q years in prispn.

DAMS is separately facing criminal chaxges in the United Kingdom, which remainpending, .and. ACKROYD, s being interviewed #oday by the Police ~en~ra,~, e-crime. Unit in theUnited Kingdom.. O'CEAItRBHA~L was ,arrested today by the Gaarda

'The case is being prosecuxed by the. U.S. Attorney',s :Office. for the Southern District ofNew York. The investigation was initiated and led by the FBI, and its New York, Cyber Crime ',Task Force, vvh cl~ is a federal, state. and local law enforcement task farce combating cybercrime,with assistance from the PCeU; a unit of New Scotland.Yard's Specialist Crime.D rectorate,SCD6; the Garda; the Cruninal Division's CCiPS; and the U.S. Attorneys' Officesfor the...Eastern District of California, the Central District o California, the Northern Dzsirict of Georgia,and.the Easters District of Virginia; ~s well as the Criminal Division's Office of InternationalAffairs. _

The charges contained in the Indictment and Complaints are merely accusations, and thedefend~.nts are presumed innocent unless and until proven guilty.

12-068 ###,


Computing Essintials

This is a 5 HOUR CLASS

Overview

in a wprld where information increases exponentially, individuais are expected to develop and usecritical-thinking and decision-making skills. Digital taois enhance society's emerging abilities. to analyze,synthesize, and evaluate information. The integration of technology systems expands and optimizestheir ability to use information and to communicate and collaborate with diverse individuals to expand.the knowledge and skills necessary for solving both hypotheti~ai and authentic problems.

In a global world community, individuals are expected to be responsible digital citizens who practicesafe, legal, a.nd responsible use of technology systems and digital media, Individuals must comprehendthe impact of technology on the culture, social, economic, environmental, and political aspects ofsociety., Positive attitudes toward technology use are essential to support collaboration, learning, andproductivity fQr success in the twenty-first century.

Intro to Computers: 5 weeks

Week 1:

1. Identify basic parts of various technology systems, naming input and output devices, lE input-keyboard, stylus, output: printer

2. Identify applications and operations of various technology systems IE: Appi~cations-wordprocessing; operations-opening, closing, and, saving files

Documents

Hector Sabu Monsegur Sentencing Order and Background