Sex, Drugs, and the Biggest Cybercrime of All Time

Page 3 of 6

"He wasn't as interested in the ideology," Stephen would later recall. Albert just wanted to hack shit for fun — and maybe for profit. Not as a white hat, of course; he'd never sell out. Instead, he coined a new term to describe the role he saw for himself. He'd be a "green hat" — the color of money. Albert wanted a wife and kids someday, and he could already foresee that raising a family would require some serious cash. "What good will a couple million dollars do?" he asked Stephen. "You have health problems, your kids need braces, you pay for their college — your money goes right down the drain."

Albert's initial attempts to succeed in the real world got off to a rocky start. He dropped out of Miami Dade Junior College in his first semester, bored by his intro computer courses, and moved to New York to work for a dot-com firm that soon went bust. He landed another job, at Siemens, but bailed when the company moved to Pennsylvania. In 2002, unemployed and liberally self-medicating, Albert took his first stab at being a green hat: He became one of the leaders of an Internet "carding" forum called Shadowcrew, where thousands of international criminals exchanged services, from selling fake driver's licenses and Social Security cards to stolen credit- and debit-card numbers. But while Albert was good at orchestrating such deals, he didn't know how to stay off the police's radar. In 2003, he was arrested in New Jersey after withdrawing money with a fake bank card from an ATM. He had 15 phony cards in his possession.

Where another hacker might have seen jail time, Albert saw opportunity: He allowed himself to be recruited as a key informant for "Operation Firewall," a federal cybercrime task force that was trying to take down Shadowcrew. Albert proved to be a diligent snitch, ratting out his fellow hackers to the Secret Service. At the same time, he was studying the agents he worked with — their tactics, their mind-set — and realizing how little they actually understood. "These people are fucking retarded about anything other than jumping in front of a bullet," he told Stephen, insisting that they knew too little about computers to have any real impact on cybercrime. In a perverse way, his work for the government only encouraged his criminal behavior and pushed his wayward ambitions into the stratosphere. In Albert's mind, his value to the Secret Service reinforced just how special his skills were — and what a unique position he was in.

"That is a very big problem with using sources," says E.J. Hilbert, a former FBI cybercrimes agent who went undercover for Operation Firewall. "While working as an informant, Albert obtained insight. Even if his handlers tried to not show him everything, he got a pretty good idea of how things were going to play out." In October 2004, the feds arrested 28 members of Shadowcrew for stealing 1.5 million credit-card numbers — thanks in part to information supplied by Albert. By that point, however, Albert already had a big plan of his own under way. He named it "Operation Get Rich or Die Tryin'."

It didn't start out as some well-organized criminal enterprise. "It wasn't anything official," recalls Patrick Toey. "It was just something I was doing for money. And as a favor to Albert. Because he was a friend." In Patrick, Albert had found his perfect street operative. The two had become fast friends through Internet Relay Chat, but they didn't begin hanging out until four years later, in 2003, when Patrick boarded a bus from his home in Virginia Beach and headed to New York for his first "cashout" trip as a member of Shadowcrew. Only 18, Patrick was making the trip with the blessing of his mom, who needed the rent money.

Arriving in New York, Patrick climbed into Albert's Honda Accord, where he helped himself to a pot cookie from a package at his feet. He and Albert had come prepared for their mission with stacks of blank ATM cards, procured online, upon which they had encoded stolen account data by swiping them through magnetic-stripe readers plugged into their laptops. Together the two friends began scurrying from ATM to ATM with the rigged cards, punching in the PIN numbers they had scribbled on the cards with a Sharpie. Soon the pockets of their cargo pants were bulging with twenties.

Raised in a down-and-out home with a shifting cast of characters, Patrick had started smoking pot at 11, left school at 15 and, shortly thereafter, was busted by the FBI for hacking an Internet service provider. With his lanky swagger and shorn blond hair, he bore a passing resemblance to Eminem in more ways than one: Patrick was also a furious intellect who always seemed one step away from self-immolation. An aimless loner and reliable hacker, he was quiet and laconic, except when provoked — in which case he was always up for a brawl. "If Patrick gets pushed to his limits, he's ready to throw down, a zero-to-90 kind of thing," Stephen says admiringly. "He's like the skinny guy you gotta watch out for, the one who's really fucking crazy."

Operation Get Rich began in Miami. Hackers recruited by Albert would drive up and down U.S. 1, a busy artery of strip malls and traffic lights, with their laptops open, searching for retail stores with open wireless networks, a technique called "wardriving." When they found an open network, they would park in a nearby lot or rent a hotel room close by and swiftly hack into the store's payment database. Then they would bide their time. From that point on, each time the store swiped a card, the hackers could capture its data and send it on to Albert. Albert would then forward the data to Patrick and other hacker allies across the country, who would decrypt and encode the data onto bank cards, cash them out at ATMs, and mail Albert's share to a drop box in Miami. Raised as a Catholic, Albert felt a pang of guilt about the people whose accounts he was raiding — "We're definitely going to hell for this," he told Patrick. But once the fraud was detected, Albert rationalized, the credit-card companies would restore people's money. "And he didn't give a fuck about the credit-card companies," says Patrick.

It was a decent plan but inefficient and risky: Each exploit was limited to a single store, and the hackers were sitting ducks out there in the parking lot for hours at a time. "Being parked out front with an eight-foot antenna isn't the most graceful way of getting in," observes Patrick. What Albert needed was a "sniffer code," a hacking program that would intercept payment data at a higher level. With a well-crafted code, he could follow the chain of network vulnerabilities up from a retail store and into its parent company's larger corporate database, capturing far more data with far less exposure. Albert lacked the technical skills to write such a code himself, but he knew exactly who to call for help. He fired off an IM to Stephen Watt.

By then, Stephen was working in the IT department at Morgan Stanley in New York, having graduated from college at 19, but he found the nine-to-five existence of cubicles and coffee breaks stifling. He lived for the weekends, when he would head to after-hours clubs and trip on LSD, which had quickly become a cornerstone of his lifestyle. He also spent his off-hours writing whatever computer code Albert asked for, including programs to break into networks at bizrate.com and Florida International University. Conventional ethics meant nothing compared to the brotherhood of the hackers. "I never had a moral problem giving him something," Stephen says. "As a friend, my willingness to please him may have overshadowed the way I saw my own moral responsibility." Despite having never lived in the same city, he and Albert had grown even closer over the years. At one point, when Stephen and his live-in girlfriend broke up, Albert had flown up from Miami to help him move, telling Stephen that he needed to drive the U-Haul because Stephen was such a lousy driver. "He spent more money getting to me than I spent on the move," recalls Stephen.

So when Albert asked him to write a sniffer code, Stephen was happy to oblige. He dashed it off in 10 hours — an eye blink, in hacker time — giving it the throwaway title "blabla." He knew better than to ask what Albert needed it for. "Albert was very careful not to give any of the people he worked with, myself included, too much information," Stephen says. "But we all knew what we were getting into."

To read the new issue of Rolling Stone online, plus the entire RS archive: Click Here

Culture Main Next

blog comments powered by Disqus
Around the Web
Powered By ZergNet
Daily Newsletter

Get the latest RS news in your inbox.

Sign up to receive the Rolling Stone newsletter and special offers from RS and its
marketing partners.


We may use your e-mail address to send you the newsletter and offers that may interest you, on behalf of Rolling Stone and its partners. For more information please read our Privacy Policy.