From guns and fast cars to desolate cell... turbo-charged fall of the NHS hack buster
BY ANYONE’S standards, it has been a tumultuous few months for computer geniusMarcus Hutchins, now languishing in an FBI holding cell in Las Vegas . First , the 23- year-old was dragged reluctantly into the spotlight after stopping a worldwide cyber attack. Hailed ahero,he worked his magic from his small bedroom, strewn with pizza boxes , a this parents ’home in these a sidetown of Ilfra combe, Devon. But in a dizzying fall from grace,the so-called ‘ethical’ hacker, who breaks into systems to improve security, now stands accused of criminal hacking himself–and could-face up to 40 years in a US jail. So has Hutchins, a keen surfer, whooccasionally helps the British security services, really switched sides? Hisfriends and colleagues doubt it very much. Whatever the truth, one thing is forsure: he doesn’t appear to be a typical hacker. Normally preferring life inthe shadows, if they leave footprints at all it’s normally the online kind. But having complained about being unmaskedafter his heroics in May, Hutchins flewearlier this month to Vegas for asecurityconvention,where, in his downtime, he appeared to enjoy the kindof fast living far removed from geekery. What’s more , he flaunted his bling-filled so journ on social media. Where in Nevada , he asked his Twitter followers ,could he put arented £500,000 Lamborghini through it spaces without risking arrest? Along with a few pals ,known online by the name Malware Tech– stayed in a sprawling £1,500- a-night villa , said to boast the largest private pool in town , with sand flown in from Malibu beach . There’ s also a champagne-filled Jacuzzi known as the BubblyTub. At one point during his break ,
Hutchins posted a picture of a pairofloafers, a gift from his bossthat, he said, cost more than hisentire wardrobe.
Onlinefootage also showed himfiring a powerful machine gun at aNevada firing range.
Cyber security expert Kevin Collier, who had dinner with
Hutchins in Vegas, told The Mail onSunday he ‘came across as a sweetyoung guy who was having a rareweekend away from home and wassqueezing in as much party in gashe could’. But then the fun stopped.News broke last week that Hutchinshad been arrested in an FBI
swoop. He was accused of creating software used to raid bank accounts that was sold online.
Computer security experts believe that a co-defendant in the conspiracy between July 2014 and July 2015, whose name has been redacted from the six-count indictment, may have framed Hutchins.
Others simply stress he is one of the good guys: one of the much sought-after ‘white hats’ who defend networks from so-called ‘black hats’ or criminal hackers.
The Mail on Sunday has been told that Hutchins, though UK-based, works for a US firm called Kryptos Logic and is paid a sixfigure salary.
While he awaits the chance to mount his defence, he remains in his cell, seven miles north of the famous Vegas Strip, clad in a prison-issued yellow jumpsuit with ‘detainee’ stamped on the back, orange Crocs on his feet and a GPS tag around his ankle.
Yesterday he appeared in court where further details of the case against him began to emerge. He is accused of creating and transmitting the program called Kronos.
His co-defendant is accused of advertising and selling it on the dark web marketplace AlphaBay, which was shut down last month.
Dan Cowhig, prosecuting, said the evidence against him included an alleged confession during a police interview. ‘He admitted he was the author of the code of Kronos malware and indicated he sold it,’ Mr Cowhig said.
After the hearing Hutchins’s lawyer Adrian Lobo said he plans to plead not guilty to all charges.
Although she managed to win bail for him yesterday, he will remain in a cell until tomorrow.
She said: ‘He has dedicated his life to researching malware, not trying to harm people. Use the internet for good is what he has done. He was completely shocked, this isn’t something he anticipated. He came here for a work-related conference and he was fully anticipating to go back home and had no reason to be fearful of coming or going from the United States.’
Robin Edgar, an ethical computer hacker who knows Hutchins, said: ‘We are fairly upset because it looks like he has been picked up off the airport, almost kidnapped by the FBI. He disappeared completely off the radar for about a day with no way of finding him.’
Another friend, Andrew Mabbitt, said: ‘[Marcus] did not have a lawyer for the first 48 hours, and had no outside contact with friends or family. He still has not had contact with his parents.’
The charges follow an FBI sting operation in which agents posed as criminals looking to buy Kronos. According to prosecutors Hutchins and an unnamed co-defendant discussed the virus in an online chat.
But Mr Edgar said: ‘If you look at his Twitter account, he posted a piece of code in January 2015 showing a vulnerability in some software. In February, a version of Kronos came out and the...day after he posted a Tweet saying look this Kronos thing has stolen my code and used it...
‘So he was very unhappy that his code had been stolen and used within Kronos. He did not write Kronos, it looks like, but he wrote a little piece of code that was used in the malware.’
Next week Hutchins will appear in court in Milwaukee in the Midwest state of Wisconsin to face trial.
A British cyber security expert said: ‘He has a close relationship with law enforcement through his work, including the FBI. He makes an absolute fortune on legitimate work, it’s a complete surprise.’
Hutchins’s mother Janet Hutchins has said her son’s involvement was ‘hugely unlikely’ because he has spent enormous amounts of time and even his free time’ combating malware.