Hacker who stole from stars is sentenced

Oregon man gets 6 months in federal prison for accessing and saving scores of personal photos.

A federal judge sentenced a man to six months in federal prison Thursday for hacking into hundreds of Apple and Google accounts and stealing scores of personal photos, including some belonging to celebrities.

U.S. District Judge John A. Kronstadt also issued a $3,000 fine to Andrew Helton, who pleaded guilty to a federal hacking charge in February, according to the U.S. attorney’s office in Los Angeles.

Helton, a 29-year-old resident of Portland, Ore., acknowledged that for two years starting in March 2011 he operated a phishing scheme that gave him usernames and passwords for 363 email accounts, prosecutors said.

As part of the ruse, he sent emails that asked Apple and Google users to “verify” their accounts. After clicking on the link, the users would see a faux log-in page for Apple or Google and would unwittingly hand over their login information by entering their password and username, according to court documents.

With the private information, Helton canvassed the email accounts and retrieved 161 nude or partially nude images from more than a dozen people, including well-known figures in the entertainment industry.

“He systematically searched for and stole intimate images and stored them in his own computer for personal use, which meant the victims continued to suffer as a result of his voyeurism,” U.S. Atty. Eileen M. Decker said.

“Helton's crime was a deep invasion of privacy that caused real harm.”

The victims of Helton’s scheme were not named by prosecutors. One victim, identified as “R” in court papers, submitted a letter to the judge attesting to the harm done by the hack.

“It has caused me sleepless nights and a lot of stress which ultimately affected my work,” the person wrote.

“I felt extremely violated, something that was so personal was taken from me.”

Before the judge imposed the prison term, defense attorney Shannon L. Gray pointed out in a memorandum to the court that her client immediately accepted responsibility and cooperated with authorities.

The lawyer described Helton as suffering from bipolar disorder and said he entered treatment shortly after federal authorities conducted a search warrant on his home. Around the time of the hacks, he was coping with the cancer diagnosis of his father, the death of his dog and the end of a sevenyear relationship, Gray told the judge.

The attorney also disputed any characterization that Helton was a sophisticated hacker and noted that he has two master’s degrees in fields unrelated to technology.

“Phishing emails and scams have been around since 1995 and are one of the least advanced ways to hack a user’s account,” Gray wrote.

Helton, who is scheduled to report to prison by Oct. 11, is the latest to be prosecuted for hacking the accounts of celebrities. Visibility of such crimes was elevated in “Celebgate” — the widespread posting of stolen, nude celebrity photos on the Internet in September 2014. Photos of actress Jennifer Lawrence and model Kate Upton were among those published online. But the investigation into Helton preceded “Celebgate” by more than a year.

In May, Ryan Collins, 36, of Pennsylvania pleaded guilty before a federal judge in Los Angeles to carrying out a phishing scam that netted the login information to 50 Apple accounts and 72 Gmail accounts.

Collins was the first person to plead guilty in connection with the investigation that launched after “Celebgate.”

Helton said in a letter to the judge that he regretted what happened but that his manic and obsessive-compulsive behavior led him to carry out a scheme that he still does not fully understand.

“There was no expertise involved. All I did was essentially copy and paste,” he wrote.

He said he didn’t target people but simply found several contact lists online.

“Those who read about my case probably imagine me in a room hatching fiendish plots to take advantage of people,” Helton wrote. “The truth is, when this was going on, it was usually filled with tears and suffering.”

‘I felt extremely violated, something that was so personal was taken from me.’ —“R,” one victim of Andrew Helton, who hacked into hundreds of Apple and Google accounts