Serial hacker, doxxer, and swatter sentenced to two years in prison

He and others "embarked on this digital crime spree to entertain themselves."

The site Exposed.su published the birthdays, addresses, phone numbers, and Social Security numbers of dozens of celebrities and public officials, including the heads of the FBI and CIA.

krebonsecurity.com

A 22-year-old hacker has been handed a two-year prison sentence for his role in doxing and swatting politicians, celebrities, prosecutors, the first lady, and security journalist Brian Krebs.

While cooperating with the FBI after his 2012 arrest on unrelated charges, Mir Islam doxed and swatted as many as 50 people, authorities said. Those who were doxed had their information appear on a website Islam ran called "Exposed." Victims included First Lady Michelle Obama and Vice President Joe Biden. Those who were swatted include Stephen P. Heymann, the Massachusetts federal prosecutor that handled the Aaron Swartz prosecution; security journalist Brian Krebs; Wayne LaPierre, the CEO of the National Rifle Association; and Mike Rogers, a former GOP representative from Michigan and a key supporter of the Stop Online Piracy Act.

Islam also orchestrated a phony threat of an active shooter at the University of Arizona.

According to Krebs:

On March 14, 2014, Islam and a group of as-yet-unnamed co-conspirators used a text-to-speech (TTY) service for the deaf to relay a message to our local police department stating that there was an active hostage situation going on at our modest town home in Annandale, Va. Nearly a dozen heavily-armed officers responded to the call, forcing me out of my home at gunpoint and putting me in handcuffs before the officer in charge realized it was all a hoax.

Prosecutors urged District Court Judge Randolph Moss in Washington, DC, to hand the defendant nearly four years in prison. The defense sought no prison time (PDF) and said the Bangladeshi-born hacker suffered from depression and a bi-polar disorder.

"I didn’t expect to go as far as I did, but because of these disorders I felt I was invincible," Islam told the judge at his Monday sentencing hearing, according to Krebs. “The mistakes I made before, I have to pay for that. I understand that.”

The defendant was originally arrested in 2012 in connection to an FBI sting in which he was trying to buy and sell stolen credit cards. He pleaded guilty, got a day in jail, and then cooperated with federal authorities. But all the while, Islam was participating in the doxxing and swatting scheme.

Islam secretly pleaded guilty on July 6, according to court documents. (PDF) The charges included conspiracy, making false bomb threats, and cyber-stalking.

Prosecutors wrote:

In accordance with his plea and accompanying Statement of Offense, Islam acknowledges a general pattern of criminal conduct from February 2013 through September 2013 in which he, and others conspiring with him, used the Internet intentionally to harass, intimidate, assault, harm, or inflict substantial emotional distress upon dozens of celebrities and state and federal public officials, and a student at a university, none of whom Islam knew personally. Islam and his coconspirators embarked on this digital crime spree to entertain themselves; to exact revenge for official conduct they found objectionable; to express animus; for their own notoriety; and, in the case of the university student, to inflict emotional distress because the student spurned contact from Islam who had developed an online obsession with her. Some of the victims, to this day, continue to suffer from the aftereffects of Islam's and his coconspirators' criminal conduct.

Prosecutors have not publicly named who was working with Islam.