SALT LAKE CITY — A 22-year-old "hacktivist" who breached two Utah law enforcement websites last year was sentenced Thursday to three years in federal prison.
John Anthony Borell III, of Toledo, Ohio, pleaded guilty to five counts of computer intrusion for hacking into police websites in Salt Lake City, Los Angeles and Syracuse, N.Y., the city of Springfield, Mo., and pendletonundergound.com. Prosecutors say his actions compromised the personal information of thousands of people and cost more than $226,000 in website repairs.
"Regarding all of these hacks, I knew what I was doing was illegal," he wrote in his plea agreement with federal prosecutors.
U.S. District Judge Robert J. Shelby called it a "fair and reasonable" resolution. He noted in court Thursday that he read through Borell's personal history prior to sentencing with "interest and sadness," and warned him to stay away from "self-medicating drugs" and guns. But with a new family and support system at home, Shelby said he does not expect Borell to re-offend when he is released.
"We don't want to see you in court again," he said during sentencing.
But Shelby also cautioned Borell that he had "a challenging road ahead." He said he believes incarceration and treatment will actually be beneficial, and told him that this was a "new chapter, new start" in his life.
"You'll have to decide whether to put (your past) behind you," the judge told him.
Borell, 22, claimed his primary motivation to hack the Salt Lake police website was SB107, a legislative bill that would have made it a crime to possess graffiti paraphernalia. The bill did not pass the Utah Legislature.
Borell accessed a server hosting a website for the Utah Chiefs of Police Association on Jan. 19, 2012, and one hosting the Salt Lake City Police Department website on Jan. 31, 2012. He then tweeted about it, providing usernames and passwords to the site.
"I just need it back up for 30 seconds so I can log in and rick roll them all," Borell posted on one of his many Twitter accounts on Jan. 19, according to court documents.
The self-proclaimed "hacktivist" — a slang term for hacker activism, the act of breaking into computer systems for political or social purposes — continued taunting the agency with various tweets, according to court documents. "Looking at the files I snagged from you SLCPD, it seems these files can out your confidential informants. You should up your security," one stated.
The chiefs' website incurred $145,500 in damages, while Salt Lake police damages totaled nearly $33,000.
A Salt Lake-based Associated Press reporter contacted a man claiming to be responsible via Twitter, asking for more information. Borell responded with, "It was at the time an unrelated hack, just one I was working on, but I decided it was a good spot to spread the message about megavideo."
Megavideo and Megaupload are file-sharing websites that allowed users to share and watch files, many of them illegal. Federal agencies shut down the sites on Jan. 19, prompting hackers from "Anonymous" — an Internet group with no defined leadership or membership that targets various agencies, specifically law enforcement — to retaliate by launching an attack on federal and public websites.
Another tweet stated: "SLCPD. Shut Down The Website, But Its Too Late For Damage Control. I Have Your Crime Tip Police Reports. Will Keep Them Safe For You."
Salt Lake City took down the police website after noticing what had been done, specifically additional pages had been added to the site the agency uses to communicate with media and the public.
KSL reporter Shara Park and other local news media had online conversations with the tweeter "ItsKahuna."
The poster said he could provide a "sample of the released file" and shared a submission from the traffic complaints section of the police database. He also confirmed that he was part of "Anonymous" and that he was responsible for hacking into the Salt Lake police website.
In another conversation, ItsKahuna wrote, "haha they wont ever find me, im too awesome :) Trust me, I wouldnt have gotten away with as much as I have if I wasnt careful enough to make sure I dont get caught Im like the gingerbread man, no one can catch me :P"
Shelby agreed to have Borell serve his time in a federal prison in Michigan that was close to his hometown of Toledo. He set Dec. 6 as the deadline for him to surrender to officials to begin serving his time, so he could spend one more Thanksgiving with his new family.
In addition to 36 months' incarceration, Borell will be on 36 months' supervision when he is released and will have to submit to some random drug testing. The judge also ordered a DNA sample collected for the federal database, mental health treatment, and for Borell to be part of the government's Computer and Internet Monitoring Program.
Shelby waived a fine but did order Borell to pay a total of more than $227,000 in restitution to the various law enforcement agencies.