AT&T hacker seeks sentencing leniency

Lawyers claim iPad 3G account hacker Andrew Auernheimer's exploits did not cause any actual damage

Andrew Auernheimer, a hacker who was convicted last November of illegally accessing emails and other data belonging to 120,000 iPad 3G owners from AT&T's networks is seeking leniency in his sentencing from the court.

In a memo filed Wednesday in United States District Court for the District of New Jersey, Auemheimer's lawyers maintained their client did not deserve to be jailed for his actions. Rather than years in prison, Auemheimer deserved only months of non-custodial probation, the memo noted.

"The sentence which the Defense suggests to the court ... would be adequate but no greater than necessary to accomplish the purposes of sentence," the memo said.

Auernheimer was found guilty last November on charges of conspiracy to access a computer without authorization and fraud in connection with personal information. Prosecutors have recommended that Auernheimer receive a sentence of 33 to 41 months when he comes up for sentencing on March 18.

Auernheimer made headlines in June 2010 when he and co-accused Daniel Spitler used an automated script they called iPad 3G Account Slurper to extract email addresses and SIM card ID numbers of more than 100,000 iPad owners from AT&T's servers. The duo claimed they carried out the exercise to demonstrate how AT&T was leaking the data via its Web site.

The data accessed by Auernheimer and Spitler included email addresses belonging to New York Mayor Michael Bloomberg, New York Times CEO Janet Robinson, ABC's Diane Sawyer, movie producer Harvey Weinstein, former White House chief of staff Rahm Emmanuel and numerous others. The data ended up being posted publicly on Gawker and other websites.

Auernheimer, and Spitler claimed they pulled the hack purely to highlight the vulnerability on AT&Ts network. Prosecutors however saw it differently.

Aurenheimer was arrested in 2011 on charges of identify theft and conspiracy to gain unauthorized access to computers.

In their complaint, prosecutors noted that Auernheimer, who used the online handle "weev," not only took credit for the breach but openly boasted about it to the media and others. They described Goatse Security, the hacker group that Auernheimer belonged to, as a group of trolls bent on disrupting services and content on the Internet.

The federal complaint against the two defendants contained numerous excerpts of interviews with the media where Aurenheimer boasted of his hacking abilities. One excerpt is from a 2008 interview with the The New York Times where Auernheimer is quoted as saying, "I hack, I ruin, I make piles of money. I make people afraid for their lives."

Prosecutors also highlighted how Auernheimer, in a video posted on his website, boasted how he had caused a one billion change in's market capitalization through his trolling activities. "So a billion dollars changed hands as a result of my trolling and I'm very, very glad to know such insignificant things on the Internet can have such a drastic, far reaching effects."

Prosecutors presented several chat transcripts between Auernheimer and Spitler to bolster their claim that the two hackers extracted the data to attract publicity to their activities, and to promote themselves within the hacker community and the media at large.

In Wednesday's pre-sentencing memo, Auernheimer's lawyers sought leniency on the grounds that the exploit did not cause any damage to AT&T. They noted that the two hacker had not subverted any passwords or used any malware to gain access to the data. They disputed AT&Ts claim that the incident had cost the company more than $73,000.

In their memo, Auernheimer's layers noted that the costs AT&T incurred were related to the company's duplicative efforts to notify affected iPad users of the compromise. The company had already informed the affected users by email of the incident but then needlessly followed them up with a mailed notification, they claimed.

The memo quotes an AT&T investigator as saying he believe no case existed because the breach did not involve any circumvention of AT&T's security controls. Rather it merely exploited a poorly implemented feature on AT&T's networks that allowed the data to be easily acceesed.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed. His e-mail address is

See more by Jaikumar Vijayan on

Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags network securityCybercrime and Hackingdata securityat&tsecuritydata protection

More about ABC NetworksABC NetworksAmazon.comAmazon Web ServicesAndrew Corporation (Australia)BloombergTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jaikumar Vijayan

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place