"Botnet" hacker sentenced to 3 years

A 21-year-old computer hacker has been sentenced to three years in prison for launching a "botnet" that attacked millions of computers worldwide and disrupted networks at hospitals, schools and the U.S. Department of Defense.

Judge Marsha Pechman delivered the sentence to Christopher Maxwell in federal court in Seattle Friday after a lengthy hearing that included five witnesses who testified about the damage caused by the botnet attack, which lasted at least 12 months.

Maxwell is from Vacaville, Calif., but was prosecuted in Washington state because Northwest Hospital & Medical Center in Seattle was a primary victim.

A botnet exploits software vulnerabilities to invade individual computers, then attacks other computers connected to the original targets via the Internet.

Maxwell's botnet installed adware on victims' computers that launched pop-up ads, even if the computers were not online. Often, the pop-up ads appeared in such abundance that they froze computers and disabled e-mail and other communications systems.

Maxwell received commissions for each installment of adware. The government estimated he earned at least $30,000 from the botnet.

Over a two-week period in February 2005, according to investigators, Maxwell's botnet attacked more than 441,000 computers.

Maxwell told the court he created the botnet with two co-conspirators he met online in an Internet chat room. The others have not been named because they are juveniles.

Maxwell said the attacks began as an informal competition to see how many computers each person could put adware on.

"I just kept getting better and better at what I was doing," said Maxwell, fighting off tears, "I never stopped to think about the consequences."

Northwest Hospital contacted the FBI soon after its computers were attacked in January 2005. A six-month investigation eventually led to Maxwell.

Maxwell pleaded guilty in May to one count of conspiracy to intentionally damage a protected computer and one count of intentional computer damage that interferes with medical treatment.

Assistant U.S. Attorney Kathryn Warma had sought a six-year prison term for Maxwell to send a message to others who might follow in his footsteps.

"The need for serious sentences as an effective deterrent to hacking offenses is compelling, and if such a sentence is imposed in this case, it will be quickly communicated with the botnet community," Warma wrote in court papers.

Pechman agreed. "Whatever I do, even before I get off this bench tonight, half the world will know about it," the judge said. "That leads me to the conclusion that there must indeed be deterrence."

However, Pechman cited Maxwell's age and lack of previous criminal history in imposing a prison sentence of 37 months plus three years of probation.

Maxwell must also pay restitution of $114,000 to Northwest Hospital and $138,000 to the Department of Defense.

David Bowermaster: 206-464-2724 or dbowermaster@seattletimes.com