1 00:00:01,960 --> 00:00:04,440 This is the CNBC Original. 2 00:00:11,300 --> 00:00:16,800 In this episode of American Green, a crime spree on the Internet using stolen 3 00:00:16,800 --> 00:00:22,500 information. It's basically a supermarket of cybercrime. Where 4 00:00:22,500 --> 00:00:24,580 trade your financial life story. 5 00:00:24,960 --> 00:00:26,240 This is not a victimless crime. 6 00:00:26,440 --> 00:00:28,900 They may think it is, but I was the victim. 7 00:00:29,320 --> 00:00:31,160 Billions of dollars are at stake. 8 00:00:31,840 --> 00:00:33,220 They followed the money all along. 9 00:00:33,740 --> 00:00:35,260 Fraud migrates to opportunity. 10 00:00:35,660 --> 00:00:39,400 And an unlikely computer genius fights to control it all. 11 00:00:39,620 --> 00:00:41,880 This was spy versus spy. 12 00:00:42,120 --> 00:00:43,660 It was quite an ego boost. 13 00:00:58,890 --> 00:01:04,069 One evening in November 2009, Julie is working late in her home office. 14 00:01:04,629 --> 00:01:08,970 Her concentration and focus are shattered by a disturbing phone call. 15 00:01:09,370 --> 00:01:14,270 So I asked my husband to get the phone, and it happened to be the manager of a 16 00:01:14,270 --> 00:01:15,650 big box store up in Wisconsin. 17 00:01:16,190 --> 00:01:20,750 And she said, I know this might seem like a strange call, but there's a woman 18 00:01:20,750 --> 00:01:25,790 the store who says she's you, and she's opening up a line of credit. 19 00:01:26,410 --> 00:01:30,770 The store is calling because the woman seems to be buying as many high -priced 20 00:01:30,770 --> 00:01:32,130 items as she possibly can. 21 00:01:34,430 --> 00:01:38,110 Julie's mind is racing. Who is this woman in the store? 22 00:01:38,630 --> 00:01:40,710 How did she get her personal information? 23 00:01:41,250 --> 00:01:43,370 And how much damage has she done? 24 00:01:43,730 --> 00:01:49,550 So when she was about the $4 ,700 mark, she said to them, how many more iPods 25 00:01:49,550 --> 00:01:53,010 can I get before I hit the line of credit? 26 00:01:53,960 --> 00:01:59,100 Julie is the latest victim of identity theft, joining the 10 million Americans 27 00:01:59,100 --> 00:02:03,240 whose lives have been turned upside down by this crime every year. 28 00:02:03,540 --> 00:02:08,360 I was exposed in a way that I've never been exposed before, and I've worked a 29 00:02:08,360 --> 00:02:13,360 long time to have good credit, and I've worked a long time to have financial 30 00:02:13,360 --> 00:02:19,120 security for my family, and suddenly it's out there, and I have no idea who 31 00:02:19,120 --> 00:02:21,440 it, and I have no idea how they're going to use it. 32 00:02:22,360 --> 00:02:28,360 In 2009, identity thieves cost U .S. businesses and individuals an estimated 33 00:02:28,360 --> 00:02:29,360 billion. 34 00:02:30,100 --> 00:02:34,620 Credit card numbers and identities like Julie's are bought and sold by the 35 00:02:34,620 --> 00:02:38,560 thousands on websites called Carter's Forums. 36 00:02:39,000 --> 00:02:44,400 It's an underground economy run by gangs that are global, sophisticated, and 37 00:02:44,400 --> 00:02:45,400 highly organized. 38 00:02:46,180 --> 00:02:51,080 At the top of the pyramid are the godfathers, people like Max Ray Butler. 39 00:02:51,600 --> 00:02:53,440 also known as Iceman. 40 00:02:54,240 --> 00:02:56,980 Butler is a brilliant computer hacker. 41 00:02:57,400 --> 00:03:02,600 His theft ring traffics an estimated 1 .8 million stolen credit cards. 42 00:03:03,000 --> 00:03:06,420 And he leads the feds on a year -long game of cat and mouse. 43 00:03:07,060 --> 00:03:11,080 In an exclusive interview with American Greed before entering federal prison, 44 00:03:11,420 --> 00:03:13,720 Butler explains his scheme. 45 00:03:14,120 --> 00:03:17,640 From law enforcement's perspective, these carding forums are probably... 46 00:03:17,930 --> 00:03:24,130 Another paradigm of crime, like you have individuals, street gangs, mafias, and 47 00:03:24,130 --> 00:03:28,750 now you've got this open source mafia where people just go on the Internet and 48 00:03:28,750 --> 00:03:31,790 form little ad hoc collectives and plan who knows what. 49 00:03:32,570 --> 00:03:35,710 Most people think of a hacker as a person working by themselves. 50 00:03:36,370 --> 00:03:41,710 Keith Malarski is a special agent with the FBI who spends years undercover as a 51 00:03:41,710 --> 00:03:45,510 hacker, working to bring down cyber criminals like Max Butler. 52 00:03:46,250 --> 00:03:50,170 In my own experience, I would always think back to the movie War Games. And 53 00:03:50,170 --> 00:03:54,110 think of Matthew Broderick sitting in his room with a computer trying to hack 54 00:03:54,110 --> 00:03:59,270 into something with a modem. But really, over the years, that's changed now, 55 00:03:59,370 --> 00:04:00,990 where this is really organized crime. 56 00:04:01,630 --> 00:04:05,910 Carter's forums traffic in millions of stolen identities every year. 57 00:04:06,350 --> 00:04:09,230 It's a multi -billion dollar business worldwide. 58 00:04:14,790 --> 00:04:20,290 Before he becomes a Don of the digital underworld, Max Butler grows up near 59 00:04:20,290 --> 00:04:21,290 Boise, Idaho. 60 00:04:21,709 --> 00:04:23,510 I was a computer geek from a young age. 61 00:04:24,150 --> 00:04:28,850 My father worked with computers. He worked at IBM, and then he worked at a 62 00:04:28,850 --> 00:04:31,230 computer store, and then he started his own computer store. So I always had 63 00:04:31,230 --> 00:04:32,230 access to machines. 64 00:04:32,350 --> 00:04:37,190 And I started programming when I was eight and was into video games, and I 65 00:04:37,190 --> 00:04:38,310 quite a geek, really. 66 00:04:39,050 --> 00:04:41,690 Butler begins hacking in his teens. 67 00:04:42,520 --> 00:04:46,140 My colleague, he's breaking into the network of Boise State University. 68 00:04:46,880 --> 00:04:51,220 Butler says that at this stage, his hacking is just for kicks. 69 00:04:51,580 --> 00:04:55,360 The administrators that were watching me and watching my activities, because I 70 00:04:55,360 --> 00:04:58,480 was a very curious person, I would go into the binary directory. 71 00:04:58,720 --> 00:05:00,740 Well, that caught their attention. Like, what's this guy doing? 72 00:05:01,460 --> 00:05:04,700 As they started paying attention to me, I started paying attention to them. We 73 00:05:04,700 --> 00:05:07,700 were kind of watching each other, and that was like an early sparring match 74 00:05:07,700 --> 00:05:08,700 happened. 75 00:05:08,730 --> 00:05:12,870 But behind the geeky demeanor, there lurks a history of violence. 76 00:05:13,330 --> 00:05:17,790 In his freshman year in college, Butler is arrested for choking and threatening 77 00:05:17,790 --> 00:05:19,110 to kill his girlfriend. 78 00:05:19,570 --> 00:05:24,310 He is convicted of aggravated assault and receives a stiff five -year 79 00:05:27,050 --> 00:05:33,310 In 1995, his prison stint over, the 22 -year -old Butler tries to build a new 80 00:05:33,310 --> 00:05:34,790 life in San Francisco. 81 00:05:35,910 --> 00:05:37,370 Friends told me that... 82 00:05:37,720 --> 00:05:41,080 You can just move computers around physically and make $30 an hour, let 83 00:05:41,080 --> 00:05:44,940 you actually knew how to use one. And I did, and I was good, and so I moved 84 00:05:44,940 --> 00:05:45,940 down. 85 00:05:46,020 --> 00:05:48,820 As a teenager, Butler hacked for fun. 86 00:05:49,880 --> 00:05:52,400 Now he can turn hacking into a lucrative career. 87 00:05:53,220 --> 00:05:56,400 He goes to work as a computer security consultant. 88 00:05:57,200 --> 00:05:59,000 He was what they call a white hat hacker. 89 00:05:59,840 --> 00:06:02,220 In fact, he epitomized it. 90 00:06:02,660 --> 00:06:04,860 He made a lot of money doing penetration tests. 91 00:06:05,600 --> 00:06:09,100 You would pay him to break into your computer to test your security, but at 92 00:06:09,100 --> 00:06:11,960 same time, he donated his services for free to nonprofit groups. 93 00:06:13,260 --> 00:06:17,000 Soon, Butler is commanding a fee of more than $100 an hour. 94 00:06:17,780 --> 00:06:23,540 He goes by the name Max Vision and enjoys an almost celebrity status among 95 00:06:23,540 --> 00:06:24,540 hacking elite. 96 00:06:25,220 --> 00:06:28,340 I had a really good reputation for always finding the hold because I was 97 00:06:28,340 --> 00:06:33,880 good at what I did. Then I set up a website, Max Vision, network security, 98 00:06:33,880 --> 00:06:34,960 whitehats .com. 99 00:06:35,470 --> 00:06:41,270 In fact, he's so good that the FBI office in San Francisco asks for his 100 00:06:41,270 --> 00:06:45,110 hacking into systems and pointing out weak spots in security. 101 00:06:45,690 --> 00:06:46,870 I got to do what I loved. 102 00:06:47,250 --> 00:06:52,490 I was already spending most of my waking hours doing security research. Now I 103 00:06:52,490 --> 00:06:55,090 can actually apply it and give a nice written report to someone. 104 00:06:56,550 --> 00:07:00,970 Made me feel good. It was a very useful service. I really helped a lot of 105 00:07:00,970 --> 00:07:01,970 people. 106 00:07:02,130 --> 00:07:04,390 But life is a white hat hacker. 107 00:07:04,860 --> 00:07:06,400 isn't exciting enough for Butler. 108 00:07:06,740 --> 00:07:09,960 He starts to break into private networks without permission. 109 00:07:10,860 --> 00:07:16,000 He thrived on the ego of it, of beating these defense systems. 110 00:07:16,340 --> 00:07:20,780 A couple things were really wrong about that. One, I thought I didn't get 111 00:07:20,780 --> 00:07:23,540 permission. I didn't have permission from any of the people who I actually 112 00:07:23,540 --> 00:07:26,000 and fixed their systems. I didn't have permission from the FBI. They didn't 113 00:07:26,100 --> 00:07:27,100 hey, this is a Nokia project. 114 00:07:27,320 --> 00:07:28,920 They didn't actually respond to the email. 115 00:07:29,710 --> 00:07:33,110 The next time I had contact with him, it was in person, like, hey, what's going 116 00:07:33,110 --> 00:07:36,390 on? The Air Force, off to a special investigation in my living room. 117 00:07:37,710 --> 00:07:40,150 Butler is charged with computer fraud. 118 00:07:41,130 --> 00:07:45,310 In May 2001, he is sentenced to 18 months in federal prison. 119 00:07:46,970 --> 00:07:49,190 It is his second time behind bars. 120 00:07:49,770 --> 00:07:51,590 He's only 28 years old. 121 00:07:53,450 --> 00:07:55,570 While Butler sits in prison... 122 00:07:55,900 --> 00:07:58,840 Hacking culture undergoes a dramatic transformation. 123 00:07:59,500 --> 00:08:05,260 The real migration that we saw beginning around 2000 was hackers getting into 124 00:08:05,260 --> 00:08:09,640 systems for profit. So their targets are all monetary, and they're making 125 00:08:09,640 --> 00:08:11,480 enormous amounts of money off of it. 126 00:08:11,840 --> 00:08:14,920 Law enforcement also undergoes a transformation. 127 00:08:15,540 --> 00:08:21,320 In 2002, in an effort to combat cybercrime, the National Cyber Forensics 128 00:08:21,320 --> 00:08:25,220 Training Alliance, or NCFTA, is created. 129 00:08:25,700 --> 00:08:28,680 Among its top targets are the Carter's Forums. 130 00:08:29,000 --> 00:08:34,179 American Greed has given special access to NCFTA's headquarters in Pittsburgh. 131 00:08:34,900 --> 00:08:39,059 This here is a screenshot of Carter Planet, which was one of the original 132 00:08:39,059 --> 00:08:40,059 carding forums. 133 00:08:40,260 --> 00:08:44,140 Anything you want to know about credit cards, social security numbers, dumps or 134 00:08:44,140 --> 00:08:45,280 cashing, you can go in there. 135 00:08:45,770 --> 00:08:50,570 There's a thread here for IDs, so anything you want to know about 136 00:08:50,570 --> 00:08:53,450 kind of for driver's licenses, you can go into that form. 137 00:08:53,850 --> 00:08:59,730 As the world of hacking evolves in the outside world, on the inside, Max Butler 138 00:08:59,730 --> 00:09:02,250 is forging new relationships with criminals. 139 00:09:03,190 --> 00:09:09,770 We would just walk the yard. As exercise, we talk about, well, 140 00:09:09,770 --> 00:09:12,010 about what we did and talk about what could be done. 141 00:09:12,510 --> 00:09:15,990 So we talk about it in a sort of fanciful way, like, oh, wouldn't that be 142 00:09:17,250 --> 00:09:22,750 Next on American Greed, prison yard scheming goes active, costing victims 143 00:09:22,750 --> 00:09:23,750 than $80 million. 144 00:09:24,550 --> 00:09:28,010 And Max Butler is reborn as Iceman. 145 00:09:28,570 --> 00:09:32,350 He's this elite hacker, and he's making over $1 ,000 a day. 146 00:09:43,340 --> 00:09:49,020 In 2002, computer hacker Max Butler is released from prison, having served 18 147 00:09:49,020 --> 00:09:50,580 months for computer fraud. 148 00:09:51,020 --> 00:09:56,700 Butler used to work as a white hat hacker, identifying and fixing security 149 00:09:56,700 --> 00:09:58,200 in computer networks. 150 00:09:58,540 --> 00:10:04,520 But now, he's a twice convicted felon. And, as Max Butler says in an exclusive 151 00:10:04,520 --> 00:10:09,160 interview with American Greed, that white hat isn't looking so good. 152 00:10:10,090 --> 00:10:13,370 I got desperate and I actually started going and looking for minimum wage work. 153 00:10:14,010 --> 00:10:18,310 I went to those places where you show up at 5, 6 o 'clock in the morning and you 154 00:10:18,310 --> 00:10:22,950 do manual labor, move boards around, whatever, and I couldn't get placed 155 00:10:22,950 --> 00:10:26,350 because there would be a queue, a seniority, and so I would just end up 156 00:10:26,350 --> 00:10:28,370 there all morning and nobody would even hire me there. 157 00:10:31,150 --> 00:10:36,070 Former hacker Kevin Polson knows how hard it can be to rebuild a life after 158 00:10:36,070 --> 00:10:37,070 years in prison. 159 00:10:37,570 --> 00:10:42,560 As a 25 -year -old, Polson was arrested for computer intrusion and money 160 00:10:42,560 --> 00:10:48,140 laundering. Now he's a husband and father and senior editor at Wired .com. 161 00:10:48,560 --> 00:10:50,700 Polson is writing a book on Butler. 162 00:10:51,500 --> 00:10:53,020 He was ready to make some money. 163 00:10:53,300 --> 00:10:54,420 He needed the money. 164 00:10:54,860 --> 00:10:57,320 Butler soon finds a way to make some cash. 165 00:10:57,780 --> 00:11:01,720 Through an old prison buddy, he is introduced to Christopher Aragon. 166 00:11:02,300 --> 00:11:06,720 Aragon is a former bank robber who is now learning the dark art of making 167 00:11:06,720 --> 00:11:08,200 counterfeit credit cards. 168 00:11:08,840 --> 00:11:12,660 Aragon tells Butler that they have complementary skill sets. 169 00:11:13,300 --> 00:11:18,520 Butler was the hacker extraordinaire who could obtain access to computer 170 00:11:18,520 --> 00:11:24,940 systems. Aragon, who was also quite computer savvy, was very adept at social 171 00:11:24,940 --> 00:11:25,940 manipulation. 172 00:11:26,200 --> 00:11:28,060 The initial plan is simple. 173 00:11:28,360 --> 00:11:33,280 Butler will target Carter Forums, the black market websites that traffic in 174 00:11:33,280 --> 00:11:35,460 stolen identities and financial information. 175 00:11:36,490 --> 00:11:41,410 He'll hack into their computer systems, steal credit card numbers, and sell them 176 00:11:41,410 --> 00:11:44,230 to Chris Aragon, who will make fake credit cards. 177 00:11:44,710 --> 00:11:49,110 It's a scam that Keith Malarski, an FBI special agent who has gone undercover on 178 00:11:49,110 --> 00:11:52,170 Carter forums, has seen many times before. 179 00:11:53,470 --> 00:12:00,070 So what we have here is a MSR -206, which is the most popular magnetic 180 00:12:00,070 --> 00:12:01,590 and reader that's out on the market. 181 00:12:02,050 --> 00:12:03,430 A simple laptop. 182 00:12:04,030 --> 00:12:09,670 And the bad guys have designed a program called The Germ, which will enable you 183 00:12:09,670 --> 00:12:13,890 to take the credit card number and write it onto the magnetic strip on the back. 184 00:12:14,070 --> 00:12:18,430 So what you do is you take the card, and then you just swipe it, and it's as 185 00:12:18,430 --> 00:12:19,430 easy as that. 186 00:12:19,610 --> 00:12:22,050 The fake credit cards look legitimate. 187 00:12:22,760 --> 00:12:27,960 You can see the quality on the card here is very good. The hologram, the 188 00:12:27,960 --> 00:12:32,200 MasterCard hologram is good. And even on the back, he had raised numbers here, 189 00:12:32,220 --> 00:12:36,000 so when you would feel that as a security measure, it would pass that. 190 00:12:36,420 --> 00:12:39,420 But the hackers won't use the credit cards themselves. 191 00:12:40,240 --> 00:12:46,660 Chris Aragon hires teams of young girls called cashiers, or sometimes mules, to 192 00:12:46,660 --> 00:12:48,640 go on a high -end shopping spree. 193 00:12:49,130 --> 00:12:53,230 you know, girls that he'd met in clubs or friends of friends and say, hey, 194 00:12:53,230 --> 00:12:56,710 you like to go shopping and show them, you know, credit cards that you could 195 00:12:56,710 --> 00:12:59,790 just use for whatever, they would all be excited about it. 196 00:13:00,090 --> 00:13:03,730 Eventually, he would get an organized team together of false IDs, go into a 197 00:13:03,730 --> 00:13:09,950 complex and just go crazy, buy whatever they could, fill up a SUV, and then they 198 00:13:09,950 --> 00:13:11,350 would try to, you know, go fence that merchandise. 199 00:13:12,090 --> 00:13:17,010 Arrogant crew would then use online auction sites to sell some of the stolen 200 00:13:17,010 --> 00:13:18,010 goods. 201 00:13:18,110 --> 00:13:21,070 So it will appear like a legitimate product, and they could sell it for a 202 00:13:21,070 --> 00:13:24,270 discount, and then that's how the lower -end people will make their money. 203 00:13:24,610 --> 00:13:29,530 Butler and Aragon figure the scam will bring in several hundred thousand 204 00:13:29,530 --> 00:13:30,530 a year. 205 00:13:30,710 --> 00:13:34,030 At some point, money would trickle back to me. It was never half. 206 00:13:34,230 --> 00:13:36,810 It was... Really, I got scraps. 207 00:13:37,290 --> 00:13:42,170 But I kind of had this idea that maybe I would get half, but that never worked 208 00:13:42,170 --> 00:13:43,149 out. 209 00:13:43,150 --> 00:13:45,170 To make the scheme more profitable... 210 00:13:45,610 --> 00:13:48,270 Butler needs a steady stream of credit card numbers. 211 00:13:48,910 --> 00:13:54,570 He goes straight to the motherlode, the Carter's forums, where hackers like him 212 00:13:54,570 --> 00:13:58,010 buy and sell numbers and identities by the hundreds of thousands. 213 00:13:58,970 --> 00:14:01,390 He'll be a pirate of pirates. 214 00:14:03,310 --> 00:14:07,710 In 2003, Butler and Aragon spring into action. 215 00:14:08,550 --> 00:14:13,430 The partners set up their hacking operation in hotel rooms around San 216 00:14:14,060 --> 00:14:16,660 Where the air is thick with Wi -Fi signals. 217 00:14:17,340 --> 00:14:20,700 We would choose location based on access to wireless networks. 218 00:14:21,040 --> 00:14:26,280 He would have it packed with computer equipment, including a high -end antenna 219 00:14:26,280 --> 00:14:29,440 that could be used for interception of wireless communications. 220 00:14:30,180 --> 00:14:35,840 Using someone else's Wi -Fi network means Butler can hack away without 221 00:14:35,840 --> 00:14:37,880 trace. He would use a giant... 222 00:14:38,270 --> 00:14:43,290 in order to hack into Wi -Fi signals from neighboring apartments or from 223 00:14:43,290 --> 00:14:46,850 the street in order to have an anonymous Internet connection that he felt 224 00:14:46,850 --> 00:14:48,430 couldn't really be traced back to him. 225 00:14:48,810 --> 00:14:53,930 Once he's up and running on a hijacked Wi -Fi, Butler logs on to Carter's 226 00:14:53,930 --> 00:14:56,870 and looks for weak spots in their security networks. 227 00:14:57,370 --> 00:15:01,430 So I got into hundreds of their machines, and I was watching them. 228 00:15:01,990 --> 00:15:05,690 This was by versus by. It was me against them. 229 00:15:06,960 --> 00:15:10,480 It was quite an ego boost. I got a rush from it. 230 00:15:11,020 --> 00:15:15,500 When he finally breaks through security, Butler loots all the financial data 231 00:15:15,500 --> 00:15:17,380 another criminal has already stolen. 232 00:15:17,720 --> 00:15:22,640 He steals thousands of credit card numbers, passwords, and pins, and 233 00:15:22,640 --> 00:15:24,500 them to his partner, Chris Aragon. 234 00:15:25,320 --> 00:15:28,640 He would kind of set me up, and then I would just be like an incubator. I would 235 00:15:28,640 --> 00:15:31,920 just try to churn out information to provide to him. 236 00:15:32,340 --> 00:15:34,540 In time, it's a well -oiled machine. 237 00:15:35,720 --> 00:15:38,680 Butler nets close to $10 ,000 a month. 238 00:15:38,920 --> 00:15:43,700 But the hacking location, or safe house, has to change every few months to stay 239 00:15:43,700 --> 00:15:44,900 one step ahead of the law. 240 00:15:46,360 --> 00:15:48,760 But law enforcement is close behind. 241 00:15:49,200 --> 00:15:54,380 When American greed returns, a mole has infiltrated the Carter's forums, and 242 00:15:54,380 --> 00:15:57,900 he's working with the U .S. Secret Service to bring down Iceman. 243 00:16:09,550 --> 00:16:15,510 In San Francisco in June 2005, computer hacker Max Butler and his partner Chris 244 00:16:15,510 --> 00:16:20,330 Aragon are stealing credit card numbers with impunity. And they're leaving a 245 00:16:20,330 --> 00:16:23,510 wake of financial disaster for millions of Americans. 246 00:16:24,610 --> 00:16:30,970 Butler, who now calls himself Iceman online, hacks into Carter's forums, the 247 00:16:30,970 --> 00:16:35,510 illegal websites where criminals buy and sell stolen financial data. 248 00:16:36,790 --> 00:16:38,730 Greed has gotten the best of him. 249 00:16:39,310 --> 00:16:40,310 He wants more. 250 00:16:40,830 --> 00:16:43,790 He's even hacking into banks and credit unions. 251 00:16:44,230 --> 00:16:47,930 He's in this cyber underground where he's this elite hacker, and he's making 252 00:16:47,930 --> 00:16:49,270 over $1 ,000 a day. 253 00:16:49,550 --> 00:16:54,170 That's very, very good money, and it's kind of hard to walk away from that, 254 00:16:54,310 --> 00:16:59,290 especially when your ego gets involved where you think that you can't be 255 00:16:59,850 --> 00:17:05,530 Butler justifies his criminal acts by telling himself he's just sticking it to 256 00:17:05,530 --> 00:17:08,150 banks. You know, I made myself feel better about it. 257 00:17:09,000 --> 00:17:11,240 not actually hurting people, individuals. 258 00:17:11,760 --> 00:17:17,900 Of course, it turns out I did actually cause quite a bit of, more than just an 259 00:17:17,900 --> 00:17:19,720 inconvenience, quite an ordeal for a lot of people. 260 00:17:20,060 --> 00:17:24,040 People like Julie, who asked that her last name not be used. 261 00:17:24,440 --> 00:17:30,800 In late 2009, someone using stolen identity information opened up several 262 00:17:30,800 --> 00:17:32,380 of credit at various stores. 263 00:17:32,800 --> 00:17:37,280 They almost get away with charging $11 ,000 in her name. 264 00:17:38,030 --> 00:17:39,470 This is not a victimless crime. 265 00:17:39,830 --> 00:17:42,410 They may think it is, but I was the victim. 266 00:17:42,890 --> 00:17:48,470 Depending on the case, it can take up to two years of painstaking work to clear 267 00:17:48,470 --> 00:17:50,570 one's name after identity theft. 268 00:17:51,310 --> 00:17:56,870 The countless hours that I've had to put into this to try to fix. 269 00:17:57,280 --> 00:18:01,400 My credit and the amount of stress that's gone into this and the amount of 270 00:18:01,400 --> 00:18:07,480 it's taken away from my work schedule and from my family has been tremendous. 271 00:18:08,420 --> 00:18:13,740 Back in his safe house in San Francisco, Iceman is not thinking of his victims. 272 00:18:14,740 --> 00:18:18,940 He's thinking about how he can get even more control and power. 273 00:18:19,420 --> 00:18:24,320 He and partner Chris Aragon decide to start their own Carter's Forum. They 274 00:18:24,320 --> 00:18:26,020 it Carter's Market. 275 00:18:26,730 --> 00:18:31,290 The name was actually his idea. He wanted Carter's Market. He felt that 276 00:18:31,290 --> 00:18:33,190 business motive was appropriate. 277 00:18:33,670 --> 00:18:39,070 Both partners see an upside in the arrangement, an opportunity to greatly 278 00:18:39,070 --> 00:18:40,070 their market. 279 00:18:40,550 --> 00:18:44,070 Max wanted to be able to sell credit card information to more than just 280 00:18:44,830 --> 00:18:50,370 Aragon wanted to be able to sell counterfeit credit cards to other 281 00:18:50,370 --> 00:18:53,710 that he wasn't entirely relying on the purchases that his cashers were making. 282 00:18:54,070 --> 00:18:55,670 So they both had a stake in this. 283 00:18:56,080 --> 00:19:01,020 Butler creates a sliding scale for his wares, and it may be surprising how 284 00:19:01,020 --> 00:19:03,720 cheaply the market prices a stolen credit card. 285 00:19:03,960 --> 00:19:10,500 He charges $12 for a Visa Classic, $16 .50 for a MasterCard, $36 for American 286 00:19:10,500 --> 00:19:11,500 Express. 287 00:19:11,840 --> 00:19:15,780 And like any reputable vendor, his inventory runs deep. 288 00:19:16,280 --> 00:19:21,900 To be a reviewed vendor, for example, of dumps or credit cards, you need to have 289 00:19:21,900 --> 00:19:25,180 a supply of hundreds of thousands, if not millions, of cards. 290 00:19:26,320 --> 00:19:30,740 The credit card numbers are coming from other Carter's forums that Butler has 291 00:19:30,740 --> 00:19:31,740 hacked into. 292 00:19:31,900 --> 00:19:37,660 Every month, Butler is selling more than 250 dumps, the stolen financial and 293 00:19:37,660 --> 00:19:38,660 identity data. 294 00:19:38,740 --> 00:19:41,640 His reputation as master hacker is sealed. 295 00:19:42,000 --> 00:19:46,200 He definitely became one of the top five dump spenders in the world. And this 296 00:19:46,200 --> 00:19:49,160 isn't a business that's traditionally dominated by Eastern Europe. 297 00:19:50,110 --> 00:19:55,630 I really think that Iceman was the first real elite hacker to run one of these 298 00:19:55,630 --> 00:19:56,630 carding forums. 299 00:19:56,970 --> 00:20:01,350 What's more, Butler and Aragon are frustrating law enforcement. 300 00:20:01,690 --> 00:20:08,030 The real difficulty with a cybercrime case is the degree of anonymity that the 301 00:20:08,030 --> 00:20:14,350 Internet affords. It's not the typical situation where you have something like 302 00:20:14,350 --> 00:20:18,050 DNA or blood evidence. You have to... 303 00:20:18,430 --> 00:20:21,450 amass the proof that puts that person behind the keyboard. 304 00:20:21,850 --> 00:20:27,410 The Carter's forums are notoriously tight -knit and suspicious of outsiders. 305 00:20:28,170 --> 00:20:32,650 Prospective members must have an existing member vouch for their 306 00:20:33,450 --> 00:20:37,050 You need to know another criminal in there, generally a couple of criminals 307 00:20:37,050 --> 00:20:41,310 where you've done business with them enough so that they will vouch for your 308 00:20:41,310 --> 00:20:43,490 credibility in order to be a member of the group. 309 00:20:43,730 --> 00:20:48,210 And that culture of secrecy is bolstered by high -tech encryption. 310 00:20:49,130 --> 00:20:53,690 Now they've moved to encrypted communications on encrypted servers. 311 00:20:53,950 --> 00:20:58,430 So it makes it very difficult for law enforcement. And now we have to find 312 00:20:58,430 --> 00:21:02,610 avenues to get into the group in order to get into their very secret 313 00:21:02,610 --> 00:21:07,210 communications. So the criminals know that law enforcement now is looking at 314 00:21:07,210 --> 00:21:11,370 them. So as a result, they're evolving in their techniques. 315 00:21:12,210 --> 00:21:17,090 Despite their success in making money and staying ahead of the law, Butler is 316 00:21:17,090 --> 00:21:21,580 worried. For one thing, he thinks his partner, Chris Aragon, is spending money 317 00:21:21,580 --> 00:21:24,840 too lavishly and drawing too much attention to himself. 318 00:21:25,800 --> 00:21:30,120 His crew was young, and they liked to party. So there were nights out, and 319 00:21:30,120 --> 00:21:34,620 they'd go clubbing in Las Vegas, and he'd spend $1 ,000 on a meal, another $1 320 00:21:34,620 --> 00:21:35,620 ,000 on wine. 321 00:21:35,880 --> 00:21:41,440 I wasn't really so much as excited about that. I wanted to be, you know, working 322 00:21:41,440 --> 00:21:42,680 on the computers. 323 00:21:42,940 --> 00:21:44,540 I wasn't really into that party lifestyle. 324 00:21:45,200 --> 00:21:46,840 And there's a much bigger worry. 325 00:21:47,560 --> 00:21:53,540 In 2004, a federal dragnet called Operation Firewall brings down a 326 00:21:53,540 --> 00:21:55,260 Forum called Shadow Crew. 327 00:21:55,900 --> 00:22:00,780 28 people are arrested, ratcheting up the already fearful and paranoid 328 00:22:00,780 --> 00:22:02,760 atmosphere in the Carter's Forums. 329 00:22:03,060 --> 00:22:08,200 In a world where everyone hides behind a screen name, no one knows who might be 330 00:22:08,200 --> 00:22:10,060 an undercover FBI agent. 331 00:22:11,630 --> 00:22:16,350 There's a lot of paranoia on the forums, especially after Operation Firewall. 332 00:22:16,790 --> 00:22:22,390 Nobody really knows who they can trust, and so a lot of accusations get thrown 333 00:22:22,390 --> 00:22:28,030 around. Iceman begins to obsess that an FBI mole might penetrate Carter's 334 00:22:28,030 --> 00:22:32,830 market, or even a rival website, and bring their good times to a screeching 335 00:22:32,830 --> 00:22:36,690 halt. He decided there were too many competing forums, and it was dividing up 336 00:22:36,690 --> 00:22:37,669 the business. 337 00:22:37,670 --> 00:22:39,090 Vendors were scattered around. 338 00:22:39,870 --> 00:22:41,490 They had poor security. 339 00:22:41,890 --> 00:22:47,850 And that the criminal underground would be better off under a single board and 340 00:22:47,850 --> 00:22:49,130 under his benign rule. 341 00:22:49,470 --> 00:22:53,770 At one point, I thought it would be beneficial to just get all the 342 00:22:53,770 --> 00:22:54,770 in one place. 343 00:22:54,930 --> 00:23:00,030 Butler wants to take over and control the Carter's forums so he can weed out 344 00:23:00,030 --> 00:23:03,190 suspicious characters who might be working with law enforcement. 345 00:23:03,770 --> 00:23:09,590 He decides to plot a hostile takeover of his four main rivals, Dark Market, talk 346 00:23:09,590 --> 00:23:15,550 cash, Scandinavian carding, and the vouched. If he can take all their users 347 00:23:15,550 --> 00:23:20,470 bring them under his umbrella, he figures he can exercise total control 348 00:23:20,470 --> 00:23:21,930 has access to the site. 349 00:23:22,390 --> 00:23:24,250 He spends two months preparing. 350 00:23:24,950 --> 00:23:29,990 Then in August 2006, Butler locks himself in his safe house. 351 00:23:30,350 --> 00:23:36,350 And in one spree, a 48 -hour session where I stayed awake, I went through and 352 00:23:36,350 --> 00:23:37,350 checked them off. 353 00:23:37,840 --> 00:23:41,080 got into the site, copied all their data out, got a current snapshot of their 354 00:23:41,080 --> 00:23:46,480 database, shut their site down, deleted their database, imported it into ours, 355 00:23:46,620 --> 00:23:48,180 and built up Carter's Market. 356 00:23:48,940 --> 00:23:51,420 And, I don't know, it seemed fun at the time. 357 00:23:52,400 --> 00:23:54,780 He looks proud, and he is. 358 00:23:55,820 --> 00:24:00,020 Emails, usernames, passwords of everyone who bought and sold on the sites. 359 00:24:00,280 --> 00:24:02,320 The information is all his. 360 00:24:02,880 --> 00:24:06,560 It's like a mob boss taking out the heads of other families. 361 00:24:07,230 --> 00:24:12,370 Iceman is now the undisputed don of the Carter Forums. It was a huge boost for 362 00:24:12,370 --> 00:24:13,209 Carter's Market. 363 00:24:13,210 --> 00:24:19,110 He went from 1 ,500 users to 6 ,000 users overnight with this hostile 364 00:24:19,410 --> 00:24:24,890 The takeover merits a lengthy article in USA Today, which dubs Carter's Market 365 00:24:24,890 --> 00:24:27,270 the Walmart of Carter's Forums. 366 00:24:27,630 --> 00:24:29,930 Carter's Market was the only place to do business now. 367 00:24:30,210 --> 00:24:31,770 When American greed returns, 368 00:24:32,490 --> 00:24:34,690 Iceman seems in total control. 369 00:24:35,200 --> 00:24:38,000 But his arrogance gets the attention of the feds. 370 00:24:49,460 --> 00:24:55,660 In August 2006, Max Iceman Butler is at the top of his game. 371 00:24:55,860 --> 00:25:01,540 As founder and administrator of the illegal website Carter's Market, He and 372 00:25:01,540 --> 00:25:05,840 partner Chris Aragon oversee a multimillion -dollar black market 373 00:25:06,700 --> 00:25:10,620 Carter's Market is described as the Walmart of the digital underground. 374 00:25:11,080 --> 00:25:13,660 And Max Butler is its CEO. 375 00:25:14,820 --> 00:25:20,340 Mr. Butler, in running that website, had complete control of who could access it 376 00:25:20,340 --> 00:25:22,240 and the extent of their access. 377 00:25:23,320 --> 00:25:29,160 But, as the saying goes, power corrupts. And absolute power corrupts absolutely. 378 00:25:30,350 --> 00:25:34,330 Butler has hacked into the sites of his main competitors and stolen their 379 00:25:34,330 --> 00:25:35,870 members to create a monopoly. 380 00:25:36,850 --> 00:25:40,090 This hostile takeover has brought a serious backlash. 381 00:25:40,750 --> 00:25:45,410 What that did was really upset or ticked off a lot of the other people running 382 00:25:45,410 --> 00:25:52,030 the other sites out there. And the equivalent of a cyber war broke out or 383 00:25:52,030 --> 00:25:56,490 war broke out between the rival factions. People were very angry about 384 00:25:56,510 --> 00:25:58,170 especially the people that ran the other forums. 385 00:25:59,340 --> 00:26:02,340 Didn't know what to think. Right away, some people accused us of being fed. 386 00:26:02,720 --> 00:26:07,960 There was a well -known forum member called El Mariachi, who'd been in the 387 00:26:07,960 --> 00:26:12,840 forever, who had already decided that Iceman was an informant just because he 388 00:26:12,840 --> 00:26:13,840 was so arrogant. 389 00:26:14,200 --> 00:26:19,080 And after the hostile takeover, El Mariachi started calling out Max online, 390 00:26:19,280 --> 00:26:24,880 saying, you know, you're obviously a snitch, goading him on, and there were 391 00:26:24,880 --> 00:26:25,880 threats exchanged. 392 00:26:26,270 --> 00:26:28,770 It could be dismissed as hacker's drama. 393 00:26:29,270 --> 00:26:33,250 But for the federal agents who have been stymied in their efforts to infiltrate 394 00:26:33,250 --> 00:26:36,890 the Carter's forums, this cyber war presents an opportunity. 395 00:26:37,870 --> 00:26:43,210 FBI agent Keith Malarski works undercover as a hacker named Master 396 00:26:43,730 --> 00:26:48,850 He sees a chance to boost his undercover reputation and expand the scope of the 397 00:26:48,850 --> 00:26:49,850 investigation. 398 00:26:50,630 --> 00:26:54,970 There was a lot of warring going on. People really didn't know who to trust. 399 00:26:55,700 --> 00:27:00,620 So they were looking for names that had been around for a while, and my name had 400 00:27:00,620 --> 00:27:03,820 been around for a while, the Master Splinter moniker. 401 00:27:04,180 --> 00:27:08,860 People started coming to me and asking me, whose side am I on? 402 00:27:09,060 --> 00:27:14,800 And that really opened up the opportunity for us to take the 403 00:27:14,800 --> 00:27:15,800 the next level. 404 00:27:15,840 --> 00:27:21,240 Agent Malarski creates a legend of Master Splinter as one of the world's 405 00:27:21,240 --> 00:27:26,760 spammers. What that enabled us to do was really penetrate a number of different 406 00:27:26,760 --> 00:27:30,740 groups because spamming is really the backbone that drives the underground 407 00:27:30,740 --> 00:27:31,740 economy. 408 00:27:32,020 --> 00:27:37,680 Before long, Agent Malarski, as Master Splinter, gets the Carter site Dark 409 00:27:37,680 --> 00:27:42,240 Market up and running again after Butler has hacked into it and shut it down. 410 00:27:43,020 --> 00:27:47,860 After Dark Market came back up, Mac continued to hack back into it. It was 411 00:27:47,860 --> 00:27:48,860 ongoing war. 412 00:27:49,669 --> 00:27:53,990 Max and I kind of became enemies, and he hated me. 413 00:27:55,050 --> 00:27:59,330 There were a lot of people going back and forth, and they would come to me and 414 00:27:59,330 --> 00:28:03,170 say, do you know what Iceman said about you, or do you know what Iceman's doing 415 00:28:03,170 --> 00:28:05,090 now, or Iceman's going to try to hack you. 416 00:28:05,610 --> 00:28:07,790 They're mortal enemies on the Internet. 417 00:28:08,270 --> 00:28:13,830 But in reality, Agent Malarski doesn't know the true identity of Iceman or have 418 00:28:13,830 --> 00:28:16,170 any idea where in the world he's operating from. 419 00:28:16,890 --> 00:28:18,570 All that's about to change. 420 00:28:20,080 --> 00:28:23,100 The FBI joins ranks with the U .S. Secret Service. 421 00:28:23,320 --> 00:28:27,960 And in the spring of 2006, the Secret Service develops two confidential 422 00:28:27,960 --> 00:28:28,960 informants. 423 00:28:29,640 --> 00:28:34,760 They're both trusted members on Carter's Market who have decided to work with 424 00:28:34,760 --> 00:28:39,420 law enforcement and provide the federal agents a glimpse behind the curtain of 425 00:28:39,420 --> 00:28:40,700 this black market. 426 00:28:41,020 --> 00:28:43,060 They had an informant on the site. 427 00:28:43,660 --> 00:28:49,120 who was also an administrator, who was able to give them information from the 428 00:28:49,120 --> 00:28:52,100 inside as well. So they were working to find out who Iceman was. 429 00:28:52,540 --> 00:28:58,720 In that fall of 2006, with the Secret Service at his side, one of the 430 00:28:58,720 --> 00:29:01,340 buys 23 credit card accounts from Butler. 431 00:29:01,840 --> 00:29:05,660 Max presumably thought he was corresponding with somebody in Eastern 432 00:29:05,660 --> 00:29:06,660 that he'd be safe. 433 00:29:06,980 --> 00:29:08,980 And in fact, it wound up in Pittsburgh. 434 00:29:09,820 --> 00:29:12,760 It's a small sale worth just $480. 435 00:29:13,380 --> 00:29:16,240 But for the Secret Service, it's a big moment. 436 00:29:16,560 --> 00:29:18,400 That instantly gives them the case. 437 00:29:18,860 --> 00:29:22,600 When you sell anybody stolen credit card information, you're automatically a 438 00:29:22,600 --> 00:29:23,600 felon. 439 00:29:24,600 --> 00:29:27,180 Then Butler makes another misstep. 440 00:29:27,440 --> 00:29:32,860 In a brazen move to steal more financial data, Butler sends a corrupted link to 441 00:29:32,860 --> 00:29:37,040 the e -mail accounts of 500 employees at Capital One Bank. 442 00:29:38,600 --> 00:29:44,760 So hundreds of people clicked on this link in Capital One, and they got 443 00:29:44,760 --> 00:29:47,480 with this, giving him access to their internal network. 444 00:29:47,960 --> 00:29:49,900 But his plan backfires. 445 00:29:50,660 --> 00:29:55,840 Capital One contacts the FBI, who traces the cyberattack to the same account 446 00:29:55,840 --> 00:29:57,520 that registered Carter's Market. 447 00:29:58,340 --> 00:30:00,900 The case against Butler is building. 448 00:30:01,340 --> 00:30:03,880 But Iceman is a worthy adversary. 449 00:30:04,280 --> 00:30:06,400 He suspects correctly... 450 00:30:06,840 --> 00:30:09,360 that Master Splinter is a federal agent. 451 00:30:09,960 --> 00:30:15,680 Max saw that Master Splinter was logging on not from Eastern Europe, where he 452 00:30:15,680 --> 00:30:19,080 was supposed to be based, but from an office building in Pittsburgh. 453 00:30:19,580 --> 00:30:25,400 It's the building that houses the NCFTA, the National Cyber Forensics Training 454 00:30:25,400 --> 00:30:26,400 Alliance. 455 00:30:26,780 --> 00:30:30,840 So Iceman shouted to the hills that anybody would listen that Master 456 00:30:30,840 --> 00:30:35,280 was a Fed and a dark market was a sting operation being run by the FBI or the 457 00:30:35,280 --> 00:30:37,520 NCFDA. He would tell anybody that would listen. 458 00:30:38,180 --> 00:30:44,400 For Malarski slash Master Splinter, being outed threatens to kill his 459 00:30:44,400 --> 00:30:45,400 in the cradle. 460 00:30:45,700 --> 00:30:50,060 So we had to do some scrubbing because we had just taken over this site, and 461 00:30:50,060 --> 00:30:54,380 this was the potential to compromise it all right in the first couple weeks. 462 00:30:55,160 --> 00:31:01,040 Fortunately for Agent Malarski, Iceman cries wolf one too many times, having 463 00:31:01,040 --> 00:31:03,840 accused people before of being federal agents. 464 00:31:04,460 --> 00:31:10,240 Malarski also has a world -class support team, which scrubs the data of any tie 465 00:31:10,240 --> 00:31:11,300 to the federal government. 466 00:31:11,740 --> 00:31:18,280 So now when Iceman made his big reveal to the world that Master Flinner was 467 00:31:18,280 --> 00:31:20,800 of the NCFTA, none of that stuff was there. 468 00:31:21,240 --> 00:31:26,340 So I had convinced the people on Dark Market that I was legit. So they just 469 00:31:26,340 --> 00:31:28,620 thought that Iceman was throwing dirt at me. 470 00:31:29,160 --> 00:31:32,700 So there was a lot of allegations where people were calling one another cops or 471 00:31:32,700 --> 00:31:37,020 feds all the time. And luckily for me, I was just kind of in that wave of all 472 00:31:37,020 --> 00:31:40,760 this allegation, and I was able to survive it. 473 00:31:42,460 --> 00:31:46,720 Next on American Greed, authorities are closing in. 474 00:31:47,500 --> 00:31:50,560 The big break comes when they nab Chris Aragon. 475 00:31:51,200 --> 00:31:54,560 the only person in the world who knows Iceman's real name. 476 00:31:54,940 --> 00:31:56,540 Would he give up his partner? 477 00:32:05,520 --> 00:32:07,580 In spring 2007, 478 00:32:08,280 --> 00:32:15,100 Max Butler, a .k .a. Iceman, is living the hacker's dream, illegally breaking 479 00:32:15,100 --> 00:32:17,960 into systems and getting paid good money for it. 480 00:32:18,680 --> 00:32:22,870 He and his partner, Chris Aragon, managed the multi -million dollar 481 00:32:22,870 --> 00:32:25,150 website called Carter's Market. 482 00:32:26,230 --> 00:32:31,130 It's an online bazaar where crooks can buy and sell stolen credit card and 483 00:32:31,130 --> 00:32:32,130 identity information. 484 00:32:32,910 --> 00:32:37,290 Carter's Market website was founded by Mr. Butler and a close associate of his, 485 00:32:37,390 --> 00:32:42,070 Christopher Aragon, largely so that they would have complete control over the 486 00:32:42,070 --> 00:32:44,730 servers and the access to that market. 487 00:32:45,210 --> 00:32:50,770 But in an interview with American Greed, Max Butler says by spring he was ready 488 00:32:50,770 --> 00:32:55,650 to get out. I had been sort of winding down, wanting to get out from under the 489 00:32:55,650 --> 00:32:59,850 forum. But it's too late. The feds are closing in on Iceman. 490 00:33:00,530 --> 00:33:05,210 So things started to unravel for Max very rapidly. 491 00:33:05,470 --> 00:33:06,910 There were two things that happened. 492 00:33:07,190 --> 00:33:12,210 First, a young charter named Jonathan Giannone, a .k .a. Zebra. 493 00:33:12,700 --> 00:33:15,180 is arrested for wire fraud and identity theft. 494 00:33:15,540 --> 00:33:20,460 An early administrator on Carter's Market, Giannone has an insider's 495 00:33:20,460 --> 00:33:24,360 on Iceman, and he's looking at several years in prison. 496 00:33:25,500 --> 00:33:29,340 The Secret Service came to him and said, if you want to help yourself, you're 497 00:33:29,340 --> 00:33:32,900 going to tell us everything you know about Iceman, the guy that did this 498 00:33:32,900 --> 00:33:36,420 takeover. The zebra has one card to play. 499 00:33:36,990 --> 00:33:41,470 He didn't know who Iceman was, but he did know Chris Aragon, and he knew that 500 00:33:41,470 --> 00:33:44,690 Chris Aragon worked closely with Iceman in real life. 501 00:33:44,930 --> 00:33:50,270 Only one person really on the planet knew who the Iceman was, and that was 502 00:33:50,270 --> 00:33:51,270 Christopher Aragon. 503 00:33:51,730 --> 00:33:56,530 If the Secret Service can get to Chris Aragon, there's a good chance they can 504 00:33:56,530 --> 00:33:57,530 stop Iceman. 505 00:33:58,250 --> 00:34:00,050 The opportunity comes quickly. 506 00:34:00,690 --> 00:34:03,190 On May 12, 2007... 507 00:34:03,450 --> 00:34:08,489 Aragon is arrested trying to use one of his counterfeit cards to buy $13 ,000 508 00:34:08,489 --> 00:34:11,989 worth of luxury purses at Bloomingdale's. 509 00:34:12,770 --> 00:34:17,710 Following that arrest, police in Newport Beach did a series of searches of 510 00:34:17,710 --> 00:34:22,130 computer equipment and other electronic devices in connection with Aragon's 511 00:34:22,130 --> 00:34:24,310 business activities and criminal activities. 512 00:34:24,989 --> 00:34:29,949 Part of that information was shared with the United States Secret Service and 513 00:34:29,949 --> 00:34:31,750 was made available to us in our case. 514 00:34:32,429 --> 00:34:37,030 Just like Zebra, Chris Aragon puts self -preservation above loyalty. 515 00:34:37,710 --> 00:34:42,889 Facing charges of commercial burglary and identity theft, Aragon decides to 516 00:34:42,889 --> 00:34:48,150 talk. He tells them the addresses of Iceman's safe houses, though he doesn't 517 00:34:48,150 --> 00:34:49,270 know his current one. 518 00:34:49,690 --> 00:34:54,770 And he tells them something even more vital, Iceman's true identity. 519 00:34:55,270 --> 00:34:58,670 Chris was really the only one that knew that Iceman was Max Butler. 520 00:34:59,340 --> 00:35:03,860 For the first time in this investigation, the feds now know who 521 00:35:03,860 --> 00:35:09,700 for, a 6 '5", brown -haired, white male who lives in the San Francisco area 522 00:35:09,700 --> 00:35:11,440 named Max Butler. 523 00:35:13,260 --> 00:35:19,240 After Aragon's arrest, Butler is cagey. He quickly abandons his current safe 524 00:35:19,240 --> 00:35:25,760 house. I was in an apartment that he provided, so I got out of there. So I 525 00:35:25,760 --> 00:35:26,760 changed location. 526 00:35:27,000 --> 00:35:29,280 I got rid of all my wireless gear. 527 00:35:29,780 --> 00:35:32,180 But the Secret Service has key information. 528 00:35:32,900 --> 00:35:37,460 They get the name of Butler's girlfriend from an associate of Aragon's and track 529 00:35:37,460 --> 00:35:38,460 down her address. 530 00:35:39,400 --> 00:35:43,980 It's now a shoe leather investigation as teams of agents take out the 531 00:35:43,980 --> 00:35:44,980 girlfriend's house. 532 00:35:45,560 --> 00:35:49,660 Once Butler leaves, they follow him straight to his safe house. 533 00:35:50,220 --> 00:35:55,140 and they followed him as he moved some of his stuff into his new safe house. So 534 00:35:55,140 --> 00:35:57,740 they just followed him right to the front door, literally to the front door. 535 00:35:58,340 --> 00:36:00,860 But they don't rush in, not yet. 536 00:36:01,320 --> 00:36:05,640 Aragon had told them that Butler has a kill switch program that can immediately 537 00:36:05,640 --> 00:36:06,960 destroy evidence. 538 00:36:07,700 --> 00:36:11,580 We knew he had encryption on that computer, and it was going to be hard to 539 00:36:11,580 --> 00:36:13,480 unless those computers were on. 540 00:36:14,140 --> 00:36:17,900 I had them all locked and encrypted. In my mind, encryption was... 541 00:36:18,670 --> 00:36:21,970 This blanket that made them not even real. I didn't see the computers as 542 00:36:21,970 --> 00:36:24,230 computers. When they were encrypted, in my mind, they're brick. 543 00:36:24,870 --> 00:36:28,250 And it's kind of hard to explain that. You think, well, are you crazy? But I 544 00:36:28,250 --> 00:36:29,250 really believed that. 545 00:36:29,430 --> 00:36:34,350 They called on the expertise of CERT, the Computer Emergency Response Team, 546 00:36:34,450 --> 00:36:35,710 based in Pittsburgh. 547 00:36:36,190 --> 00:36:40,930 These are some of the country's foremost experts in the area of decryption, of 548 00:36:40,930 --> 00:36:45,990 taking an encrypted computer and trying to figure out ways to get into that 549 00:36:45,990 --> 00:36:47,470 computer and obtain the evidence. 550 00:36:48,220 --> 00:36:49,420 that we're seeking in the search. 551 00:36:51,600 --> 00:36:54,100 The arrest has to go down without a hitch. 552 00:36:54,560 --> 00:37:00,880 On September 5, 2007, after the 16 -month investigation, the feds are ready 553 00:37:00,880 --> 00:37:01,880 move. 554 00:37:02,400 --> 00:37:07,700 Several Secret Service agents, along with FBI agent Malarski, charge into 555 00:37:07,700 --> 00:37:08,700 Butler's safe house. 556 00:37:09,180 --> 00:37:13,280 Suddenly there's a football team of agents between me and the computers, and 557 00:37:13,280 --> 00:37:14,280 just in shock. 558 00:37:14,640 --> 00:37:16,980 The computer experts get to work. 559 00:37:17,710 --> 00:37:20,110 I thought that they were going in and collecting bricks. I thought they had 560 00:37:20,110 --> 00:37:21,110 nothing. 561 00:37:21,390 --> 00:37:25,110 Of course, that's not the case. They have some really sharp people. 562 00:37:25,750 --> 00:37:27,910 And they were able to get all that information. 563 00:37:28,610 --> 00:37:30,490 The takedown is successful. 564 00:37:31,130 --> 00:37:34,710 They get to Butler's computer before any evidence can be destroyed. 565 00:37:35,630 --> 00:37:39,330 The amount of stolen data in Butler's possession is staggering. 566 00:37:40,370 --> 00:37:43,010 The total of fraudulent charges. 567 00:37:43,870 --> 00:37:49,470 On the 1 .8 million plus cards in Mr. Butler's possession as of the date of 568 00:37:49,470 --> 00:37:52,950 search was $86 .4 million. 569 00:37:54,030 --> 00:37:59,170 At the time, it is the largest identity theft and hacking case in the country's 570 00:37:59,170 --> 00:38:00,170 history. 571 00:38:00,650 --> 00:38:06,430 On September 11, 2007, Butler is charged with three counts of wire fraud and two 572 00:38:06,430 --> 00:38:07,630 counts of identity theft. 573 00:38:09,520 --> 00:38:14,100 Federal sentencing guidelines can put him behind bars for 40 years. 574 00:38:14,440 --> 00:38:19,200 The charges reflect a small fraction of the real cost of Buckner's crimes. 575 00:38:19,640 --> 00:38:25,480 The effect on our economy is huge, obviously, when you're talking about a 576 00:38:25,480 --> 00:38:26,299 of this size. 577 00:38:26,300 --> 00:38:32,920 Financial institutions are under enough stress in this country, and the effect 578 00:38:32,920 --> 00:38:37,920 of hacking activity and identity theft just makes the situation worse. 579 00:38:38,350 --> 00:38:43,810 from everybody, from their employees to those whose cards are compromised, to 580 00:38:43,810 --> 00:38:47,150 individuals who want to then apply for credit in this country. 581 00:38:48,030 --> 00:38:53,950 On June 29, 2009, Butler pleads guilty to wire fraud charges. 582 00:38:54,550 --> 00:38:59,130 His guilty plea, in cooperation with the feds, helped Butler avoid a possible 583 00:38:59,130 --> 00:39:00,610 sentence of 40 years. 584 00:39:03,080 --> 00:39:09,900 On February 12, 2010, Butler is sentenced to 13 years in prison and $27 585 00:39:09,900 --> 00:39:11,700 million in restitution. 586 00:39:12,080 --> 00:39:16,820 At the time, it is the longest sentence for hacking in U .S. history. 587 00:39:17,400 --> 00:39:22,980 With Butler and Aragon behind bars, Carter's market eventually closes down. 588 00:39:23,460 --> 00:39:28,540 But Dark Market keeps its doors open. Master Splinter isn't finished yet. 589 00:39:29,000 --> 00:39:34,240 Slowly, one by one, administrators on Dark Market and other sites begin to be 590 00:39:34,240 --> 00:39:35,240 arrested. 591 00:39:35,620 --> 00:39:38,660 It's a massive sting operation that spans the globe. 592 00:39:40,380 --> 00:39:44,840 The only high -ranking member of Dark Market that hasn't been arrested is 593 00:39:44,840 --> 00:39:47,500 Splinter. It's time to close up shop. 594 00:39:48,540 --> 00:39:53,440 I wrote a going -away letter to the members of Dark Market saying there are 595 00:39:53,440 --> 00:39:56,980 many feds and law enforcement on this site. It's been penetrated. 596 00:39:57,820 --> 00:40:02,320 Iceman was arrested, all the other administrators have been arrested, and 597 00:40:02,320 --> 00:40:05,000 not going to suffer the same fate that they did. 598 00:40:05,360 --> 00:40:11,640 The shutdown of Dark Market prevents more than $150 million worth of loss for 599 00:40:11,640 --> 00:40:13,660 businesses and individuals worldwide. 600 00:40:14,380 --> 00:40:19,220 Within the cybercrime area, there is a bit of an arms race that goes on. 601 00:40:19,640 --> 00:40:24,580 Today, law enforcement and business must wage a full -out assault if they are to 602 00:40:24,580 --> 00:40:26,280 keep ahead of cybercriminals. 603 00:40:26,910 --> 00:40:33,390 There is this constant one -upmanship that goes on within the hacking 604 00:40:33,390 --> 00:40:38,030 against the security professionals that are involved in protecting business 605 00:40:38,030 --> 00:40:42,850 networks. This is very important to us as law enforcement because we also have 606 00:40:42,850 --> 00:40:45,210 to be on the cutting edge of the technology. 607 00:40:45,870 --> 00:40:50,010 We can get you, so you can't hide from us. And we have our international 608 00:40:50,010 --> 00:40:54,090 coalitions, and we're working very closely together with them in order to 609 00:40:54,090 --> 00:40:55,090 this problem. 610 00:40:55,370 --> 00:40:58,790 For victims like Julie, it's too little, too late. 611 00:40:59,230 --> 00:41:04,350 I will have to pay for my credit report every two months, check it, and make 612 00:41:04,350 --> 00:41:05,690 sure that there's nothing on it. 613 00:41:06,070 --> 00:41:08,910 And that's really the maddening part. That's the part that gives me anxiety 614 00:41:08,910 --> 00:41:13,390 attacks. It's like, what else could I be doing to protect myself here? How can I 615 00:41:13,390 --> 00:41:17,730 stop this from becoming this nightmare of trying, you know... 616 00:41:18,250 --> 00:41:22,350 Just basically like being the detective myself and trying to sort this out and 617 00:41:22,350 --> 00:41:24,990 figure out what steps to take. You know, how do I protect myself? 618 00:41:25,990 --> 00:41:30,850 Chris Aragon is currently awaiting trial in California for burglary and identity 619 00:41:30,850 --> 00:41:33,070 theft, among several other charges. 620 00:41:33,550 --> 00:41:39,050 Max Butler serves his time in a federal penitentiary. The Bureau of Prison says 621 00:41:39,050 --> 00:41:43,370 Butler may have limited access to computers behind bars. 622 00:41:44,230 --> 00:41:46,990 In this case, greed was certainly a motive. 623 00:41:47,470 --> 00:41:53,470 But what's obvious from the communications and the risks that Mr. 624 00:41:53,470 --> 00:41:55,630 that ego also played a very big role. 625 00:41:56,170 --> 00:42:02,250 Perhaps the biggest disappointment or shame of this case is the waste of 626 00:42:02,250 --> 00:42:08,110 here by someone who is very bright, very creative, and could have used his 627 00:42:08,110 --> 00:42:13,310 talents to benefit society and ultimately himself, and instead he 628 00:42:13,840 --> 00:42:18,740 a path that would harm many people and businesses and ultimately harm himself. 629 00:42:19,820 --> 00:42:22,660 Illegal hacking can be seductive. 630 00:42:23,160 --> 00:42:29,600 It's a thrill. It's an ego rush to be able to get into another computer that 631 00:42:29,600 --> 00:42:30,960 didn't ask for permission to get into. 632 00:42:32,140 --> 00:42:36,560 It's a temptation, but it's worth it to resist that temptation. 633 00:42:37,680 --> 00:42:42,300 I would say go to school, get an advanced degree, and stay out of 634 00:42:44,650 --> 00:42:46,250 I wish I had advice back then.