A young Canadian hacker hired by Russian FSB agents to help with the biggest hack in history will spend five years for his role in the crime, a U.S. federal just ruled today. Karim Baratov, one of the key figures in my podcast about the Yahoo hack, Breach, was spared some of the 94-month sentence that federal prosecutors requested. Still, the Kazakh-born hacker was given a 5-year sentence by U.S. Judge Vince Chabria, and fined $250,000.
Baratov played a relatively small role in the vast Yahoo hack, which federal authorities say led to theft of credentials for 500 millions accounts. The hack also allowed Russian agents to read the emails of 32 million victims worldwide.
Three Russians indicted with Baratov are still at large, believed to be in Russia.
Baratov confessed to the hacking crimes, but said he was unaware that he was aiding the Russians in the large Yahoo hack. His specialty was gaining access to targets’ email accounts. He advertised his service as an aid to suspicious spouses online, and generally charged $100 to break into a Gmail account and give access to whomever paid him.
Baratov unlocked perhaps hundreds of accounts for Dmitry Dokuchaev, federal authorities say. Dokuchaev and fellow FSB agent Igor Sushchin ran a years-long plot to access Yahoo email accounts and mine the content for intelligence, the U.S. alleges. The group targeted specific individuals, such as diplomats, journalists, and corporate executives. U.S. authorities say Dokuchaev gave Baratov details of targets’ Yahoo accounts, and Baratov used that information to break into their Gmail accounts.
According to journalist Joshua Sisco, Chabria shaved about three years off Baratov’s sentence because of his lack of criminal history and “family support.” Previously, the judge was skeptical of prosecutors demands for a longer sentence, noting that Baratov didn’t directly hack Yahoo.
At sentencing, the judge called the incident the “worst of both worlds,” because had targeted individuals and participated in a mass hack, Sisco said on Twitter.
Baratov’s parents emigrated from Kazakhstan to Canadian when he was 7 years old, and previously had said Baratov wouldn’t knowingly work with Russians.
He lived an extravagant lifestyle with his hacking profits, purchasing expensive cars and a large home outside Ontario, Canada.
According to Kevin Poulsen of the Daily Beast, Baratov “briefly addressed the judge to apologize to his victims.”
“The last 14 months have been a very humbling and eye opening experience,” he said. “There’s no excuse for my actions.… All I can do is promise to be a better man, obey the law and ask for a second chance.”