Youth jailed over global computer hacking business
A young man has been jailed for two years for setting up an online computer hacking business which caused chaos all over the world.
Adam Mudd was just 16 when he created his Titanium Stresser programme, which was used to carry out more than 1.7 million attacks on websites including Minecraft, Xbox Live, and gamers' communications tool TeamSpeak.
He raked in more than £386,000 worth of US dollars and Bitcoins from selling the programme to cyber criminals across the world.
Mudd admitted his money-making scheme and was sentenced at the Old Bailey by Judge Michael Topolski QC.
The judge noted that Mudd came from a "perfectly respectable and caring family" but the effect of his crimes caused damage "from Greenland to New Zealand from Russia to Chile".
He said the sentence must have a "real element of deterrent" and refused to suspend the jail term.
"I'm entirely satisfied that you knew full well and understood completely this was not a game for fun," he told Mudd.
"It was a serious money-making business and your software was doing exactly what you created it to do".
Mudd showed no emotion as he was sent down to serve his sentence in a young offenders' institution.
During the two-day hearing, prosecutor Jonathan Polnay said the effect of his hacking programme was truly global, adding: "Where there are computers there are attacks, almost every major city in the world, with hot spots in France, Paris, around the UK."
The Old Bailey heard that Mudd, who lived at home with his parents, had previously undiagnosed Asperger syndrome and was more interested in "status" in the online gaming community than the money.
The court heard that the defendant, now aged 20, carried out 594 of the distributed denial of service (DDoS) attacks himself, against 181 IP addresses, between December 2013 and March 2015.
He has admitted security breaches against his college while he was studying computer science.
The attacks on West Herts College brought down the network and cost about £2,000 to investigate, but caused "incalculable" damage to productivity, the court heard.
On one occasion in 2014, the college hacking affected 70 other schools and colleges, including Cambridge University and the Universities of Essex and East Anglia as well as local councils.
Mudd's explanation for one of the attacks was that he reported being mugged to the college but claimed no action was taken.
Mr Polnay said there were more than 112,000 registered users of Mudd's programme who hacked some 666,000 IP addresses. Of those, nearly 53,000 were in the UK.
Among the targets was the fantasy game RuneScape, which had 25,000 attacks.
It cost its owner company £6 million to try to defend itself against DDoS attacks with a revenue loss of £184,000.
The court heard that Mudd created Titanium Stresser in September 2013 using a fake name and address in Manchester.
Mudd offered a variety of payment plans to his customers, who had to log in with a username and password.
He offered discounts for bulk purchases of up to 309.99 US dollars for 30,000 seconds over five years as well as a refer-a-friend scheme.
But Mr Polnay said: "This is a young man who lived at home. This is not a lavish lifestyle case.
"The motivation around this we tend to agree is about status. The money-making is by the by."
Mudd got round PayPal attempts to bar payments to Titanium Stresser by using 328 different accounts.
He withdrew nearly 19,000 US dollars from PayPal, which he later said was to "pay his tax and National Insurance and save some money for later", the court heard.
When he was arrested in March 2015, Mudd was in his bedroom on his computer which he refused to unlock before his father intervened.
In police interview, he admitted that Titanium Stresser was for DDoS and explained how he avoided PayPal scrutiny.
Mudd, from Kings Langley, Hertfordshire, pleaded guilty to one count of doing unauthorised acts with intent to impair the operation of computers, one count of making, supplying or offering to supply an article for use in an offence contrary to the Computer Misuse Act, and one count of concealing criminal property.
Mitigating, Ben Cooper appealed for his client to be given a suspended sentence.
He said Mudd had been "sucked into" the cyber world of online gaming and become "lost in an alternate reality" after withdrawing from school due to bullying.
Mudd, who was expelled from college and now works as a kitchen porter, had been offline for two years, which was a form of punishment for any computer-obsessed teenager, he added.
The "bright and high-functioning" defendant understands what he did was wrong but at the time he lacked empathy due to his autistic condition, the court heard.
Mr Cooper said: "This was an unhappy period for Mr Mudd, during which he suffered greatly.
"This is someone seeking friendship and status within the gaming community."
But Judge Topolksi warned: "I have a duty to the public who are worried about this, threatened by this, damaged by this all the time ... It's terrifying."
Detective Chief Inspector Martin Peters, of Bedfordshire Police, said: "It is important that this case sends out a clear message to others who may be tempted by committing cyber crime or who are already engaging in cyber scams from the comfort of their own bedrooms to consider what they are doing, and it is for parents to know and understand what your children are doing online."
Claire Pluckrose, from the National Crime Agency's National Cyber Crime Unit, said: "This investigation is a great example of the effective way national and regional teams work together to tackle cyber crime."
Outside court, Mudd's parents said in a statement they were "devastated" at the judge's decision not to suspend his sentence.
They said their son had been "let down by the health services' failure to diagnose his condition earlier".