Marcus Hutchins, aka Malwaretech, the 25 year old former hacker who ‘accidentally’ stopped the WannaCry cyber-attack in 2017, and was subsequently arrested in the US for his role in creation and selling of the Kronos and UPAS Kit banking malware, will not be going to jail, he was told in sentencing today. He had potentially faced a 10 year stretch and a maximum US$ 500,000 fine.
SC Media UK awarded Hutchins a special recongnition award in June 2017 following his role the previous month in creating a kill switch for WannaCry, which was causing havoc in the NHS as well as impacting organisations around the world.
He registered a domain name to understand the spread of the virus, but it halted the spread. Then in August 2017, after attending Def Con cyber-security conference in Las Vegas that summer, he was arrested by federal marshals at the airport before he was able to return to the UK, and had been in the US on bail since then.
Initially Hutchins initially plead Not Guilty in relation to hacking activities in 2012 and 2015 but online chats intercepted by the FBI on November 2014 provided a range of evidence including a complaint that he had only made US$ 8,000 from five sales of Kronos. He subsequently put in a guilty plea to two counts of creating and selling the malware and eight remaining charges were dropped.
US prosecutors argued that despite Hutchins having admitted guilt, apologising for and regretting his earlier actions, and having clearly reformed to work on the side of cyber-security, he still bore responsibility for his actions.
Hutchins said: "I regret these actions and accept full responsibility for my mistakes. Having grown up, I've since been using the same skills that I misused several years ago for constructive purposes. I will continue to devote my time to keeping people safe from malware attacks."
Presiding judge JP Stadtmueller accepted that Hutchins had "turned a corner" and in a Milwaukee federal court today he sentenced Hutchins to one year of supervised release and he would be allowed to return to the UK and would not have to pay any fines.