NullCrew hacker never made a dime off crimes but gets 45 months

Timothy French may have never made a dime from his exploits with the notorious hacking group, NullCrew.

But U.S. District Judge Gary Feinerman said French, 22, seemed to take pleasure in the harm he caused by embarrassing businesses, universities and governments online, and by dumping sensitive personal information on the Internet.

“He was more like a vandal — committing vandalism,” Feinerman said as French stood before him Tuesday. “And he enjoyed it.”

Moments later, Feinerman sentenced French to 45 months in prison for helping expose 12,000 Bell Canada customer usernames and passwords in June 2014. Feinerman handed down the sentence despite an emotional plea from French, who sought only three years behind bars. French predicted that’s the amount of time he’ll need to rehabilitate himself in prison.

“All I want is a chance to succeed in life,” French said.

Defense attorney Candace Jackson said such an opportunity was fleeting, if non-existent, for French while he was growing up in Morristown, Tenn., where she said most kids wound up in one of three categories — pot heads, pill heads and meth heads. Bullied and abused, French retreated to his computer as a youth, Jackson said.

But the feds say French fell in with the hacking group known as Team Poison, which carried out cyberattacks against the UN, NASA and NATO in 2011 and 2012. Jackson emphasized that French had nothing to do with those attacks. Rather, his ties to a community college hack led the FBI to his door in December 2011 — when he was just 17.

But that’s one reason Assistant U.S. Attorney William Ridgway sought a stiffer sentence for French. Rather than change his ways after the FBI gave him a pass, Ridgway said French escalated his hacking campaigns and became an elusive target for law enforcement.

“This must stop, and we need to take this seriously,” Ridgway told the judge.

Feinerman cited French’s difficult upbringing and young age while handing down his sentence, as well as the fact that French has never been to prison before.

“He committed this crime before he became — and I don’t think he has yet become — a fully formed person,” Feinerman said.

Jackson said French never stole a Social Security Number nor did he profit from the hacks. She said her client’s attraction to the Internet is the behavior of an addict. And in a bid for redemption, she said French offered Feinerman a sealed list of suggestions for institutions hoping to improve their online security. She compared him to notorious hacker Kevin Mitnick, who used his computer skills to develop a career as a security consultant.

But the feds say French’s hacks caused more than $792,000 in damage, and much of the havoc can’t even be quantified. He admitted in December that he launched a NullCrew cyberattack through a Naperville computer server and participated in six additional attacks. NullCrew tried to publicly embarrass targets — which also included the University of Virginia and the Science & Technology Center in Ukraine — by boasting about its successes on Twitter.

French used the online handles “Orbit,” “@Orbit_g1rl,” “crysis,” “rootcrysis” and “c0rps3.”

“It took a very long time to catch him,” Ridgway said.