BreachForums admin 'Pompourin' sentenced to 20 years of supervised release Conor Brian Fitzpatrick – aka "Pompourin," a former administrator of notorious leak site BreachForums – has been sentenced to 20 years of supervised release. Fitzpatrick was arrested and charged in March 2023. Authorities accused him of running the site, which allegedly facilitated sales of stolen data, hacking tools, and …
So what exactly does that mean? I assume they mean he can't use a browser, but when assuming can land your ass 10 years in jail...
So most phones use a WI-Fi connection over the internet to make a call when they can.. does that count?
But then I assume using a smartphone is right out. No Google Maps, for example. But what about Google Maps in his car? That seems to be "always-on" in my friend's Honda.
Does using a smart TV count? Or even just a smart refrigerator or washer? Or an Alexa device?
That is actually a really harsh punishment - many things these days are difficult or impossible to do without internet access. Some examples:
- taking stuff to the dump - you have to book appointment online here
- paying bills - most of them require online banking or payment via website
- banking in general - all those branch closures make it harder
I can only assume that the prosecution had a word with the judge that he's been very useful to them in bringing cases against some of his former users, otherwise it seems inconceivable that he'd get off so lightly, even with guilty pleas. Either that or it was in the "too much likt hard work to bring to trial" box.
He's forbidden from using the internet for the first year.
The defendant shall not have any access to the internet within the first year of his supervised release. After that year the defendant shall not sell or offer to sell any item on the internet for another person or entity without pre-approval and authorization from the court or probation officer. This includes, but is not limited to, selling items on internet auction sites.
The sentencing conditions also read:
The defendant shall disclose to the probation office all computers as defined in 18 U.S.C. § 1030(e)(1)*, and similar
devices that provide access to the Internet, that the defendant owns, possesses, or uses. The defendant shall not possess
or use any computer or similar device, which includes use of computers at work, unless the defendant cooperates with
the probation office's computer monitoring program or receives permission from the probation office. The defendant
shall permit random, unannounced inspections on any unmonitored computer or similar device under the defendant's
control to ensure compliance. The defendant shall not use the Internet to communicate with any individual or group
who promotes sexual abuse of children.
Don't forget that (aside from his headline conviction for running BreachForums) this guy was found to be in possession of CSAM, so the internet monitoring relates to that too.
The judgment states that he needs to turn over his devices to a probation officer upon request. Failure to do so = revocation of release.
At the risk of going to prison for 20 years, I wouldn't be looking for any loopholes in the sentencing guidelines if I were him.
* "...the term “computer” means an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device;"
I'll agree with you on that first part. Deviants who traffic in child sex abuse material have a special place waiting for them in hell.
The only reason this guy's not in prison is obviously that he provided the FBI with useful information. The court document linked in the article suggests that the monitoring and associated probation-related expenses are on him rather than the taxpayers. Which is something, I suppose...
Isaac Asimov got there first (I think).
Spent a few hours failing to find an Asimov(?) short story about a computer fraudster whose punishment involved psychological conditioning that made it impossible for him to use or even touch computers. They were omnipresent in the imagined setting, so he couldn't play on-line chess, he couldn't order food in a restaurant, he couldn't apply for or hold a job, he was essentially cut off from society. He tried to enlist a lawyer to get his sentence lightened, and the lawyer promised to try but held out little hope. In the lawyer's opinion, "The punishment fits the crime" (the Gilbert&Sullivan reference reinforces my belief that it was an Asimov story).
Probably, though the nasty stuff Pegasus has to perform to do what it does may render it incompatible with the normal iOS shutdown process. At least it would be nice if that were the case.
Since Pegasus all and its brethren are memory resident since none has cracked Apple's code signing Apple ought to introduce an option to have an iPhone reboot itself every night - at a user specified time or after midnight whenever it hasn't been touched for at least an hour. I think NSO relies on the fact that phones are only rebooted when a software update is done. If they were rebooted daily that would require hitting them all with the targeted attack payload on a daily basis, increasing the chance of discovery.
Not close enough to the details to know enough, but let me get this straight - site used to share information on security issues is "illegal" because downstream users did bad stuff with it.
Where does that leave, say, chemistry textbooks available to anyone that, if you know what you are doing, teach how to make all kinds of nasties. Or Physics textbooks, that similarly, teach the underpinnings of nuclear fission and the potential for critical mass/density?
We have in absolutely plain view subscription services and businesses (Shodan, amongst others) that share information that could be used to enable crime. Is the business the culprit here? Should they also stop operating overnight?
What you choose to use the information on downstream might well be illegal; but the information on the system itself?
Law is a very screwed up place.
"...site used to share information on security issues"
That's quite a description for a forum that distributed stolen data and child pornography.
It's in no way comparable to Shodan.
Here's the Wikipedia page to bring you up to speed.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
