Before being freed, hacker Sabu was ‘extraordinary’ FBI informant

The news was astonishing: Rapper Tupac Shakur was alive and well in New Zealand. But the 2011 report was a hoax, and on Tuesday, one of the hackers behind it, Hector Xavier Monsegur, appeared in court to be sentenced for cyberattacks that stole credit card information, defaced government websites, rattled media companies and briefly brought Shakur back from the dead.

The hulking Monsegur, whose online moniker was Sabu, could have received more than 20 years in prison, but the hacker-turned-informant walked out of court a free man after being sentenced to time served: seven months. He pleaded guilty in August 2011 to 12 counts related to hacking, fraud and identity theft.

It was an abrupt turn in a case that made headlines for Monsegur’s ties to the “hacktivist” group Anonymous and to high-profile cybercriminals, who showcased their skills by attacking those whose politics and policies they opposed.

But prosecutors, who asked for the lenient sentence, said Monsegur had proved to be an invaluable informant — so invaluable that they relocated him and some of his family members after they came under threat because of Monsegur’s cooperation with the FBI.

In Manhattan federal court, U.S. District Judge Loretta Preska agreed that Monsegur had turned himself around three years after FBI agents arrived at his Manhattan apartment and confronted him over his hacking. “It was truly extraordinary,” Preska said of Monsegur’s service, which began immediately upon his arrest in June 2011.

“I’m not the same person,” Monsegur, 30, said.

Monsegur’s lawyers cited his troubled upbringing, his decision to help the FBI and the “round-the-clock, all-consuming nature” of his cooperation as reasons he deserved a break. They also said his decision to work with prosecutors had upended the life of Monsegur and his family.

“Following the barrage of publicity, Mr. Monsegur could not even return home,” defense attorney Peggy Cross-Goldenberg said of the effect on Monsegur after word got out that he was aiding in FBI investigations.

In court documents, Manhattan U.S. Atty. Preet Bharara and Assistant U.S. Atty. James J. Pastore Jr. said Monsegur’s information led to the arrests of at least eight co-conspirators and enabled authorities to prevent or mitigate more than 300 cyberattacks.

“The amount of loss prevented by Monsegur’s actions is difficult to fully quantify, but even a conservative estimate would yield a loss prevention figure in the millions of dollars,” they said.

Among those convicted as a result of Monsegur’s cooperation was Jeremy Hammond, who in 2012 was considered the FBI’s most wanted cybercriminal. Hammond is serving a 10-year prison sentence after pleading guilty to hacking charges.

Monsegur also fed authorities information leading to the arrest of Matthew Keys. Keys has pleaded not guilty to charges he helped Anonymous hack into Tribune Co., parent of the Los Angeles Times, and post a fake story on The Times’ website in December 2010.

Lawyers described Monsegur as a self-taught computer whiz. He told prosecutors that he began hacking into computer systems in 1999 and that his motives varied over the years: to steal credit card information to pay his household bills; to expose online vulnerabilities so he could set up a computer security company; to undermine governments and companies he believed were blocking access to information.

In December 2011, Monsegur and a group calling itself Lulz Security, or LulzSec, posted the fake Shakur story on the “PBS NewsHour” website in retaliation for that network’s airing of a documentary about WikiLeaks. In a claim of responsibility, they said the documentary, which appeared on the program “Frontline,” was biased.

In addition to the story about Shakur, who was slain in Las Vegas in 1996, the group posted information online about some PBS journalists.

Monsegur also was involved in attacks targeting the websites of Visa, MasterCard and PayPal. In early 2011, prosecutors said, he helped stage attacks on government websites of Algeria, Tunisia, Yemen and Zimbabwe out of anger over crackdowns on public dissent in those countries.

Media organizations targeted in Monsegur’s attacks included Fox Broadcasting Co. Prosecutors said Monsegur and co-conspirators accessed Fox computer servers and stole information related to the TV show “The X Factor.”

On Tuesday, Monsegur smiled broadly as he left the courthouse but did not issue a statement. His lawyers said he hoped to find a job using his computer skills, as a systems administrator or teacher.

tina.susman@latimes.com