Police blotter: 'Special skills' hurt credit card thief

"Police blotter" is a weekly report on the intersection of technology and the law. This episode: An Internet credit card thief is nabbed.

What: Appeal by a Massachusetts man who had pleaded guilty to illegally possessing credit card numbers obtained from e-commerce sites.

When: Decided July 22 by the First Circuit Court of Appeals.

Outcome: Sentence upheld, including additional punishment for "special" computer skills related to Web hacking.

What happened: When Kenneth Prochner tried to enter Canada at a border crossing from New York state, police discovered he was carrying papers and a notebook with "numerous" credit card numbers.

A quick investigation revealed that the credit card numbers had been reported as lost or stolen, and Prochner confessed to obtaining them from the Internet. In a written statement, he described altering Web sites' cgi-bin addresses in a way that let him view order logs with credit card numbers.

After his confession, Prochner seemed to realize he had little chance in court. He plead guilty in July 2003 to violating a federal law prohibiting the possession of 15 or more credit card numbers with intent to defraud. He was sentenced to a 25-month prison term and three years of supervised release.

His attorney appealed, saying the sentence, which included $2,610.19 of restitution, was too harsh. Prochner also challenged a requirement barring him from working with children while on supervised release--a condition imposed because entries in his journal talked about wanting to have sex with boys and, in the court's words, indicated that he "may have" done so.

A three-judge panel of the appeals court rejected all of his arguments.

They concluded Prochner had "special skills"--a phrase used in federal sentencing guidelines--because he knew how to rewrite the input sent to Web sites' cgi-bin interfaces. "Prochner's affidavit supports finding a level of sophistication well beyond the ordinary," the judges concluded. (Without the special skills enhancement, his sentence would have been as low as zero to six months.)

The court also concluded that "Prochner might pose a threat to children, and that evaluation for participation in a sex offender treatment program, and participation if further ordered, was reasonably related to the purposes of supervised release."

Quote from Prochner's written statement: (As released by the court; some parentheses and brackets have been removed for clarity.) "After accessing the Internet, via telnet and MIRC/PIRCH and accessing websites' order logs via Cart32 (an Internet credit card ordering program), I scanned twenty some credit cards... credit cards can be checked for validity via bots (i.e. scripts that check cards are still active/inactive), and I used a MIRC based program via Windows 98SE, on an Undernet channel and a Dalnet based channel to check three or four AMEX cards and found them to be 'extremely' valid."

[Mendz]

Document your sins...

... and carry them around with you in a notebook anyone can read is as good as letting yourself get caught. So, if you can't encrypt/decrypt, next time, memorize.

[Aimster]

Censorship

Am I being stuffy or is it crazy that we can publish what this guy said? The normal American looks as the quote from this guy's notebook and it looks like gibberish, but to someone who is as technologically well versed and just as devious we have just handed them carte blanche on how to do the same thing. When will there be censorship on what is reported? Are we not thinking or are we trying to protect our rights? Where is the line drawn?

[Mendz]

Correct...

I almost wanted to thank the author for the details... But then again I remembered: I'm not a hacker.

[George Cole]

normal American

<a class="jive-link-external" href="http://www.analogstereo.com/land_rover_owners_manual.htm" target="_newWindow">http://www.analogstereo.com/land_rover_owners_manual.htm</a>

[Dachi]

It was a bit harsh.

He stole some credit card #'s but did he even use them? 25 years is what they give people who kill someone for their wallet and then actually use their credit. IMHO until he actually makes a purchase or sells this information, he is a hobbyist with a (mostly) illegal hobby.

[Dachi]

Re: It was a bit harsh.

Er. nevermind, I am tired and I read that as years, not months. 25 months is fine.