1. Early life

2. First offense

3. Professional and personal life

4. FBI investigation, guilty plea, and sentencing

5. References

6. Further reading

Early life

Butler was born on July 10, 1972,^[4][5][6] and grew up in Meridian, Idaho with a younger sibling; his parents divorced when he was 14.^[5] His father was a Vietnam War veteran and computer store owner who married a daughter of Ukrainian immigrants.^[7] As a teenager, Max Butler became interested in bulletin board systems and hacking.^[5] After a parent reported a theft of chemicals from a lab room, Meridian High School expelled Butler, and Butler pleaded guilty to malicious injury to property, first-degree burglary, and grand theft. Butler was diagnosed as bipolar in a two-week psychiatric evaluation at an in-care facility and ultimately received probation for his crimes, sent to live with his father, and transferred to Bishop Kelly High School.^[8]

First offense

Butler attended Boise State University for a year.^[9] In 1991, Butler was convicted of assault during his freshman year of college.^[5] His appeal was unsuccessful on procedural grounds, as a judge ruled that Butler's defense attorney did not raise the issue in an earlier appeal. The Idaho State Penitentiary paroled Butler on 26 April 1995.^[10]

Professional and personal life

Butler moved with his father near Seattle and worked in part-time technical support positions in various companies. He discovered Internet Relay Chat and frequently downloaded warez, or illegally downloaded software or media. After an Internet service provider in Littleton, Colorado traced Butler's uploads of warez to an unprotected file transfer protocol server –the uploads were consuming excessive bandwidth–to the CompuServe corporate offices in Bellevue, Washington, CompuServe fired Butler.^[11]

Moving to Half Moon Bay, California, Butler changed his last name to Vision and lived in a rented mansion "Hungry Manor" with a group of other computer enthusiasts.^[12] Butler became a system administrator at computer gaming start-up MPath Interactive.^[13] The Software Publishers Association filed a $300,000 lawsuit against Butler for engaging in unauthorized distribution of software from CompuServe's office and later settled the case for $3,500 and free computer consulting.

After marrying Kimi Winters, he moved to Berkeley, California, and worked as a freelance pentester and security consultant. During this time, he developed 'an online community resource called the "advanced reference archive of current heuristics for network intrusion detection systems," or arachNIDS.'^[14]

FBI investigation, guilty plea, and sentencing

In the spring of 1998, Butler installed a backdoor onto American federal government websites while trying to fix a security hole in the BIND server daemon. However, an investigator with the United States Air Force found Butler via pop-up notifications.^[15] He hired attorney Jennifer Granick for legal representation after hearing Granick speak at DEF CON. On 25 September 2000, Butler pleaded guilty to gaining unauthorized access to Defense Department computers.^[4] Starting in May 2001, Butler served an 18-month federal prison sentence handed down by US District Judge James Ware.^[16]

After his release from prison in 2003 on supervised release, Butler exploited Wi-Fi technology to commit cyberattacks anonymously along with Chris Aragon from San Francisco.^[17] He advanced to programming malware, such as allowing the Bifrost trojan horse to evade virus scanner programs and exploited the HTML Application feature of Internet Explorer to steal American Express credit card information.^[18] Butler also targeted Citibank by using a Trojan horse towards a credit card identity thief and began distributing PINs to Aragon, who would have others withdraw the maximum daily amount of cash from ATMs until the compromised account was empty.^[19]

Arrested in 2007, Butler was accused of operating CardersMarket, a forum where cyber criminals bought and sold sensitive data such as credit card numbers. After pleading guilty to two counts of wire fraud, stealing nearly 2 million credit card numbers, and spending $86 million in fraudulent purchases, Butler was sentenced to 13 years in prison, which was the longest sentence ever given for hacking charges in the United States of America. At least two longer sentences are known – Albert Gonzales, the TJX hacker (2010: 20 years),^[20] and Roman Seleznev, (2017: 27 years).^[21] After prison, Butler will also face 5 years of supervised release and is ordered to pay $27.5 million in restitution to his victims.^[3][22]

The restitution amount was figured by taking the full credit amount of each credit card and not the actual amounts ultimately charged. Although the banks refunded all amounts to the individuals, inconvenience and disruption resulted. Max realized the harm done and has publicly apologized to all affected. Actual amounts ultimately charged to the cards did not exceed one hundred thousand dollars and the crime profits mostly went to the other people who ultimately used the stolen cards. Also the vast majority of the credit card data was lifted by Max Ray Butler from other cybercrime online pirate websites. Max not only took the credit cards from criminal web sites but he also shut those sites down.

Butler is currently incarcerated at Calcasieu Correctional Center. Mailing address is Max Ray Butler, B7 - Calcasieu Correctional Center - PO Box 2017 - Lake Charles, LA 70602-2017. Open and closed case data can be found on pacer.com by searching Max Ray Butler.

Butler's story was featured in an episode of the CNBC television program American Greed in 2010.^[23]

References

Further reading

• Kevin Poulsen, Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground, 2011, publisher: Crown. {{ISBN|0-307-58868-8}}
• Misha Glenny, DarkMarket: How Hackers Became the New Mafia, 2012, publisher: Vintage. {{ISBN|0307476448}}

• State highway 127A (Massachusetts)
• State Highway 127A (Massachusetts)
• State Highway 127 (AR)
• State highway 127 (AR)
• State highway 127 (Arkansas)
• State Highway 127 (Arkansas)
• State Highway 127 (Massachusetts)
• State highway 127 (Massachusetts)
• State highway 127 (Missouri)
• State highway 127 (MO)
• State Highway 127 (Oklahoma)
• State Highway 127 (Texas)
• State Highway 127 (Texas 1939)
• State Highway 128
• State highway 128 (Massachusetts)
• State Highway 128 (Massachusetts)
• State Highway 128 (Missouri)
• State highway 128 (MO)
• State Highway 128 (Oklahoma)
• State Highway 128 (Texas)
• State Highway 128 (Texas pre-1939)
• State Highway 129
• State Highway 129A (Massachusetts)
• State highway 129A (Massachusetts)
• State highway 129 (Massachusetts)