I Was Sentenced to 18 Months in Prison for Hacking Back - My Story

My Journey Through Digital Ethics, Policy, Love and Fear, and Intention, Which Started With a Homeless Lady in San Francisco

To this point in my life, my identity has been linked with the American dream. I was a self-made millionaire at sixteen after starting at an ad technology company in my parents’ basement.

Following high school, I attended Stanford, where I was Chair of Entrepreneurship for the student government, co-founded an entrepreneurship dorm on campus, and was invited as a youth delegate for entrepreneurship at summits around the world like the St. Petersburg Economic Forum.

I later dropped out to start Ink, a hardware and software company creating a modern version of FedEx Office. We moved the company from San Francisco to Nebraska in a ribbon cutting with the governor after we saw significant opportunities in the state.

I also co-founded a blockchain-based cybersecurity start-up with the mission of securing IoT devices and critical infrastructure from bad actors.

Early one morning in 2019, though, when my friend’s house in the backcountry of Maui was raided by the FBI, the American dream started to morph into a nightmare.

In its most jarring turn, about a month ago, I stood in front of a federal judge, advocating for my freedom for defending myself, my start-up, and my employees against cyber theft.

A few years into building Ink, after securing over $7 million in seed capital, growing to a headcount of 30, and deploying the solution to over twenty colleges across the country, we were preparing for a growth round of financing.

Around this time, an employee left our company to join our only competitor in the higher-ed market — he had previously worked for them.

On the way out, an internal investigation determined he had taken important files and IP¹ and was disparaging us in the marketplace.

In a state of fear, I “hacked back” to assess what was taken and to mitigate the loss. I also developed a plan to counteract the disparagement.

Due diligence on the competitor showed that there might be areas for concern about their corporate history which the customers likely did not know about.

In an anonymous email to some of the competitors’ customers² and prospects, I brought these to their attention.

At the time, I viewed what I did through the lens of the Old Testament, “eye-for-an-eye,” justice. Like many in the cyber community, I believed hack backs were ethical and the only recourse that could be deployed in a timely enough fashion to protect essential trade secrets and IP.

The law is also catching up with this point of view.

The Active Cyber Defense Certainty Act, a bipartisan bill proposed to Congress in 2017 and 2019, would provide an exception to the Computer Fraud and Abuse Act (federal hacking law enacted before the Internet) to allow hack backs as a form of cyber “self-defense.”

Recently, the Biden Administration unveiled a new policy that will empower US Agencies to retaliate against hackers with counter-attacks.³ Also, the Department of Justice, in a joint initiative with the Commerce Department has launched a “hack back squad” to stop tech theft.⁴

In 2018, a little more than a year before I was indicted, though, my entire worldview changed. I had a supernatural experience with a homeless lady in San Francisco. Among other things, she predicted specific things in my life would happen, some of which have come to pass.

The experience led me down a rabbit hole of researching as much as I could about quantum mechanics, spirituality, philosophy, and neuroscience, and I started to write a book about the power of intention.

As Nikola Tesla said, “The day science begins to study non-physical phenomena, it will make more progress in one decade than in all the previous centuries of its existence.”

For me, the ends didn’t justify the means anymore. One problem with this philosophy is it doesn’t jive with natural law. Take the core principles of quantum mechanics. The intent is linked to outcomes outside of our observable reality.

If I do something which is “bad” in order to achieve something “virtuous,” the intent to do something bad — the input — ripples out and impacts outcomes outside of what we can directly see.

Spirituality and moral imperatives like the Ten Commandments provide another framework for this idea. I realized I shouldn’t have hacked back. There was a better way.

After nearly three and a half years of litigation, on December 14th, I entered into a misdemeanor plea deal. The government argued that the anonymous emails I sent to the competitors’ prospects led to a loss of business.

According to the competitor, the prospects had allegedly “verbally committed” prior to when the emails were sent, and based on a loss analysis, the shortfall was in the hundreds of thousands of dollars.

In a desire to own up to my actions, reach a misdemeanor settlement before trial, and move forward, I agreed to pay the amount.⁵ The court scheduled a hearing to determine my fate.

On April 20th, I was sentenced to 18 months in federal prison. The judge referenced the “hack back” circumstances and said he wanted to provide a deterrent to acting the way I did.

I Didn’t Expect the Outcome.

One of my attorneys, Kellen Dwyer, who is Co-Chair of Alston & Bird’s National Security & Digital Crimes Team, and who had previously worked as deputy assistant attorney general in the National Security Division, said he was not aware of anyone being charged with violating the Computer Fraud and Abuse Act where the motivation appears to have been purely defensive.

A former attorney to Ink, who was a former US Attorney, mentioned that he believed there would be a “1 percent” chance the hack would result in prosecution after we reached a civil settlement in the matter with the competitor.

Many of my friends, family, and colleagues thought the sentence was indicative of a more systemic issue in the way justice is currently administered in the country. My friends living in other countries mentioned that the matter would not have been treated criminally there.

In conversations about what happened, there invariably comes a moment when it is time for me to provide my take…

I respect the judge’s sentence. I understand the benefits of deterrence. More significant to me than policy considerations, though, is that I don’t hold the worldview I did at the time when I hacked back.

I’ve learned that ethics and law don’t always meet in the middle, and sometimes, in emerging areas like technology, might end up miles apart. I’ve also experienced the merits of different ethical models.

Consequential ethics, where ends justify the means, give us tempting logic like effective altruism and hack backs.

But, at the end of the day, although they may be born from good intent, they deprive us of the miracles and beauty which come from an independently pure motive–one which doesn’t need to be justified.

I believe each of us has a life calling of service, which, should we choose to pursue it, leads to our unique life mission. Along that journey, we will encounter challenges and setbacks, oftentimes brought on by our less experienced and evolved selves.

By approaching them with the right intention, they further refine us and our missions, serve as our greatest teachers and ultimately bless us.

There seems to be an observable universal truth that resonates regardless of your theology. The world is organized around two polar forces: love and fear. Love is the energy of creation, growth, and life. Fear is the energy of destruction, decay, and death.

No matter what circumstance we find ourselves in, we have the free will to choose which we would like to enter our reality. This is our intention. It is my intention to learn and grow from this experience and to use it for good. When I hacked back, I acted in fear.

Today, I Embrace the Outcome of My Actions With Love.

In 1918, Max Planck won the Nobel Prize in Physics for the discovery of energy quanta. He is considered the father of quantum mechanics. In describing the seemingly supernatural implications of one of his experiments, Planck said, “When you change the way you look at things, the things you look at change.”

The views represented are my own and do not reflect those of any organizations with which I am affiliated.

1. https://www.scribd.com/document/642057205/167-1-3

   
   

2. To this day, the competitor maintains a customer locator tool on their website which we frequently “scraped” to understand the growth of their customer base.

   
   

3. https://www.securityweek.com/us-national-cyber-strategy-pushes-regulation-aggressive-hack-back-operations/

   
   

4. https://gizmodo.com/hack-disruptive-technology-strike-force-justice-dept-1850123260

   
   

5. In sentencing filings, my attorneys specified that we agreed to pay based on case law supporting a broad interpretation of what constitutes restitution and that the loss was not linked to the “hack back.”

Also published here