Quantcast StorefrontBacktalk » Blog Archive » Gonzalez Attorney: He May Not Have Known Right From Wrong
advertisement
advertisement

Gonzalez Attorney: He May Not Have Known Right From Wrong

Written by Evan Schuman
December 16th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Accused cyberthief ringleader Albert Gonzalez may not have had the “capacity to knowingly evaluate the wrongfulness of his actions and consciously behave lawfully and avoid crime” and his criminal “behavior was consistent with the description of Asperger’s disorder,” according to a government filing on Tuesday (Dec. 15), which itself quoted from a defense psychologist report.

The government was asking a federal judge for more time to investigate before a sentencing hearing, said the memo from Assistant U.S. Attorneys Stephen P. Heymann and Donald L. Cabell. “The government has been given no prior notice of either of these assertions, the defendant’s intended reliance on expert testimony to support them or that the defendant was undergoing a psychological forensic examination.”

Gonzalez has agreed to plead guilty to masterminding a cyberthief ring that stole data from TJX, BJ’s Wholesale Club, Boston Market and Sports Authority, among other major chains.

A defense sentencing memo was also filed, where defense counsel Martin G. Weinberg argued that Gonzalez should receive a more lenient sentence than the government is seeking. In that memo, Gonzalez’s attorney wrote that Gonzalez told government lawyers that his team had “breached at least four card processing companies,” according to a story about the sentencing memo in Wired.

If Gonzalez and/or his associates had indeed breached at least four card processors, that goes well beyond the number the government has accused him of. It would also explain quite a few groups of reissued cards that didn’t seem to connect to any publicly reported breach.

In addition, the sentencing memo confirmed that his team had a means to deencrypt stolen payment card information and that Gonzalez told the feds about data breaches that had not yet been detected.


advertisement

3 Comments | Read Gonzalez Attorney: He May Not Have Known Right From Wrong

  1. Centennial Says:

    THIS IS ABSURD! Asperger’s Syndrome does NOT affect ones ability to reason right and wrong.

  2. Evan Schuman Says:

    Editor’s Note: Yes, we had the same thought. But we referenced it for three reasons. First, the defense has the right to say anything in their defense and we don’t think it’s right for us to say, “We won’t tell you the defense’s strategy because we think it’s silly.” We can certainly comment on it, but we felt this was important enough for the readers to hear. Secondly, the defense didn’t say that Asperger’s impacted the defendant’s ability to reason right and wrong. It made two distinct points: He indeed can’t differentiate between those two and he also seems to have Asperger’s. Had they said “he doesn’t have the ability to differentiate right and wrong and he also’s confined to a wheelchair and an oxygen tank because of a car accident.” The defense didn’t directly link the right/wrong point and Asperger. That was key to our decision to run it. Thirdly, the government noted it and didn’t choose to dispute it.
    In short, you’re right about Asperger but I don’t think the story contradicted that position.

  3. Biff Matthews Says:

    What a bunch of BS and waste of everyone’s time and money. How about some fairness for those victimized.

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...