Sentencing delayed for Hamilton 'hacker for hire' as prosecutors seek long prison term

Sentencing for Karim Baratov, who pleaded guilty to charges connected to a massive Yahoo data breach, has been delayed to give U.S. officials more time to drum up case law that supports their proposed prison sentence of almost eight years.

U.S. prosecutors say Karim Baratov's profession was 'breaking into the private lives' of his victims

Karim Baratov is shown in a photo from his Instagram account. Baratov, a Canadian man of Kazakh origins, will learn how long he has to spend behind bars in the U.S. as his sentencing hearing begins Tuesday. (Instagram/Canadian Press)

A judge is asking U.S. prosecutors to justify why Karim Baratov, who pleaded guilty to charges connected to a massive Yahoo data breach, should be sentenced to almost eight years behind bars.

The 23-year-old Hamilton man, who American officials have described as an "international hacker for hire," is facing prison time on convictions of one count of conspiracy to commit computer fraud and abuse and eight counts of aggravated identity theft.

A memorandum filed by U.S. law enforcement officials described a "pressing need" to deter cybercriminals whose hacking can lead to other criminal activity, including foreign espionage. 

Baratov was scheduled to be sentenced in a San Francisco courtroom Tuesday, but Judge Vince Chhabria questioned whether the sentence of seven years and 10 months that prosecutors were seeking was longer than what other hackers had received for similar crimes.

Baratov's attorneys have called for a sentence of three years and nine months.

Chhabria stressed that Baratov was not behind the Yahoo hack, and he rescheduled the sentencing hearing for May 29.

"We consider this a breakthrough with the defence … because [the judge] seemed to make our arguments for us," said Amadeo DiCarlo, one of the lawyers defending Baratov.

Amedeo DiCarlo, lawyer for Karim Baratov, says his client is anxious to move on with his life. (Nathan Denette/Canadian Press)

In addition to almost eight years behind bars, prosecutors were asking the court to sentence Baratov to three years of supervision after his release and fines in amounts covering "any and all of his assets."

Lawyers say curiosity 'got the best' of Baratov 

Lawyers for Baratov, who was 19 at the time the hack began, argue he was simply a curious young man whose fascination with coding "got the best of him" and unintentionally led him to amass the wealth he eagerly displayed on social media.

"He bore no intent to cause harm. He sincerely regrets his actions," wrote Andrew Mancilla and Robert Fantone in their submission to the court. "This is a hard lesson to learn for a young man ... but it is a lesson he has learned."

This is not a case of a teenager making an isolated mistake on the internet out of curiosity.- U.S. sentencing submission

They're asking he spend 45 months (almost four years) in prison, saying his youth, lack of criminal history and willingness to plead guilty should all be taken into consideration.

"Neither Mr. Baratov nor the community would be well served by a lengthy prison sentence," the lawyers said.

But authorities said Baratov's actions were not driven by innocent curiosity.

"This is not a case of a teenager making an isolated mistake on the internet out of curiosity," officials wrote. "Rather, this is a case of the defendant making a profession out of breaking into the private lives of thousands of victims."

Officials describe Baratov's actions as "egregious, extensive, and reprehensible" and say he hacked into the webmail accounts of 11,000 victims, broke into their digital records, and sold stolen access to their private lives between 2010 and 2017 to live "lavishly."

Karim Baratov poses in front of his house in Ancaster, Ont., in this undated photo. (Facebook)

Authorities say he also accessed at least 80 webmail accounts as part of a hack directed by two Russian intelligence agents.

Lawyers on both sides of the case agree Baratov did not discuss reasons for targeting specific victims with Russian spies, but U.S. officials maintain a lack of knowledge is no excuse.

"Burying one's head in the ground to the identities, motives, and plans of one's criminal customers should not be a complete shield to the consequences of working for such customers."

The Russian agents, Dmitry Dokuchaev and Igor Sushchin, used the information they stole from Yahoo to spy on Russian journalists, U.S. and Russian government officials and employees of financial services and other private businesses, according to prosecutors.

Dokuchaev, Sushchin and a third Russian national, Alexsey Belan, were also named in the indictment filed in February, though it's not clear whether they will ever step foot in an American courtroom since there's no extradition treaty with Russia.

Hacker known for flashy cars

Baratov lived in a $650,000 house on a quiet street in the affluent Hamilton suburb of Ancaster, Ont.

Neighbours knew him for his flashy cars, which included a Lamborghini, Porsche, Aston Martin, Mercedes and BMW, according to U.S. officials. He also posted photos on social media, showing off stacks of $100 bills.

But despite the appearance of wealth, American authorities say Baratov seems to have spent his money as he earned it — his only remaining assets are $30,000 from his home, $1,500 U.S. in a PayPal account and $900 that was in his wallet when he was arrested by the RCMP.

Baratov 'in good spirits'

Baratov initially pleaded not guilty to his charges. But he then decided not to fight extradition to the U.S., going there in August of 2017.

In the U.S., he  changed his plea after eight months of maintaining his innocence.

DiCarlo is in California with Baratov and his family for the sentencing and said his client still feels pleading guilty was the right choice.

"He is in good spirits and very anxious to put this behind him."

With files from The Associated Press