Associated Press | A San Francisco man who had more than 1.8 million stolen bank and
credit card numbers on his home computers was sentenced Friday to 13
years in federal prison and ordered to repay $27.5 million to the banks
and credit card companies he victimized.

Max Ray Vision, who legally changed his last name from Butler, had
pleaded guilty in June to his role in an online clearinghouse where
identity thieves shared stolen information.

A self-taught computer whiz who fell in love with the devices as an 8-year-old boy in his father’s computer store, Vision told Senior U.S. District Judge Maurice B. Cohill Jr. that he was mesmerized by “the thrill of hacking, being addicted to it.”

Bespectacled, soft-spoken and articulate, the 37-year-old Vision told the judge he had changed and realizes what he did was wrong.

“You probably hear that a lot, but it’s absolutely true,” he said.

Cohill’s sentence was based on a joint recommendation by federal prosecutors and Vision’s public defender, Michael Novara. Federal sentencing guidelines suggested a sentence of 30 years to life, which Novara called “ludicrous.”

Still, Assistant U.S. Attorney Luke Dembosky said serious punishment was merited because of the scale of Vision’s crimes. Dembosky agreed to the lesser sentence because Vision has continued to work with the government under terms that remain sealed.

All Dembosky would say is, “It could relate to a whole range of things.”

Before his arrest in 2007, Vision had developed software to prevent hacking and had even worked as a volunteer who helped the FBI understand and prevent cyber crimes.

Dembosky agreed that Vision wasn’t mean-spirited, but was more “wide-eyed” and “curious” about what he could accomplish behind a keyboard.

“Unfortunately, that curiosity took a dark turn and that’s why we’re here today,” Dembosky said. “The amount of damage a person can cause with a keyboard in this day and age is astronomical.”

Visa, MasterCard, American Express and Discover tracked more than $86 million in fraudulent purchases to the account numbers found on Vision’s computers. In all, 10,000 financial institutions were victimized, Dembosky said.

Vision was charged in Pittsburgh because he sold more than 100 credit card numbers and related information to a western Pennsylvania resident who cooperated with the investigation of a Web site called cardersmarket.com. About 4,500 people worldwide could trade or access stolen credit information on the Web site from 2005 until it was shut down in 2007.

Vision has been in custody since authorities raided his apartment in September 2007.

Although authorities found 1.8 million stolen credit card numbers on his computers, they said they were confident that Vision had obtained 1.1 million directly, Dembosky said. The others might have come from other sources.

Vision’s $27.5 million restitution was calculated by multiplying the 1.1 million by the roughly $25 it costs banks and credit card companies to replace each stolen credit card number, Dembosky said.

“No one should think that’s the amount of money Max gained as a result of this misadventure,” said Novara, who claims Vision likely netted less than $1 million from selling the numbers.

“I think we’re all trying to figure out, how did we get here?” Novara said.