Judge Truncates Sentence of Young Hacker Who Helped Islamic State

ALEXANDRIA, Va. (CN) — Just a few years ago, hacker Ardit Ferizi was sentenced to 20 years for sharing personal information about U.S. military servicemembers with the Islamic State group.

Due to an outbreak of Covid-19 at his prison in West Virginia, however, that sentence is now cut short.

U.S. District Judge Leonie Brinkema ordered the release and immediate deportation of the Kosovo-born computer fraudster Thursday, despite having rejected a similar request in October,

Prosecutors wrote in a sentencing memo that Ferizi engaged with the now-dead terrorist recruiter Junaid Hussain in 2015 — a time when Islamic State strongholds in Syria and Iraq were ramping up calls for attacks on U.S. citizens, civilian or military. 

Crowdsourcing those efforts, Hussain turned his sights online and courted international supporters of the Islamic State through Twitter and other platforms. Hussain eventually posted a “kill list” naming 100 U.S. military personnel, and 19-year-old Ferizi, federal prosecutors said, “outdid himself” to assist Hussain.

“With complete awareness,” the memo states, Ferizi supplied Hussain with phone numbers, email addresses, account passwords and other personal information that he had culled from a company with servers based in Arizona. 

The company’s database held tens of thousands of names, and Ferizi specifically fished out roughly 1,400 clients whose email addresses ended with .mil or .gov.

Within two months of extracting the data, Hussain took what Ferizi stole for him and published it on Twitter with a warning: “We are in your emails and computer systems, watching and recording your every, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!” [sic]

Investigators ultimately identified Ferizi as the man behind the online alias “Th3Dir3orY.” The teen was arrested in Malaysia, where he had been studying, and spent three months in captivity Kuala Lumpur. Before he was extradited to the U.S. in 2016, according to Brinkema’s order Friday, Ferizi was doused with water, burned with cigarettes, and made to sleep on a concrete floor naked. He was provided with neither bedding nor toilet during his time. 

After pleading guilty to computer fraud and providing material support to a foreign terrorist organization, Ferizi was sentenced to 20 years in prison.  He was the first person to be convicted of such charges in the United States.

Now 24, Ferizi requested a sentence reduction this summer, citing concerns over the pandemic and his underlying obesity and severe asthma he has dealt with since childhood. Given his citizenship in Kosovo, Ferizi also raised concerns about how long it would take for him to be deported or even if he could be deported to his home country given quarantine restrictions.

Brinkema had shot Ferizi down initially at a hearing in October, but the Alexandria, Virginia-based judge reversed course Friday, noting there was “no dispute the defendant has a particularized susceptibility” to the virus.

The Centers for Disease Control and Prevention states moderate to severe asthma in the face of Covid-19 can be dire. For those like Ferizi who take a daily steroid regimen, the risk of severe complication is even higher. Combined with a high body mass index, another risk underlined by the CDC, Ferizi’s chance of contracting the virus are “extraordinary,” Brinkema said. 

This June the Kosovo national was transferred from the Lewisburg U.S. Prison in Pennsylvania before being transferring to FCI Gilmer, a correctional institute in West Virginia. At Gilmer, as of Wednesday, 20 inmates and at least one staff member are positive. Two weeks ago, the number of inmates infected was 122.

“Defendant reports that no widespread testing is underway at the facility, which suggests that the recent drop in reported case numbers may well reflect inadequate testing rather than improved conditions,” the 9-page order from Brinkema states. “Although the government argues (without pointing to any supporting evidence) that BOP's safety procedures "have continued to be successful at controlling transmission at many other facilities across the country," it concedes that there is an "ongoing COVID outbreak at FCI Gilmer.” 

A Gilmer prison spokesperson declined comment Friday but pointed to the Bureau of Prisons website for additional updates on outbreaks. According to a Bureau of Prisons spokeswoman, positive test numbers are based on the most recently available data and the number of positive test cases and new cases will fluctuate as cases are added or resolved. 

Without diminishing the seriousness of Ferizi’s crimes, Brinkema found that there was room for leniency as his crime was not a violent one, and none of the victims whose information he gave to the Islamic State suffered harm. 

Judge Brinkema also cited the declaration Ferizi made to the court after he entered his plea as evidence of his immaturity at the time of his crimes.

“When I gave the information, I was mostly focused on trying to show off my hacking skills to people I had met online. I deeply regret my actions and I accept the consequences of what I have done,” Ferizi said.

Though federal prosecutors argued his release and deportation to Kosovo posed a risk and that Ferizi was likely to reoffend, Judge Brinkema was unimpressed by the “somewhat alarmist position.”

Authorities in Kosovo investigating cybercrime are regularly cooperative with the United States and were instrumental in Ferizi’s, tracking, arrest and extradition.

A network of family support also awaits him in Kosovo, Brinkema said Friday.

“Given the defendant’s age, the more than five years he has spent in prison, including the particularly brutal months in the Malaysian prison, his health risks and the conditions at Gilmer, defendant has established extraordinary and compelling grounds for release,” the order states. 

Presently, Kosovo has just over 41,000 cases of the novel respiratory virus. In the United States, there are now more than 14 million.

Subscribe to Closing Arguments

Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.

Email *

Submit