SAN FRANCISCO (CN) — A federal judge on Tuesday sentenced convicted Russian hacker Yevgeniy Nikulin to 88 months in prison for stealing more than 100 million user credentials from LinkedIn, Dropbox and Formspring databases in 2012.
“I think you're a brilliant guy. Very smart. I urge you to apply that brilliance to a lawful profession and do something good with your life other than hacking into computers,” U.S. District Judge William Alsup said after imposing the sentence he believes takes into account the nearly four years Nikulin has spent behind bars awaiting trial, the Covid-19 pandemic and the fact that he will likely never see his mother again.
The 88 months amounts to a little more than seven years behind bars for Nikulin, who will turn 33 next month.
In 2016, he was snatched off the streets of Prague, where he spent two years awaiting extradition to the U.S. to face nine criminal counts of computer intrusion, causing damage to a protected computer, aggravated identity theft, trafficking and conspiracy.
A jury convicted him of all counts in July, but found the government did not present enough evidence to prove that he committed the Dropbox and Formspring hacks for financial gain.
Alsup said Tuesday that he had his doubts about the strength of the government's case throughout the trial.
“I feel I said things on the record in frustration along the way that may have led the casual observer to think the case was a weak case,” he said. “It's true that while the evidence was coming in at trial that me, the judge, felt the case was disjointed and possibly too weak to go to the jury. I did have that feeling from time to time.”
But any misgivings he had early on were put to rest during Assistant U.S. Attorney Katherine Wawrzyniak’s closing argument, which Alsup said was one of the best he had heard in 21 years on the federal bench.
“All of the loose pieces and data points fell into place and it was quite clear the government had a strong case, not a weak case,” he said.
He also said the defense did an admirable job, but that Nikulin’s case was hurt, not helped, by going to trial.
Nikulin’s sentence breaks down to 64 months on counts two, six and eight related to trafficking in unauthorized access devices and causing damage to a protected computer, and 60 months for counts one, four, five and seven related to computer intrusion and conspiracy. These will all be served concurrently. He will also serve 24 months for aggravated identity theft.
“I want to impose a sentence that would take into account that the time imposed is harder on him than anyone in his position,” Alsup said, adding that the Covid-19 pandemic has made being in prison harder, along with the experience of awaiting trial in a country where he does not speak English and a judicial system with which he is unfamiliar.
“It's not quite Kafkaesque because he did the crime, but it is harder on him than it is on the ordinary defendant,” Alsup said.
The judge also seemed particularly affected by the fact that Nikulin has a 10-year-old daughter in Russia and that his mother may not live long enough for him to see her again. His attorney Valery Nechay said she has had four spinal surgeries and three strokes in recent years.
“It is very possible she is at the edge of her life and that Mr. Nikulin may never get to see her again. The weight of the guilt and the pain of being separated from these people who love and need him is far more punitive than any term of imprisonment that this court or any other can issue to Mr. Nikulin,” she said, arguing for time served.
Follow @MariaDinzeo
