USA v. Hutchins: Security Researcher Pleads Not Guilty To Hacking Charges

Marcus Hutchins, the security researcher credited with stopping the spread of the WannaCry ransomware attack, plead not guilty to charges that alleged he created and distributed malware used to steal banking credentials.

Hutchins, a 23-year-old British national, plead not guilty to six separate charges brought against him by the United States government at his arraignment Monday at a federal court in Milwaukee, Wisc.

The FBI arrested Hutchins at the McCarren International Airport on Aug. 3 as the researcher was readying to board his plane back to the United Kingdom. The arrest came after a grand jury in the Eastern district of Wisconsin indicted Hutchins and a second, unnamed defendant.

The security researcher, also known by his online handle MalwareTech, is accused of creating the Kronos banking trojan, a malicious piece of software used to steal banking credentials and other financial information. The charges claim Hutchins created the malware in 2014. A second defendant allegedly distributed and sold Kronos online.

The charges against Hutchins include hacking, wiretapping, and fraudulent activity including conspiracy to defraud the United States. The charges carry a maximum fine of $250,000 and maximum prison charges of 5 to ten years.

Hutchins was originally denied access to a computer and the internet but his defense asked for the restriction to be lifted. The government agreed to the request, calling the case against Hutchins a historical one and acknowledging his work requires such access.

Hutchins will be able to use his computer and the internet, and his access will not be limited to work. The only restriction placed on his internet use is he will not be able to access the sinkhole he created to stop the spread of WannaCry.

Hutchins created the sinkhole earlier this year when he discovered a domain within the code of the ransomware attack that spread to hundreds of thousands of machines in May. Hutchins registered the domain, an action that led to the halt of the outbreak.

In addition to regaining internet access, restrictions on Hutchins’ travel within the U.S. has also been lifted. He will reside in Los Angeles, where his counsel resides, though he will still be subject to GPS monitoring until Pretrial services deem it no longer necessary. Prior to the arraignment, Hutchins was limited to traveling to Las Vegas and the Eastern district of Wisconsin.

Hutchins will be represented by Brian Klein and Marcia Hofmann during the case. Hoffman serves as special counsel to the Electronic Frontier Foundation (EFF).

"Marcus Hutchins is a brilliant young man and hero," Hoffman said after the hearing. "He is going to vigorously defend himself against these charges and when the evidence comes to light we are confident he will be fully vindicated."

Pretrial motions are required to be submitted by Aug. 29, with a deadline for responses to motions set for Sept. 8. A pretrial conference is scheduled for Oct. 17 and the trial is scheduled to begin on October 23, though the date may be pushed back if the government determines the case is more complex than initially expected.