Freed Facebook hack Brit vents fury at $200k cleanup claim

Original URL: https://www.theregister.com/2012/04/30/facebook_hacker_appeal/

Mangham longs for security job after sentence halved on appeal

Posted in Security, 30th April 2012 10:02 GMT

A UK man jailed for hacking into Facebook has vowed to rebuild his life – and his reputation – after winning an appeal against his sentence.

Glen Steven Mangham, 26, from Acomb, near York, was jailed for eight months in February after he pleaded guilty to infiltrating the website's internal network between April and May last year.

Mangham's sentence was halved to four months in April after senior judges at London’s Court of Appeal ruled he had been treated unduly harshly by the trial judge at Southwark Crown Court. The decision made Mangham eligible for immediate release on the basis of time served, although he is still obliged to wear a tag.

The computer science student extracted Facebook's source code without permission in hope of pointing out security flaws in the web giant's blueprints. The intrusion was detected by Facebook and reported to the FBI, which passed the case over to British cops after the penetration was traced to the UK.

Blighty's detectives further tracked the hack to Mangham's parents' house in York, leading to his arrest and subsequent prosecution. Mangham admitted three counts of unauthorised access to computers and unauthorised modification of computer data, contrary to the UK's anti-hacking laws.

The undergraduate claimed throughout that his actions were motivated by a desire to help Facebook improve its security, something he had previously done with Yahoo! The prosecution rejected this rationale and pressed for harsh punishment as a deterrent.

Facebook stressed that no user data had been involved in the breach. During Mangham's trial, representatives of the social networking firm said that the hack had resulted in investigation costs and other expenses that ran up to in $200,000 – which Mangham disputes.

In sentencing, trial judge Alistair McCreath sided with the prosecution and imposed an eight-month sentence on Mangham.

'Super Asbo' sentencing

However at the start of April, Mr Justice Cranston, sitting with Lord Justice Hooper and Judge Peter Rook QC at the Court of Appeal, said that Mr McCreath had erred in not giving enough weight to mitigating factors in the case, such as the lack of any attempt to Mangham to profit from his crime.

“He [the trial judge] rightly highlighted the persistence, sophistication and deliberation with which Mangham mounted his attack," Mr Justice Cranston said, the York Press reports.

“The judge was entitled to conclude that his motive was not to inform Facebook of the defects in the system, but to prove that he could beat the system.

“In our view, the combination of the aggravating factors and mitigating factors is such that the more appropriate starting point, in our view, would have been six months, reduced to four months given the appellant’s plea. In particular, we would underline the point which the judge mentioned that the information had not been passed on to anyone and there was no financial gain involved.”

Peter Minnikin, of Harrogate firm McCormicks Solicitors, Mangham's defence lawyers, said two grounds on which Mangham petitioned for appeal were granted.

Firstly, Mangham's defence team successfully argued that the original sentence was "manifestly excessive" and the trial judge had failed to apply consideration over whether a suspended sentence or community order might be appropriate.

Secondly, Mangham's previous good character was not factored into the original sentence he received, the solicitor continued.

Appeal judges also agreed that the "serious crime prevention order" applied by the trial judge against Mangham was unreasonable because his misdeeds were not serious enough to deserve a "super Asbo".

The latter decision means that Mangham is once again free to go online and also clear to express his opinions about the case, Minnikin explained.

Mangham wasted little time following his return online to post a lengthy criticism of Facebook's handling of his case and to tell his side of the story. The full 3,700-plus word essay is here but Mangham summarised his main gripes in this email exchange with The Reg.

He hits out at Facebook's $200,000 allegation

The undergraduate was mainly angry at what he claimed was Facebook's attempts to exaggerate the damage and disruption he had supposedly caused, as well as its attempt to "milk publicity" from the case:

I do not believe for a minute that this whole thing actually cost $200,000 [£122,000] to do. I fully accept that there was a cost but I cannot imagine how it ever reached such dizzying heights. Perhaps had they given some evidence to support and justify it then I would have been less critical here. Instead it was submitted very close to sentencing and accepted without any real scrutiny.

Based on the sentencing judge's comments this was one of the reasons he felt a custodial sentence inevitable.

Mangham's passport image was given to Facebook representatives and subsequently used as "some sort of trophy" in an article in Forbes, he said. Mangham, who accused Facebook of "maligning" his character during the trial, plans to return to his studies, which were disrupted by his prosecution. He still holds out the hope of getting a job in computer security:

I definitely plan to finish the final year of my degree, which was disrupted because of all the fuss and the bail conditions. I also hope to continue in the area of penetration testing as it is something that I really enjoy.

The 26-year-old does appear to be chastened by his experience, however:

I will be more cautious to have explicit permission in future. I am hoping that this incident has not caused irreparable damage to my reputation and prospects but I hope people can see why I needed to speak out. Had i quietly taken my beat down then only the 'nasty' version of events would be etched on to the internet. I would hope that telling my side of things helps people to see that where hacking is concerned, things are seldom black and white.

We asked Facebook to comment on Mangham's published criticism of its handling of his prosecution. A spokeswoman for the social network declined this invitation, saying it had nothing to add beyond its previous statement on the case.

In his blog post, Mangham concludes that he is lucky to have avoided the threat of extradition that other UK citizens are desperately fending off after they were accused of breaking US laws:

I am relieved that the ordeal is now over and that I can finally get on with my life. Despite all my moaning I suppose that in many respects I have been very lucky. I could have been subjected to the same kind of treatment as Gary McKinnon and Richard O’Dwyer and Christopher Tappin.
The lopsided-extradition treaty is doing a marvellous job at ensuring British citizens are whisked off to cloud-cuckoo land to be buried in some desert for a few years. I thank my lucky stars that I somehow avoided that fate, despite being such an obvious candidate for it.