Ardit Ferizi was angry that he had been falsely accused of joining the Islamic State. The hacker’s response: He stole the personal information of U.S. service members and handed it over to the terrorist group.
“Stupidly I was annoyed that the U.S. Embassy would not defend me,” Ferizi, a 20-year-old citizen of Kosovo, wrote in a letter to a federal judge in Virginia. “I don’t know why I thought the U.S. Embassy would get involved. I was doing a lot of drugs now and spending all the day online.”
U.S. District Judge Leonie M. Brinkema on Friday showed little sympathy for an explanation that even Ferizi’s defense attorney called “nonsensical.” While acknowledging that Ferizi is young and has mental-health problems, Brinkema sentenced him to 20 years in prison.
“I want to send a message,” Brinkema said. “Playing around with computers is not a game.”
As the result of Ferizi’s hack of a retail company server, names, email addresses, passwords and other data of 1,351 military members and other government employees were published on an Islamic State “kill list” last year. In court Friday, Assistant U.S. Attorney Brandon Van Grack said one woman named on the list has begun fearing all Muslims might attack her.
The case is the first to combine charges of hacking and terrorism, a confluence that national security officials say represents the increasing prominence of cyberwarfare.
“This case represents the first time we have seen the very real and dangerous national security cyber threat that results from the combination of terrorism and hacking,” John P. Carlin, assistant attorney general for national security, said in a statement. “This was a wake-up call not only to those of us in law enforcement, but also to those in private industry.”
Ferizi was extradited last fall from Malaysia, where he had been studying computer science.
Defense attorney Elizabeth Mullin said that while Ferizi was in Malaysia, a journalist in Kosovo wrote last year that he had gone to Syria to fight with the Islamic State. Both Ferizi and his mother said the article caused him to lash out.
“We know that the article . . . worsened Ardit’s health situation,” his mother wrote in a letter to the court, referring to his psychological problems.
Van Grack called that explanation a “nonsensical story,” and Mullin agreed.
“It was a completely nonsensical, juvenile response because he was a nonsensical, misguided teenager who really didn’t know what he was doing,” Mullin said.
Ferizi began communicating online with Junaid Hussain, an Islamic State recruiter and hacker killed in a drone strike in August 2015. Before distributing the personal information of U.S. government employees, Ferizi hosted a pro-Islamic State website and argued in favor of the group online.
In the name of the Islamic State Hacking Division, Hussain tweeted out the list, along with a statement declaring, “We are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!”
Mullin argued that the “kill list” was merely propaganda, noting that personal and work addresses were not included. “The information [Ferizi] sent . . . could not assist in a specific attack against any individual,” she said.
Brinkema said that “just having your name on a list, knowing that you’ve been identified by a terrorist group,” is “terrorizing,” even if the information does not include specific locations.
Ferizi said in court Friday: “I feel so bad that what I did made people scared. I’m so sorry.” In his letter to the court, he said he had never been loyal to the Islamic State and denounced the group completely. On the contrary, he said, he has always been grateful to the United States for intervening in the war in Kosovo in 1999. Family members said they all feel warmly toward the United States and have several relatives here.
His mother also suggested in her letter to the court that the war left her son with some psychological damage.
“On the second night of the NATO airstrikes, Ardit was in the fourth year of his life,” she wrote. “The street was full of Serbian army and people wearing black uniforms and masks. They came screaming, shouting and shooting, burning houses and killing people.”
Ferizi has agreed to be deported to Kosovo after serving his prison sentence, and he will not be allowed to return to the United States.