A Ukrainian national and one of the world’s most notorious cyber-criminals, Roman Vega (aka “Boa”), was sentenced to 18 years in jail by a US federal court. Boa helped cofound CarderPlanet, one of the first online marketplaces for stolen financial data.
Vega, 49, pleaded guilty in 2009 to conspiracies to commit money laundering and access device fraud in a federal court in Brooklyn, New York on Thursday.
Apart from his popular moniker, Boa (he was also known by the aliases ‘Roman Stepanenko’, ‘Randy Riolta’ and ‘RioRita’), “conspired with others to steal large volumes of credit card information through hacking and other sophisticated means, and then sold that stolen information to others, who ultimately used the information to purchase merchandise and services,” the US Department of Justice (DOJ) said in a statement.
“Vega helped create one of the largest and most sophisticated credit card fraud sites in the cybercrime underworld – a distinction that has earned him the substantial sentence he received today,” said Acting Assistant Attorney General Raman on Thursday.
The Ukrainian hacker’s foray into stolen financial data began with the Boa Factory in the late 90s, a trailblazing website for buyers and sellers of stolen credit card information.
In 2001, Vega spearheaded efforts among 150 hackers who met in a restaurant in Odessa, Ukraine, to form CarderPlanet, one of the most prolific fraudulent credit card data websites in history. According to the US Justice Department, Vega possessed more than half a million stolen credit card numbers at the time of his arrest.
According to the DOJ, CarderPlanet became a premier online criminal bazaar due in large part to Vega’s leadership. The DOJ noted Vega’s role in instigating “a quality control system for sales” by which a stolen credit card was “subjected to a vetting process overseen by a manager to ensure that buyers obtained usable stolen data.”
Carderplanet also deployed e-currencies, such as WebMoney, established “an efficient and trustworthy online marketplace for the buyers and sellers of stolen financial information not unlike legitimate e-commerce sites.”
The organization, which boasted over 6,000 members at the height of its popularity, employed a hierarchical leadership structure mirroring that of the organized crime group, La Cosa Nostra.
At the head of the cypher-criminal organization was the ‘Godfather,’ with “a number of “Dons,” including the defendant, who used the name ‘Boa’, filling out the next rung of the later, the DOJ said. Under his assumed alias ‘RioRita’, Vega also served as a Consigliore – three levels below that of Don.
“The defendant and his group of cybercriminals emulated the mafia in organizing their criminal operations,” said US Attorney Lynch. “Now, the defendant shares the same fate as so many mafia bosses – a long term of imprisonment. This investigation has spanned the globe and should send the unmistakable message that when it comes to dismantling global cybercrime organizations, we will not be held back by distance or complexity.”
Earlier this year, Vladislav Anatolievich Horohori, who operated under the alias “BadB”, was sentenced to 88 months in prison for his role in the CarderPlanet affair.
The case was investigated by the US Secret Service, with assistance from the US Postal Inspection Service.
“The Secret Service is pleased to have participated in this multi-agency criminal investigation that lead to the arrest of Roman Vega also known as ‘Boa’,” said Secret Service Special Agent Charge Hughes following Thursday’s sentencing.
Vega’s legal drama was a long and drawn out process. He was first arrested, prosecuted, and convicted by a Cypriot court in 2003. He was later brought over to the United States in 2004, where he faced fresh federal charges in California. His legal troubles only compounded when he was indicted by a New York court in 2007. Two years later, he pleaded guilty to those charges, only to withdraw his plea in 2011. Following a series of motions, by May 2012 a judge ultimately denied his request and the guilty plea stood.
The long delay between his initial arrest and final sentencing on Thursday could suggest a plea bargain of some kind between Vega and American authorities, Cyrus Farivar, Senior Business Editor at Ars Technica, wrote.
Farivar, citing a 20 page recommendation letter from the judge, said the United States Attorney for the Eastern District of New York recommended that Vega be given “at least 20 years” in prison – two years shy of the final sentence.