May 12, 2017, the day that could have put an end to the internet. The computers of Britain's National Health Service begin to collapse one after another. They stop working, and an unambiguous message appears on the screen: “Ooops, your files have been encrypted! Send between $300 and $600 in bitcoin to the following address to unlock the machine…”
The problem quickly snowballs into an avalanche. Some 70,000 devices go dark—not just computers, but scanners, refrigerators that store blood… all the medical equipment! The lives of thousands of people are at risk.
At the same time, the attack is unfolding all over the world. The WannaCry virus, which entered Bulgarian meme folklore under the absurd translation Искаплаче (Iskaplache, “wants-to-cry”), becomes the most powerful cyberattack in human history. In a single afternoon it causes between $4 billion and $8 billion in damage. What's more, because of how and how fast it spreads, it threatens to infect every device connected to the internet within a day.
It is stopped, in a most unexpected way, by a likable curly-haired Briton of Jamaican descent. At just 22, he becomes a celebrity in the cyberworld. Until, a few months later, he ends up in an American prison facing charges that could bring him decades behind bars.
The story of Marcus Hutchins is something between The Count of Monte Cristo and Crime and Punishment for the digital age. About the rise and fall of the boy who saved the internet (and thousands of lives) before he came face to face with the mistakes of his past…
Mother Cries
Waking up after a loud party in Las Vegas, Marcus will see a black van in the yard, just like in the movies. “It can't be the FBI, it can't be that obvious,” he will think. And later, when two neatly suited men approach him at the airport and show their badges, he will still believe they have come to gather information about the devastating WannaCry, the virus he stopped a few months earlier. Except he will hear a single word—“Kronos”—and he will understand that the demons of the past have returned. And that it is time to answer for the mistakes of his childhood…
Speaking of childhood, Marcus's great passion back then was to get on his surfboard and ride the huge waves. For years he won the surf lifesaving competitions that are popular in some parts of England.
His mother, Janet, is a nurse born in Scotland. His father, Desmond, works in social services, has experience as a firefighter and comes from Jamaica. The two met in a London nightclub, and it was in the suburbs of the British capital that their two boys were born. Marcus was 9 when the family moved to a stone house in the middle of a livestock farm just a few miles from the west coast of Britain.
Life on the farm turns out to be exactly the idyll they expected, and the children get used to a daily routine close to nature. Marcus is a bright kid. He doesn't have many friends, but, as his father says, he grows up with a very keen sense of right and wrong. He falls and breaks his wrist without making a sound, yet cries inconsolably when their landlord, the farmer, has to put down a sick calf.
The future hacker doesn't have many friends; he stands out with his height and his exotic looks in a place inhabited mostly by native-born Brits.
British Evenings
As often happens with the heroes of the digital age, that is precisely what steers him not only toward surfing but also toward technology. From the age of 6 he is drawn to the family computer; a year later he can take it apart and put it back together, fills it with strange programs, and soon starts writing them himself. As he will later say, programming becomes for him “a portal to a world where you can build anything you want. With no limits at all!”
At school, while the others are learning word processing, he is learning to write programs that get around the restrictions so he can install whatever he likes. At 13 he gets his first computer from his parents… or rather, the parts he picked out to assemble it himself. As his mother puts it, by then the computer has become “a complete and boundless love” for Marcus, who leaves it only for the surf.
Before he knows it, though, the boy feels he has learned everything he wanted, and the familiar programs bore him. And that is when he takes the step that will shape his future more than any other—he creates an account on a popular hacker forum…
As usual on a slippery slope, it all starts quite innocently. The forum gathers teenagers discussing how they've managed to crack the security of the popular MSN Messenger. One of the visitors describes software he has written, disguised as a picture, which, once opened, sends itself to everyone on the contact list and thus reaches a huge number of people. “Wow, look what programming can do,” Marcus thinks at that moment. “I want to be able to do things like that too!”
I Shot The Sheriff
At only 14, he makes his debut on the forum with a simple password-stealing program… He does astonishingly well for someone with no experience, managing to break the protection of the most popular browser of the day—Internet Explorer. The browser supposedly encrypts the passwords it saves, but the underage hacker gets around the protection. His program “reads” all of the user's passwords and sends them to his email.
The others on the forum are impressed, without the slightest suspicion that they are dealing with a kid. He says that back then it never occurred to him he was doing anything wrong. He didn't even think about what the stolen passwords might be used for. “I just felt, ‘Wow, what a cool thing I've made!’”
The first wrong step comes very quickly. One day his school online account is blocked and he is called in to explain himself. He is accused of organizing a cyberattack that irreparably damaged an expensive server on the school network. Although Marcus denies it to this day, the odds that it was a coincidence are slim…
Just then the family moves to an even smaller village, and he gets a room on the second floor, separate from everyone else. That is where his career develops—one that will cut him off from the world for a long time… before bringing him worldwide fame.
Marcus moves to another, more professional forum, where users brag about their ability to break into all kinds of systems. The minimum skill required to be admitted is having your own botnet—controlling thousands of devices whose owners have no idea, and directing them at servers to overload them until they stop working, the so-called DDOS attack.
Cry, Child, Your Father Is Innocent!
And there he is: a curly-haired 15-year-old in the middle of the idyll of the deep British countryside, already running his own botnet of 8,000 computers. He gains access to them by hiding a malicious script in torrents; users open them suspecting nothing and join the network…
But again, it's important to note: Marcus, both then and later, clearly pulls off his hacks because he can. His aim isn't to steal or to cause harm; he is simply using his skills on yet another intellectual challenge.
Somewhere along the way, however, lies the fine line that sooner or later is bound to be crossed.
At first Marcus chooses a relatively legitimate business that still brings him some income. He rents servers and provides the hosting his fellow hackers on the forum need. When asked point-blank whether he'll host phishing sites, he replies: “No problem! Anything goes, except child porn.”
A year later he has had enough of botnets, and of hosting too, because of all the dealing with unhappy customers, and he turns to what lies closest to his heart—developing attack software. And here we arrive at the story that will eventually lead him to the FBI…
Dr. Faustus
Marcus has built a solid name among hackers when a man going by the handle Vinny contacts him with an ambitious proposal: to create hacking software with a wide range of capabilities. Vinny would sell it and the two would split the revenue. That is how the program UPAS Kit comes about, named after the upas tree, whose sap the people of Java used to poison the tips of their arrows.
The business takes off very quickly—and not only the business. Marcus grows close to Vinny, and for his 17th birthday receives from him a gift: an assortment of marijuana and hallucinogenic mushrooms.
Our hero is more than happy with life. He creates programs that interest him, feels in demand and makes good money. His parents have no reason to doubt that he works as a freelance programmer; they have long known how good he is with computers. He has no need to think about what his program is used for, since every month several thousand dollars land in his bitcoin wallet.
Yes, young as he is, he already has experience covering his tracks and staying anonymous, something vital in this line of work. And yet he makes the mistake of giving Vinny his address so the special gift can be delivered.
Viral Spiral
After this success, Vinny comes back with his next proposal: a second version of the software, this time with a keylogger added—software that lets hackers capture everything the victim types on the keyboard. And also the ability to inject malicious code into the forms on websites.
The purpose of both is clear—they were the most widespread hacking tools of the time for stealing payment data. Vinny proposes to Marcus that they put into their clients' hands the ability to drain their victims' money.
Well, this is where a light finally goes on in Marcus's head that he is about to cross the line. But he doesn't have much of a choice—he refuses, and Vinny threatens to give his address to the police and expose him as the creator of hacking software. Even so, our hero holds firm. In the end the two seem to reach a compromise—Marcus will build all the other features of the software they discussed, but not the ones related to bank theft.
So a few months later, UPAS Kit 2.0 appears on the “hacker market.” It turns out Vinny has secretly hired a second person to add the features he wanted. Soon afterward the kit reappears under a new name—Kronos. It's a play on Zeus, a piece of software popular among cybercriminals. And an allusion to Greek mythology—the name of the Titan father who devoured his sons until Zeus was finally born.
This malware quickly becomes a market hit, and then a legend. And it is precisely the word “Kronos” that Marcus will hear from the FBI agents in Las Vegas seven years later…
No Woman, No Cry
The young man is sensible enough to simply pocket the money and cut all ties with Vinny. Over the following years he remains active on hacker forums. He starts his blog, MalwareTech, where he publishes detailed technical analyses of different types of malware—how they work and how they can be stopped. He begins carefully analyzing some of the most dangerous botnet groups and even develops countermeasures. He manages to get inside their software and show which computers have been drafted into them without their owners' knowledge.
All of this wins him his first legitimate job. Salim Neino, owner of Kryptos Logic, a small cybersecurity firm in Los Angeles, is impressed by the blog posts. He writes to him with an invitation to jointly develop software that checks whether a given computer has been pulled into a botnet and warns its owners. He offers him $10,000 for the project, and Marcus, guilt-ridden over his past, is so driven that he builds the first version in a few weeks.
That, in turn, earns him a permanent job, now entirely as a “white hat”—the cybersecurity term for hackers who hunt for problems so they can be fixed. And the young man is now earning more than he did in his best days “on the other side.”
Barely 20, he works relentlessly and manages to stop serious hacking attacks. He takes down the first big new-generation botnet, one that has added a huge number of so-called smart devices to its arsenal. Not just computers anymore, but cameras, phones and GPS units, skillfully hacked so that at their new master's command they can wreak havoc. Marcus manages to stop the first such group, but instead of turning it in to the authorities, he simply writes to its creator telling him to stop.
The Rich Also Cry
“Throughout my career I've found that few people are truly evil; most simply don't think about the effect of their actions,” he writes in the blog post describing his successful operation.
Which brings us to the moment when Marcus, now 22, takes a whole week off for the first time….
Around noon on May 12, 2017, the administrators of Britain's National Health Service sense that serious trouble is brewing. One by one, thousands of devices start locking up, and the problem snowballs. It very quickly becomes clear that countless countries are affected and that this is the notorious virus still known today as the largest-scale cyberattack in the history of the internet. WannaCry…
It gets its name because it irreversibly encrypts sensitive information on computers and saves it as files with the .wncry extension.
Who Laughs Last?
It will later emerge that its creators were North Korean hackers who used a particularly dangerous module built for the purposes of the US National Security Agency. The NSA's high-tech spy tool had been stolen and turned into a weapon that looked utterly indestructible and capable of infecting literally every computer on the network..
And perhaps it would have, had Marcus Hutchins chosen not to dabble in hacking but stayed on his surfboard off the remote shores of England…
“It was like watching the moment before a car crash. We knew something deadly was coming that would cost many people their lives, and there was no way to stop it,” says Josh Corman, a leading cybersecurity expert. “It looked like WannaCry was ready to spread into the US health care system. If that had happened, a huge number of people would have died. Our worst nightmare was coming true live.”
Laughing Through Tears
Within hours, the systems of the German railway company Deutsche Bahn, Russia's Sberbank, the carmakers Renault, Nissan and Honda, universities in China, police departments in India, the Spanish telecom company Telefónica, FedEx and Boeing are all hit. In a single afternoon, the data on nearly a quarter of a million computers is destroyed.
Fortunately, it doesn't last until evening. Around 2:30 p.m., after a walk around the village, Marcus happens to sit down to eat in front of his computer, only to see that the internet is on fire. “I picked a hell of a good week to take off work,” he writes on Twitter.
Within minutes he has received a copy of the malicious code from a colleague and starts feverishly studying it. His lunch is still in front of him as he uses the program to simulate an attack on a virtual machine in his bedroom. Purely by chance, literally for an instant, he sees the malware send a request to a very strange address online: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com.
Marcus has gained quite a bit of experience, and although he isn't sure exactly what this is, he knows it isn't random. So he quickly sets out to trace the site and… it doesn't exist. So he decides to simply buy the domain and see what happens, what kind of request will arrive from the infected computers.
Four seconds after 3:08 p.m., Marcus registers the site with its not-especially-catchy name for the princely sum of $10.69.
Champagne and Tears
Suddenly the terrifying WannaCry… stops. The War of the Worlds. Marcus abruptly starts receiving a huge number of requests to the site from all the infected computers around the world, but the virus stops spreading any further. It simply turned out that its creators had made a mistake: if the request went through, the code stopped running right there…
When he realizes what he has done, Marcus leaps joyfully from his chair and, for once, goes to boast to his family. “Well done, dear,” his mother says, and goes on chopping onions.
Over the next few days come furious attacks on the server, trying to take it down and thereby set the monster free again. But Marcus already understands what is going on, and he has powerful allies. For a whole week our hero never sleeps more than three hours at a stretch while making sure the site holds. “We knew that if that domain went down, WannaCry would restart,” recalls Salim Neino, Hutchins's boss. “Within 24 hours the virus would have hit every vulnerable computer in the world.”
It remains a mystery why, over the following days, the creators didn't release a new version with this small flaw fixed. Months will pass before analyses show that the culprits were North Korean hackers, though of course their homeland denies it. Many will speculate that Marcus himself was the creator, and that this explains the miracle of the sudden end, but plenty of arguments will pile up that this simply couldn't be the case.
The Truth and Nothing but the Truth
Meanwhile, he is becoming a global superstar. Overnight, 100,000 people follow him on Twitter. Thanks to the tiny photo on his blog, the neighbors recognize him, and the family home is quickly besieged by journalists. Over the following months he is forced to leave his comfortable refuge to enjoy his fame. He tours international events, telling how he managed to deal with the terrifying virus… until one morning we reach the long-awaited encounter with retribution for his earlier mistakes.
August 2017, just three months after the great triumph. The previous evening Marcus spoke in front of 30,000 people at the world's biggest cybersecurity conference in Las Vegas. Around 7 a.m. he sees the van with agents outside the door, but tells himself that kind of thing only happens in the movies.
A little later he heads to the airport, where he notices that nobody asks to check his computer. Instead, a little while later in the waiting area, two men in suits approach him. And after the introductory small talk, after they show their badges and get down to business, the very first word makes him understand that they haven't come to ask about his great success—the fairy tale is over. “Kronos.” Then they put the handcuffs on him.
Months in American jails follow, but Marcus has already earned a worldwide reputation, and a huge number of cybersecurity specialists rally to his side. Leading lawyers take on his defense free of charge.
Until Proven Otherwise
Still, there isn't much they can do, because the young man has nothing to deny. At the very first interrogation they show him a printed chat he knows well, in which he describes details of his venture. He makes a full confession.
Several weeks in jail follow, until his lawyers get him released under certain restrictions. What torments him most isn't that he came to the city of his dreams only to land in jail, but the feeling of betrayed trust. “All these people were writing to the FBI to say, ‘You've got the wrong guy.’ And that was heartbreaking,” Hutchins says. “The guilt was a thousand times worse than what I felt about Kronos.”
He is tempted to tell the whole truth on his blog, but his lawyers talk him out of it. In the spring of 2018, nine months after the arrest, prosecutors offer Hutchins a deal. If he agrees to reveal everything he knows about the identities of other hackers and malware authors, they will guarantee he won't go back to prison.
Marcus refuses. He agrees to plead guilty to only two of the ten charges. Even those are enough to put him in prison for at least 10 years, but the decision is in the judge's hands.
He has the good luck to land before an old-school judge, who notes that he has been on the bench for three decades, during which he has sentenced more than 2,200 people. “I appreciate the fact that one can consider the dishonorable conduct at the heart of this case against what some describe as the work of a true hero. In the end, that is precisely what makes this case unique,” says Judge Stadtmueller before announcing his decision.
And He Became a Man
“At the same time, if we don't take measures to protect the security of these wonderful technologies we rely on every day, all of this has the potential to cause incredible chaos.”
The case ends with a suspended sentence. The judge weighs our hero's contribution against the damage he caused and decides that his moral debt has been canceled. Almost two years after the first arrest, Marcus walks free and returns to his parents. And to his work—protecting the online world from “the bad guys.”
Must every crime have its retribution?
“There's a misconception that to be a security expert you have to dabble in the dark side,” Hutchins later advises. “That's not true. You can learn everything you need to know legally. Stick to the light.”
But had he followed his own advice, would he ever have ended up in the role of savior? Sometimes simple explanations don't work. And that is exactly when the time comes for powerful stories, like that of Marcus Hutchins…
This piece is based on Wired's in-depth feature on the subject.
