US Gov suggests 15 years jail-time for Breached admin

Those of you who followed my 365 days of blogs last year will remember I posted a few times of the story concerning the stolen data sharing forum Breached.vc, the arrest of the site admin, and the subsequent FBI seizure of the domain. This post is an update to the ongoing tale.

The breached forum was administered by Conor Brian Fitzpatrick, who went be the online alias of Pompompourin – He named himself after the character developed by the Japanese company Sanrio which is a part of the Hello Kitty range of characters.

By way of a quick run through of events:

• March 2023 – Conor Brian Fitzpatrick arrested by Federal agents in New York
• June 2023 – Breached.vc domain seized by FBI
• July 2024 – Fitzpatrick pleads guilty to 3 counts relating to
  • Count 1 – Conspiracy to commit device access fraud
  • Count 2 – Solicitation for the purpose of offering access devices
  • Count 3 – Possession of child pornography
• July 2024 – Court issues bond requirements for Fitzpatrick – set at $300,000
• August 2023 – Fitpatrick allowed to travel to Pennsylvania for medical assessment
• October 2023 – Fitzpatrick subject to a Presentence Investigation Report (PSR) to determine if he should be held in detention prior to trial based on sensitive (and withheld) data – subsequent court documents suggest this could be related to the charges of child sexual exploitation as he was undergoing psycho-sexual evaluation
• December 21^st 2023 – Warrant issues for arrest of Fitzpatrick
• January 3^rd 2024 – Temporary Detention Order issued
• January 3^rd 2024 – Revocation of bail
• January 3^rd 2024 – Arrest warrant executed

On Tuesday this week (16^th Jan) The US Government filed a recommendation to the court that Fitzpatrick should receive the following sentencing:

• On counts 1 and 2 – a sentence of 120 months imprisonment
• On count 3 – a sentence of between 188 and 235 months imprisonment

Overall the government recommends Fitzptrick is sentenced to 188 months imprisonment for the offences he is charged with. This equates to 15.6 years behind bars.

The filing states that “the sentence is sufficient, but not greater than necessary to reflect the seriousness of the crime, the significant harm caused by the defendants crimes, the risk of recidivism, and to deter the defendant and others who may seek to profit from this type of widespread cybercrime in the future.“

UPDATE – 20^th January

Since publishing this post, the sentencing report in the case of Conor Fitzpatrick has been released.

Judge Brinkema has passed the following sentence:

• On count 1 – Conor Fitzpatrick will be subject to 3 years supervised release
• On count 2 – Conor Fitzpatrick will be subject to 3 years supervised release
• On count 3 – Conor Fitzpatrick will be subject to 20 years supervised release

A number of special conditions have been applied to the ruling, including:

• The defendant shall serve his first two (2) years of supervised release on HOME ARREST with GPS location monitoring with the following outings and permission given in advance by the probation officer: Therapy sessions, meetings with the probation officer, medical appointments, and religious observances
• The defendant shall participate in a program approved by the United States Probation Office for mental health treatment, to include a psychosexual evaluation and sex offender treatment. The costs of these programs are to be paid by the defendant as directed by the probation officer. The defendant shall waive all rights of confidentiality regarding sex offender/mental health treatment to allow the release of information to the United States Probation Office and authorize communication between the probation officer and the treatment provider.
• The defendant shall not view or possess any “visual depiction” of any “sexually explicit conduct”, including any photograph, film, video, picture, or computer or computer-generated image or picture, whether made or produced by electronic, mechanical, or other means.
• The defendant shall not have any access to the internet within the first year of his supervised release. After that year the defendant shall not sell or offer to sell any item on the internet for another person or entity without pre-approval and authorization from the court or probation officer. This includes, but is not limited to, selling items on internet auction sites.
• The defendant shall disclose to the probation office all computers as defined in 18 U.S.C. § 1030(e)(1), and similar devices that provide access to the Internet, that the defendant owns, possesses, or uses. The defendant shall not possess or use any computer or similar device, which includes use of computers at work, unless the defendant cooperates with the probation office’s computer monitoring program or receives permission from the probation office. The defendant shall permit random, unannounced inspections on any unmonitored computer or similar device under the defendant’s control to ensure compliance. The defendant shall not use the Internet to communicate with any individual or group who promotes sexual abuse of children.