Karim Baratov, who pleaded guilty to charges connected to a massive Yahoo data breach, is expected to find out Tuesday how much time he'll spend behind bars in the U.S.
The 23-year-old Hamilton man, who American officials have described as an "international hacker for hire," is facing time on convictions of one count of conspiracy to commit computer fraud and abuse and eight counts of aggravated identity theft.
A memorandum filed by U.S. law enforcement officials describes a "pressing need" to deter cyber criminals whose hacking can lead to other criminal activity, including foreign espionage.
They're asking the court to sentence Baratov to 94 months (just under eight years) in prison, with three years of supervision after his release and that he face fines in amounts covering "any and all of his assets."
Lawyers say curiosity 'got the best' of Baratov
Lawyers for Baratov argue he was simply a curious young man whose fascination with coding "got the best of him" and unintentionally led him to amass the wealth he eagerly displayed on social media.
"He bore no intent to cause harm. He sincerely regrets his actions," wrote Andrew Mancilla and Robert Fantone in their submission to the court. "This is a hard lesson to learn for a young man ... but it is a lesson he has learned."
This is not a case of a teenager making an isolated mistake on the Internet out of curiosity.- U.S. sentencing submission
They're asking he spend 45 months (almost four years) in prison, saying his youth, lack of criminal history and willingness to plead guilty should all be taken into consideration.
"Neither Mr. Baratov nor the community would be well served by a lengthy prison sentence," the lawyers explained.
But authorities say Baratov's actions were not driven by innocent curiosity.
"This is not a case of a teenager making an isolated mistake on the internet out of curiosity," officials wrote. "Rather, this is a case of the defendant making a profession out of breaking into the private lives of thousands of victims."
Officials describe Baratov's actions as "egregious, extensive, and reprehensible" and say he hacked into the webmail accounts of 11,000 victims, broke into their digital records, and sold stolen access to their private lives between 2010 and 2017 to live "lavishly."
Authorities say he also accessed at least 80 webmail accounts as part of a hack directed by two Russian intelligence agents.
Lawyers on both sides of the case agree Baratov did not discuss reasons for targeting specific victims with Russian spies, but U.S. officials maintain a lack of knowledge is no excuse.
"Burying one's head in the ground to the identities, motives, and plans of one's criminal customers should not be a complete shield to the consequences of working for such customers."
The Russian agents, Dmitry Dokuchaev and Igor Sushchin, used the information they stole from Yahoo to spy on Russian journalists, U.S. and Russian government officials and employees of financial services and other private businesses, according to prosecutors.
Dokuchaev, Sushchin and a third Russian national, Alexsey Belan, were also named in the indictment filed in February, though it's not clear whether they will ever step foot in an American courtroom since there's no extradition treaty with Russia.
Hacker known for flashy cars
Baratov, who was 19 when the hack began, lived in a $650,000 house on a quiet street in the affluent Hamilton suburb of Ancaster, Ont.
Neighbours knew him for his flashy cars, which included a Lamborghini, Porsche, Aston Martin, Mercedes and BMW, according to U.S. officials. He also posted photos on social media, showing off stacks of $100 bills.
But despite the appearance of wealth, American authorities say Baratov seems to have spent his money as he earned it — his only remaining assets are $30,000 from his home, $1,500 U.S. in a PayPal account and $900 that was in his wallet when he was arrested by the RCMP.
Baratov 'in good spirits'
Baratov initially pleaded not guilty to his charges. But he then decided not to fight extradition to the U.S., going there in August of 2017.
In the U.S., he changed his plea after eight months of maintaining his innocence.
Amadeo DiCarlo, one of the lawyers representing Baratov, said he's in California with Baratov and his family for the sentencing.
"He is in good spirits and very anxious to put this behind him," said DiCarlo. "This was Karim's choice and he still feels he did the right thing."
Baratov's sentencing is set to begin at 10:30 a.m. PT (1:30 p.m. ET) at the Philip Burton Federal Building and U.S. Courthouse in San Francisco, Calif.