Threat Management, Vulnerability Management

TJX hacker Gonzalez asks for withdrawl of guilty plea

Albert Gonzalez, currently serving a 20-year prison sentence for hacking into the payment card networks of retail chains to steal 130 million credit and debit card numbers, now says he was acting on behalf of the government and was authorized to conduct the illegal activities.

In a 25-page petition filed March 25 in U.S. District Court in Boston, Gonzalez asked that his guilty plea be withdrawn and his sentence overturned because he was working as an agent of the U.S. Secret Service.

In the petition, Gonzalez blamed his attorneys for failing to inform him of the “public authority” defense option, by which a defendant can assert he or she committed a crime in response to a government request.

“I still believe that I was acting on behalf of the United States Secret Service and that I was authorized and directed to engage in the conduct I committed as part of my assignment to gather intelligence and seek out international cybercriminals,” Gonzalez wrote in the petition. “I believe I am actually innocent of the charges brought against me.”

Gonzalez in 2009 pleaded guilty to multiple federal charges of conspiracy, computer fraud, access device fraud and identity theft for hacking into TJX (which owns T.J. Maxx), Heartland Payment Systems, Dave & Buster's, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble and Sports Authority.

He is serving out his 20-year prison sentence, the largest ever issued for hacking charges, in a low-security federal prison in Milan, Mich., with a release date scheduled for 2025.

Government officials have said Gonzalez was an instrumental Secret Service informant who provided leads that helped convict other hackers. In his petition, Gonzalez said he became a confidential informant for the Secret Service after being arrested in 2003 on charges of ATM and debit card fraud.

He said he quickly became a trusted member of the Secret Service, sitting in confidential briefings and offering opinions.

Gonzalez said he was paid $1,200 a month, plus occasional money to help cover expenses. The hacker even developed friendships with Secret Service agents outside of work, going bike riding and “bar hopping” together, Gonzalez said in the petition.

“I was asked to commit acts I knew were illegal, but I complied in order to please the agents who had shown me such respect and friendship,” Gonzalez wrote. “The agents had me infiltrating chat rooms, setting people up, and then the agents would bust them….They told me do what [I] have to do, just try not to get caught. All the time, I was educating the agents as to hacking methods and computer crimes.”

Robert Novy, spokesman for the U.S. Secret Service, declined comment to on Monday.

In his petition, Gonzalez also said his attorneys, Rene Palomino and Martin Weinberg, never appealed his sentence after he asked them to. Weinberg, however, said Gonzalez waived his right to an appeal as part of his plea agreement, according to court documents.

Gonzalez also said his attorneys failed to file a motion to suppress evidence “obtained by way of torture," which led to his arrest.

Gonzalez alleged that in 2007, Turkish police tortured and beat carder Maksym Yastremskiy to obtain a password that would decrypt information on his computer. Without that data, authorities would have no case against Gonzalez, the hacker said.  

Gonzalez claimed he asked his attorneys to investigate the beatings and file a motion to suppress data obtained from Yastremskiy's encrypted computer.

“If Mr. Palomino would have filed a motion to suppress the evidence obtained through the illegal use of torture and beatings of Yastremskiy, the evidence would have been suppressed and the government would have had no case against me and I would not have plead guilty,” Gonzalez wrote in the petition.

Palomino and Weinberg were not immediately available when contacted by on Monday.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.