They stole tens of millions of credit and debit card numbers, using some to make withdrawals at ATM machines and selling millions of the numbers to other criminals, in what prosecutors termed "unparalleled" online theft.
The case before Judge Woodlock differed from those heard by Judge Saris in a number of substantive ways, according to both Assistant U.S. Attorney Stephen Heymann and defense attorney Martin Weinberg. First, Gonzalez was not the leader of the international network of hackers, as he was with the cybercrime group that hacked the retailers and the Dave & Buster's restaurant network.
In the group where he was the mastermind, the criminals knew each other personally, in some instances having gone to school together and socialized together. Most of their hacking was done in cars or when the criminals were physically near a location, breaching networks wirelessly to steal information.
In contrast, the international ring came together through connections made only in cyberspace, with no real hierarchical structure. They were a group of "elite international hackers ... moving seamlessly over international borders," Heymann said.
The international group used more sophisticated SQL injection attacks and had advanced from hacking into retailers' systems to attacking the financial system itself, Heymann said to answer questions from Judge Woodlock, who sought an explanation for differences between the cases.
"It acts like a tremor," rippling through the system and shaking the faith of people in credit and debit card transactions and companies. Customers can choose to not shop with a retailer whose system has been proven vulnerable to hackers, but that's not so easy to do when the companies under attack are those that process payments.
That international aspect and the way in which the cyberthieves connected made the case before Judge Woodlock particularly "dangerous" and part of an increasingly sophisticated approach to cybercrime that is particularly troubling to law enforcement agencies, Heymann noted.
While Judge Woodlock took all of that in, he also said that he believed that Judge Saris' sentences were reasonable and that it would be appropriate for him to impose the same number of years. After doing so, he offered advice to Gonzalez, whose intelligence and "gifts" the judge recognized.
"People with your gifts often find themselves dealing obsessively with computers," he said, adding that Gonzalez misapplied his abilities, and that while "the perception is that there's no harm if you don't see the people," the judge had heard from some of those affected in victim impact statements.
He was especially taken by an elderly couple whose lives were badly disrupted when their private information was obtained through hacking into the Hannaford system. And so it was his duty, Judge Woodlock said, to address the issue of deterrence and to impose a sentence that would send a message to other cybercriminals and would-be cybercriminals.