A bright computer programmer with a great future, but decided to design malware that would allow users to control other people’s Android phones, received a sentence of probation Monday instead of doing hard time.
Morgan Culbertson, 22, got a three-year term and ended up ordered to do 300 hours of community service at his sentencing by U.S. District Judge Arthur Schwab.
He faced a possible 10 to 16 months behind bars, but it was his first offense, he quickly admitted his guilt and he and his family said he’s been trying to make amends.
“I’m very sorry for what I did and will be haunted by this for the rest of my life,” he told the judge.
Culbertson, a former Carnegie Mellon University (CMU) student from Churchill, PA, pleaded guilty over the summer to conspiracy to damage protected computers.
Calling himself “Andoid” online, he initially conspired with a man in the Netherlands to design a product called “Dendroid” and sell it on Darkode, an online marketplace for hackers.
Dendroid infected victims’ phones, allowing a customer who bought the malware to intercept texts, steal files, take photos and review search histories and record phone calls, all without the user’s knowledge.
He later bought out his partner’s share of their enterprise and started working with another person, identified as “Elzig,” in trying to market Dendroid on Darkode.
Culbertson has taken a leave of absence from CMU and is taking classes at Community College of Allegheny County and working as an intern at Hyiilon in Plum, which designs technology for the trucking industry.
He was among about 70 people targeted in an international investigation based in Pittsburgh focusing on Darkode, which the FBI has since shut down.
Judge Schwab said probation was fair but also told Culbertson and his family in the gallery that the 22-year-old’s conduct was more serious than someone just making poor choices, such as choosing “the wrong ice cream.”
“It’s not ‘bad choices,'” the judge said. “It’s a crime.”