“Simply put, Roman Seleznev has harmed more victims and caused more financial loss than perhaps any other defendant that has appeared before the court,” federal prosecutors said in their sentencing memorandum. “This prosecution is unprecedented.”
For years, law enforcement in the United States has faced challenges in capturing and convicting Russians accused of hacking. Russian cybercriminals operate with relative impunity inside Russia as long as they do not hack targets in their country. In return for their immunity, cybercriminals are often tapped to work for Russia’s intelligence agencies.
It is only when Russian computer criminals have traveled outside Russia that United States law enforcement has detained them, most recently in Prague and in Barcelona. But law enforcement officials say more than three dozen overseas hackers suspected in crimes remain beyond their reach.
The United States Secret Service, which handles financial fraud cases, tracked Mr. Seleznev for more than a decade, according to court filings. But he was careful not to go to a country that had an extradition treaty with the United States.
The Secret Service caught a break in June 2014, when investigators learned that Mr. Seleznev planned a vacation to the Maldives with his girlfriend. The State Department persuaded the police there to assist, although the country does not have an extradition treaty with the United States.
A month later, Mr. Seleznev was arrested at the Maldives airport by the local police. He was handed over to Secret Service agents and taken by private jet to the United States territory of Guam, and from there to a federal prison in Washington.
Investigators seized evidence from Mr. Seleznev’s computers of his various hacking and carding schemes. They also found photographs of Mr. Seleznev driving flashy sports cars and vacationing in tropical locations, and photographs of stacks upon stacks of what appeared to be 5,000-ruble bills.
“This investigation, conviction and sentence demonstrates that the United States will bring the full force of the American justice system upon cybercriminals like Seleznev who victimize U.S. citizens and companies from afar,” said Kenneth A. Blanco, the acting assistant attorney general of the Justice Department’s criminal division. “And we will not tolerate the existence of safe havens for these crimes — we will identify cybercriminals from the dark corners of the internet and bring them to justice.”
Mr. Seleznev is the son of Valery Seleznev, an outspoken member of the Duma, the lower house of the Russian Parliament, and a close political ally of President Vladimir V. Putin of Russia.
The elder Mr. Seleznev has accused the United States of “kidnapping” his son, and he told a Russian news outlet that the charges against him were a “monstrous lie.” The Foreign Affairs Ministry of Russia has lashed out at Maldivian authorities for cooperating with the United States in what it, too, has described as a “kidnapping.”
Valery Seleznev’s office in the Russian Parliament did not respond to a written request for comment sent Friday.
At trial, prosecutors successfully argued that Mr. Seleznev had run one of the largest credit card and online identity theft rings, under various aliases, including Track2, 2pac and nCuX — derived from the Russian word for “psycho.”
Given the large number of victims and financial losses, federal sentencing guidelines indicated that Mr. Seleznev should be given a life sentence, but prosecutors recommended the 30-year sentence.
The 27-year sentence handed down on Friday is expected to send a message to other Russian computer criminals. “This is a huge success in that there are significant challenges to indicting Russian cybercriminals,” said Levi Gundert, a former Secret Service agent who now works as vice president of intelligence at Recorded Future, a cybersecurity firm.
In an 11-page handwritten letter submitted to the federal court this year, Mr. Seleznev admitted to, and apologized for, his crimes.
“I am alive today and I thank God and the United States of America government,” he wrote. “I was going down a very deadly road before my arrest.”
United States attorneys said they thought the case would be a deterrent to other Russian cybercriminals.
“Today is a bad day for hackers around the world,” said Annette L. Hayes, the United States attorney for the Western District of Washington. “The notion that the internet is a Wild West where anything goes is a thing of the past.”
Mr. Seleznev still faces hacking-related charges in Nevada and Georgia. It is not yet clear whether his sentence in Washington will satisfy prosecutors in those cases.