U.S. Seeks to Curb Freedom of Cyber-Crook, or Hero, Hutchins

(Bloomberg) -- A British security researcher charged in the U.S. with creating malware used to hack banking systems has too much freedom while awaiting trial and may skip the country, government prosecutors warned a judge.

Marcus Hutchins, 23, is credited with stopping a devastating cyberattack in May, but according to the U.S. he helped create and distribute Kronos, a malicious Trojan virus that steals usernames and passwords for banking websites from infected computers. He was arrested in Las Vegas on Aug. 2.

Hutchins was allowed out of jail on Aug. 14 on a $30,000 cash bond and confined to a halfway house in Los Angeles. On Thursday a magistrate judge lifted some of the bail restrictions at the request of pretrial court officials, giving Hutchins more freedom to move around. Prosecutors weren’t notified of the request and complained.

"Mr. Hutchins is a foreign national with no ties to the United States and his current conditions of bond increase the likelihood of nonappearance in this matter," prosecutor Michael Chmelar said in a letter Friday to U.S. District Judge J.P. Stadtmueller in Milwaukee. 

"Mr. Hutchins could leave his residence at 6 a.m., travel anywhere in the U.S., including to the U.S./Mexican border without raising any concerns, until 9 p.m. when/if he failed to return to his temporary residence," Chmelar said.

Lawyers for Hutchins later responded that there is no risk he will try to flee. They said he would agree to a requirement that he get prior approval from court officials before going to any airports in the greater Los Angeles area.

“While the government’s motion expresses concern that Mr. Hutchins might have a greater opportunity to leave the country if he is placed on curfew, the government does not even mention the fact that Mr. Hutchins’ movements are currently monitored via GPS,” the attorneys said in a filing.

Hutchins, who blogs and tweets under the pseudonym MalwareTech, thanked his lawyers in a posting on Twitter.

“Big thanks to @brianeklein & @marciahofmann for their work on my bail conditions, nobody ever even thought I’d be allowed back online,” he wrote on Thursday.

Earlier that day, he complained about restrictions though. “If you think your life is hard, remember that I have to get my lawyers approval to retweet memes on twitter,” he wrote.

Hutchins was arrested as he was about to board a flight to the U.K. after attending the Black Hat and Def Con conferences in Las Vegas.

Under the terms of his initial bond, he could travel within the continental U.S. and was allowed access to a computer, phone and the Internet, court records show. The federal magistrate also allowed Hutchins "to continue his work as a cyber security researcher and expert."

Those limitations remained essentially in place until last week when pretrial court officials complained the restrictions were "unfair" because Hutchins was only permitted to leave his residence for four hours a week. He had become a prisoner of his own home, or halfway house, they said.

The case is U.S. v. Hutchins, 17-CR-124, U.S. District Court for the Eastern District of Wisconsin (Milwaukee).