Max Butler

Early Life

Born on July 10, 1972, Max Ray Butler grew up in Meridian, Idaho, alongside a younger sibling. His parents divorced when he was 14. His father was a Vietnam War veteran and computer store owner whose wife was a daughter of Ukrainian immigrants. As a teenager, Butler developed an interest in bulletin board systems and hacking. His early legal troubles included a guilty plea to malicious injury to property, first-degree burglary, and grand theft after a parent reported a theft of chemicals from a lab room at Meridian High School. Butler received probation and was sent to live with his father, transferring to Bishop Kelly High School.

Early Adulthood and First Offense

Butler attended Boise State University for a year before a 1991 assault conviction during his first year of college. His appeal was unsuccessful on procedural grounds, with a judge ruling that his defense attorney had not raised the relevant issue in an earlier appeal. The Idaho State Penitentiary paroled Butler on April 26, 1995.

Professional Life and Security Work

Following his release, Butler moved with his father to the Seattle area and worked in part-time technical support roles. He became active on IRC and engaged in downloading warez. After an Internet service provider in Littleton, Colorado traced unauthorized uploads to CompuServe's corporate offices in Bellevue, Washington, Butler was fired. The Software Publishers Association subsequently filed a $300,000 lawsuit against him for unauthorized software distribution; the case was later settled for $3,500 and free computer consulting.

Butler relocated to Half Moon Bay, California, changed his surname to Vision, and lived in a rented residence known as "Hungry Manor" with other computer enthusiasts. He worked as a system administrator at computer gaming startup MPath Interactive. After marrying Kimi Winters, he moved to Berkeley, California, and worked as a freelance penetration tester and security consultant. During this period he developed an online resource called the "advanced reference archive of current heuristics for network intrusion detection systems," known as arachNIDS.

FBI Investigation and First Federal Sentence

In the spring of 1998, while attempting to fix a security vulnerability in the BIND server daemon, Butler installed a backdoor on American federal government websites. An investigator with the United States Air Force identified him through pop-up notifications. Butler retained attorney Jennifer Granick, whom he had heard speak at DEF CON, for his legal representation. On September 25, 2000, he pleaded guilty to gaining unauthorized access to Defense Department computers. Beginning in May 2001, he served an 18-month federal prison sentence handed down by U.S. District Judge James Ware.

CardersMarket and Major Conviction

After his release from prison in 2003, Butler was placed on supervised release. During this period he exploited Wi-Fi technology to conduct cyberattacks anonymously alongside Chris Aragon from San Francisco. He modified malware, including enabling the Bifrost Trojan horse to evade virus scanners, and used Internet Explorer's HTML Application feature to steal American Express credit card information. He also targeted Citibank using a Trojan horse and distributed stolen PINs to Aragon, who coordinated others to withdraw maximum daily cash amounts from ATMs tied to compromised accounts.

Butler was arrested in 2007 and accused of operating CardersMarket, an online forum where cybercriminals traded sensitive financial data including credit card numbers. After pleading guilty to two counts of wire fraud, he was sentenced to 13 years in federal prison — the longest sentence ever handed down for hacking-related charges in the United States at the time. He was also ordered to serve five years of supervised release following his prison term and to pay $27.5 million in restitution to victims.

Aftermath

In 2018, Butler was charged with running a drone-smuggling ring from prison. Prosecutors alleged that in October 2014 he obtained an illicit cell phone and used it to acquire stolen debit card numbers, funneling proceeds to fellow inmates. Authorities further alleged that in the spring of 2016, Butler directed a former cellmate, Jason Dane Tidwell, to purchase a remotely piloted drone to deliver contraband via airdrop. An inmate informed on the scheme, though guards never recovered the contraband. Inmate Phillip Tyler Hammons confessed to retrieving airdrops and identified Butler as the organizer; Butler disputed this account. Butler was released from FCI Victorville Medium 2 on April 14, 2021.

Recognition in Media

Butler's story was featured in an episode of the CNBC television program American Greed in 2010. His activities have also been chronicled in books by journalists Kevin Poulsen and Misha Glenny.