Yahoo hacker feels he's 'doing the right thing' after pleading guilty, lawyer says

After eight months of maintaining his innocence in a massive data breach at Yahoo, Karim Baratov feels like he's now, his lawyer says, doing the right thing by pleading guilty to charges stemming from his role as a hacker.

Baratov, who is from Hamilton, is scheduled for sentencing in February, after pleading guilty,in a U.S. court on Tuesday,to one count of conspiracy to commit computer fraud and abuse and eight counts of aggravated identity theft.

"He's feeling like he's doing the right thing he's happy that he's doing the right thing, he's happy that he's opening up, and he's not holding back," said Amedeo DiCarlo, one of Baratov's lawyers. "I think that's what the justice system expects of him."

Authorities say the hack affected at least a half billion user accounts, and was directed by two Russian intelligence agents. U.S. law enforcement officials call the 22-year-old Baratov a "hacker-for-hire" and say he was paid by members of Russia's Federal Security Service to access more than 80 accounts.

DiCarlo wouldn't say if Baratov turned over information on the two Russians linked to the case, but did say he has been "very forthcoming with his information" and "very transparent."

"He told them everything they needed to know," DiCarlo said.

Another one of his attorneys, Andrew Mancilla, echoed that sentiment outside of court after the guilty plea was made. "He's been transparent and forthright with the government since he got here," Mancilla said.

The Russian agents, Dmitry Dokuchaev and Igor Sushchin, used the information they stole from Yahoo to spy on Russian journalists, U.S. and Russian government officials and employees of financial services and other private businesses, according to prosecutors.

Dokuchaev, Sushchin and a third Russian national, Alexsey Belan, were also named in the indictment filed in February, though it's not clear whether they will ever step foot in an American courtroom since there's no extradition treaty with Russia.

Yahoo user accounts began being compromised at least as early as 2014. Prosecutors say Dokuchaev and Sushchin turned to Baratov after learning that one of their targets had accounts at webmail providers other than Yahoo.

After Baratov's arrest, his parents said that their son was a "scapegoat." DiCarlo said they are now finally seeing some sense of closure.

"It's a big strain on everybody it's kind of like you're biting your fingernails, waiting for the result. Now, here is a final result in their opinion they see an end in the future."

Baratov's sentencing is set to happen in February, and the threshold for how much jail time he could face ranges from zero to 20 years, DiCarlo said though he would not disclose what sentence the defence will submit as appropriate. It's also not clear if Baratov would serve a sentence in Canada or the United States.

"We've got our ranges to work with, and that's where the lawyering takes place," DiCarlo said.

adam.carter@cbc.ca