FBI docs say Steinbrenner was an international man of mystery

Well, sorta.

Though the plotline would have even seemed outlandish on the set of "Seinfeld," recently declassified documents reveal that George Steinbrenner aided and cooperated with the FBI on cases involving national security.

But a James Bond or Jason Bourne, the late New York Yankees owner was not.

Though his exact role remains unclear, Steinbrenner initially agreed to things like allowing an organized crime sting at old Yankee Stadium because he was trying to clear his own name.

From the New York Times:

His help to the F.B.I. in the 1970s and '80s helped lead to his receiving a pardon from President Reagan in 1989 for a conviction for illegal contributions to Richard M. Nixon's 1972 presidential re-election campaign. [...]

There are no details of what assistance Steinbrenner provided, or the role he played, in his pardon petition or in an F.B.I. memorandum. Both were heavily redacted before release.

In addition to the gambling syndicate sting in the Bronx, it was revealed that Steinbrenner also helped "without hesitation" on a three-year undercover case that his lawyer claimed to have involved a "terrorist matter."

It is not surprising that Steinbrenner helped the F.B.I., to help his case for a pardon but perhaps also to demonstrate his avowed patriotism. But clearly, he wanted a pardon.

Seeking pardon or not, this is still a pretty fascinating and fun story, and one that will have us lamenting the lost opportunities that "Seinfeld" may have been able to mine.

The Boss talking into his shoe ... grappling up the frieze at Yankee Stadium ... steering a powerboat down the Hudson River before thwarting a madman's plot at the Statue of Liberty ... wooing Ursula Andress from behind his desk ... Yeah, the possibilities would have been endless.

The sneakiest new shopping scams

Easy ways to avoid the biggest rip-offs online and in stores

By the editors of Shop Smart Magazine

Just as important as knowing how to sniff out great buys is understanding what it takes to avoid rip-offs. And with Internet fraud on the rise, it's getting tougher to outsmart the criminals. Complaints to the Internet Crime Complaint Center, a joint operation of the FBI and the National White Collar Crime Center, jumped 22 percent last year. The complaints include plenty of run-of-the-mill scams, like sellers who steal credit-card numbers or take the money and run. But those are child's play compared with what else is brewing.

More from ConsumerReports.org Store brands vs. name brands Get the best price on anything Consumer Reports has no relationship with any advertisers or sponsors on Yahoo!

Think you're too savvy to get taken? OK, maybe you don't fall for those e-mails from Nigerian royalty asking you to wire money, but digital criminals are getting sneakier every year. One scam that can trip up even the most cautious consumers involves "skimmers" attached to ATMs. Those devices record account numbers and passwords so that thieves can clean out your bank account.

"These guys are constantly thinking of new ways to swindle you, some of which are quite sophisticated," says Brian Krebs, a computer security expert and author of "Krebs on Security" at Krebsonsecurity.com.

Think you're safer shopping at the mall? Official purse-snatching statistics show there's been a downward trend, but many of those crimes aren't reported to law enforcement officials. And pickpocket activity always jumps around holiday time, says Bob Arno, co-author of "Travel Advisory! How to Avoid Thefts, Cons and Street Scams While Traveling" (Bonus Books, 2003). But you can outsmart even the craftiest swindlers if you know what's in their bag of nasty tricks. Here's a guide to the latest, sneakiest scams, and simple tips that can help you protect yourself.

'Smishing'

How it works "Phishing" is when you get an e-mail from a supposedly trustworthy source, such as your bank or PayPal, claiming a problem with your account and asking for your user name and password. When you respond, your information is stolen and your account is siphoned. "Smishing" is the latest twist on that scam—instead of getting an e-mail, you get a text message. (The word is a combination of "SMS," for short message service, aka text messaging, and "phishing.") You're told to call a toll-free number, which is answered by a bogus interactive voice-response system that tries to fool you into providing your account number and password.

"It works because people don't give their cell-phone numbers out," Krebs says. "If someone has my cell number, I figure it's someone I know." Thieves can use random-dialing telemarketing services to hit on your number, says Rod Rasmussen, president and CTO of IID, an Internet security firm. If you belong to a credit union, be especially wary—members are targets because often the call-back number has a local area code, not an 800 number, which makes victims less likely to suspect a hoax, Rasmussen says.

Prevent it If you get a text alert about an account, don't respond before you verify that it's legitimate. You can do a Google search on the number to see whether it matches your financial institution. Even better, call the customer-service number at your bank or other service provider to give any needed information to a representative.

Teeny, tiny charges

How it works Thieves get hold of your credit- or debit-card number and make very small charges of 20 cents to $10. The charges appear on your bill with an innocuous-sounding corporate name, and a toll-free number may appear next to the charge. But when you call the number, it's either disconnected or you're instructed to leave a message and your call is never returned.

That was precisely the scam that the Federal Trade Commission broke up in June, according to spokesman Frank Dorman. "We don't know where the thieves got the card numbers, but we're looking into that," he says. The scam was successful because most consumers either didn't notice the charges or didn't bother to correct them because the amounts were so small. In all, the crime ring racked up more than $10 million in bogus charges, the FTC estimates.

Prevent it Scrutinize every item on your bill every month, and question those you don't recognize. (Some charges, but not all, will list a phone number.) If you think a charge is fraudulent, notify your card company as soon as possible but no later than 60 days after the charge appears. By law, the card company must remove the disputed amount from your account while it investigates. Worst case, by law you're liable for only the first $50 on a credit card. (In most cases, Visa and MasterCard will cover the full amount.) Debit cards offer fewer protections: You must report the problem two days after you notice it. If you don't, you could be liable for the first $500 in fraudulent charges. If you wait more than 60 days after your statement is mailed, you could lose all the money in your account.

Skimmers

How it works Skimmers, devices that thieves attach to ATMs or gas pumps to steal your debit account number and password, have been around for years—and they're not going away. They're getting even more sophisticated.

The devices are placed at the mouth of the card-acceptance slot and record the data off of the magnetic strip on the back of your ATM card when you slide it into the machine. Crooks will usually plant a second device, such as a hidden camera or a transparent plastic PIN pad overlay, that's used to record your PIN when you type it in. In the early days of skimming, the thief had to return to the ATM or gas pump to retrieve the apparatus. But now, Krebs says, wireless technology enables the devices to be rigged to send account information via text message to the thief's cell phone. "The thief can be down the street in a coffee house or halfway around the world," he says. "As long as he's got a working phone signal, he can get the information sent to him right away and start using it."

Prevent it Use credit cards and avoid using non-bank ATMs. Those machines are generally located in areas that are less secure, making it easier for thieves to tamper with them. And check the card slot: If there's a plastic strip or plastic film sticking out, or anything glued to the card reader, go elsewhere. If your card is stuck inside the card slot, do not leave the machine. Use your cell phone to call your bank branch or the 24-hour service number to report the problem.

Membership programs

How they work You're buying from a large, reputable website but just before you click the "confirm" button on your purchase, you see a pop-up window or banner ad with an offer such as "$10 Cash Back on Your Next Purchase!" Here's the catch. By accepting that so-called deal, you're agreeing to enroll in a Web discount program that's run by a completely separate company. Those programs, which have innocuous names such as "Reservation Rewards," "Travel Values Plus," or "Great Fun," often provide a 30-day trial period during which you get discounts on a variety of merchandise and services. After that, a monthly membership fee, usually $10 to $20, will appear on your credit-card bill—even though you never gave that outside company your card number.

Sounds dicey, doesn't it? A Senate committee headed by Jay Rockefeller, D-W.Va., thought so, too. Last year, the committee launched an investigation into three large companies that sell memberships to those discount clubs: Affinion Group, Vertrue, and Webloyalty. The committee's report was issued last November and alleged, among other things, that "misleading 'Yes' and 'Continue' buttons cause consumers to reasonably think they are completing the original transaction, rather than entering into a new, ongoing financial relationship with a membership club operated by Affinion, Vertrue, or Webloyalty."

The problem is so ubiquitous that in May, Rockefeller introduced a bill to ban that and other misleading sales practices. Meanwhile, the three companies mentioned in the report have pledged to change their ways. Previously, customers' credit-card numbers were provided to the discount company by the original site without the consumer's knowledge. After the investigation began, all three companies started to require consumers to type in, at a minimum, the last four digits of their card number to make it clear that they are entering into a separate transaction. We'll be on the lookout for whether those changes are enough to keep consumers from being duped.

Prevent it Be wary of pop-up windows or banner ads that promise an additional discount before you complete a transaction. If you do click on an offer, take the time to read the fine print. Scrutinize your credit-card statement every month and question any unfamiliar charges, no matter how small. Check your e-mail inbox and spam folder because Web loyalty programs often send a notification e-mail before they start charging your credit card, when you still have time to cancel.

Stripped gift cards

How it works Thieves look for gift cards that are displayed on grab-and-go racks, such as in grocery and department stores. They use a handheld scanner—which you can buy online for just a few hundred dollars—to read the code behind the magnetic or scratch-off strip on the back of the card. That, combined with the card number on the front, gives them everything they need to steal the value of the card. Then they put the card back on the rack. Later an unsuspecting buyer purchases the worthless gift card. Even if a card isn't preloaded, a thief can steal the card number and security code, then call the 800 number shown on the card every few days to check the balance. Once a shopper has purchased the card and loaded it with a dollar amount, the thief can spend it before the purchaser does.

Prevent it Buy cards that are behind a customer-service desk, says Tom Browning, vice president of corporate compliance and chief security officer for AlliedBarton Security Services. Inspect the card; if the magnetic or peel-off strip on the back isn't pristine, the card might have been tampered with. When buying a preloaded card, ask the cashier to scan it to make sure the full value is on it. If you're buying from a third-party gift-card site, look at the refund policy. And always hang on to the receipts. If something goes wrong, it can help you—or the gift recipient—get a refund.

Counterfeit electronics

How it works Counterfeiting might seem like old news, but it's still going strong—in fact, stronger than ever. Last year, U.S. Customs and Border Protection made 14,841 seizures of fake and pirated goods worth $261 billion, an all-time high. The counterfeits seized included the usual suspects—footwear, apparel, and accessories—plus a huge number of electronics. "A knockoff handbag may not present a direct risk to consumers," says Anthony Toderian, spokesman for CSA International, which tests and certifies products, "but counterfeit electronics certainly do." Fake goods could have substandard wiring, faulty fuses, flammable plastic casings, and harmful chemicals such as lead and mercury. All kinds of electronics have been illegally copied, including computers, phones, and handheld gaming devices, he says. Although online shopping and auction sites and deep-discount stores are the most likely places those fakes will pop up, some have made their way onto the shelves of major retailers. "Buyers for stores can be fooled just as easily as regular consumers can," Toderian says.

Prevent it Look for a label stating that the product has been certified by CSA International or Underwriters Laboratory. (Go to CSA -International. org and click on "Certification Marks" to see what genuine labels look like. At UL.com, go to the search box and type in "How to spot fakes.") Look at the product, too. Are there misspellings on the package? If the box is see-through, does it contain all of the listed components, including batteries, cases, and power cords? Is the manufacturer's contact information, including address and phone number, clearly displayed? When in doubt, buy from well-known retailers that offer a full refund.

3 simple ways to protect yourself

Get the right security software In recent tests, we found two great, downloadable programs that protect against viruses, spyware, and other online threats at no charge. Try Avira, at www.free-av.com, or Microsoft Security Essentials, at www.microsoft.com/security_essentials.

Fight fraud There are several useful resources for ensuring your online safety. Bookmark these!

FTC.gov The Federal Trade Commission's site has lots of fact sheets that tell you what to do you if you've been scammed. Under the Consumer Protection tab, click on "Consumer Information" and then "Shopping for Products & Services." Don't miss the helpful primers on what to do if you're billed for merchandise you never receive and "How to right a wrong."

Safeshopping.org This site is sponsored by the American Bar Association and is packed with advice on safe payment methods, protecting your privacy when you shop, and other need-to-know topics.

OnGuardOnline.gov This site has tips on Internet shopping and is sponsored by government agencies. Quizzes test your knowledge of spyware, online auctions, ID theft, and more.

Antiphishing.org The Anti-Phishing Working Group, an industry-sponsored association, has a tip sheet on how to avoid being scammed. Click on "Consumer Advice," then "How to Avoid Phishing Scams."

Check sellers Before you do business with anyone, go to the Better Business Bureau, at www.bbb.org/us. Grades A to F are based on how long the seller has been in business and how good a job it does resolving complaints. Other sites that are worth a look include SiteJabber.com, Complaints.com, and RipoffReport.com, for its user reviews. Also do a Google search of the site or retailer and the word "complaints."

Hang on to your handbag!

Bob Arno, an author and anti-theft consultant, has traveled the world secretly filming pickpockets. So he knows their tricks and how to thwart them. Here's his advice:

Get a grip Thieves are just as likely to snatch your purse as to slip a hand inside it to grab a wallet. So keep your handbag tight against your body and in front of you at all times. And when you're sitting down in the food court at the mall, don't sling your purse behind you on the chair. Even if you think you're maintaining physical contact with your bag, leaning forward for just a second is all the opportunity a thief needs to grab it. And never put it on the floor, even if it's in front of you.

Nix knapsacks They're back in style, but any bag that's not within your view is a juicy target for skilled pickpockets, no matter how securely it's fastened. And avoid purses with open compartments. Bags with zippers are best.

Keep your focus A classic ploy of purse thieves is to create a diversion—pointing at something, talking loudly, holding open a map and asking for directions, or spilling something on your coat then offering to clean it up. It can happen in a restaurant or a busy mall. Whenever anyone approaches you, be sure to firmly hold your purse and keep it in front of you.

Pare down your wallet Do you really need to bring all of your credit cards and ID cards with you? Leave everything except the necessities at home. And never routinely carry around anything with your Social Security number on it. (Photocopy all of the cards in your wallet, just in case.)

Be smart with your car Park in well-lit areas. If it's still daylight but you plan to shop for a while, park under a street lamp or in a well-lit garage. Always put up your windows and lock the car. If you go back to your car to stow packages, put them in the trunk—visible boxes and bags are magnets for thieves. Don't load up with so many packages that your purse dangles from your arm, out of your sight. Take advantage of curbside pickup or ask the store to hold bags for you. If someone tries to grab your purse, don't resist. "It's not worth losing your life over," Arno says. Also, if you have a GPS device in your car, program it so that your "home" setting isn't your home address. Instead, use the school or church down the street, or crooks will know how to get to your house while you're out. GPS thefts are also on the rise, so don't leave any visible trace of one in your car, including the mount.

Check sellers Before you do business with anyone, go to the Better Business Bureau, at www.bbb.org/us. Grades A to F are based on how long the seller has been in business and how good a job it does resolving complaints. Other sites that are worth a look include SiteJabber.com, Complaints.com, and RipoffReport.com, for its user reviews. Also do a Google search of the site or retailer and the word "complaints."

ShopSmart;) the unique shopping magazine, offers unbiased, easy-to-read advice on the best brands of household appliances, kitchenware, electronics, and more. Subscribe today!

Copyright © 2006-2010 Consumers Union of U.S., Inc. No reproduction, in whole or in part, without written permission.

Hacker explains why he reported 'Wikileaks source'

So news that former high-profile hacker Adrian Lamo had turned over an Army intelligence analyst to authorities was met with derision by some.

"A lot of people have labelled me a snitch," Mr Lamo told BBC News. "I guess I deserve that on this one but not as a generality."

"This was a very hard decision for me."

Mr Lamo is a former hacker, who exposed security flaws at the New York Times, Yahoo and Microsoft. After a brief stint hiding from the FBI, Mr Lamo was imprisoned and fined. He now works as a journalist and security analyst.

'By the book'

Mr Lamo says that he was responsible for reporting Specialist (SPC) Brad Manning to the military authorities after the analyst boasted to him that he had handed over thousands of classified documents and classified military video to whistle-blower site Wikileaks.

One video posted to the site shows a US Apache helicopter killing up to 12 people - including two Reuters journalists - during an attack in Baghdad in 2007. Two children were also seriously injured in the attack. Some of the men were armed.

Mr Manning, 22, reportedly acquired the video during the course of his work at a US Military field base FOB Hammer, on the outskirts of Baghdad.

“Start Quote

I didn't want any more FBI agents knocking at the door”

End Quote Adrian Lamo

• US intelligence analyst arrested

Mr Lamo said that he did not suspect anything unusual when Mr Manning contacted him over instant messenger and e-mail.

"I'm contacted on a daily basis by all kinds of people who confess to all kinds of federal crimes," he said.

"I have never once turned them in, even when the FBI offered me a deal."

However, after Mr Manning confessed to distributing the documents, Mr Lamo said that his stance changed and he "felt the need to contact investigators".

"At the moment he gave me the information, it was basically a suicide pact."

"I was worried for my family - that if I were obstructing justice that they could be caught up in any investigation," he said.

"I wanted to do this one by the book, by the numbers. I didn't want any more FBI agents knocking at the door."

Code words

Mr Lamo also said that he had decided to report Mr Manning for reasons of national security.

Instead of going straight to the authorities, Mr Lamo disclosed the information to "a friend" who had worked as an agent in the Army counter intelligence unit.

"He put me in touch with some of his former colleagues who he felt could handle the issue in a low key way," he said.

• Who are WikiLeaks?

Four agents - from different federal and military agencies - turned up at his house to read the conversation logs - from his e-mail and instant messenger conversations with Mr Manning - "one by one", he added.

"I gave them conversation logs that implicated Special Agent Manning.

"They were particularly interested in a code word for a major operation."

Mr Lamo also described how Mr Manning had supposedly obtained the documents.

"He described the process of operational security in detail," said Mr Lamo.

"What he described was a culture of insecurity with poor attention to information.

"The field base didn't have significant security."

'Impossible decision'

He said that Mr Manning would download the documents from a room that needed a unique security code to access it. However, security on the base had slipped, he said.

"He said you'd knock on the door and they'd let you in."

Mr Lamo said that Mr Manning would take a CD labelled Lady Gaga into the room which he would load into a computer.

“Start Quote

I want to be proud of it but I can't bring myself to be”

End Quote Adrian Lamo

"Basically he sat down and started burning data to the CD whilst pretending to be bopping along."

Mr Manning would then upload the documents to Wikileaks servers, which are held in various countries around the world and anonymise the source.

Wikileaks has not confirmed Mr Manning as the source of the video and has said it never collects personal information on sources. It said that it has not been sent 260,000 classified US embassy cables that Mr Manning reportedly leaked to the site.

Wikileaks also questions Mr Lamo's credibility.

However, the US military has confirmed that Mr Manning has been detained on suspicion of leaking classified documents and video. He is being held "in pre-trial confinement" in Kuwait.

"I want to be proud of it but I can't bring myself to be. I keep thinking about what it was like being 22, alone and not knowing about my future," said Mr Lamo.

"Knowing that I did that to somebody - it hurts. I feel like I should be talking to a priest."

He said he had been placed in a situation where "an impossible decision had to be made".

"I hope that Manning gets the same chance as I did - the same chance to take his punishment as I did and start a new life as I did."

"I like to think I prevented him from getting into more serious trouble."

FBI director defends bureau over test cheating

WASHINGTON – FBI Director Robert Mueller told Congress on Wednesday that he doesn't know how many of his agents cheated on an important test about the limitations of the bureau's powers to conduct surveillance and open cases without evidence that a crime has been committed.

The Justice Department inspector general is investigating whether hundreds of FBI agents cheated on the test — a brewing scandal that could be further embarrassment for the FBI as it continues cleaning up after years of collecting phone records without court approval.

Asked by Sen. Patrick Leahy, D-Vt., about an Associated Press report on the cheating, Mueller told the Senate Judiciary Committee he didn't know the exact number of agents involved.

"I've got a general idea, but I do not know how many," Mueller testified. "And I am not certain the IG knows how many either. He has pointed out instances orally to me where there maybe persons in a particular office where it was widespread and maybe attributable to a lack of understanding and confusion about the procedures."

In some instances, agents took the open-book test together, violating rules that they take it alone. Others finished the lengthy exam unusually quickly, current and former officials said.

In Columbia, S.C., agents printed the test in advance to use as a study guide, according to a letter to the inspector general from the FBI Agents Association that summarized the investigation. The inspector general investigation also was confirmed by current and former officials who spoke on condition of anonymity because of the sensitivity of the case.

"There are similar stories for practically every office, demonstrating the pervasive confusion and miscommunication that existed," Konrad Motyka, the association's president, wrote May 13 in the letter obtained by The Associated Press.

Depending on the outcome of the investigation, agents could be disciplined or even fired.

The inquiry threatens to be another black eye for the FBI as it tightens controls after years of collecting phone records and e-mails without court approval. The brewing scandal has already upended management at one of the nation's largest field offices.

The FBI had no comment on the investigation late Tuesday.

Motyka's letter urges the inspector general to focus instead on what he called the "systemic failure" of administering the test without consistent rules.

FBI agents should not be punished "because of a failure to effectively communicate the rules," he wrote.

Such testing is unusual. FBI agents are required to take online training courses to stay current on bureau policies, but pass-fail tests are rare. In 2008, however, when the FBI received more leeway than ever in conducting surveillance and opening investigations, it assured Congress that it would train and test its agents to make sure they knew the rules.

Agents were required to take 16 hours of training, which cut down paperwork errors by 80 percent, Mueller said.

"I do believe that our work force absolutely understands what can be investigated, how it must be investigated, what predication is necessary for a particular investigation in this day and age," Mueller said.

The test had 51 questions. The last question asked if anyone assisted the test-taker.

The Domestic Investigations and Operation Guidelines allowed the FBI, for the first time, to conduct surveillance for national security purposes without evidence of a crime. Agents were also allowed to consider race when opening early inquiries. For instance, the FBI could look into whether the terrorist group Lashkar-e Taiba had taken hold in a city if it had a large Pakistani-American presence.

The new rules gave agents more flexibility to identify and prevent terrorist attacks. They also raised concerns that the FBI would use its new powers to monitor religious organizations or single out certain races.

The FBI has a checkered past when it comes to conducting surveillance. From the late 1950s though the early 1970s, the bureau opened hundreds of thousands of files on Americans and domestic groups, including anti-war organizations, civil rights groups and women's movements. After the Sept. 11, 2001, terrorist attacks, the bureau collected U.S. phone and computer records without court orders.

Lawmakers and civil liberties groups were concerned that the new rules would allow racial profiling and other abuses. The FBI assured them they would not.

"We share the concern and have devoted considerable time and effort to educating our employees regarding how race and ethnicity can — and cannot — be used," FBI counsel Valerie Caproni told Congress in December 2008.

But problems with the training and testing programs surfaced quickly. Last year, Assistant Director Joseph Persichini, the head of the FBI's Washington field office that investigates congressional wrongdoing and other crime in the nation's capital, retired amid a review of test-taking in his office.

Persichini took the test alongside two of his most senior managers and one of the bureau attorneys in charge of making sure the exam was administered properly, current and former officials said. The two agents who took the test with him have been moved to headquarters while the investigation continues.

At the time, the inquiry appeared limited to the Washington field office. But investigators have broadened their inquiry to cover the entire FBI. Among other things, they are focusing on agents who took the test particularly quickly, officials said.

Source: Yahoo!

___

Online:

Letter to the DOJ inspector general: http://wid.ap.org/documents/fbiaa_letter.pdf

FBI says mastermind of botnet nabbed

(Sod-a-Blog) - International authorities have arrested a computer hacker believed responsible for creating the malicious computer code that infected as many as 12 million computers, invading major banks and corporations around the world, FBI officials told The Associated Press on Tuesday.

A 23-year-old Slovenian known as Iserdo was picked up in Maribor, Slovenia, after a lengthy investigation by Slovenian Criminal Police there along with FBI and Spanish authorities.

His arrest comes about five months after Spanish police broke up the massive cyber scam, arresting three of the alleged ringleaders who operated the so-called Mariposa botnet, stealing credit cards and online banking credentials. The botnet _ a network of infected computers _ appeared in December 2008 and infected more than half of the Fortune 1,000 companies and at least 40 major banks.

Botnets are networks of infected PCs that have been hijacked from their owners, often without their knowledge, and put into the control of criminals.

Jeffrey Troy, the FBI's deputy assistant director for the cyber division, said Tuesday that Iserdo's arrest is a major break in the investigation. He said it will take the alleged cyber mastermind off the street and prevent him from updating the malicious software code or somehow regaining control of computers that are still infected.

Officials declined to release Iserdo's real name and the exact charges filed against him, but said the arrest took place about 10 days ago and the man has been released on bond.

"To use an analogy here," said Troy, "as opposed to arresting the guy who broke into your home, we've arrested the guy that gave him the crowbar, the map and the best houses in the neighborhood. And that is a huge break in the investigation of cyber crimes."

Troy said more arrests are expected and are likely to extend beyond Spain and Slovenia and include additional operators who allegedly bought the malware from Iserdo. Authorities would not say how much Iserdo supposedly charged, but said hackers could buy the software package for a certain amount, or pay more to have it customized or get additional features. Internet reports suggest the fees ranged from as much as $500 for basic packages to more than $1,300 for more advanced versions.

Cyber masterminds behind the biggest botnets aren't often taken down largely because it is easy for experienced hackers to hide their identities by disguising the source of their Internet traffic. Usually the computer resources they use are stolen. And the investigations are complex and technical, often spanning dozens of countries with conflicting or even non-existing cyber crime laws.

For instance, there have been no arrests yet in the spread of the Conficker worm, which infected 3 million to 12 million PCs running Microsoft Corp.'s Windows operating system and caused widespread fear that it could be used as a kind of Internet super weapon.

The Conficker botnet is still active, but is closely watched by security researchers. The infected computers have so far been used to make money in ordinary ways, pumping out spam and spreading fake antivirus software.

The Mariposa botnet, which has been dismantled, was easily one of the world's biggest botnets. It spread to more than 190 countries, according to researchers. It also appears to be far more sophisticated than the botnet that was used to hack into Google Inc. and other companies in the attack that led Google to threaten to pull out of China.

The researchers that helped take down Mariposa _ which is from the Spanish word for "butterfly" _ first started looking at it in the spring of 2009.

Hackers spread the botnet by using instant-messaging malicious links to contacts on infected computers. They also used removable thumb drives and peer-to-peer networks to spread the botnet.

The investigation has included federal and international law enforcement as well as a team of more than 100 people, including FBI agents, members of a specialized botnet investigative team and the so-called Mariposa working group, which includes researchers and private industry experts.

Friend: Government was paying hacker $75k a year

Convicted TJX hacker Albert Gonzalez earned $75,000 a year working undercover for the U.S. Secret Service, informing on bank card thieves before he was arrested in 2008 for running his own multimillion-dollar card-hacking operation.

That information is according to one of Gonzalez's best friends and convicted accomplices, Stephen Watt.

Watt pleaded guilty last year to creating a sniffer program that Gonzalez used to siphon millions of credit and debit card numbers from the TJX corporate network while he was working undercover for the government.

Watt told Threat Level that Gonzalez was paid in cash, which is generally done to protect someone's status as a confidential informant.

The Secret Service said it would not comment on payments made to informants. Gonzalez's attorney did not respond to a call for comment.

"It's a significant amount of money to pay an informant but it's not an outrageous amount to pay if the guy was working full time and delivering good results," says former federal prosecutor Mark Rasch. "It's probably the only thing he was doing -- other than hacking into TJX and making millions of dollars."

Gonzalez's reported salary highlights how entwined he was with the government at the time he participated in the largest identity theft crimes in U.S. history.

Gonzalez, 28, is set for sentencing this week on three indictments covering nearly every headline-making bank-card theft in recent years, including intrusions at TJX, Office Max, Hannaford Brothers, 7-Eleven and Heartland Payment Systems (which alone exposed magstripe data on 130 million credit and debit cards).

Thehacker's plea agreements contemplate a total prison term of between 17 and 25 years.

Rasch says Gonzalez's $75,000 is nothing compared to the million-dollar payouts some undercover informants get for high-risk, high-value cases such as Mafia investigations. But Gonzalez's payments dwarf the meager handouts given previous computer crime informants.

Identity thief Brett Johnson, aka Gollumfun, said he earned $350 a week -- the equivalent of about $18,000 a year -- while working undercover in the Secret Service's Columbia, South Carolina, field office helping catch card thieves.

Johnson was recruited by the agency in 2005 after he was arrested buying merchandise with counterfeit cashier's checks; his public service ended 10 months later when agents discovered that, like Gonzalez, Johnson was two-timing them, running a fraudulent tax-return scheme during his off hours that was bringing him an extra $5,000 to $6,000 each week.

Another carder, David "El Mariachi" Thomas, worked undercover for 18 months for the FBI in 2003 and 2004 running a carding site called The Grifters out of a Seattle apartment. The bureau paid rent and expenses for him and his live-in girlfriend, and bought the computers he used to run the undercover operation, but didn't pay him a salary.

In the 1990s, informant Justin "Agent Steal" Petersen was reportedly paid $200 a week while helping the FBI build a case against Kevin Mitnick, then the number one hacker target on the government's radar.

For his part, Gonzalez began working for theSecret Service when he was arrested making fraudulent ATM withdrawals in New York.

Under the nickname "Cumbajohnny," he was a top administrator on a carding site called Shadowcrew. The agency cut him loose and put him to work undercover on the site, where he set up a VPN the carders could use to communicate -- a supposedly secure communications channel that was actually wiretapped by the Secret Service's New Jersey office.

That undercover operation, known as "Operation Firewall," led to the arrest of 28 members of the site in October 2004. After the site went down, Gonzalez changed his nickname to "Segvec" and moved to Miami where he resumed his life of crime under the noses of the agents who were paying him.

Authorities finally arrested him in May 2008. After many months, he directed them to a stash of more than $1 million in cash buried in a barrel in the backyard of his parents' home.

Rasch says a number of factors determine what an informant is paid, such as whether they have specialized technical skills or have infiltrated an underground organization; whether they're putting themselves or family members at risk; and whether the investigations they work involve stolen funds that the government has a good chance of recovering.

"If I'm working on a case involving $20 million in fraud and the government is likely to get some of that money back, $75,000 is chump change," Rasch says. "They don't use paid informants that often.... Criminals will ordinarily cooperate [without payment] in return for a non-prosecution" or sentence reduction.

The Department of Justice publishes nonbinding guidelines that discuss the necessity of monitoring informants and assessing a criminal's suitability to be one, but they don't provide standards for doing so.

Per the attorney general's guidelines, two law enforcement representatives are required to witness any payment made to a confidential informant and document the payment in the case files, indicating if it's for information, services or expenses. The informant must also sign or initial a written receipt.

At the time of the payment, the law enforcement agents are required to advise the confidential informant that the payment may be taxable income that must be reported to the IRS and state agencies.

The Secret Service's embrace of Gonzalez as a professional informant may have reinforced his criminal behavior. Gonzalez felt he'd been rewarded for his preoccupation with computers, according to a letter written by his sister to one of his sentencing judges.

"All this seemed okay at the time, but psychologically it was feeding an obsession that in the end would become my brother's downfall," Frances Gonzalez Lago told the court in December.

Gonzalez is set for sentencing Thursday in U.S. District Court in Boston for the TJX, Office Max, and Dave & Buster's breaches. He appears in front of a different judge the next day for sentencing on the Heartland, Hannaford and 7-Eleven thefts. The government is seeking a sentence of 25 years in prison.