ALEXANDRIA, Va. – Ardit Ferizi was angry that he had been falsely accused of joining the Islamic State. The hacker’s response: to steal the personal information of U.S. service members and hand it over to the terrorist group.

“Stupidly I was annoyed that the U.S. Embassy would not defend me,” the 20-year-old citizen of Kosovo wrote in a letter to a federal judge in Virginia. “I don’t know why I thought the U.S. Embassy would get involved. I was doing a lot of drugs now and spending all the day online.”

Judge Leonie Brinkema on Friday showed little sympathy for the convoluted justification that even Ferizi’s defense attorney called “nonsensical.” While acknowledging that Ferizi was young and suffers from mental health issues, she sentenced him to 20 years in prison for his crime.

“I want to send a message,” the judge said. “Playing around with computers is not a game.”

Thanks to Ferizi’s hack of a retail company server, the names, email addresses, passwords and other data of 1,351 military members and other government employees were published on an Islamic State “kill list” last year. In court Friday, Assistant U.S. Attorney Brandon Van Grack said one woman named on the list has begun fearing all Muslims might attack her.

The case is the first to combine charges of hacking and terrorism, a confluence national security officials say represents the increasing prominence of cyber warfare.

“This case represents the first time we have seen the very real and dangerous national security cyber threat that results from the combination of terrorism and hacking,” Assistant Attorney General for National Security John Carlin said in a statement. “This was a wake-up call not only to those of us in law enforcement, but also to those in private industry.”

Ferizi was extradited last fall from Malaysia, where he had been studying computer science. While he was there last year, defense attorney Elizabeth Mullin said, a journalist in Kosovo claimed Ferizi had actually gone to Syria to fight with the Islamic State.

“We know that the article. . .worsened Ardit’s health situation,” his mother wrote in a letter to the court.

Van Grack called that explanation a “nonsensical story,” and Mullin agreed.

“It was a completely nonsensical, juvenile response because he was a nonsensical, misguided teenager who really didn’t know what he was doing.”

Ferizi began communicating online with Junaid Hussain, a British-Pakistani Islamic State recruiter and hacker killed in a drone strike last August. Before distributing the personal information of U.S. government employees, Ferizi hosted a pro-Islamic State website and argued in favor of the group online.

In the name of the Islamic State Hacking Division, Hussain tweeted out the list along with a statement declaring, “We are in your emails and computer systems, watching and recording your every move, we have your names and addresses, we are in your emails and social media accounts, we are extracting confidential data and passing on your personal information to the soldiers of the khilafah, who soon with the permission of Allah will strike at your necks in your own lands!”

Defense attorney Mullin argued that the “kill list” was merely propaganda, noting that personal and work addresses were not included.

“The information [Ferizi] sent. . . could not assist in a specific attack against any individual,” she said.

Brinkema said that ‘just having your name on a list, knowing that you’ve been identified by a terrorist group” is “terrorizing,” even if the information does not include specific locations.

“I feel so bad that what I did made people scared,” Ferizi said in court Friday. “I’m so sorry.” In his letter to the court, he said he had never been loyal to the Islamic State and renounced the group completely. On the contrary, he said, he has always been grateful to the United States for intervening in the war in Kosovo in 1999. Family members said they all feel warmly towards America and have several relatives there.

But his mother suggested in her letter to the court that the war also left her son with some psychological damage.

“On the second night of the NATO airstrikes, Ardit was in the fourth year of his life,” she wrote. “The street was full of Serbian army and people wearing black uniforms and masks. They came screaming, shouting and shooting, burning houses and killing people.”

Ferizi has agreed to be deported to Kosovo after serving his prison sentence and will not be allowed to return to the United States.

(c) 2016, The Washington Post · Rachel Weiner

Facebook Comments