Almost nobody outside of the , Kentucky Department of Corrections , has heard about how several hundred prison inmates hacked their , state-issued, for-profit computer tablets , to create more than$ 1 million that did n’t really exist.
The “dollars” were used for the purchase of cheap internet and video appointments with their loved ones, as well as sports, music and movies.
By the time state leaders learned what was happening — when they got an anonymous tip on , Jan. 3, 2023 , — the captives had spent practically$ 88, 000 on digital media items, according to a review of more than 1, 700 pages of domestic investigative documents the Herald-Leader obtained through the Kentucky Open Records Act.
For the next six months, the , Department of Corrections , and , Securus Technologies,  , the , Texas  , company behind the tablets, struggled to figure out who bought what with stolen money and how it might be recovered.
” What a mess” , , Amanda Sayle, the department’s director of information services, emailed a colleague, information systems supervisor , Jeremy Shuck, on , Jan. 5, 2023.
” I know”, Shuck replied.
This was n’t the first time inmates outfoxed Securus.
In 2018,  , several hundred , Idaho , prisoners , did much the same thing, hacking tablets provided by , JPay, a related company, to transfer roughly$ 225, 000 into their digital media accounts that did n’t really exist, then going on a spending spree.
Inmates now face liens
Securus Technologies, headquartered in , Plano, Texas, did not respond to requests for comment. The company is , owned by , Platinum Equity,  , a private equity firm with over$ 48 billion in assets.
Kentucky Corrections Commissioner , Cookie Crews , and other state officials declined to be interviewed for this story.
In a series of email exchanges with the Herald-Leader, a spokeswoman for the Justice and Public Safety Cabinet, which oversees the , Department of Corrections, said no taxpayer money was lost in the hacking, which she referred to as a” software glitch”.
Only Securus can explain what it did to help retrieve the stolen funds, said cabinet spokeswoman , Morgan Hall, referring questions to the company.
In some cases, Hall added, the , Department of Corrections , has placed liens on inmates ‘ prison commissary accounts, where loved ones deposit money that inmates use to purchase snacks, toiletries and other tangible items, and it has been deducting funds from these accounts to gradually clear the tablet-related debts.
The debt collection continues today, Hall added.
According to Hall, prison officials “prohibited the inmates involved from accessing their tablets for for more than three months,” and any inmate who still owes money is prohibited from using the phone system until their debt is paid off,”
How the hack worked
Securus , won its first contract , in 2006 to sell for-profit inmate telephone service to all , Kentucky , prisons. Later, it branched out to sell other digital products to this captive audience. It struck similar deals with local jails across the state,  , including the city of Lexington’s.
Prisoners are a lucrative source of income,  , Securus told potential investors , around the time it entered , Kentucky.
According to the company,” The corrections industry has experienced sustained growth over the last ten as a result of societal and political trends.” This industry has grown thanks to anti-crime legislation, restrictions on parole, and spending authorizations for crime prevention and the construction of additional correctional facilities.
As part of its contract with the , Department of Corrections, Securus promises the state a cut of the money it collects from inmates.
Since 2020, the company has paid the state$ 22.3 million, according to financial data the Herald-Leader obtained under the Open Records Act.
On , Dec. 9, 2022, to help this cash flow more smoothly, the , Department of Corrections , loaded a new app on inmates ‘ tablets.
Inmates could transfer money from their commissary accounts, where loved ones had previously deposited funds for them to purchase tangible goods from the prison canteens, to their Securus accounts, where they could purchase digital goods from the company on their tablets.
Within 24 hours, the first inmate discovered a way to hack the app and outwitted Securus.
LaDaniel Brown, a 30-year-old , Bowling Green , man, had a commissary account balance of$ 0 at the 1, 200-bed , Luther Luckett Correctional Complex , in , Oldham County, where he was serving 30 years for child sexual abuse.
The lack of funds did n’t discourage Brown.
After experimenting with the new app, Brown later admitted to finding that when he inserted a minus sign in front of a dollar figure when he transferred money from his commissary account to his Securus account, that amount would actually be added.
Typing in”-$ 500″ suddenly credited$ 500 to both of Brown’s accounts, money that did n’t really exist.
Investigators wrote in their report on the incident that inmate Brown continued to deposit money by placing a minus sign in front of the sum of money a month later after interviewing him.
” Inmate Brown made a deposit for$ 100 dollars,$ 16 dollars,$ 1 dollar,$ 294 dollars,$ 300 dollars,$ 362.43 and$ 319.12″, they wrote. ” Inmate Brown made a total of$ 1, 892.55. Additionally, Inmate Brown acknowledged how simple it was.
Prison officials did n’t notice
Commissary accounts are used to buy real-life items, like toiletries and food.  , Kentucky , inmates drop about$ 4 million a year at prison canteens, with , the money required by law , to be spent on programs and services for their own benefit. Before a guard notices, you ca n’t pass around too much money at a canteen.
In fact, when a , Luther Luckett Correctional Complex , inmate tried to buy$ 735 in snacks and drinks using the$ 2, 400 he hacked into his commissary account through the new Securus app, he got caught right away.
But Securus accounts operate entirely in the digital realm, on tablets. Inmates can browse and purchase digital goods in their own cells, which is relative to privacy.
How the tablets could be hacked quickly became a topic of conversation among the prisoners. With money that was n’t there an hour ago, games, movies, and music could be purchased. Email and video visits could also be used.
Some inmates cheated up hundreds of dollars on fake stamps so they could write to their homes for nothing.
Over the next few weeks, according to one estimate prepared by internal investigators, 366 inmates collectively added$ 529, 000 both to their commissary accounts and their Securus accounts, for a total of more than$ 1 million.
They secretly spent$ 87, 959 on Securus digital media products without the authorities noticing.
In a 72-hour span, for example, inmate , Jonce Adams , went on a Securus spending spree, buying$ 250 in email stamps,$ 37 in games and more than$ 1, 200 in music. Adams, who is serving 10 years for , his role in a , Bell County , meth manufacturing ring, had loaded$ 1, 700 onto his Securus account, investigators wrote in their report.
The majority of the prisoners were at the Luther Luckett Correctional Complex, while others were in various other state prisons.
Their fun ended on , Jan. 3, 2023. How the hack was carried out was revealed in an email to prison officials that was anonymous.
By the next morning, officials were frantically emailing each other —” ALERT!!”! — and making plans to permanently shut down the inmates ‘ accounts and seize their tablets.
Prison guards tried to recoup money from inmates who were scheduled to leave.
” I have an inmate that was released today from DOC ( the , Department of Corrections ). He is leaving with approximately$ 1, 700 in arrears with Securus” , , Michael McKinney, the agency’s director of administrative services, emailed to , Amy Hewitt, a Securus executive, on , March 21, 2023.
” If we can give you a list of outliers, we can reduce the loss in the end for both of us”, McKinney told Hewitt.
Three months later, on , June 9, 2023, Hewitt proposed to McKinney that Securus and the , Department of Corrections , split between them any financial losses that could not be recovered.
” We will absorb the price for all other costs ( games, movies, content delivery, stamps, etc. Hewitt wrote to McKinney,” We request that KY cover 50 % of the stolen music because that will help cover the licensing costs we are unable to get reimbursed,” Hewitt wrote.
” I believe this sounds fair. Thoughts”? McKinney wrote to Shuck, his , Department of Corrections , colleague.
” I agree”, Shuck replied. ” At most, the inmates had just under a month to enjoy these purchases. I believe they would get their tablet back once that is paid if we were able to place a lien on their account to pay back the rest of the balance.
Who stole from whom?
The Kentucky State Police , and the FBI took an interest in the inmate hacking.
They met , Feb. 22, 2023, with Luther Luckett Warden , Amy Robey , to ask her about Securus ‘ banking app and its now-obvious vulnerabilities. ( Reached by phone recently, Robey declined to comment for this story. )
However, it appears that no one has been charged criminally.  , The Department of Corrections , ultimately declined to hand down much in the way of administrative penalties to the inmates involved.
The inmates were sentenced to 15 days of disciplinary segregation, which included confinement alone in a cell, in a lengthy series of disciplinary proceedings handled by internal affairs. However, those sentences were imposed on 90 days as long as the prisoners did not commit any additional offenses while they were there.
Only a few inmates who were found with stolen money in their accounts acknowledged being actively involved in the tablet hacking, according to internal investigators.
The majority of the prisoners involved refused to respond to inquiries, and others said they were unsure of how the money came there, and it just appeared, according to investigators in their report.
Bianca Tylek , is executive director of , Worth Rises, a nonprofit advocacy group  , that’s critical of what it calls” the prison industry”. Tylek said the hacking was “more like a loss of revenue for Securus than a theft of funds.”
” This is lunacy, what these corporations are allowed to do to people who are incarcerated, and to their loved ones”, Tylek said.
” These are incredibly cheap services in the year 2024 — I mean, we’re talking about email and video chat — that would not require much of a state agency’s budget, and it would tremendously help us to keep an inmate’s family relationships stable for when they’re released. However, we sell this to prisoners for outrageous prices in order to make a profit.
” At some point you have to ask yourself, who’s really committed the crime here”? she said.
___
© 2024 Lexington Herald-Leader
Distributed by Tribune Content Agency, LLC.
