Earlier this month, Idaho prison officials discovered that 364 prison inmates exploited a vulnerability in tightly controlled profit-driven company tablets and added nearly $ 225,000 to personal accounts for email and video calls, music and other digital services. The hack triggered a review of the practices of JPay, the servicer who sells the tablets to inmates, and charged them with 47 cents for a single e-mail.
According to the Associated Press, the widespread exploit was uncovered by the Idaho Corrections Department. The hack, according to a spokesman for the Idaho Department of Justice, "was intentional, not accidental, and required knowledge of the JPay system and the diverse measures taken by every inmate who exploited the system's vulnerability to mis-credit their account." [1
Get Data Sheet, Fortune's Technology Newsletter
The inmates who added credit to their accounts were spread across five facilities, suggesting that the technique was widely used for the hack was shared by word of mouth. Prisoners had a lot of motivation, thanks to the high prices JPay uses for services that are almost free for many Americans.
According to Wired, JPay has an effective monopoly on e-mail and digital services in Idaho prisons and has contracts with dozens of state prison systems. In addition to paying up to 47 cents for e-mail "stamps", JPay charges up to $ 18 an hour for video calls, a stark contrast to largely free services like Skype. JPay sells music downloads for up to $ 2.50 per song – far beyond the cost of iTunes downloads. JPay also offers bank-like cash handling for inmate digital and commissary accounts, and fees to send money to an inmate's account can be exorbitant – a deposit of less than $ 20 can cost $ 3.50.
These prices allow Jpay to provide services at no cost to taxpayers – in fact, according to the New York Times law enforcement agencies and government agencies often receive a substantial cut in revenue generated by JPay and similar services , Prison service companies generally argue that the high fees are necessary to ensure security, although the Idaho hack seems to undermine this argument. Dozens of lawsuits against prison service providers have been filed on their installments and fees, and the Idaho hack has sparked online debate over whether such charges are unjust and inhumane.
Many answers to the Idaho hack praise even the inmates, some even go so far as to suggest offering jobs in cybersecurity.