Here’s something I’ve been putting off writing: I spent eighteen months in federal prison. The charge was computer fraud. The context is weirder.
In 2016, I built a website called HeheStreams. It started as a joke—a proof of concept I posted on Reddit after BallStreams, my beloved NBA streaming site, vanished overnight. Nobody picked it up, so I kept working on it. Eventually I slapped a paywall on it, thinking it was ludicrous that anyone would pay for such a thing.
People paid for such a thing.
What HeheStreams actually was
HeheStreams let users watch live sports from MLB, NBA, NFL, and NHL. But it wasn’t a typical piracy operation. I wasn’t capturing broadcasts and rehosting them. Users connected to the leagues’ own streams—their infrastructure, their CDNs. The streams were as reliable as the official ones because they were the official ones.
It was, in retrospect, a better product than what the leagues were selling. Users asked if it was legal. I had to explain that no, no sports league licenses content to a website called HeheStreams.
It was an open secret in certain circles. Many of my fellow developers at previous jobs knew about HeheStreams. One happened to be a subscriber before we worked together. That’s the kind of product-market fit you don’t expect from a janky piracy side project.
The site ran from 2016 to 2021.
It wasn’t about the money. It never was.
I made the site for me so I could watch sports. I just had some other people watching with me and didn’t know how to say no.
When I eventually put up a paywall, it was “pay what you think it’s worth.” The first purchase was for $100. I’d hoped nobody would pay—I wanted a social life and didn’t want to be beholden to grown men telling me their janky streaming site was broken. But people kept paying. So I kept building.
And then I felt an obligation to fix the site when grown men told me my shitty basketball streaming website wasn’t working for them. That’s a weird kind of pressure. It’s also, apparently, the seed of product-market fit.
The big draw was bypassing geoblocking that you couldn’t otherwise buy your way out of legally. If you lived in the wrong city for your team, the official services were useless. HeheStreams wasn’t.
I said no to a lot of requests. UFC/MMA/boxing I turned down because their business models revolve around PPV—I wasn’t going to undercut something that depended on individual event revenue. NCAA sports I refused outright. NIL didn’t exist at the time, and I wasn’t going to profit off children. Feature parity mattered to me too. If I couldn’t make it as good as the other sports’ implementations, I didn’t add it.
Not every customer is a good customer. I learned that quickly. The quirks and features of the site filtered for a certain type of user—people who could figure things out, who understood that things would occasionally break, and who didn’t expect me to be their personal concierge.
I treated every message—even transactional emails—as an opportunity to build trust. My copywriting was informal and self-deprecating. I swore at myself when apologizing for things not working. People told me they looked forward to my automated emails. That was a good litmus test.
But scaling personality is nearly impossible. You can’t build a playbook for friendliness. People have bad days they drag into work. I’m guilty of this too. The week after my mom died, I was terse. I have uncomfortable memories of being short with users and not living up to my own standards. I went so far as to tell one user my situation, and he told me that because I’m providing a service, I have to do better.
He churned.
That part of the story deserves its own post.
How it ended
In July 2021, the Alliance for Creativity and Entertainment came knocking. Civil settlement. Site goes dark.
Then in October 2021, the U.S. Government decided they weren’t done. I was charged with computer fraud, wire fraud, illicit digital transmission, and—here’s the fun one—extortion.
The extortion charge came from a series of emails with Major League Baseball. I’d found some security vulnerabilities in their systems. Nothing related to streaming—garden-variety web issues. I disclosed them responsibly and wanted to blog about them.
Someone at MLB asked what I “valued” the bugs at. Being me—autistic, methodical—I referenced Shopify’s bug bounty calculator. It spat out something like $150k per bug. I immediately said that was ridiculous since I’d spent maybe ten minutes finding them.
Nuance doesn’t survive email threads.
The autism meant I missed every bit of corporate subtext. That’s not an excuse—just a debugging note about the operating systems involved.
The plea
I signed a plea deal. I pleaded guilty to one count of computer fraud—accessing a protected computer without authorization. The streaming part, I did. No footnotes, no irony.
I was sentenced to three years in federal prison, three years of supervised release, $500,000 in forfeiture, and roughly $3 million in restitution.
My name ended up on ESPN for something that started as a weekend project. That was weird.
The facility
I did my time at FCI Thomson in northwestern Illinois.
If that name sounds familiar, you might know it as “Gitmo North.” The Obama administration originally planned to house Guantanamo Bay detainees there. Congress blocked that, so the Bureau of Prisons bought it instead and turned it into a Special Management Unit—essentially a second supermax, modeled after ADX Florence.
For years, Thomson was one of the deadliest federal prisons in the country. Multiple inmate murders—by staff. The Marshall Project called it “one of the deadliest” facilities in the federal system. In 2023, after a series of homicides and a damning investigation, the BOP finally converted it to a low-security facility. They already paid for it, so they had to make use of it.
The average age of an inmate in the federal system will soon be 55. Many of those inmates will transition to low-security facilities because of how the scoring system works. There are already overcrowding issues and staffing issues—nobody wants to live in the middle of a cornfield.
18 months inside
Federal prison is optimized—systemically and socially—for drug cases and sex offenses. There were many instances where there was no “other” checkbox. This had a trickle-down effect: inmates assumed a short, well-groomed male was a sex offender because he didn’t fit the profile.
I had to answer the question “what are you in for?” a lot. People would come back to me saying, “hey, so-and-so was asking what you were in for, lol.” The rumor mill runs on assumptions, and the assumptions aren’t kind to anyone who doesn’t fit the standard profiles.
Sex offenders were treated as significantly less than human. The unwritten rules were clear: don’t associate, don’t share, don’t acknowledge. And I get it—some of those crimes are genuinely heinous. But the blanket dehumanization extended to everyone in that category, regardless of circumstances. There’s no nuance. No consideration for the 19-year-old who slept with his 17-year-old girlfriend. No distinction between the predator and the edge case. There were significantly more of the latter.
I consciously went against those unwritten rules when they didn’t align with my values. Not as some moral stand—I just couldn’t square the blanket cruelty with my own sense of how people should be treated.
For people with longer sentences, prison is their way of life. I was a tourist on the shittiest vacation.
Being autistic in federal prison
I was diagnosed autistic in my 30s, before I went in. Reading Unmasking Autism while incarcerated hit different—suddenly large portions of my life started making sense, and I was processing that while surrounded by people I couldn’t fully read.
I don’t have many sensory sensitivities. Noise is bad, though. Federal prison is loud. Doors. Arguments. The ambient chaos of people living on top of each other. It wears on you. People always moving—always moving—isn’t very fun either.
The bigger issue was social dynamics. Autistic people are notoriously bad at understanding and parsing unwritten rules, and prison runs on unwritten rules. Who you can sit with. What you can say to whom. The subtle signals that mean you’re about to have a problem. I missed things. I misread things. That’s dangerous in an environment where misreading someone can escalate fast.
I adapted better than I expected. I learned I’m more socially capable than I gave myself credit for—better at blending in, better at adjusting. But I was always operating with a slight delay, always parsing things consciously that other people seemed to catch automatically.
Reading
Here’s something I didn’t expect: I read books. A lot of them. Before prison, I’d never finished one—not even in high school.
My favorites were Determined, Behave, Salt Fat Acid Heat, Unmasking Autism, Enigma, and Neurotribes. Heavy on the neuroscience and autism literature. Tracks.
What I learned about myself
Prison was weird for my own growth cycle. I didn’t become a different person—just one who understands himself better. Not in a memoir-worthy way.
I’m more tolerant of different people and a lot more worried about incarcerated individuals than I was before. Those inside aren’t set up for success in the free world. I’m an outlier, and I know that. The problem-solver in me has no idea how to fix it, or if it can be fixed within our current system.
Inmates—regardless of crime—need real opportunities while incarcerated that actually prepare them for life afterward. Right now, we fail at that completely.
Getting out
I was released in August of 2025. Finding work was surprisingly effortless, considering the job market. I had six offers within a few weeks.
I took the one where the founder showed up in a sports jersey to our video chat, knowing exactly what I went to prison for.
He’s since told the team that one of the factors in hiring me was the success of the site itself—the product instincts, the technical execution, the fact that I’d built something people wanted badly enough to pay for even when they knew it was illegal. That acknowledgment meant a lot. It was a signal that the thing I’d done wrong was also, in some way, evidence of something I could do right.
It’s been a good fit.
The same instinct, pointed differently
I don’t think of it as “life after prison.” It’s just life. Same problems, different points of view. The same ingredients rearranged. I still get up, write code, and think about building all the time. There’s a latte in my routine now. That’s different I guess.
Another difference is that I’m more deliberate about the things I say yes to. I try to build stuff that doesn’t just work, but feels aligned with something bigger than my own curiosity. You start caring about that after things go sideways once.
Curiosity is neutral. It’s what you point it at that matters. That’s both empowering and terrifying—especially when your curiosity once built something that landed you federal charges. My curiousity doesn’t extend itself to other crime-y things, thankfully.
I haven’t lost the impulse that got me here. The same instinct that made me want to take apart systems and rebuild them is the one that drove HeheStreams, and it’s the same one that makes me good at my job now.
On vulnerability disclosure
Every company should have a standardized playbook for handling security disclosures. Every single one. Not a “we’ll get back to you” email. Not radio silence. Not calling the FBI.
A clear, published process. A timeline. A point of contact. Protections for the reporter.
This exists for whistleblowers. It should exist for bug reporters too.
One thing that bothers me is that corporations engage in behavior that’s ethically far worse—price-fixing, wage theft, environmental destruction—and pay fines that amount to rounding errors on their quarterly earnings.
I’m not saying I didn’t break the law. I totally and absolutely did. Asymmetry is hard to ignore.
On the “extortion” narrative
This was paraded and I’m still unhappy about it.
Why I’m writing this
There’s a certain freedom in owning your story publicly. People can’t weaponize what you’ve already made peace with.
The explainer website originally existed privately, and I’d pass it along with my resume—which included my mention of prison—so that there’s context. It was never meant for a wide audience.
It hit the front page of HackerNews twice (both times posted by another user) lingered for a bit. There’s some validation there—not validation for what I did but the context wasn’t as poorly received as I had anticipated, had the public ever had a chance to see it. When you’re incarcerated, there’s some weird voodoo that convinces you that your crime is like everyone else’s. I was incarcerated at the same facility, yes, but I’d argue that second-degree murder isn’t the same as my charge. The system shapes you to think that way. It did me, at least. I had that mentality getting out. The little ego boost I got from HackerNews jas been helpful in the healing sense.
Now I’m out and I can have a little bit of coming-out party.
I recently did the same thing at work—gave a slideshow during an all-hands that started as a standard “about me” and then pivoted to “oh yeah, also.” Being able to shape the narrative and tell my side before someone Googles me and finds the slanted reporting has proven helpful. I told them the truth is usually somewhere between what the DOJ says and what actually happened.
I’m still the same person. Just with better self-knowledge, I guess.
For more detail on the charges, the site, or the rest of it: prison.josh.mn