The FBI's WikiLeaks Mole

When he met Julian Assange for the first time, Sigurdur Thordarson admired the WikiLeaks founder’s attitude and quickly signed up to the cause. But little more than a year later, Thordarson was working as an informant spying on WikiLeaks for the US government — embroiling himself as a teenager in one of the most complicated international events in recent history.

In a series of interviews with Slate, Thordarson has detailed the full story behind how, in an extraordinary sequence of events, he went from accompanying Assange to court hearings in London to secretly passing troves of data on WikiLeaks staff and affiliated activists to the FBI. The 20-year-old Icelandic citizen’s account is partly corroborated by authorities in Iceland, who have confirmed that he was at the center of a diplomatic row in 2011 when a handful of FBI agents flew in to the country to meet with him — but were subsequently asked to leave after a government minister suspected they were trying to “frame” Assange.

Thordarson, who first outed himself as an informant in a Wired story in June, provided me with access to a pseudonymous email account that he says was created for him by the FBI. He also produced documents and travel records for trips to Denmark and the United States that he says were organized and paid for by the bureau.

The FBI declined to comment on Thordarson’s role as an informant or the content of the emails its agents are alleged to have sent him. In a statement, it said that it was “not able to discuss investigative tools and techniques, nor comment on ongoing investigations.” But emails sent by alleged FBI agents to Thordarson, which left a digital trail leading back to computers located within the United States, appear to shine a light on the extent of the bureau’s efforts to aggressively investigate WikiLeaks following the whistle-blower website’s publication of classified US military and State Department files in 2010.

Late last month, Army intelligence analyst Bradley Manning was convicted on counts of espionage, theft, and computer fraud for passing the group the secrets. During the Manning trial, military prosecutors portrayed Assange as an “information anarchist,” and now it seems increasingly possible that the US government may next go after the 42-year-old Australian for his role in obtaining and publishing the documents. For the past 14 months, Assange has been living in Ecuador’s London Embassy after being granted political asylum by the country over fears that, if he is sent to Sweden to face sexual offense allegations, he will be detained and subsequently extradited to the United States.

Meanwhile, for more than two years, prosecutors have been quietly conducting a sweeping investigation into WikiLeaks that remains active today. The FBI’s files in the Manning case number more than 42,000 pages, according to statements made during the soldier’s pretrial hearings, and that stack of proverbial paper likely continues to grow. Thordarson’s story offers a unique insight into the politically-charged probe: Information he has provided appears to show that there was internal tension within the FBI over a controversial attempt to infiltrate and gather intelligence on the whistle-blower group. Thordarson gave the FBI a large amount of data on WikiLeaks, including private chat message logs, photographs, and contact details of volunteers, activists, and journalists affiliated with the organization. Thordarson alleges that the bureau even asked him to covertly record conversations with Assange in a bid to tie him to a criminal hacking conspiracy. The feds pulled back only after becoming concerned that the Australian was close to discovering the spy effort.

*****

It was 2010 when the saga began in Reykjavik, Iceland. Thordarson, then just 17, says that before his first encounter with Assange, he knew little about the man beyond a few YouTube videos he’d watched about WikiLeaks. But he went to hear Assange speak at a conference hosted by an Icelandic university, and the teenager was impressed. After the event, a journalist Thordarson knew introduced him to Assange, and the pair struck up a relationship that led to Thordarson doing some volunteer work for the organization. Before long, he was on the edges of WikiLeaks’ small, tight-knit inner circle.

At that time, the group was sitting on the explosive files it had received from Manning that included a video showing a US helicopter attack that resulted in the deaths of 12 civilians, among them two employees of the Reuters news agency.

Thordarson, a blond-haired stocky figure with a baby face, was present while WikiLeaks staff and volunteers in Reykjavik were preparing the video for publication. When it was published by WikiLeaks in April 2010, under the name Collateral Murder, it catapulted the organization into the international spotlight and provoked an angry response from government officials in Washington.

The then-teenager, known as “Siggi” to his friends, was around at the height of that backlash. He was given administrative privileges to moderate an Internet chat room run by WikiLeaks. And when Assange relocated from Iceland to England, Thordarson came to visit. He even accompanied the WikiLeaks founder to court appearances in London as he fought extradition to Sweden over allegations of sexual assault.

Thordarson looked up to Assange, viewing him as a friend. The WikiLeaks chief, he says, treated him well — helping him find a lawyer in 2010, not long after the pair had met, when he says he was wrongly accused by Icelandic police of breaking into a business premises. But signs that Thordarson had a proclivity for brushes with the law did not appear to trigger alarm bells early on at WikiLeaks — though perhaps they should have, because he was certainly not any ordinary volunteer. Unlike many drawn to WikiLeaks, Thordarson does not seem to have been principally motivated by a passion for the cause of transparency or by the desire to expose government wrongdoing. Instead, he was on the hunt for excitement and got a thrill out of being close to people publishing secret government documents.

As a child, Thordarson led a fairly normal middle-class life in Reykjavik, enjoying social studies and chemistry at school. His father worked as a sales manager at a painting firm, and his mother ran a hair salon. But as he entered his teenage years, he says, he began to feel that he could not connect with others in his peer group. He went to college to study computer science and psychology — but claims he was suspended after hacking into a college computer system.

By mid-2011, Thordarson’s thirst for adventure, combined with his interest in hacking, would irreversibly complicate his relationship with WikiLeaks. In June of that year, the Anonymous-linked hacker group LulzSec brought down the website of the CIA. Thordarson says that he and other WikiLeaks staff were amused by the incident, and he decided to reach out to the hackers to establish contact. Thordarson claims that, using the aliases “Q” and “Penguin X,” he set up a line of communication between WikiLeaks and LulzSec. During the series of exchanges that followed, Thordarson says he “suggested” that his group wanted assistance to find evidence of anti-WikiLeaks sentiment within the Icelandic government’s Ministry of Finance, which had thwarted an attempt by DataCell, a company that processes WikiLeaks donations, to purchase a large new data center in Reykjavik. (In early 2011, DataCell’s founder questioned whether the Icelandic government had deliberately prevented the deal because it was “afraid of letting WikiLeaks here into the country.”)

“That was basically the first assignment WikiLeaks gave to LulzSec,” Thordarson alleges, “to breach the Icelandic government infrastructure.”

The Barrett Brown Saga

Until the moment the FBI burst through his door, it had been much like any other day for Barrett Brown.

The 31-year-old writer and activist, closely affiliated to the Anonymous hacking collective, had been joking around late at night in an internet webcam chat room with a few friends. But the conversation abruptly halted when Brown's video feed blacked out. Amid a flurry of commotion and cries of "get down," a troupe of armed agents surged into his apartment in Dallas, Texas, and handcuffed him face down on the floor.

Since that evening, on 12 September last year, Brown has been in a Texas jail awaiting a looming trial that could land him several decades behind bars. He stands accused of committing 17 offences in total, including aiding and abetting aggravated identity theft, making internet threats, and retaliation against a federal law enforcement officer. But it is no ordinary, open and shut case. It is a bizarre saga that involves a web of secrets, scandals, covert informants and some of the most widely publicised computer hacking conspiracies in recent history.

US authorities have made it clear in indictments lodged against Brown that they view him as a menace to society — an anti-government anarchist agitating for violent revolution. But supporters claim he is being subjected to heavy-handed prosecution, comparing his plight to that of Matthew Keys, the Reuters social media editor accused last week of conspiring with Anonymous, and Aaron Swartz, the prominent internet freedom activist who committed suicide in January while facing a host of controversial hacking charges. In reality, neither side is the full story.

Brown, just short of 6 feet tall, skinny with sandy brown hair, grew up in an affluent part of Dallas County, the son of a wealthy Texas real estate developer. He is a somewhat eccentric character — a college dropout firebrand with a history of drug addiction and a penchant for ranting, red wine and cigarettes.

Before he crossed paths with the FBI, Brown was a prolific writer who had contributed to publications including Vanity Fair, the Guardian, the Huffington Post and satirical news site the Onion. He had a short stint in politics as the director of communications for an atheist group called Enlighten the Vote, and he co-authored a well-received book mocking creationism, Flock of Dodos, which the Harvard law professor Alan Dershowitz compared to works by celebrated authors Thomas Paine and Mark Twain.

"I really just wanted to write humour and was absolutely on track to doing so until a couple events and thoughts in 2009," Brown told me in August last year, shortly before his arrest. What changed his trajectory was that he immersed himself in what he would sometimes jokingly term "this computer shit" — a strange and chaotic world of online activism.

There were a number of factors involved, each of them closely connected. It began when Brown hatched the idea for an internet thinktank he named Project PM, in 2009, dedicated to investigating private government contractors working in the secretive fields of cybersecurity, intelligence and surveillance. Then, in 2010, WikiLeaks published thousands of classified US government documents. And at around the same time Anonymous exploded onto the world stage, attacking the Church of Scientology and defending WikiLeaks by declaring cyberwar on payment processors like Paypal and Visa, which had blocked the whistleblower website's funding sources after pressure from US politicians.

Brown saw a conflation of interests between Project PM, WikiLeaks and Anonymous. He believed WikiLeaks was doing a "tremendous service to humanity" by releasing classified government information, and he was inspired by Anonymous, which he viewed as "unprecedented" because of the way it brought people on the internet together as a force for political change.

Before long, Brown had directly affiliated himself with Anonymous, and by early 2011 he was working alongside some its most skilled hackers as a sort of de facto press officer. He had no hacking ability, but instead put his flair for writing and rhetoric to use. He would send out missives to his media contacts and do televised interviews in which he would rail against murky government cybersecurity initiatives that he said Anonymous would expose.

Some within the diffuse community of Anonymous took an instant dislike to Brown, accusing him of being a paranoid egomaniac who was seeking fame and hogging the limelight. But he rarely gave his critics a second glance because, as far as he was concerned, he had more pertinent issues to deal with — on one occasion embroiling himself in a surreal public spat with a Mexican drug cartel over a kidnapped activist.

"We have hit upon things here that really do matter — that haven't been given due consideration," he would bark in his distinctive, rapid-fire baritone southern drawl. "The battlefield is the information flow."

Brown's interviews, some aired as "exclusives" on major US TV news networks like NBC, grabbed attention. He viewed himself as engaged in what he would refer to as "information operations," almost like a military propaganda campaign. Hackers would sometimes obtain data and then pass it on to him. He would spend days and nights hunkered down in his small uptown Dallas apartment poring through troves of hacked documents, writing blog posts about US government intelligence contractors and their "misplaced power" while working to garner wider media coverage.

When servers belonging to the American security thinktank Stratfor were infiltrated by the hackers in December 2011, for instance, Brown alerted reporters across the world. He told the Times that millions of stolen emails, later published by WikiLeaks, could prove to be "the smoking gun for a number of crimes of extraordinary importance". It was mostly hyperbole, of course, but he was a skilled operator. He knew how to get headlines, especially headlines that would rile his adversaries.

By becoming a public advocate for hackers implicated in major computer crimes, however, Brown was in extremely shaky legal territory. He had developed a close relationship with an Anonymous splinter group called AntiSec — a volatile, militant outfit that had evolved out of LulzSec, another Anonymous offshoot which took credit for a series of prominent attacks on government websites and multinational corporations over a 50-day rampage in the summer of 2011.

AntiSec became highly active toward the end of 2011, hacking Stratfor and then later a Virginia-based law firm involved in defending a US marine who had played a key role in a massacre of civilians during the Iraq war. The group dumped thousands of Stratfor customers' credit card numbers online and posted a large trove of emails obtained from the law firm, collaterally exposing personal details about victims of sexual assault in the process.

It appeared that the hackers were becoming increasingly callous and equally careless, veering from the "vigilantes for good" image they liked to project of themselves.

Brown said that the credit card leak was a "public relations blunder" that had caused internal conflict between the hackers. One party had been "blindsided" by the data dump, according to Brown, and one of the team quit the group and "went dark" because of it.

"I wasn't informed of the leak or the nature of the leak," he told me at the time. "I do defend them for it and I will take responsibility for defending them. But if I had my way it would have been done differently. I have no... they don't need me, basically, so they don't ask my opinion."

But by then it was too late: Brown's relationship with AntiSec had pinned a law enforcement target on his back. A few months after the hack on Stratfor, he was raided for the first time by the FBI. He was not arrested, but some of his property, including his laptop computer, was confiscated as evidence.

On the same day, 6 March 2012, an explosive Fox News story outed a core member of both AntiSec and LulzSec as an FBI informant. "Sabu," real name Hector Monsegur, 29, had been "turned" nine months earlier by the authorities after being traced to his New York apartment.

In order to escape jail, Monsegur, a notorious loudmouth elite hacker who was considered a ringleader of the groups, had been covertly cooperating with the FBI to help build cases against, and track down, his former partners. It was an extraordinary development that shook the hacking community and made front page news internationally.

Prosecutors, likely assisted at least in part by evidence gleaned by Monsegur, have since accused Brown of aiding and abetting the transfer of the credit card numbers obtained from Statfor's servers in a case of aggravated identity theft. The hackers used the credit cards to fraudulently donate hundreds of thousands of dollars to charities including the Red Cross and Save the Children.

Brown, who denies all of the charges against him, is also accused of a separate fraud-related offence that carries up to 15 years imprisonment for copying and pasting a hyperlink in a chat room to a file that allegedly included within it some 5,000 Stratfor credit card details. This has caused an outcry among some activists, with secret-spilling website Cryptome — which published the same link Brown is accused of sharing — posting a statement likening the charge to "official chilling of free speech online" and criticising "over-reaching indictments."

The spiralling debacle eventually took its toll on Brown. The FBI seizure of his property and the revelation about Monsegur, whom he angrily branded a "degenerate pussy traitor," seemed pivotal.

When I spoke to him earlier in 2011 he had appeared optimistic — as if he felt he was riding the crest of an unstoppable wave. He would talk enthusiastically about "spiritual change" taking place due to revolutions sweeping the Arab world, and explain how young Anonymous hackers he knew had assisted activists in the Middle East by providing them with tools to counter government surveillance and tracking. But by spring 2012, his mindset seemed to alter, his mood darker and at times almost anguished.

"We're losing hope in the idea of trying to convince the American people to pay attention to something that matters," he lamented in April, speaking on the phone from Dallas. "To some extent we are all the enemy, all of us have failed."

Brown was frustrated that mainstream media outlets were not covering stories he felt deserved attention. He would complain that reporters would often approach him and ask about the personalities of some of the more prominent hackers, like Monsegur, but ignore the deeper issues about governments and private contractors contained in documents that had been hacked.

Complicating matters further, as a recovering heroin addict, Brown was taking Suboxone, a prescription drug used to treat opiate withdrawal. This was having an impact on his health, perhaps amplified by the cyclone of drama engulfing him. One day in August, he told me he had broken down in tears. "All of it gets to be too much," he wrote in an email.

Three weeks later, Brown would be in jail. He had posted online a series of videos in which he appeared to issue threats directed at a named FBI agent, whom he accused of harassing his mother, and demanded that his previously seized property be returned. In the videos he looked frazzled, pale and on edge. He concluded with a lengthy tirade, saying he feared drug cartel "assassin squads" were out to get him and warning government officials not to come near his apartment.

"I will shoot all of them and kill them if they come," he said, looking blankly straight into the camera. "It was pretty obvious I was going to be dead before I was forty or so — so I wouldn't mind going out with two FBI sidearms like a fucking Egyptian Pharaoh."

Within hours of the video appearing, agents charged through his door and pinned him to the floor. For the FBI, it was clearly the final straw. Brown had moved from publishing long blog screeds blasting shady security firms to making violent threats. Hyperbole or not, a line had been crossed. His time was up.

When the moment finally came, Brown can't have been too surprised. He suspected that one day he was going to end up carted off to a dingy jail cell, he just didn't know exactly when or in what circumstances. He had accepted his fate fairly soon after becoming involved with Anonymous.

"I'll probably be charged or indicted," he told me during one interview in early 2012. "I just hope that a trial will bring more media attention to the issues that brought me here in the first place."

Brown is due to face two separate trials, the first of which is scheduled to begin on 3 September.

Last I heard from him he was doing all right.

"How's everything?" he wrote in short message. "I seem to be in prison."

--

This article first appeared in the Guardian.

Surveillance Proof

As government agencies in the United States, the United Kingdom, Canada, and Australia push for increased surveillance powers, one pioneering American is pushing back.

New York-based entrepreneur Nicholas Merrill is making progress on a project he revealed in April: an encryption-based telecommunications provider designed to be “untappable.” After crowd-funding almost $70,000 in donations, Merrill says that he has held talks with a host of interested venture capitalists and a few “really big companies” apparently interested in partnering up or helping with financial support. Now the “surveillance-proof” software is in development, and he is on track to begin operating a limited service by the end of the year.

Merrill’s ultimate aim is to create a telecommunications infrastructure that inhibits mass surveillance. First, he is building an Internet provider that will use end-to-end encryption for Web browsing and email. Then he plans to roll out a mobile phone service that will enable users to encrypt calls, making them difficult to intercept. The key to decrypt the communications would be held by each individual customer, not Merrill’s company. Because the telecom firm would be unable to access the communications, law enforcement agencies that want to read or listen to communications would be forced to serve warrants or court orders on individuals directly. “This would make it impossible to do blanket, dragnet surveillance of all the customers of a telecommunications carrier,” Merrill says.

The idea for the project is not to help bad guys evade detection, though undoubtedly that’s how some critics will see it. Rather, Merrill is particularly keen to develop the technology to help journalists and human rights organizations—groups, he says, “whose right to confidentiality is more or less accepted under the law.”

Merrill has a strong record of defending user privacy. In 2004, he became the first ISP executive to successfully challenge a secret FBI “national security letter” demanding he hand over customer information. His willingness to question the constitutionality of the secret letter at the time put him at odds with most major telecoms providers, which have a poor track record when it comes to protecting customer privacy. In 2005 and 2006, a number of companies were revealed to have handed over troves of customer data and opened up wiretaps to the National Security Agency, sometimes without a warrant.

Today, Merrill admits prospective funders of his latest project have expressed concerns that it could lead to a confrontation with powerful actors (“It’s challenging to go up against some of the forces that are trying to open up all communications to wiretapping,” he says). But he is trying to address this by showing that government and law enforcement agencies could themselves benefit from his technology. Cybersecurity and privacy are part of the same problem but framed differently, he believes. Both could be addressed at once by ubiquitous encryption of communications and data transfer—protecting user privacy while also helping prevent malicious hackers from stealing information.

Some establishment figures have already been won over by Merrill’s argument. The advisory board of his nonprofit research institute, Calyx, which is developing the technology, includes a former NSA technical director and a former federal prosecutor who is also ex-CIA. Whether he can get the backing of current members of the U.S. law enforcement community, though, is another matter altogether. Merrill’s technology could be seen as creating extra barriers for law enforcement and the authorities would likely oppose it for that reason. Existing U.S. wiretapping law, called CALEA, states that telecom providers "shall not be responsible for decrypting" communications if they don't possess "the information necessary to decrypt.” But that may change under reforms proposed by the FBI, which is actively seeking more surveillance powers.

As governments increasingly move toward expanding their power to conduct electronic surveillance, it is inevitable that innovative technologists, software developers, and cryptographers will work to help people protect the privacy of their personal communications. Earlier this week the NSA’s chief tried to quell concerns over allegations that it is building a huge domestic surveillance center in Utah, dismissing whistle-blowers’ claims as “baloney.” Given the NSA’s recent history, however, it is likely many Americans will remain skeptical about the spy agency’s reassurances—and some will turn to encryption.

Merrill aims to launch his telecommunications firm first in the United States before tackling the international market, where there are also mounting concerns about government surveillance schemes. “We’re not trying to force people to use our service,” Merrill says. “What we’re trying to do is re-envision how the telecommunications industry could work if privacy and encryption technology was built in from the beginning.”

This article first appeared at Slate.com

Police Meetings and Trojan Surveillance

Infecting a computer with spyware in order to secretly siphon data is a tactic most commonly associated with criminals. But explosive new revelations in Germany suggest international law enforcement agencies are adopting similar methods as a form of intrusive suspect surveillance, raising fresh civil liberties concerns.

Information released last month by the German government shows that between 2008-2011, representatives from the FBI; the U.K.’s Serious Organised Crime Agency (SOCA); and France’s secret service, the DCRI, were among those to have held meetings with German federal police about deploying “monitoring software” used to covertly infiltrate computers.

The disclosure was made in response to a series of questions tabled by Left Party Member of Parliament Andrej Hunko and reported by German-language media. It comes on the heels of an exposé by the Chaos Computer Club, a Berlin-based hacker collective, which revealed in October that German police forces had been using a so-called "Bundestrojaner” (federal Trojan) to spy on suspects.

The Bundestrojaner technology could be sent disguised as a legitimate software update and was capable of recording Skype calls, monitoring Internet use, and logging messenger chats and keystrokes. It could also activate computer hardware such as microphones or webcams and secretly take snapshots or record audio before sending it back to the authorities.

German federal authorities initially denied deploying any Bundestrojaner, but it soon transpired that courts had in fact approved requests from officials to employ such Trojan horse programs more than 50 times. Following a public outcry over the use of the technology, which many believe breached the country’s strict privacy laws, further details have surfaced.

Inquiries by Green Party MP Konstantin von Notz revealed in January that, in addition to the Bundestrojaner discovered by the CCC, German authorities had also acquired a license in early 2011 to test a similar Trojan technology called “FinSpy,”manufactured by England-based firm Gamma Group. FinSpy enables clandestine access to a targeted computer, and was reportedly used for five months by Hosni Mubarak’s Egyptian state security forces in 2010 to monitor personal Skype accounts and record voice and video conversations over the Internet.

But it is the German government’s response to a series of questions recently submitted by Hunko that is perhaps the most revealing to date. In a letter from Secretary of State Ole Schröder on March 6, which I have translated, Hunko was informed that German federal police force, the Bundeskriminalamt (BKA), met to discuss the use of monitoring software with counterparts from the U.S., Britain, Israel, Luxemburg, Liechtenstein, the Netherlands, Belgium, France, Switzerland, and Austria. The meetings took place separately between Feb. 19, 2008, and Feb. 1, 2012. While this story has been covered in the German media, it hasn’t received the English-language attention it deserves.

Both the FBI and Britain’s SOCA are said to have discussed with the Germans the “basic legal requirements” of using computer-monitoring software. The meeting with SOCA also covered the “technical and tactical aspects” of deploying computer infiltration technology, according to Schröder’s letter. France’s secret service and police from Switzerland, Austria, Luxemburg, and Liechtenstein were separately briefed by the BKA on its experiences using Trojan computer infiltration.

Interestingly, at a meeting in October 2010 attended by police from Germany, the Netherlands, and Belgium, representatives from the Gamma Group were present and apparently showcased their shadowy products. It is possible that the Germans decided at this meeting to proceed with the FinSpy trial we now know took place in early 2011.

If nothing else, these revelations confirm that police internationally are increasingly looking to deploy ethically contentious computer intrusion techniques that exist in a legal gray area. The combination of the rapid development of Internet technologies and persistent fears about national security seem to have led to a paradigm shift in police tactics—one that appears, worryingly, to be taking place almost entirely behind closed doors and under cover of state secrecy.

The use of highly intrusive surveillance technologies in any context demands some level of democratic scrutiny. How many police and government agencies are sanctioned to use hacking and Trojans as a means to surveil their citizens, how frequently does it happen, on what grounds, and with what oversight? The fallout from Germany’s Bundestrojaner scandal may have shed some much-needed light on this murky world, but still we are left with many more questions than answers.

This article first appeared at: slate.com

The Sabu Revelation

To most observers he seemed unpredictable, dangerous and so highly skilled that he could evade the long arm of the law. But in an astonishing revelation, last week it emerged that Sabu, the notorious figurehead of hacking group LulzSec, had for almost nine months been working secretly as an informant for the FBI.

The identity of 28-year-old Hector Xavier Monsegur, who led a rampage against government websites and multi-national corporations, had been uncovered when he failed to mask his computer's IP address using an internet chat room on just one fateful occasion.

Soon after, FBI agents appeared at the door of his apartment on the sixth floor of a 14-story housing project in Manhattan. The agents reportedly played "good cop bad cop", convincing the infamous hacker - almost immediately, according to court documents - that his only way out was to cooperate with an international investigation into his former comrades.

Monsegur, under his Sabu guise, proceeded to continue operating aggressively online - in some cases encouraging fellow hackers to commit crimes - all while under apparent instruction of the FBI.

Some suspected he had been "turned" - but the hacker world is rife with conspiracy theories and there was no hard evidence to prove it. "Sabu was identified, apprehended by the FBI and turned to an informant," one perceptive group wrote in November last year. Yet the claim never gained substantial traction.

From the perspective of the authorities, it was a tactical masterstroke. They had managed to flip the most notorious, the most feared, and the most accomplished of the LulzSec members. Due to his close ties and wide respect among hacker collective Anonymous and other splinter groups such as AntiSec, Sabu was a goldmine to the FBI. With his help, they were able to level charges against five accused hackers based in Britain, Ireland and America.

There are concerns, however, about how far the Bureau went to pursue its goals.

On 19 June, just 12 days after Sabu had been arrested, LulzSec, the group he commanded, issued a public call to arms. "Top priority is to steal and leak any classified government information, including email spools and documentation," it wrote in a manifesto.

Sabu was quick to proudly point out the manifesto to his 30,000 Twitter followers. "The biggest, unified operation amongst hackers in history," he wrote, possibly from an FBI computer. "All factions welcome. We are one."

Two months later, on 17 August, Sabu disappeared offline for 30 days. We now know that just two days prior, on 15 August, he had secretly pleaded guilty to twelve counts of hacking in a closed hearing at Southern District court, between Manhattan Bridge and Broadway, New York. When he returned, though he reportedly helped call off some attacks, he maintained a hostile front, claiming, "I wasn't owned, arrested, hacked or any of the other rumors [sic]."

In December, he encouraged an offensive against companies manufacturing surveillance technology; he called on hackers to target "with impunity" anyone supporting legislation that would restrict internet freedoms; and played what sources close to him say was a central role in hacking intelligence and security thinktank Stratfor. The attack on Stratfor resulted in 75,000 credit card numbers being posted online, with 5.5m of the thinktank's confidential emails subsequently passed to WikiLeaks.

This trend continued almost right up until 6 March, the day he was "outed" in an exclusive published by Fox News. As recently as two weeks ago Sabu had publicly instructed hackers to "infiltrate" international crime organisation Interpol and to "expose" arms companies. "Hack their servers," he tweeted on 28 February. "Scour their user email/passes. Grab mailspoolz. Grab docs... Leak. Rinse. Repeat."

Sabu's activities while working out of FBI offices, and then later his home under 24-hour surveillance, raise significant legal and ethical questions. Most notably: by encouraging people to commit crimes in such a brazen fashion, did he cross the thin line from informant to agent provocateur?

It has been suggested that the attack on Stratfor and the subsequent dealing with WikiLeaks was allowed - perhaps encouraged - by the FBI, not only to strengthen the US government's case against the hackers, but also to assist in the prosecution of WikiLeaks founder Julian Assange. (This does not seem beyond the realms of possibility, particularly given America's well-documented desire to prosecute Assange for his role in publishing US government secrets.)

It could have been the case, of course, that Sabu on occasion went "rogue" while under FBI direction. But given that he was the most notorious hacker in the world and having his every move monitored, it is doubtful the authorities would have let him out of their sight long enough for him to have the opportunity - repeatedly and over a period of several months - to incite others to commit criminal acts. What appears more likely is that the FBI decided, like the hackers, they too could play dirty.

These are issues that will no doubt be addressed In the months ahead, as the FBI's tactics fall under scrutiny in the courts and elsewhere. The impact of the Sabu revelation, meantime, has unsurprisingly reverberated like an atomic bomb within the Anonymous community.

"I feel for the ones who worked with him and who trusted him with leaks/data," one hacker told New Statesman. "They could never have known."

This sentiment is one shared across online chat rooms frequented by Anonymous, where there are varying degrees of anger, paranoia, fear and sadness.

For many, the large void left by Sabu will provide a defining moment of sobering reality. His silent Twitter page, once a ceaseless stream of anti-establishment rage, is now nothing but a ghostly relic - a symbolic reminder that in the shadowy virtual world hackers inhabit, no one is untouchable, and everyone, no matter who they profess to be, is potentially an informant.

This article first appeared at: http://www.newstatesman.com/the-staggers/2012/03/sabu-fbi-hackers-informant

Hackers Wage War on 'Profiteering Gluttons'

In secretive online chat rooms, away from the glare of police, small groups of elite hackers plot attacks against multi-national corporations and governments. But in a quest to expose what they see as a conspiracy of high-level corruption, the hackers – affiliated to cyber-activist network Anonymous – have in recent months expanded their targets, becoming increasingly unpredictable and callous in the process.

2011 was a significant year for Anonymous, both in terms of activity and evolution. The chaotic collective, born out of online messageboard 4Chan in 2003, continued to grow, partly fuelled by the social unrest that has gripped the world.

Its members helped revolutionaries in Tunisia, Egypt and Syria counter government censorship, and temporarily disabled the websites of powerful financial institutions for refusing to process WikiLeaks donations. They have taken part in traditional protests as part of the worldwide Occupy movement and led a challenge against new laws that they say would stifle internet freedom .

At the same time, however, an aggressive and volatile faction within Anonymous has also flourished – and that is causing a degree of internal division.

Made up of a small highly skilled hacker team which carries out attacks under the name Operation Anti-Security – or AntiSec – it includes some of those previously involved with the group LulzSec, which for two months last year attacked a series of major targets including Sony and the US Central Intelligence Agency.

Unlike the majority of mainstream Anonymous participants, AntiSec's core members – numbering up to 10, with around three or four key hackers, according to sources close to the group – do not often participate in distributed denial of service (DDoS) attacks that flood websites with traffic and force them offline for a temporary period.

Announced by LulzSec in June 2011 as part of an offensive against government agencies and what it called profiteering gluttons, AntiSec's elite – like a clandestine special-forces wing of Anonymous – devote themselves to far more precarious and controversial activity.

The group breaks into servers, exposing security vulnerabilities while mining data – often including passwords and credit card numbers – that it ultimately dumps onto the web for anyone to download.

Partly inspired by a 13-year-old hacking movement of the same name, since December 2011 AntiSec has embarked on a seemingly unstoppable rampage.

It has intercepted an FBI/Scotland Yard phone call, and attacked a well-known thinktank, a number of US police forces, a law firm and even US consumer watchdog the Federal Trade Commission. Almost nothing, it seems, is off limits.

"Generally we target government systems, police systems and evil corporations," says an AntiSec hacker, who asks not to be named ("I don't need the heat"). "But law firms do usually contain a wealth of private information, and when they are representing people who are already in our crosshairs, it's fair game."

On 24 December, AntiSec broke into the website of Stratfor, a US security and intelligence thinktank that specialises in geopolitical analysis.

Aiming to expose "rich and powerful oppressors", it stole a huge 200GB cache of data from Statfor's servers, including 5m emails and 75,000 credit card numbers belonging to the thinktank's subscribers. The emails were handed to WikiLeaks, which on Monday began publishing selections of them.

But the credit card details were simply dumped online for anyone to download, leaving thousands of Statfor's customers – among them ordinary citizens who paid to receive updates on world affairs – open to exploitation by fraudsters.

There had been more unwitting victims on 3 February, when AntiSec attacked law firm Puckett and Faraj, which represented Frank Wuterich, a US soldier convicted for involvement in the killing of 24 Iraqi civilians in 2005.

The hackers were outraged when Wuterich, who admitted issuing an order to shoot first and ask questions later, avoided a jail sentence for his role in the incident, winning leniency through a plea bargain that carried no punishment beyond a reduction in rank and a pay cut.

AntiSec broke into Puckett and Faraj's servers, obtained nearly 3GB of emails (numbering tens of thousands of messages and dating back two years), and posted them onto the internet "to expose the corruption of the court systems and the brutality of US imperialism".

The trove included emails showing how Wuterich's lawyer, Mark Zaid, planned to meet Republican congressman Duncan Hunter about "making this whole case go away". But it also contained a mass of highly sensitive information from an array of cases unrelated to the Wuterich incident, such as witness statements from victims of sexual assault.

This caused unease among some members of Anonymous, with a statement published online purportedly from a disenchanted group saying that a “silent majority” were “growing uncomfortable with this new and inaccurate meaning for Anonymous.” AntiSec, however, has remained unapologetic.

"When justice cannot be found in the courts, it will be found in the streets – or in this case, the internet," says a hacker involved in the attack on Puckett and Faraj, adding that the group still has access to a private email account used by Neal Puckett, the firm's founder.

"Generally, we do work to redact information on bystanders – for example, in all of our police attacks, we have carefully redacted prisoner/parolee information. [But] it is the firm's responsibility to protect the information of their clients."

Will there be more attacks on law firms in the future? "If law firms stick their necks out in defence of notoriously corrupt corporations – especially if it is shown that wrongdoing was involved – then yes, I'd say that could be possible."

Adopting such an increasingly militant approach has gained AntiSec a number of vocal critics, most notably among organisations that in the past may have sympathised with the wider aims of the Anonymous movement.

Alex Hanff, managing director at consultancy firm Think Privacy and former communications project leader at civil liberties watchdog Privacy International, denounced the group earlier in February after it posted the source code of popular Symantec anti-virus software online, rendering it potentially unsafe. Hanff, who keeps in regular contact with those involved in Anonymous actions, was asked to endorse the Symantec release by AntiSec. When he refused, saying it could make thousands of computer users vulnerable to criminals, a Privacy International affiliated website came under attack.

"People who hold Anonymous's cause close to heart are incredibly aggravated by the actions of AntiSec," Hanff says. "There is a very significant lack of social responsibility, morals and ethics – they seem to be a group that are bent on only pursing their own course, for their own purposes, without any awareness or even any care for what the consequences of that may be."

Some believe the increasingly erratic attacks, perpetrated by small cells of hackers such as AntiSec, only serve to give governments justification for asserting greater control over the internet.

At present, though, it seems even the introduction of punitive legislation would prove futile, because the most skilled hackers – as volatile as they may be – are able to outsmart and outstep the authorities at almost every turn, and, perhaps most crucially, are committed to stop at nothing.

"I don't want come off as someone who's saying that our particular grievance is going to be the thing that ruins America – that finishes it off – but that's what it's looking like from our standpoint," says Barrett Brown, an activist who works closely with AntiSec.

"This is going to turn into an actual shooting war. It just looks to me like things are accelerating ... if you're mad at us now, just wait a couple of years. No one's burning down villages; no one's dropping bombs – yet."

This article first appeared at: http://www.guardian.co.uk/technology/2012/feb/27/anonymous-splinter-group-antisec-waging-war

How did Anonymous hack the FBI?

In the last twelve months it has attacked government websites in Syria, declared cyber war on a brutal Mexican drug cartel, and exposed an anti-WikiLeaks "dirty tricks campaign" allegedly plotted by a prominent US security firm. But on Friday, Anonymous, a diffuse network of internet hackers, reached a new level when it intercepted and leaked a conference call between FBI agents and Scotland Yard detectives.

The astonishing feat - confirmed as genuine by the FBI - was apparently carried out after the hackers breached email accounts belonging to the authorities. In doing so, they were able to snoop on communications being exchanged between forces involved in a joint international anti-hacking operation across England, Ireland, Holland, France, Denmark, Sweden and America. In a piece of surreal real-life theatre, the tables were embarrassingly and dramatically turned. The investigators became the investigated; the watchers became the watched.

The call in question, which lasts around 16 minutes, is one of the boldest leaks ever produced by the hackers, and it may also be one of the most revelatory. A fascinating glimpse into a highly classified world, it shows the extent to which the Metropolitan police is willing to collaborate with its foreign counterparts as part of cyber-crime investigations, even if doing so means interfering with the British judicial process. At one point during the call, for instance, one of the Scotland Yard detectives tells his FBI colleagues that they secretly delayed an ongoing court case involving two UK-based suspected hackers - Jake Davis and Ryan Cleary - at America's behest.

"Following some discussion with the New York office, we're looking to try and build some time in to allow some operational matters to fulfil on your side of the water," the Scotland Yard detective is quoted as saying. "We've got the prosecution making an application in chambers, i.e. without the defence knowing, to seek a way to try and factor some time in, that won't look suspicious." He goes on: "Hey, we're here to help. We've cocked things up in the past, we know that."

The FBI has previously declined to comment on whether it would pursue extradition of Cleary or Davis, both of whom are facing a series of charges in Britain for their alleged involvement with Anonymous and its affiliated offshoot, LulzSec.

The call suggests, however, that the US could indeed be building its own case against the hackers. Davis in particular, who stands accused of being the audacious LulzSec spokesperson known online as "Topiary", would no doubt be wanted by the Americans. Over a two-month period in 2011, LulzSec perpetrated a series of high-profile attacks on the websites of US-based multi-national corporations and state agencies - including the CIA and the US senate - making it a prime target for cyber-crime investigators within the FBI.

Prior to the leaked call, it was clear that Davis's legal team already suspected US involvement on some level. This was made apparent last month, during a short hearing at Southwark Crown Court, when Gideon Cammerman, Davis's lawyer, expressed concern about outside interference, asking prosecutors that any "letters of request from a foreign jurisdiction" are presented to him when evidence is formally exchanged on 30 March, prior to Davis and Cleary entering pleas on 11 May. (A letter of request is a method used by a foreign court to seek judicial assistance, such as to obtain information or a witness statement from a specified person.)

Responding to concerns raised by Cammerman, a source within the Crown Prosecution Service said that they could not officially comment on the matter of foreign involvement until after 30 March, but stressed both prosecution and defence had a "common interest in the case being tried here [in the UK] effectively," hinting that any possible US extradition request could hinge on the outcome of the British trial.

In the meantime, the key question is whether Anonymous is sitting on more hacked information as explosive as the conference call, which, depending on its content, could have potentially massive repercussions.

To some extent, the authorities on both sides of the Atlantic have now been put on the back foot. Likely rattled and aghast that their own private conversations were hacked by the very hackers they are paid to investigate, they will be apprehensive about what could come next.

Cleary's lawyer, Karen Todner, has starkly warned that "whole cases could be blown apart" as a result of future security breaches; Anonymous, as ever, has promised more revelations are yet to come.

"You think we're done? Fuck no," tweeted one of its most prominent hackers, Sabu, on Friday. "Truth is we're still in the agents (sic) mailbox right now."

This article originally appeared at: http://www.newstatesman.com/the-staggers/2012/02/hackers-fbi-davis-call

Inside LulzSec

It was a tight-knit and enigmatic group finding its feet in the febrile world of hacker collectives, where exposing and embarrassing your targets is just as important as protecting your own identity.

But leaked logs from LulzSec's private chatroom – seen, and published today, by the Guardian – provide for the first time a unique, fly-on-the-wall insight into a team of audacious young hackers whose inner workings have until now remained opaque.

LulzSec is not, despite its braggadocio, a large – or even coherent – organisation. The logs reveal how one hacker known as "Sabu", believed to be a 30-year-old security consultant, effectively controls the group of between six and eight people, keeping the others in line and warning them not to discuss what they have done with others; another, "Kayla", provides a large botnet – networks of infected computers controlled remotely – to bring down targeted websites with distributed denial of service (DDoS) attacks; while a third, "Topiary", manages the public image, including the LulzSec Twitter feed.

They turn out to be obsessed with their coverage in the media, especially in physical newspapers, sharing pictures of coverage they have received in the Wall Street Journal and other papers. They also engineered a misinformation campaign to make people think they are a US-government sponsored team.

They also express their enmity towards a rival called The Jester – an ex-US military hacker who usually attacks jihadist sites, but has become embroiled in a dispute with Anonymous, WikiLeaks and LulzSec over the leaked diplomatic cables and, more recently, LulzSec's attacks on US government websites, including those of the CIA and the US Senate.

In a further sign that the spotlight is beginning to engulf LulzSec, a lone-wolf hacker managed to temporarily cripple the group's website on Friday morning. Originally thought to be the work of The Jester, an activist, known as Oneiroi, later claimed responsibility for the attack but did not provide an explanation.

The group's ambitions went too far for some of its members: when the group hit an FBI-affiliated site on 3 June, two lost their nerve and quit, fearing reprisals from the US government. After revealing that the two, "recursion" and "devrandom" have quit, saying they were "not up for the heat", Sabu tells the remaining members: "You realise we smacked the FBI today. This means everyone in here must remain extremely secure."

Another member, "storm", then asks worriedly: "Sabu, did you wipe the PBS bd [board] logs?", referring to an attack by LulzSec on PBS on 29 May, when they planted a fake story that the dead rapper Tupac Shakur was alive. If traces remained there of the hackers' identities, that could lead the FBI to them.

"Yes," Sabu says. "All PBS logs are clean." Storm replies: "Then I'm game for some more." Sabu says: "We're good. We got a good team here."

Documenting a crucial five-day period in the group's early development from 31 May to 4 June, the logs – whose authenticity has been separately confirmed through comments made online by LulzSec's members – are believed to have been posted online by a former affiliate named "m_nerva". They contain detailed conversations between the group, who have in recent weeks perpetrated a series of audacious attacks on a range of high-profile targets, including Sony, the CIA, the US Senate, and the UK's Serious Organised Crime Agency (SOCA).

LulzSec threatened m_nerva on Tuesday in a tweet saying "Remember this tweet, m_nerva, for I know you'll read it: your cold jail cell will be haunted with our endless laughter. Game over, child." As an explanation, they said: "They leaked logs, we owned them [took over their computer], one of them literally started crying for mercy". The leaked logs are the ones seen by the Guardian.

The conversations confirm that LulzSec has links with – but is distinct from – the notorious hacker group Anonymous. Sabu, a knowledgeable hacker, emerges as a commanding figure who issues orders to the small, tight-knit team with striking authority.

Despite directing the LulzSec operation, Sabu does not appear to engage in the group's public activity, and warns others to be careful who and how they talk outside their private chatroom. "The people on [popular hacker site] 2600 are not your friends," Sabu warns them on 2 June. "95% are there to social engineer [trick] you, to analyse how you talk. I am just reminding you. Don't go off and befriend any of them."

But the difficulty of keeping their exploits and identities secret proves difficult: Kayla is accused of giving some stolen Amazon voucher codes to someone outside the group, which could lead back to one of their hacks. "If he's talking publicly, Kayla will talk to him," Sabu comments, bluntly.

Topiary, who manages the public image of LulzSec – which centres around its popular Twitter feed, with almost 260,000 followers – also acted previously as a spokesman for Anonymous, once going head-to-head in a live video with Shirley Phelps-Roper of the controversial Westboro Baptist Church, during which he hacked into the church's website mid-interview.

His creative use of language and sharp sense of humour earns praise from his fellow hackers in the chat logs, who tell him he should "write a fucking book". On one occasion, after a successful DDoS attack brings down a targeted web server, Topiary responds in characteristic fashion to the hacker responsible, Storm: "You're like our resident sniper sitting in the crow's nest with a goddamn deck-shattering electricity blast," he writes. "Enemy ships being riddled with holes."

But while LulzSec has a jovial exterior, and proclaims that its purpose is to hack "for the lulz" (internet slang for laughs and giggles), Sabu is unremittingly serious. Domineering and at times almost parental, he frequently reminds the other hackers of the dangers of being tracked by the authorities, who the logs reveal are often hot on their heels.

During one exchange, a hacker named Neuron starts an IAmA (Q and A) session for LulzSec on the website Reddit for "funzies" and to engage with the public. This immediately raises the ire of Sabu, who puts an angry and abrupt halt to it.

"You guys started an IAmA on reddit?" Sabu asks in disbelief. "I will go to your homes and kill you. If you really started an IAmA bro, you really don't understand what we are about here. I thought all this stuff was common knowledge ... no more public apperances [sic] without us organizing it."

He adds: "If you are not familiar with these hostile environments, don't partake in it."

The logs also reveal that the group began a campaign of disinformation around LulzSec. Their goal was to convince – and confuse – internet users into believing a conspiracy theory: that LulzSec is in fact a crack team of CIA agents working to expose the insecurities of the web, headed by Adrian Lamo, the hacker who reported the alleged WikiLeaks whistleblower Bradley Manning to the authorities.

"You guys are claiming that LulzSec is a CIA op ... that Anonymous is working to uncover LulzSec ... that Adrian Lamo is at the head of it all ... and people actually BELIEVE this shit?" writes joepie91, another member. "You just tell some bullshit story and people fill in the rest for you."

"I know, it's brilliant," replies Topiary. The attempts did pay off, with some bloggers passing comments such as: "I hypothesize that this is a government 'red team' or 'red cell' operation, aimed at building support for government intervention into internet security from both the public and private sectors."

The group monitors news reports closely, and appears to enjoy – even thrive – on the publicity its actions bring. But the logs show that the members are frustrated by the efforts of a self-professed "patriot-hacker" known as the Jester (or th3j35t3r), whose name is pejoratively referenced throughout.

The Jester is purportedly an ex-US military hacker, and was responsible for high-profile attacks on WikiLeaks prior to the release of US diplomatic cables in November. In recent weeks he has made LulzSec his principal target, describing them as "common bullies". Topiary in turn dismisses The Jester as a "pompous elitism-fuelling blogger" – but the group is always worried that The Jester or his associates are trying to track them down.

The Jester claims LulzSec are motivated by money and points to allegations that the group tried to extort money from Unveillance, a data security company. Similar accusations against LulzSec by two other groups, "Web Ninjas" and "TeaMp0isoN_". Web Ninjas say they want to see LulzSec "behind bars" for committing "insane acts ... in the name of publicity or financial gain or anti-govt agenda".

The logs do not reveal any discussion of extortion between the LulzSec inner circle; nor do they indicate any underlying political motivations for the attacks. But amid the often tense atmosphere depicted in the logs the hackers do occasionally find time to talk politics.

"One of these days we will have tanks on our homes," writes trollpoll, shortly after it emerged the US government was reclassifying hacking as a possible act of war. "Yea, no shit," responds Storm.

"Corporations should realize the internet isn't theirs," adds joepie91. "And I don't mean the physical tubes, but the actual internet ... the community, idea, concept."

"Yes, the utopia is to create a new internet," says trollpoll. "Corporation free."

On Monday 20 June, Sabu's worst fears may have been confirmed when a 19-year-old named Ryan Cleary was arrested in Wickford, Essex and later charged with a cyber attack in connection with a joint Scotland Yard and FBI probe in to a hacking group believed to be LulzSec.

Metropolitan Police Commissioner Sir Paul Stephenson described the arrest as "very significant", though LulzSec itself was quick to claim Cleary was not a member of the group and had only allowed it to host "legitimate chatrooms" on his server.

"Clearly the UK police are so desperate to catch us that they've gone and arrested someone who is, at best, mildly associated with us," the group tweeted.

An individual named "Ryan" is occasionally referenced by the hackers in the logs, though he himself does not feature and appears to have only a loose association with the group.

Scotland Yard confirmed on Thursday that it was continuing to work with "a range of agencies" as part of an "ongoing investigation into network intrusions and distributed denial of service attacks against a number of international business and intelligence agencies by what is believed to be the same hacking group".

In response to the leaked logs, LulzSec posted a statement on the website pastebin, claiming users named joepie91, Neuron, Storm and trollpoll were "not involved with LulzSec" and rather "just hang out with us".

They added: "Those logs are primarily from a channel called #pure-elite, which is /not/ the LulzSec core chatting channel. #pure-elite is where we gather potential backup/subcrew research and development battle fleet members – ie, we were using that channel only to recruit talent for side-operations."

The group has vowed to continue its actions undeterred. But they now face a determined pincer movement from the FBI, UK police, and other hackers – including The Jester, who has been relentless in his pursuit of them for more than a fortnight. If its members' real identities are revealed, LulzSec may vanish as quickly as it rose to prominence.

This article originally appeared at: http://www.guardian.co.uk/technology/2011/jun/24/inside-lulzsec-chatroom-logs-hackers

Read the full chat logs here: http://www.guardian.co.uk/technology/2011/jun/24/lulzsec-irc-leak-the-full-record

Follow up coverage: New York Times, ZDNet, The Age, Yahoo, Maximum PC, Salon, Thinq, the Register, Washington Post, BGR.