Turncoat hackers: a brief history of snitching in high-tech dragnets

Supporters of Anonymous have been shocked by revelations that Sabu, one of the hacking collective’s kingpins and spiritual leaders, spent the past eight months ensnaring other members in a coordinated FBI sting.

Perhaps they shouldn’t have been. As anyone who has followed other high-tech dragnets over the past two decades knows, turncoats are an inevitable ingredient in most probes.

In 1995, for instance, when a fugitive named Kevin Mitnick was apprehended for using cloned cellular devices to hack into dozens of computer networks, federal authorities located him with the help of a cohort named Justin Peterson. A few years earlier, according to hacking folklore, Peterson helped feds find Kevin Poulsen—now a senior editor at Wired who was then a fugitive wanted for a string of wire-fraud and phone-phreaking offenses. Peterson, who was being pursued for hacking crimes of his own, also helped investigators locate Ronald Austin, who was wanted for breaking into Arpanet servers.

“I can’t think of any (hacking) case where there wasn’t an informant involved because when these guys get busted, they roll,” Kevin Mitnick, who is now a professional security consultant, told Ars. “They sing like a bird to get themselves out of trouble. It’s common.”

More recently, there was the case of Max Butler, a hacker arrested in 2007 for the theft of 2 million credit card numbers following invaluable information cohort Christopher Aragon provided to the FBI.

A few years later, another prolific carder named Albert Gonzalez was undone in part by help given to authorities from an associate who had helped him hack into dozens of retail and payment processor networks and steal data for tens of millions of cards. Besides the sophistication of the operation and the estimated $400 million worth of damage it caused to TJX, Heartland Payment Systems, and other victims, the Gonzalez case was significant for just how deep the duplicity went. Even as he masterminded the crimes, Gonzalez was a paid informant for the Secret Service who helped put away more than a dozen members of Shadowcrew, an online bazaar where crooks went to buy and sell payment card numbers and other data used in fraud.

Adrian Lamo, another hacker who served time in federal prison, also became an informant of sorts when he supplied government investigators with chat transcripts of Bradley Manning detailing his leaking of hundreds of thousands of classified US documents to WikiLeaks.

Enter Sabu

In a series of Fox News exclusives, FBI officials said they arrested Sabu in June and quickly convinced him to become an informant. Court documents filed on Tuesday against five of his alleged associates show just how eager the 28-year-old father of two—whose real name is Hector Xavier Monsegur—was to help build a case against his one-time comrades. In late December, an alleged member of the splinter group Lulzsec entered a password-protected chat channel to report on the progress he was making in reformatting gigabytes of information stolen after breaching the security of Austin, Texas-based Strategic Forecasting Inc. so it could be publicly released on the Internet.

On December 26, when the hacker identified as Jeremy Hammond of Chicago said some 60,000 confidential e-mails were close to being released, Monsegur replied with forced enthusiasm.

“Weee,” he replied, as federal agents looked on.

Transcripts of other chats show Monsegur painstakingly drawing incriminating information out of Hammond, who used multiple hacking handles to make it harder for investigators to link them to a single individual. In one session, he referred to Hammond by the aliases “sup_g” and “anarchaos” in what’s now a not-so-oblique attempt to help feds prove the handles were masks used to hide the same individual. At other points, Monsegur, who was under constant supervision while conducting the sting, teased out details about a 2004 arrest of Hammond at the Republican National Convention in New York, a conviction the following year for a hack that stole credit card numbers from a politically conservative website, and a 2011 arrest for possession of marijuana.

Transcripts of chats Monsegur conducted with a hacker alternately called “palladium,” “polonium,” and “anonsacco” show him working tirelessly to establish that the handles belonged to one Donncha O’Cearrbhail of Ireland. Prosecutors ultimately used the sessions to support allegations the 19-year-old infiltrated and recorded a conference call between members of the FBI and UK police on the topic of Anonymous.

The dark side of confidential informants

The transcripts of Sabu’s dealings with the people he set up also shows the darker side of law enforcement’s reliance on alleged criminals to win indictments and convictions. Discussions about the attack on Stratfor and the resulting exposure of e-mails, credit card details and passwords for more than 800,000 of its clients and employees means that agents monitoring the sessions had advanced notice that crimes would take place and chose not to stop them. From December 6 through early February, about $700,000 in unauthorized charges were made to the payment cards compromised in the hack. The price of protecting the confidentiality of the sting meant they had little choice but to stand by as the charges continued to accrue.

Similarly, agents monitoring Sabu’s chats with Anonsacco had advanced notice that the Irish hacker had compromised the e-mail account of a senior UK law enforcement official and planned to use the access to intercept what was supposed to be a confidential conference call between FBI agents and their counterparts in Europe to discuss their investigation into Anonymous. Eleven days later, agents monitoring the chat sat by helplessly as Anonsacco discussed ways to use a recording of the call for maximum effect.

“I think we need to hype it up,” the court documents quote Anonsacco as saying during a January 28 chat. “Let the feds think we have been recording their calls. They will be paranoid that none of their communications methods are safe or secure from Anon.” A week later, agents found the recording had been posted to YouTube.