FBI Added Lulzsec Hactivist Jeremy Hammond To The Terrorist Watchlist A Year Before He Was Arrested

from the terrorism-is-just-things-we-don't-fully-comprehend dept

Jeremy Hammond -- a member of various Anonymous offshoots -- had the misfortune of being prosecuted in the United States. While his UK accomplices in the Stratfor hack were sentenced to 1-3 years, Hammond received a 10-year sentence (along with three years of supervised release) for his participation. The length of Hammond's sentence was mainly due to the CFAA (Computer Fraud and Abuse Act) being a horribly-written law (and there's a possibility it will get much worse in the future), and the FBI's willingness to toss the hacktivist under the bus for the sins of Anonymous, while glossing over the fact that it was an FBI informant (Hector Monsegur, aka Sabu) who handed out hacking targets to Hammond.

Hammond's lengthy prison sentence may also have to do with other bad laws written by legislators who didn't have a full understanding of the issues they were attempting to address. A leaked document obtained by the Daily Dot [pdf link] shows the FBI put Hammond on the government's terrorist watchlist more than a year (Date/Time Entered: 1/19/2011) before he was arrested for the Stratfor hack.

A leaked document originating from the New York State Division of Criminal Justice Services (DCJS) reveals that Hammond was considered a "possible terrorist organization member," and indicates that he was placed on the multi-agency Terrorist Screening Database (TSDB), alongside individuals suspected of ties to Al Qaeda, Somalia-based extremists al-Shabaab, and Colombia's leftist FARC guerilla movement.

Here's the pertinent information is all of its teletyped glory:



The document also includes Hammond's rap sheet, which up to that point, only includes fraud and unauthorized computer access related to the theft of credit card information from a conservative website. What it doesn't include is anything that might justify his addition to the terrorist watchlist -- unless the FBI considers protests to be a terrorist activity.

Of course, the government agencies that have the power to place US citizens on terrorist watchlists don't seem interested in providing justification for their decisions. Just having a vague sense of unease seems to be all the "evidence" any agent/official needs to declare a person a threat to this country. Nearly 40% of those currently on the government's terrorist watchlist have "no known affiliation to recognized terrorist groups."

The government has long shown it doesn't understand hacking and is no fan of activism -- generally viewing both activities as some sort of threat. So, on the watchlist Hammond went, something that presumably played a part in the prosecution's push for a decade-long sentence for the hacktivist. His actions and motives were often far from pure, but his imprisonment appears to be a result of the FBI throwing an unwitting operative onto the judicial scrapheap before moving onto its next sting operation.

Filed Under: anonymous, doj, fbi, jeremy hammond, lulzsec, terrorist watch list, tsdb

Missing From The Story: LulzSec Informant Sabu Released Early Because He Got LulzSec To Hack FOR The FBI

from the time-served-indeed dept

Earlier this week, there were plenty of reports about how Hector Xavier Monsegur, also know as "Sabu," the leader/turned informant of the Anonymous spinoff hacking project LulzSec, was released from jail early for his "extraordinary cooperation" with the FBI. Technically, this was at his sentencing, and he was given "time served" (amounting to about 7 months in jail). Most folks have noted that the "extraordinary cooperation" involved handing over the names and information on other LulzSec members, including Jeremy Hammond, who was recently sentenced (by the same judge) to 10 years in prison.

However, that seems to leave out the other, increasingly troubling, aspect of the Sabu story -- which was that he didn't just "cooperate" with the FBI in fingering various LulzSec members, he actually gave them orders (which first came from the FBI) on who to hack, including key government computers in a variety of foreign countries. It seems likely that this was the "extraordinary cooperation" that helped Sabu secure a much shorter sentence.

Two of the other individuals that Sabu helped authorities arrest and prosecute have commented on Sabu's deal. Jake Davis highlights how Sabu was a huge "get" for the FBI, since they didn't seem to understand much about internet hacking without Sabu to lead them through everything -- and he wonders if this will lead others to rush to become informants as well. In fact, Davis points out that the whole reason for the light sentence is probably to encourage more informants -- though, it could equally be argued that it's not just to encourage more informants, but more people who can help the FBI secretly hack into targets.

Meanwhile, another LulzSec member, Ryan Ackroyd, who was recently released after serving 9 months of a 30-month sentence, pointed out that while the sentence is unsurprising, it's somewhat ridiculous given Sabu was in many ways "the worst" of the bunch:

"Sabu was the worst one out of us all, he should have been given the largest sentence. He was the one stealing from people's bank accounts, credit cards and PayPal so that he could pay his bills and buy new things. Sabu talked people into hacking things for him and when he got caught he decided to snitch on these people, for something he asked them to do, in order to save himself."

Either way, no matter what you think of the situation and Sabu, it seems worth remembering that he didn't just help find other LulzSec members, he got them to hack specific FBI targets.

Filed Under: extraordinary cooperation, fbi, hacking, hector xavier monsegur, jake davis, jeremy hammond, leniency, lulzsec, ryan ackroyd, sabu, time served

Barrett Brown Signs Plea Deal

from the of-course dept

Late yesterday, a superseding indictment was filed in Barrett Brown's case, knocking the charges down to just two, with the main one being that he somehow offered assistance to Jeremy Hammond, who had taken an earlier plea deal for the Stratfor hack. As many people suggested, this new indictment was almost certainly because of a plea deal, which has now been confirmed, as the court also granted a motion to seal the plea deal.

The case against Brown has been something of a travesty from the beginning, as Brown was clearly never involved in the hack, but was involved in reporting on the hack and then involved in some rather misguided public ranting in which he threatened the feds if they came after him. As it became clear that the key part of the government's case hinged on the idea that copying and pasting a link found elsewhere was tantamount to hackking, the DOJ was forced to back down and dismiss most of the charges. Brown has been in jail for many months already, and it's likely that the plea deal will keep him in for a short while longer. Accepting a plea deal is pretty standard in these situations. If you're not familiar with how these things go down, when the DOJ is embarrassed -- as they clearly were in this case -- they almost always pressure defendants into agreeing to some minor plea deal, to save face for themselves. It takes the "risk" away from the defendant, and generally speeds up the process. It's the same sort of thing that happened to Thomas Drake. As we've said before, if you think plea deals like this are an actual admission of guilt, we suggest you watch the documentary Better This World, which shows you how the DOJ deals with cases like this, where they will do basically anything to get people to plead guilty.

Filed Under: barrett brown, doj, jeremy hammond, journalism, linking, plea deal, stratfor hack

List Of Targets FBI Supposedly Asked Jeremy Hammond To Crack Revealed

from the that-didn't-take-long dept

On Friday, we wrote about Jeremy Hammond's 10-year prison sentence, mentioning that the judge had required part of Hammond's statement be redacted from any reports as his discussion of the list of targets he was asked to hack by FBI informant Sabu (Hector Xavier Monsegur) was considered classified. Of course, it will come as little surprise that the unredacted/uncensored text of his original statement is alleged to have leaked soon after the sentencing. Someone posted it to Pastebin. While it's entirely possible that this is fake, there are at least some indications that it's accurate.

Sabu also supplied lists of targets that were vulnerable to "zero day exploits" used to break into systems, including a powerful remote root vulnerability effecting the popular Plesk software. At his request, these websites were broken into, their emails and databases were uploaded to Sabu's FBI server, and the password information and the location of root backdoors were supplied. These intrusions took place in January/February of 2012 and affected over 2000 domains, including numerous foreign government websites in Brazil, Turkey, Syria, Puerto Rico, Colombia, Nigeria, Iran, Slovenia, Greece, Pakistan, and others. A few of the compromised websites that I recollect include the official website of the Governor of Puerto Rico, the Internal Affairs Division of the Military Police of Brazil, the Official Website of the Crown Prince of Kuwait, the Tax Department of Turkey, the Iranian Academic Center for Education and Cultural Research, the Polish Embassy in the UK, and the Ministry of Electricity of Iraq.

Sabu also infiltrated a group of hackers that had access to hundreds of Syrian systems including government institutions, banks, and ISPs. He logged several relevant IRC channels persistently asking for live access to mail systems and bank transfer details. The FBI took advantage of hackers who wanted to help support the Syrian people against the Assad regime, who instead unwittingly provided the U.S. government access to Syrian systems, undoubtedly supplying useful intelligence to the military and their buildup for war.

All of this happened under the control and supervision of the FBI and can be easily confirmed by chat logs the government provided to us pursuant to the government's discovery obligations in the case against me. However, the full extent of the FBI's abuses remains hidden. Because I pled guilty, I do not have access to many documents that might have been provided to me in advance of trial, such as Sabu's communications with the FBI. In addition, the majority of the documents provided to me are under a "protective order" which insulates this material from public scrutiny. As government transparency is an issue at the heart of my case, I ask that this evidence be made public. I believe the documents will show that the government's actions go way beyond catching hackers and stopping computer crimes.

Again, while Hammond is responsible for actually carrying out the activity of breaking into these sites, it still seems incredibly questionable that the targets may have been suggested by the FBI, which then basically got to take advantage of Hammond's activities, and then when that wasn't useful any more, to throw him in jail for a decade.

Filed Under: cfaa, fbi, hacking, hector monsegur, jeremy hammond, sabu, targets

Hacktivist Jeremy Hammond Gets 10 Years In Prison; Explains How FBI Gave Him The Targets To Hack

from the of-course-they-did dept

We wrote, earlier this year, about LulzSec/Antisec/Anonymous hacktivist Jeremy Hammond pleading guilty to hacking Stratfor. While the other Lulzsec hackers who were arrested in the UK got sentences of one to three years, the fact that here in the US we have the CFAA, and the fact that the DOJ saw another hacktivist to railroad, it was expected that Hammond would get a much longer sentence. Indeed, he did: he was sentenced today to ten years in prison plus another three years of supervised release.

No one denies that he broke into Stratfor's computers (as well as other sites and even governments). However, many people quite reasonably argue that he was doing so for the purposes of activism, not for personal wealth or benefits, and that fact should have been taken into account in his sentencing. The DOJ, of course, want to use Hammond as yet another example case of how they can throw the book at hacktivists. The Sparrow Project has a good account of what happened in the courtroom:

Jeremy’s lead counsel, Sarah Kunstler, who is 9 months pregnant and due to give birth today, delivered a passionate testimonial as to the person that Jeremy is, and the need for people like Jeremy during our changing socio-political landscape. She was followed by co-counsel, Susan Keller, who wept as she recalled her experiences reading the hundreds of letters from supporters to the court detailing the Jeremy Hammond’s selflessness and enthusiastic volunteerism. She pointed out that it was this same selflessness that motivated Jeremy’s actions in this case. She closed her testimony by underscoring that, “The centerpiece of our argument is a young man with high hopes and unbelievably laudable expectations in this world.”

They also include Hammond's statement, in which he clearly states why he did what he did, and repeatedly points out that most of the sites he hacked (including Stratfor and foreign governments) were done under the direction of Sabu (real name: Hector Xavier Monsegur) who had already turned into an FBI informant. In other words, he's suggesting that the FBI was more or less telling him who to hack, and then they get to turn around and throw the book at him.

The acts of civil disobedience and direct action that I am being sentenced for today are in line with the principles of community and equality that have guided my life. I hacked into dozens of high profile corporations and government institutions, understanding very clearly that what I was doing was against the law, and that my actions could land me back in federal prison. But I felt that I had an obligation to use my skills to expose and confront injustice--and to bring the truth to light.

Could I have achieved the same goals through legal means? I have tried everything from voting petitions to peaceful protest and have found that those in power do not want the truth to be exposed. When we speak truth to power we are ignored at best and brutally suppressed at worst. We are confronting a power structure that does not respect its own system of checks and balances, never mind the rights of it’s own citizens or the international community.

The full statement is long, but well worth reading. The court forced everyone to redact part of the speech -- where he names who else he hacked at the direction of Sabu, including foreign governments. When you think about this, it seems particularly obnoxious. Basically, the FBI had Sabu tell Hammond to hack into the computers of foreign governments and now Hammond gets the book thrown at him because of that. Does anyone think that the feds didn't make use of that access to foreign government computers? It's a pretty neat trick: trick a hacktivist to break into the computers of foreign governments for you and then throw him in jail for ten years.

In an interview Hammond gave to The Guardian prior to the sentencing, Hammond notes that his days of hacking "are done" but remains pretty defiant and supportive of hacktivism in general and against oppressive government action. He notes that one of the reasons he was such a target was he had access to an exploit that it appears the NSA didn't yet have, which allowed him to get into those foreign government servers:

“I felt betrayed, obviously. Though I knew these things happen. What surprised me was that Sabu was involved in so much strategic targeting, in actually identifying targets. He gave me the information on targets.”

Part of Sabu’s interest in him, he now believes, was that Hammond had access to advanced tools including one known as PLESK that allowed him to break into web systems used by large numbers of foreign governments. “The FBI and NSA are clearly able to do their own hacking of other countries. But when a new vulnerability emerges in internet security, sometimes hackers have access to tools that are ahead of them that can be very valuable,” he said.

In that same interview, he notes he never would have hacked Stratfor if it weren't for Sabu, noting he'd never even heard of the organization before that.

Clearly, Hammond broke the law. But it seems very, very wrong that the federal government clearly used him to break into places they wanted to get into (all of which now remains classified), and then threw the book at him and will lock him up for a decade.

Filed Under: cfaa, fbi, hacking, hacktivism, hector xavier monsegur, jeremy hammond, sabu, sentencing
Companies: stratfor

LulzSec Hacker Jeremy Hammond Pleads Guilty To CFAA Charge; Faces 10 Years

from the doj-pile-on dept

In yet another Computer Fraud and Abuse Act case, in which the DOJ piled on charge after charge after charge until the person they were pressuring accepted a plea bargain, Jeremy Hammond has officially accepted a plea deal for helping LulzSec/Anonymous hack Stratfor. He admits that he did it, and given that, it's perfectly reasonable to suggest that some punishment is warranted, but it still seems troubling the amount of pressure that the DOJ used to get him to take a plea bargain. We've talked about this for years: very few cases go to trial, because the DOJ pulls out everything possible to pressure you to take a plea:

There were numerous problems with the government's case, including the credibility of FBI informant Hector Monsegur. However, because prosecutors stacked the charges with inflated damages figures, I was looking at a sentencing guideline range of over 30 years if I lost at trial. I have wonderful lawyers and an amazing community of people on the outside who support me. None of that changes the fact that I was likely to lose at trial. But, even if I was found not guilty at trial, the government claimed that there were eight other outstanding indictments against me from jurisdictions scattered throughout the country. If I had won this trial I would likely have been shipped across the country to face new but similar charges in a different district. The process might have repeated indefinitely. Ultimately I decided that the most practical route was to accept this plea with a maximum of a ten year sentence and immunity from prosecution in every federal court.

It's worth noting that others involved in the same case have been sentenced to much lower sentences in the UK, so it will be interesting to see what the final sentencing yields.

Hammond insists that he still stands by what he did:

Now that I have pleaded guilty it is a relief to be able to say that I did work with Anonymous to hack Stratfor, among other websites. Those others included military and police equipment suppliers, private intelligence and information security firms, and law enforcement agencies. I did this because I believe people have a right to know what governments and corporations are doing behind closed doors. I did what I believe is right.

As I've said before, while I understand why people think this is reasonable strategy, such hacks almost always lead to more backlash than forward momentum. Yes, governments and companies are doing questionable things behind closed doors, but hacking into them to "prove" that takes away much of the value of finding out that information, and only increases the power of the government to create and use laws like the CFAA broadly to stifle perfectly legitimate uses of computers.

Filed Under: anonymous, cfaa, cracking, doj, hacking, jeremy hammond, lulzsec
Companies: stratfor