Jake Davis, who has pleaded guilty to participating in cyber attacks on Sony Pictures, HBGary Federal and FBI affiliate Infragard, leaving court last August (Image credit: Getty Images via @daylife)
Two British men accused of taking part in high-profile cyber attacks by hacking group LulzSec in 2011, have pleaded guilty to charges that include conspiring to attack Sony Pictures, FBI affiliate Atlanta Infragard and IT security company HBGary Federal.
Jake Davis, 19 and Ryan Cleary, 24, also admitted to offences against the websites of News International, Nintendo, Britain’s National Health Service and the Arizona Police Department, using tactics such as Distributed Denial of Service (DDoS) attacks with the help of a botnet. Cleary pleaded guilty to a total of six out of eight charges, Davis to two out of four charges.
Davis and Cleary’s guilty pleas specifically related to two counts of conspiracy to do an “unauthorized act or acts with intent to impair or with recklessness as to impairing, the operation of a computer or computers.”The pair and two other men who appeared in Southwark Crown Court in London today were accused of being part of LulzSec, a splinter group from the subversive online community Anonymous. The latter cyber movement of so-called hacktivists and trolls are best known for attacking the Church of Scientology in 2008 and MasterCard and PayPal in late 2010 to avenge WikiLeaks.
Cleary, who wore a dark t-shirt and slacks in court this morning, also admitted to four charges separate to those levelled at Davis. These extra charges for Cleary included hacking into U.S. Air Force computers.
Cleary and Davis, who came to court in a dark suit and tie and is known by the online handle Topiary, both pleaded not guilty to two counts: encouraging or assisting an offence, contrary to section 45 of the Serious Crime Act 2007, and encouraging or assisting offences contrary to section 46 of the Serious Crime Act 2007. The Crown Prosecution Service would “need further time to consider whether public interest requires a trial” for the two counts denied by Davis and Cleary, prosecutor Hugh Davies said in court today.
The eight-count indictment was also shared with two other men: Ryan Ackroyd, a 26-year-old man from northern England who is accused of hacking offences committed under the nickname Kayla, and a 17-year-old student from London who could not be named because of his legal status as a minor. Both Ackroyd, who sported a crew cut, white t-shirt and jeans, and the 17-year-old pleaded not guilty to the four charges levelled against them, which mirrored the charges against Jake Davis.
Ackroyd’s lawyer, Kevin Barry, said that in the last week his team had been sent a disk from the prosecution containing reams of chat logs being used as evidence. “We received 150,000 pages of material last week,” Barry told the court, adding that it would take 3,000 man hours to read through it all. When Judge Alistair McCreath asked if Ackroyd’s defence team would be “trial-ready” by the end of August, Barry replied, “No.” Ackroyd and the 17-year-old are now scheduled to stand trial on April 8, 2013, and a trial could last roughly eight weeks.
All four men were arrested in their homes between June and September 2011. Three of the defendants were released on bail after today’s hearing, while Cleary was remanded in custody after breaching his bail conditions earlier this year. Cleary is reportedly unlikely to face extradition to the United States. Both Ackroyd and Davis have been fitted with electronic tags.
The hacking group LulzSec came to prominence in the summer of 2011 after it organized a series of attacks against high-profile targets such as Sony Pictures, PBS, Atlanta Infragard (an affiliate of the FBI) and the CIA, over the course of 50 days. Nearly all of its founding members have been arrested and / or charged by police in the United States and Britain.
The hacking group was established by a team of young men, mostly hailing from the British Isles and United States. The six core members had aligned themselves with Anonymous in the months prior, taking part in or helping to organize cyber attacks on PayPal.com, the websites of repressive Middle Eastern regimes, the Westboro Baptist Church and perhaps most devastatingly, on the IT security company HBGary Federal in February 2011.
Having established solid online friendships by early May 2011, two of the men–one of whom was a defendant in court today and the other a New York-based hacker who went by the nickname Sabu–discussed the creation of a splinter group. They initially decided that their group would not be constrained by some of the loose etiquette that had been established in Anonymous, including not attacking the media or making a particular socio-political point with each attack. Instead they would attack high profile targets with a more flexible range of reasons, including lulz (online slang for fun at other people’s expense) and retribution.
Over the course of 50 days their attacks became increasingly serious. Having started with an attack on Fox.com that saw the release of personal details for people interested in forthcoming auditions for the TV talent show The X Factor, the group went on to hack into the PBS Newshour website and publish a fake article about Tupac Shakur, before launching a DDoS attack on the website of the CIA and releasing personal details from the Arizona Police Department. By the end of its 50 days, LulzSec had amassed more than a quarter of a million Twitter followers, a stream of mainstream news headlines, well over a dozen hackers who acted as second-tier supporters and a chat network frequented by hundreds of fans and observers.
Along the way, co-founder and de facto group leader Sabu was arrested on June 6, 2012 by the FBI and, on threat of imprisonment for separate cyber crimes, turned informant. Real name Hector Monsegur, the 29-year-old continued conspiring with LulzSec while feeding information about the team members to the police until the group disbanded on June 26, 2011 and released their “50 Days of Lulz” statement.
