Hack attacks no laughing matter
WINDING through corridors lined with poison-tipped umbrellas, pistols fashioned from lipstick tubes, and bulky button-hole cameras, visitors to Washington’s International Spy Museum will soon be confronted by a modern tool of the trade: a small black laptop.
According to the computer’s owner, it was employed over a three-year period to briefly knock WikiLeaks offline, disable almost 200 jihadist websites, and develop a handful of sophisticated hacking tools.
The laptop, says International Spy Museum executive director Peter Earnest, will provide historical context to the “world of espionage and the intelligence community, in this instance through the scope of cyberterrorism”. But the laptop’s owner claims no affiliation with the intelligence community; nor can he, by any traditional definition, be classified as a spy. He’s a freelancer, a “patriotic hacktivist” who goes by the nom de guerre the Jester — or, in hacker argot, ‘th3j35t3r’.”
Within certain cybercircles, he has achieved mythical status. According to security analyst TJ O’Connor, the Jester has “proved that a single individual is very capable of waging cyberwar at a level we previously attributed only to intelligence agencies or crime syndicates.”
There exist countless blog posts and Twitter exchanges speculating on the Jester’s identity, but we still know almost nothing about him. He implies that he’s American, says he has a background in computer programming, and explains he was motivated to undertake offensive hacking operations against enemies of the United States after serving in the military. (He claims to have been affiliated with “a rather famous unit” in Afghanistan that was “involved with supporting special forces”.) These are, of course, uncheckable assertions.
The Jester first surfaced on Jan 1, 2010, with a tweet announcing a “sporadic cyber-attack” on a Taliban website: “OWNED. By me, Jester.” He issues short epistles through Twitter, usually documenting websites he has disabled, and offers longer discussions of his work on his blog. But he jealously guards his anonymity, granting relatively few interviews to journalists.
I first reached out to him for an interview last July, establishing contact through Twitter — the only way he communicates with unknowns. After telling me he would reconnect after an online vetting process, he hesitantly agreed to answer questions in an encrypted chat room. And then disappeared. When I reestablished contact a few months later, he declined to talk.
But last month, with fingers crossed, I made another approach and received a surprisingly quick response: “Can I ping you with secure [connection] in a bit?”
Hacking, the Jester tells me during our exchange, was merely “a continuation of [military] service”. Indeed, he believes that laptops will someday replace M-16s as the primary tool of warfare. Last year, in a rare live chat with computer science students at the University of Southern Maine, the Jester speculated that soon “wars won’t be fought with boots on the ground” but in dark basements packed with glowing computer monitors.
He claims “no official relationship with law enforcement agencies”, yet as members of the hacker collective Anonymous have been hauled into courtrooms around the globe, it’s noteworthy that the Jester has been left untouched.
Given that his targets tend to be hostile to American foreign policy, it seems at least plausible that he is operating with the tacit permission of the US intelligence community. Both the Jester and US intelligence officials are tight-lipped on these matters — and there is no suggestion of an active working relationship — but in the murky world of cyberwarfare, it certainly seems that the feds are unconcerned by his attacks on their common enemies.
The Jester has targeted Julian Assange’s controversial WikiLeaks. So does he, or does he not, provide information to the authorities? “I make my work available — sometimes [publicly], sometimes privately — but I have no official relationship with law enforcement agencies,” he tells me. “I just put things where certain people might ‘find’ them. It’s an unsaid, unspoken nonrelationship.”
The Jester’s techniques have varied over the years. In 2010 after WikiLeaks posted a tranche of classified US State Department cables online, he launched a denial of service (DoS) attack that took the site offline.
The goal, he tells me, was to knock WikiLeaks off servers in Sweden and “back onto US servers, where I was hoping the legal peeps would shut that shit off now it was back in jurisdiction. But that didn’t happen and we are where we are today”.
In 2011 the Jester pummelled various Web properties of the Westboro Baptist Church (of “God Hates Fags” infamy) with DoS attacks in response to the group’s picketing the funerals of American soldiers killed in action. This month he took a slightly different tack with Westboro: after the group celebrated the destructive tornado that hit Oklahoma as divine retribution for America’s sins, the Jester took over their website, replaced it with an image of Jesus giving the middle finger, and then rerouted traffic to a Red Cross donation page.
After the gruesome murder of a soldier by two jihadists in London, the Jester knocked offline the website of the London-based radical Islamist preacher Anjem Choudary.
During the war in Libya, the Jester hacked into The Tripoli Post, a Gaddafi-backed news site, and The Malta Independent, planting fake news stories claiming that regime loyalists were defecting en masse.
He has also sought to expose the real identities of those he considers enemies of the United States — for instance, revealing the names of jihadists who recruit and proselytise online, as well as the names of people affiliated with Anonymous.
He points out that, soon after he published the identities of Anonymous members, “there were some more Anonymous arrests. Just as a side note”.
All of this online intrigue has created a lucrative role for private companies that help victims of hacking play defence.
When we spoke about Stuxnet, the sophisticated malware developed by the United States and Israel that attacked Iran’s nuclear facilities, the Jester argued that the attack demonstrated that cyberwarfare is more than merely disabling websites and taunting your enemies online.
“It showed that one could, with absolute precision, and no boots on the ground, target assets in the physical world too,” he says. “I find the ability to ‘touch’ and adversely affect real-world targets from ... cyberspace very comforting.”
Given his list of nasty targets — jihadists, Gaddafi, the fanatics of Westboro — it’s hard not to find the Jester’s work comforting. But the wider phenomenon that he typifies is disquieting.
Around the world, independent hackers are increasingly engaged in work that looks a lot like espionage and cyberwarfare. Richard Bejtlich, chief security officer at Mandiant, a Virginia–based cybersecurity firm, sees these hackers as a return to history.
“If you look at espionage over thousands of years, for the most part it has been private individuals who were spies. It was only in the 20th century that governments took a real step forward in the creation of national industries around espionage.” Now, he says, “the private sector is getting back into the game as a result of the technology available to everyone”.
The existence of both the Jester and his nemeses in Anonymous reflects the sea change that has occurred in hacking and cybersecurity over the past two decades. As Mikko Hypponen, chief research officer of the Helsinki-based firm F-Secure, recently put it, in the 1990s hackers hacked for fun, but “those happy days are behind us ... The happy hackers have disappeared”. Today “all hackers have motives for their actions”.
In 1999, during the Kosovo War, the US president Bill Clinton greenlit a CIA campaign of cyberwarfare against Serbian targets, including an attempt to drain Serbian bank accounts associated with the government.
It remains unclear whether this was ever carried out — relevant documents are still classified — but it was the first time an American hacking operation had been approved as part of a hot war.
But it isn’t just hackers whose political importance is on the rise; all of this online intrigue has also created a lucrative role for private companies that, for rather large fees, help victims of hacking play defense against their tormentors. In their own way, these people, too, have ended up as key players on the geopolitical stage.
In October 2012, the New York Times China correspondent, David Barboza, published a blockbuster exposé — which would later win a Pulitzer — detailing the personal wealth accrued by former prime minister Wen Jiabao.
It was classic shoe-leather journalism: using publicly available “corporate and regulatory records”, Barboza painted a picture of an authoritarian kleptocracy, in which party grandees feathered their nests with massive bribes and kickbacks.
China’s response to the story was swift: Beijing, which had previously been accused of infiltrating computers at Bloomberg and the Associated Press, hacked into the Times. The method was a technique called spear-phishing, in which hackers send emails with infected attachments or links.
In the end, the Chinese intruders gained access to email accounts on about 50 Times computers and obtained the passwords of every Times employee. (According to editor Jill Abramson, however, there was “no evidence that sensitive emails or files from the reporting of our articles about the Wen family were accessed, downloaded or copied”.)
The Times hired the cybersecurity firm Mandiant to help it defend itself. Mandiant was founded in 2004 by Kevin Mandia, a former US Air Force cyberforensics investigator. It now has 330 employees — many of whom are former government computer security analysts and retired members of the intelligence community.
Mandiant allowed the Time’s hackers — who it identified as being affiliated with the Chinese government — to skulk around the newspaper’s networks, learning from their movements before ejecting them. “The counterintelligence model is the best one for this,” says Mandiant’s Richard Bejtlich. “In most cases, you are operating against the equivalent of a foreign intelligence agency.”
When Mandiant released a minutely detailed report on Chinese hacking of US corporations in February, the Associated Press said the document was noteworthy because “the extraordinary details ... came from a private security company without the official backing of the US military or intelligence agencies that are responsible for protecting the nation from a cyberattack”.
Of course, that kind of aggressive engagement with adversaries is something the Jester is already doing. He does appear to have struggled with the morality of his actions. Around the time he became the Jester, he told the website Infosec Island, “I do wrestle with whether what I am doing is right.” In his 2012 chat with University of Southern Maine students, he acknowledged that he violates “the same laws the bad guys do. I am under no illusions that I am also a criminal”.
But when I ask him whether he still has mixed feelings about his work, he says that his doubts have receded. “I used to have a harder time with my moral compass than I do now. The law is murky and unclear at the moment on cyber related issues [and] I am capitalising on that fact while I can.”
It’s an unsurprising sentiment from someone who sees himself as a soldier in an ongoing war. As he puts it, “Cyberspace is fast becoming a serious battle space, everyone is now taking notice, and I am proud to be on the right side of things (kinda).”
CONNECT WITH US TODAY
Be the first to know the latest news and updates
