Indictment sheets detail how cases against five men alleged to be Anonymous members were made with help of group leader
The FBI turned a computer hacker to build its case against a group of people it alleges are responsible for a string of audacious attacks that captured the personal details of more than one million people, US court documents have revealed.
They reveal an astonishing degree of co-operation between the FBI and its source, who gave the bureau details of other hackers and advance notice of attacks – which the FBI then apparently allowed to happen. The FBI even provided its own servers for members of hacking collectives to use.
The indictment sheets detail charges against five men alleged to be principal members of the hacking groups Anonymous and Lulzsec. The source has been indicated to be Hector Xavier Monsegur, known as 'Sabu', one of the group's most visible members and often referred to as the group's leader.
Monsegur was arrested by US authorities on 7 June 2011, according to his charge document, and from this point is not described as a member of Anonymous or Lulzsec. By August 2011 he had pleaded guilty to twelve charges relating to computer hacking.
His online avatar, Sabu, has subsequently remained active on Twitter and elsewhere, posting a final update less than 24 hours before the latest spate of arrests. Monsegur's arrest and guilty pleas have been kept secret until today, as he is said to have provided information against other arrested individuals.
The crimes to which Monsegur has lodged a guilty plea carry a maximum jail sentence in excess of 124 years. Such sentences are often mitigated if offenders co-operate with authorities after their arrest.
Another charge sheet, against Donncha O'Cearrbhaill, 19, from Ireland, sets out how Sabu's cooperation was central in building the FBI allegations. O'Cearrbhaill, is accused of two offences relating to intercepting and recording a conference call between the FBI and the UK's Serious and Organised Crime Agency, which was subsequently posted online in February.
The indictment, written by the investigating FBI officer, details how Sabu, referred to as 'CW', communicated with other hackers "acting under the direction of the FBI". From information taken from internet chat logs "recorded by the FBI with the CW's consent", the document relating to O'Cearrbhaill recounts an online conversation between the informant and another individual, allegedly the defendant, using the nickname "anonsacco".
In the first conversation, on 14 January 2012, anonsacco gets in touch asking Sabu for some technical help with a hack.
"Hi mate. Could I ask you for help? I need to intercept a conference call which would be a very good leak … If you could help me I am happy to leak the call to you solely. I guarantee it will be of interest!!"
The FBI agent confirms the conference call under question did indeed take place, and believed information on how to gain access had been gleaned from a previous email hack of the Irish police force, the Garda.
Two weeks later, anonsacco got in touch with Sabu again through private chat. "Hey mate. Would you like a recording of a call between SOCA and the FBI regarding anonymous and lulzsec?" he said. "I think we need to hype it up. Let the feds think we have been recording their calls."
Sabu's responses are not recorded, but the indictment says he agreed to receive the file, which was then checked by the FBI and found to indeed be a recording of the conference call. Five days later, the recording was posted online.
The indictment later details an earlier conversation with Sabu in which "palladium", allegedly another identity used by O'Cearrbhaill, is asked to corrobrate his identity. Palladium confirms details about his internet address and services he used to anonymise himself.
If extradited and convicted, O'Cearrbhaill faces up to15 years in prison.
The logs also detail Sabu's astonishing involvement in the hacking attack on the security company Stratfor, of which US citizen Jeremy Hammond is accused.
A cache of more than 5m emails taken from an attack on the company's servers in December 2011 is currently being published by WikiLeaks, but the indictment documents reveal that straight after the attack, Sabu offered an FBI-owned server to store the cache – which was quickly accepted.
"btw I started unpacking on [CW-1]'s new server," an online identity alleged to be Hammond notes.
This not only gave the FBI access to review or even potentially amend the cache, but also an inside track on Anonymous' discussions on how to use the documents, and potentially – though not revealed within the files unsealed to date – conversations between Anonymous and WikiLeaks.
The US department of justice has convened a grand jury investigation into WikiLeaks, based in Virginia. If through Sabu or information he had gleaned from other Anons the US could glean any evidence to tie Julian Assange to hacking attacks on US soil, such as Stratfor, the case for extradition would be substantially strengthened.
The extent of communication between WikiLeaks and Anonymous regarding the Stratfor leak is currently unknown.
Throughout the logs detailed in the indictments published to date, the informer talks to other hackers in the room, at one stage even proposing publishing private password details: "Wanna release that list of 92% cracked stratfor hashes?" he asks. "Hrm, your call..." the defendent replies. "I'd err on the side of no, so that way we can more fully exploit."
Sabu also provided detailed information to authorities carrying out physical surveillance on Hammond prior to his arrest, giving details of login and logout times of various identities while FBI agents tracked internet use, use of TOR – a service which anonymises internet connections – and other activity at Hammond's addresss alongside his physical movements from 28 February 2012.
Sabu's online persona has been silent since the legal files have been unsealed, but had continued unabated until shortly before, with recent tweets angrily denouncing the federal government.
"The feds at this moment are scouring our lives without warrants. Without judges approval. This needs to change. Asap," said one sent within the last day. "The federal government is run by a bunch of fucking cowards. Don't give in to these people. Fight back. Stay strong," said another shortly afterwards
His final tweet, sent less than 4 hours later, contained the last words of Marxist revolutionary Rosa Luxemburg. They translate as: "The revolution says I am, I was, I will be."