UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK

--

--

---------

-x
INDICTMENT Sl 12 Cr. 185 (LAP)

UNITED STATES OF AMERICA

- v. " a/k/a "kayla,"101," a/k/a a/k/a "lolspoon," JAKE DAVIS, a/k/a "topiary," a/k/a "atopiary" DARREN MARTYN, a/k/a "pwnsauce, " a/k/a "raepsauce, " a/k/a "networkkitten, " DONNCHA O'CEARRBHAIL, a/k/a "palladium," and JEREMY HAMMOND, a/k/a "Anarchaos, " a/k/a "sup_g, " a/k/a "burn, " a/k/a "yohoho, " a/k/a "POW, " a/k/a "tylerknowsthis, " a/k/a "crediblethreat, " a/k/a "ghost" a/k/a "anarchacker, " Defendants.

"

_ _ _ _ _ _ _ _ _ _ _ - - - - - - -x

COUNT ONE (CONSPIRACY TO COMMIT COMPUTER The Grand Jury charges: THE DEFENDANTS 1. RYAN ACKROYD, At certain a/k/a times relevant to this Indictment, "lolspoon," and HACKING - INTERNET FEDS)

"kayla," a/k/a

"101," a/k/a

JAKE DAVIS,

a/k/a

"topiary,"

a/k/a

"atopiary," in the United a/k/a

the defendants, Kingdom. "kayla," a/k/a

were computer 2. "101," a/k/a things, computer

hackers

who resided

The role of RYAN ACKROYD, "lolspoon," the defendant,

included,

among other in victims' access

~dent~fy~ng systems

and explo~t~ng

vulnerabilities

for the purpose

of gaining

unauthorized

to those systems this Indictment. 3. "atopiary,"

for the groups charged

in Counts One and Two of

The role of JAKE DAVIS, the defendant, included,

a/k/a

"topiary,"

a/k/a acting

among other things,

as a spokesman

for the group,s charged

in Counts One and Two of in interviews activities; confidential hacking with the drafting

this Indictment,

for example by engaging those groups'

media and publicizing press releases; information described

hacking

and organizing

and ~toring

stolen in connection

with the computer

in Counts One and Two of this Indictment. 4. At certain times relevant to this Indictment, a/k/ a .

DARREN MARTYN, "networkkitten," the defendants, 5. JEREMY HAMMOND, a/k/a "yohoho,"

a/k/ a "pwnsauce," and DONNCHA were computer At certain

a/k/ a "raepsauce," a/k/a

O'CEARRBHAIL, hackers

"palladium," in Ireland.

who resided

times relevant a/k/a

to this Indictment, "sup_g," a/k/a "burn,"

a/k/a Anarchaos," a/kj,a "POW," a/k/a a/k/a

"tylerknowsthis," "anarchacker,"

a/k/a the

"crediblethreat,"

"ghost," a/k/a
2

defendant, Illinois.

was a computer

hacker who resided

in Chicago,

BACKGROUND 6. including

ON ANONYMOUS

AND INTERNET

FEDS and

Since at least in or about 2008, up through "Anonymous" and others slogans,

at least in or about Ma:tcl! 2012, of computer common hackers

has been

a loose confederation among other things, identifying of Anonymous destruction, symbols.

sharing, and common

interests,

common

During

that time period, campaign

certain members of online

have waged a deliberate intimidation,

and criminality,

as part of which businesses and the

they have carried out cyber attacks against government world. 7. Between in or about December entities in the United

States and throughout

2010 and in or about with Anonymous who

May 2011, one group of individuals engaged hackers Feds." Internet websites entities in such criminal who collectively At various

affiliated

conduct was composed referred

of elite computer as "Internet members of

to themselves

times relevant

to this Indictment,

Feds carried and computer in the United

out a series of cyber attacks systems of certain business States and around businesses

against

the

and government including,

the world,

among others,

the following a.

and organizations: party in Ireland,
II

Fine Gael, a political the website

which maintained

"www.finegae12011.com;
3

b. Federal, computer provided thlngs, LLC

HBGary,

Inc. and its affiliate, referred to herein

HBGary

(collectively

as "HBGary"),

security computer

firms based in the United security software

States which among other

and services,

to thelr cllents,

and which maintained and Company

the website

"www.HBGaryFederal.comi" c. commercial broadcast

Fox Broadcasting television

("Fox"), a States,

network

in the United

which maintained 8. (1) breaking confidentiai sensitive victimsi victims' publicly Internet victims' Internet

the website

..ww.fox.com." w involved, deleting encrypted among other things: data, and stealing and unencrypted of individual stolen from (3) on the

These cyber attacks into computer information, systems, including

personal

information

for thousands

(2) de~encrypting computer systems,

confidential including

information

encrypted

passwordsi

disclosing by dumping

that stolen confidential it on certain websitesi accountsi

information (4) hijacking

email and Twitter websitesi and/or

(5) defacing

victims'

(6) "doxing," personal

that is, publicly information, number, of, among the victim

disclosing

online a victim's

identifying

such as the victim's email account, other things, to harassment.

name, address, number,

Social

Security

and telephone intimidating

with the object and subjecting

the victim

4

9.

At various

times relevant of Internet

to this Indictment, Feds sought to

and

as part of Anonymous, publicize

members

their Internet

assaults

and intimidate messages

their victims in which attacks; they

by, among other things: they discussed

(1) posting

online

theiL attacks and threatened

additional

(2) using par t Lcu.tax logos and slogans when, posted messages online and defaced websites; of the press. times relevant

for example, and

(3) discussing

their attacks with members 10. much At various

to this Indictment, of Internet conduct, by, for

and

like other members their efforts attempted

of Anonymous,

members

Feds,

despite

to publicize

their illegal

typically example,

to hide their true identities

using aliases when they communicated

with the public

or

with each other. 11. members At various times relevant to this Indictment, of Anonymous,

of Internet using,

Feds, much like other members among other means, that is, real-time, Internet

communicated

Relay Chat online

("IRC") channels forums.

text-based

Some of these channels channels

were open to the public. of Anonymous criminal Instead, those by and

Others, particularly members of Internet including

in which members and organized were not.

Feds planned

activity, channels

cyber attacks,

were generally only, usually

password-restricted to trusted
5

and available

invitation

individuals

who had proven

themselves of Internet coordinated

through past criminal

hacking.

Specifically, planned and

members

Feds and their co-conspirators

their cyber attacks using password-restricted, IRC channels "#hq," amollg such as "#InternetFeds,"
0 Lhex

invitation-only .... #Hackel s,
g

and

s. to this Indictment, the

12. members a/k/a

At various

times relevant

of Internet

Feds included,

among others,

RYAN ACKROYD, a/k/a

"kayla," a/k/a a/k/a

"101," a/k/a "lolspoon,"
DARREN MARTYN,

JAKE DAVIS,

"topiary," a/k/a

"atopiary," a/k/a

a/k/a

"pwnsauce,"

"raepsauce," a/k/a

"networkkitten,"

and DONNCHA as well as

O'CEARRBHAIL,

"palladium," including,

the defendants,

other individuals,

but not limited "TFLOW,"

to, individuals and "AVUNIT."

who used the online aliases

"SABU,"

CYBER ATTACKS 13. including including

BY INTERNET

FEDS

From in or about December

2010, up to and of Internet Feds,

in or about May 2011, members RYAN ACKROYD, JAKE DAVIS, a/k/a a/k/a a/k/a

"kayla," a/k/a "topiary," a/k/a

"101," a/k/a
"atopiary," a/k/a

"lolspoon,"

a/k/a

DARREN MARTYN, "networkkitten," the defendants, others,

"pwnsauce,"

"raepsauce," a/k/a

and DONNCHA

O'CEARRBHAIL,

"palladium," among on, and

and their co-conspirators, launched

including, cyber attacks

SABU, TFLOW ~nd AVUNIT,

gained unauthorized

access to, the websites victims,
6

and computers

systems of the following

among others:

Hack of Fine Gael a. O'CEARRBHAIL website, In or about January 2011, MARTYN and

participated

in a cyber attack on Fine Gael's Among other things, MARTYN and

www.finegae12011.com.

O'CEARRBHAIL
Arizona

accessed

without authorization

computer

servers in

used by Fine Gael to maintain the website.

its website,

and uploaded

code that defaced

Hack of HBGary b. MARTYN, AVUNIT, computer In or about February 2011, ACKROYD, DAVIS,

and their co-conspirators, participated

including

SABU, TFLOW and and

in a cyber attack on the website

systems of HBGary. c. Among other things, ACKROYD, accessed without DAVIS, MARTYN,

and their co-conspirators computer servers

authorization used by HBGary and including

in California information

and Colorado

stole confidential approximately employees

from those servers,

60,000 emails from email accounts of HBGary

used by HBGary LLC (the

and a senior executive

Federal, DAVIS,

"HBGary Federal Executive"), and their co-conspirators www.thepiratebay.org that permits

which ACKROYD, disclosed

and MARTYN,

publicly

via the

website

(an anonymous

file sharing website among other means. and their co-

users to post stolen content), d. ACKROYD, DAVIS, MARTYN, gained
7

conspirators

used information

from those stolen emails to

access, without

authorization,

and steal the contents

of an Inc. to the

email account belonging (the "HBGary, servers computer

to a senior executive

of HBGary, access

Inc. Executive");

gain unauthorized an online

for the website hacking

www.rootkit.com.

forum on and

maintained

by the HBGazy,

Inc. Executive, and encrypted

steal confidential passwords

data, including

usernames

for approximately

80,000 user accounts; account Federal

access without

authorization

and deface the Twitter and dox the HBGary

of the HBGary Executive number by, and home or

Federal Executive;

among other things, posting address on his Twitter

his Social Security

account without

his authorization

approval. e. conspirators ACKROYD, DAVIS, MARTYN, and their coof the encrypted and

de-encrypted

tens of thousands

www.rootkit.com publicly usernames belonging certain

users' passwords

that they had stolen,

disclosed

those de -enc rypt-ed passwords,

the rootki t. com

they had stolen, and the contents to the HBGary, Inc. Executive,

of the email account them on

by dumping

Internet

websites. Hack of Fox

f. MARTYN, O'CEARRBHAIL,

In or about April

2011, ACKROYD,

DAVIS, SABU,

and their co-conspirators,

including

TFLOW and AVUNIT, and computer

participated

in a cyber attack on the website

systems of Fox.
8

g. O'CEARRBHAIL, authorization

Among other things, ACKROYD, accessed

DAVIS, MARTYN, without

and their co-conspirators computer servers

in California

used by Fox and including

stole and publicly

disclosed

confidential

information,

a database

of the nallles,daLes of bixLh,
and residences,

Lelephone

llumbers,
for

email addresses,

among other information,

more than 70,000 potential television show.

contestants 'on -X-Factor,"

a Fox

STATUTORY 14. and including

ALLEGATIONS 2010, up to District of

From at least in or about December

in or about May 2011, in the Southern RYAN ACKROYD, JAKE DAVIS, a/k/a a/k/a a/k/a

New York and elsewhere, -101," a/k/a -atopiary," a/k/a -lolspoon,"

-kayla," a/k/a -topiary," a/k/a a/k/a

DARREN MARTYN,

-pwnsauce,"

-rEi;epsauce,"

-networkkitten,"

and DONNCHA

O'CEARRBHAIL,

a/k/a

-palladium," willfully agreed

the defendants,

and others known and unknown, conspired, confederated, in computer Code, Section and

and knowingly,

combined,

together

and with each other to engage of Title 18, united

hacking,

in violation

States

1030 (a) (5) (A) . 15. It was a part and an object of the conspiracy a/k/a -kayla," a/k/a a/k/a -101," a/k/a -lolspoon,"

that RYAN ACKROYD, JAKE DAVIS, a/k/a a/k/a -pwnsauce,"

"topiary," a/k/a

"atopiary," a/k/a

DARREN MARTYN, and

-raepsauce,"
9

-networkkitten,"

DONNCHA

O'CEARRBHAIL,

a/k/a

"palladium,"

the defendants,

and

others known and unknown, cause the transmission command,

willfully

and knowingly information,

would and did code and

of a program,

and, as a result of such conduct, cause damage without

would and did

lntentlonally computer, resulting

authorizatioIl, to a pIoLecLed (including affecting loss one and

which would and did cause a loss from a related course of conduct aggregating

more other protected

computers)

to at least $5,000 in violation

to one and more persons of Title 18, United 1030 (c) (4) (B) (i) and

during anyone

year period,

States Code, Sections (c) (4) (A) (i) (I). OVERT ACTS

1030(a) (5) (A),

16.

In furtherance thereof,

of the conspiracy

and to effect

the illegal object

the following

overt acts, among of New York and

others, were committed elsewhere: a. O'CEARRBHAIL, electronic a/k/a a/k/a

in the Southern

District

On or about January "palladium,"

9, 2011, DONNCHA sent an "pwnsauce,"

the defendant, a/k/a

communication a/k/a

to DARREN MARTYN, "networkkitten,"

"raepsauce," computer

the defendant, the

containing

code to be used to deface website. In or about February

www.finegae12011.com b. computer located

201'1, SAEU used a

in New York, New York ,to access without 10

authorization thousands HBGary

computer

servers used by HBGary to employees

and steal tens of and the

of emails belonging Executive. c.

of HBGary

Federal

In or about February
"t' a

2011, JAKE DAVIS, accesse

a/Kia

" t'Oplaly,

" aT'X: 7a I

oplaIY ,lee tl
rr

d f ell d an,t

d "v9'J:t ut . ho

authorization Executive

the Twitter

account

of the HBGary

Federal

and posted d.

one or more fraudulent In or about February "101," a/Kia

tweets.

2011, RYAN ACKROYD, the defendant, to the

a/Kia

"kayla," a/Kia without

"lolspoon,"

accessed HBGary,

authorization

an email account belonging

Inc. Executive

and sent one or more fraudulent

emails

from that account website requesting e.

to an administrator administrative

for the www.rootkit.com

access to that website. 7, 2011, TFLOW uploaded to as well as the

On or about February

links to tens of thousands employees

of stolen emails belonging Federal Executive

of HBGary and the HBGary

a copy of certain

text that had been used to deface website, to an account

www.HBGaryFederal.com www.thepiratebay.org f. the IRC channel Twitter account

on the website

in the name "HBGary leaked emails." On or about February 8, 2011, DAVIS, had locked the and stated, using

#hq, discussed of the HBGary

how Twitter

Federal Executive

"That works in our favour. tweets. Including his SSN."

His Twitter

still has all our

11

g.

On or about February

9, 2011, ACKROYD, he had received

using

the IRC channel #hq, asked TFLOW whether of emails belonging TFLOW responded to the HBGary,

a copy

Inc. Executive,

to which

affirmatively

and stated that he would add them

h.

On or about February

12, 2011, SABU, using data on a server

the IRC channel #hq, stated that he had deleted used by HBGary. i. the IRC channel IRC/Skype, On or about February

13, 2011, DAVIS,

using

#hq, told AVUNIT

~I'm happy to talk to press on and told TFLOW that he

have done

[so] for months,"

had "talked to maybe 150 journalists." j. In or about May 2011, SABU used a computer authorization containing a computer personal

in New York, New York to access without server used by Fox and download information television relating show. (Title 18, United

a database

to potential

contestan~s

on the X-Factor

States Code, Section COUNT TWO

1030(b).)

(CONSPIRACY TO COMMIT COMPUTER

HACKING

- LULZSEC)

The Grand Jury further charges: 17. Indictment herein. 12 The allegations in paragraphs 1 through 6 of this

are repeated

and realleged

as though

fully set forth

BACKGROUND 18.

ON LULZSEC the publicity of Fine Feds,

In or about May 2011, following

that they had generated Gael and HBGary, including

as a result of their hacking members

among other victims,

of Internet

RYAN ACKROYD, JAKE DAVIS, a/k/a

a/k/a
a/k/a

"kayla,U

a/lela "101," a/k/a
a/k/a "atopiary," a/k/a and and

"lolspoon,"

"topiary," a/k/a

DARREN MARTYN, "networkkitten," AVUNIT, group,

"pwnsauce,"

"raepsauce,"

the defendants,

as well as SABU, TFLOW, members

formed and became "Lulz Security"

the principal

of a new hacking

or "LulzSec." a/k/a

Other co-conspirators, a/k/a "sup_g,"

including a/k/a

JEREMY HAMMOND,

"Anarchaos;"

"burn," a/k/a

"yohoho," a/k/a

"POW," a/k/a a/k/a "ghost," a/k/a

"tylerknowsthis," "anarchacker," LulzSec's

a/k/a

"crediblethreat,"

the defendant, activities.

also participated

in some of

hacking 19.

Like Internet cyber assaults

Feds, LulzSec undertook on the websites entities

a campaign systems States and

of malicious of various

and computer in the United

business

and government Although

and throughout

the world.

the members

of LulzSec

their co-conspirators for humorous interpreted criminal purposes

claimed

to have engaged

in these attacks

("lulz" is Internet

slang which can be LulzSec's

as "laughs,"

"humor," or "amusement"), among other things, including 13

acts included,

the thef.t of personal

confidential

information,

sensitive

information computer

for thousands

of individuals, disclosure

from their victims'

systems;

the public

of that confidential of Internet with bogus

information websites; requests

on the Internet;

the defacement

and overwhelming for information

victims'

computers

(known as v'denial

of sex vice" ox "DoS"

attacks) . 20. notoriety Also like Internet Feds, LulzSec and repeated sought to gain efforts to As

for their hacks by varied

broadcast ,their acts of online destruction a means of publicizing

and criminality.

their cyber assaults,members maintained a website,

of LulzSec

and their co-conspirators ..ww.LulzSecurity.com; w www.thepiratebay.org;

..an account and a Twitter

in the name account,

"LulzSec"

at all of

"@LulzSec;"

which they used to, among other things, announce issue written "press releases" and publicly

their hacks and

about them; mock their victims; disclose confidential

solicit donations; information

they had stolen through Similar to Internet

their cyber attacks. Feds, as a means of as well as intimidating used "press their

21. publicizing victims,

their online assaults, of LulzSec

members

and their co-conspirators in, for example, their

particular releases,"

logos and slogans their website

defacements,

and on the Twitter account.

www.LulzSecurity.com

website

and the @LulzSec

14

22.

Despite

going to great lengths the members

to seek attention and their co-

for their illegal conduct, conspirators

of LulzSec

-- like Internet

Feds -- attempted

to hide their to and

true identities. themselves

Among other things, attempted including

they referred

by aliases, means,

to promote

false peLsonas,

used technical

proxy servers,

in an effort to

conceal themselves 23. members

online. times relevant to this Indictment, a/k/a "kayla," a/k/a a/k/a

At various

of LulzSec,

including

RYAN ACKROYD,

"101," a/k/a "atopiary," "raepsauce,"

"lolspoon,"

JAKE DAVIS, a/k/a a/k/a

"topiary,"

and DARREN MARTYN, a/k/a

"pwnsauce,"

a/kia, as well as including, "sup_g,"

"networkkitten,"

the defendants,

SABU, TFLOW, and AVUNIT, at times, JEREMY HAMMOND, a/k/a "burn," a/k/a

and their co-conspirators, a/k/a "Anarchaos," a/k/a

"yohoho," a/k/a

"POW," a/k/a a/k/a "ghost," a/k/a

"tylerknowsthis," "anarchacker," websites others: a. Pictures"), company, movies

a/k/a

"crediblethreat," launched

the defendant,

cyber attacks

on the among

and computer

systems of the following

victims,

Sony Pictures

Entertainment

("Sony and media

a division

of Sony, a global electronics and distributed television

which produced

shows and ..

and maintained

the website

..ww.sonypictures.com; w

15

b. non-profit public

The Public Broadcasting television broadcasting

Service service

("PBS"), a

in the United

States, which maintained c. Infragard

the website

"www.pbs.orgi" chapter of the an infoImatioIl

The Atlanta,

Georgia

Members Alliance between

("Infragard-Atlanta"), the Federal Bureau concerned

sharing partnership ("FBI") and private infrastructure website

of Investigation critical the

industry

with protecting

in the United

States, which maintained

"www.infraguardatlanta.orgi" d. Bethesda Softworks, a video game company "Brink" and and Safety (the which

based in Maryland, maintained

which owned the videogame www.brinkthegame.com.i Department

the website e.

The Arizona

of Public

"Arizona DPS"), maintained

a state law enforcement "www.azdps.gov." times relevant

agency

in Arizona,

the website 24.

At various

to this Indictment,

in

addition victims' received

to identifying computer

and exploiting

vulnerabilities

in their

systems on their own, the members hackers information

of LulzSec

from other computer

regarding of business

vulnerabilities and government information

in the computer entities.

systems of a variety

LulzSec members

then used this or stored

to launch cyber attacks on those entities in anticipation of future attacks.

this information

16

25. members

At various

times relevant

to this Indictment, communicated with using

of LulzSec

and their co-conspirators and coordinated

each other and planned password-restricted, among others,

their cyber attacks

invitation-only and "#lrq".

IRC channels,

including,

n#uppe:tdeck'''

CYBER ATTACKS 26.

BY LULZSEC at

From in or about May 2011, up to and including of LulzSec, including JAKE a/k/a

least in or about June 2011, members ACKROYD, DAVIS, a/k/a "kayla," a/k/a a/k/a

RYAN

"101," a/k/a "atopiary," a/k/a

"lolspoon,"

a/k/a

"topiary," a/k/a

DARREN MARTYN, the

"pwnsauce," defendants,

"raepsauce,"

"networkkitten,"

as well as SABU, TFLOW, and AVUNIT, including, a/k/a

and their coa/k/a a/k/a

conspirators, "Anarchaos," "POW," a/k/a

among others, JEREMY HAMMOND, "burn," a/k/a

"sup_g," a/k/a

"yohoho,"

"tylerknowsthis," "anarchacker,"

a/k/a

"crediblethreat," launched

a/k/a cyber and

"ghost," a/k/a attacks

the defendant,

on, and gained unauthorized systems of the following

access to, the websites victims, among others:

computers

Hack of PBS a. MARTYN, AVUNIT, In or about May 2011, ACKROYD, including DAVIS,

and their co-conspirators, in retaliation

SABU, TFLOW and to be unfavorable Frontline,

for what they perceived

news coverage

in an episode of the PBS news program

17

undertook PBS.

a cyber attack on the website

and computer

systems of

b. conspirators,

ACKROYD,

DAVIS, MARTYN, authorization

and their cocomputer servers in

accessed

without

vlrglnla used by PBS, stole confidential servers, names, including,

infoLlllaLionfrom those containing

among other things, databases usernames and passwords

email addresses,

of more than and

approximately entities

2,000 PBS employees

and other individuals disclosed the that

associated

with PBS; publicly

information

on certain websites, website;

including

www.LulzSecurity.com including

and defaced

the PBS website,

by inserting

a bogus news article. Hack of Sony Pictures

c.

In or about May 2011, ACKROYD, including

DAVIS,

and

their co-conspirators, participated Pictures.

SABU, TFLOW and AVUNIT, systems used by Sony without authorization and

in a cyber attack on computer This attack computer included accessing

Sony Pictures' publicly

servers in California,

and stealing the

disclosing

on certain websites, website,

including

www.LulzSecurity.com least approximately website, including

confidential

information

for at

100,000 users of the www.sonypictures.com the users' passwords, email addresses, home

addresses,

and dates of birth.

18

Hack of Infragard-Atlanta
d.

In or about June 2011, ACKROYD, including

DAVIS,

MARTYN, AVUNIT, systems

and their co-conspirators, launched

SABU, TFLOW and and computer included and other stealing

cyber attacks on the website These attacks passwords,

of Infragard-Atlanta.

the login credentials, confidential

encrypted

information

for approximately

180 users of the defacing

Infragard-Atlanta that website; disclosing

website,

www.atlantainfraguard.org; the stolen passwords;

de-encrypting

and publicly including the

the stolen confidential passwords,

user information,

the de-encrypted

on certain websites,

including

www.LulzSecurity.com

website. Hack of Bethesda Softworks DAVIS,

e. MARTYN,

In or about June 2011, ACKROYD, including TFLOW,

and their co-conspirators,

participated Bethesda

in a cyber attack on the computer stealing confidential

systems used by including

Softw9rks,

information, passwords,

authorization accounts website,

keys, as well as usernames,

and email Softworks' and

for approximately

200,000 users of Bethesda ACKROYD, disclosed

..ww.brinkthegame.com." w publicly

DAVIS, MARTIN,

their co-conspirators,

some of that stolen

data on certain websites, website.

including

the www.LulzSecurity.com

19

Hack of the Arizona f.

DPS HAMMOND, and

In or about June 2011, DAVIS, including

their co-conspirators, attack on the· computer other things, DPS's computer disclosed

TFLOW, participated

in a cyber Among

systems used by the Arizona pPS. without

they accessed servers

authoxizatioll the Arizona and stole and publicly the website such as law for

in Arizona,

on certain websites,

including

www.LulzsSecurity.com. enforcement Arizona sensitive

confidential documents

information

and personal

information

law enforcement names,

personnel

and their family members, home addresses,

including

email accounts

and passwords,

and home telephone

and cell phone numbers. STATUTORY ALLEGATIONS

27. including District a/k/a a/k/a

From at least in or about May 2011, up to and

at least in or about June 2011, in the Southern of New York and elsewhere, "lolspoon," RYAN ACKROYD, a/k/a a/k/a "kayla,"

"101," a/k/a "atopiary," a/k/a a/k/a

JAKE DAVIS, a/k/a

"topiary," a/k/a a/k/a a/k/a

DARREN MARTYN,

"pwnsauce,"

"raepsauce," "Anarchaos," "POW," a/k/a

"networkkitten,"

and JEREMY HAMMOND,

"sup_g," a/k/a "burn," a/k/a a/k/a

"yohoho,"

"tylerknowsthis," "anarchacker,"

"crediblethreat,"

a/k/a

"ghost," a/k/a and unknown, confederated,

the defendants,

and others known conspired,

willfully

and knowingly,

combined,

and agreed together 20

and with each other to engage

in computer hacking,

in violation

of Title 18, United States

Code, Section 1030(a) (5) (A). 28. It was a part and an object of the conspiracy a/k/a "kayla," a/k/a "101," a/k/a "lolspoon,"
'l'topiaLY," a/k/a "atopia~y," DARRENMARTYN,

that RYAN ACKROYD,
JAKE DAv-rS, a/kja

a/k/a "pwnsauce," a/k/a "raepsauce," JEREMY HAMMOND, a/k/a "Anarchaos,"

a/k/a "networkkitten,"

and

a/k/a "sup_g," a/k/a "burn," a/k/a the

a/k/a "yohoho," a/k/a "POW," a/k/a "tylerknowsthis," "crediblethreat,"
---

a/k/a "ghost," a/k/a "anarchacker,"

defendants, knowingly

and others known and unknown, willfully

and

would and did cause the transmission

of a program,

information,

code and command, and, as a result of such conduct, cause damage without authorization,

would and did intentionally to a protected

computer, which would and did cause a loss from a related course of conduct computers) aggregating year to

(including loss resulting affecting

one and more other protected

at least $5,000 to one and more persons during anyone period, in violation

of Title 18, United States Code, Sections

1030 (a) (5) (A), 1030 (c) (4) (B) (i) and (c) (4) (A) (i) (I) . OVERT ACTS 29. In furtherance of the conspiracy and to effect

the illegal object thereof, the following overt acts, among others, were committed elsewhere: 21 in the Southern District of New York and

a. "topiary," Twitter a/k/a

On or about May 6, 2011, JAKE DAVIS, "atopiary," the defendant, established a

a/k/a

account

in the name "@LulzSec." b. In or about May 2011, SAEU used a computer

located in New :fork, New York, computer

to gain unaatho:rized access to

systems used by PBS and install one or more means ("backdoors") by which SAEU and others authorization. could

surreptitious secretly

re-access c.

those systems without

In or about May 2011, DAVIS wrote a bogus website. a/k/a and SAEU

news article,

which was used to deface the www.pbs.org d. In or about May 2011, RYAN ACKROYD, the defendant,

"kayla," a/k/a accessed

"101," a/k/a "lolspoon," authorization computer

without

servers used by PBS and

downloaded

confidential e.

information.

In or about May 2011, SAEU used a computer access to

located

in New York, New York, to gain unauthorized

servers used by Sony Pictures. f. In or about June 2011, SAEU used a. computer access to,

located in New York, New York to gain unauthorized and install one or more backdoors Infragard-Atlanta. g. without authorization confidential In or about June 2011, ACKROYD in, computer

systems used by

accessed and

servers used by Infraguard-Atlanta information. 22

downloaded

h. named as a defendant vulnerability ACKROYD

In or about June 2011, a co-conspirator herein provided information concerning Softworks

not a to

in computer

systems used by Bethesda of LulzSec.
about June 12, 2011,

and other members i.
On
01:

ACKROYDus ed

the

foregoing

vulnerability

to gain unauthorized Softworks,

access

to computer

systems used by Bethesda backdoors, download

install one or more of LulzSec, and

which he provided

to other members

confidential j.

information. In or about June 2011, DAVIS used a backdoor to access without Softworks authorization computer

provided

by ACKROYD

systems used by Bethesda information,

and download

confidential

which DAVIS then organized. k. On or about June 12, 2011, DARREN MARTYN, a/k/a "raepsauce," a/k/a "networkkitten," the

a/k/a "pwnsauce," defendant, #upperdeck: responded posted

the following message

in the IRC channel to which ACKROYD

"Ok, who are we raping, brink?"

affirmatively. 1. On or about June 12, 2011, DAVIS posted in the IRC channel #upperdeck: is 100% organized the

following

message

"so everyone

knows, Brink leakage on the 200K DB." m.

on my end; just waiting

On or about June 21, 2011, a co-conspirator herein provided 23 SABU with confidential

not named as a defendant

files relating

to a computer

network

at the "madison ave hq in of Sony. a/k/a a/k/a

nyc" of Sony Music Entertainment, n. "Anarchaos," a/k/a

a division

In or about June 2011, JEREMY HAMMOND, "sup g," a/k/a "burn," a/k/a a/k/a "yohoho,"

"POW," a/k/a "tylerknowsthis,"
"ghost," a/k/a authorization downloaded "anarchacker," computer

"credibleth:teat,'" a/k/a accessed without

the defendant,

servers used by the Arizona information.

DPS and

confidential o.

On or about June 20, 2011, HAMMOND with confidential

provided that

SABU, who was in Manhattan, HAMMOND

information

had stolen from computer over 100 documents

servers used by the Arizona labeled "Law Enforcement DPS documents issues, law

DPS, including Sensitive" relating

and hundreds

of internal Arizona

to, among other things, officer techniques, p. and operational

safety plans.

enforcement

On or about June 23, 2011, DAVIS posted in the IRe channel #upperdeck: shit today, tflow is working "leaking

the

following hilarious

message police q.

some

on it." to

On or about June 23, 2011, TFLOW uploaded website confidential DPS. information

the www.thepiratebay.org from computer

stolen

servers used by the Arizona r.

On or about June 23, 2011, after TFLOW had information, DAVIS posted on the @LulzSec

uploaded

the foregoing

24

,.:.;

Twitter

account

a link to that stolen information website. States Code, Section COUNT THREE

on the

www.thepiratebay.org

(Title 18, United

1030(b).)

(CONSPIRACY TO COMMIT COMPUTER

HACKING

ANTISElC)

The Grand Jury further charges: 30. Indictment herein. BACKGROUND 31. ON ANTISEC of Internet a/k/a The allegations in paragraphs 1 through 6 of this

are repeated

and realleged

as though

fully set forth

In or about late June 2011, members including RYAN ACKROYD, a/k/a a/k/a

Feds and LulzSec,

"kayla,"

"101," a/k/a "lolspoon,"
"atopiary," a/k/a

JAKE DAVIS, a/k/a

"topiary," a/k/a

a/k/a

DARREN MARTYN,

"pwnsauce,"

"raepsauce,"

"networkkitten,"

and DONNCHA

O'CEARRBHAIL,

a/k/a and their co-

"palladium," conspirators,

the defendants, including

as well as TFLOW, a/k/a a/k/a

JEREMY HAMMOND, "yohoho,"

"Anarchaos," "POW," a/k/a "ghost,"

a/k/a

"sup_g," a/k/a

"burn," a/k/a a/k/a

"tylerknowsthis," "anarchacker," "Operation

"crediblethreat,"

a/k/a

a/k/a

the defendant,

formed a new hacking

group called

Anti-Security," 32.

or "AntiSec." Feds and LulzSec, AntiSec carried and entities

Like Internet

out a series of computer computer

attacks against businesses 25

the websites

systems of various

and government

in the United included,

States and around

the world.

These attacks

have

among other things, the theft of confidential including sensitive personal information for the of

information, thousands public

of individuals,

from victims'

computer

systems;

disclosure websites. 33.

of that iIlfoLltlaLioIli the defacement and

victims'

As with Internet

Feds and LulzSec,

members

of by, to

AntiSec

sought to gain publicity

for these cyber assaults and various public

among other things, using Twitter announce their hacks, publicly

websites

disclose

stolen confidential

information, 34. members

and deride their victims. At various times relevant to this Indictment, a/k/a "kayla," a/k/a a/k/a

of AntiSec,

including

RYAN ACKROYD, a/k/a

"101," a/k/a "atopiary," a/k/a

"lolspoon,"

JAKE DAVIS, a/k/a

"topiary," a/k/a a/k/a

DARREN MARTYN,

"pwnsauce,"

"raepsauce," "palladium,"

"networkkitten,"

DONNCHA

O'CEARRBHAIL, a/k/a

and JEREMY HAMMOND, "burn," a/k/a a/k/a

a/k/a "Anarchaos,"

"sup_g," a/k/a

"yohoho," a/k/a a/k/a

"POW," a/k/a

"tylerknowsthis," "anarchacker," the

"crediblethreat,"

"ghost," a/k/a

defendants, launched various Inc.

as well as TFLOW, and their co-conspirators, and computer Strategic systems of Foreca$ting, in ...

cyber attacks on the websites victims, including,

among others, analysis

("Stratfor"),

an information

company based

Austin,

Texas, which maintained

the website
26

..ww.stratfor.com w

35. members

At various

times relevant

to this Indictment, communicated with using

of AntiSec

and their co-conspirators and coordinated

each other and planned password-restricted,

their cyber attacks

invitation-only

IRC channels,

including,

CYBER ATTACKS 36. including including

BY ANTISEC

From in or about late June 2011, up to and of AntiSec,

at least in or about March 2012, members RYAN ACKROYD, a/k/a "kayla," a/k/a "topiary," a/k/a

"101," a/k/a "atopiary," a/k/a and

"lolspoon,"

JAKE DAVIS, a/k/a

a/k/a

DARREN MARTYN, "networkkitten," JEREMY HAMMOND, a/k/a

a/k/a "pwnsauce," DONNCHA a/k/a

"raepsauce," a/k/a

O'CEARRBHAIL,

"palladium,"

"Anarchaos," "POW," a/k/a

a/k/a

"sup_g," a/k/a

"burn,"

"yohoho," a/k/a

"tylerknowsthis," "anarchacker,"

a/k/a the

"crediblethreat," defendants, launched

a/k/a

"ghost," a/k/a

as well as TFLOW, and their co-conspirators, access victim, to, among

cyber attacks on, and gained unauthorized and computer systems of the following

the websites others:

Hack of Stratfor a. to and including conspirators From at least in or about December in or about March 2012, HAMMOND 2011, up

and his coand computer

mounted

a cyber assault on the website

systems of Stratfor.
27

b. without

HAMMOND

and his co-conspirators servers

accessed

authorization

computer

in Texas used by Stratfor

and, among other things: i. fIom those seIveIS, numbers including stole confidential appIoximately information caLd

60,000 cIedit

and associated

data belonging

to clients

of Stratfor, as well as the for

including

the cardholders'

names and addresses,

cards' security approximately

codes and expiration

dates; records including

860,000 Stratfor encrypted

clients,

individual

user IDs, us ernames, emails belonging corporate

passwords,

and email addresses; Stratfor

to Stratfor

employees;

and internal

documents; ii. used some of the stolen worth of unauthorized

credit card data to make at least $700,000 charges; iii. WWW.stratfor.com; iv. computer servers, including deleted Stratfor defaced

Stratfor's

website;

data from Stratfor's employees' stored emails products; confidential including,

and historical

archives

of Stratfor v.

analytical

publicly

disclosed

data that had been stolen from Stratfor's among other things, names, addresses,

servers,

credit card numbers,

28

usernames, clients,

and email addresses

for thousands

of Stratfor and from Stratfor

as well as Stratfor vi.

employees' uploaded

emails;

data stolen District

onto a server located

in the Southern

of New York.

37. including

From at least in or about June 2011, up to and District a/k/a a/k/a of

in or about March 2012, in the Southern RYAN ACKROYD, JAKE DAVIS, a/k/a a/k/a a/k/a

New York and elsewhere, "101," a/k/a "atopiary," a/k/a "lolspoon,"

"kayla," "topiary," a/k/a a/k/a

DARREN MARTYN,

"pwnsauce~"

"raepsauce," "palladium," a/k/a

"networkkitten,"

DONNCHA

O'CEARRBHAIL, a/k/a

and JEREMY HAMMOND, "burn," a/k/a a/k/a

a/k/a

"Anarchaos,"

"sup_g,"

"yohoho," a/k/a a/k/a

"POW," a/k/a

"tylerknowsthis," "anarchacker," and the

"crediblethreat,"

"ghost," a/k/a

defendants, knowingly, together violation

and others known and unknown, combined, conspired,

willfully

confederated,

and agreed hacking, in

and with each other to engage in computer of Title 18, United States Code, Section

1030 (a) (5) (A). 38. It was a part and an object of the conspiracy a/k/a ."kayla," a/k/a "topiary," a/k/a a/k/a "101," a/k/a DARREN "lolspoon," MARTYN,

that RYAN ACKROYD, JAKE DAVIS, a/k/a a/k/a

"atopiary," a/k/a

"pwnsauce,"

"raepsauce,"

"networkkitten,"

DONNCHA

O'CEARRBHAIL,

a/k/a

"palladium,"
29

and JEREMY HAMMOND,

a/k/a a/k/a a/k/a

"Anarchaos," "POW," a/k/a

a/k/a

"sup_g," a/k/a

"burn," a/k/a

"yohoho,"

"tylerknowsthis," "anarchacker,"

a/k/a

"crediblethreat," and others

"ghost," a/k/a

the defendants,

known and unknown,

willfully

and knowingly

would and did cause

the

t:rans([[ission 'of a p:rog:ralll,info:rlllatioIl, code

and

command,

and, as a result of such conduct, cause damage without authorization,

would and did intentionally to a protected computer, from

which would and did cause a loss a related protected

(including

loss resulting

course of conduct affecting computers) aggregating

one and more other

to at least $5,000 to one and in violation of Title

more persons 18, United and

during anyone

year period,

States Code, Sections

1030(a) (5) (A), 1030(c) (4) (B) (i)

(c) (4) (A) (i) (I). OVERT ACTS 39. In furtherance of the conspiracy and to effect

the illegal object thereof, others, were committed elsewhere: a. exchanged

the following

overt acts, among of New York and

in the Southern

District

On or about December

14, 2011, HAMMOND not named

online chat messages herein

with a co-conspirator

as a defendant

("CC-1"), in which HAMMOND access to Stratfor's

stated that he network.

had gained unauthorized b. conspirator

computer

On or about December

19, 2011, a codata stolen from

not named herein

("CC-2") uploaded 30

Stratfor

to a computer

server located

in the Southern

District

of New York. c. exchanged On or about December 26, 2011, HAMMOND not named

online chat messages

with co-conspirators

herein

("CC 3" and "CC-4"),

in which HAMMOND stated that he and
the passwords for the user

his co-conspirators accounts

had decrypted

of 4,500 Stratfor d.

clients. 26, 2011, HAMMOND

On or about December

exchanged discussed

online chat messages exploiting

with CC-3 and CC-4, in which they that had been

credit card information computer servers.

stolen from Stratfor's

(Title 18, United

States Code, Section COUNT FOUR

1030(b).)

(COMPUTER HACKING

- STRATFOR)

The Grand Jury further charges: 40. through though The allegations in paragraphs are repeated 1 through 6 and 31 as

36 of this Indictment fully set forth herein. 41.

and realleged

From at least in or about December District

2011, up to in

or about March 2012, in the Southern elsewhere, a/k/a JEREMY HAMMOND, a/k/a

of New York and a/k/a "sup_g,"

"Anarchaos,"

"burn," a/k/a

"yohoho,"

a/k/a

"POW," a/k/a a/k/a "ghost," a/k/a

"tylerknowsthis," "anarchacker,"

a/k/a

"crediblethreat," willfully 31

the defendant,

and knowingly

caused the

transmission

of a program,

information,

code and command,

and,

as a result of such conduct, to cause damage without

intentionally

caused and attempted computer, loss

authorization,

to a protected (including

which caused and attempted

to cause a loss

more other protected

computers)

aggregating

to at least $5,000 to wit,

to one and more persons HAMMOND

during anyone

year period, access

and others gained unauthorized

to computer information

systems used by Stratfor, analysis defaced services Stratfor's computer

a company which provides

for its clients, website; network,

and, among other things, data from employees' and credit at least websitesj

stole confidential including Stratfor

Stratfor's

emails, as well as personally card data for Stratfor's

identifying publicly

information disclosed Internet

clientsj

some of that data by dumping

it on certain

used at least some of the stolen credit card data to make unauthorized network. (Title 18, United States Code, Sections 1030(a) (5) (A), 103 0 (b), 103 0 (c) (4) (B) (i), and 2) . charges; and deleted data on Stratfor's computer

32

COUNT FIVE (CONSPIRACY TO COMMIT ACCESS The Grand Jury further charges: 42. through though The allegations in paragraphs ar@ r@p@at@d 1 through 6 and 31 as DEVICE FRAUD)

36 of this Indictm@nt fully set forth herein. 43.

and r@all@g@d

From at least in or about December District

2011, up to in

or about March 2012, in the Southern elsewhere a/k/a JEREMY HAMMOND, a/k/a

of New York and a/k/a "sup_g,"

"Anarchaos,"

"burn," a/k/a

"yohoho,"

a/k/a "POW," a/k/a a/k/a "ghost," a/k/a

"tylerknowsthis,"

a/k/a

"crediblethreat,"

"anarchacker," .the defendant, willfully and knowingly

and others known and unknown, conspire, confederate, and

did combine,

agree together the United

and with each other to commit an offense to wit, to violate Title 18, United

against States

States,

Code, Sections 44.

1029 (a) (2), 1029 (a) (3), and 1029 (a) (5) . It was a part and an object of the conspiracy a/k/a "Anarchaos," a/k/a "sup_g," a/k/a

that JEREMY HAMMOND, "burn," a/k/a a/k/a

"yohoho," a/k/a a/k/a

"POW," a/k/a

"tylerknowsthis," "anarchacker," and affecting in and the

"crediblethreat,"

"ghost," a/k/a

defendant, knowingly, interstate

and others known and unknown, and with intent to defraud, and foreign commerce,

willfully

in an offense

would and did traffic

use one and more unauthorized

access devices 33

during a one year

period,

and by such conduct would and did obtain $1,000 and more during

a thing of in

value aggregating violation

that period,

of Title 18, United 45.

States Code, Section

1029(a) (2). of the "sup

It was further a part and an object a/k/a

cOIlspi:racyLha:L JEREMY HAMMOND, g," a/k/a "burn," a/k/a a/k/a

"Ana!:chaos," a/k/a
"POW,"

"yohoho," a/k/a "crediblethreat,"

a/k/a "ghost," a/k/a

"tylerknowsthis," "anarchacker," willfully offense possess devices,

a/k/a

the defendant,

and others known and unknown, in an

and knowingly,

and with intent to defraud, and foreign commerce,

affecting

interstate

would and did access

fifteen and more devices which were unauthorized in violation of Title 18, United States

Code, Section

1029(a)(3). 46. conspiracy g," a/k/a It was further a part and an object a/k/a "Anarchaos,"
"POW,"

of the a/k/a "SUP

that JEREMY HAMMOND, "burn," a/k/a a/k/a

"yohoho," a/k/a "crediblethreat,"

a/k/a "ghost," a/k/a

"tylerknowsthis," "anarchacker," willfully offense effect

a/k/a

the defendant,

and others known and unknown, in an

and knowingly,

and with intent to defraud, and foreign commerce,

affecting

interstate

would and did issued to thing

transactions,

with one and more access devices to receive payment period the aggregate

another person

and persons,

and another

of value during a one-year

value of which

34

was equal to or greater United

than $1,000, in violation 1029(a) (5). OVERT ACTS

of Title 18,

States Code, Section

47. the illegal

In furtherance thereof,

of the conspiracy the follmdng overt

and to effect acts, among

obj eets

others, were committed elsewhere: a. exchanged HAMMOND online

in the Southern

District

of New York and

On or about December chat messages

26, 2011, HAMMOND

with CC-3 and CC-4, in which had decrypted clients. the

stated that he and his co-conspirators for the user accounts b.

passwords

of 4,500 Stratfor

On or about December chat messages

26, 2011, HAMMOND

exchanged discussed stolen

online

with CC-3 and CC-4, in which they that had been

exploiting

credit card information computer servers.

from Stratfor's (Title 18, United

States Code, Sections COUNT SIX

1029(b) (2).)

(AGGRAVATED

IDENTITY

THEFT)

The Grand Jury further charges: 48. through though The allegations in paragraphs repeated 1 through 6 and 31 as

36 of this Indictment.are fully set forth herein. 49.

and realleged

From at least in or about December

2011, up to

35

and including "Anarchaos," "POW," a/k/a

in or about March 2012, JEREMY HAMMOND, a/k/a "sup g," a/k/a "burn," a/k/a a/k/a

a/k/a a/k/a

"yohoho,"

"tylerknowsthis," "anarchacker,"

"crediblethreat," willfully

a/k/a and

"ghost," a/k/a

the defendant,

knowingly
authority,

did t:ransier, possess,
means of identification to felony violations 1028A(c),

and use, without

lawful
during and

of other persons, enumerated

in relation

in Title 18, United transferred, addresses, and with and

States Code, Section possessed,

to wit, HAMMOND

and used, among other things, names, numbers of other persons to commi~

credit card account his participation substantive

in connection computer

in a conspiracy hacking,

hacking

computer

as charged

in Counts Three and with his fraud as

Four of this Indictment, participation charged

as well as in connection to commit access

in a conspiracy

device

in Count Five of this Indictment. States Code, Sections 1028A and 2.) SIX

(Title 18, united FORFEITURE 50. offenses

ALLEGATION

AS TO COUNTS ONE THROUGH

As a result of committing

one or more of the

alleged

in Counts One through Six of this Indictment, "kayla," a/k/a a/k/a "101," a/k/a DARREN "lolspoon," MARTYN, and HAMMOND, "yohoho," JAKE

RYAN ACKROYD, DAVIS, a/k/a

a/k/a

"topiary," a/k/a

"atopiary," a/k/a

a/k/a

"pwnsauce," DONNCHA a/k/a

"raepsauce," a/k/a

"networkkitten," and JEREMY

O'CEARRBHAIL,

"palladium,"

"Anarchaos,"

a/k/a

"sup_g," a/k/a 36

"burn," a/k/a

a/k/a a/k/a

"POW," a/k/a

"tylerknowsthis," "anarchacker,"

a/k/a

"crediblethreat," shall

"ghost," a/k/a

the defendants, to 18 U.S.C.

forfeit to the United
§

States, pursuant

982(a) (2) (B), any property obtained directly

constituting,

or derived as a result

from, of one or to a sum of

proceeds

or indirectly including

both of the said offenses, money representing

but not limited obtained

the amount of proceeds

as a result

of one or both of the said offenses. SUBSTITUTE 51. property, ASSETS PROVISION forfeitable of the defendants: of due

If any of the above-described

as a result of any act or omission a.

cannot be located upon the exercise

diligence; b. deposited has been transferred or sold to, or

with, a third person; c. has been placed beyond the jurisdiction of

the Court; d. or e. has been commingled without with other property has been substantially diminished in value;

which cannot be subdivided

difficulty; to 18 U.S.C.

it is the intent of the United

States, pursuant

37

§

982(b) (1) and 21 U.S.C.

§

853(p), to-seek forfeiture

of any

other property forfeitable (Title

of said defendants

up to the value of the above

property. 982 (a) (2) (B) and (b) (1), Section 853

PREET BHARARA

United States Attorney

38

Form No. USA-33s-274

(Ed. 9-25-58)

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK UNITED STATES OF AMERICA - v. -

RYAN ACKROYD, JAKE DAVI S, DARREN MARTYN, DONNCHA 0' CEARRBHAIL, and JEREMY HAMMOND, Defendants.

SUPERSEDING

INDICTMENT (LAP)

Sl 12 Cr. 185 18 U.S.C.
§§

10301 1029(b) (2)1 1028A and 2.

PREET BHARARA United States Attorney. A TRUE BILL