by WILLIAM BASTONE
In fact, huddled over his Toshiba laptop, with rock music blaring from his bedroom stereo and Jerry Springer flickering on the TV, the Sheepshead Bay resident looks like any other teenager, albeit one experiencing maximum sensory overload, 1998-style.
But actually Gilson is part of a nationwide networkof teenage computer hackers who have stolen everything from Internet accounts to credit card numbers, a cybergang that has flourished despite a yearlong effort by the FBI to curb this online piracy, the Voice has learned. “I’ve stolen accounts and stuff like that. I didn’t even think it was that big of a deal,” Gilson said. “Everybody does it.”
For months, federal investigators have been serving subpoenas and search warrants at the homes of these young hackers, carting away computers, disks, modems, and other items as parents watch in horror. Agents with the FBI’s computer crimes squad have recently raided homes across the metropolitan area–from Brooklyn to the New Jersey suburbs–as part of a probe into wide-scale credit card fraud and other cybercrimes.
In several instances, agents visited the same residences more than once — first in mid 1997 and then again earlier this year — because some young hackers were undeterred by the federal probe. According to one court record, a hacker recently boasted to a friend that “nothing could be done to him because he was a minor.”
One federal investigator acknowledged that while “it’s tough to prosecute a juvenile,” the FBI is “not always sure you’re gonna find a teenager” at “the end of the string.” The source added, “And if you do, it still doesn’t mean the game is off, because if the damage is severe enough it is still a crime and it’s still a problem.”
Since the probe is ongoing–and every target appears to be underage —
investigators have tried to keep details of the case confidential, including whether any teenagers have been arrested on federal charges. But interviews with several subjects of the criminal inquiry and a confidential FBI document obtained by the Voice provide a detailed look at the current investigation.
The federal probe began last spring, when agents learned of the “massive deployment of a password-stealing program” on the Internet, according to the FBI document. The scheme targeted accounts on America Online (AOL), the nation’s largest online service. AOL is a favorite nesting place for young hackers, who congregate in chat rooms with names like Dead End and Island 55. “Fifteen seems to be the preferred age for an AOL hacker,” said one long-in-the-tooth 18-year-old hacker.
Rich D’Amato, an AOL spokesman, said the service does not comment on specific criminal investigations, but that the company has a “working relationship” with law enforcement agencies “in an effort to combat cybercrime.” D’Amato added that AOL regularly warns its members about password- and credit-card-stealing programs, known online as “Trojan Horses.”
With these stolen passwords, teenagers illegally accessed the accounts of thousands of unsuspecting AOL customers as well as employees of the online giant, sources said. In some instances, hackers were able to access an AOL user’s credit information and order merchandise with the pilfered card number.
Along with password theft, many hackers developed or distributed a separate computer program that hijacked credit card numbers. Variations of that program, designed to look like an official communication from AOL, were e-mailed to thousands of account holders. When AOL customers opened the file, they would receive a message informing them of some type of billing discrepancy and that they needed to resubmit their credit card information. Though it appeared the information had been sent to AOL, carefully cloaked hackers were actually on the receiving end.
Armed with stolen credit card numbers, teenagers would use them to buy merchandise as well as open other Internet accounts. But a favorite prank of many hackers is to use the information for what is known as “carding.”
It seems that every young hacker is a member of a loosely knit online “crew” and within those predominantly male groups everybody has an enemy or two, rivalries formed during chat room sessions filled with insults and put-downs. When one Southern hacker learned that a reporter had met with one of his New York rivals, the teenager had only one question: “Is he fat?” When told that his foe was, in fact, a bit overweight, the teenager whooped, “I knew it!”
Because of these geographic considerations, crew members rarely meet in person to settle their differences. Instead, hackers prefer to “card” their rivals by ordering expensive merchandise with a stolen credit card and having it delivered to their foe’s home. Four teenagers told the Voice that they had been carded, though each denied ever pulling the prank himself.
Paul Lesiak, a 16-year-old known online as Pizza, said he has refused the delivery of a fax machine and dozens of roses sent to his New Jersey home. Bay Ridge’s Alex Berger, 15, also said he turned away flowers and a fax, as well as a refrigerator. Ian Massey, 18, of Louisville, Kentucky, said after a beef with a New Jersey hacker, the teenager “carded a 14-inch dildo to my house.” Joshua Gilson has seen flowers, a fax machine, a microwave oven, and a refrigerator arrive at his apartment door. Gilson, known as Ski, said the Panasonic fax–which he kept–came courtesy of an Illinois hacker with whom he was fighting. After the delivery, Gilson said his rival called him with the taunt, “Hey, Ski, did you like that fax machine?”
Lesiak told the Voice that twice in the last year FBI agents arrived at his Passaic County home to question him and seize computer equipment. While saying that “I didn’t mess with credit cards,” Lesiak admitted authoring a password-stealing program, which he circulated among other hackers. Prior to the FBI’s first visit, in mid 1997, Lesiak said that a friend told him of being questioned by agents. “I got all paranoid, so I killed most of the stuff off my computer,” said the high school sophomore. But when two weeks passed and the FBI had not contacted him, Lesiak said he restored some of the password- stealing programs.
Shortly after he reinstalled the incriminating programs, FBI agent Linda Walsh and a partner arrived at Lesiak’s door asking to examine his computer, a request with which the teen’s parents complied.
A month ago, Walsh returned to Lesiak’s home, this time with a subpoena for his computer equipment. Lesiak was not sure what the FBI was investigating him for this time, and he could not locate his copy of the subpoena (though during a phone interview he did try to locate the document, calling out matter-of-factlyto his mother, “Mom, do you have the subpoena from when the FBI was here?”).
While Lesiak admitted that his heart was in his throat when the agents first showed up at his house, the 16-year-old has gotten a bit bolder. He called Walsh’s FBI partner “a fat idiot. He’s like white trash times three. You’d expect him to have half a brain to be investigating this kind of stuff, but he had no idea what he was talking about.”
Berger also has had two FBI visits and claimed not to go online anymore because “I don’t wanna lose more computers.” The high school sophomore said agents found password stealers on his hard drive and he admitted that a “couple of times” he used stolen credit card numbers to buy merchandise for himself, though he termed that activity “nothing serious.” But by having the merchandise delivered to his home, Berger said, “that’s how I got caught.”
The most recent round of FBI searches in the New York area was apparently triggered by a late-February incident online in which tens of thousands of people nationwide–from Buffalo to Honolulu–received a death threat in their electronic mail.
The trouble started, oddly enough, when Ian Massey called Gilson a “poophead.”
The pair, along with Chris Bladis, a Summit, New Jersey, teen known as K1ng, were in a private chat room at 2 a.m. when they decided to have a three-way telephone conversation. During that talk, Massey and Gilson–both high school dropouts now studying for a GED–traded insults. “I called him a poophead,” Massey said, noting seriously that he used “the old-school
insult . . . because people haven’t heard them in a long time and they don’t quite know how to respond.” Massey said he chose the childish term over “shithead” or “fuckface” because “I get called shithead every day.”
Sitting in his bedroom, Gilson responded by typing out a message that included Massey’s name, address, and home phone number and the threat, “I have your credit card number and all your personal information. Call me right now . . . if you don’t I will kill you and your family.” Gilson, using a stolen AOL account, said he immediately sent the e-mail to more than 1000 addresses.
Gilson said that over the next two days his pal Bladis sent the threatening message to tens of thousands of other e-mail addresses. Bladis’s father Richard said that while the 17-year-old has had his computer equipment seized by the FBI and been the subject of an investigation by U.S. postal inspectors, he doubted that his son was involved in circulating the death threat. The postal probe involved charges that the teenager used stolen credit cards to make purchases. As a result, the elder Bladis said, he was forced–on his son’s behalf–to make restitution totaling “a couple of thousand dollars” for these charges.
One of Bladis’s hacker buddies told the Voice that Bladis was a clearinghouse for stolen credit card numbers, once offering him a file of 16,000 numbers in exchange for some stolen AOL accounts.
After Gilson’s and Bladis’s handiwork, Massey said he was deluged with calls from people asking, “Why did you threaten to kill my family?” The 18-year-old contacted the Louisville FBI office and, within two days, agents executed a search warrant at Gilson’s Brooklyn home, looking for evidence of several federal crimes, including wire fraud and unauthorized access to a computer. During the March 1 raid, investigators seized the 17-year-old’s computer, monitor, two keyboards, and the Panasonic fax machine that was paid for with a stolen credit card.
“Now that I think about it, it was definitely stupid,” Gilson said of his spam (mass e-mail) attack.
Sitting in the apartment he shares with his mother, Gilson, who turned 17 in January, is dressed in a hooded Adidas sweatshirt, a Nike baseball cap, and Nike sneakers. He is wearing two silver hoops in his left ear, one in the lobe, one at the top of his ear. He looks sleepy and explains that he had been out with friends until four in the morning. Getting up for school was not a consideration, though, since he dropped out of the 10th grade last year.
His small bedroom, which looks out onto noisy Avenue U, is dominated by a large graffiti tag on the wall over his single bed. It reads “Ski,” his all-purpose vandalism handle.
The teenager recalled his first encounter with the FBI in early 1997, when agents questioned him about password-stealing programs and credit card fraud. Gilson said he was shocked when agent Walsh showed him a detailed paper trail of his illegal exploits on AOL. “It was sick,” he said. “It was like they’d been stalking me.” Gilson said agents wanted him to cooperate and keep a log of the names, addresses, and phone numbers of other hackers with whom he would subsequently be in contact. He promised to do that, but, Gilson admitted, “I never bothered.”
When agents searched his home in March, Gilson said that he was placed up against the living-room wall and frisked. Agents asked him no questions and left with all of his computer equipment, save two audio speakers. Within weeks, accompanied by a lawyer, he attended a meeting with FBI agents and prosecutor Marcia Isaacson of the major crimes unit of the Manhattan U.S. Attorney’s office. “I had to tell them everything that I knew,” said Gilson.
The teenager said he does not know what, if any, charges he will face. But he expects to make an appearance in federal court soon. “I don’t think they’re sending me to jail. Because, like, for this? I mean, murderers are in jail.”