Monday, July 28, 2003

Hacker claims he was working for FBI


Feds not talking, but county forging ahead on case

By Dan Horn
The Cincinnati Enquirer

[img]
Jesse Tuttle, a computer hacker better known as 'Hackah Jak.'
(Joseph Fuqua II photo)
| ZOOM |
Jesse Tuttle was sure he had made a good deal two years ago when he agreed to help the government safeguard sensitive computer systems against hackers, thieves and terrorists.

For Tuttle, a computer hacker known around the world as "Hackah Jak," it was the chance of a lifetime.

The deal would help him avoid prosecution on computer hacking charges and would pay him to do something he loves: search the Internet for vulnerable computer systems. If he found one, he says, he wrote a report about it for the FBI in Cincinnati.

"He is a genius with computers," says Tuttle's lawyer, Firooz Namei. "He was basically the eyes and ears of the FBI on this world that no one knows exists."

But Tuttle's Internet sleuthing ended in May, when Hamilton County sheriff's deputies charged the 23-year-old Camp Dennison man with breaking into the county's computer network and accused him of storing child pornography on his home computer.

Tuttle says his work with federal authorities explains everything, and that he was arrested because one government agency didn't know what another was doing.

But the FBI isn't talking and county officials stand by Tuttle's arrest.

Tuttle's case is the product of an intensifying cyber war between hackers and law enforcement officials around the world. It's a high-tech war with high stakes.

The fight will decide who has access to everything from credit card numbers to military secrets to designs for the next generation of space shuttles.

And as Tuttle's case illustrates, it's not always easy to tell the good guys from the bad.

"You never really know what (a hacker's) motives are and who else they may be working with," says Dorothy Denning, a professor at the Naval Postgraduate School who has written about cyber terrorism. "There is some risk involved."

But with the number of computer intrusions nationwide jumping from 22,000 to 82,000 in the past three years, authorities and private companies are increasingly willing to work with hackers like Tuttle in hopes of preventing online attacks.

The trend has sometimes caused disagreements and confusion among law enforcement agencies, as Tuttle claims happened in his case. And it has forced hackers who traditionally guard their independence to choose sides.

Hackers dedicated to making the Internet more secure call themselves "white hats," while those determined to damage or steal from Web sites consider themselves "black hats."

Tuttle refers to himself as a "gray hat," someone who does no serious harm but still enjoys the illicit thrill of cracking a system.

"It's always been like a sport for me," says Tuttle, who is free pending his trial. "Being able to do it, outsmarting the system. ... I find a lot of pleasure in it."

Whatever Tuttle's motives - and whether he was really working for or against the government, or both - his story is a cautionary tale from the front lines of a war most Americans never see.

Contact with the FBI

Tuttle says his motives have been clear since the day he agreed to help the government. He says everything he did - from tapping into computer systems to posing as a teenage girl online - was related to his work with the FBI.

He says he helped make several highly sensitive government networks more secure and, in one case, helped federal agents track a pedophile's online activities.

"I never tried to steal goods or services," Tuttle says. "If I found out about (a vulnerable system), I'd hack the system. If there was a problem ... I'd call the FBI and say there is a hole."

That's what he says he was doing earlier this year when he tapped into the county's Regional Computer Center, which stores electronic versions of court records, property tax information and other data.

Although Tuttle says the FBI never asked him to crack specific systems - including the county's system - he says the agency encouraged his work and paid him up to $1,000 cash at a time for information.

As a matter of policy, FBI officials neither confirm nor deny working with specific informants. But court records and other sources show a link between Tuttle and federal authorities.

Tuttle signed an agreement with federal prosecutors in August 2001 that helped him avoid criminal charges for hacking into the computer system of a New York brokerage firm. Although it was not a formal cooperation agreement, the document states that Tuttle "agreed to provide the government with information."

Tuttle and his lawyer at the time, C. Ransom Hudson, say it was understood that Tuttle would continue to help the FBI. Tuttle has business cards from agents in New York and Cincinnati and says he remained in regular contact.

"They decided to see how he could be useful," Hudson says of the FBI.

He says federal authorities delivered a new CD burner for Tuttle to his law office so the young computer hacker could take it home, copy information that he gathered on the Internet and share it with the FBI.

The CD burner, along with the rest of Tuttle's computer equipment, is now in the hands of sheriff's investigators.

Prosecutor Mike Allen says the man known as Hackah Jak is a criminal, regardless of whatever else he may have been doing. He says he has not yet contacted the FBI about the case.

"We don't know anything about it," Allen says. "We're just concerned about our case."

Namei says the FBI's efforts in the worldwide cyber war will suffer as long as local authorities prosecute his client.

"These charges could be destructive to a relationship that the FBI has nurtured," says Namei, who says he has spoken several times to FBI agents about their work with Tuttle. "

Tuttle says he just wants his name cleared.

He says he knows nothing about child pornography on his computer but speculates it may stem from his work on the pedophile case. And he says his brief invasion of the county's system was typical of his work with the FBI.

Typically, Tuttle learned about potentially vulnerable systems from talking to other hackers online. The only wrinkle this time was that he says he investigated the county's system after a freelance writer asked him whether he thought it might be vulnerable. "I gained access in two seconds," Tuttle says of the county's system.

He says he was preparing a report about it for the FBI at the time of his arrest.

An online celebrity

Even before his arrest, Tuttle had numerous brushes with controversy. Though most know him as a bartender who lives with his parents in Camp Dennison, his alter ego, Hackah Jak, has been an online celebrity for years.

His hacker resume includes raids on Web sites for Sony Corp., Comedy Central and even the Girl Scouts. In each case, he says, he left a calling card but rarely did significant damage.

After cracking a food Web site, for example, he added a series of recipes for meals "you can eat while hacking."

Like many hackers, some of whom have dubbed themselves "hacktivists," Tuttle says there is good in what he does. Hackers can make political statements, he says, and their raids often lead to improvements in computer security.

While that may be true, some experts say, it also may be nothing more than an excuse for bad behavior.

"I think there's a lot of people who say they are hacktivists when in reality they are just interested in sophomoric attempts to get notoriety," says Dan Moniz, a staff technologist with the Electronic Frontier Foundation, a non-profit group dedicated to protecting people's freedoms online.

But Tuttle says he's more interested in hacktivism than showing off.

He points out that Hackah Jak was among the most vocal of the hackers who raided Chinese government Web sites after China seized an American spy plane more than two years ago.

He said he did much the same after the Sept. 11 terrorist attacks when he helped create "The Dispatchers," a group of hackers that targeted government sites in several Middle Eastern countries.

Tuttle says the same sense of patriotism that drove him then was one of the reasons his deal with the FBI was so appealing.

He acknowledges he had another motive, too: The opportunity to avoid criminal charges for hacking the New York brokerage firm.

A risky business

It is that mix of motives that makes any deal with hackers a risky proposition. Hackers, by their very nature, walk a fine line between harmless fun and serious legal trouble.

But as computer crime continues to rise, hackers have found their skills are marketable.

"We won't hire them, but some will," says Peggy Weigle, chief executive officer of Sanctum Inc., a security consulting firm in Santa Clara, Calif. "There is a kind of religious debate about it. Some feel once they do that sort of thing, they've gone too far."

There are risks for hackers, too. While most security work is done with full disclosure to the parties involved, hackers like Tuttle work in a less defined, more dangerous world.

That's because the act of cracking a system is usually a crime, even if the hacker does no harm and later tells the Web site manager how to fix the security breach.

"How that's received depends on who is on the other end," Moniz says. "Some will say 'thanks,' and some will file a lawsuit or criminal charges."

Hamilton County officials have taken the latter approach with Tuttle.

"He didn't do anything malicious. He just got in there," says Ed DePompei, a project manager at the Regional Computer Center. "But if you leave your door open and somebody walks in and sits down in your chair, would you consider that a crime? Just because the door is open, it doesn't mean I'm inviting you in."

Tuttle says he doesn't understand how an act he considers a good deed could be turned into criminal charges and a possible 80 years in prison.

But despite his predicament, he says he is eager to get back online and back into the cyber war.

"The work I do for the FBI," Tuttle says, "I can still do that work for them."

---

Email dhorn@enquirer.com




TOP WEEKEND STORIES
Women take power roles
UC's new leader keeps fast pace, personal touch
UC students: What's your advice for the new president?
Slaying from '80 going to trial

ENQUIRER COLUMNISTS
Radel: Ding-dong! Kids calling
Amos: School expects more
Howard: Some good news

TOP LOCAL NEWS
Hacker claims he was working for FBI
Family of slain pair wants answers
Five plan English Channel swim in honor of their ailing sister
Condon's work sold at auction
City, victims tangle over last month's flooding
They walk each step to freedom
When children need help, she's the problem-solver
Franklin Schools: Bond issue will ease crowding
Christmas tree farms growing
Two Kokomo girls found OK after possible abduction
Drug makers challenge referendum
Tristate A.M. Report

OBITUARY
George J. Wedekind Jr., 80, a leader in aviation

KENTUCKY REPORT
Engineer battalion returns home to a warm welcome
Rangers hired to clean up city park
Kentucky community agenda