ARAD, Romania — He reveled in tormenting members of the Bush family, Colin L. Powell and a host of other prominent Americans, and also in outfoxing the F.B.I. and the Secret Service, foiling their efforts to discover even his nationality, never mind his identity. Early this year, however, the elusive online outlaw known as Guccifer lost his cocky composure and began to panic.
He smashed his hard drive and cellphone with an ax.
That spasm of precautionary destruction, at his home in Romania’s rural Transylvania region, did not help him much — especially as he left pieces of what would later become evidence scattered in the mud.
Two weeks later, on Jan. 22, a global hunt for the celebrated and mysterious hacker who first revealed self-portraits painted by George W. Bush and plundered a trove of personal emails from politicians, military officers and celebrities finally ended in an early morning raid of his home.
“I was expecting them, but the shock was still very big for me,” the hacker, now serving a seven-year sentence, said. He spoke in an interview, his first, at the Arad Penitentiary here. “It is hard to be a hacker, but even harder to erase your tracks.”
In many ways, however, his two-year rampage through the email accounts of rich and powerful Americans showed how easy it can be to go rogue on the Internet and, even when armed with only rudimentary skills, to stay one step ahead of the law, at least for a while.
The hacker who signed off as Guccifer (pronounced GUCCI-fer) — a nom de guerre coined, he said, to combine “the style of Gucci and the light of Lucifer” — turned out to be Marcel-Lehel Lazar, a jobless 43-year-old former taxi driver. He had no expertise in computers, no fancy equipment, only a clunky NEC desktop and a Samsung cellphone, and no special skills beyond what he had picked up on the web.
Viorel Badea, the Romanian prosecutor who directed the case, expressed dismay that Mr. Lazar had gotten so far with so little. “He was not really a hacker but just a smart guy who was very patient and persistent,” Mr. Badea said.
Instead of burrowing into his victims’ email accounts using computer worms and other hacking tools, the prosecutor said, Mr. Lazar trawled the web for information about his targets and then simply guessed the right answers to security questions. “He is just a poor Romanian guy who wanted to be famous,” said the prosecutor, who leads a cybercrime team in Romania’s organized crime unit.
It took six months of trial and error for Mr. Lazar to guess the right answers and gain access to the emails of Corina Cretu, a 47-year-old Romanian politician who sent pictures of herself in a bikini and a flirtatious message to Mr. Powell, the former secretary of state. Mr. Powell, who has denied having an affair with Ms. Cretu, had urged her to delete all their messages after he discovered that his own email account had been hacked.
Mr. Lazar, who is half-Hungarian, acknowledged that he relied mostly on educated guesswork. He said he had no training in computers, though he did work, briefly, in a computer factory. “I got fired after two weeks,” he said.
Continue reading the main story
To cover his tracks, he launched most of his raids through a proxy server in Russia. He figured that would hide any fingerprints leading back to Romania, where he already had a police record. That followed a 2011 conviction for hacking into the email accounts of Romanian starlets and other celebrities under the name Micul Fum, or Little Smoke.
Mr. Lazar was so confident of his ability to elude detection that, late last year, he started boasting of his exploits to The Smoking Gun, an American website that on Jan. 6 posted a defiant email message in broken English from the still unidentified Guccifer: “NO I am not concerned, i think i switch the proxies go to play some backgammon on yahoo watch tv, play with my family and daughter.”
A day later, however, Mr. Lazar got a shock when George Maior, the head of Romania’s domestic intelligence agency, announced that the authorities would soon catch America’s most wanted hacker, a vow that suggested they knew he was in Romania. Mr. Lazar, in his prison interview, said he was also badly shaken by Mr. Maior’s description of him as “Little Guccifer,” which to him indicated that investigators had linked Guccifer with Little Smoke, the pseudonym he used before his 2011 arrest.
Thrown into a panic, he decided it was time to destroy evidence of his hacking and took an ax to his computer and cellphone in his yard in the village of Sambateni, about 11 miles east of Arad, the Transylvanian city where he is now in prison. “I knew they were coming for me,” he recalled. “My sixth sense told me I was surrounded. I was losing control of the situation.”
In reality, the authorities still had little idea who Guccifer was. Mr. Maior, in an interview in Bucharest, the Romanian capital, said he was not aware that Guccifer was the same person as Little Smoke, and had merely called him “little” to “minimize his aura of un-catchability.” The authorities, Mr. Maior said, did not even know at the time that Guccifer was Romanian.
But they had suspected he might be since September, when Guccifer hijacked a personal email account used by Mr. Maior, the security chief, and then used it to send Romanian-language messages to Mr. Maior’s official email account at the Romanian Intelligence Service.
Mr. Maior promptly ordered an investigation. “It was clear he had broken into my email,” Mr. Maior said. “He wanted to prove something. I took it seriously.”
Aided by American investigators, who had been hunting in vain for Guccifer for months, the Romanians quickly homed in on Mr. Lazar, who had left a clumsy trail of clues.
“He made many mistakes,” Mr. Badea, the prosecutor, said.
Mr. Lazar said he could have covered his tracks better if he had had more money — for a more powerful computer, for instance.
“Of course, I could have stolen money from them,” he said, distancing himself from the legions of his countrymen who have made Romania, the second-poorest country in the 28-member European Union, a global leader in Internet fraud. “I didn’t. Not a single dollar.”
Continue reading the main storyContinue reading the main storyContinue reading the main story
An American indictment filed against Mr. Lazar in Virginia in June accused him of trying to extort “money and property by means of materially false and fraudulent representations, pretenses and promises” to his American victims, but Romanian investigators say they found no evidence of extortion.
Romanian officials say the United States has not asked Romania to extradite Mr. Lazar but has sent investigators to question him to learn how he managed to prey on so many powerful Americans. The United States Justice Department declined to comment.
Before agreeing to answer questions from The New York Times in prison, where he shares a cell with four others, including two convicted murderers, he read out a lengthy handwritten statement that he said explained the purpose of his hacking.
A potpourri of conspiracy theories about the terrorist attacks of Sept. 11, 2001, the 1997 death of Princess Diana and alleged plans for a nuclear attack in Chicago in 2015, it said: “This world is run by a group of conspirators called the Council of Illuminati, very rich people, noble families, bankers and industrialists from the 19th and 20th century.”
Mr. Badea, the Romanian prosecutor, scoffed at Mr. Lazar’s fixation on so-called Illuminati as a ruse intended to give a political gloss to a peeping-tom hacking addiction. The hacking exploits that led to his 2011 conviction involved “no Illuminati, just famous and beautiful girls,” the prosecutor said.
Mr. Lazar denied any interest in celebrities, asserting that he had only stumbled on most of the people he hacked as Guccifer, a long list that included the actress Mariel Hemingway, the “Sex and the City” author Candace Bushnell, the editor Tina Brown, the comedian Steve Martin, the author Kitty Kelley and many others.
With no access to a computer in jail, he now pours out his phobias and conspiracy theories in notebooks filled with his small, neat handwriting. “O.K., I broke the law, but seven years in a maximum-security prison? I am not a murderer or a thief,” he said. “What I did was right, of course.”
He smashed his hard drive and cellphone with an ax.
That spasm of precautionary destruction, at his home in Romania’s rural Transylvania region, did not help him much — especially as he left pieces of what would later become evidence scattered in the mud.
Two weeks later, on Jan. 22, a global hunt for the celebrated and mysterious hacker who first revealed self-portraits painted by George W. Bush and plundered a trove of personal emails from politicians, military officers and celebrities finally ended in an early morning raid of his home.
“I was expecting them, but the shock was still very big for me,” the hacker, now serving a seven-year sentence, said. He spoke in an interview, his first, at the Arad Penitentiary here. “It is hard to be a hacker, but even harder to erase your tracks.”
In many ways, however, his two-year rampage through the email accounts of rich and powerful Americans showed how easy it can be to go rogue on the Internet and, even when armed with only rudimentary skills, to stay one step ahead of the law, at least for a while.
The hacker who signed off as Guccifer (pronounced GUCCI-fer) — a nom de guerre coined, he said, to combine “the style of Gucci and the light of Lucifer” — turned out to be Marcel-Lehel Lazar, a jobless 43-year-old former taxi driver. He had no expertise in computers, no fancy equipment, only a clunky NEC desktop and a Samsung cellphone, and no special skills beyond what he had picked up on the web.
Viorel Badea, the Romanian prosecutor who directed the case, expressed dismay that Mr. Lazar had gotten so far with so little. “He was not really a hacker but just a smart guy who was very patient and persistent,” Mr. Badea said.
Instead of burrowing into his victims’ email accounts using computer worms and other hacking tools, the prosecutor said, Mr. Lazar trawled the web for information about his targets and then simply guessed the right answers to security questions. “He is just a poor Romanian guy who wanted to be famous,” said the prosecutor, who leads a cybercrime team in Romania’s organized crime unit.
It took six months of trial and error for Mr. Lazar to guess the right answers and gain access to the emails of Corina Cretu, a 47-year-old Romanian politician who sent pictures of herself in a bikini and a flirtatious message to Mr. Powell, the former secretary of state. Mr. Powell, who has denied having an affair with Ms. Cretu, had urged her to delete all their messages after he discovered that his own email account had been hacked.
Mr. Lazar, who is half-Hungarian, acknowledged that he relied mostly on educated guesswork. He said he had no training in computers, though he did work, briefly, in a computer factory. “I got fired after two weeks,” he said.
Continue reading the main story
To cover his tracks, he launched most of his raids through a proxy server in Russia. He figured that would hide any fingerprints leading back to Romania, where he already had a police record. That followed a 2011 conviction for hacking into the email accounts of Romanian starlets and other celebrities under the name Micul Fum, or Little Smoke.
Mr. Lazar was so confident of his ability to elude detection that, late last year, he started boasting of his exploits to The Smoking Gun, an American website that on Jan. 6 posted a defiant email message in broken English from the still unidentified Guccifer: “NO I am not concerned, i think i switch the proxies go to play some backgammon on yahoo watch tv, play with my family and daughter.”
A day later, however, Mr. Lazar got a shock when George Maior, the head of Romania’s domestic intelligence agency, announced that the authorities would soon catch America’s most wanted hacker, a vow that suggested they knew he was in Romania. Mr. Lazar, in his prison interview, said he was also badly shaken by Mr. Maior’s description of him as “Little Guccifer,” which to him indicated that investigators had linked Guccifer with Little Smoke, the pseudonym he used before his 2011 arrest.
Thrown into a panic, he decided it was time to destroy evidence of his hacking and took an ax to his computer and cellphone in his yard in the village of Sambateni, about 11 miles east of Arad, the Transylvanian city where he is now in prison. “I knew they were coming for me,” he recalled. “My sixth sense told me I was surrounded. I was losing control of the situation.”
In reality, the authorities still had little idea who Guccifer was. Mr. Maior, in an interview in Bucharest, the Romanian capital, said he was not aware that Guccifer was the same person as Little Smoke, and had merely called him “little” to “minimize his aura of un-catchability.” The authorities, Mr. Maior said, did not even know at the time that Guccifer was Romanian.
But they had suspected he might be since September, when Guccifer hijacked a personal email account used by Mr. Maior, the security chief, and then used it to send Romanian-language messages to Mr. Maior’s official email account at the Romanian Intelligence Service.
Mr. Maior promptly ordered an investigation. “It was clear he had broken into my email,” Mr. Maior said. “He wanted to prove something. I took it seriously.”
Aided by American investigators, who had been hunting in vain for Guccifer for months, the Romanians quickly homed in on Mr. Lazar, who had left a clumsy trail of clues.
“He made many mistakes,” Mr. Badea, the prosecutor, said.
Mr. Lazar said he could have covered his tracks better if he had had more money — for a more powerful computer, for instance.
“Of course, I could have stolen money from them,” he said, distancing himself from the legions of his countrymen who have made Romania, the second-poorest country in the 28-member European Union, a global leader in Internet fraud. “I didn’t. Not a single dollar.”
Continue reading the main storyContinue reading the main storyContinue reading the main story
An American indictment filed against Mr. Lazar in Virginia in June accused him of trying to extort “money and property by means of materially false and fraudulent representations, pretenses and promises” to his American victims, but Romanian investigators say they found no evidence of extortion.
Romanian officials say the United States has not asked Romania to extradite Mr. Lazar but has sent investigators to question him to learn how he managed to prey on so many powerful Americans. The United States Justice Department declined to comment.
Before agreeing to answer questions from The New York Times in prison, where he shares a cell with four others, including two convicted murderers, he read out a lengthy handwritten statement that he said explained the purpose of his hacking.
A potpourri of conspiracy theories about the terrorist attacks of Sept. 11, 2001, the 1997 death of Princess Diana and alleged plans for a nuclear attack in Chicago in 2015, it said: “This world is run by a group of conspirators called the Council of Illuminati, very rich people, noble families, bankers and industrialists from the 19th and 20th century.”
Mr. Badea, the Romanian prosecutor, scoffed at Mr. Lazar’s fixation on so-called Illuminati as a ruse intended to give a political gloss to a peeping-tom hacking addiction. The hacking exploits that led to his 2011 conviction involved “no Illuminati, just famous and beautiful girls,” the prosecutor said.
Mr. Lazar denied any interest in celebrities, asserting that he had only stumbled on most of the people he hacked as Guccifer, a long list that included the actress Mariel Hemingway, the “Sex and the City” author Candace Bushnell, the editor Tina Brown, the comedian Steve Martin, the author Kitty Kelley and many others.
With no access to a computer in jail, he now pours out his phobias and conspiracy theories in notebooks filled with his small, neat handwriting. “O.K., I broke the law, but seven years in a maximum-security prison? I am not a murderer or a thief,” he said. “What I did was right, of course.”
Anne New York City
7 years for a prankster, no time for the banksters.
Impedimentus Nuuk
Computer crime is only noteworthy when it is directed at the elites.
Uzi Nogueira Florianopolis, SC
And to think tons of US taxpayers money is being spent to pay for the most expensive hacking system in the world, NSA and Prism.
This Guccifer guy -- unemployed taxi driver turned hacker -- operating a beat up computer in Romania raises an important point. The cyberspace is a target rich environment for asymmetrical warfare. This makes powerful countries vulnerable and backward countries dangerous.
seeing with open eyes usa
I wonder if our government spent as much time and money finding the hackers who got into Home Depot and Target customer accounts as it did to find this guy who uncovered celebrity bad behavior.
Michael Olenick Paris, France
I'd prefer that neither paranoid sociopaths nor paranoid governments spy on me. It's notable that even with billions of dollars in technology the NSA couldn't catch an already known hacker (the Romanians found him) who had little technology, money, training, or resources.
Mike Cornelison The OC
Guccifer gets seven years, still no accountability at the NSA? What Guccifer did was frivolous and miniscule compared to the scale and scope of the NSA collecting all our emails and phone calls. The potential for abuse could make the handful of people J. Edgar Hoover was blackmailing seem quaint by comparison.
Never put your faith in the idea that the data collection of every American citizen is necessary for our security and will only be used for good. If there was any good in our leaders, these enemies of the Fourth Amendment would have already been brought to justice.
Olivier Tucson
This man is a bit of a voyeur to be sure. He attempted no fraud, no theft. He gets 7 years in prison. The bankers who ripped us off got nothing. Sad commentary.
Patrick MacKellan Los Angeles CA
7 years for stealing bikini pictures etc. and doing so using no sophisticated or nefarious techniques. If he has stolen his neighbor's bikini pictures from her email would he have gotten the same jail sentence? You know the answer. He would not even have been prosecuted. Our entire world order does one thing only: protect the elite.
Keith USA
Pity the fool who seeks to torment the rich and powerful.
Murph Eastern CT
The Internet still suffers from a technology that assumes everyone is honest and will treat everyone else honorably--a technology that made at least a little sense before our bank accounts and personal lives became connected to the entire world.
We all need a more secure system. Our social security numbers (or national identity numbers in other countries) can no longer be depended upon to correctly identify us and not someone else. It's uncommonly easy for someone who is up to no good to look up our mother's maiden name, or where we went to high school.
The best we can do for now is invent totally bogus answers (that only we know) to those ubiquitous "security questions" and use those instead of the real answers (and make sure to use different bogus answers for different websites).
Where can I buy stock in the providers of apps that encrypt all those passwords and identity statements under a single (very difficult to crack) password?
jane ny 13
What a asset this man could have been if he had been on the right side of the law. Tenacity, a well-honed sixth sense, intelligence....
Take note America: when we don't value the lives of our children through affordable health care and good education we lose our most valuable assets and feed the underworld.
Gregory Boston
This poor man has a paraphrenia (paranoid but not schizophrenic in the classic sense) - his paranoias are reality based. He is not nefarious, nor evil. It's a shame to see such vigorous responses aimed at this individual when the flaw is systematic. And if anyone is narcissistic, it is those who believe their electronic communications posted in cyberspace are "private".
John O'Hanlon Salt Lake City
"Internet security" is an oxymoron. Everything you do online is subject to "legal hacking" by the government of whatever country you happen to inhabit. From there, the same systems are open to exploit by almost anyone who has the inclination to go for it.
This fellow happens to be one of the few who exposed how easy it is to crack the false patina of security while actually doing no more than disrupting the routines of his targets. His hacks actually were good in the sense that awareness of how stupidly easy it was for him to work may spread into people's minds and they will routinely change their passwords and security answers on those types of accounts with high frequency.
I think all of us are still waiting for the truthful story of how a bunch of people looted the system and brought the U.S. economy to the brink of total collapse in 2008 and simply got away with it. None of those guys have been charged and they have been able to keep the billions they all made prior to the collapse of their real estate shell games.
Meanwhile, this one guy is in prison in Transylvania, of all places, for seven years and the authorities are acting like it's some major breakthrough.
What a joke. One guy.
Hey, by the way - who hacked Target and the Home Depot, oh, and J.P. Morgan Chase?
Right. You don't know.
Steve Austin Hopkinsville KY
We are all so very proud of our intellect and our nation's technologies and our own gadgets. We have such an advanced technological national defense system that we never imagine that we are in any sort of personal danger from anything.
Yet mankind is always one slip, one impulse from barbarism, from the worst cruelties. Stars in our culture are never the religious or the highly educated - they are judged by appearances, pretty words, and being ''edgy.''
Even elitists and their fans smile as a female political candidate, Sarah Palin, is called the worst names in our language. Had she been physically attacked, can we honestly say whether most of our proudly educated ''in crowd'' would have regretted it?
We have outrun our moral headlights in this age. We have pride where we should have self-knowledge, and so when the lure of money and power come around, we jump up and offer ourselves. As Garrison Keillor once said, if pride were kindling, we could heat an entire church in winter.
DD Los Angeles
"An American indictment filed against Mr. Lazar in Virginia in June accused him of trying to extort “money and property by means of materially false and fraudulent representations, pretenses and promises” to his American victims"
There is absolutely ZERO evidence this guy did ANY of that. Such a typically stupid reaction by American prosecutors, who don't need facts or evidence to beat down anyone they set their sights on. Just throw out accusation after accusation, make up 'facts' and 'evidence', then push for a 'deal' so they don't actually have to go to court to prove any of it.
This is how American justice works now - use the might and money of the government to intimidate anyone without the resources to fight back, because when people DO have the resources to fight back, the government almost always loses. Gotta keep that win ratio high to get promotions and raises, which is what it's mostly about.
When prosecutors have skin in the game, there is no justice.
EA Dallas TX
Funny. American intelligence copies all phone calls and internet communication, Yet uneducated hackers can break into G Bush’s and Colin Powell’s emails. Maybe our resources are misplaced. Funny. Too funny. Colin Powell emails Romanian official who send pic of herself in a bikini. Too funny.
Unfunny. Then they file an indictment of extortion when the man never asked for money nor made a $1 off his capers. Too unfunny. Honesty is not in vogue except for the poor & uneducated and slightly disturbed. Punishment, yes but 7 years?
Da click aici ca sa vezi totul!
Niciun comentariu:
Trimiteți un comentariu