I. The Bumper
The trip to Delaware was only supposed to last a day. David Pokora, a bespectacled University of Toronto senior with scraggly blond hair down to his shoulders, needed to travel south to fetch a bumper that he’d bought for his souped-up Volkswagen Golf R.
The American seller had balked at shipping to Canada, so Pokora arranged to have the part sent to a buddy, Justin May, who lived in Wilmington. The young men, both ardent gamers, shared a fascination with the inner workings of the Xbox; though they’d been chatting and collaborating for years, they’d never met in person. Pokora planned to induce the eight-hour drive on a Friday, grab a leisurely dinner with May, then haul the metallic-blue bumper back home to Mississauga, Ontario, that night or early the following morning. His father offered to tag along so they could take turns behind the wheel of the family’s Jetta.
An hour into their journey on March 28, 2014, the Pokoras traversed the Lewiston-Queenston Bridge and reached the border checkpoint on the eastern side of the Niagara Gorge. An American customs agent gently quizzed them about their itinerary as he scanned their passports in his booth. He seemed ready to wave the Jetta through when something on his monitor caught his eye.
“What’s … Xenon? ” the agent asked, stumbling over the pronunciation of the word.
David, who was in the passenger seat, was startled by the question. Xenon was one of his online aliases, a pseudonym he often used–along with Xenomega and DeToX–when playing Halo or discussing his Xbox hacking projects with fellow programmers. Why would that nickname, familiar to only a handful of gaming fanatics, pop up when his passport was checked?
Pokora’s puzzlement lasted a few moments before he remembered that he’d named his one-man corporation Xenon Development Studios; the business processed pays for the Xbox service he operated that gave monthly subscribers the ability to unlock accomplishments or skip levels in more than 100 different games. He mentioned the company to the customs agent, constructing sure to emphasize that it was legally registered. The agent instructed the Pokoras to sit tight for only a minute longer.
As he and his father waited for permission to enter western New York, David saw a fluttering of motion behind the idling Jetta. He glanced back and find two men in darknes uniforms approaching the car, one on either side. “Something’s wrong, ” his father said, an instant before a figure appeared outside the passenger-side window. As a voice barked at him to step out of the vehicle, Pokora realized he’d strolled into a trap.
In the detention area of the adjoining US Customs and Border Protection building, an antiseptic room with a lone metal bench, Pokora mulled all the foolish dangers he’d taken while in thrall to his Xbox obsession. When he’d started picking apart the console’s software a decade earlier, it had seemed like harmless fun–a way for him and his friends to match wits with the corporate engineers whose ranks they hankered to join. But the Xbox hacking scene had turned sordid over period, its ethical norms corroded by the allure of money, thrills, and status. And Pokora had gradually become enmeshed in a series of schemes that would have alarmed his younger self: infiltrating game developers’ networks, counterfeiting an Xbox prototype, even abetting a burglary on Microsoft’s main campus.
Pokora had long been aware that his misdeeds had angered some powerful interests, and not just within the gaming industry; in the course of trying out all things Xbox, he and his associates had wormed into American military networks too. But in those early hours after his arrest, Pokora had no clue just how much legal fury he’d brought upon his head: For eight months he’d been under sealed indictment for conspiring to steal as much as$ 1 billion worth of the intellectual property rights, and federal prosecutors were intent on stimulating him the first foreign hacker to be convicted for the stealing of American trade secret. Several of his friends and colleagues would end up being pulled into the vortex of trouble he’d helped create; one would become an informant, one would become a fugitive, and one would end up dead.
Pokora could see his father sitting in a room outside the holding cell, on the other side of a thick glass partition. He watched as a federal agent leaned down to inform the elder Pokora, a Polish-born construction worker, that his only son wouldn’t be returning to Canada for a very long time; his father responded by burying his head in his calloused hands.
Gutted to have caused the usually stoic man such anguish, David wished he could offer some words of convenience. “It’s going to be OK, dad, ” he said in a soft voice, gesturing to get his attention. “It’s going to be OK.” But his father couldn’t hear him through the glass.
II. Kindergarten Security Mistakes
Well before he could read or write, David Pokora mastered the intricacies of first-person shooters. There is a grainy video of him playing Blake Stone: Foreigners of Gold in 1995, his 3-year-old fingers nimbly dancing around the keyboard of his parents’ off-brand PC. What captivated him about the game was not its violence but rather the seem magical of its controls; he “re wondering how” a boxy beige machine could convert his physical actions into onscreen motion. The kid was a born programmer.
Pokora dabbled in coding throughout elementary school, build tools like basic web browsers. But he became wholly enamored with the craft as a preteen on a family trip to Poland. He had lugged his bulky laptop to the sleepy town where his parents’ relatives lived. There was little else to do, so as chickens roamed the yards he passed the time by teaching himself the Visual Basic. NET programming language. The house where he bided had no internet access, so Pokora couldn’t Google for help when his programs spit up faults. But he maintained chipping away at his code until it was immaculate, a labor-intensive process that filled him with unexpected exhilaration. By the time he got back home, he was hooked on the psychological rewards of bending machines to his will.
As Pokora began to immerse himself in programming, his family bought its first Xbox. With its ability to connect to multiplayer conferences on the Xbox Live service and its familiar Windows-derived architecture, the machine built Pokora’s Super Nintendo seem like a relic. Whenever he wasn’t splattering aliens in Halo , Pokora scoured the internet for technological information about his new favorite plaything. His wanders brought him into contact with a community of hackers who were redefining what the Xbox could do.
To divine its secrets, these hackers had cracked open the console’s case and eavesdropped on the data that zipped between the motherboard’s various components–the CPU, the RAM, the Flash chip. This led to the discovery of what the cryptography expert Bruce Schneier termed “lots of kindergarten security mistakes.” For example, Microsoft had left the decryption key for the machine’s boot code lying around in an accessible region of the machine’s memory. When an MIT graduate student named Bunnie Huang located that key in 2002, he devoted his hacker compatriots the power to trick the Xbox into booting up homebrew programs that could stream music, run Linux, or emulate Segas and Nintendos. All they had to do first was tweak their consoles’ firmware, either by soldering a so-called modchip onto the motherboard or loading a hacked game-save file from a USB drive.
Once Pokora hacked his family’s Xbox, he got heavy into tinkering with his cherished Halo . He haunted IRC channels and web forums where the best Halo programmers hung out, poring over tutorials on how to alter the physics of the game. He was soon making a name for himself by writing Halo 2 utilities that allowed players to fill any of the game’s sceneries with digitized water or change blue skies into rain.
The hacking free-for-all ended with the release of the second-generation Xbox, the Xbox 360, in November 2005. The 360 had none of the glaring security flaws of its predecessor, to the chagrin of programmers like the 13 -year-old Pokora who could no longer run code that hadn’t been approved by Microsoft. There was one potential workaround for frustrated hackers, but it required a rare piece of hardware: an Xbox 360 growth kit.
Dev kits are the machines that Microsoft-approved developers use to write Xbox content. To the untrained eye they look like ordinary consoles, but the units contain most of the software integral to the game development process, including tools for line-by-line debugging. A hacker with a dev kit can manipulate Xbox software just like an authorized programmer.
Microsoft sends dev kits merely to rigorously screened game-development companies. In the mid-2 000 s a few kits would occasionally become available when a bankrupt developer dumped its assets in haste, but for the most part the hardware was seldom spotted in the wild. There was one hacker, however, who lucked into a mother lode of 360 dev kits and whose eagerness to earning off his good fortune would help Pokora ascend to the top of the Xbox scene.
III. The Only Education That Mattered
In 2006, while working as a Wells Fargo technology manager in Walnut Creek, California, 38 -year-old Rowdy Van Cleave learned that a nearby recycling facility was selling Xbox DVD drives cheap. When he went to inspect the merchandise, the facility’s owneds mentioned they received regular deliveries of surplus Microsoft hardware. Van Cleave, who’d been part of a venerated Xbox-hacking crew called Team Avalaunch, volunteered to poke around the recyclers’ warehouse and point out any Xbox junk that might have resale value.
After sifting through mountains of Xbox flotsam and jetsam, Van Cleave talked the recyclers into letting him take home five motherboards. When he jacked one of them into his Xbox 360 and booted it up, the screen devoted him the option to activate debugging mode. “Holy shit, ” Van Cleave guessed, “this is a frickin’ dev motherboard! ”
Aware that he had stumbled on the Xbox scene’s equivalent of King Tut’s tomb, Van Cleave cut a deal with the recyclers that let him buy whatever discarded Xbox hardware came their route. Some of these riches he maintained for his own sizable collection or handed out to friends; he once dedicated another Team Avalaunch member a dev kit as a wedding present. But Van Cleave was always on the lookout for paying clients he could trust to be discreet.
The 16 -year-old Pokora became one of those customers in 2008, shortly after meeting Van Cleave through an online friend and impressing him with his technological prowess. In addition to buying kits for himself, Pokora acted as a salesman for Van Cleave, peddling hardware at significant markup to other Halo hackers; he charged around $1,000 per kit, though desperate souls sometimes ponied up as much as $3,000.( Van Cleave denies that Pokora sold kits on his behalf .) He befriended several of his customers, including a guy named Justin May who lived in Wilmington, Delaware.
Now flush with dev kits, Pokora was able to start modifying the recently released Halo 3. He maintained vampire hours as he hacked, coding in a trancelike state that he termed “hyperfocus” until he fell from exhaustion at around 3 or 4 am. He was often late for school, but he shrugged off his slump grades; he considered programming on his dev kit to be the only education that mattered.
Pokora posted snippets of his Halo 3 work on forums like Halomods.com, which is how he came to the attention of a hacker in Whittier, California, named Anthony Clark. The 18 -year-old Clark had experience disassembling Xbox games–reverse-engineering their code from computer language into a programming language. He reached out to Pokora and recommend that they join forces on some projects.
Clark and Pokora grew close, talking nearly every day about programming as well as music, automobiles, and other adolescent fixations. Pokora sold Clark a dev kit so they are unable to hack Halo 3 in tandem; Clark, in turn, dedicated Pokora tips-off on the art of the disassembly. They cowrote a Halo 3 tool that let them endow the protagonist, Master Chief, with special skills–like the ability to jump into the clouds or fire weird missiles. And they logged countless hours playing their hacked creations on PartnerNet, a sandbox version of Xbox Live available only to dev kit owners.
As they released bits and pieces of their software online, Pokora and Clark began to hear from technologists at Microsoft and Bungie, the developer behind the Halo series. The professional programmers offered nothing but praise, despite knowing that Pokora and Clark were using ill-gotten dev kits. Cool, you did a good job of reverse-engineering this , they’d tell Pokora. The encouraging feedback convinced him that he was on an unorthodox path to a career in game development–perhaps the only track available to a construction worker’s son from Mississauga who was no classroom star.
But Pokora and Clark occasionally flirted with darker hijinks. By 2009 the pair was using PartnerNet not only to play their modded versions of Halo 3 but also to swipe unreleased software that was still being tested. There was one Halo 3 map that Pokora snapped a picture of and then shared too liberally with friends; the screenshot wound up getting passed around among Halo fans. When Pokora and Clark next turned over to PartnerNet to play Halo 3 , they encountered a message on the game’s main screen that Bungie engineers had expressly left for them: “Winners Don’t Break Into PartnerNet.”
The two hackers laughed off the warning. They considered their mischief all in good fun–they’d steal a beta here and there, but merely because they loved the Xbox so much , not to enrich themselves. They considered no reason to stop playing cat and mouse with the Xbox pros, whom they hoped to call coworkers some day.
IV. I Mean, It &# x27; s Just Videogames
The Xbox 360 remained largely invulnerable until late 2009, when security researchers ultimately identified a weakness: By affixing a modchip to an arcane decide of motherboard pins used for quality-assurance testing, they managed to nullify the 360 ’s defenses. The hack came to be known as the JTAG, after the Joint Test Action Group, the industry body that had recommended adding the pins to all published circuit board in the mid-1 980 s.
When news of the vulnerability break, Xbox 360 owners rushed to get their consoles JTAGed by services that materialized overnight. With 23 million subscribers now on Xbox Live, multiplayer gaming had become vastly more competitive, and a throng of gamers whom Pokora dubbed “spoiled kids with their parents’ credit cards” were willing to go to extraordinary lengths to humble their rivals.
For Pokora and Clark, it was an opportunity to cash in. They hacked the Call of Duty series of military-themed shooters to create so-called modded lobbies–places on Xbox Live where Call of Duty players could join games governed by reality-bending rules. For fees that ranged up to $ 100 per half-hour, players with JTAGed consoles could participate in death matches while wielding superpowers: They could fly, walk through walls, sprint with Flash-like speed, or shoot bullets that never missed their targets.
For an extra $ 50 to $150, Pokora and Clark also offered “infections”–powers that players’ characters would retain when they joined nonhacked games. Pokora was initially reluctant to sell infections: He knew his turbocharged clients would slaughter their hapless opponents, a situation that struck him as contrary to the spirit of gaming. But then the money started rolling in–as much as $ 8,000 on busy days. There were so many customers that he and Clark had to hire employees to deal with the madness. Swept up in the exhilaration of becoming an entrepreneur, Pokora forgot all about his commitment to fairness. It was one more step down a ladder he barely noticed he was descending.
Microsoft tried to squelch breaches like the Call of Duty cheats by launching an automated system that could detect JTAGed consoles and banning them. But Pokora reverse-engineered the system and devised a way to beat it: He wrote a programme designed that hijacked Xbox Live’s security queries to an area of the console where they could be filled with false data, and thus be deceived into certifying a hacked console.
Pokora reveled in the perks of his success. He still lived with his mothers, but he paid his tuition as he entered the University of Toronto in the autumn of 2010. He and his girlfriend dined at upscale eateries every night and bided at $400 -a-night hotels as they traveled around Canada for metal displays. But he wasn’t genuinely in it for the money or even the adulation of his peers; what he most coveted was the sense of glee and power he derived from constructing $60 million games behave however he wished.
Pokora knew there was a whiff of the illegal about his Call of Duty business, which violated numerous copyrights. But he construed the lack of meaningful pushback from either Microsoft or Activision, Call of Duty ’s developer, as a sign that the companies would tolerate his enterprise, much as Bungie had put up with his Halo 3 shenanigans. Activision did send a series of cease-and-desist letters, but the company never followed through on its threats.
“I mean, it’s only videogames, ” Pokora told himself whenever another Activision letter arrived. “It’s not like we’re hacking into a server or stealing anyone’s information.” That would come soon enough.
Dylan Wheeler, a hacker in Perth, Australia, whose alias was SuperDaE, knew that something juicy had fallen into his lap. An American friend of his who went by the name Gamerfreak had slipped him a password list for the public forums operated by Epic Games, a Cary, North Carolina, game developer known for its Unreal and Gears of War series. In 2010 Wheeler started poking around the forums’ accounts to see if any of them belonged to Epic employees. He eventually identified a member of the company’s IT department whose employee email address and password appeared on Gamerfreak’s list; rummaging through the man’s personal emails, Wheeler observed a password for the purposes of an internal EpicGames.com account.
Once he had a toehold at Epic, Wheeler wanted a talented partner to help him sally deeper into the network. “Who is big enough to be interested in something like this? ” he wondered. Xenomega–David Pokora–whom he’d long admired from afar and was eager to befriend, was the first name that popped to mind. Wheeler cold-messaged the Canadian and offered him the chance to get inside one of the world’s preeminent game developers; he didn’t mention that he was only 14, fearing that his age would be a deal breaker.
What Wheeler was proposing was substantially shadier than anything Pokora had attempted before: It was one thing to download Halo maps from the semipublic PartnerNet and quite another to break into a fortified private network where a company stores its most sensitive data. But Pokora was overwhelmed by curiosity about what software he might unearth on Epic’s servers and titillated by the prospect of reverse-engineering a trove of top-secret games. And so he rationalized what he was about to do by setting ground rules–he wouldn’t take any credit card numbers, for example , nor peek at personal information about Epic’s customers.
Pokora and Wheeler combed through Epic’s network by masquerading as the IT employee whose login credentials Wheeler had compromised. They situated a plugged-in USB drive that keep all of the company’s passwords, including one that gave them root access to the entire network. Then they pried into the computers of Epic bigwigs such as design director Cliff “CliffyB” Bleszinski; the pair chortled when they opened a music folder that Bleszinski had made for his Lamborghini and insured that it contained lots of Katy Perry and Miley Cyrus tunes.( Bleszinski, who left Epic in 2012, corroborates the hackers’ account, adding that he’s “always been public and forthright about my taste for bubblegum pop.”)
To exfiltrate Epic’s data, Wheeler enlisted the help of Sanadodeh “Sonic” Nesheiwat, a New Jersey gamer who possessed a hacked cable modem that could obfuscate its place. In June 2011 Nesheiwat downloaded a prerelease transcript of Gears of War 3 from Epic, along with hundreds of gigabytes of other software. He burned Epic’s source code onto eight Blu-ray discs that he shipped to Pokora in a package marked wedding videos. Pokora shared video games with several friends, including his dev kit customer Justin May; within days a transcript depicted up on the Pirate Bay, a notorious BitTorrent site.
The Gears of War 3 leak triggered a federal investigation, and Epic began working with the FBI to determine how its security had been breached. Pokora and Wheeler found out about the nascent probe while read Epic’s emails; they freaked out when one of those emails described a meeting between the company’s brain trust and FBI agents. “I need your help–I’m going to get arrested, ” a panicked Pokora wrote to May that July. “I need to encrypt some hard drives.”
But the email chatter between Epic and the FBI quickly died down, and the company built no apparent effort to block the hackers’ root access to the network–a sign that it couldn’t pinpoint their means of entry. Having survived their first brush with the law, the hackers felt emboldened–the brazen Wheeler most of all. He maintained trespassing on sensitive the sector of Epic’s network, building few efforts to conceal his IP address as he snooped on high-level corporate sessions through webcams he’d commandeered. “He knowingly logs into Epic knowing that the feds chill there, ” Nesheiwat told Pokora about their Australian partner. “They were emailing FBI people, but he still manages to not care.”
Owning Epic’s network devoted the hackers entree to a slew of other organizations. Pokora and Wheeler came across login credentials for Scaleform, a so-called middleware company that provided technology for the engine at the heart of Epic’s games. Once they’d broken into Scaleform, they discovered that the company’s network was full of credentials for Silicon Valley titans, Hollywood entertainment conglomerates, and Zombie Studios, the developer of the Spec Ops series of games. On Zombie’s network they uncovered remote-access “tunnels” to its clients, including branches of the American military. Wriggling through those poorly secured passageways was no great challenge, though Pokora was wary of leaving behind too many digital tracks. “If they notice any of this, ” he told the group, “they’re going to come looking for me.”
As the scale of their enterprise increased, the hackers discussed what they should do if the FBI came knocking. High off the feeling of omnipotence that came from burrowing into supposedly impregnable networks, Pokora proposed releasing all of Epic’s proprietary data as an act of revenge: “If we ever go disappearing, merely, you know, upload it to the internet and say fuck you Epic.”
The group also cracked jokes about what they should call their prison gang. Everyone excavate Wheeler’s tongue-in-cheek suggestion that they could strike fear into other inmates’ hearts by dubbing themselves the Xbox Underground.
VI. How Do We End It?
Pokora was becoming ever more infatuated with his forays into corporate networks, and his old friends from the Xbox scene dreaded for his future. Kevin Skitzo, a Team Avalaunch hacker, recommended him to pull back from the abyss. “Dude, just stop this shit, ” he implored Pokora. “Focus on school, because this shit? I entail, I get it–it’s a high. But as technology progresses and law enforcement gets more aware, you can only dodge that bullet for so long.”
But Pokora was too caught up in the thrill of stockpiling forbidden software to heed this advice. In September 2011 he stole a prerelease transcript of Call of Duty : Modern Warfare 3. “Let’s get arrested, ” he quipped to his friends as he started the download.
Though he was turning cocky as he swung from network to network without consequence, Pokora still took pride in how little he cared about money. After seizing a database that contained “a fuckton of PayPals, ” Pokora sang his own praises to his associates for resisting the temptation to profit off the accounts. “We could already have sold them for Bitcoins which would have been untraceable if we did it right. It could have already been easily an easy fifty grand.”
But with each passing week, Pokora became a little bit more mercenary. In November 2011, for example, he asked his friend May to broker a deal with a gamer who went by Xboxdevguy, who’d conveyed an interest in buying prerelease games. Pokora was willing to deliver any titles Xboxdevguy desired for a few hundred dollars each.
Pokora’s close relationship with May induced his hacker cohorts uneasy. They knew that May had been arrested at a Boston gaming convention in March 2010 for trying to download the source code for the first-person shooter Breach. A spokesperson for the game’s developer told the tech blog Engadget that, upon being caught after a brief foot chase, May had said he “could dedicate us bigger and more important people and he could’ name names.’” But Pokora trusted May because he’d watched him participate in many crooked endeavors; he couldn’t imagine that anyone in cahoots with law enforcement would be allowed to do so much dirt.
By the springtime of 2012, Pokora and Wheeler were focused on pillaging the network of Zombie Studios. Their crew now included two new faces from the scene: Austin “AAmonkey” Alcala, an Indiana high school kid, and Nathan “animefre4k” Leroux, the homeschooled son of a diesel mechanic from Bowie, Maryland. Leroux, in particular, was an exceptional talent: He’d cowritten a program that could trick Electronic Arts’ football game FIFA 2012 into minting the virtual coins that players get for completing matches, and which are used to buy character upgrades.
While navigating through Zombie’s network, the working group stumbled on a tunnel to a US Army server; it contained a simulator for the AH-6 4D Apache helicopter that Zombie was developing on a Pentagon contract. Ever the wild man, Wheeler downloaded the software and told his colleagues they should “sell the simulators to the Arabs.”
The hackers were also busy tormenting Microsoft, stealing documents that contained specs for an early version of the Durango, the codename for the next-generation Xbox–a machine that would come to be known as the Xbox One. Rather than sell the documents to a Microsoft competitor, the hackers opted for a more byzantine strategy: They would counterfeit and sell a Durango themselves, utilizing off-the-shelf components. Leroux volunteered to do the assembly in exchange for a cut of the proceeds; he needed money to pay for online computer science classes at the University of Maryland.
The hackers put under feelers around the scene and received a buyer in the Seychelles who was willing to pay $ 5,000 for the forgery console. May picked up the completed machine from Leroux’s house and promised to ship it to the archipelago in the Indian Ocean.
But the Durango never arrived at its destination. When the buyer complained, paranoia set in: Had the FBI intercepted the shipment? Were they now all under surveillance?
Wheeler was especially unsettled: He’d supposed the crew was untouchable after the Epic investigation appeared to stall, but now he felt certain that everyone was about to get hammered by a racketeering instance. “How do we end this game? ” he asked himself. The answer he came up with was to go down in a blaze of glory, to do things that would ensure his place in Xbox lore.
Wheeler launched his campaign for notoriety by posting a Durango for sale on eBay, use photographs of the one that Leroux had constructed. The bidding for the nonexistent machine reached $20,100 before eBay canceled the auction, declaring it fraudulent. Infuriated by the media attention the saga made, Pokora cut off contact with Wheeler.
A few weeks later, Leroux faded from the scene; rumors swirled that he’d been raided by the FBI. Americans close to Pokora began to tell him they were being tailed by black automobiles with tinted windows. The hackers suspected there might be an informant in their midst.
VII. Person A
The relationship between Pokora and Clark soured as Pokora get deeper into hacking developers. The two finally fell out over staffing issues at their Call of Duty business–for example, they hired some workers whom Pokora considered greedy, but Clark refused to call them out. Sick of dealing with such friction, both men drifted into other ventures. Pokora focused on Horizon, an Xbox cheating service that he built on the side with some friends; he liked that Horizon’s cheats couldn’t be used on Xbox Live, which entailed fewer potential technological and legal headaches. Clark, meanwhile, refined Leroux’s FIFA coin-minting technology and started selling the virtual currency on the black market. Austin Alcala, who’d participated in the hack of Zombie Studios and the Xbox One counterfeiting caper, worked for Clark’s new venture.
As the now 20 -year-old Pokora split his energies between helping to run Horizon and attending university, Wheeler continued his kamikaze quest for attention. In the wake of his eBay stunt, Microsoft sent a private investigator named Miles Hawkes to Perth to confront him. Wheeler posted on Twitter about session “Mr. Microsoft Man, ” who pressed him for information about his collaborators over lunch at the Hyatt. According to Wheeler, Hawkes told him not to worry about any legal repercussions, as Microsoft was only interested in going after “real assholes.”( Microsoft denies that Hawkes said this .)
In December 2012 the FBI raided Sanadodeh Nesheiwat’s home in New Jersey. Nesheiwat posted an unredacted version of the search warrant online. Wheeler reacted by doxing the agents in a public forum and encouraging people to harass them; he also spoke openly about hiring a hitman to slaying the federal judge who’d signed the warrant.
Wheeler’s bizarre compulsion to escalate every situation alarmed federal prosecutors, who’d been carefully building a lawsuit against the hackers since the Gears of War leak in June 2011. Edward McAndrew, the deputy US attorney who was resulting the investigation, felt he needed to accelerate the pace of his team’s work before Wheeler triggered real violence.
On the morning of February 19, 2013, Wheeler was working in his family’s home in Perth when he noticed a din in the yard below his window. A phalanx of men in light tactical gear was approaching the house, Glocks holstered by their sides. Wheeler scrambled to shut down all of his computers, so that whoever would be dissecting his hardware would at least have to crack his passwords.
Over the next few hours, Australian police carted away what Wheeler estimated to be more than $ 20,000 worth of computer equipment; Wheeler was miffed that no one bothered to place his precious hard drives in antistatic containers. He wasn’t jailed the working day, but his hard drives yielded a bounty of incriminating evidence: Wheeler had taken frequent screenshots of his hacking exploits, such as a chat in which he proposed running “some crazy program to fuck the fans up” on Zombie Studios’ servers.
That July, Pokora told Justin May he was about to attend Defcon, the annual hacker collecting in Las Vegas–his first journey across the border in years. On July 23, McAndrew and his colleagues filed a sealed 16 -count indictment against Pokora, Nesheiwat, and Leroux, charging them with crimes including wire fraud, identify theft, and conspiracy to steal trade secret; Wheeler and Gamerfreak, the original source of the Epic password list, were named as unindicted coconspirators.( Alcala would be added as a defendant four months later .) The document revealed that much of the government’s case was built on evidence supplied by an informant referred to as Person A. He was described as a Delaware resident who had picked up the counterfeit Durango from Leroux’s house, then handed it over to the FBI.
Prosecutors also characterized the defendants as members of the “Xbox Underground.” Wheeler’s prison-gang joke was a joke no longer.
The hackers cracked jokes about what they should call their prison gang. Everyone dug Wheeler &# x27; s tongue-in-cheek suggestion that they could strike fear into the hearts of other inmates by dubbing themselves the Xbox Underground.
Though he knew nothing about the secret indictment, Pokora was too busy to go to Defcon and pulled out at the last minute. The FBI worried that arresting his American coconspirators would spur him to go on the lam, so the agency decided to wait for him to journey south before rolled up the crew.
Two months later, Pokora went to the Toronto Opera House for a reveal by the Swedish metal band Katatonia. His phone buzzed as a warm-up act was tearing through a song–it was Alcala , now a high school senior in Fishers, Indiana. He was tittering with exhilaration: He said he knew a guy who could get them both the latest Durango prototypes–real ones , not counterfeits like the machine they’d made the summer before. His connection was willing to break into a building on Microsoft’s Redmond campus to steal them. In exchange, the burglar was demanding login credentials for Microsoft’s game developer network plus a few thousand dollars. Pokora was baffled by the aspiring burglar’s audacity. “This guy’s stupid, ” he guessed. But after years of pushing his luck, Pokora was no longer in the habit of listening to his own common sense. He told Alcala to put them in touch.
The burglar was a recent high school graduate named Arman, known on the scene as ArmanTheCyber.( He agreed to share his story on the condition that his last name not be used .) A year earlier he’d cloned a Microsoft employee badge that belonged to his mother’s boyfriend; he’d been using the RFID card to explore the Redmond campus ever since, passing as an employee by dressing head to toe in Microsoft swag.( Microsoft claims he didn’t copy the badge but rather stole it .) The 18 -year-old had already stolen one Durango for personal employ; he was nervous about going back for more but also brimming with the recklessness of youth.
Around 9 pm on a late September night, Arman swiped himself into the building that housed the Durangos. A few engineers were still roaming the hallways; Arman dove into a cubicle and hid whenever he heard footsteps. He eventually climbed the stairs to the fifth floor, where he’d heard there was a cache of Durangos. As he started to stimulate his style into the darkened floor, motion detectors sensed his presence and light inundated the room. Spooked, Arman bolted back downstairs.
He finally procured what he was looking for in two third-floor cubicles. One of the Durangos had a pair of stiletto heels atop the case; Arman set the two consoles in his oversize backpack and left the fancy shoes on the carpet.
A week after he sent the stolen Durangos to Pokora and Alcala, Arman received some surprising news: A Microsoft vendor had finally reviewed an employment application he’d submitted that summer and hired him as a quality-assurance tester. He lasted only a couple weeks on the number of jobs before examiners identified him as the Durango thief; a stairwell camera had caught him leaving the building. To minimise the legal fallout, he implored Pokora and Alcala to send back the theft consoles. He also returned the Durango he’d taken for himself, and not a moment too soon: Jealous hackers had been scoping out his house online, as a prelude to executing a robbery.
Pokora spent all wintertime hacking the Xbox 360 ’s games for Horizon. But as Toronto was beginning to thaw out in March 2014, he figured he could spare a weekend to drive down to Delaware and pick up the bumper he’d ordered for his Volkswagen Golf.
“Y’know, there’s a chance I could get arrested, ” he told his dad as they prepared to leave. His father had no idea what he was talking about and cracked a thin smile at what was surely a bad joke.
VIII. “This Life Ain &# x27; t For You”
After an initial appearance at the federal courthouse in Buffalo and a few days in a nearby county incarcerate, Pokora was loaded onto a van alongside another federal inmate, a gang member with a powerlifter’s arms and no discernible neck. They were being transported to a private prison in Ohio, where Pokora would be held until the court in Delaware was ready to start its proceedings against him. For kickings, he says, the guards tossed the prisoners’ sandwiches onto the floor of the van, knowing that the tightly shackled humen couldn’t reach them.
During the three-hour journey, the gang member, who was serving time for beating a human with a hammer, counseled Pokora to do whatever was necessary to minimize his time behind bars. “This life ain’t for you, ” he said. “This life ain’t for nobody, really.”
Pokora took those words to heart when he was finally brought to Delaware in early April 2014. He speedily accepted the plea deal that was offered, and he helped the victimized companies identify the vulnerabilities he’d exploited–for example, the softly protected tunnels that let him hopscotch among networks. As he sat in rooms and listened to Pokora explain his hackers with professorial panache, McAndrew, the lead attorney, took a glisten to the now 22 -year-old Canadian. “He’s a very talented kid who started down a bad route, ” he says. “A lot of periods when you’re investigating these things, you have to have a certain level of admiration for the grandeur and creativity of the work. But then you kind of step back and say,’ Here’s where it went wrong.’”
One day, on the way from jail to tribunal, Pokora was placed in a marshal’s vehicle with someone who appeared familiar–a pale 20 -year-old guy with a wispy build and teeth marred by a Skittles habit. It was Nathan Leroux, whom Pokora had never met in person but recognized from a photo. He had been arrested on March 31 in Madison, Wisconsin, where he’d moved after the FBI raid that had scared him into dropping out of the Xbox scene. He’d been flourishing in his new life as a programmer at Human Head Studios, a small game developer, when the feds showed up to take him into custody.
As he and Leroux rode to court in shackles, Pokora tried to pass along the gang member’s advice. “Look, a lot of this was escalated because of DaE–DaE’s an asshole, ” he said, utilizing the shorthand of Wheeler’s nickname, SuperDaE. “You can rat on me or do whatever, because you don’t deserve this shit. Let’s merely do what we got to do and get out of here.”
Unlike Pokora, Leroux was granted bail and was allowed to live with his mothers as his case progressed. But as he persisted at his Maryland home, he grew convinced that, devoted his diminutive stature and shy nature, he was doomed to be raped or murdered if he went to prison. His fear became so overwhelming that, on June 16, he clipped off his ankle monitor and fled.
He paid a friend to try to smuggle him into Canada, nearly 400 miles to the north. But their long drive ended in futility: The Canadians flagged the car at common borders. Rather than been recognized that his escape had failed, Leroux pulled out a knife and tried to sprint across the bridge onto Canadian clay. When policemen surrounded him, he decided he had just one alternative left: He stabbed himself multiple times. Doctors at an Ontario hospital managed to save his life. Once he was released from intensive care and transported back to Buffalo, his bail was revoked.
When it came time for Pokora’s sentencing, his attorney argued for leniency by contend that his client had lost the ability to differentiate play from crime. “David in the real world was something else wholly from David online, ” he wrote in his sentencing memo. “But it was in this tenebrous world of anonymity, frontier rules, and private communication set at a remove from everyday life that David was incrementally desensitized to an online culture in which the line between playing a videogame and hacking into a computer network narrowed to the vanishing point.”
After pleading guilty, Pokora, Leroux, and Nesheiwat ultimately received similar penalties: 18 months in prison for Pokora and Nesheiwat, 24 months for Leroux. Pokora did the majority of his time at the Federal Detention Center in Philadelphia, where he made use of the computer room to send emails or listen to MP3s. Once, while waiting for a terminal to open up, a mentally unstable inmate get in his face, and Pokora defended himself so he wouldn’t seem weak; the brawl objective when a guard explosion him with pepper spray. After finishing his prison sentence, Pokora expended several more months awaiting deportation to Canada in an immigration detention facility in Newark, New Jersey. That jail had PCs in the law library, and Pokora got to use his hacker skills to find and play a hide version of Microsoft Solitaire .
When he ultimately returned to Mississauga in October 2015, Pokora texted his old friend Anthony Clark, who was now facing a legal predicament of his own. Alcala had told the government all about Clark’s FIFA coin-minting operation. The enterprise had already been on the IRS’s radar: One of Clark’s workers had come under suspicion for withdrawing as much as $ 30,000 a day from a Dallas bank account. Alcala connected the dots for the feds, explaining to them that the business could fool Electronic Arts’ servers into spitting out thousands of coins per second: The group’s code automated and accelerated FIFA ’s gameplay, so that more than 11,500 matches could be completed in the time it took a human to finish merely one. The datum he provided led to the indictment of Clark and three others for wire fraud; they had allegedly grossed $16 million by selling the FIFA coins, primarily to a Chinese businessman they knew only as Tao.
Though Clark’s three codefendants had all pleaded guilty, he was intent on going to trial. He felt that he had done nothing wrong, especially since Electronic Arts’ terms of service state that its FIFA coins have no real value. Besides, if Electronic Art executives were really upset about his operation, why didn’t they reach out to discuss the matter like adults? Perhaps Electronic Arts was just jealous that he–not they–had figured out how to generate revenue from in-game currencies.
“Yeah, I’m facing 8+ years, ” Clark wrote in a text to Pokora. “And if I take the plea 31/2. Either way fuck them. They keep trying to get me to plea.”
“They roof you if you fail at trial, ” Pokora cautioned. “My only concern is to educate you a bit about what it will be like. Because it’s a shitty thing to go through.” But Clark wouldn’t be swayed–he was a man of principle.
That Fourth of July, Pokora wrote to Clark again. He jokingly asked why Clark hadn’t yet sent him a custom video that he’d requested: Clark and his Mexican-American relatives dancing to salsa music beneath a Donald Trump pinata. “Where’s the salsa? ” Pokora asked.
The reply came back: “On my chips, ” followed by the smiling-face-with-sunglasses emoji. It was the last time Pokora ever heard from his Halo 3 comrade.
Clark’s trial in federal district tribunal in Fort Worth that November did not go as he had hoped: He was convicted on one count of conspiracy to perpetrate wire scam. His attorneys thought he had excellent grounds for appeal, since they believed that the prosecution had failed to prove the FIFA coin business had caused Electronic Arts any actual harm.
But Clark’s legal team never got the chance to attain that case. On February 26, 2017, about a few months before he was scheduled to be sentenced, Clark died in his Whittier home. People close to his family insist that the demise was accidental, the outcome of a lethal interaction between alcohol and medication. Clark had just turned 27 and left behind an estate valued at more than$ 4 million.
IX. “I Wanted to See How Far It Could Go”
The members of the Xbox Underground have readjusted to civilian life with varying degrees of success. In exchange for existing cooperation, Alcala received no prison time; he enrolled at Ball State University and constructed the dean’s list. The 20 -year-old brought his girlfriend to his April 2016 sentencing hearing–“my first real girlfriend”–and spoke about a talk he’d given at an FBI conference on infrastructure protection. “The world is your oyster, ” the judge told him.
Leroux’s coworkers at Human Head Studios send letters to the court on his behalf, commending his intelligence and kindness. “He has a very promising game development career ahead of him, and I wouldn’t think he’d ever again risk hurling that away, ” one supporter wrote. On his release from prison, Leroux returned to Madison to rejoin the company.
Nesheiwat, who was 28 at the time of his arrest, did not fare as well as his younger colleagues. He fought with addiction and was rearrested last December for infringing his probation by use cocaine and opiates; his probation officer said he’d “admitted to doing up to 50 bags of heroin per day” before his most recent stint in rehab.
Because Wheeler had been a juvenile when most of the hacking resulted, the US decided to leave his prosecution to the Australian authorities. After being given 48 hours to turn in his passport, Wheeler drove straight to the airport and absconded to the Czech Republic, his mother’s native land. The Australians imprisoned his mother for aiding his escape, presumably to pressure him into returning home to face justice.( She has since been released .) But Wheeler elected to remain a fugitive, drifting through Europe on an EU passport before eventually settling in the UK. During his travellings he tried to crowdfund the purchase of a $500,000 Ferrari, explaining that his doctor said he needed the car to cope with the anxiety caused by his legal travails.( The campaign did not succeed .)
“I never meant for it to get as bad as it did, ” Pokora says.
Pokora, who is now 26, was disoriented during his first months back in Canada. He feared that his brain had permanently rotted in prison, a place where intellectual stimulation is in short supply. But he reunited with his girlfriend, whom he’d prayed to leave him while he was behind bars, and he reenrolled at the University of Toronto. He scraped together the tuition by taking on freelance projects programming user-interface automation tools; his fiscal conflicts constructed him nostalgic for the days when he was rolling in Call of Duty cash.
When he learned of Clark’s death, Pokora briefly felt renewed bitterness toward Alcala, who’d been instrumental to the government’s case against his friend. But he let the rage pass. There was nothing to be gained by hold a rancour against his onetime fellow travelers. He couldn’t even work up much rancor against Justin May, whom he and many others are certain was the Delaware-based FBI informant identified as Person A in the Xbox Underground indictment.( “Can’t comment on that, sorry, ” May responded when asked whether he was Person A. He is currently being prosecuted in the federal district of eastern Pennsylvania for victimizing Cisco and Microsoft out of millions of dollars’ worth of hardware .)
Pokora still struggles to understand how his love for programming warped into an obsession that knocked his moral compass so far askew. “As much as I consciously built government decisions I did, I never meant for it to get as bad as it did, ” he says. “I mean, I wanted access to companies to read some source code, I wanted to learn, I wanted to see how far it could go–that was it. It was genuinely only intellectual curiosity. I didn’t want money–if I wanted money, I would’ve taken all the money that was there. But, I mean, I get it–what it turned into, it’s regrettable.”
Pokora knows he’ll forever be persona non grata in the gaming industry, so he’s been looking elsewhere for full-time employment since finishing the classwork for his computer science degree last June. But he’s had a tough time putting together a portfolio of his best work: At the behest of the FBI, Canadian authorities confiscated all of the computers he’d owned prior to his arrest, and most of the software he’d created during his Xbox heyday was lost forever. They did let him keep his 2013 Volkswagen Golf, however, the car he adores so much that he was willing to drive to Delaware for a bumper. He maintains it parked at his parents’ house in Mississauga, the place where he played his first game at the age of 2, and where he’s lived ever since leaving prison.
This article appears in the May issue. Subscribe now .
Listen to this story, and other WIRED features, on the Audm app .
Behind the Hacks
- How a dormitory room Minecraft scam brought down the internet
- Inside an epic hotel room hacking spree
- You have to hack this massively multiplayer game to beat it