April 19, 2015

#21 Hack The Police

by Reply All

Background show artwork for Reply All

When Higinio Ochoa got out of prison for hacking in September of 2014, one of the terms of his parole was that he is not allowed to use any internet connected device. We went to his home in Austin to find out how he got caught and what it's like - in 2015 - to go from living online to not having any internet access. Next week we celebrate Email Debt Forgiveness Day! Leave us a voicemail at (917) 475-6668 about your most anxiety inducing unanswered email. All will be forgiven, we promise. 


The Facts:
Our theme song and scoring is from 

Breakmaster Cylinder. Ad music is by Build Buildings




Further Reading

Our article about Higinio Ochoa at Digg.com.

Transcript

PJ VOGT: Hey Matt Lieber, Gimlet co-founder, can I interrupt you for a sec?

MATT LIEBER: Okay.

PJ: So, we have a bunch of cursing in this week's episode and we were just quickly trying to figure out whether you thought we should do a language advisory.

MATT: Like, F S C B type cursing?

PJ: Yeah. F S C B type cursing.

MATT: Yes, you should do a language advisory.

PJ: You've been advised.

PJ: Hey, Alex.

ALEX GOLDMAN: Hi.

PJ: So besides us having an episode this week, you know what else is happening?

ALEX: I think I can guess, but I'm excited to hear you say it.

PJ: No, if you know it, you've got to tell me.

ALEX: Oh, it's the new season of StartUp premieres Thursday, the day after this releases, probably hours after this releases. We tend to release our episodes pretty late at night.`

PJ: StartUp, as a lot of Reply All listeners probably know, is a podcast mini-series that documents companies as they're starting. We've heard a lot of the second season. It's amazing. We're also very excited because the second season is not about Gimlet, where we work. It's about another company.

ALEX: I know, that takes a considerable burden off of us.

PJ: There have been like unrecorded moments that have happened at Gimlet in the past few weeks and it has felt very nice.

ALEX: But don't worry everybody, we're getting sleep now. And PJ's foot fungus has cleaned up.

PJ: Possibly. So, Caitlin gave us this clip from the new season, as with Alex Blumberg, the women at the company that Lisa profiled had to pitch their company to outside investors. Unlike with Alex, some of those investors sounded kind of terrible.

WOMAN: He said something like, “I have so much to say but I'll spare you and just say that I wish I could take a shit on your company. It shouldn't exist.”

PJ: Anyway, that's StartUp. Alex?

ALEX: Yeah?

PJ: Oh man you were so looking at your phone.

ALEX: No, I'm paying attention.

MAN: He's playing a video game.

PJ: Are you seriously playing a video game?

ALEX: No.

PJ: Alex, don't do that shit. It is rude in such a profound way. Okay, you don't look ashamed enough... Okay, that's better. I was going to ask you about your story, but now I just don't want to. I want to make you sit here for 20 minutes... You're still looking at your video game.

ALEX: No, no, no I'm looking at the script.

PJ: Alex...

ALEX: I'm actually very embarrassed.

PJ: Good. Okay. Alex, you went to Austin last week.

ALEX: Yeah.

PJ: How come?

ALEX: I went to talk to a guy called Higinio Ochoa. He's 33 years old. He has a wife named Kylie, a two-year-old son named Brody, and on the surface he's a pretty normal guy, just like you or me, he lives in a normal apartment, has a Netflix account, a big old TV. He's super friendly, really easy to talk to, would happily sit down and watch TV with you, but you would have to work the remote.

PJ: He doesn't like remotes?

ALEX: No, it's actually a lot more complicated than that.

HIGINIO OCHOA: I'm not to touch any computer, smartphone or device that has internet connectivity.

ALEX: And there's a chance that if you violated this term of your parole, you could go back to jail.

HIGINIO: Yes, yes.

ALEX: Wow that's crazy.

[theme music]

ALEX: From Gimlet, this is Reply All, a show about the internet. I'm Alex Goldman.

ALEX: So I didn't know this until fairly recently, but a punishment that's sometimes handed down when people are convicted of computer related crimes is that they're banned from using the internet as part of their terms of parole, and that means not just, you can't use your computer. It means you can't use your smartphone, you can't use a tablet. You can't use anything that connects to the internet. If you have one of those smart fridges, you can't use that.

PJ: Wait, but why can't you use a smartphone that's on airplane mode?

ALEX: Because you could turn off airplane mode.

PJ: Right.

ALEX: So a lot of times this is a punishment that's used for sex offenders or predators or people who are caught with child pornography, things like that, which makes sense, but it's also frequently used with people who did not commit a sex offense, like hackers. And Higinio Ochoa, who I went to Austin to see, is a hacker. And he's been a hacker since he was like a little kid.

HIGINIO: At the time my grandmother worked for NASA, so very early on, she got this thing that people were calling a personal computer. So she comes over to the house and drops this thing in front of me and says, “Put it together.” Like, I need to get this to work, I don't know what it is. So that was really my first foray into computers and I was hooked.

ALEX: When the rest of us were just using AOL to talk to people posing as teenage girls, he was using... he was trying to figure out how to run punters, which are programs that would kick people offline and then very quickly he started breaking into administrator accounts and had his run of the place.

PJ: And how old is he at this point?

ALEX: Like 13, 14. Basically hacking his way into any unsecured computer he could find on the internet. And he took the online moniker “w0rmer” (with a zero) and he says back then, before things spiraled way out of control, he and his friends were just hacking out of curiosity.

HIGINIO: Back then, I did it -- we did it for knowledge. We did it because we wanted to learn these systems and they weren't going to give us access. They’re not going to give a—at the time—13 year old kid access to a multi-million dollar Unix server because he wants to learn to program. They will use shitty passwords and let me break into it but that's on them.

ALEX: He says that’s how it was for a long time—He and his friends just broke into stuff because they were curious. They weren't malicious. That is, until September 2011.

[protest sounds]

ALEX: When he became aware of the Occupy movement.

[protests sounds]

HIGINIO: Cops were doing really shady things at this time. Covering their badges. Turning off cameras. Harassing protesters.

[protests sounds]

HIGINIO: I grew up trusting, my government wouldn't do these things. It was ingrained in my head, they wouldn't do these things and then they did and here on American soil, these people were being pepper sprayed, beaten with batons.

ALEX: For the first time in his life, Higinio was politically motivated and really pissed off. So he hooked up with a group of hackers loosely affiliated with Anonymous called the cabin crew and he started hacking the cops. It was extremely easy.

HIGINIO: There are so many badly designed websites and badly designed info systems out there, I mean if you look at simply the timelines, I would take less than an hour and a half to break into a site and the hardest part and the longest part of it was downloading the data.

ALEX: He hacked the West Virginia chief of police website. He hacked the Mobile, Alabama police department and the Texas Department of Public safety. He hacked the website of Houston county, Alabama, and specifically, he was looking for databases of police officials, names, addresses, phone numbers of police officers. He felt like if the cops were trying to obscure their identities by putting tape over their badges, he'd retaliate and publicize their identities. And throughout all of this, he was getting bolder. On his Twitter feed, he was taunting the authorities, saying things like “wat u got?” and “come at me bro.” And when w0rmer posted the information he got from one of his hacks, he didn't just post a wall of text, he wanted it to look nice.

HIGINIO: All of my hacks have a pretty general layout to em. Um, I had done web design for a while, so that kind of shows in the fact that I like themes. I like to use ASCII text. I like to have header images. I like to have something taunting. I like to have a music video at the end. That was my call sign.

ALEX: A music video like this one.

[music]

ALEX: This is a song called "FBI File" by a band called Corporate Avenger. So, he would have like a huge document that he would release and at the bottom of the document, he would put a picture of a woman in a bikini.

PJ: What's the logic behind that?

ALEX: He just wanted to, there's no logic behind it. There's nothing to it.

PJ: Was it the same woman every time?

ALEX: Well it wasn't at first. So, he was doing this thing where he would put a picture of a woman in a bikini at the bottom of everything, and then he was in a hacker chatroom one day and...

HIGINIO: A friend of mine came in with someone named Oz girl and he had been trying to help her fix her computer, and he couldn't do it and who better to ask than a chatroom full of hackers who were trying to actually change the world. And we scolded him for that. We're not fucking IT. We're not the tech support. You know we're fucking trying to change the world here but alas...

ALEX: He responds like a putz.

HIGINIO: I made the joke 'tits or get the fuck out.'

ALEX: “Tits or get the fuck out.” And Oz girl, surprisingly, wasn't immediately disgusted, and he got a picture of a woman in a bikini and that is Kylie Ochoa, his wife.

KYLIE OCHOA: I posted a picture of me in a bikini and that was it. He was obsessed with wanting to date me.

ALEX: Now Kylie's not a hacker. In 2012, she was living in Australia working for the Department of Immigration and then she got curious about Anonymous, stumbled into this chatroom, they met and Higinio was into her pretty much right away. But he was a hacker. He was paranoid. He was doing a bunch of illegal stuff. So, he did what any hacker would do when he had a crush on someone but was suspicious of them.

HIGINIO: I'm embarrassed to say this but essentially I hacked her email.

ALEX: (laughs) That's so romantic.

HIGINIO: Yeah, she'll tell you the same thing. I hacked her email. Found out that she worked for immigration which made her an Australian federal agent. If you're a hacker, the last thing you want to know is that you’re talking to a government official. So, I was feeling her out. We Skyped, chit-chatted, and from there it was just love.

ALEX: So he asked Kylie to send him more pictures.

KYLIE: He asked if I would get a picture of myself in a bikini for a hack that he was going to do. And look, I mean I know what a computer hack is, but I was really naive back then. Like, I didn't know—they said you know it's kind of like graffitiing a wall, defacing a website. So I’m like, “Yeah, ok, this sounds like fun.” So took some photos in some bikinis which ended up around the worldwide media, unfortunately.

ALEX: Coming up after the break, Higinio's biggest hack, and his biggest mistake.


BREAK


ALEX: So in January of 2012, Higinio's life is in fifth gear. He and Kylie are falling head over heels for one another, the Occupy movement is exploding and he's spending all day hacking government databases all over the country. And so one day, in February of 2012, he's just doing another hack, he's hacked the Alabama Department of Public Safety. And this is like totally routine hack for him. He's just poking around, doing what he normally does and then he makes a startling discovery. He notices that their database has been linked up by somebody to the National Crime Information Center database, it's an information sharing database that is run by the FBI.

And so, it shares inmate information, it has records on their vehicles, it has records on outstanding warrants, gun registrations, it has all this information about criminals. So, for a criminal to have access to this database would be very valuable. They would suddenly know what kind of information the FBI has on them and is sharing with local police departments.

PJ: And also, like, he's just messing with the FBI which feels even more dangerous than messing with a bunch of local police departments, which already feels pretty dangerous.

ALEX: Yeah. If it were me, I would be petrified. I would be like, okay I have definitely stepped into some dog shit and I do not want to be a part of this, but he told me that he was just kind of embarrassed for them. He was like, I can't believe that they left this so unsecured, this is embarrassing. And this is the hack where he made a crucial and uncharacteristic mistake. He was again uploading a picture of Kylie as part of his hack. It's a picture that Kylie took of herself with her iPhone. It's from the neck down, she's wearing a bikini top and she has a piece of paper pinned to her chest that says “Owned by w0rmer and cabin crew. Love you bitches!”

PJ: OK.

ALEX: And Kylie had location services turned on on her phone, which means that embedded in every photo she takes are GPS coordinates for where the picture was taken.

PJ: Right. If you know how to look at it, it'll literally say the longitude and latitude where that photo was shot.

ALEX: Right and he was being careful and trying to scrub the photo of all of its information, but he uploaded the wrong one. He uploaded the photo with the GPS information in it.

HIGINIO: And the metadata led straight to her in Australia. Well at the time, we were engaged so all they had to do was they looked her up on Facebook and it says engaged to Higinio Ochoa.

ALEX: This means that if anyone was paying attention to what he was up to, the FBI, the local police, it was just a couple jumps from the metadata contained in that picture to Higinio's real name.

ALEX: When you realized that the metadata was released in the photo, did you think that it would lead back to you? Were you worried about it? Like how on a scale of 1 to 10 how worried would you say you were?

HIGINIO: I wish I could say like 9 or something but uh seriously it was like a 3. I always thought, “Oh fuck,” you know, “It's out there, but what is that one little piece? It's just one little piece. It's one bread crumb that slipped out of my basket. You know, what's -- what are the chances that they're even paying attention to me?”

ALEX: But over the next couple weeks, he gets more and more paranoid. He notices a new wireless network near his apartment with a Cisco router, the kind police departments use. And then there's this new tenant in his apartment right above his place. One morning when he's leaving the house, Higinio spots him, a sketchy guy, behaving an awful lot like an FBI agent.

HIGINIO: As I was walking out, here's a dude wearing a baseball cap in the middle of the summer, trying to cover his eyes and underneath where he's standing is just a pile of burnt cigarettes. He had been smoking, throwing them down, smoking, just chain-smoking. Who does that except for someone waiting to ID somebody else?

ALEX: So a couple weeks later, he's hanging out with some non-hacker friends and he tells them what he did and that he's freaked out and they basically say to him, “Nah, come on. You're just paranoid. You're not going to jail.”

HIGINIO: All these things just told me get the fuck out of here. But you smoke enough pot and hang out with the right people and they're going to tell you, “Nah dude, you're okay. No dude, don't worry. You can't get caught.”

ALEX: The next day, March 21st, 2012, Higinio woke up to a pounding on the door of his apartment.

HIGINIO: I looked through the peephole and there's a shaking, scared shaking groundskeeper with eight cops. Well, FBI guys. One dude's wearing a black mask, all pointing guns over this dude's shoulder aimed at my steel framed door. And I'll be 100% honest, I seriously for about two seconds thought, I'm just going to keep the door locked. They're not getting in. I'm going to take my laptop and I'm going to stick it in the oven. But it just, it was like no, you know, it's at this point, “game over, I'm caught,” so I unlocked the door...

ALEX: They take him out of his house at gunpoint, throw him into an SUV, and bring him into an interrogation room. And his twitter feed, the one that detailed all of his exploits while simultaneously taunting the cops, it comes back to haunt him.

HIGINIO: And he pulled out a print-up of my twitter feed. We're talking like a good 100-plus pages...

ALEX: And they're just reading them off and saying like did you do this? And he says yes. Did you do this? And he says yes. And then they're like did you do this, and he says, that's a retweet. Do you understand what a retweet is?

PJ: (laughs)

ALEX: That wasn't me. So, he's in deep trouble. He's totally facing jail time and Kylie and Higinio have only been dating for like six weeks, but Kylie moves to the United States, they get married and a short time later, she gets pregnant with Brody. And if I were in her situation, I think I'd cut and run.

ALEX: I feel like a lot of people who had never met their fiancee and found out their fiance had just gotten arrested would just bail. Why did you decide... you'd only known each other for like six or seven weeks?

KYLIE: Yeah. Six weeks. Look, I was I think 33 or 34 at the time so not some sort of silly teenager and they say if you know you know. So, I knew I wanted to be with him. I mean, I had a great career with the department of immigration. I was working for the government. My life was pretty good. But I wanted to be with him.

ALEX: Higinio went to prison in November of 2012 and Brody was born May of the following year. And in September of 2014, he was all set to get out and start working when just a couple weeks before his release, the judge said that per the terms of his parole, he wasn't allowed to use the internet. This would make anyone's life complicated, but it complicated his life more than it might yours or mine. Because Higinio is a programmer for a living. So of course, my question was, how the hell does he do it?

HIGINIO: This machine right here is the only windows based machine we have. It’s our development machine. There’s a wifi device over here that is simply blocked off from the net.

AREA: So, it's like local area wifi.

HIGINIO: Exactly.

ALEX: His office has five or six computers in it, a server, and they’re all connected to one another. It’s essentially a networked oasis, just cut off from the internet. He works from home, writing code, and he has to get this code from his computers to his bosses. And that is not easy.

HIGINIO: I have a transfer USB. It's over there. Little blue one. I plug it in, throw the code on there, zip it up and toss it to the wife. Those are generally for quick updates. Code snippet here. Code snippet there.

PJ: It sounds the way it would sound if he were missing a sense. Like, she's like an internet seeing eye person.

ALEX: Yeah, that's totally accurate. But what he told me is... he was like well you know we have this two year old kid. The two year old kid is always occupied. What if she wants to go to bed and I want to stay up? Well, the way I deal with that is Netflix autoplays, so I'll ask her to put on a series for me and I'll just let it autoplay while she goes to bed and then at the end of the night... and I'm allowed to touch the TV, I'm not allowed to touch the internet, so I can just turn the TV off and let Netflix continue to run.

ALEX: It must be inconvenient in a bunch of different ways.

KYLIE: Oh, it's so inconvenient. You know having to enroll for health care or wanting to pay bills online, I'm the one who always has to do it. I mean, it's only little things, but it can be a real pain in the ass when I'm in the middle of something and then the bills need to be paid, and I'm the one that has to do it. You know, trying to put something on to keep Brody calm. If I'm in another room, it just has to wait until I'm out here. It is a giant pain in the butt.

ALEX: But there there are limits to how much Kylie can help Higinio out. Because when he needs to send big batches of code to his boss, his parole officer gets nervous, so he figured out a way to send it that doesn't use the internet.

HIGINIO: Essentially when I'm done with a version, instead of submitting it to GitHub, I submit it to my local printer. It prints it up and I mail that to my employer, where some desk jockey just types it up.

ALEX: You actually have to print a paper copy of your code and then mail it, snail mail it to your boss and then someone at your boss' office has to type it

HIGINIO: Right.

ALEX: Higinio does go online now and then... in his dreams.

HIGINIO: I've had a couple weird dreams that I was using the internet you know and it's a weird realization when you wake up and you realize that was a dream because there's no way I got on YouTube. You know what I mean like...

ALEX: In these dreams, he's going from site to site and then he suddenly realizes what he's doing, that he's violating his parole and he's putting his future and his family at risk.

HIGINIO: It's usually what wakes me up, you know. That and knocks at doors. Like um, it's like a phantom knock. Like I'll sleep and I'll wake up here and just hear (knocking).

ALEX: And you think that it's ..

HIGINIO: I immediately jump up. It happened this morning, actually, and it was probably just the mail guy dropping off the check but I heard that knock and immediately jumped right out of bed. Right away, come out here, put my pants on. And go and see. It could be my PO. It could be a squad of cop cars. It could be, who knows who the fuck it could be, but yeah every time I hear a knock, it's... my heart has to stop.

ALEX: Next month is the six month anniversary of his release from prison and he's hoping that he can get his parole officer to change the terms of his release so that rather than being kicked off the internet entirely, his internet use is monitored by the government. But let me ask you a question, if you were kicked off the internet for six months and you were able to get back on, what's the first thing you would do?

PJ: I know this is awful, but I would probably just want to check email, like I'd probably just want to see... I'd want to check messages. I'd want to check email. I'd want to check Twitter mentions. I would just want to see what everyone was saying to me that I couldn't hear in that time, like all the things that had gotten missed on the broken wires basically.

ALEX: That's totally what I would do too, but I asked him the same question...

ALEX: If you could use the internet again, what is the first thing you would do?

HIGINIO: As nerdy as it sounds, update all my shit...

ALEX: The first thing he would do is immediately go and update all of his computers. He would get the latest patches, the latest updates to all the operating systems on his computers, because...

HIGINIO: I like to keep up on the latest tools being used, latest news...

PJ: So nerdy.

ALEX: So the government's question is, at this point, can we trust this guy? Like, if he gets back on the internet is he going to get back in touch with old friends? Is he going to start hacking again? And who knows. But my read on the situation is that he barely thinks about all that.

HIGINIO: What keeps me awake most nights is my son's well-being and my wife's well-being. Those are... those took the place of the internet and I can't say it's a bad replacement at all.

ALEX: Higinio Ochoa's world has shrunk. He's a million miles away from his life as a hacker. And he seems happy about it.

Reply All is me, Alex Goldman, and PJ Vogt. We were produced this week by Tim Howard, Sruthi Pinnamaneni, and edited by Alex Blumberg.

Matt Leiber is a buzzer-beater from half court. 

Our show this week was mixed by Rick Kwan. 

Special thanks to Emma Jacobs. 

Our theme music is by the mysterious Breakmaster Cylinder and our ad music is by Build Buildings. 

You can find more episodes at iTunes.com/replyall and we put up an article based on this story on digg.com. Our website is replyall.limo, which was designed in partnership with Athletics. 

Special thanks also to our sponsors [...]

Thanks for listening and we'll see you next week.