A group of young British computer hackers who considered themselves to be "latter-day pirates" masterminded sophisticated cyber attacks on major global institutions including the CIA, Sony, the FBI and Nintendo from their bedrooms, a court has heard.
Ryan Ackroyd, Jake Davis, Mustafa Al-Bassam and Ryan Cleary were "hactivists" with the LulzSec collective behind attacks that stole sensitive personal data including emails, online passwords and credit card details belonging to millions of people.
News International, the NHS and the UK's Serious Organised Crime Agency (Soca) were also victims of the group, who lived as far apart as London and the Shetland Islands and did not meet in person.
Stolen information was posted unencrypted on their website and file-sharing sites like Pirate Bay in 2011, London's Southwark Crown Court was told. They also carried out distributed denial of service (DDoS) attacks, using linked networks of up to one million computers to overpower and crash websites. Their activity collectively cost their targets millions of dollars and potentially left millions of people at risk from criminals, the court heard.
Prosecutor Sandip Patel said the group, a spin-off from Anonymous, had been motivated by a desire for publicity rather than financial gain. But he said they were "not naive to the risk that confidential data might be misused". "It's clear from the evidence that they intended to achieve extensive national and international notoriety and publicity," he said. "They saw themselves as latter-day pirates."
LulzSec existed only for a few months in the first half of 2011, the court heard. But it built up a huge international following, reaching 355,000 Twitter followers. It probed websites looking for security weaknesses to exploit. Attacks like those on Sony and Nintendo harvested massive amounts of private data. Sony lost details relating to 26.4 million customers, the court heard.
Davis, Al-Bassam and Ackroyd were core members of LulzSec along with a New York-based hacker, the court heard, with Cleary working with them, the court heard. Ex-soldier Ackroyd, 26, from Mexborough, South Yorkshire, previously pleaded guilty to one charge of carrying out an unauthorised act to impair the operation of a computer, contrary to the Criminal Law Act 1977. The most proficient hacker in the group, he used the online persona of a 16-year-old girl called Kayla.
Al-Bassam, 18, from Peckham, south London, used the alias tFlow. He was at school at the time and is currently sitting his A-levels, the court heard. Davis, 20, from Lerwick, Shetland, used the alias Topiary and was LulzSec's main publicist. He and Al-Bassam had previously pleaded guilty to hacking and launching cyber attacks on a range of organisations, including the CIA and Soca.
Cleary, 21, of Wickford Essex, known as ViraL, pleaded guilty to the same two charges plus four separate charges including hacking into US air force agency computers at the Pentagon. The Asperger's suffer also admitted charges of possession of indecent images relating to extreme child pornography found on his hard drive.
Judge Deborah Taylor adjourned sentencing until Thursday.