Reply All - #21 Hack The Police

Episode Date: April 20, 2015

When Higinio Ochoa got out of prison for hacking in September of 2014, one of the terms of his parole was that he is not allowed to use any internet connected device. We went to his home in Austin to find out how he got caught and what it's like - in 2015 - to go from living online to not having any internet access. Next week we celebrate Email Debt Forgiveness Day! Leave us a voicemail at [phone] about your most anxiety inducing unanswered email. All will be forgiven, we promise.  To see a written version of this story, go to http://digg.com/tag/reply-all Check out our sponsors! https://www.dropbox.com/business http://stamps.com (offer code reply) http://mailchimp.com/replyall (get a free freddy!) Learn more about your ad choices. Visit podcastchoices.com/adchoices

Hey, Matt Lieber, Gimlet co-founder. Can I interrupt you for a sec? Okay. So we have a bunch of cursing in this week's episode, and we were just quickly trying to figure out whether you thought we should do a language advisory. Like FSC type cursing? Yeah, FSC type cursing.

Yes, you should do a language advisory. You've been advised. Hey, Alex. Hi. So besides us having an episode this week, you know what else is happening? I think I can guess, but I'm excited to hear you say it. Now, if you know it, you got to tell you. Tell me. Oh, it's the new season of Startup premieres Thursday, the day after this releases, probably hours after this releases. We tend to release our episodes pretty late at night.

Startup, as a lot of reply all listeners probably know, is a podcast mini series that documents companies as they're starting. We've heard a lot of the second season. It's amazing. We're also very excited because the second season is not about Gimlet where we work. It's about another company. I know. That takes a considerable burden off of us. There have been like unrecorded moments that have happened at Gimlet in the past few weeks, and it has felt very nice. But don't worry, everybody. We're getting sleep now. And PJ's foot fungus is cleaned up. Possibly. So Caitlin gave us this clip from the new season.

As with Alex Bloomberg, the women at the company that Lisa profiled had to pitch their company to outside investors. Unlike with Alex, some of those investors sounded kind of terrible. He said something like. I have so much to say, but like, I'll spare you and just say that I wish I could take a shit on your company. It shouldn't exist. Anyway, that's startup. Alex. Yeah.

Oh, man, you are so looking at your phone. No, I'm paying attention. I'm playing a video game. Are you seriously playing a video game? No. Alex, don't do that shit. It is rude in such a profound way. Okay.

You don't look ashamed enough. Okay, that's better. I was going to ask you about your story, and now I just, like, don't want to. I want to make you sit here for 20 minutes. You're still looking at your video game. No, no, no, I'm looking at the script. I'm looking at the script.

I'm actually very embarrassed. Good, okay. Alex, you went to Austin last week. Yeah. How come? I went to talk to a guy named Hino Echoa. He's a 33-year-old. He has a wife named Kylie,

and a two-year-old son named Brody. And on the surface, he's a pretty normal guy. Just like you or me, he lives in a normal apartment, has a Netflix account and a big old TV. He's super friendly, really easy to talk to, would happily sit down and watch TV with you, but you would have to work the remote. He doesn't like remotes?

No, it's actually a lot more complicated than that. I'm not too touch. any computer, smartphone, or device that has internet connectivity. And there's a chance that if you violated this term of your parole, you could go back to jail? Yes, yes. Wow. That's crazy. From Gimlet, this is Reply All, show about the internet. I'm Alex Goldman.

So I didn't know this until fairly recently, but a punishment that's sometimes handed down when people are convicted of computer-related crimes is that they're banned from using the internet as part of the terms of their parole. And that means not just you can't use your computer. It means like you can't use your smartphone. You can't use a tablet. You can't use anything that connects to the internet. If you have one of those smart fridges, you can't use that.

Wait, but why can't you just use a smartphone that's on airplane mode? Because you could turn off airplane mode. Right. So a lot of times this is a punishment that's used for sex offenders or predators or people who are caught with child pornography, things like that. Right. Which makes sense. But it's also frequently used with people who did not commit a sex offense, like hackers.

And Hino Choa, who I went to Austin to see, is a hacker. And he's been a hacker since he was like a little kid. At the time, my grandmother worked for NASA. So very early on, she got this thing that people are calling a personal computer. So she comes over to the house and drops this thing in front of me and says, put it together. Like, I need to get this to work. I don't know what it is. So that was really my first foray into computers, and I was hooked.

When the rest of us were just using AOL to, like, talk to people posing as teenage girls, he was using, he was like trying to figure out how to, you know, run punters, which were like programs that would kick people offline. and then very quickly he started breaking into like administrator accounts and he sort of became had his run of the place. And how old is he at this point? Like 13, 14. Okay. Basically hacking his way into any unsecured computer he could find on the internet. And he took the moniker Wormer with a zero.

And he says that back then, before things spiraled way out of control, he and his friends were just hacking out of curiosity. Back then I did it. We did it for knowledge. we did it because we wanted to learn these systems, and they weren't going to give us access. They're not going to give a, at the time, 13-year-old kid, access to a multimillion-dollar Unix server because he wants to learn a program. You know, they will use shitty passwords and let me break into it.

But, you know, that's on them. He says that's how it was for a long time. He and his friends just broke into stuff because they were curious. They weren't malicious. That is until September 2011. When he became aware of the Occupy movement. Cops were doing really shady things at this time, covering their badges, turning off cameras, harassing protesters.

I grew up trusting my government, you know, wouldn't do these things. It was ingrained in my head. They wouldn't do these things. And then they did. And here on American soil, these people were being pepper sprayed, beaten with batons. For the first time in his life, he knew was politically motivated

and really pissed off. So he hooked up with a group of hackers loosely affiliated with Anonymous called The Cabin Crew, and he started hacking the cops. It was extremely easy. There are so many badly designed websites

and badly designed info systems out there. I mean, if you look at simply the timelines, I would take less than an hour and a half to break into a site, and the hardest part and longest part of it was downloading the data. He hacked the West Virginia Chiefs of Police website. He hacked the Mobile Alabama Police Department and the Texas Department of Public Safety.

He hacked the website of Houston County, Alabama. And specifically, he was looking for databases of police officials, names, addresses, phone numbers of police officers. He felt like if the cops were trying to obscure their identities by putting tape over their badges, he'd retaliate and publicize their identity. And throughout all of this, he was getting bolder. On his Twitter feed, he was taunting the authorities, saying things like, what you got, and

come at me, bro. And when Wormer posted the information he got from one of his hacks, he didn't just post a wall of text. He wanted it to look nice. All of my hacks have a pretty general layout to them. I've done web design for a while. So that kind of shows in the fact that I like themes. You know, I like to use ask key text.

I like to have header images. I like to have something taunting. I like to have a music video at the end. That was my call sign. A music video like this one. This is a song called FBI File by a band called Corporate Avenger. So he would have like a huge document that he would release. And at the bottom of the document, he would put a picture of a woman in a bikini.

What's the logic behind that? He just wanted to. There's no logic behind it. There's nothing to it. Was it the same woman every time? Well, it wasn't at first. So he was doing this thing where he would put a picture of a woman in a bikini at the bottom of everything. And then he was in a hacker chat room one day.

And a friend of mine came in with someone named Ozgirl. And they wanted, he had been trying to help her fix her computer. And they couldn't do it. And who better to ask in a chat room full of hackers who were trying to actually change the world. And we scolded him for that. You know, we're not fucking IT. We're not to tech support. You know, we're fucking trying to change the world here.

But alas. He responds like a putts. I made the joke. Tits or get the fuck out. Tits or get the fuck out. An Oz girl, surprisingly, wasn't immediately disgusted. And he got a picture of a woman in a bikini. And that is Kylie Ochoa, his wife.

I posted a picture of me in a bikini. And that was it. He was obsessed with. wanting to date me. Now, Kylie's not a hacker. In 2012, she was living in Australia working for the Department of Immigration. And then she got curious about anonymous, stumbled into this chat room. They met

and Hino was into her pretty much right away. But he was a hacker. He was paranoid. And he was doing a bunch of illegal stuff. So he did what any hacker would do when he had a crush on someone but was suspicious of them. I'm embarrassed to say this, but essentially I hacked her email. That's so romantic.

Yeah, she'll tell you the same thing. I hacked her email, found out that she worked for immigration, which made her an Australian federal agent. If you're a hacker, the last thing you want to know is that you're talking to a government official. So I was feeling her out. We, you know, we Skype, chit-chatted, and from there it was just love.

So he asked Kylie to send him more pictures. He asked if I would get a picture of myself in a bikini for a hack that he was going to do. And look, I mean, I know what a computer hack is, but I was really naive back then. Like, I didn't know. They said, you know, it's kind of like graffeting a wall defacing a website. So I'm like, yeah, okay, this sounds like fun. So took some photos in some bikinis, which ended up around the worldwide media, unfortunately. Coming up after the break, Hino's biggest hack and his biggest mistake.

So in January of 2012, Hino's life is in fifth year. He and Kylie are falling head over heels for one another. The Occupy movement's exploding. And he's spending all day hacking government databases all over the country. And so one day in February of 2012, he's just doing another hack. He's hacked the Alabama Department of Public Safety. And this is like totally routine hack for him. He's just poking around, doing what he normally does.

And then he makes a startling discovery. He notices that their data. database has been linked up by somebody to the National Crime Information Center database. It's an information sharing database that is run by the FBI. Oh. And so it shares inmate information. It has records on their vehicles. It has records on outstanding warrants, gun registrations. It has all this information about criminals. So for a criminal to have access to that database would be very valuable. They wouldn't suddenly know what kind of information the FBI has on them and is sharing with local police departments. And also, like, he's just messing with the FBI, which feels even more dangerous than messing with a bunch of local police departments, which already feels pretty dangerous.

Yeah. If it were me, I would be petrified. I would be like, okay, I have definitely stepped into some dog shit. I do not want to be a part of this. But he told me that he was just kind of embarrassed for them. He was like, I can't believe that they left this so unsecured. This is embarrassing. And this is the hack where he made a crucial and uncharacteristic mistake. He was, again, uploading a picture of Kylie as part of his hack.

It's a picture that Kylie took of herself with her iPhone. It's from the neck down. She's wearing a bikini top. She has a piece of paper pinned to her chest that says, owned by Wormer and Cabin Crew. Love you, bitches. Okay. And Kylie had location services turned on on her phone,

which means that embedded in every photo she takes are GPS coordinates. Right. If you know how to look at it, it'll literally say like the longitude and latitude where that photo was shot. Right. And he was being careful and trying to scrub these photos of that information, but he uploaded the wrong one. He uploaded the photo with the GPS information in it.

And the metadata led straight to her. in Australia. Well, at the time, we were engaged. So all they had to do was they looked her up on Facebook and it says, engaged to Hino Choa. This means that if anyone was paying attention

to what he was up to, the FBI, local police, it was just a couple jumps from the metadata contained in that picture to Hino's real name. When you realized that the metadata was released in the photo, did you think that it would lead back to you? Were you worried about it? Like how, on a scale of 1 to 10, how

worried would you say you were? I wish I could say like 9 or something, but seriously, it was like a 3. And I always thought, oh, fuck, you know, it's out there, but what is that one little piece? It's just one little piece. It's one breadcrumb that slipped out of my basket.

You know, what's... What are the chances that they're even paying attention to me? But over the next couple weeks, he gets more and more paranoid. He notices a new wireless network near his apartment with a Cisco router, the kind that police departments use. And then there's this new tenant in his apartment building right above his place. One morning, when he's leaving a house, Hino spots him.

A sketchy guy behaving an awful lot like an FBI agent. As I was walking out, here's a dude wearing a baseball cap in the middle of the summer, trying to cover his eyes, and underneath where he's standing is just a pile of burnt cigarettes. He had been smoking, throwing him down. smoking, just chain smoking. Who does that? Except for somebody waiting to ID somebody else.

So a couple weeks later, he's hanging out with some non-hacker friends, and he tells him what he did, that he's freaked out. And they basically say to him, nah, come on, you're just paranoid. You're not going to jail. All these things just told me, get the fuck out of here, you know. But you smoke enough pot and you hang out with the right people, and they're going to tell you,

no, dude, you're okay. No, dude. No worry. You can't get caught. The next day, March 21st, 2012, Hino woke up to a pounding on the door of his apartment. I looked through the peephole and there's a shaking, scared shaking groundskeeper with eight cops. Well, FBI guys. One dude's wearing a black mask, all pointing guns over this dude's shoulder aimed at my steel frame door. And I'll be 100% honest.

I seriously for about two seconds thought, I'm just going to lock the key. keep the door locked. They're not getting in. I'm going to take my laptop, and I'm going to stick it in the oven. But it just it was like, no. You know, it's at this point, game over. I'm caught. So I unlock

the door. They take him out of his house at gunpoint, throw him into an SUV, and bring him into an interrogation room. And his Twitter feed, the one that detailed all of his exploits while simultaneously taunting the cops, it comes back to haunt him. And he pulled out a printup of my

Twitter feed. We're talking like a good hundred plus pages. And they're just reading them off and saying like, did you do this? And he says yes. Did you do this? And he says yes. And then they're like, did you do this? And he's like, that's a retweet. Do you not understand what a retweet is? That wasn't me. So he's in deep trouble. He's totally facing jail time. And Kylie and Hino have only been dating at this point for like six weeks. But Kylie moves to the United States. They get married. and a short time later, she gets pregnant with Brody. And if I were in her situation, I think I'd cut and run. I feel like a lot of people who had never met their fiancé

and found out their fiancé had just gotten arrested would just bail. Why did you decide? Like, you'd only known each other for what, like six or seven weeks? Yeah, six weeks. You know, look, I was, I think, 33 or 34 at the time. So not some sort of silly teenager. And they say, like, if you know, you know. So, you know, I knew I wanted.

I wanted to be with him. I mean, I had a great career with the Department of Immigration. I was working for the government. My life was pretty good. But I wanted to be with him. Hino went to prison in November of 2012, and Brody was born May of the following year. And in September of 2014, he was all set to get out and start working. When, just a couple weeks before his release, the judge said that per the terms of his parole, he wasn't allowed to use the internet. This would make anybody's life complicated, but it complicated his life. life more than it might yours or mine, because Hino is a programmer for a living. So, of course, my question was, how the hell does he do it? This machine right here is the only Windows-based machine we have. It's a development machine. There's a Wi-Fi device over here that is simply blocked off from the net. So it's like local area of Wi-Fi. Exactly. His office has five or six

computers in it, a server, and they're all connected to one another. It's essentially like a networked oasis just cut off from the internet. He works from home, writing code, and he has to get this code from his computers to his bosses. And that is not easy. I have a transfer USB, it's over there, a little blue one, I plug it in, I throw the code on there, zip it up, and toss it to the wife. Those are generally for quick updates, code snippet here, code snippet there. it sounds a way it would sound if he were if you were missing a sense like she's like an internet seeing eye person yeah that's totally accurate but what he told me is let's he's like well you know we have this two year old kid the two year old kid is always occupied what if i what if she wants to go to bed and i want to stay up well the way I deal with that is Netflix auto plays. So I'll ask her to put on a series for me

and I'll just let it auto play while she goes to bed. And then at the end of the night, and I'm allowed to touch the TV, I'm not allowed to touch the internet. So I can just turn the TV off and let Netflix continue to run. It must be, it must be inconvenient in like a bunch of different ways.

Oh, it's so inconvenient. You know, having to like enroll for health care or, you know, wanting to pay bills. online, I'm the one that always has to do it. And, I mean, it's only little things, but it can be real pain in the ass when I'm in the middle of something, and then the bills need to be paid, and I'm the one that has to do it.

You know, trying to put something on to keep Brody calm. If I'm in another room, it just has to wait until I'm out here. It is a giant pain in the butt. But there are limits to how much Kylie can help Heño out. Because when he needs to send big batches of code to his boss,

his parole officer gets nervous. So he figured out a way to send it, that doesn't use the internet. Essentially, when I'm done with a version, instead of submitting it to GitHub, I submit it to my local printer. It prints it up, and I mail that to my employer where some desk jockey just types it up.

You actually have to print a paper copy of your code and then mail it, snail mail it to your boss, and then someone at your boss's office has to type it. in. Right. Hino does go online now and then, in his dreams. I've had a couple weird dreams that I was using the internet, you know, and it's a weird realization when you wake up and you're like, that was a dream because there's no way I got on YouTube.

You know what I mean? Like, in these dreams he's going from site to site, and then he suddenly realizes what he's doing, that he's violating his parole and he's putting his future and his family at risk. It's usually what wakes me up, you know? that knocks at doors. Like, it's like a phantom knock. Like, I'll sleep and I'll wake up and just hear,

and you think that it's... I immediately jump up. It happened this morning, actually. And it was probably just the male guy dropping off the check. But I heard that knock and immediately jump right out of bed right away, come out here, put my pants on, and go and see. It could be my PO. It could be a squad of cop cars.

It could be, who knows who the fuck it could be, you know? But yeah, every time I hear a knock, it's, my heart has to stop. Next month is the six-month anniversary of his release from prison, and he's hoping that he can get his parole officer to change the terms of his release so that rather than being kicked off the internet entirely, his internet use is monitored by the government.

But let me ask you a question. If you were kicked off the internet for six months and you were able to get back on, what's the first thing you would do? I know this is awful, but I would probably just want to check email. Like, I'd probably just want to see, like, I'd want to check messages. Like, I'd want to check, like, email. I'd want to check, like, Twitter mentions.

Like, I'd just want to see what everybody was saying to me that I couldn't hear in that time. Like, all the things that had gotten missed on the, like, broken wires, basically. That's totally what I would do, too. But I asked him the same question. If you could use the internet again, what is the first thing you would do? As nerdy as it sounds, update all my shit. The first thing he would do is he would immediately go and update all of his computers. He would get the latest patches, the latest updates to all the operating systems on his computers.

Because I like to keep up on the latest tools being used, latest news. So nerdy. So the government's question is at this point, can we trust this guy? Like if he gets back on the internet, is he going to get back in touch with old friends? is he going to start hacking again? And who knows? But my read on the situation is that he barely thinks about all that. What keeps me awake most nights is my son's well-being and my wife's well-being.

Those took the place of the internet, and I can't say it's a bad replacement at all. He knew Ochoa's world has shrunk. He's a million miles away from his life as a hacker. And he seems happy about it. is me, Alex Goldman, and PJ Vote. We were produced this week by Tim Howard, Shrithy Pina Manini, and edited by Alex Bloomberg.

Matt Lieber is a buzzer-beater from Half Court. Our show this week was mixed by Rick Kwan. Special thanks to Emma Jacobs. Our theme music is by the mysterious breakmaster cylinder, and our ad music is by Build Buildings. You can find more episodes at iTunes.com slash Reply All, and we put up an article based on this story on dig.com. Our website is Replyall.com, which was designed in partnership with athletics.

Thanks for listening, and we'll see you next week.