British cybercops may have been duped in arrest of LulzSec leader?

Arrest of LulzSec leader 'Topiary' may be scam to get the real one off the hook

The arrest last night of a 19-year-old man British police described as the hacker known as "Topiary" —leading spokesperson and second-biggest mouth in the attention-whoring, authority-flaunting hactivist group LulzSec – looks as if it might just be another LulzSec hack.

"Topiary" was arrested late yesterday as part of a "pre-planned, intelligence-led operation" on a residential address in the Shetland Islands – an isolated set of islands known primarily for their proximity to North Sea oil fields, one-lane dirt roads and excessive population of sheep.

London's Metropolitan Police made the announcement just before midnight, U.K. time, after "Topiary" had been relocated to Central London for questioning.

Police are also searching a residence in Lincolnshire in the British East Midlands, according to the announcement, but have released no details on that part of the investigation.

Ironically (though perhaps meta-ironically), the last post on Topiary's Twitter account was July 21: "You cannot arrest an idea."

" As long as 'you can't arrest an idea'.... ummm everything should be fine huh?," reads a taunt posted by well-known hacker TheJester (@th3j35t3r ), one of several prominent hackers and groups who worked to expose and bring down members of LulzSec after taking offense at their antics, attitude and ego.

Police spokesmen declined to release the name of the 19-year-old they arrested, or release any information at all about a 17-year-old detained for questioning but not arrested.

They also declined to offer details of the "intelligence" that led to the arrests.

Much of it appears to have come from Jester and a group that calls itself WebNinjas, which formed expressly to take LulzSec down a peg.

LulzSec's web site has been down or static for weeks, many of Topiary's own content was deleted from his Twitter account and the account itself hadn't been updated since July 21.

Most tellingly, Web Ninjas doxed Topiary, identifying him as a 23-year-old Swede named Daniel Sandberg. It also mapped the rest of the membership of LulzSec, identifying them by nickname and role within the group.

Given the amount of information and prominence of LulzSec as a police target, it wouldn't have been surprising to hear one or more had been nabbed. British police have been hungry to redeem themselves for the mostly-mistaken arrest of 19-year-old Ryan Cleary – touted by police as a "leader" of LulzSec, but who turned out to be a much-despised hanger-on whose only real role was to administer a couple of chat channels for Anonymous and LulzSec.

He's still being charged with being disliked by police, but has been diagnosed with Aspberger's Syndrome, given counseling and a reduction of charges and been allowed to "go home to his mum his cats and his books," according to his lawyers.

Duped again?

British cops appear to have made the Cleary goof on their own, but the arrest of "Topiary" appears to be a set-up by LulzSec and probably Topiary himself, if a report in DailyTech this morning is correct: British Police Duped by LulzSec Into Arresting the Wrong Guy.

The main evidence is a chat log released by TheJester July 13 as part of a doxing of Topiary's fellow LulzSeccer Sabu (who, as @AnonymousSabu has been conducting a low-intensity, long-term flame war with Jester for weeks).

In the log, a chatter identified as the real Topiary reveals a plan to try to recover from the doxing by pretending he doesn't know any Daniel Sandberg, and continue as he had before, and his frustration that the plan had not yet taken the heat off the real Topiary by getting the fake one arrested:

Topiary: if I go hide then people will assume the dox are right

Topiary : so I'll just act like they failed hard

[removed]: True that - so you need to make a big show of disproving them

Topiary: yeah well, this is my plan

Topiary also reveals he stole his current nickname from a British man he described only as "a troll," who turned the tables on Topiary by causing trouble online while claiming to be the LulzSec leader.

Topiary: I'll just keep denying it until they try to go after the troll

Topiary: then they'll think that's me and harass him


Topiary: I'm hoping someone will go after him and think it's me, then I'll act all scared etc


Topiary : just hoping that they'll take the bait

Topiary : the f***** has been using Topiary for like a year

Topiary : trolling everyone

Topiary : for no reason

Topiary : so now we troll him, hope he's getting raided

Topiary: well whatever, we both discussed this like last year

Topiary: so...

Topiary: then I'll stop my twitter and everything

Topiary: but it isn't F***** WORKING

[removed]: make it look like they got the right guy

Topiary: yup


[removed]: frame up this damn trollfaggot, and "carry on"

Topiary: hope it blows over and they start doxing Ireland [troll] or Scotland [troll] or wherever the f***UK part he's from

Topiary: anyway I trust you so yeah

Topiary: we can keep this between us

[removed]: Wont say a word bro

[removed]: just take care

Topiary: okay gotta go

Topiary: thanks for advic

[removed]: bye!

DailyTech acknowledges there's no way yet to know whether the plot and the chatlog are genuine or that the plot Topiary reveals isn't out of date.

Unlikely as it seems, it's possible he pulled up stakes in Sweden and went to hide in the remote Shetlands, or was never the Swedish Daniel Sandberg in the first place.

Most evidence points to him as a Swede, however. And the arrest followed the script too neatly to assume it's all coincidence.

It's especially hard given the repeated errors by both the FBI and Scotland Yard in supposing they were investigating and slapping the cuffs on LulzSec and Anonymous leaders when they were actually sweeping up among the masses of rank-and-file.

The presumed scam generated peals of lulz on Twitter but, so far, no confirmation either way.

As with other "hactivist leader" arrests, it seems most reasonable to withhold judgment, but assume there's something fishy about the story coming out in police announcements.

Police are good at following leads and coming to conclusions based on basic logic and available evidence.

They're not so good at figuring out when the evidence is being skillfully faked unless they're able to arrest and question both faker and fakee.

If the victim of a framing is a little old lady or a kid who couldn't have the skills to commit the crimes of which they're accused (as has been the case with a number of "content pirates" prosecuted by the RIAA), it's not hard to figure out when an arrest is a mistake.

When the "hacker" who's been arrested actually is a hacker who can be shown to have either been hanging out in the same venues the real Topiary would haunt or even doing his best to make it look as if he is Topiary – either to collect respect or ruin the real Topiary's reputation – it's even harder.

For now, what we know is that Scotland Yard's cybercrime unit has arrested a 19-year-old man who fits the profile of a troll Topiary talked at length of framing to convince those pursuing LulzSec leaders that the troll was the real thing.

It doesn't say much for the ethics, judgment or moral backbone of the real Topiary if he's trying to get someone else prosecuted for his crimes.

Given his history of both hactivism and pointless theft and distribution of private information on private citizens – putting them at financial risk for no reason whatsoever – Topiary's lack of any moral backbone isn't much of a surprise, either.

ITWorld DealPost: The best in tech deals and discounts.
Shop Tech Products at Amazon