Hector Monsegur: The FBI Informant Inside LulzSec
In the spring of 2011, the most feared hacker on the internet was an unemployed 27-year-old raising two little girls in a sixth-floor apartment in a Lower East Side housing project.
As Sabu, Hector Monsegur was the loud, swaggering face of Anonymous and the founder of LulzSec, the crew that spent 50 days tearing through Sony, PBS, Fox, the US Senate and the CIA's website, and laughing about it on Twitter.
Then, one June evening, FBI agents knocked on apartment 6F. Sabu kept tweeting for another nine months. He just wasn't working for the same side anymore.
Hector Monsegur at a Glance
- Born in 1983 and raised by his grandmother in the Jacob Riis Houses on Avenue D, Monsegur taught himself Linux at 14 while his father and aunt served time for heroin dealing.
- In 1999 he began defacing websites in protest over the US Navy's bombing range on Vieques, signing his work "Sabu."
- He joined Anonymous in late 2010, took part in the attacks defending WikiLeaks and in the HBGary Federal hack, and became the group's "rooter," the one who found the way in.
- In May 2011 he co-founded LulzSec, whose 50-day spree hit Sony Pictures, PBS, Fox, Nintendo, an FBI affiliate and the Senate before the group announced its own retirement.
- The FBI arrived at his apartment on June 7, 2011. He confessed that night, agreed to cooperate the next morning and kept playing Sabu online under FBI direction.
- He pleaded guilty in August 2011 to 12 counts carrying a possible 124 years, and his cooperation led to the March 2012 arrests of hackers in the US, UK and Ireland, including Jeremy Hammond.
- In May 2014 a judge sentenced him to time served, seven months, after prosecutors said he'd helped stop more than 300 attacks.
- He now works as a security researcher and co-hosts a podcast with a former FBI agent.
The Life of Hector Monsegur
Monsegur's Avenue D Childhood
Hector Xavier Monsegur was born in 1983. His father was 16, his mother left, and he was handed to his grandmother Irma, a Puerto Rican-born woman who raised him in apartment 6F at 90 Avenue D, in the Jacob Riis Houses on Manhattan's Lower East Side.
The family business was heroin. In 1997 the police broke it up: his father and his aunt Iris each went to prison for at least seven years, and 13-year-old Hector stayed with his grandmother in the projects.
He was a big, quiet kid the neighborhood called Bubi, and he didn't fit in.
"He wasn't a hood kid," one neighbor later told New York magazine. "He was a brain." The computer was his refuge, and at 14 he taught himself Linux and hacked his way to a free internet connection.
Sabu Says Hello
His political awakening came in 1999, when a US Navy bombing exercise on the Puerto Rican island of Vieques killed a civilian. Protests spread, and the teenager joined in the only way he could: by defacing websites.
"Hello, I am Sabu, no one special for now," he wrote on one of them. He took the name from a professional wrestler and kept it for the rest of his career.
School didn't last. He left Washington Irving High School in 2001 without finishing ninth grade, worked sporadically, including a stint as a systems administrator at a nonprofit, and by his own later admission paid bills by stealing and selling credit card numbers.
His grandmother died in 2010, and that same year his aunt went back to prison. Monsegur, then 27, took legal custody of her two young daughters and walked them to elementary school each morning before sitting down at a battered computer missing its shift, 7 and L keys.
The Rooter of Anonymous
In December 2010, outraged by the arrest of Julian Assange, Monsegur joined Anonymous and its attacks on PayPal, Visa and MasterCard for cutting off donations to WikiLeaks.
- Andy Greenberg's history of WikiLeaks, the cypherpunks and the hacktivists who rallied behind Assange in 2010, the cause that pulled Monsegur into Anonymous and the PayPal attacks.
He quickly stood out. In early 2011 he was involved in attacks on government sites in Tunisia, Yemen, Algeria and Zimbabwe, and in February he was part of the hack of HBGary Federal, a security firm whose chief had boasted of unmasking Anonymous. The crew took data on about 80,000 user accounts and dumped the firm's email.
Within Anonymous, federal prosecutors would later say, Sabu was the "rooter": the one who found the holes in targets and planned the attack.
50 Days of Lulz
In May 2011 Monsegur and about five other core members split off as Lulz Security, hacking "for the lulz" and bragging on Twitter almost daily. From his apartment on Avenue D he picked the targets and found the vulnerabilities.
The list ran to around 250 victims. LulzSec took data on roughly 100,000 Sony Pictures users, exposed contestants from Fox's X-Factor, planted a fake story on PBS's site after a Frontline documentary on WikiLeaks, hit Nintendo, Senate.gov and an FBI-affiliated InfraGard chapter in Atlanta, and knocked the CIA's public website offline with the tweet "Tango down."
On June 25, 2011, the group released a "50 days of lulz" farewell and announced it was disbanding. Sabu signed off with a quote from The Usual Suspects.
What almost nobody knew was that his real name had already leaked. In March, a rival group called Backtrace Security had published a document identifying him, and the FBI was closing in.
The Knock on Apartment 6F
On the evening of June 7, 2011, FBI agents came to the apartment. Monsegur didn't lawyer up and didn't stall. According to the government's own account, he admitted his crimes on the spot and spent that night going through his computer files with the agents.
The next morning he appeared in court on a sealed complaint charging credit card fraud and identity theft, was released on bail, and went straight back online. Within hours of his first interview, prosecutors wrote, "he was back online cooperating proactively."
On August 15, 2011, he quietly pleaded guilty to 12 counts: nine related to computer hacking, plus credit card fraud, conspiracy to commit bank fraud and aggravated identity theft. The maximum was more than 124 years.
Nine Months as CW-1
In court papers he became CW-1, the cooperating witness, and he was good at it. He fed the FBI advance notice of attacks, handed over chat logs recorded with his consent and drew fellow hackers into incriminating conversations, all while Sabu's Twitter feed kept raging against the federal government.
When Jeremy Hammond hacked the intelligence firm Stratfor in December 2011 and stole millions of emails, Sabu offered him a server to store the haul. The server belonged to the FBI. When an Irish teenager intercepted a conference call between the FBI and Britain's Serious Organised Crime Agency, he sent the recording to Sabu, who passed it along.
On March 6, 2012, the government unsealed charges against five men in the US, Britain and Ireland, and Monsegur's double life became public.
Less than 24 hours earlier, Sabu had tweeted, "Don't give in to these people. Fight back. Stay strong."
Anonymous called him a traitor. Hammond, arrested in Chicago with help from Monsegur's logs, was eventually sentenced to 10 years.
- Anthropologist Gabriella Coleman spent years inside Anonymous's chat rooms, through the LulzSec era and the morning the group learned Sabu had been working for the FBI. The definitive account of the movement he led and betrayed.
Time Served
Cooperation didn't make him a model defendant. In May 2012 his bail was revoked over unauthorized online postings, and he spent the next seven months in jail before a judge released him again in December.
His sentencing was postponed again and again while he kept working. By the time it finally arrived on May 27, 2014, prosecutors told the court that his help had prevented or mitigated more than 300 cyberattacks, including planned attacks on the military and NASA, and had led to the arrest and conviction of eight co-conspirators.
Federal guidelines called for 259 to 317 months. Judge Loretta Preska called his cooperation "truly extraordinary" and gave him time served, the seven months, plus a year of supervised release. Monsegur apologized to the court and promised he'd never be a defendant again.
Hector Monsegur Goes Legit
In 2015 he joined Rhino Security Labs, a small Seattle penetration testing firm, and by 2016 was leading a six-person team that broke into clients' networks for a living. Only one client ever asked to have him kept off a job.
"I'm not ex-LulzSec, I'm not ex-FBI, I'm a security researcher," he told Wired. "Sabu was a character. That man doesn't exist anymore."
By 2019 he was Rhino's chief researcher, and he's since become a familiar conference speaker. He also co-hosts the Hacker and the Fed podcast with Chris Tarbell, the former FBI agent best known for arresting Silk Road's Ross Ulbricht.
- Nick Bilton's bestselling account of Ross Ulbricht, the Dread Pirate Roberts and the agents who closed in on him. Reads like a thriller, built from the case files.
Hector Monsegur: Sabu Was a Character
Monsegur's story is the hacktivist era in one life: the poverty and politics that fed it, the swagger, and the speed with which a knock on the door turned a leader into a witness.
Today he's in his early forties, works on the defensive side and talks openly about the whole arc, including the parts the Anonymous faithful will never forgive.
He once wrote, "no one special for now." During LulzSec's roughly 50-day run in 2011, he became one of hacking's best-known names. After his arrest, the FBI used that reputation to reach the people who still trusted him.
QUOTE:
"Amateurs hack systems, professionals hack people."