Jake Davis: Topiary, LulzSec and Life After the Arrest

For 50 days in the summer of 2011, the most-followed voice in hacking belonged to an 18-year-old on a remote Scottish island with a wicked sense of humor.

Jake Davis was Topiary, the spokesman of LulzSec, the crew that hacked Sony, PBS, Fox, the CIA's website and Britain's Serious Organised Crime Agency and narrated the whole spree on Twitter to a quarter of a million followers. He wrote the press releases in Notepad. He never met his crewmates in person.

Then the Metropolitan Police flew to Shetland. His last tweet before they arrived read: "You cannot arrest an idea."

Jake Davis at a Glance

• Davis grew up on Yell, one of the northern Shetland Islands, after his mother moved the family there when he was a small child.
• As a member of Anonymous he was involved in the February 2011 attack on the security firm HBGary Federal, and that month he hijacked the Westboro Baptist Church's website live on an internet talk show.
• From May to June 2011 he ran LulzSec's Twitter account and wrote its communiqués, including the hoax story on the Sun's website announcing that Rupert Murdoch had died.
• Police arrested him in Lerwick on July 27, 2011. He was 18, and it was the first LulzSec arrest in which officers named the suspect's online alias on the spot.
• Charged with five offenses, he was bailed to his mother's house in Lincolnshire with an electronic tag and a total ban on using the internet.
• In June 2012 he pleaded guilty at Southwark Crown Court to two conspiracy counts over denial-of-service attacks, including the one on SOCA.
• On May 16, 2013, he was sentenced to 24 months in a young offenders' institution. With credit for 21 months on the tag, he served 37 days at Feltham.
• Since his release he's written about hacker culture for the Guardian, advised a Royal Court play about hacktivism and spoken at security conferences as an expert on hackers.

The Life of Jake Davis

Davis's Early Years

Jake Davis spent his childhood in Mid Yell, a village on an island at the top of the Shetlands, about as far from London as you can get and still be in Britain. His mother, Jenni, a social worker, had moved there with her two sons around 1999.

It's the kind of place where a teenager with a computer and a modem finds that the whole of the rest of the world is online. Davis found Anonymous, the leaderless collective that'd grown out of the 4chan message boards, and found that he was very good at one specific thing: talking.

He wasn't the crew's best coder. He was its writer, its voice, and the person who could keep a few hundred thousand strangers entertained while the technical work happened elsewhere.

Westboro and HBGary

In February 2011, Anonymous went after HBGary Federal, a security contractor whose chief executive, Aaron Barr, had boasted that he could unmask the collective's members. Anonymous emptied the company's email servers onto the internet. Davis later pleaded guilty to his part in the attacks on HBGary and HBGary Federal.

The same month, Davis appeared on the David Pakman Show opposite a representative of the Westboro Baptist Church, the Kansas congregation famous for picketing funerals. While the Westboro spokeswoman spoke, he replaced the church's homepage with an Anonymous message, live. The clip went viral.

It was a preview of the LulzSec method: the hack was the easy part; the performance was the point.

Fifty Days of Lulz

LulzSec appeared in May 2011 as a splinter of Anonymous, six or so hackers more interested in laughs than causes. Its motto was "high-quality entertainment at your expense," its mascot was a monocled stick figure, and its public face was Davis's Twitter account.

In seven weeks the group hit Sony Pictures, Nintendo, Fox, the Arizona state police, the FBI partner organization InfraGard, PBS and the public websites of the CIA and the US Senate. On PBS they planted a story that Tupac Shakur was alive in New Zealand. They knocked SOCA, Britain's organized-crime agency, offline with a flood of traffic.

Davis wrote every press release without planning, as he later told the Guardian: "We made it up as we went along." He picked the names, too. The group had started as @LulzLeaks, but he forgot the password, so it became @LulzSec; his own persona went from the Lulz Train to the Lulz Cannon to the Lulz Boat.

"We had an active Twitter (controlled by me), cute cats in deface messages, and a generally playful, cartoon-like aura to our operations," he said. "We knew when to start, we knew when to stop, and most of all we knew how to have fun."

The End of the Boat

On June 25, 2011, after exactly 50 days and roughly 275,000 followers, LulzSec announced it was disbanding. Davis insisted the exit was "classy," a high note before a sail into the distance.

The timing was also not an accident. Ryan Cleary, a 19-year-old in Essex connected to the group, had already been arrested, and leaked chat logs showed the crew knew the authorities were close.

What they didn't know was that the man they called their leader, Hector Monsegur, known as Sabu, had been arrested in June 2011 and was now working for the FBI. The group's chats were being recorded from his computer.

Three weeks after the disbanding, LulzSec members hacked the Sun and redirected its readers to a fake story reporting that Rupert Murdoch had died. It was the last big stunt.

Arrest in Lerwick

At 2:10 in the afternoon on July 27, 2011, officers from the Met's e-crime unit, working with Scottish police, arrested Davis in Lerwick, where he'd moved from Yell earlier that month. Police announced within hours that the man they had was Topiary.

He was taken to London, charged with five offenses under the Computer Misuse Act and other laws, and on August 1 released on bail to his mother's home in Lincolnshire. The conditions were a 10 pm to 7 am curfew enforced by an ankle tag and a complete ban on accessing the internet, directly or through anyone else.

He arrived in court carrying a book called Free Radicals: The Secret Anarchy of Science, and the LulzSec Twitter account fell silent for good.

Life Offline

Davis spent nearly two years with no internet at all. In a 2012 essay for the Guardian, he described the experience as serene: he read newspapers "as though they weren't ancient scrolls," slept properly for the first time since his early teens and found "the paranoia has certainly vanished."

"If hashtags were rice grains, do you know how many starving families we could feed? Neither do I," he wrote. "I can't Google it."

On June 25, 2012, he and Cleary pleaded guilty at Southwark Crown Court to conspiring in denial-of-service attacks against targets including the CIA, SOCA, the NHS, News International and Sony. Both denied charges of encouraging others by posting stolen data, and Davis was later found not guilty of those.

A US indictment hung over him as well. He was never extradited.

Southwark

Sentencing came on May 16, 2013. Judge Deborah Taylor told the four LulzSec defendants that they'd used their abilities "to cause catastrophic losses for amusement," and that the group's name "encapsulates your desires to cause embarrassment and disruption, while keeping your own identities hidden."

To Davis she said: "I take into account that financial gain was not your motivation. You were aware of what you were doing."

Cleary got 32 months and Ackroyd 30; Al-Bassam, who'd been 16, got a suspended sentence. Davis, now 20, received 24 months in a young offenders' institution, equal to what had been the longest British hacking sentence until that morning.

The 21 months he'd already spent tagged counted against it. He walked out of Feltham after 37 days, banned from contacting his former crewmates, from encrypting files and from deleting his browsing history.

"I was sacked as a prison cleaner for mopping too near a computer," he tweeted. "Those deadly, soapy mops are a serious threat to GCHQ, make no mistake!"

Davis After LulzSec

Davis turned the story into a career of explaining it. He wrote for the Guardian about what Sabu's light sentence meant for hackers, and in 2014 appeared on the Royal Court Theatre's stage with Al-Bassam, Ackroyd and Darren Martyn, the convicted members reunited in public for the first time, at an event around Teh Internet Is Serious Business, Tim Price's play about the birth of hacktivism.

He gave a TEDxTeen talk called "How We Hack the Planet," worked as a script consultant on film and theatre projects, and by 2020 was keynoting security conferences, billed as an expert on hackers and hacker culture. In recent years he's kept a lower profile.

Jake Davis: The Lulz Boat's Last Passenger

LulzSec lasted 50 days and has been written about for 15 years, and that's mostly Davis's doing. The hacks were real but ordinary; the voice wasn't.

He paid for it with two years in a kind of digital exile and five weeks in Feltham, and came out saying he was better for the time away. The man who once needed 275,000 followers found he could live without a single one.

Ideas, it turns out, can't be arrested. Teenagers in Lerwick can.