On Sunday The Washington Post published a profile of an anonymous hacker known as 0x80. The guy lives with his parents and writes programs that search for vulnerable PCs and install unwanted ads and pornography. The 21-year-old subject agreed to be interviewed, reporter Brian Krebbs explained, only if he wasn’t named and his hometown was not identified.
Offended by the hacker’s work, some Internet users are out to pull the mask off the guy. Searching information stored with a Post photo initially published in the story, these readers have determined the guy lives in a Midwestern town of about 3,000 residents.
Although the photos with the revealing information have since been scrubbed from the Post‘s Web site, the information is being passed around the Internet like a hot potato. Using details that appeared in the story, here’s an edited description of the source from someone who published on Slashdot.
– 21 years old
– Smokes cigarettes. Article mentions Marlboros but that’s not what fills his ashtray (cigarettes with a white butt)
– blond hair (at least blond-looking hairs on his arms)
– hair that covers his eyebrows
– lives with his parents in a “brick rambler”
– Mother is “really Christian”
– has a dog (“A small dog with matted fur”)
– “accent a slurry of heavy Southern drawl and Midwestern nasality”
– is skinny (“wiry frame”, “tall and lanky”, sez the article)
– high school dropout
– was an AOL customer 7 years ago
Easy as hellThe guy really wants to get caught if he leaves that much information be published…
Anyone feels like saying him “hello”, couldn’t take more than 2 days to find him 😉
During a livechat with Krebs today, a reader questioned the inadvertant lapse in confidentiality (but seems to be posing questions to the hacker rather than Krebs):
Washington, D.C.: Are you aware that the Post failed to scrub the metadata from the images used in this article, leaving information about your town? This was picked up by users of the Web site Slashdot over the weekend. Using other clues in the article, they were even able to guess the intersection where you live. Have you been contacted by law enforcement personnel? Do you intend to take action against the Post?
Brian Krebs: As you know we take our obligations with sources very seriously and I don’t want to comment about any speculation about sources.
Editor’s Note: This question was edited to remove a specific reference to the town name.
On the Internet, once the cat gets out of the bag, he travels fast and far. The Post, of course, is obligated to do all it can to protect the source’s identity. But that effort may be futile.
The point: It takes collaboration to carry through on a promise of anonymity. If you make such promises (for a discussion of when to make such promises, please see this column) you must work with the rest of the your newsroom to ensure you can deliver.
Other Post readers questioned Krebs’ decision not to turn the hacker into the cops. Although Krebs doesn’t answer the question directly, let me try to mount a defense for that particular choice: A journalist’s job is to observe and describe events in order to educate the public. By shedding light on the practices of this particular hacker, The Washington Post was able to take its readers to a place they could not go on their own. As a result, those readers are more informed, better able to protect themselves and more likely to participate in public policy decisions on Internet security. If journalists become partners with law enforcement, they can no longer be viewed as independent sources of information. None of this applies in a situation when calling the cops can prevent death or serious injury. But in the absence of imminent harm, when journalists avoid becoming police informants they stand a better chance of serving the greater good of their audience.
