Original: http://www.wired.com/news/print_version/culture/story/17775.html?wnpg=all
Slightly updated: http://www.wired.com/news/print_version/culture/story/17789.html?wnpg=all
A self-proclaimed ex-hacker with the charismatic pseudonyms "Christian Valor" and "Se7en" has been making headlines around the world for his alleged vigilante campaign against online pedophiles.
In the past two years, profiles in Forbes, the London Independent, the Los Angeles Times, Newsday, Wired News, and many other publications have portrayed Valor as an old-school renegade with a cause: exposing the identities -- and trashing the hard drives -- of those who traffic in sexual imagery of children.
The illegal techniques he used were those honed during 17 years in the hacker underground, the publications reported.
In fact, the primary target of Valor's hacking has turned out to be the news media.
Several of Valor's former colleagues have come forward to brand him a technologically inept poseur with a genius for self-promotion, who was unable to safeguard his own Net account against hacker exploits, much less mount a sophisticated campaign of attacks against anyone else's.
"He never deleted a single kiddie porn server himself. He's a compulsive liar, always looking for some new thing to impress people with," said Brian Martin, an independent consultant known among hackers as jericho, who lived and worked with Valor.
Information-systems specialist and online diarist Lisa Rabey, a former intimate of Valor's, also discounted his claims: "I was there. We were reading the same newsgroups. It never happened. He doesn't have the skill to do it."
Pete Shipley, senior security architect for one of the Big Six accounting firms, administers the dis.org domain where Valor had an email account and a Web page.
"I've never seen him demonstrate any expertise in accessing any system," he said. Shipley added that he had to cancel Valor's account because it was hacked so many times.
These days, Valor downplays his role as an anti-porn vigilante. He earns his living teaching courses on Internet security to industry, law enforcement, and military officials with a Southern California-based firm called New Dimensions International.
NASA, Air Force, Navy, Army, and FBI personnel take his US$1,395 three-and-a half-day courses on "Maximum Internet Security" and "Internet Predators" on government time. NDI instructors are employed to develop secure systems for mission-critical clients like the Department of Defense.
Hackers dissing hackers is not news. An investigation of the sources for the stories about Valor that proliferated in the press, however, provides a cautionary tale about the dilemmas facing reporters in the age of Internet-accelerated media.
When a news hook involves a hot-button issue like online pedophilia, even seasoned reporters may be tempted to go forward with a headline-grabbing story that relies on secondary sources. And stories about hackers may be the toughest to report accurately.
In declaring himself to be the fearsome nemesis of online pedophiles, Valor created the perfect Trojan horse.
In an article published in Forbes Digital Tool in April, reporter Adam Penenberg spotlighted Valor's "Dirty Harry-like" assaults on porn traders who were using Internet Relay Chat channels like teensex to barter forbidden images.
Valor had successfully hacked 99 pedophile targets, Penenberg reported, while law-enforcement officials "turned a blind eye" to Se7en's illegal intrusions.
"I can find a pedophile and trash his machine all within 60 minutes," Valor was quoted as saying. "I could snag more of them in one night than a D.A. could prosecute in his whole career." Newsday ran a story, reprinted in the Salt Lake Tribune and elsewhere, under the headline "Se7en's Sins Are Deadly For Child-Porn Dealers." It painted Valor as a cyber-warrior able to reduce a pedophile's hard drive to "a big hunk of Swiss," while displaying Se7en's alleged electronic calling card -- a python -- on the screen.
Another one of Se7en's "hacker weapons," Newsday's Matthew McAllester wrote, was a program that would search for and destroy all the JPEG files on a pedophile's machine.
I filed one of the first stories about Se7en's alleged crusade, "Hacker Vows 'Terror' for Child Pornographers," published in Wired News in 1997.
I quoted Valor as saying he had been initially skeptical about all the media hype about porn on the Net, but was convinced to jump into the breach after seeing images of "4-year-olds being raped, 6-year-olds forced to have oral sex with cum running down themselves."
Toward the end of our interview, Valor told me he had been abused as a child himself.
Valor subsequently appeared on MSNBC, brandishing photographs that he said were images of children downloaded from the Net.
Even a news site for Star Wars gaming fans got into the act, hailing Se7en as "a modern-day Superman."
Discovery Channel Canada Online interviewed him in RealAudio and paid tribute to the way Valor "dish(es) out justice." The accompanying article cited Valor's assertion that Usenet newsgroups dedicated to child porn garner over 7,000 new images daily, a figure repeated in article after article.
A newsgroup monitoring program on the Microsoft Research site called Netscan indicates that number was inflated ten or twentyfold.
Super-villainy calls for superheroes, and one of the superpowers that Se7en allegedly used against pedophiles was his immunity from laws against computer intrusions.
On the Microsoft Radio Network, Valor held forth for an hour claiming that police, judges, and federal officials wouldn't touch him, because they loathed his victims more than they cared about his destruction of personal property.
"You find me a jury anywhere in the world that is going to convict me for invading a child pornographer's computer and destroying it," he bragged to Newsday's McAllester. "Or in the unlikely event they find me guilty... you just made a national martyr. The whole country is going to go nuts."
Forbes' Penenberg is widely respected as an astute reporter with particular expertise in covering the hacker beat. In May, it was Penenberg who first sniffed out inconsistencies in a New Republic feature about hackers by Stephen Glass, who was subsequently found to have fabricated sources for stories in other national magazines.
Penenberg didn't rely only on Valor's own statements to write his profile. He interviewed a number of sources in law enforcement and the hacker underground -- both on and off the record. Among them was the head of the US Customs Cybersmuggling division, Gene Weinschenk, and a group that calls itself the Ethical Hackers Against Pedophilia (EHAP), dedicated to using legal means to snare child pornographers online.
"If Christian Valor fooled law enforcement and fooled EHAP, then it's possible that he fooled me," Penenberg said when contacted for this article.
Weinschenk now points out that he never actually saw Valor hack sites, that he had only heard about his campaign.
A spokesman for EHAP, who uses the pseudonym "Neville Farmer," acknowledged, "as far as seeing physical evidence, or knowing someone who'd seen something, we didn't. Normally in the underground, [first-hand reports] would have trickled down. They didn't."
The story in Newsday quoted only Valor himself, but reporter McAllester said he remembered talking with someone in the New York State attorney general's office about it. Senior members of the attorney general's Internet crime team in Buffalo say they've never heard of Valor.
Info-war specialist Winn Schwartau, who hosted the radio show featuring Valor, also said he can't personally confirm any of his hacks.
Part of the problem in accurately researching stories about hackers, Penenberg suggested, is that it's hard to know whom to trust.
"Every time I write about hackers, whether it's Yobie Benjamin, Christian Valor, milw0rm, or Kevin Mitnick," he said, "I get email from anonymous hackers in cyberspace saying that these guys don't know anything. Who do you believe?"
Journalist Richard Thieme, who published two interviews with Valor on his Web site and wrote about his alleged immunity in Salon, also never witnessed Se7en in action.
He stays away from Valor these days, calling him "a social engineer, mostly mouth."
Thieme made the observation that, by making those who trade in illegal pornography his targets and his cause célèbre, Valor's credibility had built-in insurance. Valor claimed that no one would report his attacks to the authorities, because to do so would be to implicate oneself as a pedophile.
An added benefit to Valor was that his modus operandi made it very difficult to confirm or deny his activities.
"If Se7en claimed he was hacking the Mafia," Thieme speculated, "he might get shot." Valor showcased his vigilantism as a more benevolent alternative to government censorship. But when one man's exaggerations are widely reported in the press -- like Joseph McCarthy's list of Communist spies -- they can influence legislation, believes Paul McMasters, First Amendment ombudsman for the Freedom Forum.
"It has an inevitable impact on public policy and public perception. The Rimm study [a discredited exposé of pornography online printed in Time magazine in 1995] ends up being waved on the floor of the Senate."
The eagerness of reporters to embrace Se7en's crusade points to a crucial lack of professional skepticism around the subject of child pornography, McMasters charged: "It's all about a cyberpanic -- the mainstream media's inability to resist the temptation to find another monster in the belly of the beast."
In a news industry refashioned in the image of the Net, where deadlines are perpetual and anxiety about getting scooped is soaring, reporters "aren't allowed to do a good job," he observed.
With hackers making front-page headlines, many reporters and editors are scrambling to ramp up their technical knowledge. A juicy high-tech item may not get the same edit-desk scrutiny as a story on another subject.
Ultimately, it was Valor's former comrades who brought down the legend of Se7en. The reason that Pete Shipley stopped teaching alongside him at New Dimensions International, he said, is that students would address him as Se7en's assistant.
"They'd ask me, 'What's it like to study under Se7en?'" he recalled. "I'm not going to be belittled by someone who doesn't know what they're talking about."
Brian Martin said that he truly liked Valor, but he got tired of being lied to. Valor would brag about six-figure incomes and owning an NSX racing car. Anytime anyone was in the position to see it, however, the car would be conveniently out of action.
Martin finally added his old friend to his list of "charlatans" on a Web page tracking frauds on both sides of the hacker/media fence.
Then Rabey contacted the reporters who had done the initial profiles of Se7en.
"I'm ready to sing," she wrote in email.
When I asked Valor to provide the name of one person who had observed his attacks, he said he "often lives alone." Then he named Rabey as a witness. He also claimed that he hacked pedophiles' sites on camera for MSNBC.
Rabey says, however, that the TV hack was faked, and that the pictures Valor displayed to reporters were not child pornography from the Net, but snapshots of a former girlfriend.
When I confronted Valor with a mass of evidence that his tales of pedophiles "screaming the name 'Se7en' as they go down in flames" were unverifiable, he admitted that, after remotely deleting three or four files in a couple of nights of trolling around, he "didn't have too much success."What he was doing, he said, "wasn't even really hacking."
He added, however, that after he posted his attitude-charged manifesto to a mailing list, "a lot of people went, 'This is great.' The media went nuts on this."
Valor had help in the self-promotion department. New Dimensions International has carved out a niche offering courses in Net security taught by those who know how to get around it.
Donna Schiefer, who manages systems security at an Air Force base in Ohio, praises NDI president Fred Villella for being "one of the pioneers who got the Air Force thinking outside of guns-gates-guards-badges security."
The page of instructors on the NDI site lists Valor as winning an American Legends award for his work battling online predators. That award, Villella explained, was "from a newspaper up in northern New York that was trying to buttress the idea of somebody doing something about child pornography."
Valor complains that Villella kept scheduling interviews even after he told him that he was tired of talking to the press.
"Reporters don't want to hear six sites," Valor said wearily. "They want to hear sixty."
Valor claimed that his career as a vigilante "did have its honest-intention roots." But once the press got the story, he said, "the media fed on itself."
The snowballing exaggeration became a kind of hack -- a media hack.
Now the would-be superhero just wants to teach his classes, settle down with his girlfriend, and buy a house.
"It got to the point where I grew up," he said.