Response to June 2000 Vanity Fair Article about Jericho


Brian Martin

Vanity Fair Editor -
Bryan Burrough -

I was approached by Bryan Burrough to give comments and opinions on a piece he was doing for Vanity Fair regarding Antionline and Attrition. I agreed to meet with him and ended up speaking with him for roughly two hours. I was confident that the objectivity of a professional journalist would paint a true picture of the facts. I encouraged him to ask for proof at every step of the way, from both sides. Unfortunately, that was not in keeping with his agenda apparently. Rather than write an accurate piece depicting the 'enemies', he opted to print unfounded accusations, half-wit conclusions, utter fabrications, and outrageous libel. Rather than write that unbiased piece, Mr Burrough picked up on my joke about being one step short of a Bond Villain, and ran with it.

Although I was quite disappointed with the resulting article, I opted to forget about it and move on. However, continuous inquiries from people regarding the erroneous statements about me have prompted me to write this Errata report. I will point out the errors and errata in this article, and as usual, back my claims with materials and facts that YOU the reader can see. It is obvious that facts and evidence are not needed in these types of articles. Sensationalism and incorrect reporting are.

When Burrough's submitted his final draft to Vanity Fair, one of their fact checkers contacted me to confirm details. I pointed out several errors that needed to be corrected. We missed each other on followup calls to verify the final story and Vanity Fair ran with an unconfirmed version of the facts, knowing that there were serious errors in the first version.

- Brian Martin

Material from the Vanity Fair article is quoted in Italics.

Barbarians @ The Gate

The F.B.I.'s Hacker Whiz Kids

by Bryan Burrough

"Though he says he never tried hacking himself, Vranesevich began reading everything he could..."

Vanity Fair/Vranesevich claims he has never tried to hack, yet in previous articles Vranesevich claims first hand experience at hacking. With each journalist that asks, Vranesevich provides a different and contradictory answer.

     FRIDAY, APRIL 2, 1999
     Online Sherlocks work overtime to police Internet
     Paul Van Slambrouck

     "Mr. Vranesevich trys to bridge the gulf between hackers and the
     establishment and says based on firsthand experience, most hackers
     are simply "trying to create mischief and gain peer acceptance.""

A PITT administrator shared one of Vranesevich's command histories. It clearly shows him attempting to commit Denial of Service (DoS) attacks (which are illegal) against remote sites. A quick examination of this command history shows that Vranesevich has a very limited technical ability.


"Vranesevich took it as a challenge. Using their Internet chat as a starting point, he set up a "traceback," an effort to find the point at which The Analyzer had entered the Internet. The trail led through 13 different computers in several countries, each of which The Analyzer had used as a so-called bounce-point to cover his tracks. Eventually, after a marathon 27-hour session at this computer, Vranesevich tracked The Analyzer to an Internet-service provider in Israel."

This is essentially a repeat of what Vranesevich told his friend James Glave for a Wired story.,1282,10713,00.html

     Vranesevich said that he attempted to trace Analyzer in his own chat,
     which was going on at the same time as the one between Analyzer and
     Wired News, but that the hacker had telnetted, or tunneled, through
     13 different servers, and covered his tracks by deleting log files at
     each of those boxes.

     We solicited Curt Bryson, a computer forensics consultant, and asked his expert opinion of
     Vranesevich's claims. Mr. Bryson responded with a thorough analysis of
     the supposed events revolving around tracing someone back "13 hops". From his analysis:

         "The Analyzer" had no requirement to stay legal; but those of
         us in this industry DO have such an obligation lest our client
         be held liable for our actions while carrying out the contracted
         service. My assumption here is that it took 27 hours (as cited in
         the Vanity Fair article) due to the telephone calls or other communications
         convincing the system administrators of each "bounce" to allow the investigator
         appropriate levels of access to review the logs to see telnet by telnet the path
         taken. I know of no other legal, reliable, trustworthy method of tracing back
         the origin of a machine telnetting or "bouncing" through multiple IP's on the
         open internet. Again, there are quick kludges or even all out hacks to
         attempt to trace back, but the key words here are "legal", "reliable",
         and "trustworthy".

In recent press opportunities, Vranesevich has claimed that he/AO have tracked down "hundreds" of malicious hackers. So far, proof or backing for this statement has been non-existent. There are no known published articles citing his involvement in a case, no court transcripts where he testified to the validity of evidence, nor any other form of proof to back these claims.

     To date, AntiOnline has been responsible for tracking down well over a hundred
     malicious hackers for organizations like the Federal Bureau of Investigation and the Department of Defense.

This can best be pointed out in the VF article, where Mr. Burrough essentially notices it, but does not draw the conclusion.

"Vranesevich set out to find [Khalid Ibrahim." "..Vranesevich managed to track Ibrahim to an Internet-service provider in New Delhi. There Vranesevich engaged Ibrahim in an exchange of E-mails..."

In the following paragraph, Mr. Burrough goes on to say:

"In the end no charges were brought. Ibrahim was never identified, much less arrested. But he remained active."

If Vranesevich was able to track the alleged terrorist to the ISP he was using, why wasn't he discovered and questioned? Was the information witheld from the FBI and other investigators? Or did the information turn out to be incorrect? Has Vranesevich offered copies of this mail to anyone to validate his claims? This is pointed out to show a track record for Vranesevich's claims of tracking computer criminals, when in reality he is often dead wrong.

"On June 4, at a time of international alarm over the government of India's nuclear-weapons test, a group of hackers from Britain and New Zealand, apparently an offshoot of the Masters of Downloading, announced via Vranesevich that it had successfully gotten into India's Bhabha Atomic Research Center computer system, stealing thousands of pages of E-mail and leaving behind an anti-nuclear diatribe; both the F.B.I. and the C.I.A. launched investigations (neither of which, however, led to arrests)."

     This is yet another case of Vranesevich having inside information about a hacking incident
     and it not leading to a successful investigation.

     In the wake of these events, journalist Lew Koch took the time to ferret out the
     truth from John Vranesevich. In a Cyber-Wire Dispatch, Koch spilled all the gory
     details showing in great detail that Vranesevich had little real knowledge of the events
     that occured.

The next portion of the VF article goes into Vranesevich's involvement with the New York Times defacement. It is interesting to note that over six months ago when he was asked for 'proof' behind his claims that Martin was involved, he claimed he could not divulge it because it was FBI evidence. When the FBI visited Martin, they said the evidence against him that prompted the raid was 'sealed'. Yet here Vranesevich finally divulges his "evidence" to Vanity Fair despite the ongoing investigation. Evidence is used in quotes because it is NOT evidence. One of the best definitions for 'evidence' in the context of crime can be found on "To indicate clearly; exemplify or prove." The material presented by Vranesevich is not clear and does not prove anything. Because of Vranesevich's lies, the FBI have spent well over one hundred thousand dollars of your tax money investigating Martin. In over a year and a half, no charges have been pressed, no evidence found that back Vranesevich's original lies.

"A few weeks earlier Vranesevich had received an E-mail from a hacker calling himself COmega. He wanted Vranesevich to post news on Anti-Online about the successful hacking of the Motorola Web site."

     Because of the time span between the incident and this article, COmega does not
     recall mailing Vranesevich about this, but can not say for certainty. With that
     he said that any such mail would have been PGP signed with his key and could easily
     be verified. So once again, Vranesevich should produce a copy of this e-mail to begin
     to prove his assertions.

"Another handle, Resentful Jonathon, sounded similar to Angry Johnny, the handle of a hacker who had vandalized the White House Web page two years before."

     The White House has been defaced a single time to the best of anyone's
     knowledge. It occured on May 10, 1999 and was perpetrated by "Global Hell".
     19 year old Eric Burns (aka Zyklon) plead guilty on September 7, 1999 to
     several computer crimes and admitted to involvement with the White House
     defacement. A mirror of the defacement can be found at:

     Story: Shoreline hacker gets 15-month sentence

Vranesevich's claim that "Angry Johnny" vandalized the White House Web page two years before is completely wrong and fictitious. If such an event did occur, there is certainly at least ONE legitimate news article covering the event. Yet Mr. Burrough opted not to verify this claim, and as is typical with Vranesevich, he could/would not provide proof of such claims.

"Vranesevich called up Jericho's home page and saw immediately that the large letters of the name JERICHO were in the same style as the H.F.G. hack."

     The 'style' of the JERICHO logo is completely ripped off from a music album
     titled "The Prodigy Experience". The font/style is a recreation of the font
     used on the CD Cover, but altered to say "The Jericho Page". Looking at the
     JERICHO logo next to the HFG logo, you can see there is little in common
     with the two images.
     See both images side by side
     'The Prodigy Experience'

     James Atkinson, President and Sr. Engineer (
     of Granite Island Group ( performs forensic analysis of
     computer security incidents for a wide variety of commercial companies and government
     agencies. Mr. Atkinson's background is extensive not only in computer security, but
     technical surveillance, bug sweeps, weapons training and more. We asked his opinion
     in comparing the two images to determine if any such links could be established.
     Please note that unlike Vranesevich, Mr. Atkinson posts his credentials. His reply:

         Mr Martin,

         I performed a forensic analysis on the "hfg.jpg", and "jericho.gif"
         and was not able to find a single link between either image, and
         absolutely no evidence that either image was created by the same
         person, or even on the same computer.


         The "hfg.jpg" was created with Photoshop, the "jericho.gif" was not.

         The "hfg.jpg" image contains a Photoshop tracking code, the
         "jericho.gif" does not.

         The "hfg.jpg" file is a rasterized and compressed JPEG color image,
         the "jericho.gif" is an uncompressed bit-mapped black and white
         GIF-87 image.

         The fonts used in the "hfg.jpg" have a serif, and is a completely
         different font face family then that used in the "jericho.gif"
         images. The fonts used in "jericho.gif" image do not contain any
         kind of serif elements.

         The two images are about as related as frog is to a buffalo, and any
         attempt to establish any link between the images is ludicrous.

         James M. Atkinson
         President and Sr. Engineer

"Then, at the bottom of the page, he saw the clincher. Design of the page was credited to COmega."

     This is an outright lie. The "jericho page" (
     has been the same style and design since 1994, when it was created by Demonika.
     At no time has it attributed credit to ANYONE, including the true designer. At
     no time has the name "COmega" been on the page. This is an outright lie by

"[Carolyn Meinel] alerted Vranesevich to a series of unpublicized attacks by H.F.G. against other Web sites, including those of Penthouse and NASA."

     These were made public hours after the defacements occured. Web defacement
     mirrors at the time ( and both
     took public note of these events.

"In Martin's telling, it is Vranesevich who has broken laws, Vranesevich who is being investigated by the F.B.I., Vranesevich who has launched hacking attacks on Attrition."

     From a Forbes piece about Vranesevich:
     "..the FBI would not comment whether it was in fact investigating JP or not, even
     though several other sources in the know insisted he was."

     The Ottawa Citizen also reported on this issue, but was forced to remove the piece
     when Vranesevich threatened to sue them over the piece.

"Along with a group of friends, the 26-year old Martin edits an Internet Web site named, which serves as the leading information clearinghouse for the "black hat" hacking community."

     This is a blatant distortion of the description and purpose of Attrition.
     Mr. Burrough is propogating the image of Brian Martin as the bad guy in this
     story, to help make it more dramatic. As Mr. Burrough was told, the resources
     of are used heavily by law enforcement, government agencies,
     corporations AND hackers.

"Attrition has carried articles on everything from "how to" hacking manuals to "A Guide to Shoplifting," to a recent piece that characterized the probe of February's Yahoo-eBay attacks as "a cyber-witchhunt carried out by the FBI and embittered corporations."

     While Attrition does carry some legacy content of that nature, it should be
     noted that many sites carry questionable material. Even AntiOnline carries a
     huge archive of exploit code that is used by hackers world wide to deface web
     pages ( AntiOnline also has a repository of
     Denial of Service scripts to help people carry out attacks against sites like
     CNN, Yahoo and E-Bay. (
     To make it easier, Vranesevich offers free accounts on the AntiOnline systems to help
     facilitate and support their crimes. Dozens of web page defacers use the AntiOnline accounts
     to correspond with one another, report their crimes to various defacement mirrors (including)
     Attrition, hijack Internic controlled domains and more. All of this is made possible
     by the tools and resources Vranesevich/AntiOnline offer.

     What Mr. Burrough fails to point out is that all of our recent content centers
     around helping people to secure their system. Several updates to our neophyte
     security area help novice system administrators protect their sites from the
     hackers using AntiOnline tools. We also post music reviews, product reviews
     and a world of other material. But mentioning this does not help him paint
     us as an evil entity.

     Last, his claim that we carried an article saying the attacks on Yahoo and eBay
     were "a cyber-witchhunt carried out by the FBI and embittered corporations." is
     yet another lie. It is CLEARLY not carried on Attrition. Looking at our "past
     news" (, you can search down for the
     line: "worth reading: Keystone Cyber-cops". Notice we say it is "worth reading".
     Clicking on the link takes you to: where the article is held.

"..Vranesevich considers Martin and the Attrition crowd by far the most dangerous, and not just because some of them enjoy firing machine guns, wearing fangs, and frequenting bondage clubs."

     This was explicitly explained to Mr. Burrough during his two hour talk with
     Brian Martin. The reference to fangs and bondage clubs is one to a San Francisco
     security consultant that works for a big five audit firm. He is not a member of
     Attrition and is in no way affiliated with it. No member of Attrition wears fangs
     and choice of nightclubs is irrelevant to everything. Perhaps this facet of the
     story is of concern to Vranesevich because of his intolerant and spiteful ways
     toward everyone not deemed a "normal white male". Vranesevich has demonstrated
     repeatedly that he has disdain for most nationalities and
     does not care for Mexicans, Blacks, Chinese and more.

     The reference to machine guns comes from a small convention in Denver called
     "No Hope", in which several people safely fired semi-automatic guns in a
     wooded area deep in the mountains. NO ONE from Attrition was present at that
     convention, but because Brian Martin FORMERLY lived in Denver, and because
     the convention is held just outside of Denver, both Vranesevich and Meinel
     try to associate them. As stated in the article, Martin (like federal agents
     occasionally do) does fire weapons safely on certified gun ranges.

The next portion of the article does a poor job of describing past events. It is very clear that Mr. Burrough did not take accurate notes in his talk with Martin.

"But it was around this time that Martin joined a hacker gang called the New Order. The gang, renowned for hanging out at Goth nightclubs, achieved local prominence in 1995 when four members were arrested after breaking into Denver-area computers and exchanging tips on how to execute a variety of crimes, including cred-cart theft and burglary."

     The four members arrested for breaking into Denver area computers occured some
     six months or more BEFORE Martin joined the group. Their arrest effectively
     killed the group. Martin and a friend restarted it with a new purpose and new
     goals (focused on learning and exchanging information that would lead to
     carreers in the computer industry).

     The reference to "hanging out at Goth nightclubs" is another made up arbitrary
     remark designed to attempt to link Martin to some deviant lifestyle in some way.
     While in Denver, Martin did not frequent ANY Goth nightclubs until 1998, some
     three YEARS after the demise of The New Order.

     By this quote and its inclusion in the article, both Vranesevich and Burroughs
     appear to be equating the gothic culture and patronage of certain nightclubs
     -- both legal, acceptable activities -- with criminality and deviance. Burroughs
     went fishing for a deviant lifestyle to pin on Martin to help paint him as the naughty
     villain. When he could not find such a lifestyle, he resorted to guilt by association
     to try to damage Martin's image.

"Martin says he was not involved with the break-ins. And yet, in an article that he wrote at the time and that's now posted on Attrition, he created a "Revenge Database," containing tips on ways to misuse an enemy's credit cards, run up his long-distance bills, plant phony tips with police, even sabotage his car."

     This paragraph is essentially written by Carolyn Meinel, or heavily influenced by
     her. Meinel has often pointed to this document (as well as a 1993 file written by
     Max Headroom about shoplifting) as proof that Martin is evil and commits crime.
     What Burrough and Meinel fail to point out is the companion document that was
     revised for months after the first was completed titled "How to Protect
     Yourself From Revenge" (
     Once again, by showing only half the facts, Burrough is further trying to
     paint Martin as the villain in this story.

Again, clever wording paints a picture of doubt around certain claims when there should be none.

"..Martin insists, he was actually training people, including law enforcement officials..."

     Why the word "insists"? This implies that Burrough did not believe the claim.
     Yet a few paragraphs later it was verified that Martin was correct.

"..says Mark Notaro, the Pentagon investigator, who has taken Martin's classes and considers him a valued source of information."

     If Burrough had asked, Mr. Notaro might have verified that there was at least
     one FBI agent in the last class Martin taught. But once again, that doesn't
     help the story.

"Martin's claims of upstanding behavior aren't exactly helped by the company he keeps. Vranesevich says a number of Martin's friends engage in bizarre Goth rituals, including vampirism and bloodletting."

     Excuse us? One professional associate frequents public nightclubs centered
     around the Gothic or Bondage scene. His nightlife has no bearing on Martin,
     Attrition, or anything else. These claims from Vranesevich are outright libel
     and slander. Despite these repeated claims, Vranesevich has still not been able to
     name anyone other than one consultant (who freely discusses his nightlife with
     anyone who asks). Either way, it does NOT involve vampirism, bizarre Goth
     rituals or bloodletting. Clubs are perfectly legal, they exist in cities from
     the heart of Manhattan to the buckle of the Bible Belt, and patronage of a
     nightclub in no way implies criminality on the part of the attendee. Further,
     it only represents a small portion of one's life, often times a hobby at best.

     Burroughs does not mention the company Vranesevich keeps either. Like Frank Jones
     (aka Spy King), who was found guilty to felonies involving defrauding the government.
     As a result, Frank Jones plead insanity. As a result, both Jones and associates
     are not allowed to consult for any government agency. Vranesevich was the keynote speaker
     at Jones' last seminar with a handful of attendees. Vranesevich's partners betray his
     image of the law abiding citizen.

"Then there is Martin's former roommate, a hacker known as Seven."

     This is printed despite Martin clearly explaining where this false notion came from
     (Meinel's writings), and Martin correcting it. Burrough then includes my quote
     explaining that Seven slept on my couch for five weeks while he was in Denver
     without a place to stay. This seems abundantly clear to us.

"What unnerves Vranesevich most are photos posted on Attrition of Martin and his buddies firing machine guns; in one, they can be seen mowing down slender aspen trees."

     Once again, these photos are NOT posted on Attrition, and do NOT involve Attrition
     staff in any way. The pictures have been posted to, (down) and a few other sites in the past. All sites with accounts by
     people who attended "No Hope". Once again, Vranesevich is making false claims
     and providing NO PROOF to support them. The pictures described do NOT contain Martin
     or anyone from Attrition.

Vanity Fair goes on to quote Vranesevich's manifesto in which he admits to several felonies including "Conspiracy to Commit" and "Conspiracy to Obstruct".

"...Martin struck back. Citing hacker sources, he published a "special report" on the Attrition Web site, accusing Vranesevich of paying a hacker to attack the Senate. Vranesevich did this, Martin charges, in order to be the first to interview the hacker - never mind that no interview took place."

     This is another clear example of Mr. Burrough distorting Martin's words and
     NOT RESEARCHING facts for his piece. Looking at the report itself, which
     mirrors what Martin told Burrough:


     " order for AntiOnline to break major news."

     At no point did Martin say it was for an interview. The allegation was that AntiOnline
     could break the news, which they DID in fact do. Shortly after AntiOnline broke
     the news, Wired picked up on the story.

     Have Crackers Found Military's Achilles' Heel?,1282,11811,00.html

The next segment goes into the Antionline/Vranesevich battle vs Packetstorm/Williams. Despite hundreds of people asking Vranesevich for proof to back his claims, he still has not provided it to this day. Mr. Burrough still prints these complete fabrications as gospel without any fact checking or research.

"Finally he saw the page with his teenage sister's high-school yearbook photo, her address, and an invitation to rape her."

     This is another LIE by Vranesevich. At no time did William, Packetstorm, Attrition
     nor anyone else post such a page. The image that Vranesevich is referring to is still
     up on the Internet because it does not contain his sister's address, and it does not
     contain any invitation to rape or harm her. We find it appalling that a self proclaimed
     expert in computer security, who pretends to do any sort of forensics or profiling work
     could not produce the EVIDENCE to back his claims. This sort of activity is taught
     in "Introduction to Forensics". Always make a copy of the evidence in case the
     original is destroyed, yet Vranesevich, Deborah LaComb, Carolyn Meinel, Brad
     Davis and EVERY OTHER AntiOnline supporter was not able to do this. The picture
     can stil l be seen: /errata/charlatan/negation/image/vran.jpg

"..despite repeated letters from Vranesevich's mother begging him to take it down. "Almost no one can [find] it," Martin says with a shrug when I ask why he has refused to remove it."

     Mr. Burrough is leaving out the REAL REASON Martin stated for not removing it. Like he
     stated before, we are STILL waiting for Vranesevich or LaComb to produce the material
     that includes an address and invitation to harm his sister. Until that evidence is
     produced, this remains outright libel and slander propogated by Vranesevich to help
     rid his business AntiOnline of the competition (Packetstorm). We openly challenged
     Deborah LaComb to provide the material. If she was able to do so, we offered to
     remove the picture listed above. She has not been able to do so.

     Deborah LaComb's original mail contains the same LIE that Vranesevich is propagating:

         Date: Sun, 18 Jul 1999 21:48:30 -0400
         From: deborah lacomb (
         To: webmaster[at]
         Subject: picture of aimee vranesevich

         this e-mail is to inform you that aimee vranesevich is not a member of
         the antionline crew. She is in no way connected with antionline. Aimee
         is my daughter. It is my privilege and my job to protect her. I am her
         mother. This is a picture and address of a young girl who is
         underage. I am asking you kindly to remove it. I don't know your
         reasoning for including this picture and I am not interested in
         legalities, I am just a mother trying to protect her child.
         deborah lacomb

     At NO point do we list any other address except the ANTIONLINE BUSINESS address.
     Deborah LaComb specifically states that Aimee Vranesevich is NOT part of "the
     antionline crew", and therefore it is NOT her address in any way. It is clear
     to us that John adopted his ways from his mother (also his legal counsel).

"Vranesevich says he declined to attend [Defcon] after an Attrition staffer E-mailed him that he would face "bodily harm."

     Once again, this is a complete fabrication. At no point did ANYONE from Attrition mail
     and threaten John Vranesevich in any way. As usual, Vranesevich can not provide
     a copy of this alleged e-mail. If it does exist, he has not used his computer
     skills to look at the headers of the e-mail, or he would see that the mail (if
     it exists) did not originate from anyone at Attrition. This accusation is more
     amusing in light of his partner Brad Davis making repeated threats against Martin
     on the server. Those logs are in FBI custody or they would
     be displayed here.

"Vranesevich thought the hacked Web Pages looked familiar. Using a technique he calls "virtual fingerprinting," Vranesevich found a number of similarities between the new group and the Hacking for Girlies gang. Both the graphics on the vandalized sites and, tellingly, the computer code itself indicated to him that the two groups were one and the same. Vranesevich posted an analysis on his site, pointing the finger once again straight at Martin. Once again Martin tore apart AntiOnline's analysis.

     Mr. Burrough does not include the URL's to either of these pages, so we will.
     Like Attrition staff said in their rebuttal, YOU decide based on the evidence.
     Comparing AntiOnline's vague and incorrect assumptions to our detailed and
     technical debunking, consider the "virtual fingerprinting" used. It is nothing
     more than wild speculation based on Vranesevich's previous bias.

     The original AntiOnline article:

     The Attrition rebuttal/debunking:

"After a week of investigation he narrowed his probe to three previously unidentified hackers.. he came up with proof that the three, all Americans in their late teens and early 20s, were responsible for the attacks on Yahoo and the others. What that proof is he won't say. "It's all in my report to the F.B.I.," he says. "You'll see it all in time.""

     This is yet another case of his 'hacker profiling' and no resulting charges or prosecution.
     CD Universe and Maxtor, HFG, ULG, DDoS attacks, and others: Yet no results, no charges
     and no arrests.

[Update: November, 2011: To this day, no charges were ever filed against Martin or any member of At no point were any of them detained, let alone arrested, for any computer crime.]

It is clear that yet another journalist succumbed to cutting profit off a poorly researched, over hyped article on hackers. What is more disturbing is the initial reports that Bryan Burrough will make hundreds of thousands of dollars in selling the movie deal to this story. Not only will it be an exceptionally boring and dry movie, it reeks of the ongoing saga between Kevin Mitnick, John Markoff, Jonathan Littman and the Takedown movie.

It seems clear that to sell movie rights for such a story, you must have a good and bad guy, or there is no struggle. Rather than approach the story with journalistic integrity, Mr. Burrough approached the story with money in mind. The price he paid for that rumored figure? Printing more unfounded libelous accusations against Brian Martin and the Attrition Staff.

Attrition Staff

main page ATTRITION feedback