WASHINGTON (AP) — The young hacker was told in no uncertain terms: You are safe with me.
“I am not trying to find out your true identity,” AP journalist Norm Weatherill assured the teenager in an online chat. “As a member of the Press, I would rather not know who you are as writers are not allowed to reveal their sources.”
But Norm Weatherill was no reporter. He was FBI agent Norman Sanders Jr., and the whole conversation was a trap. Within hours, the 15-year-old hacker would be in handcuffs as police swarmed his house.
The 2007 bust would put an end to 10 days of nonstop bomb threats at the hacker’s high school but would also raise a troubling question that is unanswered to this day: How often do FBI agents impersonate members of the news media?
The answer is important, says one expert who played a key role in revealing the bureau’s subterfuge, because sources need to know journalists won’t turn them in.
“Journalists play a very similar role to doctors in our society in that we trust them,” Christopher Soghoian, former chief technologist at the American Civil Liberties Union, said earlier this year. “And without trust they cannot operate.”
Two weeks ago, a federal judge rejected a lawsuit from The Associated Press and the Reporters Committee for Freedom of the Press demanding more detail from the FBI about the practice of posing as journalists. The two media organizations are appealing the ruling.
Meanwhile, the AP has drawn on hundreds of pages of records and interviews with a dozen people to piece together the story of how a computer-savvy sophomore’s end-of-year prank escalated into a confrontation between the Justice Department and the media.
“HAVE A NICE EXPLOSIVE DAY”
The first email said, “I will be blowing up your school.”
Sent on Sunday, June 3, 2007, around 9 p.m. and addressed to several dozen teachers and administrators, it said four bombs were hidden throughout Timberline High, a 1,500-student school in an aging brick building in Lacey, a middle-class suburb of Olympia, Washington.
“We treated it like a real threat,” then-Principal Dave Lehnis recalled. Administrators met with police that night and scoured the school with bomb-sniffing dogs. They found nothing.
The second threat arrived early Tuesday morning.
“It’s now time to get serious,” the email said , warning that five bombs were set to go off throughout the building. Students were evacuated to the soccer field. Again, nothing was found.
The messages, distributed via bogus Gmail accounts, continued like this for more than a week. One said , “Well have a nice explosive day and I hope everyone keeps their arms and legs.” Another warned of a vibration-triggered bomb supposedly taped to the bottom of one of the school’s portable classrooms. Some messages threatened staff members individually; Lehnis received one saying , “ENJOY YOUR LIFE ENDING.”
Each time a threat came in, the school would be emptied. Each time, nothing happened.
“There were times I just wanted to say, ‘This isn’t possible,'” Lehnis said. “I’m not sure al-Qaida could do this on this short notice.”
The threats seemed to be coming from a student. The first message — signed “Your Mom” — had the snotty tone of an attention-seeking adolescent and carried knowing references to the school’s open-plan layout. Many messages were sent in the name of a 14-year-old freshman who clearly had nothing to do with the threats. There were even complaints about prices at the student store.
“SMOOTHIES SHOULD BE $1.00,” one email said .
Some students enjoyed the evacuations. Others grew annoyed.
“A lot of kids started bringing blankets and lawn chairs,” said Meggan Dowd, a Timberline sophomore at the time. “There was just no learning because everybody was waiting for another bomb threat to happen.”
The hoaxer seemed desperate for attention, setting up a MySpace account with a picture of a bomb-wielding cartoon villain to help distribute the threats.
Lacey Police Sgt. Jeremy Knight issued a series of emergency requests to MySpace and Google, but the records pointed back to servers in Italy or the Czech Republic. The hacker had broken into the servers and used them to throw investigators off. He could have been hiding anywhere.
“It was a case unlike anything I’d ever done before or since,” Knight said in a recent interview. “The skill level there was impressive for a 15-year-old kid.”
At Timberline, Knight and his colleagues faced a number of weak tips and a multitude of potential suspects.
One student was singled out because he smiled during an evacuation. Another came under suspicion for an offhand comment about the school’s “weak firewalls.” The 14-year-old freshman framed by the hoaxer told police a certain classmate might be behind it “because he’s been talking sexual stuff about my mom.”
At one point, police had a list of 30 possible high school suspects arrayed into two spreadsheets bearing notes such as “smart, techie” or “picked on, body issues.” One note by a student’s name read: “Possible, if smart enough.”
With police hitting electronic dead ends and struggling to make sense of the high school rumor mill, parents were getting panicky. At a June 12 meeting with police and school administrators at Timberline’s library, they kicked in an extra $450 for the reward for information leading to the hoaxer’s capture.
“It’s more difficult to track email than you might think, if you have computer savvy on the internet,” Police Chief Dusty Pierpoint told the gathering.
By that point, Lacey police had called in the FBI. And agent Sanders was sending the hacker his first interview request.