“OUR SECRET IS OUT!!!”
Charles Jenkins has been programming since he was 10 or 11. Now a youthful 25-year-old with a slight frame and a boyish smile who works in software far from Washington state, he speaks in a bored-sounding monotone over the phone.
“I don’t really have any excuses,” he said in an interview, the first he has ever granted.
Jenkins — whom the AP is identifying by his FBI-assigned pseudonym because he was a minor at the time of his hoaxes — said he wanted to apologize, especially to the classmate he tried to frame. Several Timberline students said Jenkins had been bullied for being gay, but Jenkins said it wasn’t particularly serious.
“I definitely wouldn’t attribute that for a motivation for what I did,” he said. Questioned after his arrest, Jenkins described the threats as a kind of end-of-year prank. A decade later, he said he had no particular motive beyond “feeling powerful.”
He relied largely on two or three servers that he had penetrated from his home computer. He typically emailed his threats between the time his parents left for work and when he took the bus to school.
Jenkins said his parents weren’t overly concerned about what was happening at the school, though he did recall his mother remarking one evening, “Whoever is doing this is going to get in a lot of trouble.”
It was just after class on June 13 that “AP Staff Publisher Norm Weatherill” wrote to Jenkins to ask for comment on the threats.
“Leave me alone,” Jenkins replied.
Weatherill — who was actually Sanders, the undercover FBI agent — persisted, promising anonymity. “Readers find this type of story fascinating,” he explained, the way any journalist would.
Jenkins relented, and the agent sent him links to material related to an AP article he was supposedly putting together. When Jenkins clicked, malicious code ran on his computer and broadcast his internet protocol address back to law enforcement.
Six hours later, Lacey police were at his door.
Jenkins pleaded guilty in juvenile court to identity theft, harassment and making bomb threats. He was sentenced to 90 days’ detention, ordered to pay nearly $9,000 in restitution and barred from possessing computers, cellphones or video games for two years.
That might have been the end of it had it not been for Wired magazine. Two days after Jenkins was sentenced, Wired broke the news that the precocious cybercriminal had been caught with the help of FBI surveillance software, offering what it called “the first public glimpse into the bureau’s long-suspected spyware capability.”
“Our secret is out!!!” an employee of the FBI’s technology division emailed colleagues the day the story ran. The spyware disclosure angered the bureau. “People are not happy,” an FBI lawyer wrote in an email several days later.
The emails, obtained in 2011 by the San Francisco-based Electronic Frontier Foundation, were part of a cache showing how the spyware that caught Jenkins appears to have been first developed in 2001 . By 2007, the FBI was secretly deploying the technology across the country , drawing interest from the military and foreign governments .
Then in 2014, Soghoian went through the EFF documents and spotted something others had missed. The FBI hadn’t just used spyware in the Timberline case; it had delivered it using a fake AP news story dressed up to look as if it was on The Seattle Times website. Soghoian shared the find on Twitter , setting off a media firestorm .
FBI Director James Comey defended the practice in The New York Times about a week later, revealing in the process that the bureau had not merely produced a fake AP story but had also relied on an agent posing as an AP journalist.
“That technique was proper and appropriate under Justice Department and FBI guidelines at the time,” Comey wrote. He said doing the same thing now “would probably require higher-level approvals than in 2007, but it would still be lawful.”
AP responded by saying Comey’s explanation “doubles our concern and outrage.” Writing on behalf of two dozen media organizations, the Reporters Committee called law enforcement’s impersonation of journalists unacceptable, “whether it is digital or physical.”
“THE TOOL OF FIRST RESORT”
In 2007, law enforcement hacking was a novelty. By 2014, researchers had documented a crowded field of police and spy agency hackers and the frequent use of fake media personalities , malicious news apps and bogus articles to trick targets into compromising their own devices.
A few days after Comey’s comments, the AP filed a public records request seeking information on whether the FBI’s actions in the Timberline case were an isolated incident or part of a broader pattern.
The bureau blew its legally mandated 20-day deadline, at one point saying it would take 649 days to process the data. The Reporters Committee, which had filed similar requests , sued together with AP.
In March 2016, the FBI produced 186 pages of documents, among them a report acknowledging that “an argument can be made” that the FBI’s Seattle office violated agency guidelines by letting Sanders go undercover as a journalist without alerting headquarters. In June, the bureau quietly tightened its rules on the impersonation of reporters, explicitly requiring top-level clearance from Washington every time an agent poses as a member of the media.
The new restriction, made public when the FBI’s inspector general released its report on the episode in September, fell far short of the ban on impersonation that the AP and other news organizations were seeking. And it did little to answer the question of how often the FBI has passed itself off as the media.
On Feb. 23, a federal judge said the FBI had made a good-faith search of its records and had disclosed all it needed to. The AP and the Reporters Committee say the bureau needs to look harder.
“AP is calling for the release of all FBI documents related to the impersonation of any and all journalists in order to make the public aware of this deceptive practice and its breadth,” Executive Editor Sally Buzbee said in a statement.
Underlying the fight is the suspicion that the FBI didn’t impersonate a journalist just that one time.
“If they’re using this to find a teenager who doesn’t want to take an exam, it’s not a tool that’s reserved for high-profile terrorism cases or child abuse cases,” said Soghoian, formerly of the ACLU. “The concern is it’s becoming the tool of first resort.”
The FBI declined to comment on the Timberline case or its fallout and refused to make Sanders, the FBI agent, available for an interview.
Back in Lacey, even those who were pleased with the FBI’s work allowed that the bureau’s methods raised eyebrows.
Lehnis, the former principal, said the bureau caught Jenkins in the nick of time — less than two days before graduation ceremonies.
“We were glad it ended when it did,” he said. “But using the press? Certainly if I were a journalist that would piss me off some.”
AP Researcher Monika Mathur in Washington contributed to this report.
Timberline High Bomb Hoax Documents: http://apne.ws/2niMDP0
Know more about FBI hacking or law enforcement impersonation of journalists? Raphael Satter is reachable at: http://raphaelsatter.com
This material may not be published, broadcast, rewritten, or redistributed.