U.S. soldier charged in AT&T hack searched "can hacking be treason" | Hacker News Reader

U.S. soldier charged in AT&T hack searched "can hacking be treason"

krebsonsecurity.com

64 pointstodsacerdoti56 comments

> A U.S. Army soldier who pleaded guilty last week to leaking phone records for high-ranking U.S. government officials searched online for non-extradition countries and for an answer to the question “can hacking be treason?” prosecutors in the case said Wednesday.

I searched for both those sentences in the past year at least once. I also made other sketchy searches on a weekly basis. Curiosity should not be considered evidence of a crime.

I don’t expect him to get convicted for just the google searches. They possibly matter in this case because they direcly relate to his personal circumstances. In his legal proceedings, they are used as an argument to keep him in custody due to flight risk. I find that understandable.

In the US judicial system, which is adversarial in nature, the job of the prosecutor is to put forth the strongest case which involves casting even minor details in the most evil, twisted light possible.

Every single high profile case involves these sort of details including ones where the defendant is found innocent.

All it takes is reading the takedown of a prosecutors case a few times to hear these “facts” with an highly skeptical ear.

It's not, but other evidence of a crime together with suspiciously related searches might be considered evidence of a crime.

Evidence can be circumstantial.

Eg, searching “how to pick locks” when you’ve also robbed a house — even though people search that without committing crimes.

That’s particularly true for evidence showing intent.

The question for evidence is not “is this alone irrefutable proof of wrongdoing?” but “does this in an ensemble with other known facts raise the probability of guilty?”

It's not. Not at all.

As mentioned in the article, it's part of the reasons why prosecutors consider him to be a flight risk. He was searching for this, alongside figuring out what countries don't have extradition treaties and how to get to the Russian embassy.

It is difficult to reconcile anyone being charged for hacking, when Musk and his minions are bypassing every security control ever established on government systems without any repercussion.

Luckily, the law feels no need to be consistent and therefore doesn't need to reconcile it.

Do you work for the US military in any way?

This is why I take time out of my busy week to make sure I Google and plan at least one crime a week, just to keep the government on its toes in whatever discovery they’ll be forced to do.

You must like these truthful conversations with truthful detectives where being truthful with you and as you is very important in the moment, cause all of that may be taken into account and it’s a last chance for being truthful.

There is or there used to be a browser extension called Track Me Not that would run random internet searches based on trending topics on Google News or whatever.

At one point I had thousands of searches a day on multiple networks on my "profile"

His google searches:

-“where can i defect the u.s government military which country will not hand me over”

-“U.S. military personnel defecting to Russia”

-“Embassy of Russia – Washington, D.C.”

Given the Russia-centric stuff there, I can't help but imagine what it might look like if he were arrested several months later, especially if he'd known the results might be visible to new management in the DoJ or DoD.

- "how to apply for a pardon"

- "whistleblower protections from Trump for exposing the deep state"

- "biden AT&T witch-hunt tip line"

He just needed big balls on his side.

> Days after he apparently finished communicating with Country-1’s military intelligence service, Wagenius Googled, ‘can hacking be treason.'”

It's literally in the title.

I took the comment as corrective, my bad?

What a genius.

Now I’m curious what Google returns. “10 ways to commit treason (You won’t believe the last one)”? “My grandma always used this recipe to [sell neighbors to the Stazi]”?

Do governments have an SEO strategy to encourage spying from the opposite country?

The top result is "This one simple trick to evade arrest that federal prosecutors hate"

If only he'd searched for "how to cover my tracks after making incriminating google searches"

If only he searched "mens rea" first.

Out of all the search engines out there, he just had to use Google, the U.S. Big Brother search engine, to search for defecting from the U.S. Wouldn’t surprise me if the U.S. IC is alerted to these search terms in real time. Unbelievable.

> “As discussed in the government’s sealed filing, the government has uncovered evidence suggesting that the charged conduct was only a small part of Wagenius’ malicious activity,” the government memo states. “On top of this, for more than two weeks in November 2024, Wagenius communicated with an email address he believed belonged to Country-1’s military intelligence service in an attempt to sell stolen information. Days after he apparently finished communicating with Country-1’s military intelligence service, Wagenius Googled, ‘can hacking be treason.'”

Seems like an easy guess as to what "Country-1" could be.

Dumb question here: How do they know what he googled? Is it a matter of serving Google with a warrant?

Or they searched his computer and it was in the browser history.

Maybe they subpoenaed Google for the records of searches from his IP address.

Is that a thing? I don't trust incognito mode when communicating with google servers, that's for sure.

My understanding is that incognito mode just doesn’t save local browser history. Your ISP and google can still log what you search based on IP or login state.

Your ISP can't see it because of TLS. But the search provider will know things.

Is the IP hidden if I search from my workplace, where there are 250 computers from several startups behind a single IP? (and it’s not a corporate computer) Granted, Google can identify browsers uniquely using fingerprinting, even with Incognito.

FISA. All that Patriot Act bullshit is still around most likely, including the secret courts to get secret warrants. It was supposed to be for terrorism, but just about everyone in history warned us over and over that these things get repurposed.

Guantanamo Bay is still around. The legacy of the Bush administration is for real.

There's no need to bring up FISA or Guantanamo. Normal criminal cases routinely get warrants from normal non-spooky courts for Google searches.

Yes, it happens all the time.

Search "Snowden CIA google datacenter"

It's possible they could do it without a warrant

https://en.m.wikipedia.org/wiki/National_security_letter

People are overthinking things.

The court filing says they seized his laptop and phone, and seems to suggest all this information came from examining those devices. The google searches were probably just sitting in his browser history.

Oh, and then the idiot went and bought another laptop the very next day, despite explicit military orders not to. His opsec skills seem to be lacking.

This is probably exactly what happened. I bet he used Chrome as well. It doesn't really help that Google Chrome keeps history basically forever (on the order of months), even without signing into a Google Account.

Depending on who they worked for, they may sign a document that says you will be hacked and monitored for the rest of your life.

Far better than the gag for 40 years or death, whichever comes last document.

Technically it's Google's data, so all they have to do is ask. If Google says no, then they get a warrant.

Out of curiosity, why are the prosecutors who are mentioned in the article from Seattle? It sounds like the alleged criminal is from Texas and was stationed in South Korea. What determines this legal process?

He was a US Soldier, to my understanding he'll be tried under the UCMJ and federal government. I'm not sure if location has to do anything with it, as he held a clearance and committed his alleged crimes on US or US-held soil.

likely based out of there, or his unit's HQ is, even if based elsewhere. joint base lewis mcchord is just south of tacoma.

Fuck, I was heavily researching what would happen if we nuked the Arctic. Apparently nothing, sea level won’t rise dramatically.

For your sake, I hope it doesn't happen.

Like, the entire Arctic?

I guess? Just found this:

https://worldbuilding.stackexchange.com/questions/64637/nuki...

It's about time the Arctic got what's coming to it, with all its ice and polar bears.

Total worldwide first-strike nuclear capability is somewhat less than 4,000 megatons TNT.

Total worldwide annual energy production is roughly 14.8 billion tons of oil equivalent (TOE).

Dividing the two and solving for days, we're "nuking the Arctic" (and the rest of the planet) roughly every 10 days, or in actuality, probably about half of that. Call it weekly in very rough numbers.

This mostly goes to show that 1) we're consuming energy at extremely prodigious rates and 2) the rate of energy release matters. The energy released in even a large nuclear explosion is typically a few hours of energy output of a large (1--2 GW) power plant. Form of energy release also matters, with nuclear weapons releasing heat, blast, and longer-term radiation, each of which has its own destructive potential on structures, people, and the larger environment. Primary energy production largely produces heat and combustion products, by contrast.

Sources:

- Global nuclear arsenal: <https://ourworldindata.org/grapher/estimated-megatons-of-nuc...>

- Global energy consumption: <https://en.wikipedia.org/wiki/World_energy_supply_and_consum...>

Has anyone insights how the current DOGE cuts could affect the US cybersecurity posture?

It’s not hard to imagine how they accidentally cut something very crucial.

Didn't they just fire 100 NSA employees for being freaky?

Can DOGE fire itself for being freaky?

Did they get to his browsing history because he's dumb and didn't even bother deleting it before they seized his PC, or because they have access to the ISP logs, or because Google just handed over the data?

Regardless it's creepy. Use DDG, a VPN, and never persist history if you're looking for shit like this on the web.

The people you can trust the least are not hackers or foreign agents (who don't really care about you) but your own government.

What's creepy? I would definitely trust hackers or foreign government agents more if I was trying to screw over my own country. I guess at least. This guy just seems dumb.

Option A: they used a correlation exploit combining taps of 14 undersea cables, with the audio and video recordings from his laptop and phone and the devices of his 3 nearest neighbours and two of the the cars across the street, in conjunction with multiple vpn and tor exit nodes. From this they were able to detect some of the keystrokes and virtually reconstruct the image on screen using lidar and radar to intercept brainwaves.

Option B: they checked his browser history on his laptop.

option C: they just asked google and paid a small filing fee for the trouble

fairly routine thing for criminal proceedings

Reply on news.ycombinator.com