DOGE staffer 'Big Balls' provided tech support to cybercrime ring, records show | Hacker News Reader

DOGE staffer 'Big Balls' provided tech support to cybercrime ring, records show

reuters.com

175 pointspseudolus114 comments

That's borderline propaganda... By that logic, Cloudflare would be providing "tech support" to cybercrime rings just because some criminals used its DDoS protection. If we apply the same standard, every major tech company, from Google to Namecheap, would be guilty of offering "tech support" to cybercriminals on a daily basis.

But the article says they publicly posted about being "valued partners" with DiamondCDN. That seems to be more than just some criminals signing up and using the CDN. At the very least it creates more questions than answers, no?

Is a public post from a cybercrime ring credible evidence?

I get that the potential connection may warrant more investigation. But I don't see any real evidence of anything in this article other than they were a customer of DiamondCDN for an unknown amount of time.

Emphasis on they (the cybercriminals) posting about it, right? Does it seem reasonable to take the word of the cybercriminals at face value? Usually a lot of this stuff is tongue in cheek anyway.

e.g. if a cybercrime group puts out a public statement saying "thanks FBI for making your systems so easy to hack", a reasonable headline derived from that would be "FBI aids cybercriminals with hacking"?

> Does it seem reasonable to take the word

I don't know why you'd put your provider on blast like that unless you knew they'd resist any pressure or just not care about shady activities. It would just cause more issues for you (the criminal) if they cut service.

Glad we're giving so much credit to criminals for rationality and reasonable behavior.

There is a stark difference between businesses that incidentally have a tiny percentage of customers engaged in crime, and one that panders specifically to the criminal element.

https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-...

"Big Balls" came out of this cybercrime area, and this was specifically where he promoted his business. This cybercrime company is the single known customer of his "CDN", so it's a bit laughable trying to bunch it in with mainstream companies.

If someone sells burner phones to crack dealers on street corners, don't try to tell me they're just like Verizon.

This just doesn't seem like much of a story to me when we have Kevin Mitnick being convicted for hacking crimes at 25 and being a consultant for the FBI after doing his time. It might be shocking to the general public but the shady hacker turned white hat thing is as old as the cyber security industry itself

It’s a very large leap to assume anyone at DOGE is doing anything “white hat”. I mean I can think of one “white hat” thing they might be involved with but it’s not related to hacking.

"after doing his time"

So then have BigBalls at least do his time before handing him the keys to the kingdom.

And what would be the crime?

Assisting cybercrime by the sounds of things: "Two years before becoming a DOGE staffer, Coristine provided network support to a cybercrime group." That enough for you?

> So then have BigBalls at least do his time before handing him the keys to the kingdom.

Given that he hasn't been charged with a crime (much less convicted), the "time" he is due to serve is zero.

Given recent news, charging crimes is not really stopping this government.

How does providing a CDN assist a cybercrime group in committing a crime? Specifically.

I can't tell if this is a serious question or not? So this response is only in the case that it is a serious question. Please ignore if I've misapprehended the sarcasm.

Based on what I read, the minimum would be aiding and abetting. At least, that's what it would be here in Wisconsin.

aiding and abetting

Not a lawyer but I think that only sticks if the CDN he managed was specifically built for criminals and the selling points were to hide criminal activity similar to some bullet-proof hosting solutions otherwise Akamai, Bunny, Cloudflare and many others would be seized as they have a myriad of criminals utilizing their network as well but I could be wrong. Was there solid evidence that this CDN was purpose built for criminal usage such as proof of intent?

> only sticks if the CDN he managed was specifically built for criminals

Why? If he knew it was being used for crime sufficiently to let him brag about it to the FBI, he’s complicit.

Why? If he knew it was being used for crime sufficiently to let him brag about it to the FBI, he’s complicit.

I don't follow. I can brag about Akamai or Cloudflare being used for criminal activity and still use it myself or even promote it to others. That is a strong selling point in that if criminals can use it then it's less likely my crass meme sites might be taken down.

Was the CDN he promoted only sold to criminals explicitly for criminal activity? e.g. not logging admin access, hiding identities of criminals, promoting the support of illegal content, etc... The difference in my eye is the intent to use for illegal means vs. the illegal usage of a generic tool as a by-product. Was he actively promoting illegal usage to the would-be clients? As for boasting about it to the FBI I would want to hear the actual dialogue. Media have been putting slants on details as they know crapping on DOGE is popular right now.

In reference to intent an example would be if one hosts an anonymous forum or chan site and someone uploads illegal content they are protected from criminal prosecution assuming they quickly remove said content whereas if they host an anonymous forum or chan site and promote the sharing of illegal material then they are no longer protected.

> I can brag about Akamai or Cloudflare being used for criminal activity and still use it myself or even promote it to others.

You're not running Akamai or Cloudflare.

You're not running Akamai or Cloudflare.

True, but I have used Akamai knowing full well it is used by criminals. Whether I am running or not is unrelated unless it is being promoted to criminals for crime. Intent is what matters here in my opinion. If it was purpose built for crime and/or I am promoting it to be used for criminal activity them I am complicit in the usage of said crimes. Was BigBalls promoting the CDN to potential clients for the use of criminal activity?

There is a material difference between "someone using it openly acknowledges it is being used by criminals" and "someone running it openly acknowledges it is being used by criminals".

Is that difference enough to make it criminal? I dunno, I'm not a lawyer. But pretending the difference is meaningless is unhelpful.

Yeah I am not a lawyer either. I think it will be interesting to see where all of this lands. I appreciated the discussion and everyone's time. The thread was flagged so I must go get some chores done. Thankyou for the discussion.

> Was the CDN he promoted only sold to criminals explicitly for criminal activity?

Again, this is a nonsense test. I can’t get out of being a getaway driver for a bank robbery by claiming I once did a regular Uber. (I’m ignoring the irony of bending over backwards like this to exonerate a kid illegally mucking around in our agencies at the behest of our first felon President jailing folks without a trial or legal warrant.)

I can’t get out of being a getaway driver for a bank robbery by claiming I once did a regular Uber.

Of course you can. If it can be proven your intent was to help the bank robbers then you are complicit in the crime. If criminals used your service and you were either unaware or afraid for your life then at worst you would be a victim.

> If criminals used your service and you were either unaware or afraid for your life then at worst you would be a victim

If you repeatedly found yourself in that situation, got paid for it each time, never reported it and bragged about it, no, you would be an accomplice. You would certainly claim to be a victim. (Everyone in Silicon Valley is a victim nowadays.) But that would be a poor defence, certainly against criminal investigation.

I acknowledge that is a poor defense. That said, all the CDN operators know of criminals on their network but will not take them down until either the government orders them to or until the bad publicity around a site can not be ignored 8chan as an example. Some of them talk about this. They do not want to officially get into the business of policing their customers or they would be expected to by the judicial system.

To your point about money I think that is also a factor but in a different way. If every CDN/DNS/Registrar held their customers to the standards of their AuP/ToS they would lose most of their customers. When you get a chance read your AuP/ToS on your CDN/DNS/Registrar/VPS provider. Even lewd content highly subjective is an account terminating offense. They do this so they do not get sued or the suit is dismissed when they have to terminate an account but if they enforced it strictly nobody would invest in them and they would have no customers.

I think I will leave the topic here since the thread was flagged. It has been an interesting and thought provoking discussion. I must go feed the critters now.

I think it does raise the question of where the line is drawn with respect to know your customer and duty to mitigate.

Your uber driver might have it, but gas stations certainly don't.

Is it criminal if a gas station owner openly admits they don't check ID and their customers include criminals.

Are the companies behind messengers like Signal, and VPNs like Mullvad, or the Tor Project, or any number of crypto-currency projects, are they aiding and abetting criminals?

Active support of a criminal enterprise. I believe it's not just a state crime but also federal.

I don't know the law precisely, but if I attempt to emulate the US leadership, then:

It's radical lefty anti-establishment behaviour which is obviously criminal and I can't believe you're even asking such a ridiculous question when anyone who has lived in the real world for longer than a week would implicitly know the answer.

I would have used caps in select places to improve the parody, but I didn't want to seem actually serious.

read the article.

I did. What would be the crime?

The Feds have prosecuted people[1] not for committing original crimes, but for abetting those who do, which is in and of itself a crime, if done knowingly.

[1] https://www.justice.gov/sites/default/files/criminal-ccips/l...

In what way does a CDN abet others in crime, and what was the crime being abetted?

Or any thug turned into private detective/policeman. Older than you think.

This is exactly the complacency that's going to ruin lots of government systems. 20 or even 10 years ago, everyone would be rightly horrified about anyone like this having privileged access. He seemingly hasn't faced any consequences for his actions either - do you really want someone who associated with a group that "boasted [about] online of hacking government emails and cyberstalking [an] FBI agent"? The potential for him to be compromised is enormous.

The comment you are replying is literally about someone convicted of hacking crimes (not someone alleged to have aided a cybercrime group with CDN services) working for the government. So no, your assertion that 20 years ago everyone would be horrified by such a situation is dead wrong. Did you reply to the wrong comment? It kinda seems backward when your own parent comment gave a great example that disproves your point.

So no, your assertion that 20 years ago everyone would be horrified such a situation is dead wrong. Did you reply to the wrong comment?

Mitnick was 30 years ago. Things changed thereafter, and the patent is correct.

Did you reply to the wrong comment?

He was charged 30 years ago, but consulted for many years after his release (only 25 years ago). So definitely his activities would be included in the last 20 years.

Even if that wasn't the case, why should something that was OK 30 years ago be so crazy that we shouldn't do it now? Hint: no reason at all, "people would be horrified at X behavior Y years in the past" is and always was a poor argument, even when it's true (which again in this case it is clearly not).

Is it really the same thing, though? What access to government IT systems did Mitnick have in his role consulting with the FBI? What qualifications does Corastine have to be a "senior advisor" at the State Department?

Perhaps I could have been clearer, but I wasn't referring to Mitnick, I was referring to the DOGE employee, who is different in important respects from Mitnick.

Mitnick was advising the FBI, not running their systems. There is a huge difference between listening to a talk or having an outside consultation offer advice and giving them highly-privileged direct access.

Even that was controversial enough that it made the news, too.

I agree. But that wasn't the argument made in the comment above mine.

Whataboutism (and comparing wildly different things, muddling them into a superficial similarity) is going to kill your country.

I find it important to consider what is motivating whataboutism in general. It usually comes off to me as a mazy argument, but its an attempt to point out inconsistency of one's opinions.

The problem isn't when someone raises a "but what about..." argument, the problem is if someone uses it to retroactively justify something.

Its totally fair, in my opinion, to ask why someone should care about this Signal chat if they didn't care about Hillary Clinton's personal email server. On the flip side, its also reasonable to ask why someone wouldn't care about this signal chat if they previously wanted to put Hillary in prison for using her email server for official communications.

But you need to compare comparable things. Those whatabout arguments are almost always based on very superficial similarity - it "looks" to be the same thing, when those are by nature profundly different.

For sure, the approach can often be used to make logical comparisons where they aren't really equivalent.

The Hillary Clinton email server situation feels very similar to this Signal thread issue to me though. Both involved government officials using unofficial forms of communication for official work, likely confidential work in both cases.

I say likely because this one seems like it would have been classified if reviewed, and for Hillary we just don't know what was on the email server and I don't know of a public report that investigated communications that involved both her server and official servers.

For Hillary, we do know. Her server was not in violation of policy at the time for unclassified data - the policies were strengthened later – and she did not intentionally store classified data there. The FBI said nothing was classified at the time after their investigation but identified a hundred emails which should have been:

https://www.washingtonpost.com/politics/2022/09/08/hillary-c...

In this case, I think the difference is intent and ambiguity. This information was clearly known to be classified (remember last week when they were arguing that the flight details of immigrant deportations were classified and couldn’t be shared with a federal judge? Kinda hard to say information about military strikes which haven’t happened yet is less sensitive.) and it’s clearly something at the level to qualify as a federal record, but they don’t show any signs of having stored a copy.

> she did not intentionally store classified data there

Intent is always hard to prove. Either someone has to admit they intended to break the law, or they had to make the mistake of creating evidence that makes the intent clear (like writing it down or saying it to a witness who can be compelled to testify).

It is likely a realistic legal loophole that the documents stored weren't already classified, though that is gray area enough that it could very well come down to a judge's determination of whether to consider the letter of the law or the intent of the law.

All that said, my original point was simply that I find it important to understand why someone reaches for a "what about..." type argument. I see a lot of people hold inconsistent ideals depending on the context, and I meet very few people who seem to be principled in how they think through tough topics.

> Intent is always hard to prove

They found her telling people not to use it for classified information. The items which were there were not marked as classified at the time.

That’s a contrast to creating a group for the stated purpose of talking about a classified operation and enabling automatic message deletion (records laws mean they’re supposed to review before deleting).

You're leveraging the benefit of years of time with one case and comparing against the other after only a day or two. We don't know what will be known with the benefit of time here, judging a comparison here needs to use a similar timeline.

A few days after the email server situation leaked we were seeing a very similar situation to today. One party either denied it happened, refused to answer, or claimed nothing classified was shared on an insecure channel.

Hilary did this and it turns out they found nothing shared was technically classified but upon further inspection it should have been. Trump and his people are similarly claiming nothing classified was shared, that may turn out to be false of it may turn out to technically be true only because it hadn't been officially reviewed yet, we simply don't know yet.

Are those two situations so dissimilar that, in your opinion, it still falls into the whataboutism bucket? To me they aren't, though that's also fairly uncommon as many times I see "what about..." claims they aren't easily comparable and are more of a distraction or grasping at tribalistic straws.

Being a consultant is a far more limited role than what’s been reported with DOGE being given administrative-level access to many systems with sensitive data without following the normal processes for background checks, training, auditing, copying data, etc.

That’s the difference between hiring a former burglar to give you advice and putting them in charge of building security.

> a consultant for the FBI after doing his time

I take it little Richard has done his time too?

> doesn't seem like much of a story to me when we have Kevin Mitnick being convicted for hacking crimes at 25 and being a consultant for the FBI after doing his time

This kid wasn’t convicted. He’s never shown contrition or growth. He’s a cybercriminal who was given the keys to our payments systems by Musk.

This kid wasn't charged. That is a required step before being convicted.

What happened to innocent until proven guilty?

What happened to denying security clearances?

To be honest, the whole security clearance process has always seemed (to me at least) much closer to McCarthyism/security theater than an effective way to prevent infiltration by actual spies and such.

well we've done a good job this year showing the alternative of "just let whoever in" is much, much worse. Bravo.

Have we? What have been the repercussions so far?

> What have been the repercussions so far?

We really have to wait for an American pilot to be shot down, don’t we. Seeing the flames isn’t enough; the house has to burn down.

Well yes, I think there should be some tangible damage before you can make a claim like that.

> What happened to innocent until proven guilty?

that's only applicable in a court of law. otherwise the police wouldn't be able to investigate or arrest anybody - officer I haven't been found guilty, therefore I'm innocent.

The FBI has handlers to filter and proxy between the privileged information and the consultant, and whilst it might be a bit leaky as trust between the parties is earned over time, in the case of DOGE staffers, all the handlers have been fired, and it's juniors holding the golden keys and interfacing directly with data.

There's no comparison.

At least Mitnick went through a security clearance / background check before being given any type of access. I doubt the same can be said about "Big Balls".

Isn't there a substantial difference between someone who has been convicted and has subsequently reformed (at least to the satisfaction of the justice system), versus someone whose indiscretions were never disclosed prior to his employment?

Oh, sweet so Mr Balls has done time and paid his debt for his crimes then?

The next administration is going to have to replace all these systems. You have inexperienced, sketchy, and hostile actors who've gained physical access to them. They can't be trusted anymore.

The idea that next admin will be dramatically different to current one... wishful thinking. Just because it would serve nicely our ideas of how world should be run doesn't mean it will.

The irony (which is not incidental) is that there was no deep state, but one is being installed before our eyes.

The Deep State has such formidable opsec that they simultaneously are everywhere and nowhere.

The Deep State has persisted in such a dangerous world, yet the current administration has defied learning their methods.

Although the evidence of absence is mounting, the Paul Weiss deal is the clearest association of Deep State I’ve seen:

https://www.reuters.com/world/us/trump-is-not-dictating-lega...

There’s almost an indulgent irony if Paul Weiss is forced by the President to represent Big Balls.

Poe’s Law[0] prevents me from knowing if this is a serious statement.

[0] https://en.m.wikipedia.org/wiki/Poe%27s_law

Yeah, sorry that’s muddled thinking. I was agreeing with you and trying to use their hyperbolic bases to make the point that a series of disconnected phenomena have justified the President targeting individual law firms.

I first heard the term "deep state" when Erdogan started going on about it. It seems to equate to government employees loyal to their country rather than the autocrat of the moment. So it only really comes to be a thing with iffy autocrats. Before that the people are just loyal patriotic types.

Isn't that kinda the point? They don't really want these systems to exist at all.

DOGE is the best thing to ever happen to foreign intelligence agencies.

Also lawyers.

trial lawyers having a field day with everything Trump is doing.

Trump is, by executive fiat, literally banning any law firm that takes cases against him or his agenda from stepping foot in federal courthouses.

The US is speedrunning to being a despotic dictatorship and people are just blissfully unaware.

Don't forget that some of them are cheering it on too.

It doesn't work out to be a lawyer in a lawless country.

I feel like I’m taking crazy pills, did anyone read the article? He ran a CDN. Unless I missed something, there doesn’t appear to be any reason to believe he knew it was a “cybercrime ring”.

  On Feb. 15, 2023, EGodly thanked Coristine's company for its assistance in a post on the Telegram messaging app.

  "We extend our gratitude to our valued partners DiamondCDN for generously providing us with their amazing DDoS protection and caching systems, which allow us to securely host and safeguard our website," the message said.

This isn't about whether or not Coristine should go to jail for EGodly's criminal activities. This is about whether Coristine has the maturity and moral integrity to be accessing government systems.

I extend my gratitude to my valued partner loudmax, who has been helping me commit cybercrime for the last 20 years.

These fucking mediocre, feckless and otherwise ineffectual assclowns...

Putting to one side special cases would this disqualify you from security clearance? Or even.. federal employment?

Yes and you or I could be prosecuted for doing so. Unless you were able to get some kind of special permission, like other well known hackers who worked with the FBI and CIA, acknowledging that stuff would be a deal breaker for regular employment.

Under a normal regime, yes, one would expect this avenue of employment to be open to you. But you see, Trump as appointed Elon to be godking with no oversight from any branch of government, so the odds of anything happening here are low until somebody hears "Big Balls" bragging at a bar and beats him to death for destroying the country.

USA is in that final season that producers wanted but nobody asked for.

No Datadome Javascript:

https://www.staradvertiser.com/2025/03/26/breaking-news/doge...

https://www.usatoday.com/story/news/politics/2025/03/26/doge...

So I take it he isn't getting that top secret clearance after all?

What a circus

Clearances are an executive construct. Trump can give TS to every sea turtle if he wants.

Yes, but there's been a process for it for every other year before. Trump is clearly ignoring that process to great effect.

Sure. My point is that’s a norm, not a law.

Deja vu, or didn't we already know this?

I remember allegations of cyber crime connections the first time I heard about "Big Balls".

DOGE increasingly seems like a crime syndicate of some kind.

this is absolutely hilarious to watch.

I’m going to take a wild guess that the incoming negative comments will be from those who haven’t read the article, as it strikes me as quite the non-story.

His business provided a CDN to an (allegedly) criminal group for their a website. I can understand someone’s granny reading this and thinking it’s bad somehow, but this is HN, I’d expect people on these boards to known better.

Having read the article, Coristine does not come across as blameless. When you run a business, you shouldn't be gathering criminals as your clients.

He was hoping to get into the international banking game.

This is why federal jobs involve background checks and federal IT work is built around least-privilege. Before giving access to someone, they’d normally have provided a full disclosure of their past and things like this and his other ties to illegal activities would be investigated. That access when granted would have restrictions on what they get and how they do it (e.g. no personal devices, limited access to the specific data needed to perform their job, their activity is itself logged, other people oversee their work, etc.).

Because some employees of a campaign donor were granted access without following any of those rules, it’s a huge story because were heavily dependent on Musk’s personal judgement as the only real protection for federal data.

> his other ties to illegal activities

What illegal activities? The article mentions ties (we can ignore whether they are strong or weak) to people, not activities. Providing a CDN is not an illegal activity.

It can be depending on how much you know about criminal use of that service. Past reporting of him has covered a persona in a community which is popular with people engaged in illegal activities including what appears to be him soliciting DDoS services. Again, typically the kind of thing you’d investigate before giving access.

https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-...

I read that when it was on HN previously, and giving it a look again, I don't see any mention of how the CDN was used in criminal activity, nor how it could be used in criminal activity. Maybe you could point it out, seeing as you shared it.

Reply on news.ycombinator.com