Two hackers plead guilty to LulzSec attacks on Web sites

Ryan Cleary and Jake Davis, aka "Topiary," plead guilty to DDoS attacks; two others plead not guilty. The charges centered on events in a 50-day hacking spree last year.

Elinor Mills Former Staff Writer
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service and the Associated Press.
Elinor Mills
4 min read
The hacking group LulzSec, which derives from "Lulz" and Security, went on a 50-day hacking spree last year. Seven alleged members have been arrested and three have pleaded guilty.
The hacking group LulzSec, which derives from "Lulz" and Security, went on a 50-day hacking spree last year. Seven alleged members have been arrested and three have pleaded guilty. LulzSec

Two British men pleaded guilty today to conspiracy charges related to a spree of attacks on U.S. and U.K. government and corporate Web sites by the LulzSec hacking group last year.

Ryan Cleary, 20, and Jake Davis, a 19-year-old who used the hacker handle "Topiary," admitted to launching distributed denial-of-service (DDoS) attacks on Web sites including Sony, Nintendo, News International, Arizona State Police, HBGary Federal and PBS, according to The Telegraph.

Cleary pleaded guilty to four additional charges, including hacking into U.S. Air Force computers at the Pentagon. He was indicted by a U.S. federal grand jury earlier this month on charges related to hacking into the Web sites of Fox, PBS and Sony Pictures. It is unclear if prosecutors in the U.S. will try to extradite Cleary to face those charges. His lawyer says she would fight extradition because her client has Asperger's Syndrome, according to The Associated Press.

Meanwhile Ryan Ackroyd, a 25-year-old who allegedly used the handle "Kayla," and a 17-year-old who was not named because of age but has been associated with the handle "T-Flow," pleaded not guilty to the conspiracy charges. They will face trial April 8, 2013, according to The Telegraph. All the defendants were released on bail, except for Cleary.

All four pleaded not guilty to two counts of encouraging or assisting others to commit computer offenses and fraud. They were accused of posting stolen data to public Web sites. Southwark Crown Court official Gryff Waldron told the AP that prosecutors are still deciding whether to bring Cleary and Davis to court on those charges.

The group is accused of stealing confidential information -- including passwords -- and releasing it publicly, hijacking e-mail accounts and even secretly listening in on a conference call in which the FBI and Scotland Yard talked about trying to catch them.

Davis, Ackroyd and T-Flow are believed to be three of the founders of LulzSec, along with the leader "Sabu," who was identified as Hector Xavier Monsegur by the U.S. Attorney's Office in New York in March. Monsegur had been arrested and released in June 2011 when he pleaded guilty and agreed to serve as informant. His cooperation resulted in the arrests of Ackroyd, Davis and others who were associated with Anonymous, but are not believed to have been core members of LulzSec, including Darren Martyn, also known as "pwnsauce," and Donncha O'Cearrbhail, aka "Palladium," both of Ireland.

Separately, Jeremy Hammond, aka "Anarchaos," was arrested in Chicago in March and charged with crimes related to the December 2011 hack of Stratfor, a global intelligence firm. He is not alleged to be a member of LulzSec.

Below is a timeline of major LulzSec events. Dates may be approximate as it is often difficult to determine exactly when a network was compromised:

February 2, 2011 - Anonymous hacks HBGary Federal site

May 15 - LulzSec claims credit for hacking UK ATMs and Fox Network's X Factor site

May 23 - LulzSec leaks data from Sony Music Japan

May 30 - LulzSec defaces PBS.org

June 2 - Group leaks customer data from Sony Pictures

June 3 - Hacks on Nintendo and InfraGard Atlanta

June 6 - Sony Entertainment source code and Sony BMG hacks

June 7 - Monsegur, aka Sabu, arrested on identity fraud charges

June 9 - LulzSec compromises U.K. National Health Services site

June 13 - Data stolen from videogame maker Bethesda Software

June 14 - Senate site compromised

June 15 - DDoS on CIA site

June 16 - Thousands of passwords dumped

June 20 - DDoS on U.K.'s Serious Organized Crime Agency

June 21 - British police arrest 19-year-old Ryan Cleary

June 23 - Arizona law enforcement sites compromised

June 25 - LulzSec announces that they are quitting after 50 days

June 28 - Zimbabwe, Brazil, UMG, Viacom hacked

June 29 - Arizona Dept. of Public Safety data dump

June 29 - FBI searches home of Ohio man

June 30 - another Arizona law officer data dump

July 4 - Apple server targeted

July 8 - Chilean government site, IRC Federal hacked

July 11 - hackers claim Booz Allen Hamilton hack

July 18 - LulzSec deface Murdoch's The Sun

July 19 - 16 arrested in U.S.

July 22 - U.S., Italian cyber crime site hacked

July 27 - Topiary arrested (Identified this week as Jake Davis)

August 6 - Italian police sites attacked

August 15 - Monsegur pleads guilty to computer hacking charges

August 18 - Hackers claim data stolen from Vanguard Defense Industries

September 22 - Arrest of Cody Andrew Kretsinger, 23, of Phoenix

December 25 - Stratfor data stolen

March 6 - AntiSec hacks Panda Security site to protest LulzSec arrests

June 13 - U.S. indicts Ryan Cleary for Fox, PBS hacks