Haunted by hackers

Several years ago, pizzas began showing up at the front door of their home in Oswego, Illinois, a middle-class suburb about 50 miles west of Chicago. Someone was sending the pies to their house, unbidden, from every shop in town. Every few weeks, a delivery person would ring their doorbell and hear the same fatigued explanation: "Yes, you have the right address. No, we didn't order this. Yes, we know who did."

Paul Strater, a senior broadcast engineer at a local TV station, and his wife, Amy, a former hospital administrator, are used to defusing these situations. For the past three years, they've been the targets of threats, hoaxes, and impersonations, all stemming from an internet trolling campaign.

Their troll — or trolls, as the case may be — have harassed Paul and Amy in nearly every way imaginable. Bomb threats have been made under their names. Police cars and fire trucks have arrived at their house in the middle of the night to respond to fake hostage calls. Their email and social media accounts have been hacked and used to bring ruin to their social lives. They've lost jobs, friends, and relationships. They've developed chronic anxiety and other psychological problems.

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up

I recently went to Oswego to visit the Straters and see the damage for myself. I also tracked down the hacker they suspect was behind the attacks. What I found was a kind of modern-day poltergeist story, starring two frightened victims and a shapeless, mysterious digital ghost they can't see, touch, or respond to in any way.

Over lunch at a sports bar, the Straters explain how this happened. Their troubles began several years ago, they say, when their 20-year-old son, Blair, got into a fight with another hacker in an internet chat room he frequented. Blair, who goes by the handle "r000t" online, has run in hacker circles for years. According to Blair, he and a teenage Finnish hacker named Julius Kivimaki, who is reportedly a member of an international hacking crew called the Lizard Squad, got into a fight over whose server would host a new hacker "zine," or collection of data.

It was a minor fight — the kind of argument that happens every day in hacker rooms. But the Straters believe it sparked a years-long harassment campaign, with devastating collateral damage. "He got it into his craw, [and he decided] that he was going to mess with us as much as possible," Paul says.

In November 2012, a local police detective received an email from a temporary email account with an address similar to Blair's. The email contained a bomb threat. Blair was on court-ordered probation at the time, as the result of a 2010 incident in which he'd hacked and defaced his school's website. When the bomb threat email arrived, Blair was arrested and held for three weeks in jail before officers determined it was a hoax.

Blair, who now works as a developer at a managed-services provider in Chicago, looks like a central-casting hacker — fast-talking demeanor, aggressive countenance — and he spends most of lunch poking at a Microsoft Surface tablet. He's also knowledgeable about hacking techniques, and at one point spends five minutes showing me a site where users can buy a stranger's Social Security number with Bitcoin.

So, yes, Blair has a rap sheet for hacking and a deep familiarity with some of the darker parts of the internet. And yes, he may have angered the wrong hackers in that chat room, or done something that made him a target for retribution. His parents are not randomly chosen targets. But they are innocent ones — drive-by victims in what appears to be a hacker grudge battle.

After the bomb hoax, the Straters began getting a deluge of unwanted items delivered to their house. Tow trucks. Flowers. Large quantities of sand and gravel. A load of flat-rate boxes. Someone called Comcast, pretending to be Paul Strater, and canceled the family's cable plan. Their electricity and gas contracts were nearly shut off, too. Paul and Amy's AOL email accounts were hacked, and Amy's school loan documents were stolen.

Around 4 a.m. on Oct. 24, 2013, police descended on the Straters' house to respond to a call from someone identifying himself as Blair Strater, who told the dispatcher that he had taken PCP and murdered his mother. (The police left after verifying that Amy Strater was, in fact, alive.)

"Swatting," as the practice of summoning law enforcement to respond to fake crimes is known, is a staple of the troll arsenal. It's an intimidation tactic, performed anonymously and seldom resulting in consequences for the caller. And in the months following the October 2013 incident, the Straters were swatted several more times.

In quiet Oswego, where ticky-tacky houses with manicured lawns line up along placid cul-de-sacs, a streak of middle-of-the-night emergency responses has a way of causing a stir. And soon, the Straters found that they were raising eyebrows, even though they'd done nothing wrong. "Our neighbors have completely ostracized us," Amy says.

Adding to the psychic toll was the randomness of the hacker's attacks. Sometimes, months would go by without a hint of trouble. Then, hoaxes and threats would happen rapid-fire for a period of several days, followed by another bout of silence. The Straters learned to live with a constant low-level terror.

In late April, the Straters were hit by what they call "Tesla Weekend." On a Saturday morning, a hacker commandeered the website and Twitter account of Tesla Motors, and the personal Twitter account of Tesla CEO Elon Musk. On Tesla's site, the hacker posted a crude Photoshop of Blair's head on top of a Tesla car, with a message reading:

"Telsa [sic] you have been raped by [redacted] and BLAiR STRATER"

The hacker changed the name on Tesla's Twitter account to #RIPPRGANG, and posted: "THIS TWITTER IS NOW RAN [sic] BY HENRY BLAIR STRATER FROM OSWEGO ILLINOIS CALL ME AT __________". And: "GET A FREE TESLA–CALL _________".

There, in the tweets, were Blair's and Amy's real cellphone numbers, for all of Tesla's 564,000 followers to see. On Musk's personal Twitter account, which had 1.9 million followers, the hacker also offered free Teslas, and gave up the Straters' home address. He also posted "@rootworx was here," implicating Blair in the hack.

For days, Blair's and Amy's cellphones got thousands of calls from all over the world — a never-ending deluge of Tesla lovers who had been taken in by the hoax.

The attacks kept coming. In one nasty spurt in May, a hacker gained control of Amy's Twitter account, which she had used only twice before, and posted a series of racist and anti-Semitic messages. That same day, a hacker used Amy's email account to post a message to a Yahoo Groups list of about 300 residents of the Straters' subdivision, including many parents of students at the elementary school that the family's youngest daughter attends. The message carried a chilling subject line — "I Will Shoot Up Your School" — and detailed a planned attack on the school. Oswego police quickly verified that Amy's account had been hacked, but the damage had been done.

Later that day, Amy discovered that her LinkedIn account had been hacked, too. The hacker posted a message calling her employer "A TERRIBLE COMPANY RAN [sic] BY JEWS."

Amy, who had worked at the firm for seven months as a director of decision support, had suspected that the trolls might target her employer. She says she had previously alerted the company's IT department that the company's systems might be compromised by the same people who were attacking her and her son. But shortly after the hack, Amy was fired from her six-figure job, and given 12 weeks of severance. Amy says she got no satisfactory explanation for her dismissal, other than a hint that she was "too much of a liability."

While she recounts the details of losing her job, Amy begins to cry. It's been a rough few years for her. She and Paul separated last year, amid the hacker chaos, and a new relationship she's been in just ended — partly, she says, because of the stress surrounding her job loss.

She hasn't been able to get another job in hospital administration because for months, her first page of Google results has included her LinkedIn and Twitter accounts, both of which were filled with racist and anti-Semitic language. She's been driving for Uber to make ends meet, but the lack of full-time employment is draining her finances, and she's in danger of losing her house.

"I feel helpless," Amy says. "I can't get a job, my marriage is over. Not a day goes by that I don't wonder if it would be easier if I take my own life." Tears cascading down her face, she adds: "I have nothing left."

Throughout their whole three-year saga, the Straters have blamed one person — Julius Kivimaki — for waging a troll war against them. Paul has tried repeatedly to get law enforcement agencies, including the FBI, to pursue a case against Kivimaki, but says he was told that since Kivimaki was a minor in Finland, there was little they could do. (Kivimaki is now 18, but was underage when most of the alleged crimes occurred.)

Which is not to say that Kivimaki has gotten off scot-free. Last year, he was outed by security journalist Brian Krebs as a member of the Lizard Squad, which claimed credit for hacking the PlayStation Network and Xbox Live platforms and has also been linked to hacks of large companies. Earlier this year, Finnish authorities convicted Kivimaki of more than 50,000 cybercrimes (yes, 50,000 separate crimes) for a years-long hacking spree that included stealing credit cards, calling in false bomb threats, and laundering money using Bitcoin — all incidents, according to Kivimaki, that are unrelated to the Straters.

For his crimes, Kivimaki had his computer confiscated, and received a two-year suspended sentence and a fine of roughly $7,000. Kivimaki hardly seemed fazed. Shortly after his sentence was handed down, he changed the bio on his Twitter profile to read "untouchable hacker god."

I recently got in touch with Kivimaki. He admitted that, yes, he'd trolled Blair in IRC rooms, and had harassed him offline on occasion — in particular, he'd "shut down his Comcast a few times." He also said that he'd pasted the passwords to Amy's social media and email accounts to a chat room, but denied he'd been the one to deface them. And he denied that he'd been the sole force behind the harassment campaign. "If I wanted to mess with them I'd have called their workplaces on Day 1," he wrote. "I've really got very little interest in them."

Kivimaki blamed the Straters' harassment on Blair, who he said was "not very well liked in the hacker scene." For years, he said, Blair had been "a pain in the ass" in hacker chat rooms and had annoyed many of the members. As a result, he said, the hackers had turned him into a target. "I have hard time [sic] feeling sympathy for them," he wrote. "Especially considering they've been actively helping perpetuate Blair's lies."

I ask the Straters what advice they would give to other families. "Don't use Twitter, don't use LinkedIn, don't use Facebook," Amy says. "Stay under the radar," Paul adds.

At this, Blair looks up from his Surface. "No one's going to do that," he says. "That's the wrong message."

Blair has a point. In 2015, leaving the grid isn't really an option. Our jobs, relationships, and movements require us to be connected through these networked systems. And as long as those connections persist, so will the risk of being targeted if someone with enough technical skill and free time decides we're worth harassing.

The Straters are ready to head home. Paul glances around the back of the sports bar, and points to a corner where groups of people are sitting, happily watching the Bears game. "This could happen to anybody in this room," Paul says. "We're just the people who got hit."

Excerpted from an article that was originally published by Fusion.net. Reprinted with permission.