Print 29 comment(s) - last by senthewolflord.. on Aug 4 at 2:47 PM

It appears UK police have been deceived by LulzSec.  (Source: Warner Brothers)

The man they believed to be a member of LulzSec was reportedly a famous internet troll, whom a LulzSec member "stole" the name of. This could prove the latest embarasment for UK police.  (Source: Gaming Union)

LulzSec has a proud history of trickery. Thus far all its supposed "members" who were arrested turned out to be youths who had run afoul of LulzSec parent org. Anonymous. The arrests appear cleverly orchestrated by LulzSec as retribution on behalf on Anonymous. The latest incident seems to be a similar case of misdirection and trickery.  (Source: LulzSec)

One blog claims this man to be the "real" LulzSec Topiary, as seen in an Anonymous press interview.  (Source: YouTube)
Chat logs, video evidence indicate that the arrest was the result of misdirection

Earlier today the blogosphere lit up with news that "Topiary" a key hacker from Anonymous and LulzSec was arrested.  Topiary, along with "Sabu", was viewed as a LulzSec "chief", instrumental in orchestrating the group's many sophisticated attacks [1][2][3][4][5][6][7] [8][9][10][11][12][13][14][15].  But all may not be as it seems.

I. The Arrest

If the arrested man was indeed LulzSec's Topiary, he couldn't have picked a much more perfect lair.  Much like a James Bond villain, the alleged hacker was arrested on a remote island -- one of the Shetland Islands, off the north coast of Britain's mainland.

Police transported the 19-year-old suspect to central-London, for interrogation.  Police say they're also searching for a 17-year-old related to the case in Lincolnshire, a eastern province of the mainland.  

Police characterized the arrest as a "pre-planned, intelligence-led operation".

Topiary's Twitter account fell silent about a week ago, and many posts were deleted from it.  The sole remaining post, dating to July 21, played Medger Ever's iconic quote "You can not kill an idea", stating, "You cannot arrest an idea."

To add to the picture, LulzSecurity's website has been down on and off for the last few weeks, being on life-support thanks to a CloudFlare cached copy.

Given these details and the UK government's insistence they had nabbed their man, the media jumped into a fervor.  And the public gobbled it up, as they had long expected LulzSec's brass to be apprehended and redirected towards a local penitentiary.

II. Details Conflict

But this open and shut case might not be so open and shut.  Last month the blog site LulzSecurityExposed supposedly "doxed" (published the real world identity of) Topiary.  They claim he's changed names more times than Prince and their accounting puts him nowhere near Scotland.  

They write:

Topiary aka Warpstonelord aka Hombre de Mundo aka Tomtenisse

Daniel Ackerman Sandberg
Birthday 13 August 1988
Location Uppsala, Sweden
Interests Zelda :D, Warhammer, Writing, Being with friends, more...
Twitter -" rel="nofollow
Facebook -" rel="nofollow
Youtube -
Skype -   x-tomtenisse-x ,  Doxiary
Digg -


So which is the true Topiary?  The arrest 19 year old Scotland native? Or the at-large 23 year old Swede?  There's more to come.

III. Chat Logs Indicate UK Police Are Being Duped

London's police force are desperate for some good press.  Amid the resignation of London's police chief and allegations of bribery, the arrest could be a huge victory for the department.  In recent years the police have been battered by a long string of embarrassments, including an invasive camera scheme, which failed to reduce crime rates.

A series of chat logs published by anti-LulzSec American "hacktivist", th3j35t3r ("The Jester") indicate, however, that the department may be enmeshed in another debacle.  

The logs are as follows:
[removed]: S'up Daniel
Topiary: s'appening [removed]
[removed]: You OK?
Topiary: could be better, you seen the pdf table thing with all the names I take it?
[removed]: Saw that, but you seen the thing today?
Topiary: bro I've been playing it off since fakegregg said something about Zelda
[removed]: ah, well, you should keep low man
Topiary: I can't at this point, I need to just straight up deny it 100% and flaunt it everywhere
Topiary: but I trust you, you know how it is
Topiary: if I go hide then people will assume the dox are right
Topiary: so I'll just act like they failed hard
[removed]: True that - so you need to make a big show of disproving them
Topiary: yeah well, this is my plan:
Topiary: (as you know I stole this nickname from a troll last December, didn't work out so well)
Topiary: I'll just keep denying it until they try to go after the troll
Topiary: then they'll think that's me and harass him
[removed]: then he harasses back?
Topiary: yeah but if I deny my real dox enough, people will go looking for other dox
Topiary: then nobody will believe I'm me
Topiary: and all you bastards told me my Brit voice was good, damnit
Topiary: did they get voice recognition?
[removed]: well when you talk the Swedish accent comes out a bit
[removed]: but not for a couple of minutes
Topiary: these faggots aren't hitting the UK ni$%*r Topiary
Topiary: why aren't they?
Topiary: I'm hoping someone will go after him and think it's me, then I'll act all scared etc
[removed]: then boom - you drop all the heat on him
Topiary: ANYTHING to divert attention from that fuckign nameshub
Topiary: I'm assuming they put that to Feds
Topiary: so I might be raided soon
Topiary: fucking shit
Topiary: goddamnit
[removed]: that "nameshub" thing exposed a few peopl
[removed]: have the feds any jurisdiction in Sweden?
[removed]: ohwait
[removed]: shit :/
Topiary: don't know but I'm shitting bricks
Topiary: so I don't know what to do
Topiary: so I'm just playing it off
Topiary: "Who the fuck is Daniel Sandberg?", the whole story
[removed]: well, hopefully someone will go after the troll you stole the name off
Topiary: they should have already
Topiary: hoping so dude
Topiary: because I don't want this shit
Topiary: but yeah I deleted everything recently
[removed]: rm -rf
[removed]: fuck, I hope you DBAN-ed
Topiary: I'd like to make it to the end of the month, how long do they take to raid?
Topiary: better not hit me on April fool's day
Topiary: but yeah maybe they'll just think backtrace is a joke and not go after me
[removed]: Well shit, how long before they raided no that time?
Topiary: not very long
Topiary: bro why haven't you done what I did?
Topiary: find some network and steal someone's nick
Topiary: like someone you don't like
Topiary: then do illegal shit
Topiary: and they hit them instead
Topiary: you're using a real name
[removed]: never thought to do it...
[removed]: I'd advise taking a hammer to your drives though
Topiary: wouldn't that look suspicious if they come?
Topiary: maybe things just have to be normal
[removed]: hmmmm. use a guttmann pass - you know, like DBAN on crack?
[removed]: then reload windows or something
Topiary: yeah
Topiary: just hoping that they'll take the bait
Topiary: the fucker has been using Topiary for like a year
Topiary: trolling everyone
Topiary: for no reason
Topiary: so now we troll him, hope he's getting raided
Topiary: well whatever, we both discussed this like last year
Topiary: so...
Topiary: then I'll stop my twitter and everything
Topiary: but it isn't FUCKING WORKING
[removed]: make it look like they got the right guy
Topiary: yup
[removed]: it is also
Topiary: fucking tired of people adding me on Facebook
Topiary: to be honest I'm just gonna continue the Zelda casts as normal
Topiary: it would look REALLY weird if they stopped
[removed]: it shouldnt fsck with your normal life
Topiary: yeah, right, right
Topiary: agreed
Topiary: so that's what I'll do
Topiary: just keep it cool and carry on with it
[removed]: frame up this damn trollfaggot, and "carry on"
Topiary: hope it blows over and they start doxing Ireland fag or Scotland fag or wherever the fuck UK part he's from
Topiary: anyway I trust you so yeah
Topiary: we can keep this between us
[removed]: Wont say a word bro
[removed]: just take care
Topiary: okay gotta go
Topiary: thanks for advic
[removed]: bye!

If the above commentary is to be believed it sounds like the UK police has fallen hook line and sinker for LulzSec and Topiary's ploy.  And so did the mass media [1][2].

IV. Not the First Time the Police and Media Were Duped

Back on June 6, the internet lit up with reports of a LulzSec "arrest".  Only, it turns out the U.S. Federal Bureau of Investigations appears to have been duped into arresting Robert Cavenaugh ("XYZ"), a ex-Anonymous youth who the group had doxed after he published private server logs from the group.

Anonymous had it out for Mr. Cavenaugh, and thus he made the perfect fall guy for them.  And best of all he had nothing to do with LulzSec, ostensibly.

Not long after the arrest of "Chippy1337" (real name: Ryan Cleary), yet another supposed LulzSec "official" was reported.  Mr. Cleary was also former Anonymous and had helped "XYZ" publish the server logs -- and like Mr. Cavenaugh, was doxed.  Now, Mr. Cleary remained close to some in Anonymous and was indeed serving as a spokesperson for LulzSec.  But reportedly he had nothing to do with the actual operations.

How convenient, it seems.  The U.S. law enforcement is hungry to catch a LulzSec hacker and a low-ranking spokesperson who ran afoul of LulzSec's parent group (Anonymous) gets handed into their lap.  

In the end it appears Scotland's "Topiary" met a similar fate as "Chippy1337" and "XYZ" -- arrested by authorities who were led down the wrong trail by the clever members of Anonymous and LulzSec.

Supporting evidence of this conclusion can be found in several videos [1][2][3] in which Topiary speaks in Swedish or with a Swedish accent (while a member of Anonymous). Given this and the chat logs, it appears that police have the wrong guy.

Of course, the possibility remains that the chat log comments were just misdirection.  But there's too many clues pointing in the direction of Sweden to ignore that possibility, at this point.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Police statement
By Amiga500 on 7/28/2011 2:49:05 AM , Rating: 1
We badly misunderestimated Lulzsec. There were too many unknown unknowns in this case. But it won't happen again. Fool me once, shame on you. Fool me.... can't get fooled again.

With MENSA candidates like this on board, the Police can't lose:

RE: Police statement
By priusone on 7/28/2011 3:55:37 AM , Rating: 3
There are known knowns, unknown unknowns, then there are known unknowns and unknown knowns.

RE: Police statement
By Ticholo on 7/28/2011 6:17:45 AM , Rating: 3
You're badly misunderestimating the issue.

RE: Police statement
By putergeek00 on 7/28/2011 10:23:36 AM , Rating: 3
Man in Black: Truly, you have a dizzying intellect.
Vizzini: Wait till I get going! Now, where was I?

He's definit#*! jesting
By Justin Case on 7/30/2011 2:20:15 AM , Rating: 2
I've just read a page on The Jester's blog where he claims to have "unmasked" the real identity of an Anonymous "leader" by... following the WHOIS records for some of his domains. o_O

For those of you who have never registered a domain, I'll explain why this is ridiculous: You can write whatever you want in the WHOIS records. Literally. No one checks, no one cares, the registrar just wants your $12.95. It's trivial to write someone else's address (real or made-up), and obviously no actual "leader of Anonymous" would write down his real address.

Anyone who thinks the domain data is a reliable way to determine someone's identity or location is either completely clueless or deliberately trying to misdirect.

RE: He's definit#*! jesting
By Justin Case on 7/30/2011 2:21:24 AM , Rating: 2
Why does DT censor the word "definitely"...?

RE: He's definit#*! jesting
By mindless1 on 7/30/2011 3:35:04 PM , Rating: 2
It definitely doesn't do it all the time (see title above)

RE: He's definit#*! jesting
By mindless1 on 7/30/2011 3:37:23 PM , Rating: 2
Oops ignore my last message I was just testing something.

By b9536870 on 7/28/2011 1:24:49 PM , Rating: 2
For one thing, the police were NOT duped over "Mr. Cavenaugh". From what I read, he was in fact a part of the group, and just got kicked out.

As for this current arrest... just because he is caught in another location means absolutely nothing. He could have easily moved, especially hoping to not get caught on some remote island.

And just because some other hacker groups post some info, doesn't necessarily mean they are correct either. In fact if he was a real hacker he wouldn't be using his real location/info.

All these guys need to be locked up, as they are scumbag terrorists who do nothing but make threats, demands using extortion to get what they want.

And if their opinion is that someone will just fill in after they get caught... well then just arrest them all.

RE: --
By iceonfire1 on 7/28/2011 6:11:34 PM , Rating: 1
OK, it is kind of curious what a troll like Topiary would be doing in the middle of nowhere. As for the other information, where would you expect to get timely, reliable if not from an organization expressly dedicated to eliminating LulzSec?

While calling these guys terrorists may be technically correct, I suspect that if you ever get out of your basement and encounter a dangerous individual your priorities might change a little. These hackers are justly admirable and their raison d'etre is unimpeachable. Remember how the US governmental system was built in 1787 to balance power? The existence of groups like this is an excellent of method of keeping governments and businesses accountable in the modern world of lobbying and increasing federal power and invasiveness.

Plus, it might give US politics a desperately needed boost toward encouraging cybersecurity and STEM infrastructure.

Photo of Topiary
By b9536870 on 7/28/2011 1:27:03 PM , Rating: 2
If the photo is the real Topiary, then it would be pretty easy to confirm whether its him or not. Also they could use voice matching from when he called into that talk show.

So far I haven't seen any photos of this actual person arrested.

By nvpyyasnzqya on 7/30/2011 9:21:23 AM , Rating: 2
welcome to our website:

------- www (point) ifancyshop (point) com --------

if you like to order anything you like.

More details,

please just browse our website Quality is our Dignity;

Service is our Lift.

enjoy yourself.

thank you!!

-------www (point) ifancyshop (point) com-----

By caonimeiaaa on 7/31/2011 9:36:56 PM , Rating: 2
welcome to our website:

------- www (point) ifancyshop (point) com --------

if you like to order anything you like.

More details,

please just browse our website Quality is our Dignity;

Service is our Lift.

enjoy yourself.

thank you!!

------- www (point) ifancyshop (point) com -----

This is hilarious
By senthewolflord on 8/4/2011 2:47:14 PM , Rating: 2
Jeez, I look at this and say yay!
Take a look, what macho hacker that took down HBgary Federal would say stuff like that?

More likely:
This is yet another hoax for a guy who wants more security.
I wouldn't be surprised if Topiary managed to secretly hack the trolls computer and use it as a proxy.

REally guys, you think you know the basics of cybersecurity? Well your world is about to be flipped upside down, REAL FAST.

Hope you don't get motion sickness.

UK geography
By psychobriggsy on 7/28/2011 5:35:46 AM , Rating: 2
Lincolnshire is at most half-way up the country. Even if you are talking about England, not the UK, it would be eastern, not north-eastern. It's a county, not a province.

Also don't mistake the Metropolitan Police for the UK police in general. But I can bet they'll leave him on the street in London once they realise he hasn't got anything to do with the hackers, rather than compensate him for the lost time and return him to his home. But if he is a troll, then fair riddance - not that there is much else to do in the Shetland Islands.

RE: UK geography
By hexxthalion on 7/28/11, Rating: -1
That settles it then
By KeithP on 7/27/11, Rating: -1
RE: That settles it then
By mrjminer on 7/27/11, Rating: 0
RE: That settles it then
By herpderp on 7/28/2011 12:47:33 AM , Rating: 2
Uhhh....Maybe physical evidence? Theory is one thing....speculation and false identity operations are another.

RE: That settles it then
By mrjminer on 7/31/2011 8:34:32 PM , Rating: 2
I think it's pretty amusing that you're calling what was posted here physical evidence after reading my post. The police just filed the charges against him, so I guess we'll see whether your speculation and this conspiracy theory piece are going to prevail over logic. Either way, I see why your name is "herpderp.",2817,2389486,

RE: That settles it then
By priusone on 7/28/11, Rating: 0
RE: That settles it then
By BeauP on 7/28/2011 10:42:30 AM , Rating: 2
By 8 pm the beer blinders are on, they over-ride the sarcasm sensors.

By tng on 7/28/2011 10:02:11 AM , Rating: 2
Why is it that we can vote someone into office, but if they do a poor job we cannot vote them out? We can only replace them when their term ends...and the replacements are chosen by lobbyists and an elite few with money.
Right with you there.

Hacktivism is a great way to keep the lens of justice where it really belongs - on those in power.
Seems to me so far the most damage they have done is to common people who's IDs have been stolen or just put out there on the web. Not seeing the "lens" focus so much on anybody in "power".

By ilostmypen on 7/28/2011 1:40:51 PM , Rating: 2
I think it's all part of a growing process, what they really lack is some sort of unifying voice to bring their ideals to the surface. without that they will always just seem like a bunch of punk kids our for anarchy.

By tng on 7/28/2011 3:54:25 PM , Rating: 2
My opinion is that while you are correct they need a unified front that chooses targets and strategies carefully, that will never happen.

Unification means central leadership of some kind and that would make them more likely to get caught. Plus the culture there is not set up for central authority, they would rebel against it. What makes them good at hacking and avoiding detection also makes them forever under effective.

By ilostmypen on 7/28/2011 7:29:23 PM , Rating: 2
I knew that would come up because of the way I put it but I didn't mean to imply that they needed leadership. What they need is a voice that can convey their idea to the genearal public. They SHOULD NOT be someone that is directly associated to any hacker group but more along the lines of someone who is well spoken and well versed in Information Technology. Someone that can take all of this and make sense of it for the common american and show them why it's being done.

By ekv on 7/29/2011 3:16:49 PM , Rating: 3
What 'they' need is ... some negative reinforcement. Someone ought to have taken them out back the wood-shed and whooped 'em, a long time ago.

Look, you said it yourself, right now they are "a bunch of punk kids" bent on anarchy. Even in war, collateral damage is something to be avoided and minimized if at all humanly possible. These anarchists have made it a goal in-and-of-itself. Here's another simile, a shepherd does not sit on the sidelines watching, say, a wolf maul his flock. A hireling however wouldn't mind if a couple are dragged off.

There is a difference in trying to accomplish something positive and achieving something negative. Is that point at least clear?

Strange Censorship
By wilwheaton on 7/28/11, Rating: -1
"We are going to continue to work with them to make sure they understand the reality of the Internet.  A lot of these people don't have Ph.Ds, and they don't have a degree in computer science." -- RIM co-CEO Michael Lazaridis

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki