“Mom is dead, and they did it.”
An emergency dispatcher hears this message just before 4am on a Thursday morning. It’s been rendered anonymous by a text-to-voice service designed for the deaf. In short, robotic bursts, the caller tells a terrifying tale: 17-year-old Blair Strater, high on PCP, has beaten his mother to death and is threatening to take his own life with a rifle.
As officers make their way to the Straters’ single-family home, an official calls the house. Amy Strater answers. Her son Blair has never taken PCP in his life, she attempts to explain, and there are no firearms in the house. Just to be safe, the emergency responder asks her to come downstairs and meet the officers assembled in her front yard.
Standing at the edge of her doorstop, neighbors peeking through curtains across the tree-lined street, Amy adjusts her glasses and tries not to think about how she has to get up for work in a few hours. She asks the policemen precisely what she needs to do to prove she hasn’t just been murdered. Holding out her arm, she sighs as they take her blood pressure.
Telling the story in her kitchen two years later, Amy brushes her short brown hair to the side and takes a long drag on her electronic cigarette. She chuckles. Paul, her husband, lets out a guffaw. The whole thing seems ridiculous. “You’ve gotta joke about it,” she says. “You’ve gotta have fun with it.”
“We have to use humor to deal with it,” agrees Paul, who’s recovering from a recent eye surgery. His oversized sunglasses project an air of nonchalance belied by the nervous edge to his voice. “If you don’t laugh,” he adds, “you’re going to go put a gun in your mouth.”
On the surface, the Straters seem like your typical American sitcom family. Their two-story house in Oswego, an idyllic Midwestern suburb an hour outside Chicago, rests between a golf course and a corn field. Paul plays the goofy but opinionated husband: He went back to school to get a degree in broadcasting when his television career stalled at age 41. He now works behind the camera at a local public television station, broadcasting Friday nights from high school football games.
“Mom is dead, and they did it.”
Amy is the good-natured but sharp-tongued wife. Until recently, she served as director of decision support and population analytics at Ingalls Health System, a network of hospitals based in nearby Harvey, Illinois. A biostatistician, Amy tracked the health of patients after they left the hospital. Middle-schooler Jordan is the shy but bubbly daughter, and Blair, now in his early 20s, is the socially awkward but impassioned computer geek.
Since 2010, the Straters have been under assault from an online campaign of ever-increasing harassment—prank deliveries, smear attacks, high-profile hacks, and threats of violence against schools and law enforcement officials in their name—and it’s slowly torn them apart. Masterminding it all, Blair charges, is a teenage computer hacker from Finland, at war with him over a seemingly minor dispute spun completely out of control.
His family is just collateral damage.
You probably don’t know the name Julius Kivimaki, but there’s a good chance you know his work. Last year, he was one of the hackers who stole Christmas.
On Dec. 25, just as kids were unwrapping and booting up their new consoles for the first time, the online networks for Microsoft’s Xbox Live and Sony’sPlayStation Network were brought down by a pair of coordinated denial-of-service (DDoS) attacks, overwhelming their servers with data requests that rendered their systems largely unusable for days. The hackers used a botnet—a global network of malware-infected “slave” devices secretly doing a hacker’s bidding—of over 150,000 infected computers. A computer security researcher estimated the attacks cost Microsoft and Sony well over $40,000 an hour.
A group calling itself Lizard Squad took credit for the attack. The hacking collective coalesced in 2014 on the forums of Darkode, an online black market where users could buy and sell hacking services and malware. (Darkode was shuttered after a international law enforcement effort this July.) While Lizard Squad members are clear inheritors of the legacy left by infamous hacking collectives like Anonymous and Legion of Doom, their attacks aren’t inherently political. Their motivation? “Chaos is entertainment.”
A few days after the attack, a member of Lizard Squad beamed in from his native Finland for an on-camera interview with the U.K.-based Sky News. It was Kivimaki.
https://www.youtube.com/watch?v=ngp4kSB5z80
“[We did it] mostly to raise awareness for ourselves,” Kivimaki said. “Also, one of the aspects here was raising awareness of the low state of computer security at these companies. These companies make tens of millions every month from their subscriber fees… They should have more than enough funding to be able to protect against these attacks.”
“Do you feel guilty that you taken the enjoyment of gaming away from more than 100 million people?” the host asked.
“I’d be rather worried if those people didn’t have anything better to do than to play games on their consoles on Christmas Eve and Christmas Day,” he replied with a smirk. “I can’t really feel bad that I might have forced a couple of kids to spend time with their families rather than playing games.”
Kivimaki’s first brush with law enforcement came on Sept. 23, 2013. Police in Helsinki arrested him for an extensive array of crimes—none of which had to do with Lizard Squad, which didn’t exist at the time, or the Straters.
In a series of interviews with the Daily Dot, Kivimaki wasn’t particularly forthcoming with personal details. He’s currently 18 years old and has been a computer hacker for nearly half his life. His lengthy 2013 indictment serves as an incomplete guide to some of the alleged exploits of his previous hacking group, Hack the Planet. Named after a TV show in 1995 techno-thriller Hackers, Hack the Planet formed as a collection of self-styled digital activists fighting government and corporate anti-piracy efforts.
“Chaos is Entertainment.”
Finnish police charged Kivimaki with breaking into computer systems around the world, including the website of MIT, using a suite of hacking software developed by Hack the Planet. Once in the systems, the group installed programs turning the infected computers into a botnet, which was used to carry out DDoS attacks against sites like tech news outlet ZDNet. When they seized Kivimaki’s computer, law enforcement officials also found records of credit cards stolen from the subscriber database of a popular magazine’s website.
Finland’s National Bureau of Investigation reports that law enforcement officials also took Kivimaki into custody for a three-month period in the latter part of last year in regards to Lizard Squad’s earliest hacks on Sony and Blizzard, the studio behind the massive online role-playing game World of Warcraft. He was released approximately one week before Christmas.
Shortly thereafter, Kivimaki was appearing on Sky News, gloating about the Christmas Day attack. While the young hacker used the pseudonym “Ryan,” the interview was conducted on camera. In the privacy-obsessed world of Internet hackers, the brazenness with which Kivimaki discussed his exploits sent a very clear message: I am untouchable.
Deliveries started arriving at the Strater residence in 2010. Chinese food would come that no one remembered ordering. Every nearby pizzeria would arrive, one stack of large pies right after another. Amy told all the restaurants in town to ignore calls from their address. If they wanted food, they’d get it themselves.
Once, a large bouquet of flowers arrived—cash on delivery.
The deliveries culminated in a truck pulling up to the house with instructions to dump three tons of gravel in the driveway. “How was I going to get my car out?” Paul quips. “I don’t have a Dustbuster nearly big enough for all that gravel.”
Such events could be seen as the harmless pranks of teenagers with too much time on their hands. When the family started getting notices about their utilities being disconnected, they realized things were escalating out of control. Utility provider Commonwealth Edison once called the house to iron out the details about a request to have the power turned off after a supposed move. Something similar happened with their trash service. On Halloween 2013, Comcast shut off their cable and Internet service.
Paul spent much of the 1990s hosting a conservative talk radio show in Fort Wayne, Indiana, and it shows. As he talks, his stories fill the room’s airwaves, expanding into pointed arguments about politics and society. Occasionally, his eyes close in the middle of a monologue, a broadcasting booth flicking into existence around him.
“If you don’t laugh, you’re going to put a gun in your mouth.” —Paul Strater
“What if there had been somebody in my house who was living with an artificial lung or a medical pump that had to be going 24 hours a day?” he asks, playing a game of slippery slope he used to employ on his show. “All of a sudden, the electricity comes off. That person gets sick or dies because the power was cut off… Electricity gets turned off, that person get sick or dies, what’s the power company going to say? ‘Wasn’t our fault!’ Well, it really was.”
Preventing the utility outages proved trickier than expected. Comcast gives its customers the ability to password-protect their accounts. But, in the Straters’ experience, that protection rarely worked as it should. The same day Paul added a password, Blair called to make changes. The customer service rep didn’t mention a password until Blair brought it up midway through the call.
It was the first time the Straters ran into something that would soon become depressingly familiar: the failure of institutions entrusted with their information to protect them.
In May 2013, Paul called the Oswego Police Department to report a series of harassing phone calls coming from someone claiming to work for the New York Times. Blair had also received a series of phone calls from an unidentified number threatening to “fuck him up and burn his fucking house down.” The calls came with alarming regularity and at all hours of the night.
[soundcloud url=”https://api.soundcloud.com/tracks/231313282″ params=”color=ff5500&auto_play=false&hide_related=false&show_comments=true&show_user=true&show_reposts=false” width=”100%” height=”166″ iframe=”true” /]
The following March, firefighters were called to the house with reports of a structure fire—a hoax like all the others. The next month, police got a call from someone supposedly at the residence crying that the stove was on fire. Six more calls came to Oswego Police Department throughout the day, reporting everything from two black men raping a white woman to “something ticking [that] had a time and lots of wires, beeps, and stops.”
Since the calls were rendered anonymous by a text-to-voice calling service designed for the deaf, they were untraceable. The Oswego officer who fielded one call wrote in a police report, “[T]he individual I spoke with had an indistinguishable accent, but he did not sound like he was from the Midwest.”
Sending police to unsuspecting victim’s houses, typically in the middle of the night, is called swatting—and it’s an increasingly common technique employed to terrorize. It gained prominence with livestreaming gamers, as attackers would cackle with schadenfreude watching cops busting in on enemies mid-session. What makes swatting such a powerful tactic is the obligation police have to take every call seriously.
“We have policies and procedures in place when responding to all types of calls,” Oswego Police Department spokeswoman Kathy Navarra said. “Police are always going to respond to every call they get. They can put a note in about past calls [but that’s about it]. You can’t not respond.”
In April, the Twitter accounts of electric car manufacturer Tesla and its billionaire founder Elon Musk, along with the company’s website, were hacked. The accounts broadcast to their millions of combined followers that the company was giving away free cars. If people wanted one, they should call a pair of phone numbers—Blair’s and Amy’s—or show up at a specific address in the Chicago suburbs.
Someone actually arrived at the Strater house, demanding Paul open the garage, convinced a Tesla was hiding just behind the door. “If they opened the garage, they would have seen a Corvette and a Suburban,” says Paul. “That’d be the first time someone would have been disappointed to see a Corvette.”
The Straters told CNBC at the time they believed Kivimaki was behind the hack. Kivimaki contacted the news outlet, denying everything. “I think Tesla is an extraordinary company doing some quite groundbreaking work on the green-tech field,” he said.
The family’s phones were deluged with calls from as far away as South Africa. Blair immediately got frustrated, but Paul tried to make the most of the inquiries, lightly goofing on the duped callers. It was a rare respite. “On Wednesday, I didn’t know what a Tesla was,” he says. “I thought ‘Elon Musk’ was a men’s fragrance.”
From the very beginning, the Straters have blamed Kivimaki personally for the harassment.
At this point, the feud is at least five years old, and its origin differs dramatically depending on who’s telling the story. Some claim Blair kicked Kivimaki out of Echonode, an online chatroom he ran. Blair says it stemmed from a disagreement over the release of a “zine” describing the exploits of Hack the Planet, a group he was also a part of.
Kivimaki says his hostility stems from Blair’s threat to release the names and personal information of some of Kivimaki’s friends. In conversations with the Daily Dot, Kivimaki insists he never did anything more personally harmful than “troll Blair” in online chatrooms and “made sure some documents stay public.”
“For whatever reason, [Blair] is obsessed with me,” Kivimaki explained via aSkype chat session, adding that Blair has lauded other people’s hacks against Kivimaki on his blog. “My existence alone seems to infuriate him.”
Blair is fully immersed in the online world from which the attacks against the Straters originated, and he’s never played particularly well with others. He was once arrested for hacking his high school’s website and then nonchalantly admitting to it when a teacher asked what he did over the summer. (Blair insists the hack—which involved, in part, adding a video of Rick Astley’s “Never Gonna Give You Up” to the school’s website—was in retaliation for instances he witnessed of school officials using unnecessary force against students.) Blair was convicted of a felony but didn’t serve any jail time.
Paul and Amy seem to have gone back and forth on how personally responsible Blair is for the harassment he’s attracted. Blair’s online persona can often be antagonistic, but his parents ultimately can’t put it entirely on his shoulders.
“I’m a little annoyed that, yes, this all started because of something Blair supposedly did. But I’m not going to lay the blame at his feet,” Amy said. “He was just 15 [when it all started]. He had no idea that just banning someone from a … chatroom would set off this barrage of borderline schizophrenic behavior on the part of this kid in Finland. He had no way of knowing.”
That’s an assertion Kivimaki disputes. “I never ‘attacked’ him beyond saying rude things to him. I told others about his behavior, and they attacked him,” Kivimaki says, declining to identify any of the other people who may have been personally responsible for attacking the Straters.
To a degree, Kivimaki is likely correct. There’s a tendency for online forums, like the ones Kivimaki and Blair frequent, to single out someone for harassment and then pile on mercilessly. Given the relatively anonymous nature of the attacks, it’s impossible to say with certainty which events, if any, Kivimaki is directly responsible for and those he may have merely encouraged. It hasn’t helped that Blair has a tendency to lash out, escalating matters publicly.
“These groups of people … select someone that they thought … would react negatively to being treated this way and treat them this way for the negative reaction,” Blair said.
In January, visitors to the website of Malaysia Airlines were greeted with message mocking the carrier’s missing flight 370, which disappeared over the Pacific in 2014.
Blair lacks his parents’ sense of the situation’s absurdity. Sitting in his family’s kitchen dressed in a faded T-shirt and thin glasses, he vacillates between annoyance and anger. It’s not to say Blair’s humorless—far from it—but his view of what’s happened to his family is too literal to be anything other than an injustice.
“Obviously I’m predisposed, but [to be quite honest] Blair seems like a funny choice for a story about someone whose life has been ruined over the Internet,” Kivimaki countered. “Something like ‘if you can’t stand the heat, get out of the kitchen.’”
On Memorial Day, Amy’s social media accounts were hacked, triggering a series of events that would ultimately spin her career into a freefall. Her LinkedIn and Twitter accounts were also hacked to broadcast racist and anti-Semitic messages.
Shortly before her accounts were hacked, Amy talked to Ingalls Health System’s top information security people. “Blair had gotten a credible alert that they were going to come after me because they couldn’t hurt him,” she recalls. “They were going to come after me, and to do so they were going to try and lose me my job.”
She warned Ingalls that not only was she a target, but the hospital’s systems could be next. She gave her employer the business cards of the FBI agents she had been talking to. Ingalls, which was looking to get acquired by a larger hospital network, took a look at her social media accounts and, as Amy tells it, promptly showed her the door. It’s a subject that’s still raw.
“What hurts the most is that not one single person who claimed to be my friend from there, not one of them has tried to get in touch with me in any way, shape, or form,” she said bitterly. Amy’s severance package included a condition that she not address the media, but her frustration—with Ingalls and her situation—spurred her to speak out. “I’m hoping they’re under orders not to talk to me. I hope that’s that case.”
Calling the situation a “HR issue,” a representative from Ingalls declined to comment on Amy’s termination.
That same Memorial Day, a hacker used Amy’s Yahoo account to post on a message board about Southbury Elementary, the school Blair’s sister, Jordan, attended. The title: “I Will Shoot Up Your School.”
Sitting in the living room, as Amy and Paul recall the parade of horribles that has befallen them, their daughter Jordan is largely silent. She watches intently, reticent to talk about her own experiences. When the subject of the threat against her school comes up, she nervously but resolutely sits down at the table and announces she has something to say.
“[It] was a living hell. We couldn’t go outside. There were cops everywhere,” Jordan recalls, telling her story in rapid-fire staccato bursts. “Everybody was looking at me because they knew I knew what was going on, but I couldn’t really talk about it. … I told one of my friends and they were like, ‘Wow, why does he have this grudge against your family?’ I said, ‘I don’t know.’”
“[It] was a living hell. We couldn’t go outside. There were cops everywhere.” —Jordan Strater
Jordan’s experience growing up under a cloud of fear the size of the Internet itself has been profoundly isolating. “It doesn’t help Jordan because kids aren’t allowed to hang out with her because they think something is wrong with our family,” Amy adds. “The stigma in our neighborhood is that we don’t get talked to. Nobody understands why the police are here as many times as they’ve been here.”
Making matters worse for the family, Blair spent three weeks in jail in 2011 after the local officer who arrested him for hacking his high school received a bomb threat from an email address that included the name “r000t,” Blair’s online handle. Blair still maintains his innocence. “I want an apology from someone about that,” he seethed.
Amy was pregnant at the time of his arrest. She believes the stress of Blair’s imprisonment caused her to have a miscarriage—a fault line that eventually broke up her marriage. While Amy and Paul remain friendly, she moved out of the house earlier this year and now lives in an apartment a few miles away.
“To the best of my knowledge, we have wronged him in absolutely no way whatsoever. This is just fun for him,” Amy fumes. “I hope he’s damn proud of himself for having a goal and actually accomplishing it—ruining a family.”
All the while, Kivimaki has allegedly been out seeing the world. In August, he told the Daily Dot he was traveling to the mountains of Nepal. A few days later, he said he was in Macau—all paid for by trading the digital currency Bitcoin, as verified by Finnish court documents. Prosecutors asserted that, just before he was arrested in 2013, Kivimaki laundered €6,588.88 (roughly $7,060 U.S. today) from a Chinese Bitcoin broker that was “obtained through cybercrimes” and spent most of it on a trip to Mexico.
While Kivimaki was ultimately convicted this July on over 50,000 counts of computer crime, he served only a few weeks in jail. Being under 18 at the time, Kivimaki was slapped with a two-year suspended sentence. “Suspended sentences are the general rule [for juvenile defendants in Finland],” explained Jani Jukka, the Finnish lawyer who prosecuted Kivimaki’s case. “There have to be grave reasons … [or] circumstances to rule otherwise [if] the sentence is over two years.”
John Smedley, the former president of Sony Online Entertainment who had his Aug. 24, 2014 flight diverted after Lizard Squad sent a bomb threat to American Airlines, did not take kindly to the news of Kivimaki’s sentence.
Smedley posted on Reddit:
“He was the guy that brought down my flight with a bomb threat. I’ve heard the entire recording where he convinced an airline customer service agent there was a bomb on the plane. He also in conjunction with others has sent me pictures of my father’s grave with nasty stuff on it… I’ve also been swatted (multiple times) and had over 50 false credit applications submitted in my name…You shouldn’t be able to do crap like this without any hint of a consequence.”
An official with Finland’s National Bureau of Investigation told Finnish media that law enforcement had interviewed Kivimaki regarding the Christmas Day hack but had neither arrested nor detained him regarding the incident.
Even if Kivimaki were in the U.S., prosecution would still have been challenging, given current resource restraints, according to Eva Velasquez, president of the Identity Theft Resource Center.
“The percentage of cases that are reported that are actually investigated and come to fruition are minute,” she explained. “If federal and state organizations continue to have their budgets cut, they don’t have the manpower to investigate all of these crimes. The thieves know that, so it becomes worth the risk.”
The destruction of the Straters is nearly complete. Amy has been out of work since May. In a follow-up email, Amy wrote, “my family and I are destitute. My ex-husband is losing his house and I am losing [my apartment]. We have nothing.”
What’s perhaps most distressing about the Straters’ saga is the sense of helplessness the family feels and what their story reveals about the insecurities spurred by the Internet age.
After all, the Straters are hardly technical neophytes. Paul has been a systems administrator for decades—networking computers together since the days of the 386. Blair is a talented coder doing networking for a cloud storage site. When he ran through some of the security procedures he implemented on his personal computer, they were nothing short of exhaustive. And while out of work, Amy has been teaching herself the C# programming language to make progress on an app she and Paul are developing that would aggregate data feeds, like weather and traffic patterns, for people working in emergency rooms.
Despite a deep familiarity with computers and online security, there was little they could do to protect themselves. The technology that has woven itself into every aspect of the modern world has left them vulnerable. “With the push of a button,” Paul sighed, “he’s ruining our lives.”
The Straters have attempted numerous times to enlist law enforcement officials, from their local police to the FBI, for help. It has never produced results, despite several lengthy meetings with FBI agents (Representatives from the FBI did not respond to multiple requests for comment.)
“To the best of my knowledge, we have wronged him in absolutely no way whatsoever. This is just fun for him.” —Amy Strater
Even if the family’s attackers were thrown in jail, the problem of Amy’s online past would still remain. The racist comments on her social media profiles lasted for months and some continue to this day.
Amy spent months repeatedly hounding both social networks to get the accounts taken down. LinkedIn only complied with her request, and subsequently apologized, after the company was contacted by the Daily Dot. Twitter, citing that the email address connected to the email was changed to alstrater@kivima.ki, initially refused to grant Amy the access necessary to have it removed.
A Google search for “Amy Strater” reveals a litany of articles of her being targeted by hackers, hardly a headache that employers want to deal with. Any mention of the scholarly journal articles she’s authored are pushed well beyond the first page.
Amy’s considered enlisting the help of an online reputation management firm, but those services are out of her price range. Patrick Ambron, co-founder of the online reputation management firm Brand Yourself, estimates pushing all of the troublesome articles about Amy off the first page of her search results would cost at least $20,000 a year and not necessarily be guaranteed to work.
“This a scary situation because usually it’s much easier when you’re battling an isolated incident. When someone is proactively going after you, it’s a constant battle,” explained Ambron, who has agreed to work with Amy on a pro bono basis to help her clean up her online reputation problem. “It’s either a big time commitment or a big money commitment.”
While the Straters’ case is certainly extreme, Eve Velasquez of the Identity Theft Resource Center put it in the context of a gradual expansion in how identity theft is carried out.
In 2014 alone, nearly 13 million Americans were victims of some form of identity theft—that’s one new case approximately every 2.4 seconds. The most common cases involve stolen credit cards or fraudulent tax returns filed using the victim’s Social Security number. Many of the strategies employed by everyday thieves online—from hacking into vulnerable accounts to social engineering—are the very same ones employed against the Straters, only personal and destructive.
“Traditionally, it’s always been about financial gain in some manner,” Velasquez said. “It seems like it’s morphing a little bit. We have these social justice kind of folks, who think ‘you’re a bad person and we’re going to show the whole world that you’re bad person.’ And then there’s just this motive to use the Internet for revenge.”
“When someone is proactively going after you, it’s a constant battle.” –Patrick Ambron of Brand Yourself
For Amy, the real villains of this story aren’t just Kivimaki or anyone else directly harassing them. It’s all the institutions who have played right into the hacker’s hands. It’s companies like LinkedIn, Twitter, Yahoo, and Comcast who put convenience ahead of security. It’s the credit monitoring agencies who can’t keep her family’s credit scores safe from prying eyes. It’s the local police departments who bang on the door in the middle of night every time there’s a call. It’s law enforcement officials in the U.S. and Finland unable to take steps to protect them. It’s her former employer, unwilling to stand up for her in a time of need.
At this point, all the Straters can do is tell their story as a warning to others. “There goes but for the grace of God every one of us in society,” insists Paul. “Every person who does business on the Internet, every person with a utility account. All you have to do is pop up on their radar.”
The tides of justice may actually be slowly turning in the Straters’ favor. “We do have several ongoing investigations against Kivimaki,” Detective Chief Inspector Tero Muurman of Keskusrikospoliisi, the Finnish National Bureau of Investigation, told the Daily Dot in an email. “We look forward to finalize some of the cases in the near future and hand them over to prosecutor.”
In the meantime, the harassment continues. On a Friday night in late October, Blair began receiving death threats at :52 past the hour, every hour, for days.
“Every hour, a voice tells me that they’re going to burn my house down and kill my family, and that I better watch my back when I walk the streets,” Blair wrote in an email to the Daily Dot, which was also addressed to the FBI. “As an American citizen, I don’t believe I should have to live in constant fear of my own death!”
As per a tweet sent out on an official Lizard Squad account—since deleted—Blair had become the first victim of the group’s “phone bombing” service, which allows people to buy persistent, repetitive phone harassment as a service for the low price of $20 for one phone call per hour per day.
“For the extortionists amongst us we’ve added an option to cancel the calls at the click of a button, giving you complete control over the length of the attack,” reads a message on the Phone Bomber site’s ordering page, which adds that all purchases are untraceable.
There’s one only email address listed on the site where potential customers can ask questions, and it very clearly belongs to Julius Kivimaki.
All photos by Kyle LaMere
