← The Audio Long Read
The Audio Long Read
From the archive: Leave no trace: how a teenage hacker lost himself online
00:33:21
This week, from 2021: Edwin Robbe had a troubled life, but found excitement and purpose by joining an audacious community of hackers. Then the real world caught up with his online activities By Huib Modderkolk. Read by Aaron Vodovoz
Loading summary
Transcript11 lines
- [00:00]
Narrator
This is the Guardian.
- [00:09]
Shannon Maldonado
My name is Shannon Maldonado. I'm the founder of Yaoi, a gift shop. From the lens of artists and handmade objects. I chose Shopify because when I was testing other platforms it was definitely one of the most user friendly. It was important to me to think about where we would be in the future. All of the tools for reading your sales, like planning inventory, they're just right there on your dashboard. For anyone starting a small business, the biggest thing I can tell you, it doesn't have to be perfect. Shopify can help you build upon it. Start your free trial on shopify.com.
- [00:42]
Podcast Host
The guardian archive long read.
- [00:54]
Hypnoticok
Hi, my name is Hypnoticok. I'm the author of Leave no Trace. Hi How a Teenage Hacker Lost Himself Online it was published in 2021. It's a story of a troubled boy who found online the recognition he struggled to find in the real world. In a moment of bravado, he made a mistake with serious consequences, including for himself. What drew me to the story is that the consequences of the hack of the Netherlands main telecom provider were widely reported in the media. But the boy's story was never told. The first time I spoke to him, what struck me immediately was his fragility and disarming manner. It was hard not to feel a certain sympathy for him. I think that the underlining theme of the story, the vulnerability of young people in a world increasingly shaped by technology, may be even more relevant today than it was in 2021. Do we judge these young people solely by what they do? Or do we try to understand who they are and do we still hold onto a sense of humanity when we do?
- [02:01]
Claire Longrigg
Welcome to the Guardian Long Read Showcasing the best long form journalism covering culture, politics and new thinking. For the text version of this and all our long reads go to theguardian.com
- [02:14]
Narrator
longread leave no Trace How a Teenage Hacker Lost Himself Online by Haub Muderkolk read by Aaron Vodivoz and produced by Esther Opoku. Jenny. Jose Robe was leaving her place of work in Rotterdam when she saw a man and a woman walking towards her. It was a Tuesday afternoon, 20th of March 2012. Are you Mrs. Roba? She nodded. The woman, who was wearing jeans and a black wind cheater, explained that she was with the police. I'd like to talk to you for a minute. It's about your son, Edwin. We're arresting him. Yosei stared, frozen. The woman asked if she would accompany them. Warily, Yosei agreed. At the police car, the officer told her they intended to surprise her son at the family home in Barendrecht, just south of Rotterdam, and arrest him on the spot. She asked if Jose wanted to be there for her son's arrest. No, she replied grimly. It felt as if she had just betrayed her son. To stand by and watch would make it even worse. The police asked Yosei for her house keys and dropped her off at a plaza by the local supermarket a few blocks from her house. She felt terrible as the officers drove away to arrest her eldest child, just a troubled 17 year old. A little while later, three officers emerged from the house escorting Edwin. Between them, he offered no resistance. Edwin was taken to a detention center in Houghton, near Utrecht. Once he was gone, Jose finally re entered her house. She sat on the living room sofa, watching, watching as officers rummaged through cabinets, filed up and down the stairs, and bagged up flash drives, CD ROMs, and telephones. Several years later, I visited Jose and her husband, Ruud, in their terrace house in Rotterdam, where they told me about Edwin and I explained to them how I had contacted him. I had tracked Edwin down through a source, obtained his telephone number, and eventually made contact with him after repeated attempts. At first he didn't respond to the WhatsApp messages I sent. When he finally did reply, it was from a different number. What I wanted to know was why he had attacked the Netherlands biggest telecom company and plunged it into chaos. I wanted to know how he'd learned to do what he did and what had happened to him after his arrest. Our chats were erratic. One day he'd be effusive and engaging. Then he'd become remote. Sometimes days would pass before he answered a message. It would turn out he was in Asia. We also talked on Skype once. I wanted to meet. He did too, he said, but we never would. Edwin died a few months before my visit to his parents. As we talked, grief over the loss of their son reared up suddenly several times. Ruth had been the last person to see Edwin alive, and it still weighed heavily on him. Edwin was less than a year old when he was taken from his biological mother. She was on her own and unable to care for an infant. For months, she didn't even touch him. Jose and Ruth fostered Edwin. Jose worked in healthcare, and Ruth was a chemical engineer at a company that processed ores for pigment. They wanted to give baby Edwin a loving home, but he was a troubled child. I always thought his anxiety started when he was still very little. He just couldn't bond with other people, hyosei recalled. He often complained of stomachaches There were countless visits to the doctor and to the hospital. Each time there would be medical tests. Honestly, I think it was psychological, said Jose. Edwin had a lot of anxiety, but the doctors focused on physical causes. Edwin wasn't like other kids. His parents saw it and so did his teachers. One time at a parent's evening, a mentor asked, what's actually wrong with him? He has almost no friends. Whenever he was around other people, Edwin became tense, clammed up and withdrawn. He almost never did any sport or played outside. Instead, he preferred to sit at the computer in his room upstairs. His parents let him, relieved that at least he had this one hobby. They knew hardly anything about computers. They used one to send the odd email or look for holidays. But that was about it. After graduating from a vocational High School in 2010, Edwin enrolled in an IT course at Albada College in Rotterdam. He said he wanted to do something with computers. His parents let him buy a PC that he put together himself. It had a big memory card and a lot of processing power. He set it up in his bedroom. Looking back, Yosei thinks that may have been our biggest mistake. Edwin was obsessed with his new toy and only came downstairs for meals. Occasionally, his parents caught glimpses of what he was doing. Mostly he played games, especially the kind in which people are violently killed, such as by building amusement parks and then throwing people off the rides. There were also lots of shoot em ups. He took classes in ethics at school, said Ruid. So we thought it would be alright in the end. In the autumn of 2010, the robes received a letter from their Internet provider, Kapen, informing them that their Internet access had been blocked. Kapen said it had observed malicious activity on the family's IP address. When asked about it, Edwin brushed it off as nonsense. To Yosei, he answered in jargon, saying somebody had cracked his WPA2 key and exploited their Internet connection. Baffled, Yosei let it go. Kapen, however, did not let it go. The company's abuse team carried out its own investigation. This revealed that Edwin had used a rented server to mount an attack on a website offering movie and TV downloads. When confronted with the evidence, Edwin's justification was that he didn't like the site's administrators. Edwin had bombarded the website with so many data packets that it crashed, something known as a DDoS attack. This kind of attack is a crime. Edwin is very active on the Internet, as are some of his friends. In some instances, they're described as a hacking ring. Someone at Ka Phn wrote to Ruud in an email. We wonder if he understands what kind of consequences his actions can have. We urge you to talk to him about this. Ruud spoke to Edwin and wrote back. I've had a long discussion with him. He's a sensitive kid and is gradually coming to see that what he did is a serious offense. Ruth and Edwin had agreed the computer would be off limits for three months and that he'd get it cleaned by a professional. I don't know anything about computers. Ruth concluded his email. Do you have any suggestions on who could help me clean up his computer, Captain? Edwin's parents could tell that something was brewing. He was on edge and hardly ever left his room. As soon as the computer ban was lifted, he was back on his PC for as long as 12 hours a day. School wasn't going well. His course was heavy on classroom and group work, which was that didn't suit him at all. He preferred to do things on his own. He was dismissive of his teachers. I know more about computers than all of them put together, he told his parents one evening. Also, the stomach aches had returned and he was taking an anti anxiety drug, Oxazepam, to help him relax and sleep. With his parents consent. In the summer of 2011, Edwin transferred to a computing course at Zutkind College in Rotterdam, where students were given more freedom and could work independently on projects. It didn't help. Jose, en route, didn't know precisely how Edwin was spending his time. Occasionally he mentioned someone he knew in England or Australia, so they assumed he'd made friends online. At least he's finally socializing, they said. Still, he seemed joyless. They told each other he needed space, that surely there were some things that gave him pleasure, and that he had a knack for computers. But on days he never left his screen. It was hard not to despair. More than once they wondered, should we pull the plug? If computers were merely tools for his parents, for Edwin, they were a gateway to adventure, to understanding, and most of all, to recognition. They let him do whatever he wanted. If he felt like gaming, he'd boot up Windows. But more often he chose Linux, his go to operating system. From there he opened different virtual devices so that he could adopt multiple Personas. On forums he met like minded kids his age from all over the world who spent entire days at their computers and made the kinds of social connections online that they couldn't in the real world. Quiet and reclusive kids, mostly cloaked in made up identities. They chatted about computers, girls and going out and devised tricks to infiltrate private computer networks. Online, Edwin was either exs Or Yui, the latter a nod to Japanese singer Yui, of whom he was a big fan. As Yui, he was different, bolder, more self assured. Online, quiet, Edwin, with the shy smile, came alive on chat channels. He met an Australian Dwan and an American, Sabo, in 2011. The three talked about hacking, and his new friends showed Edwin places they had managed to break in. Saboo, as it happens, was a big shot in the digital world. He was the leader of LulzSec, a collective whose six members attacked a range of organizations and hacked the websites of big companies in 2011 to exploit exposed their shoddy security. Though teasing in some cases, in others, their antics had serious consequences. Such as when the group stole data belonging to more than 70,000 US contestants on the popular TV show the X Factor in retaliation for an alleged insult to the rapper Common. Also targeted by LulzSec were the Sony PlayStation Network and the website of the CIA. Several investigation agencies were hunting for Sabu, but like Edwin, he took care to cover his tracks. All the kids went by aliases on chat channels, some of which also required passwords to get in. Plus, they never logged on directly from their home connections, but rather through a secure virtual private network vpn. Edwin connected to a VPN server first, then went online anonymously. It took some discipline. Forgetting to use VPN just once would instantly make his home IP address visible for anyone to see. After a while, Edwin found his way into chat channels where the serious hackers converged. Winning their trust was a first and crucial step because police were also lurking, trying to infiltrate using fake identities. At 16ed, Edwin was orbiting LulzSec as well as a looser collective called Anonymous. Though not a member himself, he hung out on their chat channels. These were exciting times in the hacking world. Members of Anonymous had been targeting a succession of organizations and declaring their solidarity with WikiLeaks, which was publishing hundreds of thousands of US diplomatic communications. When Julian Assange's whistleblower website was blocked by the payment services PayPal, MasterCard and Visa, cutting off lots of donations to WikiLeaks, Anonymous struck back with the DDoS attack that took out the payment services websites and inflicted an estimate of $5.5 million in losses. One member would ultimately end up doing 18 months in prison in the UK. Edwin's contacts abroad gave him a confidence boost. He spent hours chatting with people from all over the world about ways to hack websites. Edwin often mocked normal life and Western society. He denounced materialism and superficial concerns. But most of all, they talked about hacking Dwan Bragged about some of the places he'd been. To them, it was all a prank, getting in and out just to prove they could bypass a site security they never stole. All they wanted was to look. In December 2011, when he was 17, Edwin had an online exchange with the Fed, who showed him an exploit. An exploit is a piece of code that takes advantage of vulnerabilities in a network's security to gain entry somewhere, like a key that opens old locks. Computer networks, especially at large organizations, rely on lots of different software. All software has one or two holes, some known, others still undiscovered. Whenever software makers discover such a vulnerability, they quickly take steps to create a patch and provide an update. Hackers, meanwhile, are snooping around for those very same weaknesses and working just as quickly to make a key, an exploit to get inside. Edwin was trawling the Internet and scanning networks to see who might be using software with a known hole. In this case, it was HP Data Protector. He searched sites manually using Google, entering data protector as the search term alongside a specific web or IP address. In early December 2011, Edwin struck gold. He found a university in Norway, NTNU, that was using the software and hadn't yet installed the update containing the patch. Edwin grabbed his exploit, executed it, and he was inside. Looking around the university's network. He discovered he had six computer servers at his command. On a roll, Edwin next gained control of a supercomputer at the University of Troms. He nosed around for a while and then installed a backdoor. Now he could access the university's computer server remotely whenever he wanted. Edwin pulled off his stunt without a hitch and earned himself hacker cred with his new friends. Dwan responded to Edwin's feat with enthused fist pumps and exclamations of LOL and omg. This only whetted Edwin's appetite. He went in search of new targets in other countries. His next victim was the University of Twente in the Netherlands, then a website in Iceland, and after that a university in Japan. He was unstoppable as long as he took care to connect to a VPN server in Russia first. He left no tracks to follow. Thank you for listening to the Guardian Long Read. We'll be back after this.
- [18:05]
Claire Longrigg
Hello, I'm Claire Longrigg, Deputy editor of the Guardian. Long Read. The summer issue of the Long Read magazine is out now, showcasing some of the Guardian's finest long form journalism. In this beautifully illustrated new edition of the magazine, you'll find stories about the UK's strangest pub chain, how AI is taking over the classroom, the Christian cult that hid in plain sight, and many more. Pick up a copy today from theguardian.com or from selected WHSMITH travel stores.
- [18:48]
Podcast Host
Former politics reporter Jane Coasten is now hosting Crooked Media's daily news podcast what a Day. Five days a week. With stories constantly flooding your for you page, it's hard to separate what matters from all the noise. That's why every weekday Jane and the Whataday team scour the biggest headlines and bring you the stories that matter most to your life, all in just 20 minutes. Listen to what a Day wherever you get your podcast or subscribe to what a Day on YouTube for the video version.
- [19:28]
Narrator
Welcome back to the guardian long read. It was while running another scan that Edwin noticed some outdated software@kapn. Holland's biggest telecoms company was using HP data protector and hadn't installed the update yet. Here was an open window. Did he dare sneak in? Why not take a quick peek inside his own Internet provider? After all, Cap' N was a big fish and would earn him massive credit. Edwin took the gamble. He entered a random Kapien IP address, ran his exploit, and then, using a detour through the Japanese university, slipped inside Kapeen's network. He found himself in a far corner of the network, which is to say, he was in but still needed to open some doors. For instance, he couldn't send commands directly from his own computer to Kappen, nor did he have full rights across the whole network. He couldn't just walk around because a firewall was blocking his way. But all this was child's play. By moving a program from his own PC onto the Kappn computer, Edwin could bypass the wall. Now he was free to do as he pleased. Stupid Kapen, he thought to himself. The whole place was riddled with holes. Scanning the rest of the network from the Kapen machine he'd accessed, Edwin saw the obsolete software being used in hundreds of places. Almost every computer server in the telecom provider's vast network had a window open. The kid from Barendrecht strolled around unimpeded, and what he saw astonished him. He could control 514 computer servers. He could even access the core router, the backbone of Kapn's entire network. He could see the data of 2.1 million Kapn customers. He could block hundreds of thousands of people from connecting to the National Emergency telephone line. He could redirect Internet traffic so that people who wanted to visit, say, a news site, would wind up somewhere completely different. Edwin could do whatever he wanted, and Kapeen would know a thing. Excitedly, he told Juan of his conquest. At first, Dwan refused to believe him. To prove he'd gained command of Kapien, Edwin logged on to the chat channel from the Kapeh network. Wtf? Tuan responded. Edwin was thrilled with his newfound status. He dropped out of his computing course at home. The tension eased. Relieved, his mother emailed a friend to say that Edwin had been feeling better. He's been exempted from attending classes this year, and now he's doing a high school English course from home. Meanwhile, up in his room, Edwin was expanding his latest coup. I'm hacking my isp, he announced to Kambaska, a Korean student. Kambaska didn't believe him and demanded evidence. Again, Edwin entered the chat channel. From the Kapaya network he urged should become a hacker, too. As Edwin gained plaudits online, a group of men and one woman sat in a high rise of the A12 motorway outside the Hague, staring at each other in dismay. Dozens of people had set up shop in a vacant office one floor up from the studios of the radio station Fresh fm. They had installed desks, laptops, and network cables. To someone who didn't know what was going on, it would have been a curious sight, people rushing up to the top floor early each morning and not re emerging until past midnight, delivery services dropping off dinner in the evenings. Between 80 and 100 workers had been holed up like this for days, many of them engineers and technicians from Kapn and researchers from Fox it, a Dutch security company that monitors systems and networks for client companies around the world. It had all started with a message from someone calling themselves Kambaska in South Korea. Kambosca said he'd been chatting with the guy calling himself Yui, who claimed to have hacked Capey, and he had evidence. After letting Yui boast about what he'd done, Kabaska had turned around and contacted capn. By now, two weeks on, there was genuine panic. Clearly somebody was inside Kapehen's network. It could be a loner, or it could be a foreign state. Nobody knew. Nor could Kapn or Fox IT get a handle on the extent of the damage. They had to tread lightly, examining computers while keeping systems running so as not to disrupt service to millions of customers. On scanning Internet traffic, it became apparent that hundreds of points in the Kapea network were connecting to locations outside window, and doors were flapping open all over the place. On 20 January 2012, CAP an raised its alert level to orange. Its Business operations were in grave danger. A week later, on 27 January, there was an even bigger discovery. The hacker had also broken into the core router, effectively taking control of the whole network, and could do whatever they wanted. Snoop on Internet traffic, turn off TVs, take out the National Emergency hotline. The alert level was raised to red. With the country's most important telecoms provider under threat, Kapen notified the National Cybersecurity center and the National Police's High Tech Crime Unit. The next morning, one of Kapien's board members filed a police report for computer invasion. The situation triggered widespread alarm. The fragility of a network on which millions of people relied had been laid bare. Following the hacker's trail, the police team Fox IT and Kopan finally identified the computer server through which he'd entered the network. But after that, the puzzle became trickier because the hacker was shielding himself using VPN connections. The police team flew to South Korea to talk to Kambaska, and later to Japan, where a university network had been breached by the same individual. Investigators could see the hacker was using a Russian VPN server whose IP address showed up more than once in Kapien's network. Frustratingly, though, this information didn't really help the team. Because VPN servers mask a user's identity, there was one last thing they could try to follow traffic from the VPN server to an individual computer in Kapien's network. That computer turned out to host a website on which Akapi and customers shared downloaded movies. On that site's server, the investigators also found hacking files. The email address of the Site's administrator was Technologyive.com when they looked it up, the investigators uncovered another lead. The same email address had been used earlier in correspondence with Kapeen about a blocked IP address. In 2010, an IP address belonging to Technologyive.com had been blocked temporarily on account of malicious activities. That IP address was linked to a house in Barendrecht, just south of Rotterdam. Finally, the hacker made a mistake. He skipped the VPN and entered a hacked Kapn computer server directly from his home connection. With that, he exposed his home address. Police had a wiretap on the hacker's home to gather some last bits of evidence. One day, their entire Internet feed vanished, leaving the police staring at a blank screen. Their tap in Barendrecht was active, but no data was coming in. The problem, police discovered, was that Ka N had accidentally blocked the suspect's Internet connection. A little more than two months after receiving Kambaska's message. The Police finally had enough evidence to pull Edwin from his computer. Two agents were sent to intercept his mother and get her house keys. Then they sneaked up to the upstairs room where Edwin sat unsuspecting, taking the Internet by storm as Xs. Suddenly, uniformed men burst into the room. Police came. Get your hands off the computer. Jose Robe put a plate of biscuits in front of me and poured coffee. Ruud sat beside me as we talked. He pulled a handkerchief from the pocket of his jeans a couple of times, pushing aside his glasses to dry his eyes. After his arrest, Edwin was detained for 42 days, found guilty of hacking and given a suspended prison sentence of 240 days plus community service. He didn't want to do community service, however. So did the time instead. Afterwards, Edwin was even more withdrawn. He self medicated with sedatives and experimented with a variety of drugs. His dad would come home to find the house strewn with leaves and plants that Edwin was using to cook up some psychedelic brew. Edwin was delusional by this point and took exception to everything. To his parents, the situation seemed hopeless. Even professionals at the rehabilitation clinic where he was admitted, the Bauman in Rotterdam, sent him packing after a week, saying his behavior made him impossible. Edwin asked Ruth if he could move back home. But his dad didn't feel up to the task of taking in his now 22 year old son. As Edwin stood on his doorstep, Rud turned him away with a heavy heart. Come on, Edwin pleaded. But Rud was at the end of his tether. We can't, he said. I'm sorry. Edwin left with a backpack. His parents had no idea where he'd go. After several weeks with no news, Ruud tried to get in touch through WhatsApp and email. Edwin only responded to one email saying, sure, everything's fine. I'm in Pyongyang, North Korea. Attached to the message was a photograph. It showed Edwin dressed all in black with eye catching chains on his jacket. Standing next to him was a Korean soldier. He had posed in front of a picture of the North Korean leader Kim Jong Un, probably in fact a tourist attraction in South Korea. Edwin closed his email with. They monitor things like WhatsApp and phones, but at least they have computers. It was one of his very last messages. Rud bowed his head. Should I have let him come back home? He wondered. Should I have given him one more chance? I'd reached my limit. I just couldn't do it. I'd wanted to hear the story from Edwin himself. The one time we Skyped, he'd been in a hotel room in South Korea. Eight minutes into our call, he signed off with a smile and a peace sign. After that, we chatted sporadically over WhatsApp. His final messages were laced with despair. I don't like it here, he wrote, and they've got guns, and I want to get out of here asap. He stopped responding to my questions about Kapen. A few days later, I was contacted by a source. Did you hear about Edwin? He'd been found dead in a hotel bathtub not far from Seoul's international airport. The door of his room had been barricaded from the inside with furniture and pillows. At their home, Jose and Ruth pulled out pictures of Edwin and told me about his complicated youth. They asked about my last conversation with him, about which Ruud observed, that was just before he died. Edwin's arrest and incarceration were a tipping point, they told me. After that, it was all downhill, and questions linger. If it's that easy to break in somewhere, isn't there a much bigger societal problem we ought to address? It certainly didn't help that his parents had only a hazy grasp of what Edwin actually did. The technical jargon authorities used in the case against Edwin meant nothing to them. According to the public prosecutor, it constituted one of the most serious hacks in the Netherlands history. Edwin's work was ingenious, and the impact on CAPN, and thus on society at large, immense. By Capien's own reckoning, it cost him €3 million. After the hack, CAPN took measures to ramp up security in its systems. Although Edwin immediately pleaded guilty to all charges in court and cooperated with the judicial inquiry, the public prosecutor was scathing in his condemnation. Edwin's actions, he charged, had been malicious and deliberate and caused imminent danger to life. We really had no idea what he was up to, ruud said. It brought home to him just how vastly different the risks of the digital world are from those of the real world. It never even occurred to us that he could cause something like this. I'm more anxious about computers now, ruth admitted. When he fills in his tax returns and can't get the site to work, he gets stressed out. Sometimes I'm afraid someone might be using my identity. I'm forced to depend on technologies I can't understand, and that worries me.
- [34:05]
Claire Longrigg
For more Guardian long reads and text and a selection in audio, visit theguardian.com longread and to purchase a beautifully illustrated collection of our finest stories in print, visit guardianbookshop.com.
- [34:28]
Narrator
This is the Guardian.