Three summers ago, law enforcement in San Diego County faced a mystery. How was it that dozens of Jeep Wranglers were being brazenly stolen in the dead of night, with no broken glass to be found? How was it that no one heard the car alarms sounding? More fundamentally, who was doing it?

On September 26, 2014, investigators caught a break. A woman in Rancho Bernardo, California, reported that her 2014 Jeep Wrangler Rubicon was stolen from her own driveway overnight, and she had video evidence. When investigators reviewed the footage, they saw three men disable the engine before using a key and a mysterious "handheld device" to quickly get into the car and drive off. The entire heist took just a few minutes.

Based on this footage, law enforcement sent Chrysler a list of 20 stolen Jeeps and asked if anyone had requested duplicate keys. Duplicates had been requested for nearly all of them via a dealer in Cabo San Lucas, Mexico.

According to recently-unsealed court documents, federal authorities now believe that a Tijuana-based motorcycle club known as the Hooligans were behind the scheme. Three suspects have been arrested, while six more men remain at large, believed to be in Mexico.

Before the unprecedented operation was disrupted, the bikers stole over 150 Jeep Wranglers worth a total of around $4.5 million.

"The joy ride is over for these Hooligans," Deputy US Attorney Mark Conover said in a statement in May 2017. "For many of us, our cars are our most valuable possessions. These arrests have put the brakes on an organization that has victimized neighborhoods in a different way—by stealing something very personal. Something that required a lot of sacrifice to purchase."

In August 2016, two men in Houston were arrested for organizing a similar car theft ring using nearly identical tactics.

“Dirty 30”

According to an affidavit by Kraig Palmer, an investigator with the California Highway Patrol, the investigation was bolstered by a confidential informant who was a member of the Hooligans.

The CI said that the Hooligans are divided further by those that are in the "Dirty 30" and those that are not. Dirty 30ers frequently engage in criminal activity, including illegal drug sales. In 2014, Dirty 30 members apparently began to be interested in Jeep Wranglers, which have a high resale value in Mexico.

Amazingly, they even organized and discussed their activities on Facebook—which law enforcement managed to obtain. On April 4, 2015, one of the defendants, Adan Esteban Sanchez Aguirre, wrote in Spanish to another co-conspirator identified only as "JC:" "They're going to say 'damn hooligans.'"

According to Palmer, the thieves orchestrated an elaborate, multi-step process to steal the Jeeps.

First, they would identify specific model years with certain accessories that they felt would be particularly valuable to resell or to strip for parts. They obtained the Vehicle Identification Number (VIN) simply by copying it from the sticker on the dashboard or the stamp under the driver's side door on the chassis itself.

Next, these Jeep scouts would send back the VIN to their Dirty 30 leader, who would use it to get a duplicate ignition key.

As Detective Palmer explained:

To obtain a duplicate key, the group first needs two codes, both of which are housed in a proprietary key database. The first code corresponds to a pattern used to cut the physical key. The second code is required to program a computer chip within the key to the targeted Jeep's onboard computer. (The computer chip, however, is not programmed using the second code until the time of the theft.) The leader sends the VIN to another Hooligan, who accesses the proprietary database and obtains the desired key codes. That Hooligan uses one of the codes to create a duplicate key for the targeted Jeep Wrangler. The Hooligan then provides the duplicate key to the leader along with the second code, which the Hooligans need in order to program the microchip within the key at the time of the theft.

The affidavit does not explain exactly how the suspects accessed this database.

An iPhone that opened up all the doors

Next, once the thieves had the duplicate key and knew where their target Jeep was, they'd simply go after it. Working quickly, the men would pop the hood by opening the distinct front latches, then cut the wires for the horn and flashing lights that would have sounded as part of the alarm. Next, they'd unlock the door with the duplicate key and enter the Jeep.

Once inside, the thieves connected a "handheld vehicle program computer" into the Jeep's diagnostic port. Then, using the second key, the microchip on the duplicate key would be programmed, or "paired." With that complete, the alarm would cease, and the rear lights would stop flashing. Finally, the thieves would drive the Jeep into Mexico.

The investigation continued, and authorities caught a break on April 30, 2017, when one of the Hooligan suspects, Henry Pulido, was stopped at the San Ysidro border while attempting to cross into Mexico. Border agents suspected that he was driving a stolen motorcycle.

Pulido, however, was one of three Hooligans who had previously been arrested and charged on federal charges of vehicle theft in June 2015—the other two include Juan Castaneda and Salvador Castillo. (The government dropped charges against Pulido and Castillo in December 2015, while Castaneda's case remained live until he pled guilty in February 2016. Castaneda is set to be sentenced in October 2017.)

When Pulido was questioned at San Ysidro, Palmer asked him to unlock his iPhone 7. Pulido did. On the phone, Palmer obtained a slew of new material, including photos of targeted Wranglers, corroborating text messages, and other incriminating information.

Two other Hooligan suspects, Alejandro Guzman and Reynaldo Rodriguez, were arrested on May 30, 2017. That same day, the criminal indictment was unsealed against them and six other suspects who are believed to still be at large. One of those six is Salvador Castillo, who was prosecuted with Castaneda and Pulido back in 2015.

Guzman, Rodriguez, and Pulido are set next to appear in court on August 28, 2017. Lawyers representing the men did not immediately respond to Ars' request for comment.