Expect us



Convinced that they had identified the right suspect, agents began continuous physical surveillance of Hammond's two-apartment home on Chicago's South Side on February 29. Their target only used the side entrance to the building, which accessed the rear apartment; using a signal strength meter and directional antennas, FBI agents located his wireless router signal and were able to confirm that it was located in the back apartment.

Watching the WiFi network revealed the Media Access Control (MAC) addresses of each device connected to the network. Most of the time there was only one, an Apple Computer—and sup_g had told Sabu that he used a Macbook.

On March 1, the agents obtained a court order allowing them to use a "pen register/trap and trace" device that could reveal only "addressing information" and not content. In other words, if it worked, agents could see what IP addresses Hammond was visiting, but they would see nothing else.

The FBI describes its device as a "wireless router monitoring device” that captures addressing and signaling information and transmits it wirelessly through the air to FBI agents watching the home. It was installed the same day and was soon showing agents what Hammond was up to online.

His Macbook's MAC address was soon seen connecting to IP addresses known to be part of the Tor anonymizing network. "An FBI Tor network expert analyzed the data from the Pen/Trace and was able to determine that a significant portion of the traffic from the Chicago Residence to the Internet was Tor-related traffic,” said the FBI's affidavit.

And while this definitely sounded like their man, the Bureau went to even greater lengths to double-check their target. The main technique was to observe when Hammond left his home, then to call Sabu in New York and ask if any of Hammond's suspected aliases had just left IRC or the Jabber instant messaging system.

Here, for instance, are two such logs from March 1:

On March 1, 2012, at approximately 5:03 PM CST, Hammond was seen leaving the Chicago Residence. Almost immediately after, CW-1 (in New York) contacted me to report that the defendant was off-line. Pen/Trap data also reflected that Tor network activity and Internet activity from the Chicago Residence stopped at approximately the same time. Later, also on March 1, 2012, at approximately 6:23 PM CST, Hammond was observed returning to the Chicago Residence. Tor Network traffic resumed from the Chicago Residence approximately a minute or so later. Moreover, CW-1 reported to me that the defendant, using the online alias “yohoho," was back online at approximately the same time as physical surveillance in Chicago showed Hammond had returned to the Chicago Residence.

Surveillance continued right up through March 4, when Sabu had his last online sighting of Hammond at 7:00pm CST. On March 5, the FBI drew up its finalized arrest affidavit and presented it to Judge Ronald Ellis in the lower Manhattan federal courthouse. Later that day, it was acted upon in Chicago.

Arrest and aftermath

Hammond was arrested last night. Residents of the Bridgeport neighborhood took to a Facebook group to figure out what was happening. "There is a big white truck outside now - the evidence wagon?" wrote one. "And more FBI agents." Another said he was told to go back inside and that the FBI had "some huge guns."

"There were a ton of FBI agents taking guys out of this house," said another. "At 8:00 at night. They weren't taking down a flag burner [some had speculated that it was due to Hammond's hippie, anarchic ways]. It's 11:00 now & there are 16 FBI vehicles still out here. I live across the street. I don't know who you're hearing stuff from - but this is BIG!"

"I asked the boyfriend to go out & see if he could get any more info," wrote a commenter. "The FBI guy said this will be out in the news tomorrow. Stay tuned."

Hammond was back in the news—again. He was profiled back in 2007 by Chicago magazine as part of a piece on hacktivism. "That evening, I caught up with Hammond in front of the flower shop," wrote author Stuart Luman. "He bragged about a current scheme involving Kinko's cards, which he had hacked so they would grant free copies. He fanned the cards in front of me as if he were performing a magic trick. Then he pulled from his pocket a San Francisco Bay Area Rapid Transit pass. 'I can clone these so easily,' he boasted."

But Hammond's passion was social change. At a hacking meeetup profiled in the piece, Hammond tells his fellow hackers that he is driven by his hatred of social inequality. "Our civilization is facing a radical, imminent mass change," he said. "The alternative to the hierarchical power structure is based on mutual aid and group consensus. As hackers we can learn these systems, manipulate these systems, and shut down these systems if we need to."

Yesterday's arrest didn't appear to surprise him. As the Chicago Tribune reported, he appeared at a hearing today in federal court and was ordered off to New York to face the charges.

"After the hearing, as he stood in a narrow hallway, Hammond appeared curious," wrote reporters Todd Lighty and Wailin Wong. "He asked deputy marshals if he could keep a copy of the criminal complaint since he had no idea about the charges until his arrest Tuesday morning. His lawyer, James Fennerty, said he considers Hammond a likable man with strongly held beliefs."

Now, those beliefs could land him in serious trouble.