Whoops! Man Accused of Being Part of CIA Hacking Group Had Already Been Doxed
Not all self-described hackers are good at hiding their identities.
A picture of Justin Liverman from his personal Facebook account.
One of the two American hackers arrested by the FBI on Thursday for his alleged role in a notorious hacking group had already been publicly identified, or "doxed," months before the feds came knocking at his door.
Justin Gray Liverman, a 24-year-old from Morehead City, North Carolina, is accused of being part of the hacktivist group known as "Crackas With Attitude," or CWA, which rose to fame last year for breaking into the AOL email account of CIA Director John Brennan. The hackers publicized the attack on social media and leaked documents found in his inbox, and then kept targeting and embarrassing several government officials in the following weeks.
According to the affidavit, the FBI identified Liverman as a hacker known by several aliases such as "D3f4ult" and "Bashtien" in part thanks to an IP address he used to access the D3f4ault and Bashtien Twitter accounts. That IP address was registered to an Edith Liverman, who Justin lived with at the time.
But it turns out that Liverman had already been publicly doxed months before, as far back as April 19 of this year.
A hacker known as Kayntias outed @Lorde_Bashtien, a hacker that at the time was loosely associated with "Crackas With Attitude," as Justin Liverman. Kayntias shared a link to a now deleted tweet from D3f4ult's Twitter account, which contained a picture of two women, apparently students at the University of North Carolina.
Kayntias followed D3f4ult's online trail, and found that he had several social media accounts under different aliases such as "BlastPhamous," including accounts on Instagram and Facebook. Some of these accounts contained similar photographs that D3f4ult was posting on his hacker accounts and even links that tied his D3f4ult and BlastPhamous aliases to his real identity of Justin Liverman.
"The feds were late to the party," Kayntias told me in an online chat.
The "_blastphamous_" Instagram account, for example, contains a link to a site of an apparent custom t-shirt brand named Ketuclothing. The same brand, with the same URL, is linked in Liverman's Facebook account, which identifies him as "CEO" of Ketu Clothing Co.
Another link found by Kayntias is a picture of Liverman, which the latter posted on his Instagram account. The photograph shows him in an airplane with a Michael Brooks book. The same book was photographed in a picture posted by @Lorde_Bashtien, according to Kayntias.
Kayntias said that at some point, Liverman's Facebook account contained direct links to other social media accounts with the handle "@liverman17," a now-deleted Twitter account which appears to include pictures of someone that is the same person, or at least looks a lot like, Liverman himself.
Liverman did not respond to a message to his alleged D3fa4lt Twitter account. The FBI declined to comment, saying it would not speak about an ongoing investigation. A spokesperson for the US State's Attorney's Office in the Eastern District of Virginia did not respond to a request for comment.
It remains to be seen if Liverman really was the person behind the D3f4ault and Bashtien online personas, but a lot of breadcrumbs, even some left for all to see, seem to point in that direction.
Want more Motherboard in your life? Then sign up for our daily newsletter.