Adrian Lamo: The Homeless Hacker Who Reported Chelsea Manning

Abstract

Adrian Lamo hacked Yahoo!, Microsoft, and the New York Times from public libraries and Kinko’s copy shops, carrying his possessions in a backpack and sleeping on friends’ couches or in abandoned buildings. He called himself “the homeless hacker.” He turned himself in to authorities after his most famous intrusion, was sentenced to six months’ home confinement, and spent the next decade as a minor celebrity in the security community. Then Chelsea Manning, a US Army intelligence analyst who had leaked hundreds of thousands of classified documents to WikiLeaks, reached out to him for advice, and Lamo reported her to the FBI. The hacker community never forgave him. He died in 2018 at thirty-seven, his reputation defined entirely by a decision he made in a Starbucks in 2010.

Adrian Lamo, 2004. Image: Adrian Lamo, CC BY-SA 3.0, via Wikimedia Commons.

The Wandering Years

Adrian Lamo was born on February 20, 1981, in Malden, Massachusetts, to a Colombian father and an American mother. The family moved often. By his late teens, Lamo had no fixed address: he moved between cities, slept on acquaintances’ floors, and spent long hours in public libraries, which offered free internet access.

He worked only from public connections (Kinko’s copy shops, public libraries, coffee shops), so no log entry pointed to a personal account or a residential IP address. He got in through unpatched holes in widely used commercial software, most often flaws in Microsoft IIS web servers and misconfigured Outlook Web Access installations, rather than through new exploits. The organizations he entered had not applied patches that were already available. He kept notes on the systems he accessed, the data he could see, and the routes he had used, and he often told the victims afterward.

The “homeless hacker” label was accurate: he slept in abandoned buildings as well as on floors, and public library computers were his main workplace. The mobility also served as security: a hacker without a permanent address leaves fewer records than one whose ISP bills arrive monthly. He carried no computer in the conventional sense; his equipment was whichever public terminal was free. Without persistent storage, a fast connection, or a private workspace, he favored methods that worked in a single session on an unfamiliar machine.

Between 2001 and 2002, Lamo accessed systems at several major organizations:

Yahoo! (2001): Found and exploited a vulnerability in Yahoo!’s editorial management system, used it to modify the company’s own news articles briefly, and reported the vulnerability to the company.

WorldCom/MCI (2001): Accessed the network of the telecommunications giant through an unpatched Outlook Web Access server, mapped internal systems, and reported vulnerabilities. WorldCom praised his disclosure.

Microsoft (2002): Penetrated Microsoft’s corporate network through a similar vulnerability, browsed internal systems, and again reported the vulnerability.

The New York Times (2002): The hack that made him nationally known. Lamo found an unprotected web portal giving access to the Times’s contributor database, a system used to manage expert sources and their contact information. He added himself to the database under a variety of expertise categories, including “national security” and “terrorist groups.” He also used the Times’s LexisNexis account. The Times was billed per search, and Lamo ran searches valued at about $300,000 before stopping.

The Times hack attracted a different order of attention than his previous intrusions. The New York Times was not a technology company; it was a media institution with legal resources and political connections, and it had been embarrassed by an outsider who had put himself in its expert database. The Times pursued the case aggressively.

Turning Himself In

Lamo’s response to the Times investigation was unusual: he contacted the Times and offered to explain what he had done, then turned himself in to federal authorities in September 2003. His public explanation was that unauthorized access without disclosure was irresponsible, and that the proper response to finding a vulnerability was to report it, even when the proper reporting mechanism was a criminal confession.

He was charged with computer fraud and sentenced in 2004 to six months of home detention, two years of probation, and $65,000 in restitution to the Times and Microsoft. The sentence was light partly because of his disclosure behavior and partly because no financial gain had been involved.

After sentencing, Lamo gave talks at security conferences, consulted on network security, and wrote occasional articles. He was technically skilled, spoke articulately about the ethics of unauthorized access, and had done something few intruders did: surrendered voluntarily instead of waiting to be caught.

The Disclosure Ethics

Lamo hacked first and disclosed afterward, which put him on disputed ground. Security researchers held that finding a vulnerability and reporting it to the victim did good, however the access had been obtained. Prosecutors saw unauthorized access as a crime whatever came after it, and victims called the “beneficial hacker” framing self-serving. His case came up often in debates over “full disclosure,” “responsible disclosure,” and the legal line of “no unauthorized access, period.” Whether turning himself in was integrity or theater depended on who was asked.

Chelsea Manning

In May 2010, Chelsea Manning (then Bradley Manning) was a twenty-two-year-old Army intelligence analyst stationed in Iraq with access to classified military and diplomatic communications. She had already transmitted to WikiLeaks the video footage that would become known as Collateral Murder (showing a US helicopter crew killing civilians and journalists in Baghdad in 2007), as well as hundreds of thousands of diplomatic cables and military incident reports.

Manning reached out to Lamo via AOL Instant Messenger on May 20, 2010. She had read about him online and believed, apparently, that as someone who had been through the legal system for unauthorized computer access, he might understand her situation and offer useful perspective. Over several days of online conversation, Manning described what she had done, why she had done it, and her belief that the leaked material would expose wrongdoing that the public deserved to know.

Lamo reported the conversations to the FBI and Army Criminal Investigation Command within days.

Manning was arrested on May 27, 2010. She was held in military custody for three years before trial, including extended periods in conditions that the UN Special Rapporteur on Torture described as cruel, inhuman, or degrading. She was convicted in 2013 of multiple charges under the Espionage Act and sentenced to thirty-five years in prison. President Obama commuted her sentence to seven years in January 2017; she was released in May 2017.

Warning

Lamo’s decision to report Manning divided opinion sharply. The hacker community largely viewed him as an informant who had betrayed the trust of someone who had come to him for help, violated an implicit norm of solidarity, and handed a vulnerable person to a military justice system that imprisoned her for three years before trial in conditions condemned by international human rights monitors. Supporters of his decision argued that the scale of the leak (750,000 classified documents) was qualitatively different from typical unauthorized access, and that his legal obligations, whatever the community norms, were clear. What was undisputed was that Manning had trusted him and that he had reported her. The hacker community’s verdict was effectively permanent.

The Manning Debate: What He Said and What It Cost Him

Lamo gave many interviews explaining his decision in the years after Manning’s arrest. His accounts were consistent in outline but varied in emphasis. He said he had believed the scale of the leak, particularly the diplomatic cables, which he felt could endanger sources in foreign countries with limited freedom of the press, represented a genuine threat that he felt obligated to report. He said he had tried to reach a lawyer before reporting and been unable to. He said he had contacted a former federal agent who was a friend and discussed the decision before acting.

The hacker community rejected these explanations. Its objection was less to his concerns than to the breach of confidence. Manning had not asked Lamo to judge her actions; she had looked for understanding from someone she believed had been in a similar position, legally exposed for unauthorized access done for reasons other than profit.

Lamo’s defenders (fewer in number but not absent) argued that the scale of Manning’s disclosure genuinely was different from typical unauthorized access, that the potential harm to foreign intelligence sources was real, and that Lamo’s legal obligations under federal law (which imposes affirmative duties to report certain categories of threat) were not imaginary. His decision may have been correct; its cost was paid by Manning, not by him.

What was not disputed: Manning spent three years in military custody under conditions that a UN human rights official found cruel and degrading; was convicted of espionage act violations; received a 35-year sentence; was eventually freed by presidential commutation; and identified Lamo’s report as the precipitating event of her imprisonment.

Death

Adrian Lamo died on March 14, 2018, in Wichita, Kansas, at the age of thirty-seven. Despite a full autopsy and toxicology testing, no definitive cause of death was established. The official ruling was “undetermined”, and toxicology reporting pointed toward an accidental overdose involving a combination of drugs (including kratom). He had been living in Wichita with friends and had struggled with mental health and substance issues for years. Since the Manning disclosure, he had been largely shunned by the security community that had once regarded him with a mixture of admiration and bemusement.

Obituaries were dominated by the Manning decision; the intrusions, the self-reporting, and his years on the security-conference circuit came second. In the history of computer intrusion he is remembered for skilled break-ins and for reporting himself. In the history of whistleblowing he is the person who turned Chelsea Manning in.