'Cynical and bullying' TalkTalk hackerhacker getsgets 4 yearsyears behindbehind barsbars

A Welsh man who hacked British ISP TalkTalk in 2015 and siphoned off subscribers' personal data has been sent down for four years. A judge at the Old Bailey in London sentenced Daniel Kelley, 22, of Heol Dinbych, Llanelli, on Monday. Kelley pleaded guilty to 11 computer crime charges in 2016, and has waited more than two and a …

[Anonymous Coward]

I've been caught ...... I must have Asperger's.

I am somewhat amazed to find yet another 'Hacker' that is diagnosed with Asperger's *after* being caught ???!!!

Is this a standard tactic by the defence or is it just all hackers have Asperger's ???

Sort of Tongue in cheek but with lingering doubts ...... ;) :)

[Expect to be downvoted ..... but question needed to be asked.]

[veti]

Re: I've been caught ...... I must have Asperger's.

We don't know when he was diagnosed with Asperger's, but it must have been a while ago because the condition doesn't exist any longer - it's called ASD now.

It would help to explain why he thought the hacking was harmless fun. But when it comes to 'bullying, intimidation and extortion', I'm inclined to think it would take more than ASD to get him off the hook for that.

[Anonymous Coward]

Re: I've been caught ...... I must have Asperger's.

the condition doesn't exist

FTFY, at least in this case

[Mr Benny]

Re: I've been caught ...... I must have Asperger's.

"It would help to explain why he thought the hacking was harmless fun"

Having Aspergers doesn't make you so socially clueless as to think hacking a companys systems is harmless fun. If he's smart enough to hack these systems he's smart enough to know its illegal and if he gets caught he'll be doing porridge.

[IGotOut]

Re: I've been caught ...... I must have Asperger's.

Asperger's, but it must have been a while...it's called ASD now.

Wrong.

ASD is Autistic spectrum disorder.

Asperger is subset of this.

Kind of like saying Hodgkin's lymphoma no longer exists, it's now called cancer.

[NonSSL-Login]

Re: I've been caught ...... I must have Asperger's.

The UK doesn't diagnose Asperger's as a condition since DSM5 which was released in 2013. Before that someone with Aspergers would get a diagnosis of Aspergers but after that date they have ASD. Just a different place on the spectrum than others with ASD.

So the original posters intention was to say he must have got diagnosed well before the case.

[Dan 55]

Re: I've been caught ...... I must have Asperger's.

Is this a standard tactic by the defence or is it just all hackers have Asperger's ???

Nothing changes. In the 80s we were all on the spectrum too, except for those on the C64.

[TimMaher]

Re: I've been caught ...... I must have Asperger's.

Upvote for that and an early days beer.

We had a Pet... and a computer.

[macjules]

Re: I've been caught ...... I must have Asperger's.

Dido Harding must be relieved.*

* NB: That is an expression of relief in sympathy with the poor lady's suffering she must have endured at the hands of that evil, Welsh hacker, and not at all a request for her to be removed from her job.

[bombastic bob]

Re: I've been caught ...... I must have Asperger's.

yeah about "ass-burgers" - it's one of those ENVIOUS nicnames for "genius personality" - like AD[H][D

better drug it out of existence, because CREATIVE and INNOVATIVE people aren't so easy to control...

[Anonymous Coward]

Re: I've been caught ...... I must have Asperger's.

Looking at some real geniuses in the computer line - Babbage, Turing, von Neumann, Max Newman - I don't notice much evidence of antisocial, criminal tendencies. Quite the reverse - all pillars of the Establishment except Turing, and he only got into trouble because the US was busily exporting paranoia about gay people and Reds under the bed.

There have always been clever sociopathic assholes around; what has changed is they have found they can get rich through social media and "disruptive" technology rather than, say, becoming arms dealers, drug barons or gangmasters.

[BebopWeBop]

Re: I've been caught ...... I must have Asperger's.

well richer anyway with much lower risk and higher society kudos

[bombastic bob]

Re: I've been caught ...... I must have Asperger's.

"Expect to be downvoted"

why?

[Anonymous Coward]

Re: I've been caught ...... I must have Asperger's.

Bombastic Bob,

"Expect to be downvoted"

Because on the 'interweb' someone 'always' takes offense !!!

Example in this thread the Character Fagin is used in the accepted way Fagin is known (running a gang of child criminals) and ....

someone takes offense *because* it could be raising anti-semetic thoughts because the Character is Jewish.

BTW: I was downvoted !!! :)

[cb7]

Now there's a kid with real talent.

Sounds like he would have put the money to better use than TalkTalk

His skills would be better put to use as an ethical hacker than wasting away in some cell probably growing bitter and twisted.

Send him on the course he wanted to do first - though he'd probably be able to teach the teachers a thing or two.

This is what's wrong with the "justice" system in this country.

[Tomato Krill]

But, apparently, only the talent for a level 2 btec?

[Jason 24]

I call crap on him only being allowed on a level 2 course.

My GCSEs should have only got me on a level 2 course, but they realised I would be very bored so they put me on a level 3 course.

We were still bored and the tutor gave us CCNA to do in the other 15 hours of the 16 hours a week we had to attend college (and I did attend all the hours for the £30 a week bung offered at the time, EMA I think? Great beer money).

That was 15 years ago mind.

[Chris G]

Whether talented or not, he was a spiteful little shit who who caused a lot of damage and put customers private details at risk.

If you can't do the time, don't do the crime.

Maybe they should offer him the alternative of signing up for the Army's hacking brigade instead of doing bird, say a five year service term.

Crapita have not had much luck with recruitment so the army could try the ' Dirty Dozen' technique.

[Anonymous Coward]

He crossed the line when her disabled NHS systems putting lives of sick people at risk.

Let him use the time to get qualifications and show remorse.

[Alan Brown]

"Whether talented or not, he was a spiteful little shit who who caused a lot of damage and put customers private details at risk"

I'll guarantee that after release, he won't have changed one iota, continues to blame everyone else for his woes (and getting caught) and continues the malicious activities if he can.

He's a carbon copy of several skiddies I've run across and jailtime wasn't a wakeup call for them either.

WRT "join the army" - you might want to consider that the Israelis tried this with 1990s nuisance Ehud "Analyzer" Tannenbaum and couldn't control him. He was last heard of in 2012 being sentenced in a New York district court for hacking banks, but I doubt he's stopped. (Incidentally one of Tannenbaum's standard MOs was to "foster" younger skiddies and train them up to do his dirty work. The guy just keeps popping up again and again when looking into skiddy history. He's kinda like Fagan in this regard.)

[Jedit]

"He's kinda like Fagan in this regard."

Just a reminder that Fagin was also Jewish, an anti-Semitic stereotype in fact. So be careful how you use him as a comparison.

[Wilseus]

Re: "He's kinda like Fagan in this regard."

You've got to hack a socket or two, boys!

You've got to hack a socket or two.

[Dr Dan Holdsworth]

The problem is that whilst he may be skilled enough to get into various systems, he probably isn't all that much use at actually useful and marketable things. Hence the course assessors only wanting him on the lower skill level course.

Employing poacher-turned-gamekeeper people is always a risk. By the time you actually catch them, they've normally been doing naughty things for easily long enough to have gotten used to the inability of the authorities to catch them most of the time, and have grown deeply cynical about the long arm of the law. Thus you have this problem of how much you actually trust them.

[sal II]

Talent?

What talent? He got traced back to his home IP. That's like hacking 101 - use VPN or remote host or both and then some if you.are being serious.

He didn't steal money from TalkTalk, to put them to better use, he stole and distributed customer data, as a direct result large number of people were scammed and lost money directly or indirectly.

If he wanted to go down the ethical hacker route he should have handed the data back to TalkTalk along with report/recommendations on how to plug the holes in their security, but he didn't do that did he?

There are many things wrong with the justice system in this country. Putting convicted criminals behind the bars ain't one of them.

[[e-mail]]

That horse has bolted.

"His skills would be better put to use as an ethical hacker than wasting away in some cell probably growing bitter and twisted."

Yes, but he's going to be put away in a cell because he was clobbered for stealing the details of TalkTalk CUSTOMERS - this wasn't like spray-painting graffiti on the side of their building or locking them out of their systems for an hour or two; this was a deliberate threat to pass the details of 'innocent' people on to other dritseks for other illegal purposes.

He had no "higher purpose", he wasn't out to expose security loopholes so they could be fixed, he wasn't targeting pr0n merchants or criminal gangs communicating via text and email, he was trying to make as much money as he could by threatening people like the old couple down the road or the single mom a couple of streets away - TalkTalk and the other companies were not the real victims in this, it is the people whose details he stole.

If you look at this as a crime against a Telco then it doesn't sound so bad, but when you take into account how many people suffer real hardship after having all their savings stolen and their bank accounts plundered using data stolen like this then you might begin to see why these scum are not modern-day robin hoods but are nothing more than cowardly muggers preying on the vulnerable and undeserving of any sympathy.

[Anonymous Coward]

Re: That horse has bolted.

Yep, and those who were customers at the time, and their families, continue to suffer to this day with malicious phone calls and email scams from criminals around the globe who use details from the hack to try to con them out of control over their computers, home networks, and ultimately bank accounts.

I never met Daniel Kelley but he's had a significantly negative impact on my life over the last four years. What's happened to the others in the group?

[mark l 2]

I watched a TV show on the BBC where some guy who was off his head on drink/drugs and used a 12inch knife to stab an officer in the arm who was trying to arrest him. That guy got a 12 month suspended sentence yes this kid gets 4 years in a YOI.

Yes he broke the law but that seems a harsh sentence for something that he did when he was still only a teenager.

[Anonymous Coward]

Punishment for embarrassing the establishment? Dido probably had a word with one of her mates.

[Alan Brown]

"Punishment for embarrassing the establishment?"

Nope. Look up the punishments for blackmail sometime - and particularly blackmail "with menaces"

The maximum penalty is 14 years' imprisonment. He got off LIGHTLY compared with sentences handed down over the years.

And then there's the damage he did to the NHS network with his DDoD attacks, puting patient data and diagnoses at risk.

[Hollerithevo]

Mens rea

A guy who is off his head on drink and/or drugs is considered lacking the mental state to do a deliberate crime. It's why drunk driver, who don't intend to cause harm, but just to drive their car, get light-ish sentences.* Our hacker knew exactly what he was doing.

* I think if someone drinks, knows they are then going to drive commits a crime of intention when they decide to drive, and then drive.

[JLV]

Re: Mens rea

Probably not in most jurisdictions. Canadian law basically doesn’t consider intoxication as much of a mitigating circumstance.

The reason killer drunk drivers don’t get as much jail as murderers is the lack of intent. They intended to get drunk. And also knowingly break DWI laws. But the killing itself is accidental, not deliberate, even though putting people at risk was.

Putting them in jail for a few years? Sure. 10 yrs and up? Not hugely useful as a deterrent.

Get hopped up on something and deliberately kill someone? You bet you’re going to jail and your intoxication is not getting you out of it.

Not defending drunk drivers, just saying you’re wrong.

[Nick Kew]

Re: Mens rea

Different jurisdictions. Blighty is disgracefully lax: drunken drivers rarely get more than a slap on the wrist. Even the most extreme cases - like killing someone while not merely drunk but also banned from driving for a string of similar previous offences - won't necessarily get you locked up.

[John Savard]

Re: Mens rea

I remember a magazine article that alleged that Japan was shockingly lax about drunk drivers. I am surprised to hear, however, that this is also true of the United Kingdom, even if to a lesser extent.

[Alan Brown]

Re: Mens rea

"I am surprised to hear, however, that this is also true of the United Kingdom, even if to a lesser extent."

It used to be the case in Australia and New Zealand too, until the mid 1970s. Both countries now regard drinking as an _aggaravating_ factor when considering sentencing for driving offences.

This comedy sketch originally from 1969 wasn't far off the truth - https://www.youtube.com/watch?v=9_7VHMIXusQ

[DavCrav]

Re: Mens rea

"A guy who is off his head on drink and/or drugs is considered lacking the mental state to do a deliberate crime."

I believe being (intentionally, i.e., not spiked) drunk at the time is considered an aggravating factor in sentencing, not a mitigating factor. It's a myth that is mistakenly employed by the small army of people having to defend themselves in court: they say they it was the drink not them, and then that increases the sentence rather than reduces it.

[Charlie Clark]

Re: Mens rea

Substance abuse is increasingly less likely to be considered as "mitigating circumstances" in many jurisdictions, but there is still the issue of intent.

[Anonymous Coward]

Re: Mens rea

The problem with drink driving is less from the "I've only had a couple, I'll be fine" types, and more from people who've had ten pints and suddenly the idea of driving seems like a fantastic plan with defenitely no drawbacks.

The only solution to the latter, for me, was to make sure that if there was a chance of me getting that pissed, that I'd have no desire or opportunity to go for a drive.

[Charlie Clark]

Even though the courts are now more careful about arguments about "diminished responsbility" when "under the influence", the key difference in any case would be whether it was a single or repeated, and hence, premeditated.

[JimC]

Think about number of victims.

Your drunk had one victim, this guy had 157,000.

[Anonymous Coward]

From knowing prison officers who worked in both adult mens prisons and YOIs. They say YOIs are much more violent places than any of the adult mens prisons in the UK. So it won't be a walk in the park like some of these 'white collar' criminals gets by going straight to open prisons.

[earl grey]

sorry, no sympathy

for this guy or the one with the knife. weld the door closed in chokey.

[Anonymous Coward]

Welcome to prison sonny and it's not a video game, the punches you get here are real.

[John Brown (no body)]

...and you don't "3 lives" to try again.

[MrMerrymaker]

Throw the book at all of em

"siphoned off subscribers' personal data"

Glad he's doing time (for anyone bizarrely against it, he will probably do half) but TalkTalk directors who failed to prevent it should do time too.

Plus TalkTalk are shite in so many ways. Directors doing time would remove these menaces from society...

[Alan Brown]

Re: Throw the book at all of em

" but TalkTalk directors who failed to prevent it should do time too."

Indeed, particularly as they failed to prevent it THREE times

[Anonymous Coward]

Skilled cyber-criminal left traces of own IP address

‘Kelley, who was previously described by prosecutors as a "prolific, skilled and cynical cyber-criminal," .. was eventually caught when the police traced an IP address .. back to his home internet connection.’

That's the first rule of cyber-hacking, don't log-in to the target from your own home computer.

[Dan 55]

Re: Skilled cyber-criminal left traces of own IP address

He may be prolific and cynical but not so skilled, then.

(Is being cynical a crime now, BTW?)

[Doctor Syntax]

Re: Skilled cyber-criminal left traces of own IP address

Being a cynical criminal is.

[chuBb.]

Re: Skilled cyber-criminal left traces of own IP address

Had clearly never watched the masterpiece hackers....

To quote cereal killer, "Thats gallactically stupid man" with regards to joey the skiddy hacking a bank across state lines from his home phone....

[Prst. V.Jeltz]

Re: Skilled cyber-criminal left traces of own IP address

how do we know he didnt take extra IP hiding measures , and the Mad Skillz of the plod traced it anyway?

[Craig 2]

Re: Skilled cyber-criminal left traces of own IP address

"how do we know he didnt take extra IP hiding measures"

Exactly, too many smart-asses commenting "just use a VPN and then you're perfectly safe and untraceable"!

[Alan Brown]

Re: Skilled cyber-criminal left traces of own IP address

> Exactly, too many smart-asses commenting "just use a VPN and then you're perfectly safe and untraceable"!

By the time these skiddies think about using a VPN they (and their online fingerprints) already well-known - plus they like to boast - which means that all it takes is someone observing the skiddy community over a prolonged period to connect the dots sufficiently to get a monitoring warrant.

Various groups have been doing exactly that and building intelligence files on skiddies from the moment they first appeared as young pains in the arse until some point when they're determined to be non-sociopathic and outgrown the behaviour. At first it was other net users who were pissed off about the DoS attacks, more recently it's law enforcement.

[Alan Brown]

Re: Skilled cyber-criminal left traces of own IP address

"how do we know he didnt take extra IP hiding measures"

He didn't. Most crims (who get caught) simply aren't that smart.

If they were, they'd hold down honest jobs (or start up new religions) - and although you occasionally hear about massive amounts stolen, when you tote up the hours involved they're usually getting less than minimum wage overall. It's some kind of gambling mentality. (big up the wins, ignore the losses)

"and the Mad Skillz of the plod traced it anyway?"

As with many such cases, it was handed to them on a silver platter after a lot of other people did the legwork.

About the only time they did their own legwork was when Peter (weaselboy) Francis-Macrae sent out fake invoice spam with a reply phone number of the Cambridgeshire police HQ's main switchboard in 2003. Then it got personal.

[Doctor Syntax]

Re: Skilled cyber-criminal left traces of own IP address

"prolific, skilled and cynical cyber-criminal,"

It's more or less part of court ritual. Prosecution will present the offender, however inept, as a criminal mastermind, defence will present them as an innocent abroad and easily lead by the bad crowd they unknowingly fell in with (or Aspergers for shorthand). It's all aimed at determining sentence.

[TDog]

Talk Talk Account

I had one of these, from a legacy with Tiscali. I didn't use it other than for potential exploratory reasons. I was not surprised when it was hacked - I was well aware of the soft and strong access routes. But what I wanted to see was the reaction of TT.

In simple terms, there is no universal guarantee that you shall not be hacked. Anyone who claims otherwise is marketing their bullshit. Teams I have worked with have assured me that any hack will simply fall into one of many traps which will both adsorb the hack; identify the hacker (through various quasi legal processes) and deal with the problem. BTW see the comment about QLP.

And they were always right - they told me so themselves. But usually there were fewer than 50 of them. Which leads me to think that marketing may be less accurate than reality. Cos even assuming they were as good as the hackers I have been told about, well maths suggests there are a lot of holes - maybe 10 ^ 3 per hundred thousand lines of code (1%) and so with guy's trying to plug the hole in the dike, well 4 fingers and a dick ain't going to work.

But they always assured me they were in control.

Yep, believed that

Digressions but a realistic understanding of risk is probably useful. There are always more people looking to hack than making it in the first place.

Oh, and about TT, incompetent, stupid, multiple times used inappropriate scripts, which had the users known would have been lying, and soft targets if you were to spend sufficient time.

Sad to see my expectations gratified

[LeahroyNake]

Re: Talk Talk Account

Plus 1 just for the 4 fingers and a dick line :p

[Toby Poynder]

"Reach out" makes me retch...

"It was also claimed Kelley *reached out* to TalkTalk's then-CEO Dido Harding" (my emphasis). Can we stop this "reaching out" bullshit please? Horrible touchy-feely language and particularly inappropriate to describe the actions of an extortionist threatening his victim.

[Roger Greenwood]

Re: "Reach out" makes me retch...

Hi Toby, just circling back to slide into your inbox and diary a conversation with you later. Need to ensure we increase our pipeline ROI.

[Anonymous Coward]

Re: "Reach out" makes me retch...

>Can we stop this "reaching out" bullshit please?

Well said there Sir, reaching out sounds like something a perv does on the Underground.

Upvoted.

[Doctor Syntax]

Re: "Reach out" makes me retch...

Should have been worth 6 months on the sentence.

[knarf]

Fatal mistake..

Thinking that Talk Talk actually cares about their customers and use that to extort money.

[Anonymous Coward]

It wasn't only DIDO thart was harrassed

Being a rural location where BT could only deliver 2 MBPS I did ed up caught up in the talk talk hack. We were lucky in 2 ways, we were out of contract and BT had finally brought FTTC to the village. I received many calls from 'talk talk engineers' who had access to my full account details who tried to get me to allow a remote connection. These guy's were plausible at first contact and I can believe that many of the people they contacted ended up granting access. I assume the data had been sold on to several groups as rejecting one approach and letting them know I knew it was a scam didn't stop the calls. In the end only the move to BT and a change in phone number stopped it. I was specifically told by TalkTalk that I was not included in the original hack and do have a suspicion that there may have been a group of bad actors within Talk Talk who were using their systems to carry out Phishing attacks, no doubt the truth will come out in the end. Don't forget that Talk Talk did not allow affected users to end their contracts early, they did charge the full termination charge. they were completely insensitive to the stress it was causing, at one point the phone was ringing 7 times a day from 'out of area' numbers so we couldn't even block them.

[bombastic bob]

was said to have cost TalkTalk £77m to clean up

I call B.S. on that £77 million - I bet the company inflated it for insurance and tax purposes

[doesn't mean the perps aren't guilty - throw the book at 'em]

[Prst. V.Jeltz]

Re: was said to have cost TalkTalk £77m to clean up

I once saw a breakdown of a "hacker damage" invoice.

Completely full of bullshit, just the full cost of anything and everything remotely involved.

[Doctor Syntax]

Re: was said to have cost TalkTalk £77m to clean up

It probably included everything they should have spent in the first place to secure their systems.

[Anonymous Coward]

Skilled cyber-criminal

Does it really take a "skilled cyber-criminal" to find & exploit SQL injection vulns ??

Really ??

[Anonymous Coward]

Re: Skilled cyber-criminal

It does take a willingness to read through a whole load of stuff on dodgy web forums, but I have to say back in the day it was kind of amusing to read the logs and look at the script kiddies (not automated then) trying to gain access to our SuSE box with Windows hacks.

A million monkeys with typewriters and scripts...

[DrXym]

Aspergers

Symptoms of which do not include the inability to tell right from wrong. Despite that it seems to be the go-to excuse for all hackers up before the beak.

[Anonymous Coward]

Re: Aspergers

Indeed, my brother was diagnosed with Asperger's and nope, still not a criminal, surely he should be fighting extradition to the US or something by now?!

[Prst. V.Jeltz]

Re: Aspergers

Like post #1 said - when was this diagnosed?

I cant imagine many hackers getting pre-collar diagnosis just in case ....

If no medical record beforehand - not a defense surely?

[Doctor Syntax]

Why did it take 2 1/2 years after a guilty plea?