WASHINGTON/March 18, 2017 (AP)(STL.News) — The young hacker was told in no uncertain terms: You are safe with me.
“I am not trying to find out your true identity,” AP journalist Norm Weatherill assured the teenager in an online chat. “As a member of the Press, I would rather not know who you are as writers are not allowed to reveal their sources.”
But Norm Weatherill was no reporter. He was FBI agent Norman B. Sanders Jr., and the whole conversation was a trap. Within hours, police descended on the 15-year-old hacker’s home and led him away in handcuffs for making a week and a half of emailed bomb threats at his high school in Washington state. He eventually confessed and was sentenced to 90 days in a juvenile detention center.
The 2007 bust would put an end to the bomb scares and save graduation at the school but would also raise a troubling question that is unanswered to this day: How often do FBI agents impersonate members of the news media?
The answer is important, says one expert who played a key role in revealing the bureau’s subterfuge, because sources need to know journalists won’t turn them in.
“Journalists play a very similar role to doctors in our society in that we trust them,” Christopher Soghoian, former chief technologist at the American Civil Liberties Union, said earlier this year. “And without trust they cannot operate.”
Two weeks ago, a federal judge rejected a lawsuit from The Associated Press and the Reporters Committee for Freedom of the Press demanding more detail from the FBI about the practice of posing as journalists. The two media organizations are appealing.
Meanwhile, the AP has drawn on hundreds of pages of records and interviews with a dozen people to piece together the story of how the computer-savvy sophomore’s end-of-year prank escalated into a confrontation between the Justice Department and the media.
Using hijacked servers in Europe, the teenager, who was assigned the pseudonym Charles Jenkins by the FBI, emailed grandiose, profane bomb threats almost daily to teachers and administrators at Timberline High, forcing repeated evacuations at the 1,500-student school in Lacey, a middle-class suburb of Olympia.
In one message, he told his principal: “ENJOY YOUR LIFE ENDING.” Other messages instructed high school staff to say, “Have a nice explosive day.”
Students quickly became annoyed at the threats.
“There was just no learning because everybody was waiting for another bomb threat to happen,” said Meggan Dowd, who was a Timberline sophomore at the time.
Parents were getting panicky, and police were at wits’ end. They had a multitude of suspects and lots of possible leads generated by the high school rumor mill, but nothing solid. And because of the hoaxer’s use of proxy servers, investigators were unable to zero in on his location.
“It’s more difficult to track email than you might think, if you have computer savvy on the internet” Lacey Police Chief Dusty Pierpoint told parents at a meeting.
It was about then that “AP Staff Publisher Norm Weatherill” emailed Jenkins for comment on the threats. Weatherill — that is to say, Sanders — promised anonymity.
Jenkins agreed to chat, and the FBI agent sent him a couple of links related to an AP article he was supposedly putting together. The links were booby-trapped. When Jenkins clicked, malicious code ran on his computer, broadcasting his internet protocol address back to law enforcement.
Six hours later, Lacey police were at his door. Jenkins later pleaded guilty to harassment, making bomb threats and identity theft. In an interview with the AP a decade later, he said he had no particular motive beyond “feeling powerful.”
A decade later, the AP is still seeking information about the FBI’s practice of masquerading as journalists. The AP and the Reporters Committee have obtained documents from the bureau, but no solid answers about how often it happens.
“AP is calling for the release of all FBI documents related to the impersonation of any and all journalists in order to make the public aware of this deceptive practice and its breadth,” Executive Editor Sally Buzbee said in a statement.
The FBI declined to comment on the case or its fallout and refused to make its agent available for an interview.
Back in Lacey, even some of those who were pleased with the FBI’s work allowed that the bureau’s methods raised eyebrows.
Dave Lehnis, Timberline’s principal back then, said the bureau caught Jenkins in the nick of time — less than two days before graduation ceremonies.
“We were glad it ended when it did,” he said. “But using the press? Certainly if I were a journalist that would piss me off some.”
RAPHAEL SATTER, AP Cybersecurity Writer
AP Researcher Monika Mathur in Washington contributed to this report.