Hack indictment issued by feds in Roll Red Roll website incident

STEUBENVILLE – Deric Lostutter, who went by the online name of KYAnonymous, was indicted Thursday by a federal grand jury for his role in hacking into the Steubenville City Schools sports fan website, Roll Red Roll, in connection with the 2012 Steubenville rape case.

The four-count indictment charges Lostutter, a Clark County, Ky., resident, with three counts of unauthorized access of a computer affecting interstate communication, in violation of Ohio, Kentucky and federal laws, to commit an invasion of privacy and libel and one count of making a false statement to the FBI.

Trent Mays, 20, of Bloomingdale and Ma’Lik Richmond, 20, of Steubenville were found guilty in juvenile court of rape in connection with an incident involving an intoxicated underage girl Aug. 11-12, 2012. Mays also was found guilty of a charge of illegal use of a minor in nudity-oriented material for allegedly having a picture of the 16-year-old victim in an outgoing text message on his cell phone.

Richmond and Mays were sentenced to spend one year in an Ohio Department of Youth Services facility. Mays was ordered to spend an additional year in the youth center for illegal use of a minor in nudity-oriented material.

After Mays and Richmond were charged, Lostutter from Dec. 21-25, 2012, conspired with others to hack into the Steubenville High School sports fan website, the indictment states. On Dec. 21, 2012, Lostutter sent an unnamed conspirator, a resident of Eastern Virginia who used an online account with the identity “JustBatCat,” a message asking the co-conspirator to work for him as part of a computer hack to draw attention to the rape case, according to the indictment. The co-conspirator created an account on a virtual private network service to anonymize his Internet activity, federal officials allege.

Lostutter and the co-conspirator gained unauthorized access to the e-mail account of a person associated with the fan website and obtained information stored on the victim’s e-mail account, including nude pictures belonging to other victims, the indictment states. Lostutter and the co-conspirator gained unauthorized access to the password-protected account management of the fan website and changed the administrator password, federal officials claim. They also changed the administrator e-mail address.

The indictment alleges Lostutter filmed a video of himself in a mask and wrote a manifesto in which he admitted accessing the victim’s e-mail account and fan website account management page, issued threats that he would disclose personal identifying information of Steubenville High School students and falsely claimed the victim was a child pornographer and directed the “rape crew.”

Lostutter sent the co-conspirator a message instructing him to post the video and manifesto publicly to the fan website and to post publicly an electronic link to download the victim’s e-mails, including the nude pictures belonging to other victims, federal officials stated. Lostutter changed the password-protected account management of the victim’s website to prevent the victim from regaining control of the website, the indictment stated. The indictment also states Lostutter sent the co-conspirator a message instructing him to delete electronic evidence of their access to the website’s password to avoid detection of their actual identities. The indictment states Lostutter sent a message to the co-conspirator promising to share credit with him to increase the publicity and reputation for the co-conspirator’s online identity.

The FBI raided Lostutter’s home in April 2013, seeking computer equipment, records related to Roll Red Roll and a Guy Fawkes mask.

The indictment states Lostutter on April 16, 2013, made a false statement to FBI agents that he had not written the manifesto, that he didn’t access the password-protected account management page of the fan website and that he had not changed the password.

Lostutter faces up to 16 years in prison if convicted.

Lostutter was ordered by U.S. Magistrate Judge Robert E. Wier to appear for an arraignment in Lexington at 1:30 p.m. on Aug. 9.

Lostutter’s attorney, Tor Ekeland of Brooklyn, N.Y., said he was surprised that an indictment came down three years after Lostutter’s home was raided by the FBI. Ekeland said he found out about the indictment Thursday night from a story on the Internet.

“I don’t understand why they are prosecuting somebody … who basically helped expose the rape of a minor,” said Ekeland, a specialist in defending people accused of computer crimes. He said the harm caused by alleged hacking was “minimal.”

Lostutter told The Associated Press in a June 2013 interview that he posted the video on an independent website run by a booster of Steubenville High School athletics, but he said he didn’t hack into the site or any computers.

He said someone else, whom he wouldn’t identify, hacked into the website.

The 12-minute Internet video posted on the high school’s fan website showed a former student joking about the attack and the victim.

Lostutter said in the interview that he believes he could go to prison for posting the video.

“I’m facing 25 years in prison when rapists face one,” Lostutter said

Lostutter said he worked with the online hacking group Anonymous and that a group of FBI agents, joined by two Kentucky State troopers and an officer from the Clark County Sheriff’s Office, spent three hours in his home.

The man who used an online account as JustBatCat was interviewed by the Herald-Star in February 2013. He asked that only his first name of Noah be used.

Noah said his only role was temporarily taking over the local website.

Noah’s involvement came by way of a conversation with KYAnonymous. “KY approached me,” Noah said. “I’ve only used the ‘BatCat’ name for this one hack. I planned from the beginning to delete ‘JustBatCat’ (Twitter name) after it was done.”

Noah said getting in and taking control of the RollRedRoll.com website “took about 15 minutes.”

“I was able to get into his Comcast account by answering his ‘forgot your password’ (security) question correctly. His (the site owner’s security) answer was ‘Big Red,’ Noah said. “I then just used that to get into the web hosting (account).”

Noah said, “I wanted to just get the word out. The story(of the rape) sounded a bit shady, so I figured I would help.”

Social media activists posted opinions on the rape case, claiming there was a cover-up. KYAnonymous also took credit for organizing “OperationRollRedRoll,” which put together the first protest rally in Steubenville.

As far as possibly facing legal action due to his role, Noah said, “I don’t think so,” and noted it was not a government site that was compromised.