×

Hacker who took over RollRedRoll website during Steubenville rape case enters guilty plea

STEUBENVILLE — The individual who gained control of a local Steubenville Big Red sports fan website in December of 2012 has entered a guilty plea over his involvement.

Noah McHugh, of Alexandria, Va., pleaded guilty in a Lexington, Va., federal court to charges of accessing a computer without authorization, according to a report by the Lexington Herald-Leader.

On Dec. 23, 2012, the RollRedRoll.com website was compromised with a video and message posted from someone identifying himself as with “KnightSec” and also with “Anonymous” – an internationally known hacker-activist group.

After the site was compromised, the video and demands went viral on the Internet and on social media websites. The effort drew national media attention and the attention of celebrities including Rosanne Barr.

In a February 2013 interview with the Herald-Star, McHugh said he helped gain control of the website to shed light on the local rape investigation involving two Steubenville High School student-athletes in an incident in August 2012.

“I wanted to just get the word out,” McHugh said at the time. “The story sounded a bit shady, so I figured I would help.”

The two key players in the initial website hack turned to Twitter and started a conversation with supporters and, to a certain degree, detractors. The individual who appeared wearing a Guy Fawkes mask in the video went by the KYAnonymous Twitter screen name.

KYAnonymous also took credit for organizing “OperationRollRedRoll,” which put together the first of several protest rallies in Steubenville.

Deric Lostutter, of Winchester, Ky., later identified as being “KYAnonymous,” was indicted on July 7 by a federal grand jury for his role in the hacking. That case is still pending.

In his plea arrangement, McHugh admitted to helping Lostutter with the 2012 website hack.

Lostutter told The Associated Press in a June 2013 interview that he posted the video on an independent website run by a booster of Steubenville High School athletics, but he said he didn’t hack into the site or any computers.

He said someone else, whom he wouldn’t identify at the time, hacked into the website.

The 12-minute Internet video posted on the high school’s fan website showed a former student joking about the attack and the victim.

In the 2013 interview with the Herald-Star, McHugh said his involvement came by way of a conversation with KYAnonymous.

“KY approached me,” McHugh said. “I’ve only used the ‘BatCat’ name for this one hack. I planned from the beginning to delete ‘JustBatCat’ (Twitter name) after it was done.”

McHugh added that getting in and taking control of the RollRedRoll.com website “took about 15 minutes.”

It was not a hack that involved cracking deep into code but relied on a combination of good luck and poor security measures. “I was able to get into his Comcast account by answering his ‘forgot your password’ (security) question correctly. His (the site owner’s security) answer was ‘Big Red,’ McHugh said in the 2013 interview. “I then just used that to get into the web hosting (account).”

A file reportedly containing the personal e-mails of the site owner and webmaster was released by the group. Also, KnightSec threatened to release Social Security numbers, addresses, phone numbers and personal information about those it claimed were involved in the rape case.

The website was compromised a second time, days after the initial takeover, but was quickly secured and has remained secure since.

When asked in 2013 if he thought legal action would be taken against him, McHugh said, “I don’t think so,” and noted it was not a government site that was compromised.

McHugh is expected to be sentenced in December.

Lostutter, who faces three counts of unauthorized access of a computer affecting interstate communication, in violation of Ohio, Kentucky and federal laws, to commit an invasion of privacy and libel and one count of making a false statement to the FBI, is expected to be arraigned later this month.

(The Associated Press contributed to this report.)

COMMENTS