Toledo man charged in hacking ring

John A. Borell III is accused of hacking into law-enforcement Web sites in Utah.

A 21-year-old Toledo man connected with the notorious hacker group Anonymous attacked the Web sites of two law-enforcement organizations in Utah, then bragged about it to reporters and followers on Twitter, according to a federal indictment unsealed on Monday.

John A. Borell III is charged with two counts of computer intrusion. Authorities say he hacked the Web sites of the Utah Chiefs of Police Association and the Salt Lake City Police Department. The hack exposed confidential narcotic tips and police officer account information, such as user names and hashed passwords, according to an FBI complaint.

Prosecutors say Mr. Borell intruded on the chiefs' Web site server on Jan. 19 and broke into the police department's Web site on Jan. 31. The two organizations spent an estimated $188,000 to mitigate the attacks, the complaint states.

Mr. Borell pleaded not guilty during an arraignment Monday in Salt Lake City federal court. His public defender, Jamie Zenger, declined to comment.

Mr. Borell is the son of John Borell, Jr., a lawyer at Marshall & Melhorn of Toledo, and the grandson of John Borell, Sr., an assistant Lucas County prosecutor. His father, who accompanied him to Utah for Monday's court appearance, did not return a phone call. His grandfather declined to comment. A Northview High School graduate, Mr. Borell worked at Affinity Information Management, a document disposal and computer recycling company in West Toledo.

Chuck Small, a vice president at the company, said Mr. Borell's primary responsibility was to test computers to see if they worked. He also did some network administration and server maintenance, Mr. Small said.

"He was a very good kid," Mr. Small said. "He worked hard and he showed up on time. I think he's in way over his head and got mixed up with the wrong people."

But according to an FBI affidavit, Mr. Borell knew exactly what he was doing.

Using the Twitter account @ItsKahuna, FBI agents say Mr. Borell took credit for the attacks.

In one Tweet, he allegedly said, "SLCPD. Shut Down The Website, But Its Too Late For Damage Control. I Have Your Crime Tip Police Reports. Will Keep Them Safe For You."

In another Twitter conversation, he allegedly wrote, "heh, I actually do networking administration an server maintenance for a living, so I fix them during the day and destroy them at night :P"

At one point, apparently while doing IT work at a church, he talks about the prospect of getting caught for another hack which he claims credit, according to the complaint: "I talked to my lawyer, the benefit of having a father as an attorney is i have connections...he will be representing me...He said when the FBI shows up dont tell them anything and give them his card and tell them if they need to talk they should go through him."

In February, after prosecutors say he hacked the Utah law enforcement Web sites, he allegedly said in a Twitter conversation, "haha they wont ever find me, im too awesome :)...Trust me, I wouldn't have gotten away with as much as I have if I wasnt careful enough to make sure I dont get caught...Im like the gingerbread man, no one can catch me :P"

The FBI arrested him in Toledo on March 16, but the indictment has been kept under seal until Monday. Mr. Borell has been staying in a Toledo halfway house since his arrest. Each of the two counts in the indictment carries up to 10 years in prison and a $250,000 fine.

The case against Mr. Borell is a result of several electronic search warrants and surveillance of Mr. Borell's physical address. The complaint suggests that Mr. Borell may have been motivated by a Utah state senator's decision to introduce a bill that would have made possession of graffiti tools, such as spray paint cans and markers, a misdemeanor.

In correspondences with reporters in Utah, Mr. Borell, through his @ItsKahuna account, said he opposed the legislation because it was based on intent to commit a crime, according to the FBI affidavit.

The FBI said Mr. Borell was part of a hacker group called CabinCr3ew, which is one of many groups and individuals that make up the loose network of hacker activists called Anonymous. The FBI began its investigation after receiving two tips in August, 2011 -- supposedly from Mr. Borell himself -- stating that Mr. Borell had knowledge of Anonymous's inner workings and had trusted relationships with many of the members with knowledge of the group, the FBI affidavit said.

Mr. Borell suffered a traumatic childhood.

His mother, Kellyanne Borell, was accused of killing her infant daughter in 1995. Two of her other children had also died before their first birthdays. The case was expected to attract national attention because Ms. Borell was accused of inducing symptoms in her children through a rare pattern of child abuse called Munchausen syndrome by proxy, a pattern in which a person makes his or her children sick to gain sympathy for him or herself.

The case never went to trial. In 1996, Ms. Borell took her own life, leaving behind her ex-husband and two living children, one of whom was 5-year-old John A. Borell III.

Mr. Borell later earned recognition as student of the month in middle school. At that time he said he wanted to attend the Massachusetts Institute of Technology. As a Northview High School student, he was active in the Rocketeer Club. He did not attend college before going to work for Affinity Information Management.

The attacks in January on the Utah servers came around the same time a spate of Internet attacks attributed to Anonymous occurred around the country, in Boston, Syracuse, New York, and overseas in Greece.

Saboteurs stole passwords and sensitive information on tipsters while hacking into the Web sites of several law enforcement agencies, police have said.

Anonymous has targeted financial institutions such as Visa and MasterCard, the Church of Scientology, and law enforcement agencies.

After a spate of arrests around the world, the group and its various offshoots have focused their attention on law enforcement agencies in general and the FBI, in particular.

At the time in February, Anonymous also published a recording on the Internet of a phone call between the FBI and Scotland Yard, gloating in a Twitter message that "the FBI might be curious how we're able to continuously read their internal comms for some time now."

In Greece, the Justice Ministry took down its site in February after a video by activists claiming to be Greek and Cypriot members of Anonymous was displayed for at least two hours.

In Boston, a message posted on the police Web site before it was taken down said, "Anonymous hacks Boston Police website in retaliation for police brutality at OWS," an apparent reference to the Occupy Wall Street movement. The message also promised "there is plenty more mayhem to deliver."

Cyber crime is an increasingly important focus for the U.S. Department of Justice, said David Bauer, the assistant U.S. Attorney in charge of the Toledo office.

"Computer intrusions are a top priority," he said. "It's particularly important when it involves a government or law enforcement agency."

Information from The Blade's news services was used in this report.

Contact Tony Cook at: tcook@theblade.com, or 419-724-6065.