Crime

INTERNET VIGILANTE

He helped put pedophiles away by hacking into their computers. Was that wrong?

CORI HOWARD June 6 2005
Crime

INTERNET VIGILANTE

He helped put pedophiles away by hacking into their computers. Was that wrong?

CORI HOWARD June 6 2005

INTERNET VIGILANTE

Crime

CORI HOWARD

He helped put pedophiles away by hacking into their computers. Was that wrong?

HE WAS A SELF-DESCRIBED computer geek, young and reclusive. But his online persona was anything but. Between 1997 and 2001, Brad Willman was known as Omni-Potent, an Internet vigilante who would track pedophiles by spending 16-plus hours a day hacking into people’s computers from his parent’s house in Langley, a suburban community just outside Vancouver. Ultimately, he was responsible for the arrests of about 40 pedophiles across Canada and the U.S. Willman’s successful, albeit unpaid and short-lived venture as “Citizen Tipster,” as he was known by police, is now over. But his activities have sparked

intense debate over the legality of his tactics.

Much of that stems from one high-profile U.S. case. In 2001, police arrested Judge Ronald Kline, a Superior Court judge in Orange County, Calif., and charged him with possessing child pornography on computers at home and in his courtroom. Many, if not all, of those images were found thanks to Willman’s hacking. After a seesaw legal battle hinging on the admissibility of Willman’s evidence, Kline has pleaded innocent to those charges and to subsequent charges of child molestation, and is set to appear in court this fall. Meanwhile, Willman has had his cloak of anonymity lifted. He says several pedophile groups around the world want him dead. More ominously, thanks to an RCMP order to stop hacking and the seizure of his hard drive for the Kline case, he can no longer access information he had collected on people who, he says, are “a thousand times worse than Kline.”

THE EVIDENCE against Judge Kline and others was uncovered using a program Willman developed, a kind of Trojan Horse. It let him seize control of about 3,000 computers around the world when users downloaded a picture, in reality a virus, that he had posted on well-travelled child porn sites. It allowed him to record everything the users did, from sending email to posting pictures. Many of his targets were ordinary people, but the list also featured military and police officers, Boy Scout leaders, priests and child care workers.

For the legal system, the Kline case posed a challenge. Initially, the Federal Court threw

out the evidence against the judge, saying it had been seized in the course of an illegal search by Willman. In that June 2003 ruling, U.S. District Judge Consuelo Marshall said that Willman was working as a police informant when he hacked into Kline’s computer and that, as a result, he needed a search warrant. But in October 2004, an appeals court overturned that decision, saying no search warrant was necessary because Will-

‘I WASN’T stealing

Visa info, which I could have done,’ Willman says. ‘I was finding out if they were harming kids.’

man was an anonymous tipster. In March of this year, the Supreme Court declined to hear the case, and Kline is now scheduled for trial this November.

Some, however, think Willman himself should be punished. “The way the information was collected is not appropriate,” says Hasan Cavusoglu, an assistant professor at the University of British Columbia’s Sauder School of Business. “It may challenge the foundation of many institutions we all rely on if everybody starts to do what they deem to be right. We should all abide by the laws.” According to Cavusoglu, it simply is not appropriate for regular citizens to assume the responsibility of going after criminals. And he believes that the ramifications of courts accepting the kind of evidence Willman provided are quite se-

rious. “This will create precedents,” he predicts, “for other prosecutors to attempt to use evidence obtained by illegal means in other trials.”

It all comes down to the fact that hacking, for whatever purpose, is against the law, Cavusoglu says. “Finding some positives in hacking, catching a criminal for instance, will not really change the fact that it is illegal. Those guys are costing millions of dollars to firms, governments and ordinary people by stealing their confidential and personal information. Therefore, they should be treated like criminals. It may seem extreme, but I believe that [Willman] has broken the law. He should be punished for this—even if his findings might have allowed the police to stop a pedophile.”

Willman, 25, actually has sympathy for this point of view. “I knew what I was doing was illegal,” he says. “I think it should be illegal, the idea of monitoring someone.” But, he notes, there should be different levels of legality. “I wasn’t stealing Visa info, which I could have done. I was finding out if they were harming kids.”

WILLMAN’S QUEST to find and punish pedophiles began by accident, when he was 17 and an online acquaintance offered him sex with his daughter. “At first, I was like, well, maybe,” he recalls. “But then I found out she was 6, and that really freaked me out.” He tried to cut off contact but he kept receiving naked pictures and descriptions of what he should do with the girl. Ultimately, Willman passed on the information to the Langley RCMP; police subsequently arrested an Edmonton man, who confessed on the spot.

Willman felt good about having helped a child, and so the idea for his Trojan Horse program began to develop. It became much like a full-time job, even though Willman was in high school or being home schooled during that period. If someone was simply downloading child porn, he would monitor them. But if they were actually posting photos, he considered that a higher priority. He would verify where suspects were from, and send the information on to Predator-Hunter, an online pedophile watchdog group that would, in turn, send it to other sources to be veri-

fied before passing it on to police. “Parents in a number of countries, I think, owe Omnipotent a debt of gratitude for what he did,” says Wendell Krueth, president of Preda-

tor-Hunter. The end justifying the means is a concept Predator-Hunter supports. “We don’t tell people to go hack, but we consider whatever information we get worthy in taking down pedophiles,” Krueth says.

Under U.S. and Canadian law, there’s no question Willman was, technically, acting illegally. But according to Richard Owens, one of Canada’s leading lawyers in the computer field and executive director of the Centre for Innovation Law and Policy at the University of Toronto, that doesn’t make the information he gathered any less forceful. “We allow private citizens to make arrests in the real world,” he says, “or to contribute evidence or provide tips. This is not that different. We may need to set certain limits, but for the moment it’s unrestricted and the risks, in this case, are balanced by the benefits of prosecuting a potential child predator.”

Willman, meanwhile, continues to live with his parents as he tries to find a career in the computer field. In spite of the legal questions surrounding what he did, he’s angry at having been forced to stop doing something that was engrossing and useful. “Being made to sign something that says I will never do it again ticks me off because the police aren’t doing the job,” he says. “I was doing it better than they could. I knew it was illegal, but I didn’t care about taking the risk. Kids were being hurt—and I didn’t want to see that happen.”