Hundreds of Lee Gibling's ICQ Logs Leaked

Following on from the earlier release of Lee Giblings ICQ logs from the time he was working for Mindport and NDS I've now received the complete selection of ICQ logs from that period, taken from his hard drive. 

You can download the new ICQ logs here

Due to the way in which the files were stored in the ICQ folder on the hard drive they've been split into three seperate folders, so in many cases you have 3 copies of a slightly differing ICQ log for each person, so it's worth comparing all the logs for differences.

As identified in the earlier posts the following ICQ numbers belong to the following people:

Avigail Gutman of NDS - 4291479
Martin Gallagher of AIM - 9552119, 50640200, 56660445, 56660605, 63376893, 76873942
Barry Watters of AIM - 26354832
Len Withall of NDS - 61770995

It would be interesting to see if the times Lee Gibling was asked to do something by Ray Adams or Martin Gallagher corresponds with his activities with THOIC members.  Ray Adams emails were partly published by AFR, and all 14k can be found here.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Lee Gibling - Ray Adams Used THOIC to Strongarm Cable Companies Into Giving Up Their Operational Security

Following on from his earlier posts on THOIC and NDS Lee Gibling popped up on Something Awful and said the following:

Well at some point of time it is bound to surface so i would rather give the facts up right now.

if you recall, i posed a question to Brown Moses, somewhat tongue in cheek, "Why would Operational Security aka NDS UK require the resources of a top team of investigators and Agents plus many paid informants when their media they were solely charged with protecting was to be blunt as safe as the Bank of England in terms of piracy".

More salient was where this budget to fund the Mad Hatters Tea Party was going to come from in lieu of Israel controlling the purse strings.

With no activity on a day-to-day basis for the operational team sitting in Maidenhead cutbacks at every corner were looking likely ultimately misplacing the talent Ray in his team had built up over the course of his tenure as head of Operational Security.

Never to be outdone, Ray came up with a magical plan.

The cable companies with their Sky TV lineup were in respect of set-box security running autonomous outside of NDS operational security. NDS UK were protecting card piracy - cable boxes used no card.

Selective hacks and pirates for cable boxes were to be cultured and made available on THOiC and the resulting impact was then delivered by a series of visits to the Cable bosses.

Ultimately Ray won his battle to retain the use of UK Operational Security personnel to take over the battle against what was presented as "blanket piracy" in their industry. I know the words used in the meetings with the Cable bosses as Ray had me write the study paper on his behalf.

Before long, the department had secured full time jobs for both Len Withall and Chris Le Maitre, both whom enjoyed the spoils of "rounding up" the same pirates that had been lured to share their spoils via THOiC.

The budget secured!

Did Israel know - I do not think so but Ray had bosses so go figure.

 You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Lee Gibling Answers Some Questions About THOIC and NDS

Recently Lee Gibling has been in contact with me, and offered to fill in some of the gaps in the earlier investigation of his ICQ logs and Ray Adams' emails.  As I posted earlier, they showed that Lee Gibling worked for a company called AIM who were working on behalf of NDS competitor MindPort/Irdeto at the same time as he was working for NDS on the THOIC website project, and Lee offered to filled in some of the details that were missed.  First he talked about the Panorama programme Murdoch's TV Pirates:

Panorama touched on very little; air time is expensive and litigation from unsubstantiated talk can be dangeous.

I placed a lot of trust in Panorama and this was not displaced. All they went with was 100% but yes, a lot of questions remain unanswered.

Some people say that this is a decade old and it is old hat but if you think the mobile hacking is big business then be prepared to see the hat blown off of News Corp

On Digital was only the one company featured in Panorama that through NDS design I brought to their knees, but under their instruction and that includes on-digital we took on anything we wanted which included the whole UK cable industry.

Many thousands of jobs were lost indirectly as a result of actions made from NDS UK what was called Operational Security at Ray Adams headquarters in Maidenhead and it needs to be brought to account.

My respects go to Milly Dowler family.

He added there was much more filmed for the Panorama programme

The Panorama interview was a single "take" with Vivian. Yes, they condensed the programme to 30 minutes but the interview at one location went well over 2-1/2 hours and covered much that the Producers did not have time to consider as part of the programme. Will there be a Part II aired?  Maybe.

 Then he went on to provide more information about the AIM/MindPort/Irdeto situation:

To set some records straight - afterall many of you have invested much energy into piecing the jigsaw together, Andy Coulthurst is NOT a hacker but a full employee/technician at NDS UK. The other AC that is mentioned in email/ICQ is Andrew Curle who was at the time head of operations at Mindport/Irdeto.

I can also reveal as this is in the public domain albeit not surfaced (surprisingly) that Barry Watters was employed by Sky as a consultant and enjoyed office space at Sky.

Yes, he was seconded to Mindport on a very lucrative retainer, however, I do not believe that Sky knew this. Martin Gallagher of course knew I worked for Ray Adams, as did Barry Watters. I did communicate directly with Andrew Curle and was retained by AIM all of which was known and engineered by Ray Adams. Did NDS Israel (the top chain) know of this arrangement?  Of course they did. It's important to outline that NDS UK operational security had their budget contributions from Sky and Israel plus contributions were made to it by Ray Adam's opposite number in the Pacific Region and Asia which would be Avigail Gutman. Hence the reporting line involved many people although ultimately the buck and call was with Reuven Hasak in Israel. 

And explained how he came into contact with Ray Adams in the first place

Contact was made with Ray Adams via an Agent (employee) meeting at my home in Essex at the time. Thereafter, the same week i was introduced to Ray Adams at his offices in Maidenhead. Bit like visiting Father Christmas at Harrods .

He also gave more information on the subscriptions for THOIC that were discussed in the emails

There was NEVER any monies taken on THOiC - that would have detracted from the whole BDS ethos of using the community as a medium to either attract talented members and/or a complete audience when used to farm out information or media.

Yes, a handful of closed areas where in operation all of which were under control and instruction by NDS personnel who used pseudonyms during their online time on the forum. 

 He went on to pose this question

Why would such a significant operational security department (at great cost) be needed for the UK/Europe regions when the Sky [digital] card itself was not at risk of being compromised?

He also explained the situation with new accusations:

While I was in the UK last week or so I was introduced to Ian Gallagher of the Mail on Sunday. The introduction was made via Max Clifford. We were all set to reveal so much (far more than the Panorama programme), information that I believe will set the record straight once and for all.

The content would have been explosive however, the Mail on Sunday decided they could not follow through. I am not sure ANY newspaper under the current regime would have the balls to print. 

He also mentioned Hairymonster/FR15K

I do know that after all this time, (and I do not take kindly to blanket dismissals from Israel), that Hairy Monster holds some important collaborational evidence that between us working together can deliver a rock solid testimonial to the Leveson Enquiry.

At this present time, my solicitor (Mark Lewis) has not been contacted in respect of tribunal requests. 

 You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Leaked ICQ Logs - Summary of What We've Learnt

Following on from the leak of Lee Gibling's ICQ logs where we discovered Lee Gibling worked for MindPort/Irdeto contractor AIM at the same time he was running THOIC for NDS Something Awful forum members Shageletic and Munin have put together an summary of what has been learnt from the leaked logs:

Lee is a good friend of Martin Gallagher, cerainly around the year 2000. The log is full of banter and they seem to have a good overview of the activities they are both involved in across NDS, AIM, Irdeto and Mindport. Lee knows that if NDS found out how closely he worked with AIM he might get into trouble.

Lee has a close working relationship with NDS. He was offered a place on the payroll, along with upgrades to servers and direct cash payments.  One of the logs mentions how he was offered the use of Ray Adam's holiday home for him and his family. He also was directly paid and employed by Barry Watters for most of the period of the logs until he started having increasing issues getting Barry Watters to pay him. He didn't have direct contact with Irdeto/Mindport. All contact seems to have been via Martin and neither wanted Mindport to know of Lee's involvement with THOIC.

Martin was employed by Barry Watters but seemed to spend most of his time interacting with Mindspring. He also was familiar with Adams and NDS but didn't seem to do any jobs for them.

Lee's main job for Barry Watters and Martin seems to have been acting as an IT consultant and general finder of information. This involved flagging up new hacker sites, monitoring the progress of various hacker groups towards a hack and providing samples of hacks and tools, with Lee occasionally purchasing them and being reimbursed by AIM.  Barry and Martin seemed to keep their client ignorant of the exact way they obtained them. They also sought to recruit other hackers

Lee's main job for NDS seemed to be doing odd programming and webmaster jobs and maintaining THOIC. He doesn't discuss many of the particulars of his NDS work with Martin. NDS helped set THOIC for Lee, which benefited from Lee's hacker knowledge, along with aggresively acting against other hacker websites.

Martin's main job seems to be as an information channel for Barry Watters and Mindspring. He traveled to meet hackers and informants. He was also (not very competently) setting up a mirror of major hacker sites on a isolated server for MindPort, with MindPort planning to use it as part of a service is wished to offer it's clients. Presumably this was to help them monitor activity on these sites and to have a local copy of any valuable intel should these vanish or get taken down.

Irdeto/Mindspring seemed to be keen on getting sites taken down. Koos and Kuster seemed to be the internal Irdeto/Mindspring security guys who were involved in that. They were both unpopular with Lee and Martin (and NDS, see the Bonds related e-mails) as they were seen as stirring up the nest and threatening valuable informants. In general, in all the logs Lee and Mertin show no desire to see most of the sites shuttered, they are more interested in observing and exploiting them.

As far as illegality is concernd then THOIC is definitely illegal and the logs show how everyone knew Lee well and that essentially everyone knew his involvement with THOIC. One thing to note is that Lee was saying that "the bosses" were monitoring his webmaster@thoic e-mail address. Something rather difficult to do if they didn't have direct control of the operation.

Nothing blatantly illegal has come up in the logs. That said both Lee and Martin were routinely dealing with criminals and buying their goods. They knew the full identities of many major players and essentially did nothing to curtail their activities. All of this, including the blattantly illegal THOIC, was all done with full knowledge of their respective superiors.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

The Leaked ICQ Logs - Lee Gibling Worked For More Than Just NDS

Yesterday I posted that a number of ICQ logs belonging to Lee Gibling had been leaked, and myself and others have spent some time working through the logs, looking for interesting information.

A number of the logs appear to belong to Martin Gallagher, who has a rather interesting CV:

Global Operations Manager Alternative Investigation Management Ltd (AIM) Public Company; 5001-10,000 employees; IVZ; Investment Management industry

1997 – 2004 (7 years) London, United Kingdom

I was responsible for all security projects including executive protection of CEOs and executives of well known multinational corportations, security reviews and risk assessments for large multinational media, hardware, software, and manufacturing & logistics companies.

Other areas of my operation and responsibility within the company were:

Surveillance, (Medical, Fraud & Piracy).
Test purchasing, for famous brands in the clothing, media and IT hardware and software industries
Undercover assignments, within logistics companies where high value thefts were prevalent.
Computer Forensics operations for individual clients and Blue Chip Hardware and Media companies.

Internet research, I was responsible for providing intensive internet research on hackers and piracy organisations , often infiltrating these criminal fraternities in order to provide law enforcement agencies and legal entities with criminals' personal details and evidence to support successful arrests and prosecutions.

It appears the following ICQ logs belong to him
56660605 21.12.1999 - 25.09.2000 Martin Gallagher

9552119 06.04.1999 - 05.09.1999 Martin Gallagher
56660445 08.05.2000 - 08.05.2000 SATNET/Ken Frazer
50640200 03.12.1999 - 15.01.2000 Ken Frazer
76873943 12.06.2000 - 03.11.2000 JanJo/Jannette Hess
63376893 05.02.2000 - 18.08.2000 Go4/Gopher Khan

He rather helpfully says this in his SATNET ICQ Log

56660445 (21.12.1999 15:44:31) MARTIN : SATNETºKenºFrazerºº0
56660445 (08.05.2000 18:41:11) MARTIN : yeah, i got several icq addresses
56660445 (08.05.2000 18:41:25) LEE : he he
56660445 (08.05.2000 18:41:58) MARTIN : you still got protium icq?
56660445 (08.05.2000 18:42:20) LEE : nah
56660445 (08.05.2000 18:42:48) LEE : i have also 56660605
56660445 (08.05.2000 18:43:25) MARTIN : that's me official one
56660445 (08.05.2000 18:44:08) LEE : ah - so this is yer dodgy one
56660445 (08.05.2000 18:45:19) MARTIN : satnet
Go4
Protium
those 3 r dodgy
56660445 (08.05.2000 18:46:49) LEE : i wondered who the fuck go4 was :-))
56660445 (08.05.2000 18:47:36) MARTIN : i am hoping that you is a nices peoples and can sends me somthings likes softwares
56660445 (08.05.2000 19:27:34) LEE : yes - we can send you any softwares you want - pls just ask Mr Satpratt

Along with references to his real name and contact details in the other ICQ logs it seems to confirm the accounts belong to him.

Martin Gallagher works for Barry Watters, the founder of Alternative Investigation Management Limited

Barry retired from the Metropolitan Police in 1995 after 31 years of distinguished service where he served as a front line detective at Scotland Yard. During his service he was engaged in a number of high profile departments including the Flying Squad, Regional Crime Squad and Specialist Operations. Whilst serving in these postings he was responsible for determining strategy in combating national and international crime organisations and was deployed on a number of occasions outside the United Kingdom.

He was also responsible for training operatives in Specialist Operations and on leaving the service in 1995 was engaged by Her Majesty’s Foreign and Commonwealth office to provide training specialist through the British Governments ‘Know How’ program to European countries seeking admission to the European Union.

On leaving the police service Barry founded Alternative Investigation Management Limited, a specialist security consultancy providing services to government, major ‘blue chip’ corporations and police services globally on risk assessment, crisis management, kidnap and ransom training, investigations and security training.

Lee Gibling and Martin Gallagher often discussed Barry Watters, especially in relation to Watters sending cheques to Gibling:
From ICQ log 63376893

63376893 (21.07.2000 20:10:00) MARTIN : Hi m8, Thanks for the mail re the free cam patch but I dont follow the story.

Baz said the cheque is in the post. hahaha!

Anyway, I have to do my end of month report now is there anything from you that I should put in?

From ICQ log 76873943

76873943 (31.10.2000 18:08:21) LEE : and wtf is bw?
76873943 (31.10.2000 18:08:39) LEE : i am officially on strike from today
76873943 (31.10.2000 18:08:41) MARTIN : barry watters?
76873943 (31.10.2000 18:08:51) LEE : yes
76873943 (31.10.2000 18:09:12) MARTIN : i am waiting 4 mine 2
76873943 (31.10.2000 18:09:27) MARTIN : go on strike m8!
76873943 (31.10.2000 18:09:59) MARTIN : no more stuff till i get paid :-)
76873943 (31.10.2000 18:10:05) LEE : wad da we wan,,,,, MONEY
wen da we wan it,,,, NOW
76873943 (31.10.2000 18:10:30) LEE : tell em m8! go4it

From ICQ log 56660605

56660605 (12.01.2000 22:13:08) LEE : still no bloody cheque from barry
56660605 (12.01.2000 22:13:40) MARTIN : all and any!!!!!!!!!!!
I gotta cover the globe so i have created country directories
56660605 (12.01.2000 22:13:55) LEE : that's a mean old task eh
56660605 (12.01.2000 22:14:06) MARTIN : I will chase baz up re the cheque
56660605 (12.01.2000 22:15:57) LEE : thanks

56660605 (14.01.2000 17:52:15) LEE : still no cheque with todays post - it doesn't take a whole week to send even 2nd class
56660605 (14.01.2000 17:53:57) MARTIN : I didnt get to speak with him yesterday. I would send an email in red!
56660605 (14.01.2000 17:54:27) LEE : no - i am officially on strike
56660605 (14.01.2000 17:55:46) MARTIN : ROFL :-D

56660605 (17.01.2000 15:51:50) LEE : still no damn cheque - btw i saw BW yesterday

56660605 (17.01.2000 17:55:27) LEE : cheque has turned up - it was only posted on 16th
56660605 (17.01.2000 17:55:49) MARTIN : he's a bad bugger!!!!!!
56660605 (17.01.2000 17:56:07) LEE : that is a bit naughty -
56660605 (17.01.2000 17:56:49) MARTIN : I'll say,,, Perhaps the girls forgot to post it heh heh heh
56660605 (17.01.2000 17:57:14) LEE : it is in BW's writing and had a first class stamp!
56660605 (17.01.2000 17:57:52) MARTIN : HE'S A REALLY BAD BUGGER!!!!
56660605 (17.01.2000 17:58:38) LEE : yep - i won't pay for any other software now until i have the money direct credited into my account - it's not fair having to wait 3 weeks for it
56660605 (17.01.2000 17:59:29) MARTIN : I agree! Perhaps he thinks your'e made of money!

From ICQ log 50640200

50640200 (29.12.1999 16:45:14) LEE : yes! i had to chaps the money on christmas eve!

750.00
75.00 (lee)
15.00 (chaps)

total: 840.00 - i would appreciate the money asap - i'm still out of pocket from the last lot - barry's cheque didn't turn up until friday! and won't clear now until the 4th of bloody january
50640200 (29.12.1999 16:45:38) MARTIN : k - i has been well busy!! yesterday was very very

So that appears to show that Lee Gibling was receiving money from AIM over a period of months, if not years, and in some cases Barry Watters, the founder of AIM, personally signed his cheques.

It appears AIM was working on behalf of Mindport, a division of Irdeto, and Lee Gibling was keeping NDS informed of their plans

From: THOiC Online© [mailto:webmaster@thoic.com]
Sent: Saturday, December 11, 1999 1:54 PM
To: radams@ndsuk.com; agutman@ndc.co.il
Subject: damn and blast!

Avigail

I have been in communication by telephone this morning with Martin
Gallagher who works for Barry Watters. The general chit chat moved to
Dave Cottle, and Martin was excited to tell me that he will be getting
a suprise very soon.

I enquired exactly what he mean't by that and he said that he was
going to be busted - he did not say whether it was he and Barry who
would be involved directly in the bust or whether it would be joint or
just Mindport.

He gleefully explained that MINDPORT had all the email from DC to
others including MM - I enquired what email he was talking about and
he said that they have an intercept running on his mailboxes.

This is crap - Mindport BW and MGallagher couldn't complete a Rubik's
Cube let alone get a hack working on several mailboxes.

I suggest the truth is they are either relying on the quantity of copy
email exchanged between Bond and MM which was furnished through me
or/and the content of Rolf's HDD.

Either way, I am concerned that they (Mindport & BW- AIM) are again
going off at a tangent looking for kudos. I think it would be a
serious judgement of error for them to attack Bond at this stage.

1. There is the GESA development which we have on the boil.

2. It would finish the Forum for GOOD. A forum that has and will
continue to produce excellent information.

3. What exactly will they get on Bond if they rely on the older
emails? a test case in australia - incitement to hack?? wow!

I've copied this to RA - you will no doubt be speaking to him on this
and I would be pleased if you can tell me that all the work we have
done will not be ruined by this complete bunch of amateurs.

Lee'

Now it's apparent that NDS and AIM had contact with each other, as this email shows:

'From: Bary Watters
To: Adams, Ray
Date: 11/17/1999 5:23:54 AM
Subject: eurosky

Hi ray the following forwarded for your info, found by martin:-

Do You live in Europe? Want to have Sky Digital in your home? Well now
you can. Here at Euro sky, we can supply one of two options to fulfill
your needs. Simple click on the option you prefer below:'

But it seems that Lee Gibling may not have been too keen on letting NDS know how much contact he was having with Martin Gallagher

63376893 (17.07.2000 20:16:17) MARTIN : u okm8?
63376893 (17.07.2000 20:17:04) LEE : yes - glad i got you
don't send any mail to lee@thoic.com or webmaster
send any mail to me at snakesurf69@hotmail.com
63376893 (17.07.2000 20:17:36) MARTIN : whats happend?
63376893 (17.07.2000 20:18:15) LEE : just that my mail is being monitored by the bosses
63376893 (17.07.2000 20:18:43) MARTIN : no probs m8. theybin moanin?
63376893 (17.07.2000 20:19:04) LEE : not really - just makin sure there's nothing to moan about
63376893 (17.07.2000 20:19:48) MARTIN LEE : k i will delete all refs to webmaster @ thoic and shall always use the new one,,,,,,,, ok?
63376893 (17.07.2000 20:20:07) LEE : i think that's best for now m8
63376893 (17.07.2000 20:20:19) MARTIN : k

Assuming that by "bosses" Lee means NDS it seems that he didn't want them to see what Martin was sending him.

Now, Martin and Lee seemed to have a very friendly relationship, with Lee apparently providing Martin with plenty of information about THOIC, including letting Martin know when THOIC users who were Mindport plants were accidently letting the webmasters know they were from Mindport.

56660605 (13.02.2000 16:14:17) LEE : MP are total wankers - there are a few people that know their ID's now in the forums
56660605 (13.02.2000 16:14:36) LEE : he he - i couldn;t sleep last night and was up till 4 am
56660605 (13.02.2000 16:14:50) MARTIN : who's bin in there?
56660605 (13.02.2000 16:17:44) LEE : quite a few actually - and silly silly boys think they are safe using a 3rd party email or ISP - but the wankers have been using the 'UBB a Friend' option to send some threads to people and the forwarding addresses they have input as so and so form mindport.com - they never learn - these forwarded messages are read by Bond - the messages are system generated when someone forwards on a message from the forums and it tells everything - bond gets copies as do I - so we can see who is forwarding threads out of the forums! it's common practise and IMO pretty lame
56660605 (13.02.2000 16:18:48) MARTIN : can u get me the details, ie alias used etc? I'll fkin sort em!!!
56660605 (13.02.2000 16:19:27) LEE : yeah - Mindport Australia - they also identify a plant in the forums - how amateur eh!
56660605 (13.02.2000 16:19:47) MARTIN : bond 007 he's one of ours, (i mean yours?)
56660605 (13.02.2000 16:20:07) MARTIN : had to be them eh?

Martin also wasn't shy about asking Lee to perform less than legal tasks

9552119 (13.07.1999 20:49:19) MARTIN : Lee, could you access hotel computers? ie bookings and reservations?
9552119 (13.07.1999 20:49:45) LEE : it's possible - depends on their security
9552119 (13.07.1999 20:50:15) MARTIN : you would have to do it through an annonymous ip eh?
9552119 (13.07.1999 20:50:25) LEE : that's easy enough
9552119 (13.07.1999 20:52:37) MARTIN : well I need to know if two people are checked in or about to checkin at
1. The Westbury Hotel (London)
2. The Hyde Park Hotel Ditto
3. Clariges London
Names: A Kashoggi
and Mr A K Pukar (Could be pookar) Spelling unsure
9552119 (13.07.1999 20:53:05) LEE : you didn't say 3!!!
that'll be 1k each
9552119 (13.07.1999 20:53:46) MARTIN : 1 kiss each okay but only if its Vicky I'm kissing! Ha
9552119 (13.07.1999 20:54:46) MARTIN : I have to phone the hotels but i thought it might be possible to check via their back orifice
9552119 (13.07.1999 20:57:48) LEE : it wouldn't be that quick to gain access - i'd first have to get their network ip address, bust their firewall (if poss dependent on the s/w) then if i got that lucky i'dhave to find the s/w prog and logon for their reservation system! they'd probably have been and left by the time i got in:-))
9552119 (13.07.1999 20:58:15) MARTIN : har har he he ho hum!
9552119 (13.07.1999 20:58:28) MARTIN : I'll stick to the phones

There's no evidence to say Lee went ahead and did the hack, but it does demonstrate how close the relationship was between Martin Gallagher and Lee Gibling at a time Lee Gibling was also apparently working for NDS.

There's still plenty more to read in the leaked ICQ logs, so hopefully tomorrow I'll have another post with even more new information.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Lee Gibling's ICQ Logs Hacked

In the last few hours I've become aware of a number of ICQ logs being posted online which appear to be conversations between Lee Gibling, the hacker at the heart of the recent NDS hacking scandal and individuals who worked with or for NDS, plus other individuals.  The list includes:
Barry Watters of AIM
Martin Gallagher over multiple identities including Ken Frazer/Khan Ghoper covering the period he worked for NDS, Irdeto, and Mindport.
Len Withall - Former senior Surrey Police officer and NDS head of Operation Security
Avigail Gutman - NDS head of security issues in Asia and Australia

There's a number of interesting aspects to the NDS-Lee Gibling story, something these ICQ logs might shed light on, for example asking why Lee Gibling appears to be talking to Martin Altham at a time he was working for Irdeto, when Avigail Gutman has been accused of using David Cottle to hack Irdeto.

While it's hard to know if these are genuine I've tried to compare the logs against the leaked emails of Ray Adams, and found examples of what was discussed coming up in the emails.  For example, from Avigail Gutman's ICQ log:

4291479 (17.03.2000 06:47:22) : btw - if I right-click your name on icq and choose "info" I get your local ip 62.6.144.179...

do you get one on me? we should cancel that option.... no?

4291479 (17.03.2000 06:47:31) : i have been onto dn all night

4291479 (17.03.2000 06:47:50) : which girl....?

4291479 (17.03.2000 06:48:07) : i am on a fixed ip so it doesn't matter to me - anyone can find me on the net

4291479 (17.03.2000 06:48:14) : aha...

The above IP address turns up in a number of Ray Adams' emails, including this one

Received: from THOIC-9PV5TQ8MK [62.6.144.179] by thoic.com
(SMTPD32-5.05) id A51AB905021C; Wed, 24 Nov 1999 13:16:10 +0000

So, if you want to look through the ICQ logs you can download them here, although do be aware they may only open in Firefox. 

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

All 14659 Ray Adams emails Leaked Online

While digging through various forums I've come across this post on the Digital Spy forums which links to a zip file of what appears to be 14659 emails from Ray Adams' computer, much more than have already been published by Austlian Financial Review.

They've been split into 4 folders, Inbox, Sent, To Ok and Deleted, and appear to represent the emails covering 1997 to 2002.  While it's impossible to verfiy if these are all genuine I've spot checked some of the new emails and they do seem to be legitimate.

As News Corp has already lawyered up and taken some emails offline it's possible these files will be deleted at some point in the near future.

You can view my earlier posts on Ray Adams here.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

More on Ray Adams and His Control of THOIC

Following on from my earlier post about Ray Adams and the hacking group THOIC Something Awful forum member Nation has come up with yet another very interesting email where Ray Adams discusses THOIC

RFC Headers:

From: Gutman, Avigail
To: Adams, Ray
Date: 12/9/1999 2:47:06 AM
Subject: RE:
-----------------------------
Ray -- I agree that we need to get exclusivity with him.

I would like to speak to Reuven, to increase my budget for next year so as to include part of his maintenance. What do you think?

I know Len is trying to help Lee manage his time better. One of the things I think Lee needs is a periodical "bigger picture" view, which will enable him to shift his focus according to our changing priorities... I would be happy to sit with him on some of these - if and when you think that would be appropriate.

Another thing that perhaps Andy can help him with is "automation" of certain routines he goes through. I don't know if he is open to this or not - but with the long-term relationship view in mind - this could save on time and resources....

Regards

Avigail


-----Original Message-----
From: Adams, Ray
Sent: Wednesday, December 08, 1999 5:17 PM
To: Gutman, Avigail
Subject: RE:


No need to phone. I handled it. I said that English is not your
first language and that you are also under tremendous pressure with a
heavy workload and no one to assist you. I told him to consider
himself as your assistant.

We need to speak soon about making Lee totally and exclusively ours
and the budget that is needed. This month he cost me £5,000 out of
my budget for his retainer and a new computer and a 21" monitor.
This is very high but it gives an indication of the type of costs we
can run into. TEL is paying him something like £1,500 a month. We
will need to get the TEL part from somewhere else to bring him fully
in- house. I have thought of making him an NDS employee and thereby
subject to an NDA.

Anyway I would appreciate your thoughts. Also think of this.
Until now he has developed THOIC in design and content on his own with
nudges from me. We need to look critically at what THOIC is and dose
and see if it needs to change.

ray



-----Original Message-----
From: Gutman, Avigail
Sent: 08 December 1999 15:04
To: Adams, Ray
Subject: RE:

Ray -- I'm sorry, written words are sometimes heard harsher than they
are said...

I was actually using the term jokingly, and the emphasis was on "is
everything alright" with HIM.

He IS a valuable resource and I tell him this every time we speak on
the phone and in emails, too. I don't say it for his ego - I say it
because I really think it.

Should I phone him on this - I don't want him to worry or to be
offended... I'll do whatever you suggest.

Regards

Avigail

-----Original Message-----
From: Adams, Ray
Sent: Wednesday, December 08, 1999 4:41 PM
To: Gutman, Avigail
Subject:


Avigail.

You are not and never, or will, be blacklisted. Why do you use such
strong words.

THOIC is now of significant importance to us. I am preparing a Mk 2
site in case THPOIC is ever exposed. However, I think you will agree
that THOIC is a wonderful tool to have. I keep impressing on Lee
that he must not take any risk and expose the site. Add to that his
jumpiness when he sees something that makes it look like the finger of
suspicion is pointing to him. Even MM said openly to him that he
suspected that his E Mail had been accessed.

Lee has no background or experience as a field investigator. He does
not have the ability to evaluate or judge. To him everything that is
said is true and of equal value. It is pointless trying to pass on
the skills and judgement to him - it would take too long. So my
constant message is that of caution.

He does not know you. He has not met you. He can only judge by the
written word. You have challenged him in the past but that is water
under the bridge. So please do not even suggest that there is
anything being witheld from you.

Now. It is clear from your message to him that you have other
sources. He will now be looking for clues as to who they are.
This is an ego problem. He means you know harm, but, you have
questioned his trust of you and want him to be open - and now you tell
him you have other sources and are keeping things from him. This
will wind him up. It is not necessary to let him know these things.
Always come to me with such issues.

Relax., You have complete access to a valuable resource.

Ray

If you want to look through some of Ray Adams selected emails you can still download them at the Austrlian Financial Review website, no doubt there's plenty more from where the above came from.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com

Ray Adams, Hairymonster and Spying on the THOIC Community - UPDATED

I came across a rather interesting post on the Digital Spy Forum's discussion of hackgate by forum member FR15K, aka Hairymonster

I have remained silent on this topic up until now, I feel I have a unique perspective on this as I was the person 'HairyMonster' aka 'FR15K' who along with several others pretty much spread the message about Lee G back in 2001. I have seen first hand the emails and various other documents/evidence that the BBC has back in 2001 (Which have not been tampered with as Mr Peled has suggested) and at the time hoped something would come of it. Sadly there were more pressing things happening back then which had more of a right to be newsworthy.

I was rightly prosecuted for running a hacking advisory website of my own back in 2008 by Virgin Media and ironicly NDS who were the main expert witnesses in the case. I do not seek in any way shape or form to undermine the charges which in my opinion were fair and the correct outcome for Virgin Media. However I am pretty much disgusted that I raised this issue during police interviews and was ready to show evidence only to be told that they had spoken to NDS who had pretty much assured them it was all rubbish. Typical eh?

As someone charged and convicted of something of which it is overwhelmingly clear members from NDS operational security had done themselves I find it an utter farce that action has not been taken against the man who openly admitted running a hacking advisory service on TV along with those who have openly admitted to funding it. The law should stand not only for people like myself but also for those with wealth and power.

I hear OFCOM are looking into the Murdochs and deciding if they are fit and proper to run BSKYB, personally I would not let them run a News Agents never mind a News Empire.

I will now retreat back into the murky shadows where I belong. 

Which was followed by a second post

I deserved the Jail sentence, I held my hands up and plead guilty. I do not in any way dispute I ran a hacking advisory service. Like I said earlier it was the correct outcome for Virgin Media.

My Co Defendant was jailed for producing a tv hacking guide, something of which an NDS funded hacking advisory service had itself done 7 years earlier via the THOiC Offline Ezine.

THOiC was not only undermining ITV Digital it was undermining NTL/Telewest, now Virgin Media amongst many other platforms across Europe and Asia whilst being funded and operated by NDS. I know as I was there and saw it as I am sure there are a few others on this site who saw it too.

The BBC program touched on a small part of what was REALLY going on.

This lead my to this thread, NDS Monitoring Sites? posted in April 2001, which had a copy of a post made about the situation that makes very interesting reading

ATTENTION: THOIC FORUMS WORK FOR Sky !!!! (29-04-2001 until 30-06-2001)
--------------------------------------------------------------------------------
Hairy Monster has just been in touch with me and blown the whistle on probably the biggest SAT Forum Scandle EVER.........

Orignal Post: www.xdigital.addr.com/cgi...1&t=000603

I have place the original link also incase anyone thinks this is a wind up.
forums.modshack.co.uk/vie...2&TID=1736
THE THOIC THING - Please Read

I have received over 50 mails in my mail box asking WTF was going on a THOIC last night so rather than reply individualy I have decided to post it here since THOIC removed it PDQ.

The NOW EX THOIC MOD CyberGaf last night in spectacular fashion QUIT from thoic giving the reason for him quiting as he does not want to be a stooge for NDS (NDS=***) and claiming that Lee Gibling Paul Briton and a few others were part of NDS and that THOIC is one big cover for an orginisation whos job it is to bust people and take sites down.

A few weeks ago a member calling himself FRISK decided to post up emails alledgedly from Lee G to ted@infopop.com (UBB) which shown him to be grassing up sites for not having licences for UBB.

In the list were

Modshack (At that time merged with Xdigital)
Xdigital (After we split)
Sat4All (Who at the time were hosted by THOIC)
& a few others like All-Tech.

Anyhow to cut a long story short I removed the post as I thought it was BS but on seeing what I saw last night I aint too sure now and so I have decided to post it here.

From: THOiC Networks© <webmaster@thoic.com>
To: "Warren, Mike" <MWarren@ndsuk.com>
Subject: Re: Hi
Date: Tue, 14 Mar 2000 10:00:11 +0000
Organization: THOiC Networks©
Reply-To: webmaster@thoic.com
Message-ID: <qb3scss08u2gfvnejvmclmdvk8kf06d1h9@4ax.com>
References: <71711A2AEB88D1118B5700805FF52D7001B332D4@dill.hro w.ndsuk.com>
In-Reply-To: <71711A2AEB88D1118B5700805FF52D7001B332D4@dill.hro w.ndsuk.com>
X-Mailer: Forte Agent 1.7/32.534

On Tue, 14 Mar 2000 09:26:44 -0000, you wrote to THOiC Online:

>Congratulations Vicki

Thanks Mike -
>Lee
>Your expenses were signed by R.A. and have been taken by hand to Finance
>and received by them last Wednesday I asked that they were dealt with asap.
>As a matter of interest although Len is still on holiday till Monday am I
>not right in believing there should be receipts with the invoice [not for
>one item agreed by RA, but for every thing else?]
Yes - you are totally correct - LW asked me to hang onto them for his
return - it's really not a problem, I wouldn't dare bill anything I
shouldn't

For those who downloaded the EMails in full all 30 odd meg of them then I am sure you will be left in no doubt of it.

All I can say is like Gaf I spent half my days over at thoic and even closed the old modshack and cableshack sites so I could be a bigger part of it. I went away for a few days because of family reasons and on my return found I had been booted as a MOD, even then I still supported them.

But no longer will that be as I am not a grass nor am I a tool for NDS and I will never be. This sucks big time as I have seen all the evidence I need to see to make me beleive and so have many many many others

THIS IS A WARNING

Every mail, every thread, every pivate message is logged on thoic and sent to NDS on CD each week. If you continue to use it then so be it but do not say no one warned you. I have passed on this info to several other site members and have had conversations with them all so they all know the score.

We can sit down and do nothing or we can all unite and say **** to them its your call.

For those who still don't beleive well nor did I until I got sent private emails that I had sent lee and Bigbird and only we knew about. I was then sent more info that has left me in no doubt that LEE = THOIC = NDS = BAD NEWS. Please pass this info and this message to every one you know as it effects them.

Please if you are a member of thoic then change your forum and email passes with imediate effect.

 "R.A." is almost certaintly Ray Adams, and shows he was signing off on the expenses incurred by what appears to be pulling the strings of the THOIC community, and demonstrates the extent to which Ray Adams was involved with all of this.

Update - FR15K/Hairymonster made another post on the Digital Spy forums with more information

North Wales Police Hi-Tech Crime Squad, although in their defence they were a little out of their depth with things and were pretty much reliant on NDS and VM bringing them up to speed so I can excuse them. The two officers who were in charge of my case were fairly decent human beings and I would in no way class them as the same as the other shower from London.

In my stupidity I actually thought they would ask for me to back up my claims and look a little further into things, it would of not changed the eventual outcome of my case but it would of shed a little more light on matters concerning THOiC and the involvement of NDS.

I was also shocked to be told that NDS were in my home at the time of my arrest and helping the police to gather evidence. In the end almost all of the items taken were returned with the exception of a PC and a couple of hard drives. My sky digital boxes were both un-compromised as was my free to air only satellite box. I had no card programming hardware or cards other than those supplied by Sky themselves which were once again un-compromised, I may of known how to get FREE TV but I paid just the same as everyone else.

The original charge was conspiracy to defraud which I refuted all the way and in the end I was charged with the then unheard of 'Providing a Hacking Advisory Service' which in my view and I am sure that of many others they were actually guilty of themselves, if not far more.

Since those days back in 2008/09 I have stepped away from the whole hacking scene and other than chatting to old friends in chat rooms I pretty much have no hand in it. As far as I am concerned VM got justice although I hasten to add that Cable Piracy is just as rife now as it was back then which is shame. It was only the other week I heard of a case of several people being arrested for supplying a card share service and openly condemned them on a public forum, I am sure they are not the only ones doing the same.

The thing is though, I was guilty, no more and no less. I rightly went to prison for running my site whilst these people remain at large and untouched for doing far worse to the paytv industry than hackers EVER could.

Utter Shambles in my opinion. 

Update 2 - Hairymonster made another post

If you can imagine at the time Lee as being someone people trusted then you can understand that with his position (and the fact that he hosted many hacking sites on his NDS paid server other than THOiC) he had access to things which the general public did not. This made him a valuable asset to have as he was ingrained into the world of tv hacking and very few suspected him. The emails and so far unreleased ICQ messages clearly show people passing info to Lee with regards files and hacks as well as messages from private sites being forwarded to NDS as Intel.

From the point of view of NDS he must of seemed like the golden ticket into a world they wanted access too. THOiC hosted many what were at the time thought private forums where almost ALL encryption systems were discussed. Hacking groups were formed by bringing people with similar interests and goals together and many of those groups still exist today as a result.

Anyone who was getting close to or even suspected of getting close to compromising NDS was paid a visit or shut down, in many cases they used the intel gathered from THOiC to use to formulate Electronic Countermeasures they could roll out more or less within days if needed. The cards you currently have in your boxes right now as a result of intel they gained that their current cards were about to be compromised, they acted quickly to close the doors, which tbh is fair play to them.

The problems start when you do not tell your competitors what your up too and allow and promote their systems to be compromised.

THOiC was set up by Lee as having the appearance of a hosting company and the first time I found out what was going on was when I was approaching Lee for hosting of my domain name, I was quickly asked to go to a different IRC server and was promptly told what was going on. At first I refused to believe it and demanded proof. Sadly indisputable proof was given to me and the rest as we say is history.

As someone who has spent many years hating Lee G for his betrayal with good reason I actually kind of made my peace with him to a tiny extent as he told the truth in the end.

Not all power corrupts, some people wield it responsibly and for the better good. Unfortunately many others seem to think that wealth can buy them the right to do anything they bloody well please and more than often is the case it seems that it is true. No matter what political party is in power there are people who see themselves as above the law and will use power and influence with those in downing street to get what they want.

The recent article about Sky News hacking emails highlights the idiocy of these people, it could then also be argued that the person who took Ray Adams (Stolen) emails was also acting in the publics interests? And to be honest more so?

I know there are a few on here who used THOiC in its heyday for what ever purpose and I know that these people will agree 100% that the site was a hacking advisory service.

The UK systems were the tip of the iceberg, the thing is THOiC encouraged people into that lifestyle. Everything was pretty much handed to you on a plate.

Like I said in the program my own site was considered by NDS to be a one stop shop for PayTV hacking, IF that is true then it is equally true that THOiC was a supermarket if not an entire shopping centre if I am being realistic.

During the interview with the BBC I was asked to view files that they had managed to get hold of which were taken from Lee's computer back in 2001, I quickly identified several files as being the ones put upon the site for the OD hack. I was not prompted to look at them nor was I told what to look for etc..

The reason I knew what to look for is because I had seen them before from the original source THOiC, they were correctly timestamped and dates and were the same files without a doubt.

The Panorama program whilst not covering the whole of the subject due to time constraints was pretty much spot on with minor details such as the colour of Lee's BMW which was in fact Yellow but we will forgive them for that. The Factual content was correct and they had the same story from the persons from both sides of the coin, I was shocked to see that Lee had given a full admission but then he said nothing that many people did not already know.

Ray and Len claim they had little to do with things but the emails and testimony of Lee show clearly that they were in it up to their necks. As too was Avigail Andy C and many others along the way.

I find myself in the awkward position of backing Lee as he for once is the one telling the truth. I mentioned the other day that I had kind of made my peace with Lee since the program, my reasoning being that he has come forwards and told the truth about what was going on back then which for me closes the book to some extent and validates my original claims that he was working for NDS back in 2001.

The one thing I can not and will never forgive him for is the betrayal of people who considered him to be a good friend and a noble man, those of whom he set up to fall from great heights and all in the name of an NDS paycheck.

Panorama described him as the 'King of the Pirates', well I can assure you that is NOT the Moniker that they use for him. They call him 'The Snake'.

You can contact the author on Twitter @brown_moses or by email at brownmoses@gmail.com