Haunted by hackers: A suburban family's digital ghost story

The systematic destruction of Paul and Amy Strater’s lives began with pizza.

Several years ago, pizzas began showing up at the front door of their home in Oswego, Illinois, a middle-class suburb about 50 miles west of Chicago. It might have been a nice surprise, except the Straters hadn’t ordered any pizzas. Someone was sending the pies to their house, unbidden, from every shop in town: Domino’s, Rosati’s, Papa John’s. The orders were always different—sometimes plain cheese, other times an odd combination like pineapples and anchovies—but the routine was the same. Every few weeks, a delivery person would ring their doorbell, give them a pizza, hold his hand out for payment, and hear the same fatigued explanation:

“Yes, you have the right address.”

“No, we didn’t order this.”

“Yes, we know who did.”

Paul, a senior broadcast engineer at a local TV station, and his wife Amy, a former hospital administrator, have gotten used to defusing these kinds of awkward situations. For the last three years, they’ve been the targets of threats, hoaxes, and impersonations, all stemming from an internet trolling campaign.

Their troll—or trolls, as the case may be—have harassed Paul and Amy in nearly every way imaginable. Bomb threats have been made under their names. Police cars and fire trucks have arrived at their house in the middle of the night to respond to fake hostage calls. Their email and social media accounts have been hacked, and used to bring ruin to their social lives. They’ve lost jobs, friends, and relationships. They’ve developed chronic anxiety and other psychological problems. More than once, they described their lives as having been “ruined” by their mystery tormenter.

Earlier this month, I went to Oswego to visit the Straters and see the damage for myself. I also tracked down the hacker they suspect was behind the attacks. What I found was a kind of modern-day poltergeist story, starring two frightened victims and a shapeless, mysterious digital ghost they can’t see, touch, or respond to in any way.

Over lunch at a sports bar near their home, while dozens of Chicago Bears fans eat wings and stare at flat-screen TVs, the Straters explain how this happened.

Their troubles began several years ago, they say, when their 20-year-old son, Blair, got into a fight with another hacker in an IRC (Internet Relay Chat) room he frequented. Blair, who goes by the handle “r000t” online, has run in hacker circles for years. (Blair calls himself a “white-hat,” meaning a non-malicious hacker, but as with most hacker classifications, the exact color of his hat is an open question.) According to Blair, he and a teenage Finnish hacker named Julius Kivimaki, who goes by “zeekill” and “ryan” and is reportedly a member of an international hacking crew called Lizard Squad, got into a fight over whose server would host a new hacker “zine,” or collection of data.

It was a minor fight—the kind of argument that happens every day in hacker rooms. But the Straters believe it sparked a years-long harassment campaign, with devastating collateral damage.

“He got it into his craw that he was going to mess with us as much as possible,” Paul says.

In November 2012, a local police detective received an email from a temporary email account with an address similar to Blair’s. The email contained a bomb threat. Blair was on court-ordered probation at the time, as the result of a 2010 incident in which he’d hacked and defaced his school’s website. (According to Blair, he pled guilty to one juvenile count of computer tampering.) When the bomb threat email arrived, Blair was arrested and held for three weeks in jail before officers determined it was a hoax.

Blair, who now works as a developer at a managed services provider in Chicago, shows up to the sports bar half an hour late, wearing a black t-shirt that reads “I’m not insane. My mother had me tested.” He looks like a central-casting hacker—fast-talking demeanor, aggressive countenance—and he spends most of lunch poking at a Microsoft Surface tablet. He’s steeped in a certain kind of teenage hacker culture—he uses 4chan slang like “newfag,” and calls hackers whose skills he doesn’t respect “skids,” short for “script kiddies”—and he’s not shy with his opinions. (He says of Kivimaki, “I want to rip his dick off and choke him with it.”) He’s also knowledgable about hacking techniques, and at one point, spends five minutes showing me a site where users can buy a stranger’s social security number with Bitcoin.

So, yes, Blair has a rap sheet for hacking and a deep familiarity with some of the darker parts of the internet. And yes, he may have angered the wrong hackers in that IRC chat room, or done something that made him a target for retribution. His parents are not randomly-chosen targets.

But they are innocent ones—drive-by victims in what appears to be a hacker grudge battle.

After the bomb hoax, the Straters began getting a deluge of unwanted items delivered to their house. Tow trucks. Flowers. Large quantities of sand and gravel. A load of flat-rate boxes from the Post Office. Someone called Comcast, pretending to be Paul Strater, and cancelled the family’s cable plan. Their electricity and gas contracts were nearly shut off, too, before a last-minute call averted a cancellation. Paul and Amy’s AOL email accounts were hacked, and Amy’s school loan documents were stolen.

Around 4:00 a.m. on the night of October 24, 2013, police officers descended on the Straters’ house to respond to a call from someone identifying himself as Blair Strater, who told the dispatcher that he had taken PCP and murdered his mother. (The police left after verifying that Amy Strater was, in fact, alive.)

“Swatting,” as the practice of summoning law enforcement to respond to fake crimes is known, is a staple of the troll arsenal. It was popularized on gaming sites like Twitch, where power-hungry users would swat popular gamers while they streamed, then watch the SWAT team break down their doors in real-time. It’s an intimidation tactic, performed anonymously and infrequently resulting in consequences for the caller. And in the months following the October 2013 swatting incident at the Straters’ house, it happened to them several more times.

In quiet Oswego, where ticky-tacky houses with manicured lawns line up along placid cul-de-sacs, a streak of middle-of-the-night emergency responses has a way of causing a stir. And soon, the Straters found that they were raising eyebrows, even though they’d done nothing wrong.

“Our neighbors have completely ostracized us,” Amy says. “They don’t talk to us, because they don’t know what’s going on.”

“Our neighbors have completely ostracized us.”

Adding to the psychic toll was the randomness of the hacker’s attacks. Sometimes, months would go by without a hint of trouble. Then, hoaxes and threats would happen rapidfire for a period of several days, followed by another bout of silence. The Straters learned to live with a constant low-level terror, not knowing when the next pizza would arrive, or when the next crew of emergency responders would show up.

In late April, the Straters were hit by what they call “Tesla Weekend.” On a Saturday morning, a hacker commandeered the website and Twitter account of Tesla Motors, and the personal Twitter account of Tesla CEO Elon Musk. On Tesla’s site, the hacker posted a crude Photoshop of Blair’s head on top of a Tesla car, with a message reading:

“Telsa [sic] you have been raped by [redacted] and BLAiR STRATER”

The hacker changed the name on Tesla’s Twitter account to #RIPPRGANG, and posted:

“THIS TWITTER IS NOW RAN [sic] BY HENRY BLAIR STRATER FROM OSWEGO ILLINOIS CALL ME AT __________”

And:

“GET A FREE TESLA – CALL _________”

There, in the tweets, were Blair’s and Amy’s real cell numbers, for all of Tesla’s 564,000 followers to see.

On Musk’s personal Twitter account, which had 1.9 million followers, the hacker also offered free Teslas, and gave up the Straters’ home address. He also posted “@rootworx was here,” implicating Blair in the hack.

For the next three days, Blair and Amy’s cell phones got thousands of phone calls from all over the world—a never-ending deluge of Tesla-lovers who had been taken in by the hoax. Paul eventually took Blair’s phone, and adopted the responsibility of telling the throngs of callers that there were not, in fact, free $80,000 electric sedans waiting for them in Oswego. (One over-eager Tesla fan showed up to the Straters’ house, and demanded that Paul open his garage door—he suspected that his free Tesla was being hidden back there. Paul angrily kicked him out.)

The Tesla problem got so bad that Blair tweeted:

As they were reeling from the Tesla attack, the Straters desperately tried to defend themselves against the next one. Paul called his utility companies and set new passwords on his accounts. He dialed up the managers of local restaurants, and instructed them not to deliver anything to their address unless it was prepaid in full. He got the Oswego Police Department to agree to call ahead to verify that an emergency was real, before sending in reinforcements.

But the attacks kept coming. In one nasty spurt in May, a hacker gained control of Amy’s Twitter account, which she had used only twice before, and posted a series of racist and antisemitic messages. (See if you can tell where Amy’s tweets end and the hacker’s begin in the timeline below.)

That same day, a hacker used Amy’s email account to post a message to a Yahoo Groups list of about 300 residents of the Straters’ subdivision, including many parents of students at the elementary school that the family’s youngest daughter attends. According to local news reports, the message carried a chilling subject line—“I Will Shoot Up Your School”—and detailed a planned attack on the school. Oswego police quickly verified that Amy’s account had been hacked and that the message was a hoax, but the damage had been done.

Later that day, Amy discovered that her LinkedIn profile had been hacked, too. The hacker posted a message calling her employer, Ingalls Health System, “A TERRIBLE COMPANY RAN [sic] BY JEWS.”

Amy, who had worked at Ingalls for seven months as a director of decision support, had suspected that the trolls might target her employer. She says she had previously alerted the company’s IT department that the company’s systems might be compromised by the same people who were attacking her and her son.

She expected support—after all, if it was her house that was being repeatedly robbed, rather than her social media accounts, wouldn’t the company be sympathetic? But none came. Shortly after the hack, Ingalls fired Amy from her six-figure job, giving her 12 weeks of severance pay. Amy says she got no satisfactory explanation for her dismissal, other than a hint that she was “too much of a liability.” (A spokeswoman for Ingalls Health System declined to comment.)

“I can’t get a job, my marriage is over. Not a day goes by that I don’t wonder if it would be easier if I take my own life.”

While she recounts the details of losing her job, Amy begins to cry. It’s been a rough few years for her, and theirs is a complicated family. She and Paul separated last year, amid the hacker chaos, and a new relationship she’s been in just ended—partly, she says, because of the stress surrounding her job loss.

She hasn’t been able to get another job in hospital administration because for months, her first page of Google results has included her LinkedIn profile and her Twitter account, both of which were filled with racist and anti-semitic language. (She recently regained access to her LinkedIn account after contacting the company’s fraud division, but her defaced Twitter account is still up, since the attacker changed the password to prevent her from restoring it.) Since she was fired from the health system, she’s been driving for Uber to make ends meet, but the lack of full-time employment is draining her finances, and she’s in danger of losing her house.

“When you Google her name, you used to see all of her scholarly articles, and the good things she’s done” says Blair. “Now it’s: hacker, hacker, hacker.”

“I feel helpless,” Amy says. “I can’t get a job, my marriage is over. Not a day goes by that I don’t wonder if it would be easier if I take my own life.”

Tears cascading down her face, she adds: “I have nothing left.”

Throughout their whole three-year saga, the Straters have blamed one person—Julius Kivimaki—for waging a troll war against them. Paul has tried repeatedly to get law enforcement agencies, including the FBI, to pursue a case against Kivimaki, but says he was told that since he was a minor in Finland, there was little they could do. (Kivimaki is now 18, but was underage when most of the alleged crimes occurred. An FBI spokeswoman declined to comment on the case.) For now, the Straters’ only recourse is revenge fantasy.

“He’s lucky he’s a $4,000 plane ride away,” Paul Strater tells me of Kivimaki.

Which is not to say that Kivimaki has gotten off scot-free. Last year, he was outed by security journalist Brian Krebs as a member of the “Lizard Squad,” a hacker collective that claimed credit for hacking the PlayStation Network and Xbox Live platforms, and that has also been linked to hacks of Malaysia Airlines and other large companies. Earlier this year, Finnish authorities convicted Kivimaki of more than 50,000 cyber-crimes (yes, 50,000 separate crimes) for a years-long hacking spree that included stealing credit cards, calling in false bomb threats, and laundering money using Bitcoin—all incidents, according to Kivimaki, that are unrelated to the Straters.

For his crimes, Kivimaki had his computer confiscated, and received a two-year suspended sentence and a fine of roughly $7,000. (Finland has one of the world’s lowest incarceration rates, and as a minor, Kivimaki probably wouldn’t have been given prison time anyway.) A suspended sentence and a fine was more like a slap on the wrist than a real deterrent, and Kivimaki hardly seemed fazed. Shortly after his sentence was handed down, he changed the bio on his Twitter profile to read “untouchable hacker god.”

Last weekend, I got in touch with Kivimaki. We talked over encrypted instant message, and his account name matched one that has been associated with him publicly for years. (He also sent me a recent photo of himself, above, as proof that it was really him.)

“I’ve been involved in very little of the stuff he’s attributing to me,” Kivimaki wrote, when I asked about Blair Strater’s allegations. “I didn’t do the Tesla hack, never ordered anything to him, for whatever strange reason I can’t seem to remember swatting him either.”

“I’ve been involved in very little of the stuff he’s attributing to me.”

Kivimaki admitted that, yes, he’d trolled Blair in IRC rooms, and had harassed him offline on occasion—in particular, he’d “shut down his Comcast a few times,” and had gotten the Straters’ phone service cut off. He also said that he’d copied and pasted the passwords to Amy’s social media and email accounts to an IRC channel, but denied he’d been the one to deface the accounts. And he denied, more broadly, that he’d been the sole force behind their harassment campaign.

“If I wanted to mess with them I’d have called their workplaces on day 1,” he wrote. “I’ve really got very little interest in them.”

Kivimaki blamed the Straters’ harassment on Blair, who he said was “not very well liked in the hacker scene.” For years, he said, Blair had been “a pain in the ass” in hacker chat rooms, and had annoyed many of the members. As a result, he said, the hackers had turned him into a target.

“Kind of like the internet equivalent of walking into a ghetto and going to talk shit to some guys dressed like gang members,” Kivimaki said.

I asked Kivimaki if he felt bad about what had happened to the Strater parents—the swatting, the mysterious deliveries, the job loss, the psychological trauma. He said he did think the hack of Amy’s LinkedIn profile, which cost her a job, was “really unnecessary.” But otherwise, he chalked it up to a hacker quid pro quo.

“I have hard time [sic] feeling sympathy for them,” he wrote. “Especially considering they’ve been actively helping perpetuate Blair’s lies.”

There’s a concept in Chanspeak, the vernacular of 4chan and other trollish internet locales, called “lulz.” It means, basically, the pleasure an internet troll gets from carrying out an attack. To the extent that there’s a logic to the attacks on Blair Strater and his family for the last three years, lulz probably figures prominently in it.

But there is also a kind of vigilante justice at work, according to Kivimaki. By the questionable logic of a teenage hacker, everything that’s happened to the Straters is justifiable under the banner of a proportionate response to Blair’s alleged activities. Innocent as they may be, Paul and Amy simply had the misfortune of being connected to Blair, at a time when trolls wanted to attack him.

“There’s a story here, but not ‘Finnish hacker harasses poor kid from Illinois. More like ‘Internet is a mean place full of really shitty people.'”

“There’s a story here, but not ‘Finnish hacker harasses poor kid from Illinois,'” Kivimaki tells me. “More like ‘Internet is a mean place full of really shitty people.'”

The Straters’ lives have been quieter recently. For months now, there haven’t been any strange deliveries, or attacks on their social media accounts, or attempts to ruin their professional lives. Perhaps that’s because, as Amy says, they have “nothing left to lose.” Or perhaps it’s because the trolls, whoever they are, got bored and moved on.

Near the end of my lunch with the Straters, Blair pulls up a folder on his tablet containing evidence of the harassment his family has faced. It’s all there—screenshots of pizza orders, copies of police reports, photos of officers rifling through their bedrooms. It’s a terrifying testament to the fragility of our digital lives, and a reminder the sheer amount of damage a dedicated attacker can do in the networked era.

“We built that house ourselves. Why should we have to move?”

I suggest to the Straters that maybe the three-year harassment campaign against them doesn’t have to define them forever. They could move to a new neighborhood, pay a reputation firm to scrub their Google results, or even change their names.

“We built that house ourselves,” Blair says. “Why should we have to move?”

He’s right, of course. Nobody should have to start their life over because a bored troll decided to wreak havoc. But the sad reality of internet permanence is that past is often destiny. Long after the Straters’ lives have returned to normal, they’ll still have their Google results, their paranoid and distrustful neighbors, and their greatly reduced job prospects. They’ll still be awakened by phantom sirens in the middle of the night. Every time the doorbell rings, they’ll still wonder if they’re being hoaxed.

I ask the Straters what advice they would give to other families, given all they’ve been through in the last few years.

“Don’t use Twitter, don’t use LinkedIn, don’t use Facebook,” Amy says. “Stay away from social media as best you can.”

“Stay under the radar,” Paul adds.

At this, Blair looks up from his Surface.

“No one’s going to do that,” he says. “That’s the wrong message.”

Blair has a point. In 2015, leaving the grid isn’t really an option. Our jobs, relationships, and movements require us to be connected through these networked systems. And as long as those connections persist, so will the risk of being targeted if someone with enough technical skill and free time decides we’re worth harassing.

The Straters are ready to head home. But first, Paul wants to tell me something. He glances around the back of the sports bar, and points to a corner where groups of people are sitting, happily watching the Bears game.

“This could happen to anybody in this room,” Paul says. “We’re just the people who got hit.”