Topiary: did police arrest the wrong man in LulzSec investigation?

29 Jul

Since the British police arrested a teenager yesterday in connection with the hacktivist activities of LulzSec and Anonymous, I’ve been asked, time and time again, the same question:

Have the cops got the right man?
Have they arrested the “real” Topiary?

It seems that the reason why they’re asking is that folks are supicious that LulzSec could have pulled a fast one – and deliberately tricked the computer crime authorities into believing that someone entirely different is the real “Topiary”.

In other words, the man arrested in Shetland could be a fall guy.

The main proponent of this theory is a blog article published on The DailyTech website by a chap called Jason Mick.

The article promotes the theory that the real “Topiary” is a 23-year-old Swedish hacker, not a teenager in Shetland, and it offers as evidence a chat log – originally published by th3j35t3r (“The Jester”) –
where a plan is described to incriminate someone else as “Topiary”:

23 <Topiary> yeah well, this is my plan:
24 <Topiary> (as you know I stole this nickname from a troll last December, didn't work out so well)
25 <Topiary> I'll just keep denying it until they try to go after the troll
26 <Topiary> then they'll think that's me and harass him
27 <removed> then he harasses back?
28 <Topiary> yeah but if I deny my real dox enough, people will go looking for other dox
29 <Topiary> then nobody will believe I'm me
30 <Topiary> and all you bastards told me my Brit voice was good, damnit
31 <Topiary> did they get voice recognition?
32 <removed> well when you talk the Swedish accent comes out a bit
33 <removed> but not for a couple of minutes
34 <Topiary> these faggots aren't hitting the UK nigger Topiary
35 <Topiary> why aren't they?
36 <Topiary> I'm hoping someone will go after him and think it's me, then I'll act all scared etc
097 <Topiary> hope it blows over and they start doxing Ireland fag or Scotland fag or wherever the fuck UK part he's from
098 <Topiary> anyway I trust you so yeah
099 <Topiary> we can keep this between us
100 <removed> Wont say a word bro
101 <removed> just take care
102 <Topiary> okay gotta go
103 <Topiary> thanks for advic
104 <removed> bye!

Hmm. I love a convoluted conspiracy as much as the next man. And it would be easy to start one, just by asking questions like:

“Why haven’t the police told us the arrested man’s real name? What are they hiding?”

“If it isn’t Topiary who was arrested, why hasn’t he or LulzSec posted any updates about the arrest on Twitter?”

“Is it a bluff or a double-bluff?”

“Why are the police not mentioning any link with phone hacking? Is it because it’s completely irrelevant, or because it *is* relevant?”

“Does the arrested man have a Scottish or a Swedish accent?”

“If he’s not got a Scottish accent, but was arrested in Shetland, when did he move there?”

“Does he have the same accent as the Anonymous spokesman who conducted all those TV interviews?”


For goodness sake people, let’s pause to breathe for a minute.

Here’s what we do know so far:

  1. The police issued a press release saying they had arrested a 19-year-old man (later changed to say he was aged 18 – let’s not start a conspiracy about that one, okay?) at a residential address in the Shetland Islands.



  1. The police didn’t release the man’s name, or details of where in the Shetland Islands he had been arrested, but did say that they believed him to be the LulzSec and Anonymous spokesman who went by the online nickname of “Topiary”.


  1. LulzSec and Topiary’s Twitter feed have gone uncharacteristically quiet.

If you ask me, is the man they arrested in the Shetland Islands is Topiary, another hacker (either working in league with Anonymous/LulzSec or opposing them), or entirely innocent.. my simple answer is I don’t know.

We have to presume he’s innocent until proven otherwise. He hasn’t been charged with any offences yet, and at the moment is just being questioned by the authorities.

I’m pretty sure that the police must have been pretty confident that they had evidence that the man they arrested was “Topiary” if they were prepared to name him as such in their press release.

If the man is connected in any way with criminal hacking activities and denial-of-service attacks I would expect him to start singing like a canary pretty quickly. You may be idealistic when young, but when the hard truth of the seriousness of the situation hits you, anyone with half a brain will realise that the only sensible course of action is to co-operate with the authorities.

So, if you ask me if I think that an unnamed man, arrested in an unnamed street, is guilty of crimes which I wasn’t present at then I’m going to have to say “pass”. Your guess is as good as mine.

I can’t look into a crystal ball and magic up the proof for you, one way or another.

So there! 🙂

by Graham Cluley on July 28, 2011


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: