A sting op on a hacker who had a noble aim

The following is an extract from the book The Anatomy of a Sting authored by Bhupen Patel:

In early June 2001, I started receiving anonymous calls from someone who sounded like he could not be more than 22 years old. He never told me his name and every call was to inform me about his hacking achievements. Sometimes he would say he had hacked websites in other countries or institutions to show how vulnerable they were to cyberattacks. I could tell he was passionate about establishing himself in the digital world the way I wanted to make it big in journalism, and I felt a strange sense of connection to him.

Though none of this was printable, I nurtured him as a source, anticipating that he would be useful to me someday. Neither of us insisted on meeting each other, but we kept in touch over the phone and at times discussed his motives for hacking.

But what brought us closer was something beyond my wildest imagination. One evening, a call on my office landline became a turning point for my career.

It was him. But his voice sounded different. There was a mix of excitement, fear and anxiety in his tone, and it was obvious that he had done something big. “I hacked the Mumbai police’s website,” he said. Now I was scared because I could possibly be considered an accomplice. I said, “Abey, bahut marenge tereko, tu ghar pe bola kya” (They will beat the hell out of you. Did you tell your family)? I had hoped he was kidding, but he replied, “You think this is a joke? I am very serious. Go to their website and you will see that their homepage is disrupted.”

I immediately logged in and saw that the homepages of two sites — cybercellmumbaicity.com and www.ccicmumbai.com — displayed the Information Technology Act and other laws pertaining to IT Act violations. He wanted to call out the cops for letting their guard down.

The young ambitious journalist and the idealistic young citizen in me were in a tussle. This would be my biggest scoop till date if I reported it. I was torn between writing about it and reporting it to the police. He probably sensed my indecisiveness because he hung up saying he would call back in 15 minutes.

I rushed to my editor’s cabin and discussed the story with him. We decided to persuade the caller to meet and I would record the interaction on a phone camera. I would also carry a pen camera as I anticipated that he wouldn’t let me take his picture. We would take a call later on whether to identify him or not.

I went back to my seat and waited for his call; I wasn’t sure if he would call me back. But exactly 15 minutes later, the phone rang again. This time, he sounded more confident. I made my request to meet him, but he hung up, thinking that it was a set-up for the cops. Before he could cut the call, I managed to tell him, “I am as hungry for this story as you are for glory in the cyber world, so please have faith in me and give me an opportunity to meet you once.” But he did not give in.

I lost my cool and banged the phone down, startling the entire office. “What’s wrong with you?” a colleague sitting next to me asked in an irritated tone. I preferred to ignore her and walked out for a break.

I had never anticipated that I would lose the story so easily. At that time, it felt like I had lost the one opportunity to kick-start my career. I was most upset that I had not been able to convince him.

When I returned, a colleague told me that someone had called and left a message that he would call back again in a few minutes. “Did you ask his name?” I asked. The caller had just replied saying that it was an important call. I heaved a sigh of relief. It had to be him. And I was right. The hacker called me back.

“I am talking to you only on one condition. You will not mention my name. I want you to come alone near Kabutar Khana in Dadar. I will see you in exactly one hour,” he said, referring to the pigeon-feeding square in Mumbai’s central neighbourhood.

“But how do I recognise you? Can I have your number?” I asked. “Once you reach the spot, I will give you a call and give you further instructions,” was his reply.

It seemed like he had learnt his moves from films. I informed the office and rushed to Dadar without wasting any time. It took me less than half an hour to reach the spot. I kept looking at the people passing by and saw him in every young boy that walked past me; I even tried to make eye contact with some. Exactly an hour after the last conversation, I got a call on my mobile number from a landline number. From where I stood, I could see three public call office (PCO) booths, of which two were busy. One was occupied by a middle-aged man while the other had a younger boy.

I was sure the latter was the one I was looking for. The hacker asked me what I was wearing. On hearing my response, he cut the call. The young boy also put down the phone. The boy then began walking straight in my direction. As I raised my hand in greeting, someone tapped me on my back and said, “I am the one you are looking for.”

I turned around and saw a six-foot-tall plump boy standing behind me. He was wearing a green T-shirt with beige three-fourth pants. He kept looking around shiftily to make sure there were no cops nearby. I assured him and asked him to relax. “Let’s go to a more secluded place and talk, this spot is not safe,” he said and led me towards one of the smaller lanes in Dadar.

He still refused to tell me his name. “I am going to be Dr Neurkar for you, you don’t have to know my real name. Let’s keep it that way,” he said. I learnt later that his pseudonym was inspired by Dr Neurkar of G-Force, the world-renowned hacker.

Though he was extra cautious about scanning our surroundings for danger, he missed the pen camera in my shirt pocket. At that time, the pen camera was not very common.

Once we sat down outside a shuttered shop, he revealed a few more details about himself, telling me his larger circle of friends was also responsible for hacking the Mumbai Police’s website.

“And your motive?” I asked him. “What kind of training are these officers getting when they cannot protect their own online properties? How will they protect the sites of others? Only passing the Indian Police Service exams is not enough for these guys, they should also be aware how to prevent cybercrimes in Mumbai. They must keep up with the times. The agency that is fighting for justice for the victims of cybercrime has to first secure itself,” he explained. “If you notice the trends in the US and European countries, crimes on the Internet are far more complicated. We only want them to take this as a lesson,” he said, as if he was doing some kind of service to the police department.