Teen Volunteer to WikiLeaks’ Assange Dug Dirt and Wooed Bieber, McCartney

(Bloomberg) -- Julian Assange was drawing up an enemies list. It was November 2010, and WikiLeaks, the controversial organization and website that Assange founded, had in the previous months exploded onto the global stage after publishing thousands of classified U.S. government documents about the wars in Iraq and Afghanistan.

Assange turned to a teenager for help. He provided the volunteer with names of prominent journalists, researchers and former WikiLeaks associates who had turned against the organization and asked him to compile information about them.  “The enemies list should also have key identifiers. e.g. Twitter accounts, email, photo,” Assange instructed.

The volunteer was Sigurdur Thordarson, a then 17-year-old Icelandic citizen, whose conversations with Assange are revealed in previously undisclosed online chat transcripts seen by Bloomberg. Thordarson, otherwise known as “Siggi,” began volunteering with WikiLeaks earlier in 2010, and later became close to Assange, working alongside him for a period of time in England, according to multiple former WikiLeaks employees and volunteers. But the Icelandic teenager later grew disenchanted with WikiLeaks – and became an informant for the FBI, according to four people familiar with the matter, documents and emails reviewed by Bloomberg.

On June 24, the Justice Department released a new indictment against Assange, accusing him of conspiracy to commit computer intrusions and unauthorized obtaining of national defense information. The indictment doesn't add new charges against Assange — who was previously indicted in 2019 — but broadens the conspiracy allegations against him. Part of the new indictment includes references to information gathered by “the teenager.”

There isn't a reference to Thordarson, but a person familiar with the investigation said “the teenager” in the indictment is the Icelandic man.

The indictment alleges that in early 2010, Assange asked the teenager “to commit computer intrusions and steal additional information, including audio records of phone conversations” of high-ranking officials at an unnamed government that is part of NATO. According to a person familiar with the investigation, the government was Iceland.

Parts of Thordarson's story, and some portion of the chat logs, have been previously reported, and WikiLeaks has long sought to distance itself from him. But the previously undisclosed chat transcripts —  which were obtained by two people familiar with the matter — suggest that Thordarson was, at least for a period of time, a trusted colleague of Assange's, and they provide new details about his role in trying to recruit hackers and put them into contact with the WikiLeaks founder. They also provide fresh insights into WikiLeaks' internal operations during some of its most consequential releases of U.S. government secrets — a period that would shape the organization's trajectory in the subsequent decade and leave Assange embroiled in an ongoing legal fight.

Thordarson declined to comment for this article. Assange is currently in jail in London, awaiting a decision on extradition to the U.S. WikiLeaks said in statements posted on Twitter that the new indictment was a “pathetic attempt by the DOJ to dupe the public” and one that relies on a “convicted fraudster” — a reference to Thordarson and his legal woes in Iceland -- to make up more “bogus claims.''

Thordarson's role was to manage a chat portal used by volunteers to communicate. Assange also tasked him to find places for him to stay, to develop partnerships with some news organizations and to cultivate celebrity support. In 2011, while WikiLeaks was facing accusations of treason from some U.S. congressmen, Thordarson tried unsuccessfully to reach out to pop stars such as Justin Bieber and Paul McCartney to get them to attend Assange's 40th birthday party and lend support to WikiLeaks, according to the transcripts. 

After falling out with Assange over money and other disputes, Thordarson handed the FBI -- between August 2011 and March 2012 — thousands of chat transcripts, photographs, videos and other data gathered from his time at WikiLeaks, according to two of the people familiar with the investigation. 

The transcripts show the teenager solicited several hackers to break into Icelandic government computer systems and claimed to be acting on behalf of WikiLeaks. “The mail is the big soup,” Thordarson wrote on June 16, 2011, and could “cause a real revolution here.” He suggested that he wanted to obtain messages related to the International Monetary Fund and the 2008 collapse of the internet savings account brand Icesave, part of Iceland's Landsbanki Islands hf, during the country's financial crisis.

The hackers, some of whom were part of a group known as LulzSec, which was affiliated with a larger hacker network known as Anonymous, probed Icelandic government infrastructure for vulnerabilities, scanning a parliamentary website, a website run by the country's prime minister and an Icelandic police website, according to the chat transcripts. But they weren't able to immediately identify a way in to the sites, the transcripts show.

One of the hackers, using the nickname “pwnsauce,” suggested sending “customized malware” to Icelandic government officials as an alternative approach, according to the transcripts. “Yes that might work,” Thordarson replied, before sending a link to a page on the Icelandic parliament's website that contained an alphabetical list of members of parliament and their contact details. It isn't clear if malware was later sent to the politicians. A message sent to an account for Pwnsauce wasn't returned. 

On June 27, 2011, the ringleader of LulzSec, known as “Sabu,” reached out to Thordarson. He promised to penetrate Icelandic government servers. “This week you should see results,” he wrote, according to the transcripts. Thordarson approved of the plan and provided Sabu with two email addresses, one of which was his own, the other he said was Assange's, the transcripts show. 

“Let Julian know that if I send him message or you, with keyword ‘M' that means we have hacked server and are ready to distribute,” Sabu wrote. “After we work together on this project, you will see we can work together great. We do what we do and you can handle leaks properly. Without anyone knowing our relationship.”

On August 1, 2011, Sabu contacted Thordarson again. He said that he had successfully penetrated Icelandic government networks after finding a “weak point” and hacking a computer in the Icelandic Embassy in New York, according to the chat transcripts. Thordarson instructed Sabu to search for information about Icesave – and asked him if he wanted to become an “underground” volunteer for WikiLeaks. “No one will know who you are (Sabu) except me and Julian,” he wrote. 

Thordarson didn't know at the time that Sabu, whose real name was Hector Monsegur, was working with the FBI. Two months earlier, on June 7, 2011, Sabu had been arrested at his apartment in New York City and pressured to cooperate with the bureau as a confidential witness. His every move was watched by the FBI and his actions — including his claims about successfully hacking Icelandic government networks — were directed by his handlers, according to court documents.

Thordarson was in close proximity to Assange while the teenager was trying to solicit the hack on Icelandic government computers. But, based on the transcripts, it isn't clear how much the WikiLeaks founder knew about the teenager's actions.

To prove his identity to the hackers, Thordarson filmed a video of his computer screen, showing his discussion with a hacker named “tmesis” about “taking out Iceland government sites.” In the previously unpublished video, obtained by Bloomberg News, the camera pans up, and a blond-haired Assange can be seen sitting directly opposite Thordarson, wearing a white shirt and resting his chin on his hand. The hacker known as tmesis couldn't be located for comment.

Thordarson repeatedly tried to set up internet meetings between hackers and Assange, and the Wikileaks founder was aware of at least some of these efforts, according to the transcripts. In April 2011, Thordarson told Assange over an encrypted chat messenger that a “group of hackers offered there [sic] services to us called Gnosis.” The Gnosis hackers had targeted the U.S. news website Gawker and the Tunisian government, Thordarson wrote, redirecting Tunisian government websites to WikiLeaks. “Cute,” Assange responded. “How can we contact them?”

By the summer of 2011, Thordarson's relationship with Assange had become thorny. After Thordarson revealed plans for an upcoming WikiLeaks release to a reporter without having first consulted Assange, he was reprimanded. “Do not ever do this again,” Assange said, according to the transcripts. “I will defend you against all accusations, ring [sic] and wrong, and stick by you, as I have done, but I expect total loyalty in return.”

Thordarson drifted away from his work with WikiLeaks and began cooperating with the FBI. In Thordarson's absence, Assange continued to communicate with some of the hackers, who passed the organization several document dumps, including one from a U.S. intelligence consulting firm, according to the Justice Department's indictment. The firm has been previously identified as StratFor.

The case against Assange has been criticized by some press organizations who believe it could chill reporters' abilities to report on classified information. Gabe Rottman, director of the Technology and Press Freedom Project at the Reporters Committee for Freedom of the Press, said the indictment showed Assange allegedly engaged in conduct that “a newsroom legal counsel certainly wouldn't advise a reporter to do.” But some of the charges the Justice Department is pursuing, he said, pose a threat to press freedom because they rely on an unusual legal theory that argues the act of publishing classified information — which has historically been protected by the First Amendment — violates the Espionage Act. “The case is concerning,” Rottman said, “despite the ethical and practical distinctions between WikiLeaks and other news organizations.”

After falling out with Assange, Thordarson returned to Iceland, where he landed in trouble with the law. In separate legal cases between October 2013 and September 2015, Thordarson was sentenced to more than five years in an Icelandic prison for a string of offenses that included embezzlement, fraud and sexual abuse against minors. A psychological evaluation of his behavior characterized him as a sociopath, it was disclosed during his court case. 

©2020 Bloomberg L.P.