In October 2015, a phone rings at a Verizon customer service center. The man on the line says he's a Verizon technician, his system is down, and he needs a colleague to pull up a customer's account for him. He reads out the customer's mobile number. The representative helps, because helping is the job, and a few minutes later the caller has the account number, the PIN, the backup email address, and the last four digits of the bank card on file.
The customer is John Brennan, the Director of the Central Intelligence Agency.
The caller is fifteen years old. He's in his bedroom in Coalville, a former mining town in Leicestershire, England, on his mother's internet connection. He hasn't written any malware and he hasn't exploited a single line of code. He has a telephone, and a voice that sounds older than it is.
Within ten days, the CIA Director's top secret clearance paperwork is on WikiLeaks.
So what was sitting in that inbox? Who were these kids? How does a phone call get you past the most secretive agency in the world? How far did it go before anyone stopped them? And what happened when they did?
Let's begin with the first question.
On the 18th of October 2015, the New York Post runs a story. Someone is claiming to have broken into the personal email of the Director of the CIA. Two days later, on the 20th, the CIA confirms it. On the 21st, WikiLeaks begins publishing the material under a plain title, "The Brennan Emails."
Inside the account was a contact list of roughly 2,611 names, email addresses, and instant messaging handles. The intruders pulled around 40 attachments. Some concerned intelligence and interrogation policy. One was a draft of Brennan's SF-86, the Questionnaire for National Security Positions. It's the 47 page form you fill out to apply for a top secret clearance, and it asks for everything. Social Security numbers, addresses going back years, foreign contacts, relatives, finances. Not just for the applicant, but for the people around him.
One detail matters more than all the rest. This was not a government system. It was a private AOL account. Brennan had forwarded work to himself, the way a lot of people do. No classified network was touched. The head of the CIA was reached through a consumer webmail address that anyone can sign up for in about ninety seconds.
Officials leaned on that distinction. No classified information was compromised. Which is true, and also beside the point, because the clearance file of the man who runs the CIA was never meant to be sitting in an AOL inbox in the first place.
While the agency is still confirming the breach, a Twitter account is already bragging about it. The handle is @CWA. The person behind it calls himself Cracka.
Let's go back.
Kane Gamble was born on the 2nd of October 1999. He lives with his mother in Coalville, a town built on coal that closed its last pit in the early nineties. He is fifteen when he starts working on John Brennan. By the time the New York Post prints the story, he has been sixteen for sixteen days.
The group he founds calls itself Crackas With Attitude. It describes itself as pro-Palestinian, and it frames every attack as a protest against American foreign policy and the treatment of Palestinians in particular. That framing is going to matter later, in two courtrooms on two continents.
Within days of the Brennan hack, an American joins. Justin Gray Liverman lives in Morehead City, North Carolina, and goes by D3F4ULT. He congratulates Cracka and pushes for more targets. Andrew Otto Boggs, also from North Carolina, calls himself INCURSIO. Two more British teenagers appear in the court filings only as Derp, who is seventeen, and Cubed, who is fifteen. They are never publicly named because of their age.
That's the whole crew. Five people, maybe six. Most of them have never met in person. Crackas With Attitude exists for about four months, from October 2015 to February 2016, and in that time it gets further into the American security establishment than most groups with far better tools ever have.
So how do you get into the CIA Director's inbox with a phone?
The answer is that you never go anywhere near the CIA. You go to the companies that hold his personal life.
Step one is a phone number. Brennan's personal mobile. How exactly the crew obtained it has never been fully spelled out in public. What matters is what a mobile number tells you, which is who the carrier is. In this case, Verizon.
Step two is Verizon. The caller says he is a Verizon employee. He needs help on a customer account because his own system isn't working. He has the phone number. The representative looks it up and reads back what the caller asks for: the account number, the PIN, the backup email address on file, and the last four digits of the bank card.
Step three is AOL. Now the caller is John Brennan. He's locked out of his email and needs a password reset. AOL asks security questions to verify identity, and the caller answers them with what Verizon handed over a few minutes earlier. The password is reset. The inbox opens.
That's the entire attack. Two phone calls.
Those four details are ordinary things: an account number, a PIN, a backup email address, and the last four digits of a card. We don't know exactly which of them AOL asked for on the call. What the record shows is that between them, they were enough. And none of the four are secret in any meaningful sense. They're things a bank teller, a shop assistant, or a phone company representative sees every day. Stacked together, in the right order, on the right afternoon, they are the keys to the CIA Director's correspondence.
Why does it work? Because both systems are built to be helpful. A support representative takes hundreds of calls a week, most of them from real customers who are annoyed and locked out. The job is to solve that. A calm voice with the right four details is indistinguishable from the account holder, because the right four details are the only thing the system ever asked for. There is no software flaw in this story. There is a process that trusts whoever knows the answers, and the answers were sitting with a second company that trusts whoever sounds like a colleague.
One member of the crew told reporters that "a 5-year-old could have hacked" these accounts. It was meant as a taunt. It's also a fairly precise description.
He never broke into the CIA. He asked to be let in, and someone said yes.
Inside, the crew finds the 2,611 contacts and the 40 attachments, the SF-86 among them. They pass the material to WikiLeaks. And then they do the thing that, in the end, matters more than any of it. They post about it.
October turns into November, and the crew gets louder.
James Clapper is the Director of National Intelligence. He sits above the CIA, the NSA, and fifteen other agencies, and reports directly to the President. The crew reaches his home Verizon FiOS account. This time they don't read anything. They change where his phone rings. Calls to the Clapper household are forwarded to the Free Palestine Movement. For a while, if you dialled the man who oversees all of American intelligence at home, an activist group picked up.
The list grows. Mark Giuliano, Deputy Director of the FBI. Avril Haines, the deputy national security adviser at the White House. The crew makes harassing calls, some of them to family members. It spoofs caller IDs so that a victim's phone shows a number they recognise. It defaces social media accounts and posts what it finds.
Then comes the jump from inboxes to government systems.
Jeh Johnson is the Secretary of Homeland Security. Using credentials tied to him, Cracka reaches something called the Law Enforcement Enterprise Portal, or LEEP. It's an FBI-run gateway that lets police departments and federal agencies share information with each other. From there, he reaches the Joint Automated Booking System, JABS, which is the federal database of arrests and bookings. He tweets screenshots that he says show the booking records of Jeremy Hammond, a hacktivist serving a federal sentence at the time.
Follow the chain. A consumer phone account gets you an email account. An email account gets you a set of credentials. The credentials get you into a portal built for police officers. And a teenager in the English Midlands is now looking at the same arrest database as an FBI field office.
Every step is posted. That is the point. A protest nobody sees isn't a protest, and Crackas With Attitude wants to be seen. But every tweet is also a timestamp. Every screenshot is a claim that can be checked against a server log. And the handle stays the same for months.
The bragging is the message. It's also the trail.
Compare what the crew said it was doing with what it did. The stated cause was Palestine and American foreign policy. The people it reached were senior officials who make that policy, which fits. But the methods were harassing phone calls to families, spoofed numbers, and a publicly posted arrest record for a man who was already in prison. Whatever the politics, none of that touches a single decision in Washington. It touches a household in Virginia at dinner time. The gap between the language of protest and the shape of the harassment is one the judges on both sides of the Atlantic will come back to.
February 2016. A list appears online. It contains the names, job titles, phone numbers, and email addresses of about 20,000 FBI employees and roughly 9,000 employees of the Department of Homeland Security. Early reports put the DHS figure closer to 10,000 before the larger set surfaced. The Justice Department and DHS open a joint investigation.
Twenty-nine thousand people. Picture a town of thirty thousand where every single resident works in federal law enforcement, and now anyone with an internet connection can find their desk phone. Agents, analysts, support staff, people who had never made a decision about anyone's foreign policy.
But by the time the list goes up, the investigation into who posted it is already well down the road.
On the 9th of February 2016, police officers arrive at Kane Gamble's mother's house in Coalville. He is sixteen years old. He is arrested.
Seven months later, on the 8th of September 2016, the FBI and the Secret Service move on two addresses in North Carolina. Andrew Boggs and Justin Liverman are arrested the same day.
How did investigators get from a Twitter handle to a bedroom in Leicestershire? Here we have to be honest about the limits of what's public. The exact investigative chain, which tip, which log, which request to which company, has never been laid out in full. Court documents in the United States and the sentencing remarks in Britain describe what the crew did. They don't narrate how the crew was found.
What the record does show is a group that named itself, announced each victim before the victim knew, and posted its trophies under the same handle for four months. It shows a crew whose entire method depended on phone calls, and phone calls to Verizon and AOL are logged by Verizon and AOL. It shows a co-conspirator in North Carolina who was, by his own later account, openly enthusiastic about the whole thing.
The American prosecution documents describe Liverman's role plainly. He joins in the days after Brennan's account falls, congratulates Cracka, and pushes the group toward new targets. He is not the one making the Verizon call. He is the one asking who's next. In a conspiracy case, that distinction matters less than you might think, and it's going to matter a great deal to how his sentence compares to everyone else's.
That account exists. In November 2023, Justin Liverman told his side of the story on the Darknet Diaries podcast, episode 139. It's a participant's version, told years later by someone who had already served his sentence, and we weigh it that way. But it is the only first-person telling of what it was like inside Crackas With Attitude, and it's worth your time.
So what did it cost them?
Andrew Boggs pleads guilty first. In June 2017 a federal court sentences him to 24 months in prison.
Justin Liverman pleads guilty on the 6th of January 2017 to a single conspiracy count. On the 8th of September 2017, exactly one year after his arrest, the Eastern District of Virginia sentences him to 60 months. Five years. That is the statutory maximum for the charge. Prosecutors put the group's combined harm at at least ten victims and roughly 1.5 million dollars in damages, and attribute about 95,000 dollars of that to Liverman directly.
Kane Gamble's case takes longer. He pleads guilty to ten charges under Britain's Computer Misuse Act, eight of securing unauthorised access to computer material and two of unauthorised modification.
On the 20th of April 2018, he is sentenced at the Old Bailey by Mr Justice Haddon-Cave. The judge calls the campaign "an extremely nasty campaign of politically motivated cyber-terrorism." He says the victims "would have felt seriously violated." The defence has argued that Gamble is autistic, and the judge addresses this directly. He says he is not satisfied that any autism spectrum disorder goes beyond a very mild degree.
The sentence is two years in youth detention.
Lay the three numbers next to each other. Boggs, who joined, gets two years. Gamble, who founded the group, chose the targets, and did the talking, gets two years. Liverman, who arrived days after Brennan's account had already fallen, gets five.
Some of that is age. Gamble was a child under British law when he started and was sentenced in a system built to treat children differently. Some of it is jurisdiction. The Americans were adults, prosecuted in the federal district that handles more national security cases than almost any other in the country. And some of it is simply that two legal systems looked at the same conspiracy and reached different conclusions about what it was worth.
The same phone calls. Two years in one country, five in another.
But none of the sentences change what happened to the people on the other end.
Brennan's SF-86 didn't just hold his own history. The form asks for the Social Security numbers, birthdates, and addresses of a spouse, of relatives, of references. People who had never worked for the CIA and never would, whose only connection to any of this was knowing John Brennan, had their identities published by WikiLeaks under a title with his name on it.
Twenty-nine thousand FBI and DHS employees had their names and contact details put online because of a protest they had no part in. Analysts, clerks, someone who processes travel forms in a regional office. The list didn't distinguish between them, and neither did the people who downloaded it.
In the Clapper household, the family phone rang for a movement none of them had ever contacted. In other homes, the calls came directly. Some of the people who picked up were relatives of the targets, not the targets themselves.
And in Coalville, a sixteen year old was taken out of his mother's house by police, and two years later was described in the Old Bailey as a terrorist.
After going through the court records, the press coverage, and the participants' own words, this is where we land. And this part is our opinion.
The most secretive agency in the United States was reached by a child who was polite on the phone. That is an indictment of the systems around powerful people: the habit of forwarding work to a personal inbox, the support lines that hand over a PIN to whoever sounds like a colleague, the assumption that security is something that happens on a classified network and not on a customer service call. It is also, in a quieter way, an indictment of the systems around a fifteen year old in a former mining town who had the ability to do this and nobody in the room to stop him. Those two failures don't cancel each other out. They sit side by side.
These are the facts. Do with them what you want.
If you want to go further than we could, Liverman's own account is on Darknet Diaries and the Old Bailey sentencing remarks are published in full. And unfortunately we're YouTubers, so we'd encourage you to read both. Hopefully you enjoyed this one. You can find more of our work on screen.
