by Declan McCullagh, email@example.com
Part 2 of a Series: For two years a pair of anonymous Net crackpots have been posting angry tirades to a cryptography discussion list, in the form of a takeoff of Netly called "Nutly News". Now the FBI and Royal Canadian Mounted Police say that a digital signature connects them to a bomb discovered last June in a Canadian courthouse.
While the FBI was building its case against Toto south of the border, he was also raising eyebrows among the Royal Canadian Mounted Police. "He was the subject of an investigation related to a web page", says RCMP Cpl. Steve Foster. The web page, registered under the user name "carljohn", featured a clever demo of how an automated Assassination Politics Bot might work -- "for entertainment purposes only". The site has since been shut down, but it was housed at the Canadian Internet provider Sympatico -- the same one from which Toto had posted his harangues to the cypherpunks list.
For entertainment purposes or not, even hypothetical talk of assassinating government officials is enough to catch the attention of the Mounties. Cpl. Foster says he started to investigate Johnson for violations of sections 319(2) and 320 of the Canadian criminal code, which punish anyone who "wilfully promotes hatred against any identifiable group" -- the group in question here apparently being the Canadian government itself. The crime carries a sentence of up to two years in prison. When Johnson crossed the Canadian border this spring, the RCMP was on his trail.
"I advised Customs he had a laptop with him... Canadian customs got it", says Foster. The RCMP also raided a home in the remote hamlet of Bienfait, Sasketchewan, where Johnson grew up and where he sometimes stayed. To prove that Johnson was Toto (and, sometimes, TruthMonger), Foster compared logs of telephone calls from Johnson's Bienfait residence to the times when Toto's Sympatico account was used on March 25, 1998. The times reportedly matched.
Foster says he also searched Johnson's computer "for the contents of the web page". He found something that would eventually prove invaluable to his colleagues at the IRS: a computer file containing a PGP private key ring.
Agent Gordon seems not to have known about Johnson's Canadian problems until the RCMP seized Johnson's computers and Toto made the fatal mistake of complaining about them to his friends on cypherpunks. "Toto's computers were seized today by RCMP and Canadian Customs", says a post from April 1998. Gordon then apparently phoned the RCMP and began a series of conversations with Foster, who was more than happy to hand over Johnson's PGP key ring. Bingo. "Only the person possessing the secret key found on Johnson's computer could have generated the 'death threat' message", Gordon wrote in his complaint. (True enough, if Johnson was the only person with a copy of that PGP key ring. It's unlikely, but he could have given copies to his friends.) In other words, Gordon now believed he had airtight proof that the anonymous message -- including what he claims is a death threat against the President -- was linked to Johnson.
But since Gordon didn't get the PGP key until July, the RCMP still wasn't ready to arrest Johnson, and Johnson wasn't barred from returning to Bienfait this spring to visit with friends and relatives. During his stay, he allegedly drove to the courthouse of the nearby town of Estevan, a mere eight miles north of the North Dakota border. Johnson fancies himself something of an amateur legal scholar, and he did some research in the basement of the courthouse, local sources say. Johnson was well-known in Estevan. Nobody really thought much of it at the time.
That changed in mid-afternoon on June 3, 1998, when police found a bomb in the basement of the courthouse. The local cops think Johnson planted it; they say they found out about it when a youth whom he enlisted as part of the scheme saw the bomb, got spooked, fled with part of the device, and called the Canadian equivalent of 911. The would-be accomplice -- some reports say he looked only 12 or 13 -- was supposed to drop off a copy of the June 3 newspaper next to the bomb in order to give Johnson an alibi, says Estevan police sergeant Del Block. Johnson had returned to the U.S. a few days before and was hoping that the presence of a June 3 newspaper at the crime scene would prove he couldn't be the culprit, Block says. "This fellow realized it was more serious and called the police."
Would a real criminal mastermind trust a 12-year-old with a key portion of his alibi? Not a sane one. Which may be precisely the point: On closer inspection, the device that Canadian authorities had variously dubbed a "fire bomb" or an "incendiary explosive device" was hardly a Unabomber-style masterpiece. It consisted of a few bottles of gasoline set up like Molotov cocktails, a half dozen shotgun shells, and some wooden matches wedged into a laptop case, says Norm Park, a reporter for the weekly Estevan Mercury newspaper, who says he examined the device when police removed it; the RCMP found another one in the air conditioning units in the basement of the courthouse. But there was no way to set it off. "There was no major triggering device", says Park. "The RCMP couldn't quite figure out what he would use."
In the next installment: The feds track Johnson to Arizona, where he crashes a hacker convention and where the IRS finally runs him to ground. (Go to Part 3)
(Go back to Part 1)