The Netly News
Wednesday, September 16, 1998

The Arrest of the Nutly Bomber

Part 3 of a Series: Carl Johnson, itinerant Netizen and soon-to-be mental patient, has been linked to the pseudonymous "Toto" - who has been posting angry tirades to a cryptography discussion list - and to a bomb discovered last June in a Canadian courthouse. In this installment, he heads south to Nevada and a Vegas hacker convention.

by Declan McCullagh, thenetlynews@pathfinder.com

On June 8, a few days after the Canadians discovered the bomblet in the courthouse basement, an anonymous message appeared in my inbox, encrypted to my PGP key. The decoded text: "Declan, You might want to notify the RCMP that there are bombs in two public buildings 11 kilometers from Mongeritaville, home of the Bienfait Nutly News. Then again, you might not..."

Was it Toto trying to tip me off, or was someone else trying to mess with my mind? I don't think I'd ever communicated with Toto directly, so why would he contact me? Besides, five days before, the Estevan police had fired off a press release ("an incendiary device was found in the Estevan Court House"), so the attempted bombing was public knowledge.

Around the same time, Carl Johnson showed up at the Tucson, Ariz., home of a longtime friend, Linda Reed. Soon Toto's inimitable form of online performance art started popping up on the cypherpunks list again, this time from Reed's account at Pima College, where she was an adjunct professor of computer science. Toto's first message not only mentioned nuking Washington, D.C. (in passing, to be fair), but also spoke of "MenInTheShadows unable to find the second VirtualNuclear Device claimed to have been planted in a public building."

Imagine how that struck the feds, who notably lack a sense of humor when the discussion turns to nuclear strikes on the nation's capital. "They were knocking on my door a couple weeks later", Reed says. Agent Jeremy Sheridan interviewed Johnson on July 31. "Johnson admitted that he often wrote on the Internet and among the names he used were Toto, C.J. Parker, and TruthMonger", the government's complaint claims. Johnson allegedly admitted to Sheridan that he wrote the so-called death threat and that he had psychological problems.

"They talked to him before I came home one night", Reed says. "They said, 'Why are you using that other person's account? Get your own account so you don't take anyone else to jail with you.'" Reed says she was "called into the Secret Service office the next day", where Sheridan quizzed her about Johnson. They told her they wanted to understand exactly how his mind worked. Reed says she lost her part-time teaching job thanks to her friend's more incendiary posts. "Apparently someone had sent a letter to the vice chancellor - someone in Turkey whom C.J. had criticized for his torture techniques", she says. When we contacted him, Sheridan declined to comment.

But Toto was as loquacious as ever, firing off e-mail not just to cypherpunks but also in connection with DefCon, a hacker convention taking place that weekend in Las Vegas. Soon he was on the road again - this time heading for Nevada. One person he reportedly said he wanted to meet at DefCon was a Chicago-area security consultant who spoke with us only on the condition that he remain anonymous. He got spooked by Toto's darkly rambling e-mail entitled "Buttfuck Me Jesus, Through The Bedposts Of Life". "I immediately sent something off to the administrator of the Pima account", the consultant says. "Next thing you know I get a phone call from the Tucson Secret Service asking what's my connection with this person... I would have Maced the fucker right there."

DefCon has always been less a convention than a no-holds-barred party for hackers, crackers, and generally underage geeks. Evening entertainment customarily involves tunneling into the hotel's security system, seizing control of the telephones, and generally building toward a barely controlled riot - until the hotel cops put an end to the fun. Even here, Toto stood out. "To be perfectly honest, he's crazy", says cypherpunk Marc Briceno, who spoke at the convention on August 2. "He approached me after I gave my speech on smart cards and gave me an envelope", Briceno says. Inside it was a disk wrapped in a printout, he says, which described how to manufacture a diskette bomb. Briceno eventually threw it away.

In the next installment: Carl Johnson is arrested and antagonizes the feds even more - if that's possible. (Go to Part 4)

(Go to Part 1)

Copyright © 1998 by TIME Digital. All Rights Reserved. Reprinted with permission.