Over soggy scrambled eggs at the Hyatt Regency in Lexington, Kentucky, Tor Ekeland is doing his best to cheer up Deric Lostutter, a 30-year-old hacker who is about to be sentenced to federal prison. “It’s terrifying,” Lostutter says.
“It is what it is,” replies Ekeland, a fast-talking 48-year-old lawyer who sports a neatly trimmed beard and a crisp blue suit for this morning’s hearing. “You’re going to know what your future is going to be after today. You know what I mean?”
Some four years earlier, Lostutter, a member of the hacker collective Anonymous, went after local authorities in Steubenville, Ohio, who he believed were covering up the rape of an unconscious 16-year-old girl by high school football players. He and another man hacked into the team’s fan site and posted a video in which Lostutter, wearing a Guy Fawkes mask, threatened to dox the players and local officials (post their private information online) if they didn’t apologize to the girl. The hack and its aftermath helped rebrand Anonymous as a force for legitimate activism. Not only were the rapists convicted, but an investigation led to the convictions of three school employees (on charges ranging from allowing underage drinking to obstructing official business). Lostutter pleaded guilty to lying to an FBI agent and violating the Computer Fraud and Abuse Act (CFAA).
After breakfast, Ekeland accompanied Lostutter to the courthouse, where a judge sentenced him to 24 months in prison—the maximum allowed under the plea deal and, despite Ekeland’s efforts, a year more than one of the Steubenville rapists had received. The prosecutor claimed the sentence would send a message that “hacks will be taken seriously as crimes, not as pranks or publicity stunts.” After the hearing, Ekeland countered that the sentence was really about “the DOJ being scared of the power of social media to organize social protests.”
Ekeland can sometimes come off a bit radical considering he used to be a corporate attorney in Manhattan. But six years ago he traded his fat paycheck for a not-so-lucrative private practice. Now he’s one of a handful of defense lawyers who specialize in computer crimes. “I’m much happier,” says Ekeland, who shows up at our first meeting in jeans and a black T-shirt. The corporate gig was boring, he explains—”it made me an alcoholic”—and he rarely saw a courtroom. When he first arrived in New York City prior to law school, he was involved in experimental theater, and it was the theatrical aspects of the court that prompted him to study law. Litigating “is super stressful,” he says. “I love it, though.”
His first client was a notorious internet troll named Andrew “Weev” Auernheimer, who was sentenced to 41 months in federal prison for exposing a flaw in an AT&T website that left tens of thousands of private email addresses vulnerable. “When Weev’s case came along,” Ekeland says, “I was like, ‘This is it!'” He managed to get his client freed on appeal—Auernheimer came out as a white supremacist not long afterward. Ekeland has been defending hackers ever since against charges ranging from probing the defenses of municipal websites to conspiring to access federal email accounts. Jay Leiderman, a California defense lawyer who shares the hacker niche, says Ekeland is “very good” at his job: “He steps up for the thankless shit and has a lot of stuff kicked back in his teeth. And he does it just because people need help.” (“The political act of resistance really appeals to me,” Ekeland says.)
Most of his cases involve the CFAA, a 1984 law reportedly passed after President Ronald Reagan watched WarGames—the 1983 thriller in which a teenage Matthew Broderick hacks into the mainframe controlling America’s nukes. Prosecutors say the CFAA is an essential tool for protecting the nation’s computers and networks, but critics view it as a ham-fisted law that results in ridiculously long sentences. Over the years, Congress has boosted penalties and expanded the range of chargeable offenses under the act, whose definition of a “protected computer” is so broad, according to the National Association of Criminal Defense Lawyers, that it could apply to “every computer connected to the Internet.”
Exhibit A for the law’s detractors is Aaron Swartz, the internet whiz kid who killed himself in 2013 while under indictment for downloading millions of copyrighted academic articles from a paywalled website. A team led by Carmen Ortiz, the former US attorney in Massachusetts, had threatened Swartz with up to 35 years in prison and $1 million in fines. “She will never be forgiven,” Ekeland says. “Ever.”
Another early Ekeland client was Fidel Salinas, who claims the US government tried (unsuccessfully) to get him to hack Mexican drug cartels after he was accused of probing a Texas county website for vulnerabilities. He was charged with 44 felony counts related to cyberstalking and computer fraud. Ekeland helped bring it down to a single misdemeanor conviction.
In one particularly crazy case, a client claimed he was slapped with child porn charges as part of an FBI attempt to cover up sensitive agency documents he’d obtained. (He also claimed the feds drugged and interrogated him, causing a psychotic break—the FBI won’t comment.) But Ekeland thrives on the insanity. “It becomes really hard to know what’s real,” he says. “Am I being a paranoid delusional person or is that actually true—or is that person lying to me? It’s kind of fun.” And then there was the time prosecutors accused Ekeland and his co-counsel of improperly accessing a classified document. “They were all indignant and basically accusing us of hacking the fucking FBI,” he recalls. In fact, the agency had posted the document publicly on its website.
Tee him up, and Ekeland is prone to launch into an extended tirade about the CFAA’s nefarious intent. “The government wants to be able to control information completely, because information is power and it allows you to control the narrative,” he says. Hackers “scare people. They make them feel vulnerable; there’s a hysteria about it.”
A legislative effort to curb prosecutorial overreach—Aaron’s Law, after Swartz—has stalled on Capitol Hill, and Ekeland isn’t optimistic about its prospects under the Trump administration. “All the good people I know at DOJ are leaving,” he says. “All the bottom-feeders and the people who wouldn’t have moved up are now going to float to the top.”
After Lostutter’s sentencing, he and Ekeland walk the half-mile back to the Hyatt, where they pick over leftovers from the breakfast buffet and talk about how Lostutter will spend his time in lockup. “You should write a book,” Ekeland tells him, still trying to be upbeat. “It’s funny. The universal advice for all my clients, because they have such interesting cases, is, ‘Take the time, write a book.'”
