![](\"https:\/\/media.wired.com\/photos\/5acd014589dd2039fecb0dd8\/master\/pass\/xboxunderground_notext.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Brendan I. Koerner| Date: Tue, 17 Apr 2018 10:00:00 +0000<\/strong><\/p>\n The trip to <\/span>Delaware was only supposed to last a day. David Pokora, a bespectacled University of Toronto senior with scraggly blond hair down to his shoulders, needed to travel south to fetch a bumper that he\u2019d bought for his souped-up Volks\u00adwagen Golf R.<\/p>\n The American seller had balked at shipping to Canada, so Pokora arranged to have the part sent to a buddy, Justin May, who lived in Wilmington. The young men, both ardent gamers, shared a fascination with the inner workings of the Xbox<\/a>; though they\u2019d been chatting and collaborating for years, they\u2019d never met in person. Pokora planned to make the eight-hour drive on a Friday, grab a leisurely dinner with May, then haul the metallic-blue bumper back home to Mississauga, Ontario, that night or early the next morning. His father offered to tag along so they could take turns behind the wheel of the family\u2019s Jetta.<\/p>\n An hour into their journey on March 28, 2014, the Pokoras crossed the Lewiston\u2013Queenston Bridge and hit the border checkpoint on the eastern side of the Niagara Gorge. An American customs agent gently quizzed them about their itinerary as he scanned their passports in his booth. He seemed ready to wave the Jetta through when something on his monitor caught his eye.<\/p>\n \u201cWhat\u2019s \u2026 Xenon?\u201d the agent asked, stumbling over the pronunciation of the word.<\/p>\n David, who was in the passenger seat, was startled by the question. Xenon was one of his online aliases, a pseudonym he often used\u2014along with Xenomega and DeToX\u2014when playing Halo<\/em><\/a> or discussing his Xbox hacking projects with fellow programmers. Why would that nickname, familiar to only a handful of gaming fanatics, pop up when his passport was checked?<\/p>\n Pokora\u2019s puzzlement lasted a few moments before he remembered that he\u2019d named his one-man corporation Xenon Development Studios; the business processed payments for the Xbox service he operated that gave monthly subscribers the ability to unlock achievements or skip levels in more than 100 different games. He mentioned the company to the customs agent, making sure to emphasize that it was legally registered. The agent instructed the Pokoras to sit tight for just a minute longer.<\/p>\n May 2018. Subscribe to WIRED<\/a>.<\/p>\n As he and his father waited for permission to enter western New York, David detected a flutter of motion behind the idling Jetta. He glanced back and saw two men in dark uniforms approaching the car, one on either side. \u201cSomething\u2019s wrong,\u201d his father said, an instant before a figure appeared outside the passenger-\u00adside window. As a voice barked at him to step out of the vehicle, Pokora realized he\u2019d walked into a trap.<\/p>\n In the detention area of the adjoining US Customs and Border Protection building, an antiseptic room with a lone metal bench, Pokora pondered all the foolish risks he\u2019d taken while in thrall to his Xbox obsession. When he\u2019d started picking apart the console\u2019s software a decade earlier, it had seemed like harmless fun\u2014a way for him and his friends to match wits with the corporate engineers whose ranks they yearned to join. But the Xbox hacking scene had turned sordid over time, its ethical norms corroded by the allure of money, thrills, and status. And Pokora had gradually become enmeshed in a series of schemes that would have alarmed his younger self: infiltrating game developers\u2019 networks, counterfeiting an Xbox prototype, even abetting a burglary on Microsoft\u2019s main campus<\/a>.<\/p>\n Pokora had long been aware that his misdeeds had angered some powerful interests, and not just within the gaming industry; in the course of seeking out all things Xbox, he and his associates had wormed into American military networks too. But in those early hours after his arrest, Pokora had no clue just how much legal wrath he\u2019d brought upon his head: For eight months he\u2019d been under sealed indictment for conspiring to steal as much as $1 billion worth of intellectual property, and federal prosecutors were intent on making him the first foreign hacker to be convicted for the theft of American trade secrets. Several of his friends and colleagues would end up being pulled into the vortex of trouble he\u2019d helped create; one would become an informant, one would become a fugitive, and one would end up dead.<\/p>\n Pokora could see his father sitting in a room outside the holding cell, on the other side of a thick glass partition. He watched as a federal agent leaned down to inform the elder Pokora, a Polish-born construction worker, that his only son wouldn\u2019t be returning to Canada for a very long time; his father responded by burying his head in his calloused hands.<\/p>\n Gutted to have caused the usually stoic man such anguish, David wished he could offer some words of comfort. \u201cIt\u2019s going to be OK, dad,\u201d he said in a soft voice, gesturing to get his attention. \u201cIt\u2019s going to be OK.\u201d But his father couldn\u2019t hear him through the glass.<\/p>\n Well before he <\/span>could read or write, David Pokora mastered the intricacies of first-person shooters. There is a grainy video of him playing Blake Stone: Aliens of Gold<\/em> in 1995, his 3-year-old fingers nimbly dancing around the keyboard of his parents\u2019 off-brand PC. What captivated him about the game was not its violence but rather the seeming magic of its controls; he wondered how a boxy beige machine could convert his physical actions into onscreen motion. The kid was a born programmer.<\/p>\n Pokora dabbled in coding throughout elementary school, building tools like basic web browsers. But he became wholly enamored with the craft as a preteen on a family trip to Poland. He had lugged his bulky laptop to the sleepy town where his parents\u2019 relatives lived. There was little else to do, so as chickens roamed the yards he passed the time by teaching himself the Visual Basic .NET programming language. The house where he stayed had no internet access, so Pokora couldn\u2019t Google for help when his programs spit out errors. But he kept chipping away at his code until it was immaculate, a labor-intensive process that filled him with unexpected joy. By the time he got back home, he was hooked on the psychological rewards of bending machines to his will.<\/p>\n As Pokora began to immerse himself in programming, his family bought its first Xbox. With its ability to connect to multiplayer sessions on the Xbox Live service and its familiar \u00adWindows-derived architecture, the machine made Pokora\u2019s Super Nintendo seem like a relic. Whenever he wasn\u2019t splattering aliens in Halo<\/em>, Pokora scoured the internet for technical information about his new favorite plaything. His wanderings brought him into contact with a community of hackers who were redefining what the Xbox could do.<\/p>\n To divine its secrets, these hackers had cracked open the console\u2019s case and eavesdropped on the data that zipped between the motherboard\u2019s various components\u2014the CPU, the RAM, the Flash chip. This led to the discovery of what the cryptography expert Bruce Schneier<\/a> termed \u201clots of kindergarten security mistakes.\u201d For example, Microsoft had left the decryption key for the machine\u2019s boot code lying around in an accessible area of the machine\u2019s memory. When an MIT graduate student named Bunnie Huang located that key in 2002, he gave his hacker compatriots the power to trick the Xbox into booting up homebrew programs that could stream music, run Linux, or emulate Segas and Nintendos. All they had to do first was tweak their consoles\u2019 firmware, either by soldering a so-called modchip onto the motherboard or loading a hacked game-save file from a USB drive.<\/p>\n Once Pokora hacked his family\u2019s Xbox, he got heavy into tinkering with his cherished Halo<\/em>. He haunted IRC channels and web forums where the best Halo<\/em> programmers hung out, poring over tutorials on how to alter the physics of the game. He was soon making a name for himself by writing Halo 2<\/em> utilities that allowed players to fill any of the game\u2019s landscapes with digitized water or change blue skies into rain.<\/p>\n The hacking free-for-all ended with the release of the second-generation Xbox, the Xbox 360, in November 2005. The 360 had none of the glaring security flaws of its predecessor, to the chagrin of programmers like the 13-year-old Pokora who could no longer run code that hadn\u2019t been approved by Microsoft. There was one potential workaround for frustrated hackers, but it required a rare piece of hardware: an Xbox 360 development kit.<\/p>\n Dev kits are the machines that Microsoft-approved developers use to write Xbox content. To the untrained eye they look like ordinary consoles, but the units contain most of the software integral to the game development process, including tools for line-by-line debugging. A hacker with a dev kit can manipulate Xbox software just like an authorized programmer.<\/p>\n Microsoft sends dev kits only to rigorously screened game-development companies. In the mid-2000s a few kits would occasionally become available when a bankrupt developer dumped its assets in haste, but for the most part the hardware was seldom spotted in the wild. There was one hacker, however, who lucked into a mother lode of 360 dev kits and whose eagerness to profit off his good fortune would help Pokora ascend to the top of the Xbox scene.<\/p>\n Meet the cast of characters behind the Xbox Underground.<\/span><\/p>\n Gifted Canadian hacker and the brains of the Xbox Underground.<\/span><\/p>\n Programmer who made millions by tricking FIFA Soccer<\/em> into minting virtual coins.<\/span><\/p>\n Australian teenage hacker who turned reckless as the FBI closed in.<\/span><\/p>\n Pokora's friend in Delaware, arrested in 2010 for trying to steal a game's source code.<\/span><\/p>\n Abruptly vanished from the Xbox hacking scene, causing widespread paranoia.<\/span><\/p>\n Owner of a hacked modem that he used to help the Xbox Underground steal software.<\/span><\/p>\n In 2006, while <\/span>working as a Wells Fargo technology manager in Walnut Creek, California, 38-year-old Rowdy Van Cleave learned that a nearby recycling facility was selling Xbox DVD drives cheap. When he went to inspect the merchandise, the facility\u2019s owners mentioned they received regular deliveries of surplus Microsoft hardware. Van Cleave, who\u2019d been part of a revered Xbox-hacking crew called Team Avalaunch, volunteered to poke around the recyclers\u2019 warehouse and point out any Xbox junk that might have resale value.<\/p>\n After sifting through mountains of Xbox flotsam and jetsam, Van Cleave talked the recyclers into letting him take home five motherboards. When he jacked one of them into his Xbox 360 and booted it up, the screen gave him the option to activate debugging mode. \u201cHoly shit,\u201d Van Cleave thought, \u201cthis is a frickin\u2019 dev motherboard!\u201d<\/p>\n Aware that he had stumbled on the Xbox scene\u2019s equivalent of King Tut\u2019s tomb, Van Cleave cut a deal with the recyclers that let him buy whatever discarded Xbox hardware came their way. Some of these treasures he kept for his own sizable collection or handed out to friends; he once gave another Team Avalaunch member a dev kit as a wedding present. But Van Cleave was always on the lookout for paying customers he could trust to be discreet.<\/p>\n The 16-year-old Pokora became one of those customers in 2008, shortly after meeting Van Cleave through an online friend and impressing him with his technical prowess. In addition to buying kits for himself, Pokora acted as a salesman for Van Cleave, peddling hardware at significant markup to other Halo<\/em> hackers; he charged around $1,000 per kit, though desperate souls sometimes ponied up as much as $3,000. (Van Cleave denies that Pokora sold kits on his behalf.) He befriended several of his customers, including a guy named Justin May who lived in Wilmington, Delaware.<\/p>\n Now flush with dev kits, Pokora was able to start modifying the recently released Halo<\/em> 3. He kept vampire hours as he hacked, coding in a trancelike state that he termed \u201chyperfocus\u201d until he dropped from exhaustion at around 3 or 4 am. He was often late for school, but he shrugged off his slumping grades; he considered programming on his dev kit to be the only education that mattered.<\/p>\n Pokora posted snippets of his Halo<\/em> 3 work on forums like Halomods.com, which is how he came to the attention of a hacker in Whittier, California, named Anthony Clark. The 18-year-old Clark had experience disassembling Xbox games\u2014reverse-engineering their code from machine language into a programming language. He reached out to Pokora and proposed that they join forces on some projects.<\/p>\n Clark and Pokora grew close, talking nearly every day about programming as well as music, cars, and other adolescent fixations. Pokora sold Clark a dev kit so they could hack Halo 3<\/em> in tandem; Clark, in turn, gave Pokora tips on the art of the disassembly. They \u00adcowrote a Halo 3<\/em> tool that let them endow the protagonist, Master Chief, with special skills\u2014like the ability to jump into the clouds or fire weird projectiles. And they logged countless hours playing their hacked creations on PartnerNet, a sandbox version of Xbox Live available only to dev kit owners.<\/p>\n As they released bits and pieces of their software online, Pokora and Clark began to hear from engineers at Microsoft and Bungie, the developer behind the Halo<\/em> series. The professional programmers offered nothing but praise, despite knowing that Pokora and Clark were using ill-gotten dev kits. Cool, you did a good job of reverse-engineering this<\/em>, they\u2019d tell Pokora. The encouraging feedback convinced him that he was on an unorthodox path to a career in game development\u2014perhaps the only path available to a construction worker\u2019s son from Mississauga who was no classroom star.<\/p>\n But Pokora and Clark occasionally flirted with darker hijinks. By 2009 the pair was using PartnerNet not only to play their modded versions of Halo 3<\/em> but also to swipe unreleased software that was still being tested. There was one Halo\u00a03<\/em> map that Pokora snapped a picture of and then shared too liberally with friends; the screenshot wound up getting passed around among Halo<\/em> fans. When Pokora and Clark next returned to PartnerNet to play Halo\u202f3<\/em>, they encountered a message on the game\u2019s main screen that Bungie engineers had expressly left for them: \u201cWinners Don\u2019t Break Into PartnerNet.\u201d<\/p>\n The two hackers laughed off the warning. They considered their mischief all in good fun\u2014they\u2019d steal a beta here and there, but only because they loved the Xbox so much, not to enrich themselves. They saw no reason to stop playing cat and mouse with the Xbox pros, whom they hoped to call coworkers some day.<\/p>\n The Xbox 360 <\/span>remained largely invulnerable until late 2009, when security researchers finally identified a weakness: By affixing a modchip to an arcane set of motherboard pins used for quality-assurance testing, they managed to nullify the 360\u2019s defenses. The hack came to be known as the JTAG, after the Joint Test Action Group, the industry body that had recommended adding the pins to all printed circuit boards in the mid-1980s.<\/p>\n When news of the vulnerability broke, Xbox 360 owners rushed to get their consoles JTAGed by services that materialized overnight. With 23 million subscribers now on Xbox Live, multi\u00adplayer gaming had become vastly more competitive, and a throng of gamers whom Pokora dubbed \u201cspoiled kids with their parents\u2019 credit cards\u201d were willing to go to extraordinary lengths to humiliate their rivals.<\/p>\n For Pokora and Clark, it was an opportunity to cash in. They hacked the Call of Duty<\/em> series<\/a> of military-themed shooters to create so-called modded lobbies\u2014places on Xbox Live where Call of Duty<\/em> players could join games governed by reality-bending rules. For fees that ranged up to $100 per half-hour, players with JTAGed consoles could participate in death matches while wielding superpowers: They could fly, walk through walls, sprint with Flash-like speed, or shoot bullets that never missed their targets.<\/p>\n For an extra $50 to $150, Pokora and Clark also offered \u201cinfections\u201d\u2014powers that players\u2019 characters would retain when they joined nonhacked games. Pokora was initially reluctant to sell infections: He knew his turbocharged clients would slaughter their hapless opponents, a situation that struck him as contrary to the spirit of gaming. But then the money started rolling in\u2014as much as $8,000 on busy days. There were so many customers that he and Clark had to hire employees to deal with the madness. Swept up in the excitement of becoming an entrepreneur, Pokora forgot all about his commitment to fairness. It was one more step down a ladder he barely noticed he was descending.<\/p>\n Microsoft tried to squelch breaches like the Call of Duty<\/em> cheats by launching an automated system that could detect JTAGed consoles and ban them. But Pokora reverse-engineered the system and devised a way to beat it: He wrote a program that hijacked Xbox Live\u2019s security queries to an area of the console where they could be filled with false data, and thus be duped into certifying a hacked console.<\/p>\n Pokora reveled in the perks of his success. He still lived with his parents, but he paid his tuition as he entered the University of Toronto in the fall of 2010. He and his girlfriend dined at upscale restaurants every night and stayed at $400-a-night hotels as they traveled around Canada for metal shows. But he wasn\u2019t really in it for the money or even the adulation of his peers; what he most coveted was the sense of glee and power he derived from making $60\u00a0million games behave however he wished.<\/p>\n Pokora knew there was a whiff of the illegal about his Call of Duty<\/em> business, which violated numerous copyrights. But he interpreted the lack of meaningful pushback from either Microsoft or Activision, Call of Duty<\/em>\u2019s developer, as a sign that the companies would tolerate his enterprise, much as Bungie had put up with his Halo 3<\/em> shenanigans. Activision did send a series of cease-and-desist letters, but the company never followed through on its threats.<\/p>\n \u201cI mean, it\u2019s just videogames,\u201d Pokora told himself whenever another Activision letter arrived. \u201cIt\u2019s not like we\u2019re hacking into a server or stealing anyone\u2019s information.\u201d That would come soon enough.<\/p>\n Dylan Wheeler, a <\/span>hacker in Perth, Australia, whose alias was SuperDaE, knew that something juicy had fallen into his lap. An American friend of his who went by the name Gamerfreak had slipped him a password list for the public forums operated by Epic Games<\/a>, a Cary, North Carolina, game developer known for its Unreal<\/em> and Gears of War<\/em> series. In 2010 Wheeler started poking around the forums\u2019 accounts to see if any of them belonged to Epic employees. He eventually identified a member of the company\u2019s IT department whose employee email address and password appeared on Gamerfreak\u2019s list; rummaging through the man\u2019s personal emails, Wheeler found a password for an internal EpicGames.com account.<\/p>\n Once he had a toehold at Epic, Wheeler wanted a talented partner to help him sally deeper into the network. \u201cWho is big enough to be interested in something like this?\u201d he wondered. Xenomega\u2014David Pokora\u2014whom he\u2019d long admired from afar and was eager to befriend, was the first name that popped to mind. Wheeler cold-messaged the Canadian and offered him the chance to get inside one of the world\u2019s preeminent game developers; he didn\u2019t mention that he was only 14, fearing that his age would be a deal breaker.<\/p>\n What Wheeler was proposing was substantially shadier than anything Pokora had attempted before: It was one thing to download Halo<\/em> maps from the semipublic PartnerNet and quite another to break into a fortified private network where a company stores its most sensitive data. But Pokora was overwhelmed by curiosity about what software he might unearth on Epic\u2019s servers and titillated by the prospect of reverse-engineering a trove of top-secret games. And so he rationalized what he was about to do by setting ground rules\u2014he wouldn\u2019t take any credit card numbers, for example, nor peek at personal information about Epic\u2019s customers.<\/p>\n Pokora and Wheeler combed through Epic\u2019s network by masquerading as the IT worker whose login credentials Wheeler had compromised. They located a plugged-in USB drive that held all of the company\u2019s passwords, including one that gave them root access to the entire network. Then they pried into the computers of Epic bigwigs such as design director Cliff \u201cCliffyB\u201d Bleszinski; the pair chortled when they opened a music folder that Bleszinski had made for his Lamborghini and saw that it contained lots of Katy Perry and Miley Cyrus tunes. (Bleszinski, who left Epic in 2012, confirms the hackers\u2019 account, adding that he\u2019s \u201calways been public and forthright about my taste for bubblegum pop.\u201d)<\/p>\n To exfiltrate Epic\u2019s data, Wheeler enlisted the help of Sanadodeh \u201cSonic\u201d Nesheiwat, a New Jersey gamer who possessed a hacked cable modem that could obfuscate its location. In June 2011 Nesheiwat downloaded a prerelease copy of Gears of War 3<\/em> from Epic, along with hundreds of gigabytes of other software. He burned Epic\u2019s source code onto eight Blu-ray discs that he shipped to Pokora in a package marked wedding videos. Pokora shared the game with several friends, including his dev kit customer Justin May; within days a copy showed up on the Pirate Bay, a notorious BitTorrent site.<\/p>\n The Gears of War 3<\/em> leak triggered a federal investigation, and Epic began working with the FBI to determine how its security had been breached. Pokora and Wheeler found out about the nascent probe while reading Epic\u2019s emails; they freaked out when one of those emails described a meeting between the company\u2019s brain trust and FBI agents. \u201cI need your help\u2014I\u2019m going to get arrested,\u201d a panicked Pokora wrote to May that July. \u201cI need to encrypt some hard drives.\u201d<\/p>\n But the email chatter between Epic and the FBI quickly died down, and the company made no apparent effort to block the hackers\u2019 root access to the network\u2014a sign that it couldn\u2019t pinpoint their means of entry. Having survived their first brush with the law, the hackers felt emboldened\u2014the brazen Wheeler most of all. He kept trespassing on sensitive areas of Epic\u2019s network, making few efforts to conceal his IP address as he spied on high-level corporate meetings through webcams he\u2019d commandeered. \u201cHe knowingly logs into Epic knowing that the feds chill there,\u201d Nesheiwat told Pokora about their Australian partner. \u201cThey were emailing FBI people, but he still manages to not care.\u201d<\/p>\n Owning Epic\u2019s network gave the hackers entr\u00e9e to a slew of other organizations. Pokora and Wheeler came across login credentials for Scaleform, a so-called middleware company that provided technology for the engine at the heart of Epic\u2019s games. Once they\u2019d broken into Scaleform, they discovered that the company\u2019s network was full of credentials for Silicon Valley titans, Hollywood entertainment conglomerates, and Zombie Studios, the developer of the Spec Ops<\/em> series of games. On Zombie\u2019s network they uncovered remote-access \u201ctunnels\u201d to its clients, including branches of the American military. Wriggling through those poorly secured tunnels was no great challenge, though Pokora was wary of leaving behind too many digital tracks. \u201cIf they notice any of this,\u201d he told the group, \u201cthey\u2019re going to come looking for me.\u201d<\/p>\n As the scale of their enterprise increased, the hackers discussed what they should do if the FBI came knocking. High off the feeling of omni\u00adpotence that came from burrowing into supposedly impregnable networks, Pokora proposed releasing all of Epic\u2019s proprietary data as an act of revenge: \u201cIf we ever go disappearing, just, you know, upload it to the internet and say fuck you Epic.\u201d<\/p>\n The group also cracked jokes about what they should call their prison gang. Everyone dug Wheeler\u2019s tongue-in-cheek suggestion that they could strike fear into other inmates\u2019 hearts by dubbing themselves the Xbox Underground.<\/p>\n Pokora was becoming <\/span>ever more infatuated with his forays into corporate networks, and his old friends from the Xbox scene feared for his future. Kevin Skitzo, a Team Avalaunch hacker, urged him to pull back from the abyss. \u201cDude, just stop this shit,\u201d he implored Pokora. \u201cFocus on school, because this shit? I mean, I get it\u2014it\u2019s a high. But as technology progresses and law enforcement gets more aware, you can only dodge that bullet for so long.\u201d<\/p>\n But Pokora was too caught up in the thrill of stockpiling forbidden software to heed this advice. In September 2011 he stole a prerelease copy of Call of Duty<\/em>: Modern Warfare 3. \u201cLet\u2019s get arrested,\u201d he quipped to his friends as he started the download.<\/p>\n Though he was turning cocky as he swung from network to network without consequence, Pokora still took pride in how little he cared about money. After seizing a database that contained \u201ca fuckton of PayPals,\u201d Pokora sang his own praises to his associates for resisting the temptation to profit off the accounts. \u201cWe could already have sold them for Bitcoins which would have been untraceable if we did it right. It could have already been easily an easy fifty grand.\u201d<\/p>\n But with each passing week, Pokora became a little bit more mercenary. In November 2011, for example, he asked his friend May to broker a deal with a gamer who went by Xboxdevguy, who\u2019d expressed an interest in buying prerelease games. Pokora was willing to deliver any titles Xboxdevguy desired for a few hundred dollars each.<\/p>\n Pokora\u2019s close relationship with May made his hacker cohorts uneasy. They knew that May had been arrested at a Boston gaming convention in March 2010 for trying to download the source code for the first-person shooter Breach. A spokesperson for the game\u2019s developer told the tech blog Engadget that, upon being caught after a brief foot chase, May had said he \u201ccould give us bigger and more important people and he could \u2018name names.\u2019\u201d But Pokora trusted May because he\u2019d watched him participate in many crooked endeavors; he couldn\u2019t imagine that anyone in cahoots with law enforcement would be allowed to do so much dirt.<\/p>\n By the spring of 2012, Pokora and Wheeler were focused on pillaging the network of Zombie Studios. Their crew now included two new faces from the scene: Austin \u201cAAmonkey\u201d Alcala, an Indiana high school kid, and Nathan \u201canimefre4k\u201d Leroux, the home\u00adschooled son of a diesel mechanic from Bowie, Maryland. Leroux, in particular, was an exceptional talent: He\u2019d cowritten a program that could trick Electronic Arts<\/a>\u2019 soccer game FIFA 2012 into minting the virtual coins that players get for completing matches, and which are used to buy character upgrades.<\/p>\n While navigating through Zombie\u2019s network, the group stumbled on a tunnel to a US Army server; it contained a simulator for the AH-64D Apache helicopter that Zombie was developing on a Pentagon contract. Ever the wild man, Wheeler downloaded the software and told his colleagues they should \u201csell the simulators to the Arabs.\u201d<\/p>\n The hackers were also busy tormenting Microsoft, stealing documents that contained specs for an early version of the Durango, the codename for the next-generation Xbox\u2014a machine that would come to be known as the Xbox One<\/a>. Rather than sell the documents to a Microsoft competitor, the hackers opted for a more byzantine scheme: They would counterfeit and sell a Durango themselves, using off-the-shelf components. Leroux volunteered to do the assembly in exchange for a cut of the proceeds; he needed money to pay for online computer science classes at the University of Maryland.<\/p>\n The hackers put out feelers around the scene and found a buyer in the Seychelles who was willing to pay $5,000 for the counterfeit console. May picked up the completed machine from Leroux\u2019s house and promised to ship it to the archipelago in the Indian Ocean.<\/p>\n But the Durango never arrived at its destination. When the buyer complained, paranoia set in: Had the FBI intercepted the shipment? Were they now all under surveillance?<\/p>\n Wheeler was especially unsettled: He\u2019d thought the crew was untouchable after the Epic investigation appeared to stall, but now he felt certain that everyone was about to get hammered by a racketeering case. \u201cHow do we end this game?\u201d he asked himself. The answer he came up with was to go down in a blaze of glory, to do things that would ensure his place in Xbox lore.<\/p>\n Wheeler launched his campaign for notoriety by posting a Durango for sale on eBay, using photographs of the one that Leroux had built. The bidding for the nonexistent machine reached $20,100 before eBay canceled the auction, declaring it fraudulent. Infuriated by the media attention the saga generated, Pokora cut off contact with Wheeler.<\/p>\n A few weeks later, Leroux vanished from the scene; rumors swirled that he\u2019d been raided by the FBI. Americans close to Pokora began to tell him they were being tailed by black cars with tinted windows. The hackers suspected there might be an informant in their midst.<\/p>\n The relationship between <\/span>Pokora and Clark soured as Pokora got deeper into hacking developers. The two finally fell out over staffing issues at their Call of Duty<\/em> business\u2014for example, they hired some workers whom Pokora considered greedy, but Clark refused to call them out. Sick of dealing with such friction, both men drifted into other ventures. Pokora focused on Horizon, an Xbox cheating service that he built on the side with some friends; he liked that Horizon\u2019s cheats couldn\u2019t be used on Xbox Live, which meant fewer potential technical and legal headaches. Clark, meanwhile, refined Leroux\u2019s FIFA<\/em> coin-minting technology and started selling the virtual currency on the black market. Austin Alcala, who\u2019d participated in the hack of Zombie Studios and the Xbox One counterfeiting caper, worked for Clark\u2019s new venture.<\/p>\n As the now 20-year-old Pokora split his energies between helping to run Horizon and attending university, Wheeler continued his kamikaze quest for attention. In the wake of his eBay stunt, Microsoft sent a private investigator named Miles Hawkes to Perth to confront him. Wheeler posted on Twitter about meeting \u201cMr. Microsoft Man,\u201d who pressed him for information about his collaborators over lunch at the Hyatt. According to Wheeler, Hawkes told him not to worry about any legal repercussions, as Microsoft was only interested in going after \u201creal assholes.\u201d (Micro\u00adsoft denies that Hawkes said this.)<\/p>\n In December 2012 the FBI raided Sanadodeh Nesheiwat\u2019s home in New Jersey. Nesheiwat posted an unredacted version of the search warrant online. Wheeler reacted by doxing the agents in a public forum and encouraging people to harass them; he also spoke openly about hiring a hitman to murder the federal judge who\u2019d signed the warrant.<\/p>\n Wheeler\u2019s bizarre compulsion to escalate every situation alarmed federal prosecutors, who\u2019d been carefully building a case against the hackers since the Gears of War<\/em> leak in June 2011. Edward McAndrew, the assistant US attorney who was leading the investigation, felt he needed to accelerate the pace of his team\u2019s work before Wheeler sparked real violence.<\/p>\n On the morning of February 19, 2013, Wheeler was working in his family\u2019s home in Perth when he noticed a commotion in the yard below his window. A phalanx of men in light tactical gear was approaching the house, Glocks holstered by their sides. Wheeler scrambled to shut down all of his computers, so that whoever would be dissecting his hardware would at least have to crack his passwords.<\/p>\n Over the next few hours, Australian police carted away what Wheeler estimated to be more than $20,000 worth of computer equipment; Wheeler was miffed that no one bothered to place his precious hard drives in antistatic bags. He wasn\u2019t jailed that day, but his hard drives yielded a bounty of incriminating evidence: Wheeler had taken frequent screenshots of his hacking exploits, such as a chat in which he proposed running \u201csome crazy program to fuck the fans up\u201d on Zombie Studios\u2019 servers.<\/p>\n That July, Pokora told Justin May he was about to attend Defcon, the annual hacker gathering<\/a> in Las Vegas\u2014his first trip across the border in years. On July 23, \u00adMcAndrew and his colleagues filed a sealed 16-count indictment against Pokora, Nesheiwat, and \u00adLeroux, charging them with crimes including wire fraud, identify theft, and conspiracy to steal trade secrets; Wheeler and Gamerfreak, the original source of the Epic password list, were named as unindicted coconspirators. (Alcala would be added as a defendant four months later.) The document revealed that much of the government\u2019s case was built on evidence supplied by an informant referred to as Person A. He was described as a Delaware resident who had picked up the counterfeit Durango from Leroux\u2019s house, then handed it over to the FBI.<\/p>\n Prosecutors also characterized the defendants as members of the \u201cXbox Underground.\u201d Wheeler\u2019s prison-gang joke was a joke no longer.<\/p>\n The hackers cracked jokes about what they should call their prison gang. Everyone dug Wheeler's tongue-in-cheek suggestion that they could strike fear into the hearts of other inmates by dubbing themselves the Xbox Underground.<\/p>\n Though he knew nothing about the secret indictment, Pokora was too busy to go to Defcon and pulled out at the last minute. The FBI worried that arresting his American coconspirators would spur him to go on the lam, so the agency decided to wait for him to journey south before rolling up the crew.<\/p>\n Two months later, Pokora went to the Toronto Opera House for a show by the Swedish metal band Katatonia. His phone buzzed as a warm-up act was tearing through a song\u2014it was Alcala, now a high school senior in Fishers, Indiana. He was tittering with excitement: He said he knew a guy who could get them both the latest Durango prototypes\u2014real ones, not counterfeits like the machine they\u2019d made the summer before. His connection was willing to break into a building on Microsoft\u2019s Redmond campus to steal them. In exchange, the burglar was demanding login credentials for Microsoft\u2019s game developer network plus a few thousand dollars.\u2029Pokora was baffled by the aspiring burglar\u2019s audacity. \u201cThis guy\u2019s stupid,\u201d he thought. But after years of pushing his luck, Pokora was no longer in the habit of listening to his own common sense. He told Alcala to put them in touch.<\/p>\n The burglar was a recent high school graduate named Arman, known on the scene as ArmanTheCyber. (He agreed to share his story on the condition that his last name not be used.) A year earlier he\u2019d cloned a Microsoft employee badge that belonged to his mother\u2019s boyfriend; he\u2019d been using the RFID card to explore the Redmond campus ever since, passing as an employee by dressing head to toe in Microsoft swag. (Microsoft claims he didn\u2019t copy the badge but rather stole it.) The 18-year-old had already stolen one Durango for personal use; he was nervous about going back for more but also brimming with the recklessness of youth.<\/p>\n Around 9 pm on a late September night, Arman swiped himself into the building that housed the Durangos. A few engineers were still roaming the hallways; Arman dove into a cubicle and hid whenever he heard footsteps. He eventually climbed the stairs to the fifth floor, where he\u2019d heard there was a cache of Durangos. As he started to make his way into the darkened floor, motion detectors sensed his presence and light flooded the room. Spooked, Arman bolted back downstairs.<\/p>\n He finally found what he was looking for in two third-floor cubicles. One of the Durangos had a pair of stiletto heels atop the case; Arman put the two consoles in his oversize backpack and left the fancy shoes on the carpet.<\/p>\n A week after he sent the stolen Durangos to Pokora and Alcala, Arman received some surprising news: A Microsoft vendor had finally reviewed an employment application he\u2019d submitted that summer and hired him as a quality-\u00adassurance tester. He lasted only a couple weeks on the job before investigators identified him as the Durango thief; a stairwell camera had caught him leaving the building. To minimize the legal fallout, he begged Pokora and Alcala to send back the stolen consoles. He also returned the Durango he\u2019d taken for himself, and not a moment too soon: Jealous hackers had been scoping out his house online, as a prelude to executing a robbery.<\/p>\n Pokora spent all winter hacking the Xbox 360\u2019s games for Horizon. But as Toronto was beginning to thaw out in March 2014, he figured he could spare a weekend to drive down to Delaware and pick up the bumper he\u2019d ordered for his Volkswagen Golf.<\/p>\n \u201cY\u2019know, there\u2019s a chance I could get arrested,\u201d he told his dad as they prepared to leave. His father had no idea what he was talking about and cracked a thin smile at what was surely a bad joke.<\/p>\n After an initial <\/span>appearance at the federal courthouse in Buffalo and a few days in a nearby county jail, Pokora was loaded into a van alongside another federal inmate, a gang member with a powerlifter\u2019s arms and no discernible neck. They were being transported to a private prison in Ohio, where Pokora would be held until the court in Delaware was ready to start its proceedings against him. For kicks, he says, the guards tossed the prisoners\u2019 sandwiches onto the floor of the van, knowing that the tightly shackled men couldn\u2019t reach them.<\/p>\n During the three-hour journey, the gang member, who was serving time for beating a man with a hammer, counseled Pokora to do whatever was necessary to minimize his time behind bars. \u201cThis life ain\u2019t for you,\u201d he said. \u201cThis life ain\u2019t for nobody, really.\u201d<\/p>\n Pokora took those words to heart when he was finally brought to Delaware in early April 2014. He quickly accepted the plea deal that was offered, and he helped the victimized companies identify the vulnerabilities he\u2019d exploited\u2014for example, the lightly protected tunnels that let him hopscotch among networks. As he sat in rooms and listened to Pokora explain his hacks with professorial flair, McAndrew, the lead prosecutor, took a shine to the now 22-year-old Canadian. \u201cHe\u2019s a very talented kid who started down a bad path,\u201d he says. \u201cA lot of times when you\u2019re investigating these things, you have to have a certain level of admiration for the brilliance and creativity of the work. But then you kind of step back and say, \u2018Here\u2019s where it went wrong.\u2019\u201d<\/p>\n One day, on the way from jail to court, Pokora was placed in a marshal\u2019s vehicle with someone who looked familiar\u2014a pale 20-year-old guy with a wispy build and teeth marred by a Skittles habit. It was Nathan Leroux, whom Pokora had never met in person but recognized from a photo. He had been arrested on March 31 in Madison, Wisconsin, where he\u2019d moved after the FBI raid that had scared him into dropping out of the Xbox scene. He\u2019d been flourishing in his new life as a programmer at Human Head Studios, a small game developer, when the feds showed up to take him into custody.<\/p>\n As he and Leroux rode to court in shackles, Pokora tried to pass along the gang member\u2019s advice. \u201cLook, a lot of this was escalated because of DaE\u2014DaE\u2019s an asshole,\u201d he said, using the shorthand of Wheeler\u2019s nickname, SuperDaE. \u201cYou can rat on me or do whatever, because you don\u2019t deserve this shit. Let\u2019s just do what we got to do and get out of here.\u201d<\/p>\n Unlike Pokora, Leroux was granted bail and was allowed to live with his parents as his case progressed. But as he lingered at his Maryland home, he grew convinced that, given his diminutive stature and shy nature, he was doomed to be raped or murdered if he went to prison. His fear became so overpowering that, on June 16, he clipped off his ankle monitor and fled.<\/p>\n He paid a friend to try to smuggle him into Canada, nearly 400 miles to the north. But their long drive ended in futility: The Canadians flagged the car at the border. Rather than accept that his escape had failed, Leroux pulled out a knife and tried to sprint across the bridge onto Canadian soil. When officers surrounded him, he decided he had just one option left: He stabbed himself multiple times. Doctors at an Ontario hospital managed to save his life. Once he was released from intensive care and transported back to Buffalo, his bail was revoked.<\/p>\n When it came time for Pokora\u2019s sentencing, his attorney argued for leniency by contending that his client had lost the ability to differentiate play from crime. \u201cDavid in the real world was something else entirely from David online,\u201d he wrote in his sentencing memorandum. \u201cBut it was in this tenebrous world of anonymity, frontier rules, and private communication set at a remove from everyday life that David was incrementally desensitized to an online culture in which the line between playing a videogame and hacking into a computer network narrowed to the vanishing point.\u201d<\/p>\n After pleading guilty, Pokora, Leroux, and Nesheiwat ultimately received similar punishments: 18 months in prison for Pokora and Nesheiwat, 24 months for Leroux. Pokora did the majority of his time at the Federal Detention Center in Philadelphia, where he made use of the computer room to send emails or listen to MP3s. Once, while waiting for a terminal to open up, a mentally unstable inmate got in his face, and Pokora defended himself so he wouldn\u2019t appear weak; the brawl ended when a guard blasted him with pepper spray. After finishing his prison sentence, Pokora spent several more months awaiting deportation to Canada in an immigration detention facility in Newark, New Jersey. That jail had PCs in the law library, and Pokora got to use his hacker skills to find and play a hidden version of Microsoft Solitaire<\/em>.<\/p>\n When he finally returned to Mississauga in October 2015, Pokora texted his old friend Anthony Clark, who was now facing a legal predicament of his own. Alcala had told the government all about Clark\u2019s FIFA<\/em> coin-minting operation. The enterprise had already been on the IRS\u2019s radar: One of Clark\u2019s workers had come under suspicion for withdrawing as much as $30,000 a day from a Dallas bank account. Alcala connected the dots for the feds, explaining to them that the business could fool Electronic Arts\u2019 servers into spitting out thousands of coins per second: The group\u2019s code automated and accelerated FIFA<\/em>\u2019s gameplay, so that more than 11,500 matches could be completed in the time it took a human to finish just one. The information he provided led to the indictment of Clark and three others for wire fraud; they had allegedly grossed $16 million by selling the FIFA<\/em> coins, primarily to a Chinese businessman they knew only as Tao.<\/p>\n Though Clark\u2019s three codefendants had all pleaded guilty, he was intent on going to trial. He felt that he had done nothing wrong, especially since Electronic Arts\u2019 terms of service state that its FIFA<\/em> coins have no real value. Besides, if Electronic Arts executives were really upset about his operation, why didn\u2019t they reach out to discuss the matter like adults? Perhaps Electronic Arts was just jealous that he\u2014not they\u2014had figured out how to generate revenue from in-game currencies.<\/p>\n \u201cYeah, I\u2019m facing 8+ years,\u201d Clark wrote in a text to Pokora. \u201cAnd if I take the plea 3\u00bd. Either way fuck them. They keep trying to get me to plea.\u201d<\/p>\n \u201cThey roof you if you fail at trial,\u201d Pokora warned. \u201cMy only concern is to educate you a bit about what it will be like. Because it\u2019s a shitty thing to go through.\u201d But Clark wouldn\u2019t be swayed\u2014he was a man of principle.<\/p>\n That Fourth of July, Pokora wrote to Clark again. He jokingly asked why Clark hadn\u2019t yet sent him a custom video that he\u2019d requested: Clark and his Mexican-American relatives dancing to salsa music beneath a Donald Trump pi\u00f1ata. \u201cWhere\u2019s the salsa?\u201d Pokora asked.<\/p>\n The reply came back: \u201cOn my chips,\u201d followed by the smiling-face-with-sunglasses emoji. It was the last time Pokora ever heard from his Halo 3<\/em> comrade.<\/p>\n Clark\u2019s trial in federal district court in Fort Worth that November did not go as he had hoped: He was convicted on one count of conspiracy to commit wire fraud. His attorneys thought he had excellent grounds for appeal, since they believed that the prosecution had failed to prove the FIFA<\/em> coin business had caused Electronic Arts any actual harm.<\/p>\n But Clark\u2019s legal team never got the chance to make that case. On February 26, 2017, about a month before he was scheduled to be sentenced, Clark died in his Whittier home. People close to his family insist that the death was accidental, the result of a lethal interaction between alcohol and medication. Clark had just turned 27 and left behind an estate valued at more than $4 million.<\/p>\n The members of <\/span>the Xbox Underground have readjusted to civilian life with varying degrees of success. In exchange for his coopera\u00adtion, Alcala received no prison time; he enrolled at Ball State University and made the dean\u2019s list. The 20-year-old brought his girlfriend to his April 2016 sentencing hearing\u2014\u201cmy first real girlfriend\u201d\u2014and spoke about a talk he\u2019d given at an FBI conference on infrastructure protection. \u201cThe world is your oyster,\u201d the judge told him.<\/p>\n Leroux\u2019s coworkers at Human Head Studios sent letters to the court on his behalf, commending his intelligence and kindness. \u201cHe has a very promising game development career ahead of him, and I wouldn\u2019t think he\u2019d ever again risk throwing that away,\u201d one supporter wrote. On his release from prison, Leroux returned to Madison to rejoin the company.<\/p>\n Nesheiwat, who was 28 at the time of his arrest, did not fare as well as his younger colleagues. He struggled with addiction and was \u00adrearrested last December for violating his probation by using cocaine and opiates; his probation officer said he\u2019d \u201cadmitted to doing up to 50 bags of heroin per day\u201d before his most recent stint in rehab.<\/p>\n Because Wheeler had been a juvenile when most of the hacking occurred, the US decided to leave his prosecution to the Australian authorities. After being given 48 hours to turn in his passport, Wheeler drove straight to the airport and absconded to the Czech Republic, his mother\u2019s native land. The Australians imprisoned his mother for aiding his escape, presumably to pressure him into returning home to face justice. (She has since been released.) But Wheeler elected to remain a fugitive, drifting through Europe on an EU passport before eventually settling in the UK. During his travels he tried to crowdfund the purchase of a $500,000 Ferrari, explaining that his doctor said he needed the car to cope with the anxiety caused by his legal travails. (The campaign did not succeed.)<\/p>\n "I never meant for it to get as bad as it did," Pokora says.<\/p>\n Pokora, who is now 26, was disoriented during his first months back in Canada. He feared that his brain had permanently rotted in prison, a place where intellectual stimulation is in short supply. But he reunited with his girlfriend, whom he\u2019d begged to leave him while he was behind bars, and he reenrolled at the University of Toronto. He scraped together the tuition by taking on freelance projects programming user-interface automation tools; his financial struggles made him nostalgic for the days when he was rolling in Call of Duty<\/em> cash.<\/p>\n When he learned of Clark\u2019s death, Pokora briefly felt renewed bitterness toward Alcala, who\u2019d been instrumental to the government\u2019s case against his friend. But he let the anger pass. There was nothing to be gained by holding a grudge against his onetime fellow travelers. He couldn\u2019t even work up much resentment against Justin May, whom he and many others are certain was the Delaware-based FBI informant identified as Person A in the Xbox Underground indictment. (\u201cCan\u2019t comment on that, sorry,\u201d May responded when asked whether he was Person A. He is currently being prosecuted in the federal district of eastern Pennsylvania for defrauding Cisco and Microsoft out of millions of dollars\u2019 worth of hardware.)<\/p>\n Pokora still struggles to understand how his love for programming warped into an obsession that knocked his moral compass so far askew. \u201cAs much as I consciously made the decisions I did, I never meant for it to get as bad as it did,\u201d he says. \u201cI mean, I wanted access to companies to read some source code, I wanted to learn, I wanted to see how far it could go\u2014that was it. It was really just intellectual curiosity. I didn\u2019t want money\u2014if I wanted money, I would\u2019ve taken all the money that was there. But, I mean, I get it\u2014what it turned into, it\u2019s regrettable.\u201d<\/p>\n Pokora knows he\u2019ll forever be persona non grata in the gaming industry, so he\u2019s been looking elsewhere for full-time employment since finishing the classwork for his computer science degree last June. But he\u2019s had a tough time putting together a portfolio of his best work: At the behest of the FBI, Canadian authorities seized all of the computers he\u2019d owned prior to his arrest, and most of the software he\u2019d created during his Xbox heyday was lost forever. They did let him keep his 2013 Volkswagen Golf, however, the car he adores so much that he was willing to drive to Delaware for a bumper. He keeps it parked at his parents\u2019 house in Mississauga, the place where he played his first game at the age of 2, and where he\u2019s lived ever since leaving prison.<\/p>\n Contributing editor<\/em> Brendan I. Koerner<\/strong> (@brendan\u00adkoerner<\/em><\/a>) wrote about silicon theft<\/a> in issue 25.10.<\/em><\/p>\n This article appears in the May issue. Subscribe now<\/a>.<\/em><\/p>\n Listen to this story, and other WIRED features, on the Audm app<\/a>.<\/em><\/p>\n