This Hacker Wears a White Hat

IN THE SKYLINE BAR OF TOKYO’S PRINCE PARK TOWER, Rick Seely is winding down the day with a beer and some conversation. A longtime American expat nearing retirement age, Seely looks out at the megacity at dusk, the lights of nearby skyscrapers flickering on, Japans Eiffel Tower replica glowing orange. The topic at hand is Ricks son, Bryan, a young ex-Marine and increasingly famous hacker in Seattle. Rick is discussing the chances that his son will be murdered.

I always thought hell just disappear one day, Rick says, sipping his Asahi lager. Bryan will get the wrong people angry, and thatll be it. He stares out the windows, his expression not so much forlorn as accepting of a tough truth. Wed never hear from him again. Hed be disappeared by someone.

With a big mustache and warm intelligence, Rick seems every bit the good dad. His concern is mixed with a deferential attitude, letting his boy make his own mistakes. This is the first time hes discussed Bryan with someone outside the family, he says. There are things he needs to get off his chest.

He cant understand why Bryan commits federal crimes, the type that gets people put away for life. Why he willfully pisses off criminal enterprises and multimillion-dollar scam networks, one of which used to employ him. Bryan has three kids. Why is he pulling the tails of tigers?

Rick and Bryan had a frigid relationship for many years, but its thawing. They talk more now, but Bryans motives remain a mystery to his father. Bryans former attorney, Bellevue-based Brian Muchinsky who says the federal government would have Bryan dead to rights on some serious crimes will later say his client is simply a good guy out to expose wrongdoing.

Months later, Id be back in Seattle, talking to Bryan and presenting his fathers assessments and predictions for a possible disappearance. Bryan will laugh, say his fathers a really smart guy and play the Im just doing the right thing card. But beers and persistent questions get him reflecting more deeply, and his motivation becomes clearer. To him, his work is some form of self-redemption and some form of revenge.

THE WORK OF HACKERS seems like a rare thing to most people, with little effect on their day-to-day existence. Its something computer experts do. Money or personal information gets stolen. Governments target other governments. North Korea leaks the private emails of Hollywood executives (allegedly). Thats the long and short of it.

But there are other forms of hacking that inflict damage on thousands of small businesses on a daily basis. Bryan Seely would know. For more than two years, he worked on the dark side. And for his attempt to make amends, he could get thrown in prison, or possibly worse.

To illustrate, lets say youre a locksmith with a small shop on the outskirts of a big city. If nearby customers Googled a locksmith service, yours wouldnt often be the top result. Through a few relatively simple tricks, however, you manage to fabricate listings on Google, Yelp, yp.com (formerly Yellowpages.com) and more. You create fake businesses with specific addresses all over the region, using phone numbers that forward to your own. It doesnt matter that theres no storefront at these locations locksmiths do most of their business remotely.

Eventually, the calls pour in and you need help answering them all. You set up a call center. You dont have enough locksmiths to handle all the business, so you start selling leads to nearby competitors. If youre ambitious, you buy some ads and hire someone to game the online search results even further, making your competitors less prominent through spammy bad reviews, flags and other tricks, and bumping up your own listings. If youre especially ambitious, you start listing locations outside the city, region and state. Theres no real limit.

BY THE TIME I STOPPED in 2010, we had 3,126 fake businesses listed around the country, says Seely. He is describing his part in a scam based in Southern California and run by a man he simply refers to as Rob that remains in operation today, bringing in $10 million annually by Seelys estimation. As evidence, he presents Excel spreadsheets of still-listed fake phone numbers, as well as thousands of fake online reviews that can be found on Yelp business listings across the country. Over the course of an hour, demonstrating fake listings and showing how theyre created, he backs up his claims with a great deal of thoroughness.

Seelys listings werent for locksmiths, but for auto-glass repair companies. No matter. Any business that offers a service landscaping, garage door repair, locksmithing and so on is fair game, he says. Its not a technically advanced hack, but its lucrative.

According to the Washington Department of Licensing, there are five licensed businesses in Seattle with locksmith in their business or trade name. The top result on Google, Fast Locksmith, is not one of them. A search for locksmith on yp.com yields 3,909 results in the city. When approaching licensed companies like Broadway Locksmith, the owners and staff respond eagerly with variations of How long have you got to talk about this?

These scammers are so organized, says Bjorn Madsen of Broadway Locksmith. They call us all the time, offering $20 leads. They have national phone banks and call centers. They pay Google and Yelp and buy out all their ad results. Its a big, big problem for honest, licensed businesses.

FOR A TIME, SEELY WAS the epitome of a failed whistleblower. From late 2013 to early 2014, he harped at Google about its hackable issues, going so far as to reach out to individual project managers and engineers. No one at the company took him seriously, he says, rejecting his work as trivial spamming. Likewise the journalists and law enforcement people he contacted. So, in a bid for attention, he resorted to drastic measures.

Creating fake listings is not the only thing semiskilled hackers can do on Google. They can also manipulate existing listings. They can change the hours of business, or even phone numbers and addresses. As Wired magazine reported last year, citing Seelys work, these activities can be enough to bury a business quickly. Fake listings on Google Maps are particularly pernicious because they are so widely used as a substitute phone directory. Seely says Google is extremely slow to respond to complaints by businesses whose listings have been manipulated, and every day that a companys phone number remains incorrect can mean lost revenue.

To draw the worlds attention to the issue, Seely created two phone accounts, which he then attached to the Secret Service office in Washington, D.C., and the FBI field office in San Francisco. By manipulating search results, the new numbers became the default contact numbers for the two offices. He set up the numbers to forward calls to the actual agencies, only with the conversations now being recorded through an automated online system.

I couldve done this for every congressman, the White House, mayors, lawyers, banks, foreign embassies, you name it, says Seely. I couldve recorded everything, and no one wouldve noticed for a long time, because the phone number I set up just forwards to the original. So everyones getting to the right destination. No one would think anything went wrong.

The moment the hack went live and the calls started recording, Seely realized he was in over his head. He had wiretapped two major federal agencies, a serious crime. With each new call that was recorded, the hole got deeper. He contacted some former Marine buddies for advice, and they reportedly told him to turn himself in immediately. It was his only hope of avoiding the slammer.

Walking into the Secret Service office in Seattle and informing agents there of his crime, he got roughly the same reaction he received from Google a stop wasting our time attitude. Seely still fumes at the memory of the agents he met.
For me to pull this off and them to roll their eyes, I just had to say, Screw you. Pick up your phone and call your D.C. office right now, says Seely.

An agent did so, using the default number that came up in a Google search. Immediately after the agents call ended, Seely received a text on his phone, informing him of a new recording. He played both sides of the phone conversation back to the agents. It was like magic. The look on their faces was like, Oh, shit. Kill it with fire. We need to kill this immediately.

The Secret Service read Seely his rights and locked him in an interrogation room for a while. It did not jail him, but
left the door open to doing so in the future. It simply demanded he immediately cease and desist his Google-altering campaign.

And when the Secret Service tells you to stop something or else, Seely says, you stop.

BUT SEELY NEVER REALLY STOPPED. The wiretapping ended, but he has continued poking at the federal government and scammers alike. He provided his recordings of FBI and Secret Service calls to the online news organization Gawker, and spoke to Seattles KOMO News about his accomplishment. Earlier this year, he created a verified business listing for Edwards Snow Den, made to appear on Google Maps as if it were situated in the White House, and at a local TEDx conference he gave a speech titled Wiretapping the Secret Service Can Be Easy and Fun.

This was followed in July by the self-publication of Cyber Fraud: The Web of Lies, a book he co-wrote with Muchinsky, his attorney. In it, he lays out in explicit detail how search engine scammers operate. The Secret Service wants to see a copy, Muchinsky says, and could bring the pain if the agency officials dont like what they read.

There is a certain braggadocio common to hacker circles, a narrow megalomania. For many hackers, theres nothing better than proving themselves smarter than the system. They often cant help but let others know about it. The difference is most hackers do this behind a veil of anonymity. Seely is zealous about putting his name and face out there, perceiving this self-publicity as necessary for his whistleblowing to have any effect.

But this approach has led to emailed death threats, says Seely, from people who dont want their scam operations publicized. Upon the announcement of his book, both he and Muchinsky say the Secret Service has taken a renewed interest in his case, and not in a good way. To hear both of them tell it, the feds are saying hes had his fun and made his point, and now its time to shut up already.

Seelys work has caused Google to disable many, though not all, of the easiest exploitable flaws in its system.

GIVEN THAT THE GUY HAS THREE KIDS, one a newborn, its tough to understand whats going through his head as he continues to pursue the issue. Back in Japan, Rick Seely praises Bryans ex-wife for providing a steady home for the grandchildren as his son tilts at windmills. For the life of Rick Seely, Bryans continued campaign cant seem anything but irresponsible.

Presented this assessment, Bryan says its hard to understand the impression being a scammer made on him. He started scamming out of financial desperation, he says, not quite knowing what he was getting into. He blames this partially on Rob, the head of his former auto glass operation, who hired Bryan for his technical expertise. He describes seeing Rob one of the worst human beings on earth who lives in an Orange County mansion, raking in millions through a simple scam, and Seely cant help but simmer and curse. Robs success seems an ongoing injustice, subtly nagging at him like a splinter whenever he thinks about it. He wants to wipe it out.
But in the end, its not Robs fault that Seely gamed the system for more than two years. He knew what he was doing. No matter how irrational some of this campaign may seem Ive never said I was smart, he says its something he believes must continue if hes to look at himself in the mirror.

I was the bad guy for a while, Seely says. I really was, and I cant forget that. We werent physically hurting people, but we were hurting them in other ways. I mightve caused the breakup of families because a guy was so stressed from losing his business that he got divorced. Kids might be leading much worse lives because of what we did. This is all I know to do to make up for my mistakes.

When I returned home from Tokyo, a curious note awaited me in my mailbox. It promoted a locksmith with the same address as my apartment building. Previously, I wouldnt have thought twice about it. But, as Bryan Seely has shown, theres a world of underground businesses out there, existing in name and phone number only, invisible but numerous, lurking just an online search away.

UPDATE: Since publication of this story, Brian Muchinsky has indicated that he is no longer representing Bryan Seely and that the book the two published together is no longer available for sale.