13 ms·

The boy who stole Half Life 2 source code (2011)

261 points by abhimir 12y ago

deftnerd 12y ago
It's stories like these that's inspired me to start up a new project at oppressed.me. I'm trying to compile a list of hackers and hacktivists that have been imprisoned in order to let the internet easily send them correspondence. I'm also going to ask publishers for donations of older copies of technical books to send them. A lot of hackers are just kids that make a stupid mistake. During their time in jail, their skills get soft or they'll get hardened by their time there. My hope is to let them know that people on the outside still are thinking of them and to help them keep their skills up-to-date. I'm a bit overwhelmed with a startup at the moment, but I anticipate the non-profit to be formed and to launch sometime in the fall.
- cabbeer 12y ago
  Sounds like a cool project. Let me know if you want some front end help.
- codexon 12y ago
  I don't feel sorry for malware writers. They are not oppressed and deserve what they got. And this guy also stole people's software keys. If they were talented coders, they could've found less destructive ways to make money. But he decided to go the greedy route.
  - NamTaf 12y ago
    Why should we not treat people who make mistakes like humans if they show genuine remose and a desire to reform, such as this guy or e.g.: Kevin Mitnick? The justice system is supposed to be (in most countries, at least) to be a method of both punishment and rehibilitation. Why not find ways to assist them in completing the latter? I don't think it's particularly farfetched to expect relatively socially ostracised teenaged boys to not make the best judgement decisions right as they are developing their computer science skills. Most of them end up becoming relatively well-adjusted (within the scope of an introverted computer nerd) people so why not help them in that development?
    - pekk 12y ago
      Why should we not start with black guys instead of making special exceptions for white kids committing "white collar" crimes? Why does the involvement of computers make some criminals better than others?
      - LukeB_UK 12y ago
        I see nothing in what NamTaf said that means we should be 'making special exceptions for white kids committing "white collar" crimes'. To me they're saying that we should treat anyone as a human if they show genuine remorse and a desire to change. This could apply to any crime committed by any race, any age and any gender. The fact that you throw the race card down so quickly when it comes to a discussion about crime concerns me.
      - vezzy-fnord 12y ago
        https://en.wikipedia.org/wiki/Fallacy_of_relative_privation https://en.wikipedia.org/wiki/Fallacy_of_relative_privation "What about the people wrongfully on death row?"
      - garric 12y ago
        He's not saying that we shouldn't. But the U.S. is overwhelmingly focused on punishment, retribution, and incapacitation rather than rehabilitation. Essentially victim blaming, if you want to look at it like that. Opinion: It's going to take system-wide reform to accomplish anything meaningful.
        paulhauggis 12y ago
        so..a person that murders an innocent person is now a victim? some people are past the point of rehabilitation and should be in prison.
        Jtsummers 12y ago
        > some people are past the point of rehabilitation and should be in prison. If we made a serious effort of rehabilitation in the US penal system, then this might be fair. We don't. Prisoners, especially those who commit the crimes in their youth, are screwed under our current system. The younger criminals, like their non-criminal youth counterparts, just don't know or don't appreciate the options available to them regarding education and learning trade skills. We put them into an environment with other people we've given up on and somehow expect that when they get out a year or a decade later they'll be ready to reintegrate into society. They didn't have the skill set going in, and they won't have it coming out. Many of them will continue to live on the fringes of our society, perhaps making a meager living as unskilled laborers. Others will fall into a crowd that keeps them involved in crime or other "antisocial", or however you want to describe it, behavior.
  - Jtsummers 12y ago
    > I don't feel sorry for malware writers. They are not oppressed and deserve what they got. Few people in US prisons [1] deserve what they're getting. It takes a cold-hearted prick to honestly believe what you've written. [1] While this guy wasn't, the sort of people deftnerd is talking about are.
  - pandatigox 12y ago
    Some of the people behind bars are because they did something that was morally right but condoned by the government. While I can't argue for the guy mentioned in the article, people like Bradley Manning are wasting away their lives. Do you really don't want to help these victims?
    - Jtsummers 12y ago
      I don't like doing this (replying without actually extending the conversation) but you've missed a word: morally right but not condoned by the government. ^^^
    - hueving 12y ago
      How was what Chelsea Manning did morally right? Leaking that much information that could put other peoples' lives at risk isn't exactly morally right.
    - codexon 12y ago
      This guy doesn't belong in the same category as Manning and Aaron Swartz.
  - PhantomGremlin 12y ago
    The problem is that this guy was young, relatively speaking, maybe about 20. The headline calls him a "boy", so he was certainly under 21. By the time I was 21, I certainly wouldn't have done something like what he did. But, just a few years earlier, say at 18, yes, I did stupid things. In his position I probably could have done what he did. At that age many "boys" brains just aren't developed enough to truly understand right and wrong. I'm not saying they shouldn't be punished. But I am saying they definitely shouldn't be punished harshly. In this case he was lucky to receive two years of probation as punishment. Something like that, or perhaps what we call "community service", is certainly more appropriate than throwing him in adult jail with hardened criminals.
  - FiloSottile 12y ago
    > If they were talented coders, they could've found less destructive ways to make money. But he decided to go the greedy route. Let me guess: you are a US citizen, or anyway live in a country where developer positions abound. Well, not everyone is. Some people live in small towns where the cool programming positions are adapting invoice management software for small businesses. Also this was before Freelancer.com, before code.org. And he was a boy, he couldn't just relocate. Also, before the App Store. This is exactly the curiosity that people who enter the InfoSec world feel, coupled with real skills. Often too much skills and too little to do to start. Then you stumble upon a IRC channel and a world of challenges opens in front of you. By the way, he asked Valve to hire him. Maybe he just didn't find "less destructive ways to make money" yet. Don't judge if people are oppressed (or better, repressed) if you have never been, please, either because at that age YOU had the occasions or guidance, or because you hadn't that curiosity or talent.
    - sillysaurus3 12y ago
      Some people live in small towns where the cool programming positions are adapting invoice management software for small businesses. That's a legitimate programming job. Cool software rarely makes money. Cool software that makes money (game development) doesn't pay very much. Then you stumble upon a IRC channel and a world of challenges opens in front of you. A book is far more challenging, because in an IRC channel you're a fish in a small pond. Eventually you grow to be the biggest fish, or forever limit yourself to being small. What a book can't give is peer recognition. But peer recognition is a vain motive, and vanity is rarely lucrative. A book also can't answer questions, but you can use IRC or a website like stackexchange for that. If anyone reading this has personal experience flirting with blackhattery, please carefully consider what you're doing and why you're doing it. (And if you'd like someone to talk to, please feel free to shoot me an email. I'd like hearing about your experiences and your thoughts.)
      - FiloSottile 12y ago
        I think I should stress I'm speaking about young people. Peer recognition is critical when starting at that age. Also careful consideration is not exactly common. I'm in no way alleging that it is a reasonable way to go for a mature professional, but I acknowledge the charm it has for the young high-schooler that is being "taught" Excel at school and being told not to fiddle with that weird black terminal. These boys and girls should not have their lives destroyed by a harsh punishment for their curiosity, that in a different setting would have been highly rewarded. I can totally picture myself doing the same errors in different conditions. Btw, management software is a legitimate programming job of zero interest to security people. Just different curiosity fields.
  - ago 12y ago
    I agree that what I did was bad, but to say that it takes no talent is just wrong. In fact some of the things were more challenging than anything I've come accross at any of my jobs (programming embedded device firmware, test automation and realtime graphics) in the last 10 years. And no, I couldn't find even a "boring" programming job where I lived. Of course I tried, I tried a lot. Really, you have no idea what kind of shithole the place I grew up at was for programmers. Still, that doesn't excuse what I did, and I'm sorry for it.
    - sillysaurus3 12y ago
      The past is the past. You shouldn't have to run around apologizing for the rest of your life. And I hope you feel welcome in communities like HN. You have a lot of talent. What have you been up to over the years? It'd be cool to hear about your career and life in general.
  - macspoofing 12y ago
    >They are not oppressed and deserve what they got. Depends what you mean by that. In this guy's case, had he boarded the plane he would have gotten two decades in an American jail, versus two years of probation in Germany. I think he should be held accountable, but somehow, given the nature of the crime and the surrounding context, I think Germany got it right.
  - Fuxy 12y ago
    You're assuming he made money. Not everybody does it for money actually his motivation was quite clear he liked the games but couldn't afford to buy them legit. A situation i can relate with given I've been in a similar one. Nowhere in this article was there a mention of hacking in order to make money.
  - norswap 12y ago
    How sad it must be, to live without compassion.
- lotsofmangos 12y ago
  I'm also going to ask publishers for donations of older copies of technical books to send them. Not allowed to send books for UK prisoners as it contravenes their new "incentives and earned privileges scheme". Books are a luxury to be earned, apparently. http://www.theguardian.com/society/2014/mar/24/ban-books-prisoners-england-wales-authors http://www.theguardian.com/society/2014/mar/24/ban-books-pri...
- zaroth 12y ago
  I think the system did quite well with Gembe all things considered... The judge sentenced him to two years' probation, citing his rough childhood and the way he had worked to turn his life around as considerations when it came to deciding on the relatively lenient punishment. The arrest at gunpoint sounds quite dramatic, but then again they let him stop for coffee and a cigarette on the way out, so this is not the typical SWAT. They did offer that it was a concurrent raid along with Sven Jaschan (author of Sasser) and they thought there was potential for a tip-off. I was cringing the whole time reading about the interrogation. I can imagine this whole thing would have ended so much worse for Gembe if he had actually gone for that job interview. Just try and compare Gembe to Weev, you might start pining for good ol Schönau im Schwarzwald.
  - ago 12y ago
    You're completely right. The police were nice to me, probably because I was very cooperative. The team was about 15 people from the LKA, including the head of the cybercrime unit. I did cause a bit of a scare when I reached for the kitchen knife to cut some bread, but they quickly realized I didnt want to stab anyone. Of course I knew that I was far better off being in Germany than anywhere else, so I wasn't worried much. Overall I'm quite satisfied with how it went for me, even though it would be 4 years until the trial where I had to report to the police 3 times a week. I had the opportunity to turn my life around and get a good job. If I got put into jail neither me nor society would have been better off considering I paid a lot of taxes in the meantime and haven't done anything criminal since.
    - Fuxy 12y ago
      To be honest if find it kind of a dick move that Valve choose to have you arrested instead of making you work your ass off to make up for your mistake. It is justified what you did was illegal and not cool but they had the chance to turn it into something positive.
      - meowface 12y ago
        I don't really think so. If I was working on a game for years, only to find out someone broke into my network, planted keyloggers on lots of my computers, and stole all of the source code for my game, I'd be interested in arresting the perpetrator as well. The game was practically Gabe's second baby. Plus, there was no way Gabe could have known that Axel was 1) truly apologetic or 2) wasn't the one who also published the code publicly. And even if it was known, the fact that he shared it with friends showed that he didn't seem to care that much about protecting it. That being said, I do work in the security industry and understand that Axel's motivations weren't evil or anything. Gabe still did what he should have done.
- epsylon 12y ago
  I must have been following the grugq[1] way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. [1] There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU [2] Another timeless classic: "Don't talk to [the] police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc
ahuth 12y ago
I'm not condoning breaking into the network and stealing source code, but what financial damage did this cause to Valve? The article repeatedly refers to financial damages, but I'm not sure how that is.
- scotty79 12y ago
  Securing their network properly after that probably costed them some money they wouldn't bother to spend otherwise.
  - ahuth 12y ago
    Can't say I'm convinced. They probably wish they'd spent that money securing their network before this happened... Also, who else had access to their network? This kid getting caught may have saved Valve from other breaches...
- codexon 12y ago
  Well first of all, the game appeared to be playable, so there's the piracy aspect. The Source engine is also licensed to other games. If the code is public, other engines could copy their features. Also it is very annoying to re-secure all your computers after you have been breached. Every single person has to change their password and you don't know what backdoors the guy has installed without a full wipe sometimes.
  - ahuth 12y ago
    Obviously they should've spent the time to secure their network before hand! Also, can't say I buy the hypothetical piracy cost. Does anyone have any examples of other engines copying Source features from the source code?
    - jabagawee 12y ago
      I reject the argument that Valve had it coming since they didn't take the time to secure their network beforehand. There are almost always going to be holes in the security of any system, especially digital ones (since they have a larger surface area to consider), so blaming the victim of a break-in implies that everyone should just resign themselves to being hacked sooner or later. Valve surely made at least some efforts to secure their systems, but even if they did not, that would not justify the morality/ethicality of entering their servers without permission.
deleted 12y ago
[deleted]
MisterMashable 12y ago
This was an amazing and somewhat sad story. How's Gembe doing today? Based on his near adoration of the Valve developers, it would be fitting if he worked in the gaming industry. Maybe he could set things right by helping to make Half-Life 3?
- hookey 12y ago
  Maybe he'd share the source with his friend again.
- johansch 12y ago
  He did a mini-AmA here: http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_stole_halflife_2_fascinating_article/c1hpqjg http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_st...
- theatraine 12y ago
  From the previously linked AmA: "This was actually one of the interview questions, don't know why they didn't use the answer. I work as a software developer and a bit of a system administrator. I work in a company that does physical security, like fire alarms and such. Most of the work I do is programming PC control software for our systems and also quite some firmware development for various uCs. I know quite a bit of different assemblers. Measurement and automation is another field that I'm currently learning more and more."
- ago 12y ago
  I worked programming fire alarm systems for a while, embedded device programming and test automation. Now I started doing realtime graphics in Bejing. Working on using the Kinect to do gesture input on presentations on really big screens. Like Powerpoint on steroids.
  - zacharycohn 12y ago
    The article didn't have any information on the person you passed the source code to. I assume they tried to figure out who it was? What happened to them?
phoboslab 12y ago
I still remember the day HL2 leaked. All of my friends and I were in IRC trying to download the damn thing from DCC bots. I was lucky and got a slot that provided the full 80kbyte/s. I finished the download first, but my PC was pretty old back then so I didn't even bother trying to run it. Instead, I removed my hard drive (my system drive!), picked up a friend and we drove to another friend who had the fastest PC at the time. About 30 mins later all of us (I believe 5 or 6 guys) gathered in a tiny dorm and just stood in awe as we booted up HL2. There was barely any gameplay present. You could just walk around in some maps and admire the graphics. It didn't matter. If we hadn't been stoked before, we were now. In hindsight, this all was just an amazing PR stunt. Fun times.
- josefresco 12y ago
  Your account brings back gaming memories from the late 90's and early 00's. "Leaks" and pirated copies of games ruled the day, and only served to make us all even bigger fans/obsessed gamers. The idea that you were using/seeing something that hadn't been released yet was thrilling and made us all even more dedicated to gaming. Of course then we were all poor college/HS kids, but most of us eventually got jobs and turned into Steam customers.
benihana 12y ago
"Have you any idea how lucky you are that we got to you before you got on that plane?" The difference in the way he was treated by police and the justice system (and how different it is than what we've come to expect in America) is what struck me the most about this story.
- ekianjo 12y ago
  > The difference in the way he was treated by police and the justice system (and how different it is than what we've come to expect in America) is what struck me the most about this story. The fact that they were setting a trap for him was also relatively shocking. Don't they have to follow due process?
  - DerpDerpDerp 12y ago
    What part of inviting a criminal you've gathered significant recorded evidence against (eg, their own telephone confession) to a place you can arrest him do you think violates due process?
    - ekianjo 12y ago
      Well, lying about your true intent. It's not like he knew he was going to be arrested.
      - vertex-four 12y ago
        Police in the US don't have to tell you what they're doing up until the point they decide to exercise their power (i.e. searches or arrests) either, last time I checked. They can ask you to go somewhere and you can voluntarily comply or choose not to.
        ekianjo 12y ago
        So you are OK with women police officers dressing up as prostitutes to attract potential costumers and then arresting them on the spot ? That's extremely twisted. There's a reason why in many countries police officers HAVE to wear uniforms.
cyanbane 12y ago
I remember reading this article a few years ago. It was a very divisive article for me. Early 20s me would have felt bad for Gembe. Early 30s me felt bad for Valve. I don't know where the cycle goes from here. Maybe the real wisdom is feeling bad for both?
- deleted 12y ago
  [deleted]
Tokala 12y ago
Unfortunately, I've never found an in-depth discussion about the part about where they attempt to lure him to the United States so that he can be arrested. It always strikes me as a bit excessive. That Valve worked with the FBI to get him sufficient permission to enter the US with the false pretense of getting a job seems to make this feel like much more personal than anything else. And I'm left scratching my head as to what it really would have accomplished...
phaus 12y ago
Interesting story, terrible article. Valve has always followed the "when its ready" release model. The article makes it sound like there was a huge conspiracy to keep valve's ineptness a secret, else Gabe would have no alternative than to commit ritual suicide.
- rebugger 12y ago
  Furthermore "...to find his bed surrounded by police officers. Automatic weapons were pointing at his head..." - that doesn't sound like Germany. Guns are only drawn if you are visibly armed.
  - schrijver 12y ago
    Pretty amazing accomplishment for the German police: they fired only 85 bullets in 2011 http://www.thewire.com/global/2012/05/german-police-used-only-85-bullets-against-people-2011/52162/ http://www.thewire.com/global/2012/05/german-police-used-onl...
- ZoFreX 12y ago
  We're used to that model then, but this was a long time ago - before "Valve time" was so accepted. They had been publically stating that the game was weeks from release, not saying "when it's done" at all. Additionally they had demo'd at E3 and claimed the demo was not scripted, whereas the leak showed it was almost entirely so.
  - phaus 12y ago
    >We're used to that model then, but this was a long time ago - before "Valve time" was so accepted. "Valve time" was already universally accepted. Between Half-Life, TFC, and Counterstrike, there was an enormous amount of good will towards this company even back then. Plus, we were already used to "Valve time" because it was actually "id time." Id had been doing it for nearly a decade before HL2 game out. >Additionally they had demo'd at E3 and claimed the demo was not scripted, whereas the leak showed it was almost entirely so. The guy who obtained the source code himself said that there were so many builds on valve's servers he had no way of knowing whether or not he had the most current build.
TwoBit 12y ago
Valve didn't use password hash salting? That seems borderline ridiculous. Pretty much the only way he could have broken the hashes is if this is so. Valve's use of SourceSafe at the time is another black mark, though not related to the security breach.
- atmosx 12y ago
  The only take-away here is that it's better to pay for a third party to secure your network, or a have a small team (2-3 guys) doing the administration/security-audit properly. I can't blame developers for not being security experts. Developers != System Administrators != Security Experts ps. The most important part however, are the developers, without them the other two groups wouldn't exist. :-)
atmosx 12y ago
The guy is extremely lucky for getting into the hands of the German police and because of his nationality. I think that if he wasn't German, but from another 'major' or 'minor' EU country, Austrilia and many others he would have been extradited at no time to the US.
hellbreakslose 12y ago
You can't really blame a kid at that age... Kids at that age have no sense of fear or can't recognize what is punishable or not. Everything is a game, especially years back as that internet was not so evolved and the laws around it weren't so strict. Its Valve's fault for letting a 16 y/o install malwares on their computers... When you are developing something you got to be serious about its security as well if you want it to remain a secret. It feels to me like their employees and IT department had no actual sense of what security was (Employees going off installing whatever on their computer, and IT team not being able to track down malware and outgoing packets to unknown sources...)
eqyiel 12y ago
I wonder if it was around this time when people wisened up to disabling zone-transfer requests. Tangentially, I took part in a CTF recently and one of the tasks was to get the list of hosts from a domain. The hint was "My sword. My bow. And my Axfr!"
harmonicon 12y ago
"Have you any idea how lucky you are that we got to you before you got on that plane?" I think the German police officer was right. If you got arrested on US soil, (your side of) the story could have been very, very different.

261 points by abhimir 12y ago

It's stories like these that's inspired me to start up a new project at oppressed.me. I'm trying to compile a list of hackers and hacktivists that have been imprisoned in order to let the internet easily send them correspondence. I'm also going to ask publishers for donations of older copies of technical books to send them. A lot of hackers are just kids that make a stupid mistake. During their time in jail, their skills get soft or they'll get hardened by their time there. My hope is to let them know that people on the outside still are thinking of them and to help them keep their skills up-to-date. I'm a bit overwhelmed with a startup at the moment, but I anticipate the non-profit to be formed and to launch sometime in the fall.

cabbeer 12y ago
Sounds like a cool project. Let me know if you want some front end help.
codexon 12y ago
I don't feel sorry for malware writers. They are not oppressed and deserve what they got. And this guy also stole people's software keys. If they were talented coders, they could've found less destructive ways to make money. But he decided to go the greedy route.
- NamTaf 12y ago
  Why should we not treat people who make mistakes like humans if they show genuine remose and a desire to reform, such as this guy or e.g.: Kevin Mitnick? The justice system is supposed to be (in most countries, at least) to be a method of both punishment and rehibilitation. Why not find ways to assist them in completing the latter? I don't think it's particularly farfetched to expect relatively socially ostracised teenaged boys to not make the best judgement decisions right as they are developing their computer science skills. Most of them end up becoming relatively well-adjusted (within the scope of an introverted computer nerd) people so why not help them in that development?
  - pekk 12y ago
    Why should we not start with black guys instead of making special exceptions for white kids committing "white collar" crimes? Why does the involvement of computers make some criminals better than others?
    - LukeB_UK 12y ago
      I see nothing in what NamTaf said that means we should be 'making special exceptions for white kids committing "white collar" crimes'. To me they're saying that we should treat anyone as a human if they show genuine remorse and a desire to change. This could apply to any crime committed by any race, any age and any gender. The fact that you throw the race card down so quickly when it comes to a discussion about crime concerns me.
    - vezzy-fnord 12y ago
      https://en.wikipedia.org/wiki/Fallacy_of_relative_privation https://en.wikipedia.org/wiki/Fallacy_of_relative_privation "What about the people wrongfully on death row?"
    - garric 12y ago
      He's not saying that we shouldn't. But the U.S. is overwhelmingly focused on punishment, retribution, and incapacitation rather than rehabilitation. Essentially victim blaming, if you want to look at it like that. Opinion: It's going to take system-wide reform to accomplish anything meaningful.
      - paulhauggis 12y ago
        so..a person that murders an innocent person is now a victim? some people are past the point of rehabilitation and should be in prison.
        Jtsummers 12y ago
        > some people are past the point of rehabilitation and should be in prison. If we made a serious effort of rehabilitation in the US penal system, then this might be fair. We don't. Prisoners, especially those who commit the crimes in their youth, are screwed under our current system. The younger criminals, like their non-criminal youth counterparts, just don't know or don't appreciate the options available to them regarding education and learning trade skills. We put them into an environment with other people we've given up on and somehow expect that when they get out a year or a decade later they'll be ready to reintegrate into society. They didn't have the skill set going in, and they won't have it coming out. Many of them will continue to live on the fringes of our society, perhaps making a meager living as unskilled laborers. Others will fall into a crowd that keeps them involved in crime or other "antisocial", or however you want to describe it, behavior.
- Jtsummers 12y ago
  > I don't feel sorry for malware writers. They are not oppressed and deserve what they got. Few people in US prisons [1] deserve what they're getting. It takes a cold-hearted prick to honestly believe what you've written. [1] While this guy wasn't, the sort of people deftnerd is talking about are.
- pandatigox 12y ago
  Some of the people behind bars are because they did something that was morally right but condoned by the government. While I can't argue for the guy mentioned in the article, people like Bradley Manning are wasting away their lives. Do you really don't want to help these victims?
  - Jtsummers 12y ago
    I don't like doing this (replying without actually extending the conversation) but you've missed a word: morally right but not condoned by the government. ^^^
  - hueving 12y ago
    How was what Chelsea Manning did morally right? Leaking that much information that could put other peoples' lives at risk isn't exactly morally right.
  - codexon 12y ago
    This guy doesn't belong in the same category as Manning and Aaron Swartz.
- PhantomGremlin 12y ago
  The problem is that this guy was young, relatively speaking, maybe about 20. The headline calls him a "boy", so he was certainly under 21. By the time I was 21, I certainly wouldn't have done something like what he did. But, just a few years earlier, say at 18, yes, I did stupid things. In his position I probably could have done what he did. At that age many "boys" brains just aren't developed enough to truly understand right and wrong. I'm not saying they shouldn't be punished. But I am saying they definitely shouldn't be punished harshly. In this case he was lucky to receive two years of probation as punishment. Something like that, or perhaps what we call "community service", is certainly more appropriate than throwing him in adult jail with hardened criminals.
- FiloSottile 12y ago
  > If they were talented coders, they could've found less destructive ways to make money. But he decided to go the greedy route. Let me guess: you are a US citizen, or anyway live in a country where developer positions abound. Well, not everyone is. Some people live in small towns where the cool programming positions are adapting invoice management software for small businesses. Also this was before Freelancer.com, before code.org. And he was a boy, he couldn't just relocate. Also, before the App Store. This is exactly the curiosity that people who enter the InfoSec world feel, coupled with real skills. Often too much skills and too little to do to start. Then you stumble upon a IRC channel and a world of challenges opens in front of you. By the way, he asked Valve to hire him. Maybe he just didn't find "less destructive ways to make money" yet. Don't judge if people are oppressed (or better, repressed) if you have never been, please, either because at that age YOU had the occasions or guidance, or because you hadn't that curiosity or talent.
  - sillysaurus3 12y ago
    Some people live in small towns where the cool programming positions are adapting invoice management software for small businesses. That's a legitimate programming job. Cool software rarely makes money. Cool software that makes money (game development) doesn't pay very much. Then you stumble upon a IRC channel and a world of challenges opens in front of you. A book is far more challenging, because in an IRC channel you're a fish in a small pond. Eventually you grow to be the biggest fish, or forever limit yourself to being small. What a book can't give is peer recognition. But peer recognition is a vain motive, and vanity is rarely lucrative. A book also can't answer questions, but you can use IRC or a website like stackexchange for that. If anyone reading this has personal experience flirting with blackhattery, please carefully consider what you're doing and why you're doing it. (And if you'd like someone to talk to, please feel free to shoot me an email. I'd like hearing about your experiences and your thoughts.)
    - FiloSottile 12y ago
      I think I should stress I'm speaking about young people. Peer recognition is critical when starting at that age. Also careful consideration is not exactly common. I'm in no way alleging that it is a reasonable way to go for a mature professional, but I acknowledge the charm it has for the young high-schooler that is being "taught" Excel at school and being told not to fiddle with that weird black terminal. These boys and girls should not have their lives destroyed by a harsh punishment for their curiosity, that in a different setting would have been highly rewarded. I can totally picture myself doing the same errors in different conditions. Btw, management software is a legitimate programming job of zero interest to security people. Just different curiosity fields.
- ago 12y ago
  I agree that what I did was bad, but to say that it takes no talent is just wrong. In fact some of the things were more challenging than anything I've come accross at any of my jobs (programming embedded device firmware, test automation and realtime graphics) in the last 10 years. And no, I couldn't find even a "boring" programming job where I lived. Of course I tried, I tried a lot. Really, you have no idea what kind of shithole the place I grew up at was for programmers. Still, that doesn't excuse what I did, and I'm sorry for it.
  - sillysaurus3 12y ago
    The past is the past. You shouldn't have to run around apologizing for the rest of your life. And I hope you feel welcome in communities like HN. You have a lot of talent. What have you been up to over the years? It'd be cool to hear about your career and life in general.
- macspoofing 12y ago
  >They are not oppressed and deserve what they got. Depends what you mean by that. In this guy's case, had he boarded the plane he would have gotten two decades in an American jail, versus two years of probation in Germany. I think he should be held accountable, but somehow, given the nature of the crime and the surrounding context, I think Germany got it right.
- Fuxy 12y ago
  You're assuming he made money. Not everybody does it for money actually his motivation was quite clear he liked the games but couldn't afford to buy them legit. A situation i can relate with given I've been in a similar one. Nowhere in this article was there a mention of hacking in order to make money.
- norswap 12y ago
  How sad it must be, to live without compassion.
lotsofmangos 12y ago
I'm also going to ask publishers for donations of older copies of technical books to send them. Not allowed to send books for UK prisoners as it contravenes their new "incentives and earned privileges scheme". Books are a luxury to be earned, apparently. http://www.theguardian.com/society/2014/mar/24/ban-books-prisoners-england-wales-authors http://www.theguardian.com/society/2014/mar/24/ban-books-pri...
zaroth 12y ago
I think the system did quite well with Gembe all things considered... The judge sentenced him to two years' probation, citing his rough childhood and the way he had worked to turn his life around as considerations when it came to deciding on the relatively lenient punishment. The arrest at gunpoint sounds quite dramatic, but then again they let him stop for coffee and a cigarette on the way out, so this is not the typical SWAT. They did offer that it was a concurrent raid along with Sven Jaschan (author of Sasser) and they thought there was potential for a tip-off. I was cringing the whole time reading about the interrogation. I can imagine this whole thing would have ended so much worse for Gembe if he had actually gone for that job interview. Just try and compare Gembe to Weev, you might start pining for good ol Schönau im Schwarzwald.
- ago 12y ago
  You're completely right. The police were nice to me, probably because I was very cooperative. The team was about 15 people from the LKA, including the head of the cybercrime unit. I did cause a bit of a scare when I reached for the kitchen knife to cut some bread, but they quickly realized I didnt want to stab anyone. Of course I knew that I was far better off being in Germany than anywhere else, so I wasn't worried much. Overall I'm quite satisfied with how it went for me, even though it would be 4 years until the trial where I had to report to the police 3 times a week. I had the opportunity to turn my life around and get a good job. If I got put into jail neither me nor society would have been better off considering I paid a lot of taxes in the meantime and haven't done anything criminal since.
  - Fuxy 12y ago
    To be honest if find it kind of a dick move that Valve choose to have you arrested instead of making you work your ass off to make up for your mistake. It is justified what you did was illegal and not cool but they had the chance to turn it into something positive.
    - meowface 12y ago
      I don't really think so. If I was working on a game for years, only to find out someone broke into my network, planted keyloggers on lots of my computers, and stole all of the source code for my game, I'd be interested in arresting the perpetrator as well. The game was practically Gabe's second baby. Plus, there was no way Gabe could have known that Axel was 1) truly apologetic or 2) wasn't the one who also published the code publicly. And even if it was known, the fact that he shared it with friends showed that he didn't seem to care that much about protecting it. That being said, I do work in the security industry and understand that Axel's motivations weren't evil or anything. Gabe still did what he should have done.
epsylon 12y ago
I must have been following the grugq[1] way too much because all I couldn't help thinking about the massive OPSEC mistakes he did. Fortunately he was apprehended by the German Police, but things would've been way different had took that plane. [1] There's a great presentation from him on video, including analysis of OPSEC failures from other hacker groups: https://www.youtube.com/watch?v=9XaYdCdwiWU https://www.youtube.com/watch?v=9XaYdCdwiWU [2] Another timeless classic: "Don't talk to [the] police", which explains why it is never in your interest to talk to the police when you are suspected of a crime (even if you are innocent): https://www.youtube.com/watch?v=6wXkI4t7nuc https://www.youtube.com/watch?v=6wXkI4t7nuc

ahuth 12y ago

I'm not condoning breaking into the network and stealing source code, but what financial damage did this cause to Valve? The article repeatedly refers to financial damages, but I'm not sure how that is.

scotty79 12y ago
Securing their network properly after that probably costed them some money they wouldn't bother to spend otherwise.
- ahuth 12y ago
  Can't say I'm convinced. They probably wish they'd spent that money securing their network before this happened... Also, who else had access to their network? This kid getting caught may have saved Valve from other breaches...
codexon 12y ago
Well first of all, the game appeared to be playable, so there's the piracy aspect. The Source engine is also licensed to other games. If the code is public, other engines could copy their features. Also it is very annoying to re-secure all your computers after you have been breached. Every single person has to change their password and you don't know what backdoors the guy has installed without a full wipe sometimes.
- ahuth 12y ago
  Obviously they should've spent the time to secure their network before hand! Also, can't say I buy the hypothetical piracy cost. Does anyone have any examples of other engines copying Source features from the source code?
  - jabagawee 12y ago
    I reject the argument that Valve had it coming since they didn't take the time to secure their network beforehand. There are almost always going to be holes in the security of any system, especially digital ones (since they have a larger surface area to consider), so blaming the victim of a break-in implies that everyone should just resign themselves to being hacked sooner or later. Valve surely made at least some efforts to secure their systems, but even if they did not, that would not justify the morality/ethicality of entering their servers without permission.

deleted 12y ago

[deleted]

MisterMashable 12y ago

This was an amazing and somewhat sad story. How's Gembe doing today? Based on his near adoration of the Valve developers, it would be fitting if he worked in the gaming industry. Maybe he could set things right by helping to make Half-Life 3?

hookey 12y ago
Maybe he'd share the source with his friend again.
johansch 12y ago
He did a mini-AmA here: http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_stole_halflife_2_fascinating_article/c1hpqjg http://www.reddit.com/r/gaming/comments/fpkav/the_boy_who_st...
theatraine 12y ago
From the previously linked AmA: "This was actually one of the interview questions, don't know why they didn't use the answer. I work as a software developer and a bit of a system administrator. I work in a company that does physical security, like fire alarms and such. Most of the work I do is programming PC control software for our systems and also quite some firmware development for various uCs. I know quite a bit of different assemblers. Measurement and automation is another field that I'm currently learning more and more."
ago 12y ago
I worked programming fire alarm systems for a while, embedded device programming and test automation. Now I started doing realtime graphics in Bejing. Working on using the Kinect to do gesture input on presentations on really big screens. Like Powerpoint on steroids.
- zacharycohn 12y ago
  The article didn't have any information on the person you passed the source code to. I assume they tried to figure out who it was? What happened to them?

phoboslab 12y ago

I still remember the day HL2 leaked. All of my friends and I were in IRC trying to download the damn thing from DCC bots. I was lucky and got a slot that provided the full 80kbyte/s. I finished the download first, but my PC was pretty old back then so I didn't even bother trying to run it. Instead, I removed my hard drive (my system drive!), picked up a friend and we drove to another friend who had the fastest PC at the time. About 30 mins later all of us (I believe 5 or 6 guys) gathered in a tiny dorm and just stood in awe as we booted up HL2. There was barely any gameplay present. You could just walk around in some maps and admire the graphics. It didn't matter. If we hadn't been stoked before, we were now. In hindsight, this all was just an amazing PR stunt. Fun times.

josefresco 12y ago
Your account brings back gaming memories from the late 90's and early 00's. "Leaks" and pirated copies of games ruled the day, and only served to make us all even bigger fans/obsessed gamers. The idea that you were using/seeing something that hadn't been released yet was thrilling and made us all even more dedicated to gaming. Of course then we were all poor college/HS kids, but most of us eventually got jobs and turned into Steam customers.

benihana 12y ago

"Have you any idea how lucky you are that we got to you before you got on that plane?" The difference in the way he was treated by police and the justice system (and how different it is than what we've come to expect in America) is what struck me the most about this story.

ekianjo 12y ago
> The difference in the way he was treated by police and the justice system (and how different it is than what we've come to expect in America) is what struck me the most about this story. The fact that they were setting a trap for him was also relatively shocking. Don't they have to follow due process?
- DerpDerpDerp 12y ago
  What part of inviting a criminal you've gathered significant recorded evidence against (eg, their own telephone confession) to a place you can arrest him do you think violates due process?
  - ekianjo 12y ago
    Well, lying about your true intent. It's not like he knew he was going to be arrested.
    - vertex-four 12y ago
      Police in the US don't have to tell you what they're doing up until the point they decide to exercise their power (i.e. searches or arrests) either, last time I checked. They can ask you to go somewhere and you can voluntarily comply or choose not to.
      - ekianjo 12y ago
        So you are OK with women police officers dressing up as prostitutes to attract potential costumers and then arresting them on the spot ? That's extremely twisted. There's a reason why in many countries police officers HAVE to wear uniforms.

cyanbane 12y ago

I remember reading this article a few years ago. It was a very divisive article for me. Early 20s me would have felt bad for Gembe. Early 30s me felt bad for Valve. I don't know where the cycle goes from here. Maybe the real wisdom is feeling bad for both?

deleted 12y ago
[deleted]

Tokala 12y ago

Unfortunately, I've never found an in-depth discussion about the part about where they attempt to lure him to the United States so that he can be arrested. It always strikes me as a bit excessive. That Valve worked with the FBI to get him sufficient permission to enter the US with the false pretense of getting a job seems to make this feel like much more personal than anything else. And I'm left scratching my head as to what it really would have accomplished...

phaus 12y ago

Interesting story, terrible article. Valve has always followed the "when its ready" release model. The article makes it sound like there was a huge conspiracy to keep valve's ineptness a secret, else Gabe would have no alternative than to commit ritual suicide.

rebugger 12y ago
Furthermore "...to find his bed surrounded by police officers. Automatic weapons were pointing at his head..." - that doesn't sound like Germany. Guns are only drawn if you are visibly armed.
- schrijver 12y ago
  Pretty amazing accomplishment for the German police: they fired only 85 bullets in 2011 http://www.thewire.com/global/2012/05/german-police-used-only-85-bullets-against-people-2011/52162/ http://www.thewire.com/global/2012/05/german-police-used-onl...
ZoFreX 12y ago
We're used to that model then, but this was a long time ago - before "Valve time" was so accepted. They had been publically stating that the game was weeks from release, not saying "when it's done" at all. Additionally they had demo'd at E3 and claimed the demo was not scripted, whereas the leak showed it was almost entirely so.
- phaus 12y ago
  >We're used to that model then, but this was a long time ago - before "Valve time" was so accepted. "Valve time" was already universally accepted. Between Half-Life, TFC, and Counterstrike, there was an enormous amount of good will towards this company even back then. Plus, we were already used to "Valve time" because it was actually "id time." Id had been doing it for nearly a decade before HL2 game out. >Additionally they had demo'd at E3 and claimed the demo was not scripted, whereas the leak showed it was almost entirely so. The guy who obtained the source code himself said that there were so many builds on valve's servers he had no way of knowing whether or not he had the most current build.

TwoBit 12y ago

Valve didn't use password hash salting? That seems borderline ridiculous. Pretty much the only way he could have broken the hashes is if this is so. Valve's use of SourceSafe at the time is another black mark, though not related to the security breach.

atmosx 12y ago
The only take-away here is that it's better to pay for a third party to secure your network, or a have a small team (2-3 guys) doing the administration/security-audit properly. I can't blame developers for not being security experts. Developers != System Administrators != Security Experts ps. The most important part however, are the developers, without them the other two groups wouldn't exist. :-)

atmosx 12y ago

The guy is extremely lucky for getting into the hands of the German police and because of his nationality. I think that if he wasn't German, but from another 'major' or 'minor' EU country, Austrilia and many others he would have been extradited at no time to the US.

hellbreakslose 12y ago

You can't really blame a kid at that age... Kids at that age have no sense of fear or can't recognize what is punishable or not. Everything is a game, especially years back as that internet was not so evolved and the laws around it weren't so strict. Its Valve's fault for letting a 16 y/o install malwares on their computers... When you are developing something you got to be serious about its security as well if you want it to remain a secret. It feels to me like their employees and IT department had no actual sense of what security was (Employees going off installing whatever on their computer, and IT team not being able to track down malware and outgoing packets to unknown sources...)

eqyiel 12y ago

I wonder if it was around this time when people wisened up to disabling zone-transfer requests. Tangentially, I took part in a CTF recently and one of the tasks was to get the list of hosts from a domain. The hint was "My sword. My bow. And my Axfr!"

harmonicon 12y ago

"Have you any idea how lucky you are that we got to you before you got on that plane?" I think the German police officer was right. If you got arrested on US soil, (your side of) the story could have been very, very different.