Anonymous and activism often cross paths. When there are injustices in the world that triggers protests or riots, there's often online version of those protests, too. And if somebody wants to simply be the voice of the citizens of the world, they can be anonymous and make threats to an organization. These anonymous, online protesters have targeted governments, churches, organizations to try to expose their corruption.
They have been known to wage online attacks so hard that the organization goes completely offline. Or they take it a step further and get internal access to the network and cause whatever destruction they can from within. On many accounts, anonymous stands up for the citizens of the world and helps fight corruption. But what if the organization that stirred the bee's nest was a hospital?
Would anyone ever consider attacking a hospital? A place where patients are on the verge of deaths and life-saving operations are happening on a daily basis? A place where people go to as a last resort for help? Can activism go too far?
This is Darknet Diaries. True stories from the dark side of the internet. I'm Jack Recider. At the center of this...
This episode is sponsored by Black Hills. Black Hills has earned the trust of the cybersecurity industry since John Strand founded it in 2008. You've got to already know that if you want to test your defenses or need around the clock monitoring, Black Hills is where you look and I really hope you've already checked out their anti-siphant training programs too where they teach you to think like an attacker. It's hands-on, practical training built for defenders who want to level up.
But did you know about the webcasts, vlogs, zines, and comics, all designed by hackers, for hackers? They even spun up a whole comic series called The Future Is from Reca Comics. It's like Black Mirror meets hackers filled with hands-on cybersecurity challenges. You can find it in over 700 comic shops worldwide or, you know, from the comfort of your keyboard at their online store, the Spearfish General Store.
And that places a rabbit hole of its own. You've got the backdoors and breeches card game, shirts, stickers, and the Reca hoodie, which is hackers spelled backwards. So when you look in the mirror... But yeah, you get it.
You see the hacker that you always knew you were. And because you're a dark knight dias listener, they've got a very special thing waiting for you at blackhillsinfosec.com. That website is blackhillsinfosec.com. This episode is sponsored by SpyCloud, with ransomware affecting 85% of organizations in the past year and phishing becoming the top entry point to ransomware, taking action on your company's exposure has never been more critical.
I recently visited spycloud.com to check my darknet exposure and was shocked to discover just how much stolen identity data criminals have at their disposal. SpyCloud's new identity threat report reveals that nearly half of all corporate users have been infected by info-stealer malware at some point. With 63.8 billion distinct identity records now circulating on the dark web, the scale of this threat is staggering. What's even more alarming is that only 38% of organizations can actually detect these historical identity exposures that create ongoing risk, knowing what's putting you and your organization at risk.
From stolen credentials to session cookies to PII, it's critical for protecting against identity-based threats like account takeover, session hijacking, and yes, even ransomware. With SpyCloud, you're never in the dark about your company's exposure from third-party breeches, successful fishes, or info-stealer infections. Read the full report and check your darknet exposure for free at spycloud.com. That's spycloud.com slash darknet diaries.
For two years, she's been under the care and the well-skilled care of Tufts Medical Center, led by Dr. Mark Corson, one of the leading mitochondrial doctors in the country, and being treated successfully, going to school, playing with the dogs. January 23rd, her grandma's 90-second birthday, she ice skated for her. She gets the flu in early February, conditions deteriorate rapidly, which is unfortunately when you have your body just doesn't fight things the way other folks can.
And the decision was made that by her main doctor at Tufts, that she needs to be seen by her stomach doctor. Unfortunately, he and his rest of his GI team, the month earlier, had transferred over from Tufts to Boston Children's Hospital. So on the snowy February 10th evening, she went by ambulance from Connecticut Children's to Boston Children's. And within a few hours of her arrival, a young neurologist came along and said, oh, there's no such thing as mitochondrial disease.
Didn't say what his game plan was, but we're going to try a different approach, which we went along with. We were trying to get our daughter better. But within a very short period of time, they had decided what she had was not medical, was in her head. And even though everything that's been done has been medically diagnosed, medically verified, and as they would say, insurance approved, nothing was done by pushy parents making something happen.
But on February 13th of 2013, my wife was given a sheet of paper called The Guidelines of Care for Justina Pelletir, which just crushed us. It says, you will not be allowed to speak to any doctors, including her Tufts doctors. You will not be able to see the doctor you came here to see, Dr. Alex Flores, world expert on GI motility and mitochondrial disease.
We are taking over. We are taking her off all her medications. She attacked a cardiac, rapid heart rate. They took her off that, a number of different things.
When you have mitochondrial disease, you have serious vitamin deficiencies, which is because mitochondrial is your energy was taken off that. So by us saying on February 13th, we don't agree with what you're doing. February 14th, I went to discharge my daughter to take her back to Tufts for her already pre-scheduled appointment with Dr. Corson.
And as I've said a few times before, Tufts medical center is not exactly Bob's Hospital, they're one of the top medical facilities in the country. Then that's where the nightmare totally began. The hospital contacted Child Protective Services, which in Boston is known as DCF, Department of Children and Families. The DCF removed Justina from the custody of her parents and placed her under the custody of the state of Massachusetts, all because of a medical disagreement between the parents and the hospital.
This was very traumatic for the Pelletir family. They believed what they were doing was beds for their daughter by listening to doctors and taking her to hospital so she can get better. And after she was diagnosed, the daughter was taken away from the parents. The parents had very short visiting times, they were not allowed to talk to doctors, and were sometimes even escorted out of the hospital by police.
To top it all off, the courts put a gag order on the parents, restricting them from being able to talk to the press. Over a year goes by where Justina remained in the Boston Children's Hospital, where she was treated for her illness. She was unable to come home for her birthday or even Christmas, because her home was the hospital, because she was under custody of the state of Massachusetts. And now it's March 5th, over a year or almost 13 months later, and here we are.
We have a daughter who's dying, she's in pain 24 hours a day because they've ignored it. And what has happened since February 10th, her condition is now where she was ice skating going to school, where now she's pretty much paralyzed below the hips, very little body strength above. Educationally, she's dropped till they think to the second grade level. She's been put through hell, through no fault of her own, through no fault of her parents who just followed her, their doctors' advice.
And the crush, it's none to her, but it's none to our family financially. When you're fighting, as I said, David against not one July, but two, we're fighting state of Massachusetts and DCF. And we're fighting Boston Children's Hospitals, and their pockets are a little bit deeper than ours. But as you saw a few weeks ago, I decided I could not stand back anymore.
The gag order was lifted off Lou, and he could finally tell his story to the press. After a year of being held in Boston Children's Hospital, she was well enough to leave. But being under custody of the state of Massachusetts, she couldn't go home. She was moved to a youth facility called Wayside, where she was treated for mental illness.
As of today, she is still at the Wayside facility, which by the way is a two-week psychiatric residential facility, non-medical. She's been there six, seven weeks. One of the things that transpired was last Monday, they had announced in the courtroom, they were going to move her to a facility called the Shared Living Collaborative. Part of the night near that went on, if you saw the media, you saw that my wife actually passed out outside the courtroom.
Two days later, shared living collaboratives said, no, no, no, we want nothing to do with Ms. Pelletier at this point because of all the media is ruining. So basically, she's in a facility that's designed to keep people two weeks or less, and non-medical. And she's been there six, seven plus weeks.
We were there the Friday before the court, and our weekly visit. And I mentioned this because it's very important. Justina's shirt at the bottom end happened to lift up, and my wife and daughter saw the severe dark red lines coming out of her port where her surgery was. That's sepsis, it's poison.
If we didn't raise the red flag, DCF officials were in their laughing, she could be in serious medical shape, even worse today or not be here today. Our family has gone through 13 months of any family's worst nightmare. That any hospital could take a child away from a family that was doing no wrong and have no recourse as far as getting her back. Greetings, fellow citizens.
We are anonymous. It has come to our attention that a 15-year-old girl by the name of Justina Palater has been held against her will by the state of Massachusetts for over one year. Justina has a condition known as Medo-Congrale Disease, however, the Boston Children's Hospital believes that it all is merely in her head and is a result she has been detained in addition to being tortured physically and mentally by this corrupted system for nothing more than being said. Anonymous and the American people will not tolerate this abuse of our children and will retaliate using whatever means necessary in order to protect our fellow citizens from this abusive and manipulative behavior.
We will punish all those held accountable and will not relent until Justina is free. Test us and you shall fail. This will be your first and final warning. Failure to comply with our demands will result in retaliation and the likes which you have never seen.
For each Justina had returned her home to her family. The voice of the people shall be heard. We are anonymous. We are legionable.
We do not forgive. We do not forget. Expect us. Operation Justina engaged.
The video also included many names of employees at Boston Children's Hospital as well as the judge that sought a case, calling for these people to be fired or threatened. The next day, Twitter messages started showing up. The user by the name of Anand Mecurial 2 started calling Anonymous to engage on attacks against the hospital using the hashtag opjustina. Anonymous also posted public dumps of private information of the judge and the doctors who took care of Justina, listing their address, home phone number, and more.
The hospital saw the docs that were posted of the doctors and lawyers' home address and their phone numbers and they saw the video and they saw the tweets. They knew an attack was coming, but they didn't know when or how big. The hospital called the police. Because what else can you do in a situation like this?
Even though the police can't protect you against a cyber threat, you feel like there's no other option, and it's good to inform them anyways, so the police were on alert. Protesters started gathering outside the hospital, with signs saying free Justina, but the protesters remained peaceful. On April 14th, 2014, members from Anonymous began a network attack on the Boston Children's Hospital. It was a typical denial of service attack at the DOS.
The attackers were sending a large amount of web traffic to the hospital's website, so much that the web server couldn't handle all the traffic, and the website was unusable. Anyone who tried to visit the hospital's website would see a server error and not see the website at all. This DOS attack was not that bad, though. The hospital was on full alert and had the appropriate staff on hand to block each IP that was attacking the hospital.
The hospital was blocking IP address after IP address, one at a time. And shortly after an IP was blocked, a new flood of traffic would come from a new IP. So this hospital had to block that new IP, too. It was like a game of whack-a-mole.
A tax kept coming from new IPs day after day for a solid week. April 19th rolls around. It's Patriot's Day, which is a state holiday in Massachusetts. And it's also the one-year anniversary of the Boston Marathon bombing.
And it's also the day of a big fundraiser campaign that was being done for the Boston Children's Hospital. And the main way to donate to the hospital was through the website. The IT department of the hospital was growing increasingly concerned. On this day, the DOS attack got much bigger.
It knocked out not only the main website, which prevented people from donating to the fundraising campaign, but it also took down many more systems on the hospital's public network. Harvard University is affiliated with Boston Children's Hospital, and they share the same network. So not only were sites at the hospital down, but now part of Harvard's network was going down, too. The hospital brought in additional help to come and defend the network.
They hired network incident responders. They were able to come in, put devices in, and block even more traffic and monitor the situation even closer. Even though the attack had grown much larger, it was managed, and the websites were starting to come back up. But the media kept running the story of how Justina was taken from her parents.
This resulted in the groundswell of protesters outside the hospital in courtrooms. At some point, too, a video was leaked from Justina, pleading to be sent home, and that she misses her family so much. All this just added fuel to the anonymous campaign of Justina. New anonymous supporters were joining in, and the DOS against the hospital was going larger and getting more serious.
The attackers began bleaching the phone lines and calling in and telling whoever answered that their bank account was compromised. They were sending in a lot of spam emails, too, and phishing emails. And at some point, an employee of the hospital clicked on a phishing email, and hackers were able to get into the hospital's mail server. They started reading emails, and even joined some conference calls, and then posted the transcripts of those calls online.
More DOS attacks were happening, and more websites were going down. Sites that were disrupted were research sites, philanthropist sites, fundraiser sites, provider portals, patient portals, and more. When the hospital found that someone was in the mail server, they shut down the mail server for 24 hours, stopping all email in and out of the hospital. The email server had 15,000 user accounts, so you can imagine how hard it would be to communicate to this many people when email is unavailable.
The attacks continued day after day, week after week, and the attacks grew larger and larger every day, and eventually spiked all the way up to 27 gigs per second. Up until this point, word about the attacks has been kept quiet, but when an email server went down, the Boston Globe news agency heard about this and ran a story about it, indicating the hospital was under a severe attack from anonymous. This was the front page story of the Boston Globe. When that happened, one of the more popular anonymous accounts tweeted, to all the anonymous attacking the children's hospital in the name of anonymous, it's a hospital.
Stop it. The next day the attacks stopped, almost completely. After three weeks of a continuous distributed denial of service attack, the network traffic returned to normal. We know these events occurred because the CIO of the hospital posted an article in the New England Journal of Medicine describing everything that happened.
The hospital estimated that this attack cost $300,000 in damages. It seemed the point had been made, and the network returned to normal. The hospital collected all the logs of the attack and gave it to the police, then the FBI got involved and started building a case. They saw the attacks were coming from hundreds of different...
This episode is sponsored by Push Security. There's a gap that attackers are exploiting. They're stealing credentials, hijacking sessions, and abusing the one tool you use all day, your browser. It's where you log into everything, and historically, it has almost no real security instrumentation.
What Push Security is built for that layer. Push is a browser-native security platform. It detects phishing kits in real-time, as pages load, not after credentials are gone. It catches AITM attacks, session hijacking, click-fix lures, and malicious OAuth flows.
And Push doesn't just alert you when something's happening. It can block credential submission, stop session replay, and prompt users to enable MFA. You're fixing the problems at the exact moment it happens, and as close to the user as possible. And deploying it is as simple as downloading an extension for whatever browser you use, Chrome, Safari, Edge, the list goes on.
So check out pushsecurity.com. That's pushsecurity.com. For IPs, most of these were proxies, which hide the attacker's real IP. This didn't give the FBI any solid leads.
So the FBI went to YouTube. YouTube is in the company, like Google, actually. It's actually common that the FBI asks YouTube or Google for data like this. If a Google user is suspected to have committed a crime, and there's evidence in that user's account, that data can be turned over to the FBI.
So the FBI asked to turn over any information on who owned the YouTube account that posted that anonymous video. The account was found to be owned by Martin Gotzfeld, a 31-year-old male from Somerville, Massachusetts. On September 29, 2014, the FBI obtained a search warrant for Martin's house. On October 1, the FBI met with Martin.
Martin admitted to posting the video but not conducting the attack. The FBI interviewed Martin's friend, who said Martin did admit to doing the attack. When the FBI searched Martin's computers, they found Martin owned the anonymous Twitter account, which called for the attacks against the hospital. They also found chat logs where Martin and someone else was planning the attacks.
The FBI continued their investigation for over a year, collecting more evidence and keeping an eye on Martin. In February 2016, Martin and his wife disappeared. Not answering calls from friends, not going to work, not talking to family and not talking to police or FBI. The FBI agent went to Martin's house but nobody was home, and the car wasn't there either.
Martin and his wife could not be found. They had gone missing for two whole weeks, neither the police or FBI knew where they were. Then an FBI agent and a Bahamas discovered their location. Martin and his wife were on board a Disney cruise ship, not far from Cuba.
But the couple weren't actually passengers on the ship. They weren't employees or stowways either. They started out on a sailboat from Miami and were possibly headed to Cuba when something went wrong on their boat. Martin's wife called for help and the nearest ship to respond was a Disney cruise ship.
They rescued them. On board their sailboat was some luggage and three laptops. The FBI took them into custody upon arriving back in Miami. Martin is still in jail today, still awaiting his trial and sentencing.
While in jail, he wrote a letter to Huffington Post titled Why I Knocked Boston Children's Hospital Off the Internet. It reads, in part, The answer is simpler than you might think. The defense of an innocent, learning-disabled 15-year-old girl. I had heard many, too many, such horror stories of institutionalized children who were killed or took their own lives in the so-called troubled teen industry.
I never imagined a renowned hospital would be capable of such brutality, and no amount of other good work could justify torturing justina. Their network was strong, well-funded, but especially vulnerable to a specific attack. Apparently Boston Children's Hospital was unwilling to architect around the problem. I see such laziness often in my work, and at least our nation vulnerable.
I had spent my career building cyber defenses. For the first time, I was on the offense. I coded around the clock for two weeks to perfect the attack. Small test runs were made.
Boston Children's Hospital bragged to the media that they were withstanding the onslaught and hadn't been taken down. They had no idea what was to come. I finished the code just in time. It ran.
Boston Children's Hospital's donations page went down. As they were down, I was nervous. I left it running for a few hours. Then with some donation time still left, I issued the command to stop the attacks.
The point had been made. Justina wasn't defenseless. Under the banner of Anonymous, she and other institutionalized children could and would be protected. Martin had previously advocated for children in the troubled teen industry and spoken out about other mental health homes for children.
But with these statements from him directly and the FBI's affidavit, it seems like Martin was the person who started this campaign and waged the attacks himself. But the courts will ultimately decide that. Martin's wife has set up a campaign called Free Marty G, and it has a tagline. He helped her.
Now let's help him. Leading up to Martin's court arraignment, he went on a two-week hunger strike. At the arraignment, Martin pleaded not guilty, even though he previously admitted to doing the attack. And then he feented in the court because of the hunger strike.
He could be facing 15 years in prison for violating the computer fraud and abuse act. And recently, he's been trying to run for Senate while in jail. I don't understand how that's possible, and I'm not even going to go into that. As far as Justina goes, the protest outside the hospital kept growing in size.
And at some point even got hundreds of supporters outside chanting to free her. More and more media coverage was given to her cause. And after 16 months of being kept away from her parents, a judge ordered she could return home. When I was on my way back to my office, my wife's phone calling in, who's on the phone, Justina, and screaming, Daddy, Daddy, I'm coming home.
And I just praise the Lord. She's coming home. No strings attached. She is back to being part of the Pelletier family.
And we can start beginning the healing process. And now a few years later, Justina is still at home with her family. Still not yet able to walk, but her health has been improving since she's been home. And we still haven't heard a clear story from the side of the hospital or the state on why she was taken away.
So it still remains a one-sided story. The Pelletier family is now suing the hospital over this incident, claiming that during her visit, she was not treated properly. That lawsuit is still going on. More I researched the story the more bothered I am by someone attacking a hospital over this.
Yeah, the medical industry is really weird in America and sometimes seems corrupt. But Jesus, if I get sick and go to hospital, I don't want to worry about someone attacking it over some custody case that I have nothing to do with. The national news is a good job of drawing attention to this controversy. There was no need to draw more attention.
And by the time the attack was done on the hospital, Justina wasn't even there. Hospitals are under-resourced when it comes to IT budgets and security. If they have to choose between saving a life or keeping the network up, they're going to save a life. But I'm curious to hear what you think.
Yeah, you, the one listening to this right now, same question I asked you at the beginning. Is it ever okay for activists to attack a hospital like this? Was this attack justified? Let me know on Twitter.
Use hashtag darknet diaries. And let me hear what you think. The whole rest of the day really means a lot to me. Thank you so much.