To HELL and BACK (Login To HELL)

A REAL HACKER’S STORY

The notion left me pondering — do we truly have control over our choices, or are we merely products of circumstance? This question weighed heavily on my mind, even in my weakened state. As I contemplated my situation, I couldn’t help but wonder if our choices shape our lives, or if it’s the other way around.

Learn about the story of Alberto Daniel Hill, the Uruguayan computer and crypto expert who was unjustly sent to prison for a crime he did not commit.

Adapted from an article by Manuel Rangel.

In February 2017, the website of one of the most important mutual insurance companies (a company that provides insurance and medical services that functions similar to a cooperative) in the small and beautiful country of Uruguay was hacked. The cybercriminal accessed the portal’s database, stealing thousands of megabytes of confidential information from its patients, and sent an email to the company demanding a ransom payment of 15 bitcoins. If the company did not pay, the cybercriminal threatened to reveal confidential medical data of the patients. However, this was not enough, as the hacker demanded an additional 5 bitcoins for each day that passed without receiving payment, an “interest rate for every day they made him waste time.”

In total, the reward requested reached a total of 60 thousand dollars… Ironically, the biggest delay faced by this cybercriminal was due to the fact that he never provided a payment address… This story was just beginning.

Obviously, Círculo Católico de Obreros de Uruguay, the affected mutual insurance company and an institution that has been founded for more than a century, would not remain idle. For weeks, they worked with the police to track down the extortionist. 7 months later, according to the Ministry of the Interior, they traced an IP address of the person who allegedly hacked the company’s database.

Like in a movie, the police in Montevideo raided the apartment of Alberto Daniel Hill, a 41-year-old computer engineer, lover of computing, computers, and blockchain technology. Alberto had collections of different types of hardware in his home: computers, USB devices, unused mobile phones, cryptocurrency wallets. In addition to this, the police found dollars and euros in cash, equipment to record and read magnetic cards, and several dozen of these cards in his name, and a Guy Fawkes mask, which has become a symbol of anarchists around the world. “Bingo!” exclaimed the police, these elements were enough evidence to prove that Alberto was the hacker they were looking for.”

By some of his most basic rights, such as his personal information (including constant monitoring of his web activity), and executing a judicial process with many inconsistencies, Alberto was sent to prison. Not satisfied with this, his case was broadcasted through the media as a great triumph of the Technological Crimes Section of the General Directorate of the Fight Against Organized Crime and Interpol, and the Presidency of the Republic itself, publicly humiliating him as the cyberterrorist protagonist of the “Bitcoin Operation,” as the first case of “cybercrime and extortion with cryptocurrencies” in that country was called. Case closed.

Not at all! After eight months in the Durazno prison in Uruguay, Alberto Daniel Hill was released after the appeal. His return to freedom was with a single mission: to clear his name and prevent injustices like those committed against him from happening again. Alberto maintains that he is innocent, and we will relate his story below.

His goodwill as a hacker opened the doors to his nightmare

And the thing is, Alberto is a hacker, not only his profession but also his personal identifying title for decades, being a hacker is a lifestyle, but unfortunately, due to inappropriate use in journalism, it has acquired a negative connotation in public opinion. The “first hacker” who was sent to prison in Uruguay affirms his innocence and has evidence to prove it.

Here we have to highlight that Alberto was not convicted of any crime, and his months in the Durazno prison were due to the judge’s consideration that “he had a high probability of fleeing,” coupled with “his high computer knowledge could interfere with the rest of the process,” so he was confined to preventive prison while the authorities continue to study the case.

To understand the whole panorama, we have to go back 2 decades. Alberto Daniel Hill has more than 20 years of experience in the computer field, working for important companies and for the Uruguayan government itself, precisely in the area he loves the most, computer security.

In 2004, when the Internet was just beginning to be popularized, his name became known as he performed the first computer expertise in a case related to child pornography, a job for which he did not charge fees. He even had the experience of collaborating with Interpol.

As a good fan of computing, he had early contact with the ideals of Satoshi Nakamoto, falling in love with the benefits that blockchain technology offers to humanity.

So he has also dedicated part of his life to sharing his knowledge and spreading the idea of decentralization through essays and conferences. In short, Alberto is an engineer fervently convinced that computing can improve social processes and, consequently, generate a better world. A whole life philosophy incompatible with the crimes he is accused of.

Here we make a small parenthesis. Unfortunately, the media and the culture of cinema and television have generated that the word hacker has a very negative connotation in recent years. It is very common to see in some Hollywood series or productions, the typical representation of a hacker typing noisily, inserting thousands of lines of code, and deciphering keys, with the intention of stealing millions of dollars, a process that according to celluloid lasts only seconds.

A very distant image from the truth since stealing and extorting with digital information is only the work of a small sector of criminals sheltered under the word hacker.

Really, and according to the RAE itself in its twenty-third edition of its an expert in handling computers, who deals with system security and develops improvement techniques.”

In short, someone who has dedicated his life to programming digital security barriers. Even, there are “ethical hacker” certificates (Alberto has one of these), which guarantee the professionalism and ethics of the hacker community.

Alberto ensures that it is normal for hackers to navigate the internet and test the security of the sites they visit. It is a hobby that helps them improve their skills. If they find a security flaw, the hacker has the responsibility to notify the company or institution that their website is vulnerable to any attack.

In fact, Alberto has dozens of records of his constant reports to Uruguay’s Computer Security Incident Response Center (CERTuy), a government institution dedicated to protecting Uruguayan government entities and companies from cyber-attacks.

This was precisely what Alberto did in 2014. His girlfriend at that time needed to check her medical records in the mutual insurance company. Therefore, Alberto accessed the site and, after consulting the data he was looking for, took the opportunity to review the site’s security, finding a critical vulnerability: he realized that the username and access password was admin/admin, the most generic username and password on the internet.

Entering as an administrator, he realized that not only his girlfriend’s data but all of his patients’ data was in danger. And not only that, even financial information from the company was exposed. Therefore, Alberto immediately sent an email to CERTuy notifying this serious flaw along with the IP address and methods he used to enter, an email that was vaguely answered.

In 2015, he found another flaw, this time it was the absence of proper access control to the site, so he reported the problem again. Satisfied with having done his job, Alberto disengaged and continued his life and his projects until three years later, he received a citation from the Montevideo Police, to attend an interrogation for a cybercrime case. Alberto, with nothing to fear, attended the appointment.

At the place, Interpol officials were waiting for him, who questioned Alberto and asked him about his connection with the company. Completely sincere, Alberto recounted how three years ago he found a critical flaw within the website portal, which was reported to CERTuy. Like another one the following year. Next, they showed him the email in which an anonymous hacker claims to have the company’s database, threatening to publish it if 15 bitcoins are not paid.

Alberto denies having sent that email or hacked the website. However, there begins his ordeal.

A Guy Fawkes mask turns him into Interpol’s trophy

As we mentioned at the outset, on September 10, 2017, the police raided Alberto’s apartment, a typical home of a computer engineer with computer parts everywhere. What first alarmed the police were some books on Bitcoin, a very new and revolutionary topic, which due to the officials’ profound ignorance of cryptocurrencies, and the unfortunate association of these in their beginnings on the deep web with money laundering, immediately raised suspicions.

In fact, Alberto is a deep enthusiast of this topic. In 2015, he received a capital from his father’s life insurance, which allowed him to invest in some cryptos such as bitcoin, litecoin, ethereum, among others, to later make purchase-sale transactions with some of them, so he had some thousands of dollars and euros in cash, savings from his entire life which Alberto perfectly justified. They did not believe him.

They also did not believe Alberto when he justified why he had 50 used hard drives, 7 laptops, and all kinds of hardware. As a good computer expert, one of Alberto’s hobbies is to dismantle all kinds of computer equipment to see its interior, test with different operating systems, and many other activities. That, along with old cell phones accumulated in his drawers for years, and his cold wallets of cryptocurrencies.

What finally convinced investigators that they had found the criminal they were looking for was the card cloner and some dozens of credit and debit cards. The police immediately assumed that Alberto obtained TDC numbers online and printed them on his cards, despite Alberto’s clear explanation, who was precisely conducting research on security problems related to Credit Cards. They did not believe him either, despite the fact that he has given several talks on cybercrime, where he addresses the topic.

Finally, in the file presented to accuse Alberto, the police indicated that they had found a guillotine in his apartment. Yes, that execution device from the Middle Ages, the same one with which they cut off the heads of Louis XVI and Marie Antoinette during the French Revolution. The Reality? A simple paper cutter.

The final evidence they used to present him as a prize to the media was the Guy Fawkes mask, which, as we know, is the symbol of hackers worldwide. For the Director of Interpol, this curiosity was definitive evidence of his guilt.

Alberto’s explanation and the other elements found in his apartment did not matter, the police needed to solve the case, and they were even excited to demonstrate that they had captured the first “cyber-terrorist” in the history of Uruguay.

It should be noted that here begins the chain of irregularities in Alberto’s process. The search warrant file irregular, it does not show exact times, nor correct names or quantities of what was seized.

Additionally, the police also took perfumes, clothing, and other personal items as evidence. They even took valuable belongings from his girlfriend, mother, and a close friend, which to this day, despite all the efforts, have not been returned, generating extra problems for Alberto. Without a warrant and without Alberto’s knowledge, the police entered the private parking lot where he kept his car and searched it.

And something very important that we must highlight. As we mentioned at the beginning, the Ministry of the Interior indicated that the 7-month investigation led them to his person thanks to the IP address. This is technically impossible since, first of all, there is no IP address that links the extortion email to Alberto. And secondly, tracing an IP address takes only minutes. Why did the investigation last so long?

With every passing hour, the nightmare grew. After the disaster they made in the apartment, the threats and pressures began. An officer approached him and threatened him, expressing that if he did not confess and accept being the hacker they were looking for, they would make his girlfriend and mother go through very bad experiences.

Those who have not been in similar situations may not know the harsh psychological torture that officials trained for years are capable of exerting during interrogations.

After several hours, and after evaluating his options, Alberto decided to accept that he sent the email, to avoid the threats from continuing and to keep his girlfriend and mother safe. In fact, the police had threatened to raid his mother’s apartment.

Alberto was very confident that later, with no evidence or IP addresses linking him to that email, he could prove his innocence, trusting that the judicial system would help him as a citizen to get out of this predicament.

However, this was not the case. Alberto had to go through the painful experience of seeing his girlfriend also arrested and psychologically tortured.

He would later learn that the officials had told his girlfriend that he had confessed everything and accused her of being the one who orchestrated the whole plan to extort the mutual health organization.

During the days of the criminal process, Alberto was questioned over and over again with questions that in many cases had nothing to do with the process.

He tried to explain the truth, but it was almost impossible for him to make himself understood to the bureaucrats of the judicial system, due to their minimal knowledge of computers, and the same arrogance of the officials, who claimed to have known bitcoin for more than a decade, when by 2017, it had been 8 years since the genesis block was mined, and only since 2012 had it become popular in some circles of the deep web. The irony is that, according to them, they knew about BTC even before Satoshi Nakamoto himself, but did not even know what an IP address was.

In summary, a process with many inconsistencies that has not even ended because the volume of information is too high for the capacity of Uruguayan authorities, demonstrating the sad technological lag of security institutions in our Latin American countries. At the end of 2017, and while the authorities, in theory, continued to analyze the evidence, Alberto was sent to pre-trial detention (threatened with being convicted of extortion and fraudulent access to secret information), to the prison in Durazno, in the interior of the country.

As mentioned earlier, Alberto was humiliated in Uruguayan media, being presented as the first hacker arrested for cyber crimes in the country. His case was so widely publicized that upon arriving in Durazno, both the rest of the prisoners and the directors knew his story inside and out.

An innocent hacker in jail.

Alberto’s profile was very different from that of the of his fellow inmates: sexual abusers, murderers, and criminals of all kinds. Although the authorities were alerted that Alberto could not touch any computer for fear of his skills, his charisma and good behavior allowed him to win the goodwill of everyone in the place. After three months in Durazno, he was already teaching basic computer classes to the other inmates.

His experiences in prison are many, however, and despite having some privileges, Alberto’s anxiety about being in prison for a crime he did not commit generated a deep trauma that affected his health.

During those months, Alberto’s lawyer worked hard to get him out of jail. However, fortune arrived at the dawn of early May 2018.

In the appeal, the judges ruled in his favor that pre-trial detention was a measure that did not correspond to his case, and after paying a bail of thousands of dollars, on May 17, Alberto Hill, the first “hacker arrested in Uruguay” for a crime he did not even commit, was granted provisional freedom.

However, his hell did not end there. Upon returning to his apartment in Montevideo, Alberto saw that some of his electronic devices that were going to be used as evidence were there, reaffirming the many irregularities that occurred in the process.

According to Alberto himself, he believes that they did not even bother to conduct a proper investigation. The police needed a trophy, unfortunately, he was chosen.

Alberto not only lost almost a year of his freedom, but also due to the trauma, his 8-year relationship with his girlfriend ended drastically, and his life savings were seized.

In addition, his reputation as a citizen was destroyed when he was presented as a criminal to all of Uruguay without the right to reply. We also highlight that his process is still paralyzed because, as we expressed paragraphs ago, the police do not have the capacity or tools to analyze all the gigabytes of information found in the seized evidence.

But despite all the negative aspects, for Alberto, this nightmare also had its positive side. This experience strengthened him in many aspects of his life, which has led him to initiate a tough fight to recover equipment with valuable information still held by the police, and beyond that, a fight to clear his name, to forever prove his innocence, and to spread his story.

In fact, the dissemination of his case internationally has made Alberto have the support of many computer experts in a large number of countries, including some who, like him, went through similar situations. Recently, he had the opportunity to tell his story at one of the largest computer security conferences in the world, in which his courage was applauded by hundreds of people. And this is not to mention that more and more publications, magazines, and specialized sites contact him to know the truth about “Operation Bitcoins”.

Speaking of Operation Bitcoins, Alberto Daniel Hill will give a better use to these words that became his personal nightmare for over a year and give them a better meaning. is creating with that name, with the aim of helping and advising all those who have been and will be unjustly imprisoned for alleged computer crimes.

In this way, Operation Bitcoins will become a symbol of strength that will prevent others from living the hell he lived.