Password: Charlie

Written by David Kushner, Wired

Friday June 1st, 2007

Charlie. It all started with Charlie.

As in Chester Charlie Bennington, lead singer of Linkin Park. His band’s infectious mashup of rap and rock had made it the most high-profile act in the genre called nu-metal. He’d sold more than 40 million records. Played stadiums, seen the world, won a couple of Grammys.

Only 30, Bennington had survived a tough past of drugs and abuse. He married and had a child, then endured a bitter and costly divorce. He had recently remarried, this time to a gorgeous schoolteacher named Talinda, and moved into a 6,000-square-foot house in Orange County.

Fans loved the pierced and tattooed man-boy for his primal scream and his approachability, the way he would sign their photos and wave back to them at the grocery store. When a group of overenthusiastic teenage girls mobbed him and ripped out some of his hair, he took it in stride. “The fans are the biggest reason we do what we do,” Bennington told me at a recording studio in West Hollywood. He was dressed in ripped black pants, black knee socks, and a long black coat with Lenin’s face stitched on the side. “If fans come up to me, I talk to them, ” he said, “I’m not an egg. I don’t need this protective wall.” So when he had to choose a password for his Mac.com email account, he just typed the first thing that came to mind, something short and easy to remember: Charlie.

Talinda Bennington sat down to check her email. It was March 2006, and for Talinda, 29, life was good. She had recently married Chester and they had just had a son together. Chester was working on an album with legendary producer Rick Rubin. She opened a message from an unfamiliar address. “I’m very happy for you and Chester,” it read. Then, as if to taunt Talinda, there was a link to a Web site run by Chester’s ex-wife, Samantha.

Talinda didn’t make much of it. She was married to a rock star, so she knew how obnoxious fans could be. They blasted Linkin Park songs outside the couple’s house at 3 am. Nailed lyrics to their front door. One time, a woman slammed on her brakes and caused an accident when she saw Chester strolling by — she had to stop and tell him how much she loved him. “There are always going to be encounters that you kind of wish went differently,” Chester says. “But the average fan really isn’t fanatical.”

On April 6, the Benningtons heard from an old friend who had received a similarly cryptic email, this one from the address informant_for_u@

yahoo.com. The friend had dated Talinda years before, and the email he received made all sorts of dark inferences based on that fact. Later, when Chester was out of town, Talinda got a message from the same address. But this time the tone wasn’t vicious; it was weirdly familiar and solicitous. “I know you’re going through a hard time being alone,” it read. “My thoughts and prayers are with you.”

The creepily chummy emails continued through the spring. Then, in the wee hours of the morning, Chester’s cell phone rang. He fumbled for it in the dark, but when he answered there was dead silence on the other end. It happened again. And again. And again. When Chester rang back the number on caller ID, he got a switchboard operator in New Mexico.

“Someone called me 15 times between 4 am and 4:30,” he complained.

“Well, who’s trying to call you?” the operator asked him.

“That’s the problem!” he said, he didn’t know. But the operator was no help. Maybe she was feigning ignorance. Or maybe she was a telemarketer. “Stop calling my fucking phone!” he screamed, and hung up.

One night soon after, Talinda had just put their son to sleep and crawled into bed when Chester’s cell phone rang. This time, she reached over and answered it herself.

“I’m watching you, ” a woman’s voice said.

Talinda tried to shrug it off. “Whatever,” she said.

“Whore!” the woman snapped back and hung up. Caller ID had been blocked.

Friends began emailing Talinda and referring to messages they had received from her — messages that she had never sent. When they forwarded the emails to her, she saw that they came from a Yahoo account she hadn’t used in months.

Then Linkin Park’s head of security, Bruce Thompson, got an email from someone purporting to be Talinda. “Hi Bruce,” it read, “do we have an email address for Samantha? Strange emails from (fan?) sources have been received. They seem to know a lot of information.” Somebody was pretending to be Chester’s current wife to get contact info for his ex.

The mind games intensified as spring turned to summer. Informant_for_U emailed a steady stream of tips and warnings to the Benningtons that evinced a deep knowledge of their daily lives. As they struggled through a child- custody battle, the stalker “helpfully” outlined an elaborate scenario on how Chester might be able to discredit his former wife.

One afternoon, Talinda discovered that she couldn’t log on to her eBay account because the password had been changed. Soon after, she got an email from PayPal reporting that someone was trying to change the password to that account. Though such emails are often spam, sent by cyber criminals in an attempt to “phish” for user data, a call to PayPal confirmed it was real. No one had taken the Benningtons’ money, but someone was trying to gain access. The PayPal rep told her to notify her local police.

“This person is hacking into everything,” Talinda thought. “Are they watching me now? Are they here?”

In August, Chester got an automated text message from Verizon Wireless, his cell phone provider, confirming a new password for his online account. Like most phone companies, Verizon allows subscribers to manage their accounts on the Internet and view lists of incoming and outgoing calls. To open this type of account, users need only go online, fill out a form, and choose a password.

But Chester had never opened an online account for his Verizon mobile phone; he got his bills the old-fashioned way, by snail mail. So why was Verizon confirming a password change?

Suspicious, Chester and Talinda logged on and changed the password, promptly receiving an SMS verification of their change. Then another notification informed them that the password had been changed again. So the couple changed it back and got another confirmation. When they got yet another text message announcing yet another change they had not made, the Benningtons logged on and found a question written in the space where the password should have been.

“Who is doing this to you?” it read.
It was September 11, 2006, a fateful anniversary but just another Monday for Konstantinos “Gus” Dimitrelos. A solid 5’5″ Joe Pesci look-alike, Dimitrelos, 40, was sitting in his office behind a Belk’s department store in Spanish Fort, Alabama, when Talinda Bennington called. Dimitrelos is a former Secret Service agent with a black belt in judo and a knack for computer forensics. As a special agent in the Secret Service’s Technical Security Division, Dimitrelos would secure locations for visits by presidents Clinton and Bush — sweeping it for hazards like bugs and chemical weapons, as well as setting up evacuation measures in case of disaster or attack.

The mission of the Secret Service also covers fraud, identity theft, and assisting local law enforcement with forensics. As a result, Dimitrelos had chased down counterfeiters in Colombia and software pirates in Miami. He was particularly adept at interrogations. “I pride myself on getting a confession,” he says. “I’m a midget compared to the guy in the street, but I’ll break him. I’ll throw a chair through a wall, flip over a table.”

In 2003, Dimitrelos blew out a knee during a confrontation, which relegated him to a desk job. When he retired a couple of years later, he could have gone into the private sector — he had lucrative offers to do cybersecurity work for Home Depot and Bank of America — but that wasn’t his speed. “Corporate America just does not appeal to me; I like the idea of putting people away.” At about this time, the state of Alabama needed someone to set up a computer-forensics department and asked Dimitrelos to organize and run it. There was a two-year backlog of state cases seeking to use the FBI forensic labs, and state law-enforcement officers needed to be trained on the seizure of digital evidence. He wasn’t crazy about moving to the sticks. But he took the contract gig and ended up digging the beaches and the barbecues in this small town of 5,600 people.

Dimitrelos works in a windowless office with beige walls and drab furniture. A photo on the wall shows him behind the White House press podium (someone is hoisting him up so he can look over it). Another image shows Dimitrelos in Bogotá with a spread of bogus Benjamins on a table before him and a shit-eating grin on his face.

In addition to overseeing the Alabama digital evidence department, Dimitrelos founded Alabama’s High-Technology Crimes Task Force, working with current Secret Service agents on cases involving homicide, student hackers, and arson. And he pursues private for-hire cases under his online shingle, Whohackedme.com.

With his Secret Service experience and contacts, Dimitrelos has garnered plenty of referrals. Since starting his company, he’s done forensics work for Perverted-Justice.com, an organization that assisted Dateline’s “To Catch a Predator” TV series in busting adults cruising for minors on the Web. Private citizens, as well as organizations like the Boys & Girls Clubs of America, have hired him to sweep for bugs. He worked for the Department of Health and Human Services on a case involving an ex-employee who was sending threatening emails, and he assisted the FBI with an investigation of a Northrop Grumman employee accused of having a hard drive full of child porn.

There was one type of client, though, that Dimitrelos tried to avoid: paranoid celebrities. One high-profile musician had him check for microphones in the shower because he thought someone was listening to him sing. “Too many drugs,” Dimitrelos says. “I don’t want to take their money; it’s boring. If I don’t get a case that has meat, I don’t want to do it.”

But on September 11, 2006, a celeb case landed in his lap: Talinda Bennington called him. “I think someone’s hacking my email,” she said. She had been referred by his lifelong best friend, Beverly Hills attorney Daniel Hayes, so Dimitrelos heard her out. She told him about the escalating invasion she and her husband were grappling with, and that she had contacted local authorities only to be told that they couldn’t do anything until someone actually got hurt.

“OK, I’m on it,” Dimitrelos told Talinda. But privately he thought, “There’d better be meat here.”

He got Talinda’s login info and went into her Yahoo email account. On his 32-inch monitor, he started to examine the messages in Talinda’s out-box that had been sent without her knowledge. The activity on the account ran all hours of the day.

Dimitrelos pulled up the header of each email, which shows the Internet protocol address it was sent from. As he eyeballed several messages, one IP address kept popping up. Dimitrelos ran a program to trace the address. When the results flashed on the screen, his eyes widened. “Sandia?” he said. “This can’t be right.”

Sandia National Laboratories is one of the Department of Energy’s three nuclear weapons research facilities. Located in Albuquerque, New Mexico, it was created in 1949 by J. Robert Oppenheimer, former head of the nearby Los Alamos lab, as a center for developing the technology that goes into nuclear bombs. The lab is run by the Sandia Corporation, which is owned by defense contractor Lockheed Martin.

The thought of someone inside a top-secret nuke lab spending their days stalking a rock singer was ludicrous. Dimitrelos figured it must be a hacker who was using a Sandia machine as a proxy to protect their own IP address and identity. This wasn’t just about a nu-metal rock star and his family anymore; it was a national security issue. He had to let Sandia know that someone had compromised one of its computers.

Calling the lab directly seemed unlikely to bear fruit — he was halfway across the country, and he was working on a private case. Luckily, from his years at the Secret Service, Dimitrelos knew his way around government bureaucracies. He found someone in Albuquerque who might be able to assist him in his investigation: a Department of Defense agent named Jeff Fauver, who worked the computer-crimes beat.

Fauver was happy to help. Like Dimitrelos, he sensed that this had the makings of a federal investigation. But he didn’t have direct access. “The difficulty of working with Sandia is that the DOD is viewed as an outside agency,” he says. “We don’t have leverage to force them to provide information.” But Fauver worked his connections, and a few days later he heard back from Sandia’s IT supervisor. The reply: “It’s probably a compromised machine.”

When Dimitrelos heard this news from Fauver, he sank into his chair. With a hacker God knows where, using Sandia as a proxy, the odds of catching the person were next to none. But the former wrestler wouldn’t let go. “I’m sort of a Columbo,” he says. “I keep going back, looking for something I must have missed.”

So he stayed up late into the September night, poring over thousands of the Benningtons’ emails. And that’s when he caught it: another IP address. He traced this one to a Comcast account. The subscriber’s name was protected, but the location wasn’t; the account was in Albuquerque.

Dimitrelos had a hunch. He re-created a timeline of the activity coming from New Mexico, and, sure enough, a pattern emerged: seven hours of messages coming from Sandia during the day, then four or five hours coming from this Albuquerque residence at night. Could they be the same person? Did the stalker work at Sandia?

“Whatever you’re doing, you’ve got a good case,” Fauver told Dimitrelos in a phone call. Fauver discovered that though the stalker was using a proxy server at Sandia, they weren’t accessing it from outside the facility but from another computer terminal inside the lab. And now a supervisor at Sandia wanted to know why a DOD official was so interested in this case. “Because,” Fauver replied, “the person is working where there’s sensitive information and technology. And clearly that has relevance to the Department of Defense.”

When Dimitrelos got off the phone with Fauver, his heart was pounding. There was meat here.

As Dimitrelos worked the case from Alabama, the Benningtons continued to be harassed by the cyberstalker they sometimes referred to as Crazypants. Dimitrelos hadn’t yet revealed his suspicions about the culprit, and looking back on the fall of 2006, Talinda says she was confused and suspicious. “I didn’t know who to trust,” she says. “I literally only trusted my husband. Our family and closest friends were all suspects.”

“Is it one of my cousins?” Chester wondered. “Is it one of the assistants of the guys in the band? Is it some new person at the management company?”

The rock star who’d prided himself on his accessibility began to erect walls. He put in motion sensors. Bought a guard dog. Installed alarms on every window. Called his dad and brother — who were cops in Arizona — and asked them to help get his local police in California to keep an eye on his house. Chester considered hiring a personal assistant to do errands for him but balked. “That’d be another person in my life that I didn’t know if I could trust,” he told me.

Dimitrelos wasn’t exactly reassuring. “Do what makes you feel comfortable,” he told Chester. “But it’s a waste of money, they’re already so far into your accounts.” To make matters worse, the couple had to let the stalker continue to harass them. Dimitrelos asked them to go about their lives and not let on that he was racing to pinpoint the culprit, who was growing increasingly bold. “I know where your kids are,” she told them one day when she called. “I have complete control of your lives.”

The case that Dimitrelos code-named Operation Eavesdrop had taken over his life, too. On a steady diet of pizza and Coke, he worked seven days a week, analyzing tens of thousands of messages that had gone in and out of the Benningtons’ email and voicemail accounts, assembling a detailed timeline of the attacks.

This was no longer a private case. On October 11, Fauver initiated a federal investigation with the DOD and contacted Department of Justice prosecutor Fred Federici, an assistant US attorney for the district of New Mexico. Dimitrelos could continue to drive the investigation because, as a member of the electronic-crimes task force, he was sworn in as a federal agent through the US Marshals Service. Dimitrelos had brought in an old friend with whom he worked regularly, Secret Service agent Kevin Levy. (As a current agent, Levy was not allowed to go on record for this story.)

When Dimitrelos, Levy, and Fauver had amassed sufficient evidence of the stalker’s online activity, they acquired a subpoena from New Mexico District Court requesting that Comcast release details on the subscriber behind the residential IP address in Albuquerque. Comcast reported that the address belonged to Devon Townsend.

Dimitrelos tracked down her MySpace page, which revealed her to be a 27-year-old single mother of an infant son. She lived with her own mom in Albuquerque and was a self-described “computer nerd” who liked grilled-cheese sandwiches, hated applesauce, and took pride in being a parent. “I enjoy watching my son grow, knowing that whatever I do impacts him,” she wrote. Dimitrelos couldn’t believe that this was the stalker.

By this point, Fauver’s DOE contact, special agent Matt Goward, had convinced Sandia officials to send him a copy of her hard drive. Townsend was employed at Sandia as a computer technologist, assisting the engineers and researchers at the facility.

“This case is unbelievable,” Dimitrelos thought. Townsend had Q-level security clearance, which allows nonmilitary personnel to access atomic or nuclear materials. It was equivalent to the clearance level that Dimitrelos himself had when he was protecting presidents. And yet she was spending seven hours a day at Sandia logging in and out of strangers’ email accounts.

Dimitrelos wondered how Townsend pulled this off. He assumed the Feds monitored the computer activity of people in nuclear research labs. But, as he learned after reading up on Sandia, the lab had recently experienced another security scandal.

In 2004, Shawn Carpenter, a network-intrusion-detection analyst at Sandia, discovered an attack on the lab’s computers (later linked in news reports to a Chinese hacking group called Titan Rain) and began back- hacking to uncover the problem. Carpenter informed the Army Research Lab and worked with them to help ID the hackers, for which he claims Sandia fired him. He sued for wrongful discharge. According to court documents, he claims he was told by Sandia’s head of counter intelligence, a retired CIA officer, “If you worked for me, I would decapitate you!” (On February 13 of this year, a New Mexico jury awarded $4.3 million to Carpenter. A Sandia spokesperson announced that they were “disappointed” by the verdict and planned to appeal it.)

Dimitrelos was incredulous. “Here’s a person trying to do the right thing,” he says, “and he was stifled internally.” The Carpenter case suggested to him that Sandia officials might not be fully helpful in his investigation. And that wasn’t all that concerned him. Through one of his DOE contacts, Fauver learned that Townsend’s mother was also employed at Sandia. She worked directly under Norm Jarvis, the head of security. Whether or not Townsend’s mother knew of her daughter’s alleged crimes, Dimitrelos was hesitant to work directly with Sandia’s security department. For all he knew, the mother would inform her daughter of the investigation, and Devon Townsend would try to cover her tracks.

Luckily, Dimitrelos found Gus Tyler Smith, a sympathetic agent in the Technology Crimes Section at DOE headquarters in DC. They hit it off — Dimitrelos called him Big Gus, and he was Little Gus. Big Gus got clearance for Levy and Little Gus to visit the lab and agreed to meet them there. Dimitrelos was convinced that they had to move fast. “Let’s pack our bags,” he told Levy. “We’re going to Sandia.”

The Benningtons had no idea that investigators were closing in on the person who was wrecking their lives. Around this time, Chester got an email from Informant_for_U. “Hey,” it read, “I felt that you probably need this for tomorrow.” He opened the attachment and gasped. It was a day sheet, the detailed schedule for a music video he would be filming the next day. The stalker knew more about his life than he did.

On November 14, Dimitrelos and Levy arrived in Albuquerque. They were there to get a formal confession from Devon Townsend. As the lead investigator on the case, Dimitrelos would conduct the interview that would later be used by the US attorney’s office. Big Gus and a man who never revealed his identity met them at the gate and followed them as they walked through the federal bunkers and wound down the hallways. The layout was unnerving: It was a one-story building with an elevator going down.

Devon Townsend worked in a cramped pod of cubicles with several other people. Her workstation was easy to spot — there was a sticker behind the monitor with the name of her favorite band. But she wasn’t around. Her manager went to fetch her, typing a security code to unlock a heavy door. She arrived a few moments later, a Native American with a round face, long dark hair, glasses, and a Linkin Park hoodie.

Dimitrelos introduced himself as a retired Secret Service agent. “Do you mind if I ask you a few questions?” he said. They walked her to a small concrete DOE building across the street, loosening her up with small talk along the way. “You look fit,” Dimitrelos said. “Do you work out?”

Levy and Dimitrelos sat down to interview Townsend. Big Gus did not take part, but DOE agent Goward was there, floating in and out of the room. Levy read Townsend her rights and had her sign the Secret Service’s Warning and Consent to Speak form 1737B. Then Dimitrelos got down to business.

“Do you know the band Linkin Park?” he asked Townsend.

“Yeah, I know them,” she replied. “I’m wearing their jacket.”

“You finish these sentences for me,” he told her as he began to repeat a passage from one of the messages the Benningtons had received. After all these months, he’d memorized it.

Dimitrelos recited from an email in which the stalker had taunted Chester and Talinda about trying to change their passwords. “You finally got smart and decided to change your password. What does — ”

” — Japan mean?” said Townsend, completing the sentence from her own email.

“OK,” Dimitrelos continued. “On November 9, you sent an article about — ”

” — cyberstalking,” she said.

There’d be no throwing chairs through the wall to elicit this confession. Townsend coolly told her tale. The stalking started after she saw Chester’s email address inadvertently CC’d in a mass mailing to promote a tattoo parlor he owned in Tempe. Using Chester’s birthday and zip code to access his Mac.com account, she started guessing passwords until she found the right one: his middle name, Charlie.

Townsend suddenly had access to all of her idol’s messages. Soon she had Talinda’s Yahoo address, too, and after guessing the password, she reset it. From there, her infiltration was a feat of feverish social engineering. As Townsend pored through the Benningtons’ email, she began cataloging every detail of their lives: friends, Social Security numbers, photos, plans. Getting Chester’s cell phone data was a snap: All she’d needed was his wireless number, his zip code, and the last four digits of his Social Security number to register his Verizon account online and get complete access to records of his calls. Even Townsend herself seemed astonished at how easy it was. When she opened the Verizon account, the user ID she chose was “ohshititworked.”

Why did you do all this? Dimitrelos asked. In flat tones, Townsend told him that she was bored. Her job at Sandia took about half an hour a day, and she was looking to pass the time.

Dimitrelos pressed for more from Townsend, trying to get a sense of her feelings about her victims. Townsend told him she loved Linkin Park, particularly Chester. She said she wanted to be “part of what he is.” In some of her emails, Townsend had told the Benningtons that she was trying to shield them from any bad information or emails that may be coming their way. It was classic stalker behavior — introducing duress, then pretending to relieve it in an attempt to appear useful. She finally told Dimitrelos that she knew what she was doing was wrong, but she couldn’t stop.

Levy and Dimitrelos drew up a confession. Townsend signed it, and they witnessed it. They made her promise not to have further contact with the Benningtons. Then she was free to go. Fauver filed a complaint on November 20 that relied on information from the interview, and Townsend was jailed that day. She was released the next, but soon afterward Sandia placed her on leave, and eventually she was fired.

As Dimitrelos and Levy were interviewing Townsend, Fauver and a dozen officials from the DOE, the Secret Service, and the US Defense Criminal Investigative Service (a division of the DOD) arrived at Townsend’s house with a warrant from a federal judge for the district of New Mexico. Inside, they found a shrine to Linkin Park: posters, a montage of photos, a paper plate signed by Chester, and a Linkin Park poster over her son’s crib.

When officials confiscated Townsend’s hard drive, they found thousands of the Benningtons’ emails, a detailed log of their friends and family, and more than 700 of their private photos. They also found one of Townsend’s personal photos, taken backstage at a concert Chester gave in Arizona. She’d learned about the event through the Benningtons’ emails, then monitored their voicemail to figure out where they would be at certain times.

The picture showed Townsend standing proudly next to Chester.

Later that day, Chester’s cell phone buzzed. “I’m sorry for doing what I did to you guys,” Townsend text-messaged. “Please accept my apology.” It was her last communication to the Benningtons. When Dimitrelos called later to announce she’d been caught, Chester felt physically ill.

“It sparks the sort of anger you don’t normally experience,” Chester told me wearily as he sat in the recording studio in March. The lights were low. Paintings of Buddhas adorned the walls. The band had just finished recording its new album, Minutes to Midnight, which was due to hit shelves May 15. But Chester wasn’t celebrating. He’d lost a year of his life to a stalker, and he was still feeling wounded.

“I don’t go out and pick fights,” he said. “But when you find out some total stranger has personal pictures of your kids in the bath, has phone numbers of your parents and close friends and every business associate, listens to every voicemail you’ve had for the last year, intercepts every email you’ve written or received … it fuels my desire to make sure this kind of action is viewed as criminal.”

The scary part is that it could have been much worse. Townsend might have emptied their bank accounts, disseminated their Social Security numbers, or exploited the information to harm their children.

Townsend’s attorney Ray Twohig declined to comment to Wired, saying only that “the case is proceeding.” But at Townsend’s detention hearing he conceded, “We have an invasion of privacy here by a fan that goes beyond what most of us are familiar with. This is not someone hiding in the dressing room of a rock star; it goes further than that.”

At the detention hearing, Townsend was placed under house arrest and forbidden to use a computer, cell phone, game console, or anything else that could connect to the Internet. A call to her residence was answered by a man who also refused to comment.

Townsend is facing a range of possible charges, including interception of electronic communications, unlawful access to stored communications, fraud and related activity connected with information, fraud and related activity in connection with computers, and unauthorized trafficking of sound and video recordings. The DOJ will not comment on an ongoing case.

Dimitrelos says there should be consequences for Sandia as well. “The US attorney wanted to get me on a gag order,” he says. “I told him to suck it.” Dimitrelos believes that Sandia’s ignorance of Townsend’s activity speaks poorly of the lab’s security. Fauver concurs, saying, “It causes me great concern that there would be people inside Sandia able to use a network that was not being closely monitored.”

Sandia downplays the potential for other people to do what Townsend did. “The employee has discovered a vulnerability in the system, and we’ve addressed that issue,” Sandia spokesperson Michael Padilla says. He stresses that her computer was not in a secured area and adds, “She had a lot of free time, apparently.”

The National Nuclear Security Administration, the DOE agency that oversees Sandia, issued a statement to Wired, reading in part: “Multiple layers of stringent security controls were in place at the time the incident occurred and the security of Sandia’s network was never compromised. Although the Laboratory is planning to improve Internet monitoring capabilities for outbound connections, no policy changes have been required as a result of the incident. The only completely effective way to prevent abuse of Internet access is to deny it entirely, and that is not a viable option for a research and development laboratory.”

Meanwhile, Chester Bennington is grappling with the headaches that increased security brings. His passwords are now long strings of random letters and numbers that he changes frequently. “I keep a list for every different thing, and it drives me out of my fucking mind,” he says. “I want to go back.” Back to Charlie.