Tillie Kottmann

maia arson crimew (formerly known as Tillie Kottmann, and also known as deletescape and antiproprietary; born August 7, 1999) is a Swiss developer and computer hacker. crimew worked in information technology as a teenager, becoming the founding developer of Lawnchair Launcher, a popular application launcher for Android. She is known for leaking source code and other data from companies such as Intel and Nissan, and for discovering a 2019 copy of the United States government's No Fly List on an unsecured CommuteAir server. crimew was also part of a group that hacked into Verkada in March 2021 and accessed more than 150,000 cameras. crimew has cited anarchism, anti-capitalism, and her opposition to the concept of intellectual property as the motives for her hacking.

In March 2021, crimew was indicted by a grand jury in the United States on criminal charges related to her alleged hacking activity between 2019 and 2021. The charges were unrelated to the hack of Verkada. Her home and her parents' home were raided by the Swiss police at the request of United States authorities, and her electronic devices were seized. People used the hashtag "#freetillie" to express support for her in the aftermath of the raid, and the Swiss magazine ''Republik'' compared her to Jeremy Hammond and Aaron Swartz.

Data and source code leaks

In July 2020, crimew posted source code from dozens of companies to a GitLab repository. She was credited with originating the Nintendo Gigaleak by ''Bleeping Computer'', but she later told ''Tom's Guide'' that Nintendo data was not included in the July leak, and that she had never posted Nintendo code to GitLab because the company was "notorious for quick takedowns". On August 6, 2020, crimew uploaded more than 20 gigabytes of Intel's proprietary data and source code to Mega. She obtained the data from another hacker who claimed to have breached Intel around May 2020, and described it as a first installment which would be followed by more leaks related to Intel. In January 2021, crimew was involved in a source code leak from Nissan, stating that she acquired the leaked code after learning from an anonymous source about a Bitbucket server that was set up with the default username and password.

crimew said in March 2021 that most of her breaches did not require much technical skill. In addition to leaking data herself, she maintained a Telegram channel called "ExConfidential" where she shared details about leaks by others. In March 2021, Distributed Denial of Secrets created a torrent of data from the channel after crimew's home was raided and her devices were seized.

In July 2022, crimew discovered and reported a vulnerability in the mental health app Feelyou, which exposed the email addresses of its nearly 80,000 users and allowed anyone to connect supposedly anonymous posts to the email addresses of the users who posted them.

Verkada hack

On March 8, 2021, a group of hackers including crimew and calling themselves "APT69420 Arson Cats" gained "super admin" rights in the network of Verkada, a cloud-based security camera company, using credentials they found on the public internet. The group had access to the network for 36 hours. They collected about 5 gigabytes of data, including live security camera footage and recordings from more than 150,000 cameras in places like a Tesla factory, a jail in Alabama, a Halifax Health hospital, and residential homes. The group also accessed a list of Verkada customers and the company's private financial information, and gained superuser access to the corporate networks of Cloudflare and Okta through their Verkada cameras.

crimew acted as the spokesperson for the group of hackers. Her Twitter account was suspended for violating Twitter's terms of service after she used it to share multiple screenshots of live security camera feeds. During the hack, crimew tweeted "What if we just absolutely ended surveillance capitalism in two days?" She contacted a ''Bloomberg'' journalist shortly after the breach, who in turn contacted Verkada, which removed the hackers' access to the network. She told ''Bloomberg'' that the hack exposed "just how broadly we're being surveilled, and how little care is put into at least securing the platforms used to do so, pursuing nothing but profit". An acquaintance of crimew told that they thought she would have carried out the hack for fun regardless of her political views.

No Fly and Selectee Lists hack

On January 19, 2023, crimew reported that she had gained access to 2019 versions of the US government's No Fly List of 1.56 million entries and Selectee List of 250,000 entries posted by CommuteAir on an unsecured Amazon Web Services cloud server. crimew noted that "it's just crazy to me how big that Terrorism Screening Database is and yet there is still very clear trends towards almost exclusively Arabic and Russian sounding names throughout the million entries"; over 10% of the listed entries contained "MUHAMMED" in either the first or last name fields.

Indictment

In March 2021, crimew was indicted by a grand jury in the United States District Court for the Western District of Washington on charges related to several hacks she allegedly carried out between 2019 and 2021. The twelve-page indictment alleged that crimew hacked dozens of entities, published proprietary information and code from more than 100 entities including government agencies, and sold hacking-related merchandise such as t-shirts. It charged her with counts of computer fraud and abuse, wire fraud, and identity theft. The indictment, and a raid by the Swiss police in which crimew's electronic devices were seized at the request of United States authorities, came shortly after she claimed involvement in the Verkada hack but did not contain charges related to it. Seven police officers searched her home during the raid and fifteen searched the home of her parents. The website git.rip, through which crimew and others allegedly shared data obtained by hacking, was seized by the FBI.

As of March 19, 2021, crimew was being represented by lawyer Marcel Bosonnet in Switzerland. A crowdfunding campaign was created in April 2021 to raise money for her to retain a lawyer in the United States.

Public response

People used the hashtag "#freetillie" to express support for crimew after the raid of her home. Hacking researcher Gabriella Coleman said that she expected crimew to gain more support in the hacker community as a result of the indictment, stating that the United States government has been overly aggressive in prosecuting hackers who pursue leftist and anti-authoritarian ideals and that "the hacker community has this in mind". An article in ''Republik'' described crimew "in the tradition of hackers like Jeremy Hammond or Aaron Swartz." Hernâni Marques, a board member of the Swiss chapter of Chaos Computer Club, called for "solidarity" with crimew. Seattle prosecutors decried this support, with Tessa M. Gorman stating that " apping oneself in an allegedly altruistic motive does not remove the criminal stench from such intrusion, theft, and fraud".

While media outside of Switzerland praised crimew for revealing flawed security in centralized surveillance systems in the United States, ''null41'' reported that Swiss media largely focused on crimew herself, especially her gender identity and appearance.

Possibility of extradition or trial in Switzerland

After the indictment, a United States Department of Justice spokesperson told ''Blick'' that proceedings had been suspended, explaining that the United States would not continue with the case unless crimew was present in the US and defended by a lawyer. crimew has expressed confidence that she will not be extradited to the United States. Swiss lawyer Roman Kost stated that Swiss extradition law does not allow extradition of citizens without their consent, but that Swiss hackers "can be tried in Switzerland if there is sufficient suspicion and evidence, and if they are found guilty, they can be punished”. Switzerland's Federal Department of Justice and Police confirmed to ''zentralplus'' that it does not extradite Swiss nationals against their will. Swiss newspaper ''Le Temps'' reported that crimew would not be extradited and would instead be tried in Switzerland.

''20 Minuten'' reported that if crimew was tried in Switzerland, she would face a maximum of four and a half years in prison. Hernâni Marques said that "much of what hedid would not be punishable in Switzerland," pointing out that much of the data crimew leaked was publicly available on the internet and arguing that the hack of Verkada was "legitimate and useful for society" because of the privacy issue it exposed. In March 2021, ''Blick'' reported that a potential warrant for crimew's arrest issued by the United States would likely be executed by all countries that share a border with Switzerland. In September 2021, crimew told ''null41'' that she was certain she would never be able to travel to certain countries again, and that even if she was able to travel in the future it would be risky because of the possibility of extradition from other countries. She noted that unlike Julian Assange, she was not relying on the goodwill of a country because the Swiss constitution prohibits her extradition. In October 2021, ''Zeit Magazin'' reported that while Interpol does not publicize most of its investigations, it was likely that an international arrest warrant had been issued for crimew, which would potentially render her unable to leave Switzerland.

Personal life

crimew was born on August 7, 1999, and lives in the Bruch district of Lucerne in the German-speaking region of Switzerland. As a teenager, she worked in information technology. She was the founding developer of the popular Android launcher "Lawnchair", which has been maintained by a different development team since February 2021. crimew is non-binary and uses it/its and she/her pronouns. She has also been known as "deletescape" and tillie crimew. In 2022, crimew legally changed her name to maia arson.

crimew is a member of the Young Socialists Switzerland, and was a candidate for Lucerne City Council in 2020; a Facebook post by the Lucerne chapter of the Young Socialists used the slogan ("Capitalism destroys all creativity or innovation!") to promote her campaign. She has cited curiosity, anti-capitalism, anarchism, and opposition to the concept of intellectual property as the motives for her hacking, stating that "caring about literally nothing but profit definitely doesn't result in security." She has additionally stated that she believes source code and documentation should be public, and that she thinks of herself as a hacktivist. Being queer and experiencing discrimination contributed to the development of crimew's political views. On her Twitter bio, crimew describes herself as an "indicted hacktivist/security researcher, artist, mentally ill enby polyam trans lesbian anarchist kitten."

Notes

References

{{DEFAULTSORT:crimew, maia arson
1999 births
Hackers
Hacktivists
Swiss LGBT people
Living people
People charged with computer fraud
People charged with identity theft
People charged with wire fraud
Swiss anti-capitalists
Swiss computer programmers
Transgender non-binary people
Swiss anarchists
Fugitives wanted by the United States