Hollywood Confidential: Industrial Strength Celebrity Hacking

Some of them still think these texts and calls are private.

After all the stories about the British Royal Family, the Murdoch media industry hacks, the revelations of government spying - and even the scripts of the movies in which they themselves have starred.

Or maybe they just think they are immune because they can afford to hire tech consultants who assure them that they are safe. Even as we celebrate the 40th anniversary of Watergate this belief in personal invulnerability persists. Hello! Anyone paying attention out there?

The amazing thing is not that these hacks exist or that they are technologically possible. Hell, we use pretty sophisticated systems when we go to the mall to buy a new flatscreen TV. No, the surprise lies in both the industrial scale of the hacking enterprise(s) - and the degree to which some celebrities become complicit in order to garner publicity - and profit. JL

David Kushner reports in GQ (hat tip Barry Ritholtz):

They've become a part of the pop-culture landscape: sexy, private shots of celebrities (your Scarletts, your Milas) stolen from their phones and e-mail accounts. They're also the center of an entire stealth industry. For the man recently arrested in the biggest case yet, hacking also gave him access to a trove of Hollywood's seamiest secrets—who was sleeping together, who was closeted, who liked to sext. What the snoop didn't realize was that he was being watched, too
The hacker's eyes widened as the image filled his screen. There, without her makeup, stood Scarlett Johansson, her famous face unmistakable in the foreground, her naked backside reflected in the bathroom mirror behind her, a cell phone poised in her hand snapping the shot. Holy shit, he thought. This was a find—even for him. For years, he had stealthily broken into the e-mail accounts of the biggest players in Hollywood. He had daily access to hundreds of messages between his victims and their managers, lawyers, friends, doctors, family, agents, nutritionists, publicists, etc. By now he knew more dirt than almost anyone in L.A.—the secret romances, the hidden identities, films in all stages of development. Still, this photo, a private self-portrait of one of our biggest stars, was something new, something larger than life, especially his. "You feel like you've seen something that the rest of the world wanted to see," he says. "But you're the only one that's seen it."

Chris Chaney never wanted to become famous as The Man Who Hacked Hollywood. In the beginning at least, he was just a 33-year-old loner looking for something to do. Two years unemployed, he lived in a rundown brick house in a middle-class neighborhood in Jacksonville, Florida, where the streets are named for fairy tales: Cinderella Road, Peter Pan Place. He'd spent his entire life in this same area, had never flown on a plane or traveled beyond the occasional trip to see family in Iowa or Alabama. His parents separated when he was 4, and during his freshman year in high school he moved into this house near Mother Hubbard Drive with his grandmother. Taking a room hardly bigger than his bed, he hung a Fight Club poster on the wall, stacked his DVDs in the corner, lined up his He-Man dolls below the television, and called it home.

One night in early 2008, while his grandma slept, the balding, 290-pound Chaney was idly surfing movie sites like Ain't It Cool News when he stumbled on the latest celebrity scandal. Stolen pictures had leaked online of Miley Cyrus posing half-dressed, her midriff exposed. Chaney sparked a clove cigarette and considered the story. He couldn't have cared less about the Miley shots themselves. What intrigued him was the guy who stole them. How'd he do it? Chaney wasn't a hacker; he didn't even own a computer until his late twenties and couldn't write a lick of code. But he'd always loved solving puzzles—completing crosswords, shouting out answers to Jeopardy! This was a tantalizing new riddle: "I was like, 'How hard could this be if it's happening all the time?' "

What Chaney lacked in technical skills, he made up for in effort. Finding a working e-mail address was a simple process of trial and error. In a Word document, he made a list of random celebrities and, one by one, entered them into Gmail—first name followed by last—until, days later, an address was finally accepted. (In the blur of celebs to follow, he wouldn't be able to recall his first.) Unlocking the account, he knew, would be more difficult. To retrieve a lost password, sites often ask subscribers so-called challenge questions: What's your mother's maiden name? What's your place of birth? Or, in the case of this celebrity, what's your pet's name? It was widely known that the hacker who broke into Paris Hilton's phone had done it with her Chihuahua's name, Tinkerbell. If her dog's name was easily available online, so too, Chaney figured, were other clues.

Oops!
Chris Chaney's hacking life started after spotting a leaked
image of Miley Cyrus. Chaney found what he was looking for on the Internet Movie Database (IMDB). After punching in the pet's name, he watched in awe as the star's private e-mails poured down his smudgy PC screen. "I don't want to compare it to throwing a touchdown pass," he says, "but it was a rush." He quickly scrolled through the contact list, cutting and pasting the e-mails of anyone he recognized into a separate file: actresses, actors, athletes—"It was pretty much anyone with a name," he says. He then set the victim's account to forward a copy of every e-mail to him, so even if the celeb reset the password, the e-mails would keep coming in.

Chaney eyed his in-box. He'd get to reading the messages in good time, but for now he wanted to crack more addresses. "You find the right pieces," he says, "and then it unlocks." There were favorite colors to ascertain. Elementary-school names. Social Security numbers. Chaney became an expert. He found old school names on Classmates.com, friends on Facebook, and hometowns on free directories like Intelius. "If they've had their names removed, their parents are probably still on there," he says.

Before long, he had total access to e-mail accounts of stars including Mila Kunis, Busy Philipps, Ali Larter. And still without work and living with the help of his mom and stepdad, he had plenty of time to read through their messages. He'd wake at noon, chug a can of Java Monster, and check his in-box to find up to 800 e-mails waiting for him—a virtual universe to explore. "It's the whole Star Trek thing," he says. " 'Going where no man has gone before.' "

Chaney's new universe wasn't so much terra incognita as terra obscura, the murky territory of the celebrity-skin underworld. It's a domain run by dubious hackers like TrainReq and anonymity-seeking bloggers like Deep at Sea. Known by their screen names, these "suppliers" provide the photos and videos that drive the market. But not all suppliers are hackers—and yes, occasionally the stars and their cohorts are complicit. One of the very first was Paris Hilton's then boyfriend Rick Salomon, who in 2004 brought a night-vision tape of their tryst to Red Light District video. Almost overnight, the video, repackaged as 1 Night in Paris, sold a reported 700,000 DVDs.

Salomon's go-between on that deal, the man who negotiated with Red Light, was Kevin Blatt. At the time, Blatt was a marketer for porn sites, but the Hilton tape lit a fire, and soon he was inundated with calls and e-mails from people who claimed to have sex tapes and photos. Today, Blatt says, the Internet has driven demand for illicit images sky-high: A single nude shot of a high-profile star like a Jennifer Lopez or Natalie Portman, he says, is "worth a million dollars, easy." Websites like TMZ and Perez Hilton cash in by luring people to click on advertising banners. Nik Richie, owner of the popular gossip site The Dirty, calls a celebrity nude a "five-timer," because it generates five times the usual traffic—as many as 500,000 visitors in a day.

Posting stolen pictures, however, is a precarious business. No one can legally publish them without the owner's permission, and even when it's granted, celebrities don't want their cooperation made public. "If you believe what they tell you, these are all rogue tapes that found their way on the Net," Blatt says. "Nothing could be further from the truth." When celebrities do give their consent, it's often after a payout. Kim Kardashian reportedly settled with porn giant Vivid Entertainment for $5 million.

Even without permission, less scrupulous publishers will test their luck, uploading the pictures to rack up page views, then taking them down if they're served by lawyers. Between ad revenues and new subscriptions, a single photo can bring in as much as $50,000 a day. Illegal uploads are a frequent enough occurrence that Blatt saw them as a second business opportunity: Today celebrities not only pay him to distribute tapes but also to keep them off the Internet. In one notable episode, Blatt says he was blindfolded, then driven to a secret location to view a sex tape of Colin Farrell. There he worked as an intermediary between Farrell's lawyers and the perps to obtain the video. (A few stills were leaked online.) Blatt charges an hourly fee of $250 for his services, and if he's able to broker a deal between the seller and the celebrity, he collects a 10 percent commission, which can range between $500 and $50,000.

To an outsider, Blatt's arrangement may seem as if it presents a conflict of interest or even the possibility for extortion. But the stars see it as something else: a necessary service in the digital age. As guitarist Dave Navarro, who worked with Blatt to keep a groupie tape off the market, told me, "I appreciate that in this case, there was someone looking out for my better interest."

Hacking didn't just take Chaney into the secret world of sex photos. It gave him access to the hidden world of Hollywood itself—the behind-the-scenes deals and day-to-day workings of the business. And Chaney, a die-hard film buff since he was a kid, says that's what drove him deeper. His ideal victim, at least at first, wasn't a starlet but a location scout. "I thought that was one of the awesomest [jobs]," he says. "They go around, find these places, take pictures of them, and send them to the directors. It was cool seeing a part of the process that nobody ever sees."

After hacking the account of one producer, Chaney saw the entire filmmaking process, from start to finish. The producer was working on In Time, a film starring Justin Timberlake, Olivia Wilde, and Amanda Seyfried. Chaney breezed through copies of the script, set in a dystopian future where people die at age 26 unless they can afford to buy another day. He marveled over production photos of arms imprinted with numbers that count down the actors' hours. He read in astonishment as one producer discussed visiting strip clubs to find a body double for an actress, perhaps Seyfried. Another had to negotiate a deal with Seyfried's agent over how much flesh she'd show. "It seemed a fairly convoluted process just to show a butt crack," Chaney says.

Though Chaney was never one for gossip, he became fascinated by the secret lives of his celebrity victims. While reading e-mails about the film Friends with Benefits, Chaney admired star Mila Kunis's effortless jokes. "She was almost the kind of person you see portrayed," he says. "Not ditzy, but she was as funny in person as she is in [movies]." Despite later rumors of sex shots of her and Timberlake, Chaney says he "never saw any communication between [them] that would insinuate anything."

There were plenty of other juicy affairs, however. "Everyone dated everyone eventually," he says. "It always reminded me of [Beverly Hills] 90210." He once followed an exchange between a famous actor and actress who tried to keep their relationship private, opting to see each other at, say, Canter's Deli at 3 a.m. instead of dodging paparazzi at the Ivy. He later read about Johansson's separation from Ryan Reynolds long before the tabloids caught on. "They were discussing, I guess, aspects of who gets what," he recalls: what furniture, what photos, what souvenirs. "It was weird to read stuff like that," he went on. "It was almost too personal."

But Chaney wasn't just reading about celebrity sex lives; he was following them in real time. Among the more surprising revelations he discovered were a handful of explicit e-mails that leading men sent to their secret male partners. "I'm trying to figure out how to say it without names," he says. "There were some that, you know, their public persona is they're kind of a player, and their private persona is they're batting for the other team.... They may have been batting for both teams, I don't know."

Chaney also saw hundreds of illicit images, so many that he created a special folder within a folder on his computer, organized by name. He estimates that about 60 percent were nudes—mainly cell-phone "self-shots." And they weren't all of young actors. Chaney remembers seeing one actress "in her mid-to-late forties," he says. "Been acting for a while. Huge. I'll just say everyone knows her name." Um, Julia Roberts? "I'm not going to say names," he replies with a nervous laugh. Still, as much as he knew how hackers, real hackers, would kill for his stolen photos, he had the discipline, initially at least, to keep them to himself. "I didn't want fame," he told me. "It was a personal thing." But soon that wouldn't be enough.

The farther Chaney plunged into the Hollywood rabbit hole, the more he wanted to tell someone, anyone, what he was finding. The urge only got worse when, in April 2010, his grandmother passed away. Suddenly the house near Mother Hubbard felt crushingly empty. Eating just a can of ravioli a day, Chaney lost eighty pounds. He Googled the symptoms of depression—each of which he met. After taking a break from his computer, he went back with a vengeance. "There was already a lack of sleep," he says, "that just became no sleep."

One night, he finally gave in to the temptation to talk. "I let my curiosity—and I think my marijuana—get the best of me," he recalls. A well-known actor had sent a wish-you-were-here photo of a European mountainside to an actress. Stoned and feeling uninhibited, Chaney logged in to the actress's e-mail against his better judgment and sent a reply saying how fantastic the view looked. He shuddered the moment he hit send. "I was like, 'You're a fucking idiot for doing this,' " he says.

But the screwups, or the impulse to share, didn't go away. While perusing the e-mail of celebrity stylist Simone Harouche in early November 2010, he stumbled across photos of her client Christina Agui-lera trying on outfits in a dressing room, wearing little more than silver pasties. Chaney found a random guy on a celebrity message board and sent him an e-mail telling him he knew "someone" who had hacked pictures of Aguilera. Did he want to check them out?

Fifteen Painful Minutes
Chaney, outside federal court in Los Angeles, says he
doesn't "plan on being famous for anything else again." Chaney freaked the moment he sent it. What the hell am I doing? he thought. He was using a phony e-mail address, but he didn't know how to effectively cover his tracks. On December 8, a headline appeared on TMZ: "Christina Aguilera: My Private Sexy Pics Were Hacked." Aguilera's rep told TMZ they were "attempting to determine the identity of the hackers and will pursue them aggressively."

When Chaney saw his Aguilera photos online, "it was like a gut punch," he says. But it was also a little exhilarating. After that initial wave of anxiety, he was left with a rare feeling of accomplishment. He'd spent years peering into the fishbowl; now he was finally stirring the waters. He soon got an unsolicited e-mail from a mysterious hacker named TrainReqSucks, a play on TrainReq, the Tennessee teen who'd released the Miley shots. The stranger wanted photos and was eager to connect Chaney to buyers. Chaney rejected his offer, but the stranger was good. He pressed all of Chaney's buttons, effusively praising his hijacking prowess, and when he asked for proof that he had the goods, Chaney couldn't resist. In fact, Chaney had something everyone in the industry wanted: pictures of Johansson—a shot in bed, another topless, and more. "I don't know why I responded," Chaney told me. "It was part bragging and part proving who I was to someone."

Chaney picked what he thought was the tamest image: the "butt shot," as he put it. The nerves kicked in again the moment he hit send, and twisted his stomach in knots when he later saw the shot online—covered in Photoshopped squiggles. "Yeah, I squiggled over that," TrainReqSucks told him, adding that he offered to remove the lines for TMZ if they met his price. To Chaney's shock and relief, the photo was discounted as a fake. No one paid any attention to it.

TrainReqSucks wasn't done. He e-mailed Chaney a fake topless shot of Selena Gomez, the perky Disney star, and said he was going to sell it as real. In it, Gomez was standing in front of a door, her hand resting on a bureau, an exotic medallion hanging between her too-ample breasts. Chaney found it "creepy" and told the guy off. This only raised TrainReqSucks's ire. "You really need to cover your ass better, 'cause they're all over you," TrainReqSucks replied. "There's heat on you."

Chaney didn't know if the guy was bluffing (were the feds really watching him?), but he couldn't quit the game. "There wasn't the functioning ability to stop myself," he says. He reached out to the infamous blogger Deep at Sea. Deep was more of a fanboy than a hacker, posting photos he found across the Web. Chaney knew the guy had a thing for Renee Olstead, the redheaded star of The Secret Life of the American Teenager, and Chaney had recently stumbled on a trove of her private pictures—showering in a tight white shirt, using a baby blue vibrator. He decided to share them with Deep. "You don't want to release these," Chaney typed. "You don't want to put them on your blog, because it'll bring heat down on you, and it'll bring heat on me." Then he hit send and let the rush wash over him.

A Star is Porn
Not all private videos and photos are hacked. Some are sold. Others are lost and found. A couple you may never see at all. Here, we follow a few notable paths to stardom.—Cole Louison

Chaney was sound asleep when he heard the knocking at his front door. It was around 6 a.m. on February 11, 2011, and he could barely make out the sun rising. He ambled down the hall, but before he'd reached the door, federal agents barreled through with a battering ram, stampeding into the room past his wide-screen TV and towering stacks of DVDs. They drew their guns, freckling Chaney's body with red laser pointers. Chaney immediately spun around and put his hands behind his back for the handcuffs. "I'm glad you did this," he said calmly, "because I wasn't going to be able to stop this on my own."

To Chaney's surprise, the feds told him he wasn't under arrest—not yet. They were confiscating his computer, and they strongly suggested that he help them get to others. Others? "They constantly repeated, 'We're after the big fish; you're just the little fish,' " Chaney says. "They were after a ring of celebrity hackers." They asked him, "Would you be willing to work with us to bring other hackers down?"

"Yeah, whatever you want."

And that was it. Chaney was left alone for months, haunted by the specter of the feds. He knew they had everything—his computer, his e-mails, the nudes—and he figured his arrest was only a matter of time.

The moment came that fall. Chaney had recently landed a data-entry job at a trucking company when, one day in September, he read online that fully nude photos of Johansson had been leaked—this time without the squiggles. "My stomach dropped," he recalls, "because I knew I'd be the first person they came to."

At 2:50 p.m. on September 14, a user nicknamed Mr. Green sent two nude shots of Johansson to Richie at The Dirty along with a message. "I love [the] fact that she probably sent some of these out to some Hollywood actor or producer and she never figured they would do her like that," Mr. Green wrote. "Well, you might be a movie star and be famous, but doesn't mean no one will fuck you over."

Richie took one look at the photos and figured they'd been faked. There were three in all: one from behind, another topless, and another from the crotch up. To his surprise, his Photoshop experts deemed the pictures legit. Richie saw dollar signs. This went way beyond a "five-timer," as he put it. "This, in Scarlett's case, was times ten; it meant a million people coming to the site," he said.

Chaney was stunned. He claims to have sent out only one shot. So how did the others get online? The only people who had seen them, he says, besides himself were the FBI, Scarlett, and her husband. Had someone hacked Chaney or Reynolds, or had someone else hacked her? Chaney's mind was spinning. "Every night after that was very little sleep, hot and cold flashes. I knew that they were coming for me," he says.

Indeed, on October 12, Chaney was in his bedroom alone when he heard the pounding. He raced down the hall, trying to get to the door before they busted in. As Chaney was surrounded, he felt the room begin to spin and darken, like some twister sucking him up through the roof, far beyond Jacksonville to some strange Oz. He fell to one knee, then passed out cold. And when he woke up, he was famous, too.

It felt like some crazy version of The Twilight Zone—the nobody obsessed with Hollywood becomes a Hollywood obsession. As Chaney peered out his venetian blinds, he saw the paparazzi camped outside his house in vans and lawn chairs. Every time he walked to his pickup truck, they swarmed. "Do you have anything to say to Scarlett?" they shouted.

"I was in zombie mode," Chaney recalls. "Head down, go to the car; head down, get out, go to the house. Almost tried to pretend like they weren't there." At an arraignment in L.A. on November 1, 2011, the paparazzi were out in force. Chaney dressed up for the occasion in Dwight Schrute chic—a spinach-colored shirt with a green patterned tie, khakis, and thick black Munster sneaks. Flushed and pale, he was clearly disoriented. "First flight and first espresso," he told me with a sigh of regret. "I guess people will know my name now, but I would rather it not be that way.... I don't plan on being famous for anything else again."

Chaney eventually pleaded guilty to nine counts, including unauthorized access to a computer and wiretapping, and faces sixty years in prison and $2.25 million in fines. In all, he had access to more than fifty celebrities. Wes Hsu, chief of the Cyber and Intellectual Property Crimes Section of the U.S. Attorney's Office, was amazed at the breadth and depth of Chaney's infiltration. "I've been doing this for more than a decade, and it's the first time I've seen this," he said.

With Chaney himself the stuff of gossip sites, the business of Hollywood hacking has been reeling. "It's changed a lot," Richie said. "When you get the FBI involved it starts getting real." The industry went quiet for months after Chaney's arrest but erupted again this spring with alleged photo leaks of Olivia Munn and Christina Hendricks. To his peers, Chaney has become a cautionary tale. "I personally think what he did was pretty idiotic," Josh "TrainReq" Holly told me. "Hacking celebrities is for the kids, and—35? I mean, I personally think he was too old for that."

Back in Jacksonville, meanwhile, Chaney's family is struggling to make sense of what drove him to his end. Over lunch at a local sandwich shop (where the waitress does a double take at Chaney), they offer their theories. "He was bored," says his half brother, Jonathan. "I don't think he was trying to be a creep or a perv," his half sister, Abigail, adds. "He was just curious."

Chaney's mom, Cathy, can't talk about her son without welling up. "My heart's hurting for Chris, because he's not the monster that they make him out to be," she says. "One reporter on television called him 'creepy,' " she continues. "It's not right." Hearing this, Chaney looked up from his grilled cheese. The paparazzi just caught him on a bad day, he figures. "I hadn't shaved in a while," he tells his mom. "I kind of looked like a creep."