Several “gray-hat” hackers are mounting an effort to unmask the persons behind Lulz Security, the group responsible for a rash of brazen attacks and breaches over the past month.
Among the cyber vigilantes are The Jester (a.k.a. Th3j35t3r), a self-described ex-military gray-hat hacker who has previously attacked Wikileaks and 4chan, and a group calling itself Web Ninjas who are documenting their search on the LulzSec Exposed website.
The evidence compiled by The Jester and Web Ninjas includes purported chat logs of LulzSec’s private IRC channel, as well as circumstantial evidence identifying the members of LulzSec and their alleged true identities. They say they have passed on the information to the FBI.
We have previously speculated that LulzSec is a throwback to Anonymous’ more anarchic past, perhaps formed by a few skilled Anons who grew weary of the hacker collective’s political pretension. The information presented by The Jester and Web Ninjas seems to corroborate this.
(MORE: ‘We Do It for the Lulz’: What Makes LulzSec Tick?)
Two weeks ago, LulzSec tweeted, “This is the guy that paid us to hack pbs.org,” and pointed to the account of Branndon Pike, a 21-year-old from Daytona, Florida, who is a former Anonymous contributor. He told Fox News that LulzSec was pranking him because they were upset he had linked them to Anonymous.
Last week, someone anonymously posted to the Full Disclosure computer security mailing list a chat log of a conversation between LulzSec members . LulzSec responded to the leak, thereby confirming the log’s authenticity, stating that the compromised channel was only used “to recruit talent for side-operations” and that their main channel remained untouched.
Mentioning handles present in the chat log, LulzSec said that “people such as joepie91/Neuron/Storm/trollpoll/voodoo are not involved with LulzSec, they just hang out with us in that channel.” This implied that the handles they did not mention—including “Kayla” and “Topiary”—are indeed members of LulzSec.
(MORE: As LulzSec Claims CIA Coup, ‘Anonymous’ Hackers Arrested Worldwide)
Kayla is a name previously linked to Anonymous and its attacks on computer security firm HBGary. In March, she gave an interview to Forbes in which she disclosed her involvement with Anonymous and many personal details. Web Ninjas and The Jester claim that Kayla is actually a man.
Topiary is also a name linked to Anonymous. After the Anonymous attacks on the Westboro Baptist Church, an Anonymous representative debated a church leader on the David Pakman show. A widely circulated video of the exchange shows the name “Topiary” as the Anonymous spokesman’s Skype username.
This week a public radio producer called the seemingly untraceable phone number at which LulzSec has been taking calls, and recorded his conversation with members of the group. One of the LulzSec voices sounds like the voice of Topiary and has a similar European accent.
Web Ninjas have also posted photos and details of several other persons who they say correspond to the handles on the chat logs, including that of a man said to be “Sabu,” the supposed leader of LulzSec. “We do have his name, address, location and work but we are not publishing,” Web Ninjas said.
Jerry Brito is a contributor to TIME. Find him on Twitter at @jerrybrito. You can also continue the discussion on TIME’s Facebook page and on Twitter at @TIME.
MORE: ‘Anonymous’ Warns NATO: ‘This Is No Longer Your World’