hacker history privacy bully cybercriminal cybersecurity security awareness training phishing phish scam alert data bomb threat

Behind A Hacker’s Bomb Threat

What makes a good guy hack? From being bullied to making bomb threats, here’s the story behind George Duke-Cohan’s hacker history.

When the teenage George Duke-Cohan told his mother he had beaten his teacher in a coding competition at his Watford secondary school, she could finally see a bright future for her autistic son, according to The Telegraph.

For years she had watched him struggle academically and socially – at one point being bullied so badly he became the school librarian to hide from his tormentors.

But when he was online, George transformed from a gauche schoolboy into a precocious talent capable of doing things few adults can grasp.

Just four years later, rather than watching George, now 20, achieving his dream of a high-flying computing career, his family is now mired in a nightmare as he faces 65 years in a US prison.

George Duke-Cohan hacker history privacy bully cybercriminal cybersecurity security awareness training phishing phish scam alert data bomb threat
George Duke-Cohan on the day he was arrested by the National Crime Agency in August 2018 CREDIT: NATIONAL CRIME AGENCY

George rose to notoriety last year after he was unmasked as the hacker behind a mass campaign of bomb threats that caused 400 schools to be evacuated and a plane to be grounded in San Francisco.

The then 19-year-old admitted the charges in the UK and is currently serving three years in a young offenders’ institution. Earlier this year the FBI charged him and another member of his ‘Apophis Squad’ hacking gang with a total of 20 counts, raising the spectre of extradition.

His mother, Mireya Duke-Cohan, 49, is now warning other parents saying her son was talent-spotted and “groomed” by hackers while playing the popular children’s online video game Minecraft.

She and George’s stepfather, Gary, told the Sunday Telegraph they did everything caring parents would to keep him safe online, including limiting his internet time, monitoring who he spoke to in the game and eventually locking away all his computing gear.

But it was not enough to prevent him being dragged into a dark hacking subculture where they say he was manipulated and pressured into becoming the ‘fall guy’ in a reckless cat-and-mouse game with the police and FBI.

Mrs Duke-Cohan is also calling on the Government to bring “harsher penalties” against games companies who fail to protect children online.

“It is a warning to parents out there,” said Mrs. Duke-Cohan. “Whilst you think you are doing your best, unless you are playing the game with them you really don’t know. There are predators out there who are a lot cleverer than you understand.”

“It is so easy for kids to be dragged in and before you know it you’re not in the game doing these things it is in the outside world. I think these games are lethal.”

Since George was a baby Mrs. Duke-Cohan knew there was something not quite right with her son. He did not start speaking until he was two and as he grew up he shunned other children preferring to play by himself making dens and forts.

She had him assessed for autism, but a paperwork problem meant the condition was never properly recognized in his childhood. Then she divorced her first husband and the family was separated as the court awarded custody of George to his father, separating him from his mother and older sister Amber.

George Duke-Cohan hacker history privacy bully cybercriminal cybersecurity security awareness training phishing phish scam alert data bomb threat
George Duke-Cohan aged 14

In the meantime, Mireya met Mr. Duke-Cohan, a partner at a London law firm whom she married in 2010 before the pair won custody of George again in 2013 and he returned to live with them in Watford. Mrs. Duke-Cohan described the separation with her son as a “traumatic” period for George where he withdrew further into himself.

“He was very quiet and withdrawn (when he returned),” said Mrs. Duke-Cohan. “He had no interest in his normal hobbies. His whole academic side plummeted and that didn’t help him mingle with his peers.”

As he struggled at Parmiter’s School, in Garston, Watford, George keenly felt his lack of academic achievement in contrast to his older sister, who excelled in her studies.

Mrs. Duke-Cohan said: “He was constantly aware and feels he’s compared against her. I told him ‘no, you each have your own strengths and you’ll find yours’.

Those maternal reassurances proved prescient, as George suddenly discovered one subject where he did excel – ICT – after choosing it as one of his GCSE options.

His teachers were so impressed with his aptitude for coding that they allowed him to take a supplementary IT course even though he didn’t have the required Maths grades.

“He didn’t know how he could do it, he could just do it,” said Mrs. Duke-Cohan “We were encouraging it at that time as he lit up with it.”

The Duke-Cohans had initially tried to build George’s confidence and social skills by keeping him away from the internet as they didn’t want him spending more time isolated in his room.

They even refused to buy him an Xbox as it could be connected online. Yet as his prodigious coding talent became apparent, the couple relented and decided to buy him a laptop for his 16th birthday.

Alongside his coding, George also started playing Minecraft, a game in which players hunt for online resources to construct virtual buildings and structures.  

Minecraft is the second most bought video game in history, after Tetris, and has almost 100 million players
Minecraft is the second most bought video game in history, after Tetris, and has almost 100 million players

It was while playing the game, which is rated suitable for children aged seven and over, that the Duke-Cohans say George first met the hackers who would form the Apophis Squad.

George later told them that members of the squad ran tasks with in-game rewards in Minecraft that covertly assessed the ability of kids as young as eight to do things such as code. He said they targeted youngsters who were “loners” and bullied in the real world, so were looking for friendships online.

Mr Duke-Cohan said: “They use it to see who is apt, who has skills and as recruitment – ‘let’s choose people out of Minecraft and see who’s really good’. It is grooming, rewarding and training without knowing you are being trained.”

Microsoft, which owns Minecraft, declined to comment for this article.

It was after George started an IT course at West Herts College in Watford in September 2016 that his parents noticed his attitude to change and he started to become very “hyped and stressed” when he was separated from his computer.

Then in October 2017 George launched a cyber attack on his college following a disagreement with a teacher, before calling in a bomb threat that led to 2,500 students and staff being evacuated in January 2018. George owned up to both attacks and was expelled.

By this time Mrs Duke-Cohen said time George was falling under the influence of other hackers and described the bomb threat a form of “gang initiation.”

George Duke-Cohan with his sister Amber, left, and parents Mireya and Gary on holiday in Dubai in 2016.
George Duke-Cohan hacker history privacy bully cybercriminal cybersecurity
George Duke-Cohan with his sister Amber, left, and parents Mireya and Gary on holiday in Dubai in 2016

From then on his behaviour escalated and in March he sent over 1,700 emails to schools, colleges and nurseries threatening to set off bombs unless money was paid, leading to panic and evacuations.

After being arrested and released, George sent another round of threats to schools in the UK and US in April, which led to him being arrested and bailed a second time.

In this period the Duke-Cohans took all George’s computers away from him and eventually decided one of them had to be with him at all times so they could account for everything he did.

Over the next few months they said George’s mood and attitude improved as he was cut off from the internet and underwent counselling.

Things had progressed to such an encouraging point by that August that Mr. and Mrs. Duke-Cohan decided, after what had been an increasingly traumatic year, that they would go on holiday to Ireland.

Mrs. Duke-Cohan suffers from an autoimmune condition, Sjögren’s syndrome, and the stress had taken its toll on her health. George, who doesn’t like new social situations, asked to be left behind to look after their seven pug dogs and his chihuahua-Jack Russell cross, Thia. His parents agreed as they were confident he had no access to computers.

However, while they were away George was called by one of the ‘clients’ of Apophis and wired £300 to buy a new laptop to get back online.

It was in the next few days that he and another member of the squad called San Francisco Airport telling the operator that he was a father whose daughter was on a United Airlines Flight from Heathrow that had been hijacked.

The airport authorities took the threat seriously, and Flight UAL-949 was grounded, while a full-scale security service operation launched before it was established it was a hoax.

Minutes after the plane landed the Apophis Squad tweeted “UAL949 grounded… HaHa. 4 guys, one bomb back of plane?… 9/11 remake.”

George was arrested a third time and remanded into custody, after which he told Mrs. Duke-Cohan he had been acting out of fear of his fellow hackers.

Officers arresting George for the final time at his home in Watford in August last year
Officers arresting George for the final time at his home in Watford in August last year CREDIT:NATIONAL CRIME AGENCY

She said: “After the interview with the NCA (National Crime Agency) I said to him ‘why on earth did you do it’ as I didn’t think he would do something so stupid.

“He said ‘it’s quite simple, if I didn’t do it then our family would have been attacked online and I would have been excommunicated from the group. There would have been a lot of trouble for all of us’.”

“He was getting to that stage (of wanting to leave the group) at that point. He did say it was a relief to tell the truth.”

The Duke-Cohans are convinced that George’s autism means he would not have had the emotional literacy to conjure the concerned father hoax scenario himself and that someone was in the background telling him what to say.  

Mr Duke-Cohan described George as the “fall guy” for the group, who manipulated his stepson’s naivety and got him to conduct the hoaxes in a way that clearly led back to him.

“He was told who to call, what to say and how to say it,” added Mr. Duke-Cohan. “He’s used his own voice, he has not hidden anything.”

After his arrest, Mrs. Duke-Cohan told George he had to admit to what he had done, despite knowing it would mean watching her son go to jail.

“That’s what we taught him and I am proud of the fact he did come clean,” said Mrs. Duke-Cohan. “I said look you are not going to have a good life until you come clean and admit what you have done. It (prison) is doing him good as he has to grow up”.

Since the final arrest the family have themselves become the target of the hacking community and have had to change their bank details, online passwords and router after a series of cyber attacks. There have also been incidents at their home, such as unknown liquid being poured through the door, leading to police fitting them with a special protective letterbox.

Meanwhile hackers have been dumping data from hacked online accounts and apps on the dark web and threatening to release more unless George receives “fair justice”.

Analysis carried out for the Telegraph by the international cyber-security firm CyberInt, said that details from more than 700 million online accounts had been dumped on a dark web marketplace since the beginning of the year.

The couple have pleaded with the hackers to stop. Mr Duke-Cohan said: “It doesn’t make it easier for George. It’s not helpful.”

In February the Duke-Cohans were alerted that George had been named on an indictment in the US along with another alleged Apophis member, 20-year-old Timothy Dalton Vaughn, from North Carolina, who is facing a total of 80 years in jail if convicted of all his counts.

“It was awful,” said Mrs Duke-Cohan. “I went online to find it and there George was listed for nine counts. It thought this is a joke, it’s ridiculous, and I had to read it again. I thought ‘how can that be for someone like him?’”

The family will now have to live with the agonizing uncertainty for months as if the US move to extradite, it is likely they won’t find out until days before George is released. The family’s main hope is that a future Home Secretary will block any request, as Theresa May did in 2012 for the British hacker Gary McKinnon.

At the time Mrs May said she was refusing the extradition request due to the risk of Mr McKinnon, who has a form of autism called Asperger’s syndrome, committing suicide if he was incarcerated in America.

Speaking of George’s case, Mr Duke-Cohan, 56, said: “You have a young man who has served time, who is autistic, who was led by these other people and it is totally wrong to allow him to be extradited to the United States. God knows what would happen in the prison system over there.”

Asked what she thinks would happen to George if he is extradited, Mrs Duke-Cohan’s response is emotional and blunt: “He won’t get there. He won’t make it.”

Wright, Mike. (2019, June 22). Parents of hacker facing 65 years in US jail warn he was ‘groomed’ playing ‘lethal’ Minecraft video game. The Telegraph.