Ten-year hactivist fugitive Commander X arrested in Mexico

A decade after Chris “Commander X” Doyon skipped out on a federal hacking charge and fled the country, the long arm of US law enforcement this week stretched out its hand and plucked him from Mexico City, where he had claimed political asylum. Doyon now faces all of the original charges for coordinating a 2010 High Orbit Ion Cannon (HOIC) DDoS attack on servers belonging to Santa Cruz, California, plus a serious new charge for jumping bail.

This has been a surprising turn of events for the homeless hacktivist, who spent his years first in Canada and then in Mexico issuing press releases, hanging out on Twitter, writing a self-published memoir, appearing in documentaries, and meeting up with journalists like me—all without apparent response from the US government.

All that changed on June 11, when Doyon was arrested by Mexican police. This was confirmed by a press release from the US Attorney for the Northern District of California, where Santa Cruz is located, though no details were provided.

But Doyon’s Mexican friends (and a filmmaker who has profiled him) offered their own account in an email to journalists:

Chris lives in a gated community in Mexico City, and on the afternoon of Friday 11th June, several armed, uniformed, Mexican men identifying themselves as DEA agents attempted to gain entry to the community but were turned away. They returned dressed as civilians, with representatives from the US embassy, scaled the walls of the compound and took Chris away in the early evening.

If this sounds rather dramatic, well—welcome to Doyon’s world. The original DDoS incident in Santa Cruz was relatively minor. It was triggered by a new law affecting the homeless community of which Doyon was a part, and it affected Santa Cruz servers for just 30 minutes. The government claimed only a few thousand dollars in damages for investigation and remediation, but the amount was just enough to clear the $5,000 threshold of the Computer Fraud and Abuse Act, making the DDoS a federal crime.

The incident happened during the rise of Anonymous, the loose hacking collective in which Doyon played a minor role. Anonymous captured the world’s attention with its antic spirit of mischief, malice, and occasional self-righteousness, and Doyon himself got caught up in the federal response to the group’s actions.

Doyon was no “hacker” in any technical sense; he hung out in IRC chatrooms and could use tools like HOIC that had been built by others. What he did have in spades, though, was a grandiose sense of personal and corporate mythology. After Doyon’s arrest and subsequent flight to Canada, he told a Canadian newspaper that Anonymous “might well be the most powerful organization on Earth.”

When Doyon announced that he was quitting Anonymous in 2013, he wrote that his “‘Commander X’ persona has become a bit like Batman, a sort of cyber-super hero. But like Batman, the impossible persona of ‘Commander X’ rests upon the shoulders of a simple man. And like all men, I have frailties, weaknesses—and limits.”

Doyon would “die alone in a foreign land, my ashes spread across a foreign forest.” But that was all right because “‘Commander X’ made a difference—he saved lives and inspired thousands to join this critical fight for the very soul of humanity.” The Commander X persona would “step off the stage of history, and fade into the mists of myth and legend.”

OK.

Strangely, the US government seemed to accept some version of this story—that is, that Doyon was someone really worth tracking down, at great expense, rather than an extremely minor miscreant who spent seven years in Toronto begging for money on the street, eating at McDonald’s, and hanging out on Twitter, before trekking down to Mexico and claiming asylum there. In its announcement of Doyon’s arrest, the government provided a list of the agencies involved in tracking him:

• The FBI, generally
• The FBI’s Mexico City legal attaché
• The FBI’s Cellular Analysis Survey Team Unit
• Mexico City Task Force (which consists of agents from the Mexican Agencia de Investigación Criminal)
• Mexican State Police and Prosecutors in the State of Morelos (Fiscalia General del Estado de Morelos, Unidad Especializada Contra el Secuestro y Extorsión)
• Mexican Immigration (Instituto Nacional de Migración)
• Interpol
• The US Department of Homeland Security, Customs and Border Protection, Mexico City Office
• The United States Department of State, Office of American Citizen Services, Mexico City Office

Doyon was easy to reach for years by email, and he met regularly with journalists and filmmakers. Heck, I met him in a public Canadian park—and it wasn’t hard to arrange. Why Interpol and a Cellular Analysis Survey Team were required to find him remains opaque—as does why the whole thing took so long. The costs here—to track down a fugitive accused of doing several thousand dollars of damage—must have been enormous.

In any event, Doyon is back in California and has already had two brief hearings, over Zoom, before a federal judge. His pro bono attorney from a decade back, Jay Leiderman, has agreed to represent Doyon once more.

Leiderman told me in 2012 that he thought the whole case should be dismissed. Most of the “damages,” he said, were just employee salaries that were already being paid; besides, he thought the whole thing was essentially just a political protest. “They didn’t harm Santa Cruz’s computers, they didn’t go in and rape their servers,” Leiderman said then. In his view, the DDoS attack was “absolute speech under the First Amendment.”

“Dateless on prom night” is how Leiderman described the moment in court when he realized that Doyon wasn’t going to show. Now, with his date back in federal custody, Leiderman may get another shot at making his argument. Doyon’s ability to avoid years in prison may depend upon it.

Listing image by Nate Anderson