JOHN VRANESEVICH▊
- ALIAS
- "JP" · jp@AntiOnline.com — his own mail signature, headers intact FACT
- OPERATION
- AntiOnline.com · AntiCode.com · self-billed "the number one security resource on Internet" (its claim, per the attrition file [1])
- HABITAT
- Beaver, Pennsylvania; wire services, cable news, exclusive-story bylines (per Salon's 2000 profile [6])
- STATUS
- OFF THE AIR — eventually shut AntiOnline down, per the research file
- DISPOSITION
- Attrition.org's case against him: published in full, June 1999, emails and logs attached — untested by any court in the record we hold ATTRIBUTED
I could make just as much, if not more money, by hunting down hackers and turning them in.
John Vranesevich, AntiOnline founder, in 1999 — as he pivoted from courting hackers to pursuing them. Critics said he was monetizing inside access; he framed the turn as principle. His quotes, dated and collected.
The specimen, observed 1994–2000 filing exclusives from Beaver, Pennsylvania, on a scene it had announced it was leaving. In June 1999 the taxonomists at attrition.org published their field study — with the emails attached, headers intact.
What you are about to observe is the rarest event in the taxonomy: the watcher accused of feeding the watched. For five years the specimen filed dispatches from the boundary between the scene and the newsroom, and prospered there — until the boundary itself came under audit, conducted by the one predator no publicist can distract: a rival with logs.
It is impossible for a normal functioning human to keep track of what happened next. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE SCOOP YEARS (1994–1998)
Every ecosystem gets the chronicler it deserves. This one got a teenager with a modem and, in time, venture capital. Watch how each exclusive feeds the next: the scene supplies the incident, the site supplies the alarm, the wire services supply the amplification.
-
MID-1990s
The hobby site
AntiOnline launches while Vranesevich is still in junior high, per Salon's profile — a five-megabyte hobby site, per attrition's account, that "chiefly trumpeted hacker exploits and provided a channel for hackers to explain their actions."
-
1998
Two scoops build the pedestal
First scoop: two Cloverdale teenagers and an Israeli known as "Analyzer" compromise government servers; through repeated AntiOnline interviews the attacks are hyped until described as "the most organized and systematic attack the Pentagon has seen to date" — later found, per attrition, to be "mostly teenagers breaking into low security machines." Second scoop: exclusives with "Masters of Downloading," who tell AntiOnline they hold files "obtained from the classified Defense Information System Network." ZDNet and others carry the escalation.
Note the feeding pattern. The specimen does not create the incidents in this act — it merely discovers that alarm scales better than accuracy, and that no wire editor ever checks the enclosure.
ACT II — THE SENATE JOB (FEB–JUNE 1999)
The site goes commercial in February. By summer, the question on the table is no longer whether the chronicler is close to the animals. It is who is paying for the meat.
-
FEB 22 1999
The commercial turn
AntiOnline becomes a commercial entity — grown, per attrition, "from a five megabyte hobby web site, into a multi domain business venture with hundreds of thousands of dollars in venture capital."
-
MAY 12 1999
The funding email
Vranesevich emails a critic, on the record and over his own signature: "Local Secure" is a Solaris vulnerability scanner "that AntiOnline is having commercially developed… it looked cool, so we threw them a few bucks." The developer is Network Security Solutions — the firm where, per attrition's mail evidence, the hacker so1o (Chris McNab) holds a significant position.
-
MAY 27 1999
senate.gov falls; the exclusive is out within the hour
The official website of the United States Senate is defaced by MOD at around 7:38pm EST. At 8:20pm, AntiOnline's newsletter goes out: "US Senate Website Hacked — AntiOnline Exclusive," already carrying an on-line interview in which MOD walks through exactly how the server was taken. Forty-two minutes, defacement to packaged exclusive with interview.
The field marks the interval. In nature, the observer who arrives before the kill is cooling is either very lucky, very good, or standing closer to the hunt than the documentary lets on.
-
JUN 2 1999
so1o, logged
In an IRC chat with attrition's Jericho, so1o discusses the MOD hacks first-hand — senate.gov, adidas.com, the working methods — and confirms his position at ns2.co.uk. Attrition publishes the log in its proof set.
-
JUN 3–4 1999
The denial, then the pivot
June 3: an individual questions Vranesevich about his ties to so1o; he denies his involvement with McNab — per attrition, "after mail explicitly stating he WAS funding McNab, and after working with McNab on an AntiOnline 'exclusive' on the MOD hacks." June 4: he publishes "A Change in Our Mission," which contains the sentence attrition will quote back at him for the rest of his career: "Many times, I knew about these instances before hand, and could have stopped them."
-
JUN 7 1999
Attrition publishes "AntiOnline crosses the Line"
The Negation report goes up with its evidence table and proof set: the funding mail, the so1o/McNab identification, the IRC log, the exclusive's own timestamps. Attrition's conclusion, in attrition's words: "He pays people to break into sites in order to report on it as an 'exclusive'… Folks.. 1 + 1 still = 2." Their inference, drawn in public, from documents they published in full.
Observe the method of the rival pack: no press release, no television booking. Just the documents, the headers, and an arithmetic problem left for the reader.
ACT III — THE FIELD RENDERS ITS OPINION (1999–2000s)
Expulsion from this habitat is not announced by any committee. It is administered one raised eyebrow at a time, in public, with the specimen present.
-
NOV 12 1999
Slashdot asks its questions
The community submits pointed questions for a Slashdot interview. The headline Slashdot chose for the result is the review: "Interview: John Vranesevich Doesn't Really Answer." Per the research file, the response was an argumentative screed rather than substantive answers — a public record of evasion, preserved under that headline ever since.
-
MAR 27 2000
Salon profiles the cybersleuth
Salon's "Cybersleuth" finds him at the other end of the arc: an FBI resource in the denial-of-service investigations — "we turned over actual names… three people" — a fresh-faced consultant in Beaver, Pa. whose site draws, by his own count, hundreds of hack attacks daily, and whose face graced "Wanted" posters at the previous summer's DEF CON. His account of the conversion, in his words: he came to see most hack attacks as "indulgent, self-serving acts of malice." Hackers' account, as Salon relays it: "he saw an opportunity to cash in on his inside knowledge."
Both origin stories are on the record, side by side, in the same paragraph of the same profile. The reader is invited to carbon-date the plumage.
-
EPILOGUE
Off the air
Per the research file: he alienated virtually every significant figure in the late-1990s security scene and eventually shut AntiOnline down. The attrition proof set — emails, logs, timestamps — remains online a quarter century later. The archive keeps the tape running.
both sides, on the record
Attrition.org's stated case (theirs, not ours): that MOD, headed by so1o, was paid by Vranesevich/AntiOnline to hack www.senate.gov so AntiOnline could break the news — supported by a published proof set: his funding mail, the so1o/McNab identification, the IRC log, and the exclusive's own timestamps [1] [2] [3] [4] [5].
His own documents: the May 12, 1999 mail — "we threw them a few bucks" — and the June 4, 1999 mission statement: "Many times, I knew about these instances before hand, and could have stopped them" [2] [1].
The reporting record: attrition's tally of AntiOnline's commercial run — 12 of 67 pieces with serious errata, "close to 20%" — and the Pentagon-story hype that dissolved into teenagers on low-security machines [1].
Vranesevich's own account: the conversion was moral, not mercenary — he came to see most hack attacks not as heroic challenges to authority but as "indulgent, self-serving acts of malice," per Salon. And his mail describes the payment as ordinary commerce: a vulnerability scanner AntiOnline was "having commercially developed," from programmers who pitched him [6] [2].
His standing: after the February 2000 denial-of-service wave, the FBI turned to AntiOnline; he says his team handed the Bureau three names and a working profile. The scene's hostility cut the other way too — hundreds of attacks on his site daily by his count, and "Wanted" posters of his face at DEF CON — which is at least evidence he was not the scene's creature [6].
Scope of the record: attrition.org was an adversary, not a neutral referee, and its Senate case is an inference from documents — presented by attrition itself as "1 + 1 still = 2." No court, prosecutor, or regulator ever tested it in the sources here; no criminal charge against Vranesevich appears anywhere in this record. The mission-statement sentence admits foreknowledge — and foreknowledge is what source relationships look like in every newsroom that covers crime.
YOU DECIDE
Scoped to the claims, never the man. The claim "AntiOnline paid for the news it broke" is attrition.org's documented inference — published emails, logs, and timestamps, never tested by any court. The claim that he funded the shop of an active hacker rests on his own mail. And the sentence "Many times, I knew about these instances before hand, and could have stopped them" needs no accuser at all: he published it himself.
Weigh the costly signals: attrition.org put its full proof set online, headers intact, and has left it standing for a quarter century. In July 1998 Vranesevich taunted a reader that "it would take a lot more than an act of congress to get AntiOnline shut down." Per the research file, no act of congress proved necessary.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD — THE ATTRITION PROOF SET
PRESS & PROFILE
Salon — "Cybersleuth" (Mark Compton, March 27, 2000) ATTRIBUTED — the fullest profile in the record; carries the defense: the FBI-resource standing, the conversion account, the DEF CON wanted posters.
salon.com/2000/03/27/vranesevich/ Slashdot — "Interview: John Vranesevich Doesn't Really Answer" (Nov 12, 1999) ATTRIBUTED — the community's questions and the headline verdict. Loads in a browser; the site blocks robots.
news.slashdot.org/story/99/11/12/1013246/…
THE DISCOURSE
The standard. Everything above is sourced to the attrition.org documentary archive — including the subject's own emails and published statements, reproduced with headers — and named press reporting. Facts are stated as facts; accusations are stated as accusations and wear their accuser. The Senate-payment case belongs to attrition.org's published analysis, not to a court; nothing in this record was ever adjudicated, and that is said plainly. The defense is presented at full strength, including what the record does not show. No motive is asserted, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.