SABU▊
The leader of LulzSec and a driving hand behind the AntiSec rampage of 2011 — the crew that hit the CIA, the Senate, Sony, and Fox for "the lulz." Then the FBI knocked on his door, and by the next morning he was theirs. For roughly ten months he ran the same @anonymousabu account, cheered on the same attacks, and rallied the same kids — while logging every keystroke for the Bureau. His cooperation put his own crew in prison and helped cage the man who hacked Stratfor. In a scene whose one unforgivable sin is cooperating with police, Sabu is the case file for the sin itself.
It wasn’t a situation where I identified anybody. I didn’t point my fingers at nobody. My cooperation entailed logging and providing intelligence.
Hector Monsegur, first television interview, 2016 — his own account of what he did for the FBI, given here for the reader to weigh against the arrests that followed (IBTimes UK)
- WHO
- Hector Xavier Monsegur — "Sabu," b. 1983, New York City (Lower East Side) FACT
- THE DRAMA
- Arrested June 7, 2011; agreed to cooperate the next day; ran "Sabu" under FBI supervision for ~10 months while his cooperation built cases against his own crew and against Jeremy Hammond (Stratfor)
- RECORD
- Pleaded guilty Aug 15, 2011 to twelve counts (hacking conspiracy, fraud, aggravated identity theft) under a cooperation agreement; faced a guidelines range north of 20 years. Sentenced May 27, 2014 to time served (~7 months) plus one year of supervised release FACT
- STATUS
- INFORMANT — the scene's cardinal sin made flesh; later a working penetration tester and speaker
This file is a record, not a lynching. The cooperation is not rumor and it is not a rival's smear — it is the government's own paperwork, admitted in open court and rewarded on the record with a walk. What the archive keeps is the gap the scene can never close: the same voice that shouted "AntiSec" and "for the lulz" was, for its loudest ten months, an FBI microphone. Sabu says he did it for the two little girls he was raising. The crew he was raising them alongside went to prison. Both of those are in the file. You get to hold them at the same time.
the drama timeline
ACT I — HELLO, I AM SABU (1997–2010)
A kid from the Riis Houses follows the wire out of the projects and into the scene, then inherits two children he never planned on.
-
~1997
The handle is born
A teenager on the Lower East Side defaces sites to protest U.S. Navy bombing on Vieques, Puerto Rico, signing one "Hello, I am Sabu, no one special for now." The name that will one day be a byword for betrayal starts as a nobody's tag.
-
2010
Guardian of two girls
After his grandmother's death, Monsegur becomes the guardian of two young cousins — the fact that will later sit at the center of his defense. He does carding and corporate intrusions, and moves deeper into Anonymous.
ACT II — FIFTY DAYS OF LULZ (May–June 2011)
He founds a crew that turns hacking into theater, and for fifty days it is the most-watched act on the internet.
-
MAY 2011
LulzSec forms — Sabu at the head
Monsegur and five others found LulzSec. He is the leader and the loudest voice. The targets come fast: PBS (May 31, a fake story that Tupac was alive), Sony Pictures (June 2), Fox, InfraGard, and more — each dump narrated on Twitter as comedy.
-
JUN 13–15, 2011
The Senate and the CIA
LulzSec dumps data from senate.gov (June 13) and knocks CIA.gov offline with a DDoS (June 15). The crew is now taunting the federal government by name — a fact that will matter enormously in about a week.
-
JUN 20, 2011
Operation AntiSec
LulzSec and Anonymous announce Operation Anti-Security (AntiSec) — open season on governments and security firms. Sabu is one of its faces. Rival crew TeaMp0isoN is unimpressed, publishing a screed headed "Lulzsec ARE Script Kiddies" as the feud spills into the open.
ACT III — THE KNOCK, AND THE TURN (June–Aug 2011)
The FBI arrives at the Riis Houses. By the next morning the leader of LulzSec is working for them — and nobody in the crew knows.
-
JUN 7, 2011
The arrest
Agents arrive at Monsegur's apartment in the Jacob Riis Houses. He had been unmasked earlier (his real name surfaced in a rival's dox in March, and, per the reporting, an IP address he failed to hide). Confronted, he does not fight.
-
JUN 8, 2011
"Immediately" cooperating
The next day, Monsegur agrees to become an FBI cooperating witness — and keeps running "Sabu" online as if nothing had changed. His attorneys would later frame it plainly: "his family came first," and he "would do whatever he had to do to protect the girls and avoid their placement in the foster care system."
-
AUG 15, 2011
The secret guilty plea
Under seal, Monsegur pleads guilty to twelve counts — computer-hacking conspiracy, hacking, hacking in furtherance of fraud, access-device and bank-fraud conspiracies, and aggravated identity theft — pursuant to a cooperation agreement. The plea stays hidden for months while he keeps working the keyboard.
ACT IV — THE MICROPHONE (Aug 2011–Mar 2012)
For ten months the most trusted voice in the crew is a government instrument — and it is pointed at his own.
-
DEC 2011
Stratfor — the honeypot
Jeremy Hammond hacks the intelligence firm Stratfor, siphoning emails and card data. Per court records and reporting, Hammond did it in contact with Sabu — who by then was an FBI informant, and whose server the stolen data was routed toward while the Bureau watched. The "AntiSec" op had become, in part, a stakeout.
-
MAR 6, 2012
The unsealing — the crew falls
The FBI unseals the case. Five are charged on the strength of Sabu's cooperation: Jake Davis (Topiary), Ryan Ackroyd (Kayla), Darren Martyn (pwnsauce), Donncha O'Cearbhaill (palladium), and Jeremy Hammond (Anarchaos). The scene learns in a single news cycle that its leader had been the leak the whole time.
ACT V — TIME SERVED (2014–)
The man who broke the crew walks, while the man who hacked Stratfor does ten years. The community draws its own conclusion.
-
MAY 27, 2014
"Extraordinary" cooperation — and a walk
Judge Loretta Preska sentences Monsegur to time served — roughly seven months — plus a year of supervised release, calling his cooperation "truly extraordinary." The government credits him with disrupting or preventing 300+ attacks (targets it lists including NASA, the military, and media companies). Guidelines had pointed north of twenty years.
-
2014–
Poacher to gamekeeper — with an asterisk
Monsegur reappears as a penetration tester, speaker, and interview subject, insisting he never named names — that his role was "logging and providing intelligence." The record shows arrests followed. In the scene's memory he is not the reformed hacker of the Phiber Optik template; he is the snitch. That verdict is the community's, not a court's [7].
both sides, on the record
The scene's case: there is one rule under all the noise — you do not work with the police against your own. Sabu did exactly that, for ten months, while wearing the mask of the crew's leader. Kids he had rallied to "AntiSec" were arrested on the strength of logs he handed the FBI; Jeremy Hammond got ten years partly off a hack the Bureau watched happen through Sabu's channel. To the community this is not a gray area. It is the cardinal sin, committed by the person best placed to commit it [4].
The optics are brutal: the informant walked with time served; the man he helped catch is still remembered doing a decade. Whatever the law made of it, the ledger the scene reads is simple [5].
He did it for the girls: Monsegur was the guardian of two young cousins, and his attorneys told the court his family "came first" — that he cooperated to keep the children out of foster care rather than face a sentence that would have taken him from them for decades. That motive is on the record and uncontested [6].
He says he named no one: in his own account, his cooperation was "logging and providing intelligence," not fingering individuals — his framing, given here at full strength for the reader to weigh against the arrests that followed [7].
The court credited real harm prevented: prosecutors and the judge credited him with disrupting or preventing some 300 attacks, on targets including government and infrastructure systems — the stated basis for the "extraordinary cooperation" finding and the lenient sentence [1].
YOU DECIDE
The facts are not in dispute: the leader of LulzSec was flipped in a day, ran the crew's own voice as an FBI instrument for ten months, and his cooperation put his people — and Jeremy Hammond — in prison. He walked with time served for it. He says he did it for two children and that he never named a name; the paperwork shows arrests all the same. The scene calls it the one unforgivable thing. The court called it extraordinary help. Both entries stay in the file.
The archive does not absolve and it does not lynch. It keeps the cooperation agreement — and the sentencing memo that says he did it for the kids.
evidence locker
PRIMARY / COURT & GOVERNMENT
Wikipedia — Hector Monsegur ATTRIBUTED — dated biography: the Vieques defacement and "Sabu" handle, guardianship of two cousins, the June 7, 2011 arrest and next-day cooperation, and the informant period.
en.wikipedia.org/wiki/Hector_Monsegur Wikipedia — LulzSec ATTRIBUTED — the crew's founding and 50-day timeline (PBS, Sony, Senate, CIA), Operation AntiSec (June 20, 2011), and the March 6, 2012 arrests that followed Sabu's cooperation.
en.wikipedia.org/wiki/LulzSec
PRESS & FIRST-PARTY
BBC News — "Hacker 'Sabu' gets lenient sentence after helping US" ATTRIBUTED — the seven-month sentence, the 300-attack credit, and the cooperation.
bbc.com/news/technology-27588976
CONTEXT & CROSS-LINKS
The standard. Hector Monsegur is a public figure, and his cooperation is public record — a sealed guilty plea, a cooperation agreement, arrests of named co-defendants, and a sentencing at which a federal judge called his help "extraordinary." Those are stated as the facts they are. His reasons — protecting the two children he was raising — and his own contested claim that he "named no one" are given at full strength and attributed to him and his lawyers. The scene's verdict that cooperating with police is the cardinal sin is the community's attributed view, not a legal finding, and it is labeled as such. No motive beyond what he has stated is asserted. If a line here couldn't survive scrutiny, it wouldn't be on the page. This file is the drama; the fuller historical profile lives on the sister site —
thefire.lol/profiles/hector-sabu-monsegur.