Incident
Hector Monsegur ("Sabu") co-founded LulzSec, the group behind a string of high-profile 2011 intrusions. The FBI arrested him in June 2011, after which he worked as an informant; the case became public in March 2012.
What happened
Monsegur routinely connected to Anonymous IRC servers through Tor. At least once, he didn't, joining from his own home IP address, which was logged and gave the FBI his location.
Rival researchers had already gotten close without government powers. His
domain prvt.org was registered behind a WHOIS privacy proxy, but when the
renewal was processed in June 2011 it went through the parent registrar,
which published his real name, address, and phone number in WHOIS for a
brief window. He also once posted, in a logged IRC channel, a link to a
personal website. Ex-Anonymous doxers at Backtrace Security assembled these
fragments into an identification months before his arrest was public.
The OPSEC mistake
Inconsistency. The protection was in place for hundreds of sessions and absent for one. Layered on top: infrastructure linked to his real identity (the domain), and trust in a third party's process (the registrar's renewal handling) to maintain his anonymity for him.
Why it mattered
IRC servers and the services around them keep connection logs. A single unprotected connection wrote a permanent record joining the persona to a physical address, the kind of record that cannot be un-created and that investigators only need once. Meanwhile the WHOIS slip shows a second failure class: anonymity that depends on a vendor's back office working perfectly, forever.
How it could have been avoided
Fail-closed tooling rather than memory: a setup in which the sensitive identity cannot connect except through the protected path (dedicated VM or system that only routes via Tor), so a moment of fatigue can't produce a bare connection. And no infrastructure that has ever touched the real identity.
Defensive lesson
Protection that depends on remembering will eventually be forgotten, design so the unsafe path doesn't exist. This is why OPSEC Fundamentals insists that consistency beats intensity, and why a VPN kill switch or Tor-only gateway matters more than any advanced setting. Also: any third party that holds your identity (registrars, hosts, payment processors) is part of your anonymity whether you like it or not.
Sources
- Ars Technica: "Doxed: how Sabu was outed by former Anons long before his arrest" (2012)
- Wikipedia: Hector Monsegur, with citations to the underlying court filings and contemporaneous reporting