Wired : MI6 Codebreaker Attended U.S. Security Conference Before His Death

MI6 Codebreaker Attended U.S. Security Conference Before His Death

Kim Zetter | May 3, 2012

A top British codebreaker who died a mysterious death in his flat two years ago had just returned from a computer security conference in the United States before his death, according to information disclosed during an inquest this week.

The body of Gareth Williams, a codebreaker with Britain’s MI6 spy agency, was discovered stuffed into a sports bag in his bathtub on Aug. 23, 2010, though he’s believed to have been killed Aug. 15.

Williams had just returned to London on Aug. 11 after spending six weeks in the United States, where he attended the annual Black Hat security conference in Las Vegas as part of a contingent of British spies, according to witnesses who spoke at the inquest. He attended Black Hat in 2008 as well.

It’s believed Williams may have also attended Black Hat’s companion hacker conference, DefCon, which follows Black Hat and draws many of the same attendees. In 2010, Black Hat was held July 24 to 29, while DefCon ran from July 30 to Aug. 1.

Black Hat is one of the top security conferences in the world, targeting the professional security crowd, while DefCon is geared more specifically to hackers. Law enforcement agents, the military and undercover spies regularly attend both conferences — often undercover — to keep pace with the latest research and learn what hackers are up to. They also recruit hackers for professional work.

DefCon holds an annual spot-the-fed contest to out undercover agents as a good-natured sport. Attendees who spot a fed receive an “I spotted a Fed” T-shirt, while the outed agent gets a trophy T-shirt of his own to take back to his office, sporting the phrase “I was spotted at DefCon.”

Not everyone wants to be outed or plays by the conference ground rules for working undercover. Several years ago, undercover agents believed to be working for Israel’s Mossad spy agency were kicked out of the conference after registering as journalists and posing as a French film crew from Canal Plus.

It’s not known specifically why Williams attended Black Hat or if he and his colleagues attended incognito. A Black Hat organizer did not immediately respond to a request for comment.

Williams, who was 31 when he died, was found inside a North Face nylon sports bag in the bathtub of his apartment. His nude body was in the fetal position, with his arms folded across his chest. The bag was closed with a padlock, and two keys to the padlock were found underneath Williams’ body inside the bag.

His mobile phone and a number of SIM cards were laid out on a table nearby; the phone had been restored to its factory settings. There were no signs of forced entry to the apartment and no signs of a struggle.

Williams was described by those who knew him as a “math genius” who graduated from Bangor University at the age of 17 with a degree in mathematics. He’d begun his university studies while still in secondary school. In 2001 he joined Government Communications Headquarters (GCHQ), Britain’s listening post, helping to break coded Taliban communications, among other things. He was considered a “world-class intelligence officer” and had won two awards for codebreaking, according to his boss at GCHQ.

In 2009, he was loaned out to MI6, Britain’s foreign intelligence service, for a three-year stint, but asked to be transferred back to GCHQ after a year. He was preparing to move back to his old job around the time he was killed.

Williams had worked in a four-man team as an expert codebreaker and shortly before his death had been in contact with two secret agents working in the field in the U.K., according to testimony at the inquest.

The Daily Mail quoted anonymous sources last year saying that Williams had been working on secret technology to track stolen money being laundered through Britain by Russian mafia. The technology was reportedly designed to allow MI6 agents to follow money from bank accounts in Russia to criminal gangs in Europe via internet and wire transfers.

He also worked on another secretive project to develop devices for stealing data from mobile phones and laptops using wireless technology.

“He was involved in a very sensitive project with the highest security clearance,” the anonymous source told the Daily Mail. “He was not an agent doing surveillance, but was very much part of the team, working on the technology side, devising stuff like software.”

The source indicated that Williams’ work to disrupt the Russian mafia could have put him at risk.

“Some of these powerful criminal networks have links with, and employ, former KGB agents who can track down people like Williams,” the source said.

Williams also had reportedly worked with the NSA and British intelligence to intercept e-mail messages that helped convict would-be bombers in the United Kingdom. He had made repeated visits to the United States to meet with the National Security Agency and worked closely with British and U.S. spy agencies to intercept and examine communications that passed between an al-Qaida official in Pakistan and three men who were convicted in 2009 of plotting to bomb transcontinental flights.

Investigators said during the inquest that there was no evidence Williams was killed as a result of the work he was doing, but they acknowledged that a full investigation had been thwarted by the spy agencies who employed Williams, raising suspicions that the agencies might have been involved in his death or at least know who was responsible for it.

Hours before he died, surveillance cameras captured Williams in London’s Knightsbridge neighborhood while he was shopping at the luxury department store Harrods. Williams was expected at work the next day, but never showed up. MI6 did not report him missing, however, until Aug. 23, at which point his body had decomposed, thwarting attempts to determine the precise cause of death.

The spy agencies also failed to hand over nine thumb drives found in Williams’ locker at work. The drives were released to investigators only this week. Other electronic equipment that Williams used at work was handed over to Scotland Yard investigators four days after Williams’ body was discovered, raising questions about whether they had been cleaned by the spy agencies first.

Family and friends testified that Williams was unhappy with his work environment at MI6 and felt he didn’t fit in with his colleagues. During the inquest, testimony revealed that the coder had conducted unauthorized searches of an MI6 database that could have put him at risk if he was discovered. Investigators said, however, that MI6 was apparently unaware that Williams had conducted the searches.

A coroner said at the inquest that while it appeared unlikely that British spy agencies played a role in the coder’s death, it was still a “legitimate line of inquiry” for the investigation.

Investigators found no fingerprints or other any other evidence indicating someone had been with Williams the night he died, or that anyone beyond his family had ever been in his apartment. Investigators said at the inquest that small traces of incomplete DNA had been found on the tiny padlock that had been used to closed the bag in which Williams’ body was stuffed. The only other DNA evidence found in the apartment that didn’t belong to Williams or his family was found on a green hand towel in the kitchen.

Authorities plan to take DNA evidence from 50 colleagues who worked with Williams at MI6 to determine if there is a match.