Topiary (hacktivist)

Jake Leslie Davis, known professionally as Topiary, is a British hacktivist. He has worked with Anonymous, LulzSec, and other similar groups. He was an associate of the Internet group Anonymous, which has publicly claimed various online attacks, including hacking HBGary, Westboro Baptist Church, and Gawker. They have also claimed responsibility for the defacing of government websites in countries such as Zimbabwe, Syria, Tunisia, Ireland, and Egypt.

Early Involvement with Anonymous

Jake Leslie Davis, born October 27, 1992, became involved with the decentralized hacker collective Anonymous under the online handle Topiary. As a member of Anonymous, Davis participated in the group's activities during a period of significant public attention, including operations that targeted organizations such as HBGary, the Westboro Baptist Church, and Gawker. Anonymous also claimed responsibility for defacing government websites in countries including Zimbabwe, Syria, Tunisia, Ireland, and Egypt.

A pivotal moment in Anonymous's history — and in Davis's trajectory — came when Aaron Barr, then CEO of HBGary, publicly claimed to have identified members of Anonymous. In response, a small team within Anonymous, including Davis, carried out an attack on HBGary and published the organization's stolen emails. That core group subsequently splintered from Anonymous and formed a new collective called LulzSec.

LulzSec

Davis became a prominent member of LulzSec, taking on the role of managing the group's Twitter account and serving as a public-facing voice for the collective. On February 24, 2011, he gained considerable attention when he appeared on The David Pakman Show and announced, during a live on-air confrontation with Shirley Phelps-Roper of the Westboro Baptist Church, that Anonymous had replaced one of the church's webpages with a message from the group. A recording of the exchange was uploaded to YouTube and surpassed one million views within five days.

On July 14, 2011, The Guardian published an exclusive interview with Topiary in which he discussed his motivations at length. He described himself as "an internet denizen with a passion for change" and expressed concern about being identified by law enforcement. A full transcript of the interview was later published by freelance Guardian journalist Ryan Gallagher.

Arrest and Charges

On July 27, 2011, an 18-year-old man suspected of being Topiary was arrested in the Shetland Islands of Scotland. Scotland Yard subsequently identified the individual as Jake Davis, a resident of the island of Yell. He was charged on July 31, 2011, with five offenses, including unauthorized computer access under the Computer Misuse Act 1990, encouraging or assisting criminal activity under the Serious Crime Act 2007, conspiracy to launch a denial-of-service attack against the Serious Organised Crime Agency contrary to the Criminal Law Act 1977, and criminal conspiracy under the same act.

Police seized a Dell laptop and a 100-gigabyte hard drive containing 16 virtual machines. The hard drive also held data related to an attack on Sony, along with hundreds of thousands of email addresses and passwords. Davis was released on bail with conditions requiring him to live under curfew with his mother and to have no access to the internet. His lawyer, Gideon Cammerman, stated that while Davis had helped publicize LulzSec and Anonymous attacks, he lacked the technical skills to have been more than a sympathizer. Following his arrest, Anonymous launched a "Free Topiary" campaign in his support.

Guilty Plea and Sentencing

On June 25, 2012, Davis pleaded guilty to DDoS attacks on several websites, while pleading not guilty to two counts of encouraging others to commit computer offenses and fraud. He was scheduled to be tried alongside fellow LulzSec members Ryan Cleary, Ryan Ackroyd, and Mustafa Al-Bassam, with proceedings set to begin April 8, 2013.

On April 8, 2013, all four defendants appeared in court and pleaded guilty to computer crimes. They were sentenced on May 14, 2013. Davis faced a maximum sentence of 10 years but received 24 months in a young offenders institute. He ultimately served 38 days in custody, as 21 months of electronic tagging prior to sentencing was counted against his term.

Later Career

After completing his sentence and serving a mandatory two-year period without internet access, Jake Davis transitioned into legitimate security research. He has since worked within the framework of corporate bug bounty programs, disclosing vulnerabilities to companies through established responsible disclosure channels.