If you call a major airline with details about a bomb on board a plane, the reaction will be swift.
Such was the case on August 24, 2014. American Airlines flight 362, going from Dallas to San Diego, was diverted to Phoenix by US Air Force jets after word came of an alleged explosive on the plane.
As revealed in the HBO Max documentary “Most Wanted: Teen Hacker,” premiering Friday, a man identifying himself as Sony gaming executive John Smedley told a customer service representative that his plane ticket and passport were missing. He added, “I think somebody stole them and boarded the plane … there is a bomb in the plane.”
F-16s scrambled the commercial jet as it touched down on a remote airfield. No bomb was on board — but, in contrast with “his” call, Smedley was. The outrageous bomb threat, it turned out, was retribution for a social media comment that Smedley made after a hacker group known as Lizard Squad took down the computer servers for Sony’s PlayStation 2 as well as Xbox.
“He upset the boys by responding [to the denial-of-service attacks] in a fiery way on Twitter,” Joe Tidy, BBC reporter and author of the upcoming book “Control+Alt+Chaos,” says in the doc. “Lizard Squad, seemingly led by Julius Kivimäki, went after John Smedley.”
Aleksanteri “Julius” Kivimäki, was just 17 and living in his native Finland at the time of the dangerous threat. In 2015, in the District Court of Espoo, Finland, he was convicted of 50,700 cybercrime-related charges, including the bomb hoax. He claimed he didn’t do it and received a two-year suspended sentence.
And bringing down a plane was only one of many big problems he caused in the US, including multiple allegations of swatting.
As made clear in “Teen Hacker,” anyone who crossed Kivimäki — known online by his game-playing name, Zeekill — could pay a heavy price.
“He seems to enjoy making people squirm and making them uncomfortable,” said Brian Krebs, who investigates computer crime, via his website Krebs On Security, and is featured in the documentary. “He’s hurt a lot of people.”
Kivimäki, now 28 and serving a six-year sentence on charges including extortion, stands accused of pulling off some tens of thousands of computer hacks.
Presenting himself as a fair-haired innocent with a raw deal, Kivimäki tells filmmakers in perfect English: “Do I feel that I’m a hacker? That’s a dumb question. Somebody could describe me that way. But these days it does not occupy much of my mind. I’m much more interested in things that happen off of computer screens.”
Lawyers for Kivimäki could not be reached by The Post.
It’s alleged that, in 2015 — when Kivimäki was 15 year old —he even managed to hack into Elon Musk’s Twitter page. Not to go after Musk, but to mess with an online chatroom acquaintance turned adversary, Blair Strater of Illinois.
“I became his punching bag,” Strater says in the doc. “[Kivimäki] reset the password for Elon Musk. Then he put my phone number and address on [Musk’s] profile. He told people to go to my address for a free car. One person would not leave until we called the police.” Strater and his parents reported the incidents to the FBI, who ultimately could do little since the alleged crimes happened when Kivimäki was a minor living in Finland. Kivimaki has stated that the 50,700 crimes of which he was convicted have nothing to do with Strater.
Other times, Kivimäki was allegedly involved in acts of swatting — falsely claiming to authorities that there is a life or death emergency that requires a SWAT team — against Americans.
As police officer Justin Bisceglie explains in the doc, “Swatting calls bring a large response with large weapons and something can go wrong.”
Bisceglie had responded to a 2014 swat call that allegedly came from Kivimäki after a girl in Norfolk, Connecticut, snubbed him online.
The [girl’s father] went out to walk the dog and there was a swat team around the house. He got pinned down on a neighbor’s lawn,” Bisceglie recalled. “The daughter was awakened with flashlights in her face. The mother cries when she thinks about it and worries that the person responsible will do it again.” Because he was a minor, according to Connecticut Patch, he could not be extradited to the US.
Kivimäki is also accused of swatting the relatives of an FBI agent on his trail. It is unclear whether or not he faced charges for this.
As for why he would swat the relatives instead of the agent, “Teen Hacker” producer Joni Soila told The Post: “It’s a much bigger thing if somebody hurts my father than if they hurt me.”
Shrugging it all off, Kivimäki says in the doc, “The swatting thing was really stupid. At some point it became trendy in the communities where I hung out.” He describes what he did as “harmless.”
Kivimäki grew up in the Helsinki suburb of Espoo and was a precociously good student — until he dropped out of secondary school to become one of the most notorious hackers in Europe.
“He comes from a very good family. His parents are normal people, very good and caring. His sisters have no problems,” Soila told The Post. “He developed computer skills [at a young age] and knew how to make code right away. He felt that he knew better than authority.”
Kivimäki was already into gaming when discovered hacking at age 12. Spending endless hours in front of screens, he was drawn to kids with the same hyper focus. They connected on chat groups, which led to him joining the hacker group Lizard Squad
“They were not [hacking] to make the world a better place. They were doing it to get power, create chaos and to earn Bitcoin,” a source says in the doc.
According to director Sami Kieksi, Kivimäki’s crypto cache may be considerable.
“I believe he earned millions,” Kieksi told The Post. “According to estimates by author and dark web expert Aarno Malin, Kivimäki could be at least partly responsible for a scammer known as Dnstats who has made at least 2 million euros through, among other things, phishing scams.
Kivimäki has claimed in court that he lives off “the appreciation of his cryptocurrencies.” Elsewhere, he has said that his annual income is in the millions.”
According to the documentary, Kivimäki became so brazen that he appeared on Sky News in Europe to talk about the PlayStation and Xbox hacks that Lizard Squad caused to happen around Christmas 2014 and took the systems offline for players around the world. He took credit for it and, according to the documentary, said he’d be worried if kids had nothing better to do on Christmas day.
“When he came out on Sky News it was shocking,” Antti Kurittu, a cyber investigator who was on Kivimäki’s trail, says in the documentary. “Who openly talks about this? Hackers cultivate personalities online behind nicknames. That’s who they are. Offline they have typical names and jobs. But he melded the two personalities together.”
Tidy, who interviewed Kivimäki for the broadcast, was shocked: “He was just a kid. I remember being stunned by the arrogance of this boy.”
A person of interest since the age of 13, Kivimäki earned Interpol Red Notice status after he hacked into Vestaamo, the biggest psychotherapy company in Finland, in 2020. Holding Vestaamo’s patient database hostage, he allegedly threatened to make the personal information of some 33,000 patients public if the company did not pay him 40 bitcoins, currently worth about $4.3 million.
When that failed, the patients themselves were mass emailed and told to pay 200 euros in bitcoin or the information would be leaked.
According to the BBC, the attack shocked the country — and led to the suicide of a distraught patient. Vestaamo’s CEO, Ville Tapio was fired and found himself convicted of failing to protect the data. He received a three-month-long prison sentence, which has been suspended.
On the run, according to Soila, Kivimäki lived the life of a jet-setter: traveling to London and St. Tropez, staying in fancy hotels, buying designer clothing and eating in top restaurants.
During an interview with the documentary filmmakers, filmed before his sentencing and while he was laying low in Helsinki, Kivimäki said, “Maybe I’ll find a good enough fake beard or a wig. Then I can go again to Michelin restaurants.”
In 2022, he was finally arrested in an apartment outside of Paris, after police responded to a domestic disturbance call and recognized his alias.
He was found guilty on all counts related to the Vestaamo hack and sentenced to just over six years, which he has been serving in a Finnish maximum-security prison. But he may not be there for much longer.
According to Soila, “If nothing changed, he’s free in the next year. [In Finland], when you are first time, you need to stay in prison for 50% [of the sentence].”
He’s shown no sympathy for his victims.
“Many people may think that this is just me playing the victim again,” Kieksi recalled being told by Kivimäki. “But let’s put it this way: It’s unlikely that among those 30,000 victims there are many people who have suffered as much from this case as I have.”
