DarkMarket: Cyberthieves, Cybercops and You

by Misha Glenny

  Among the friends invited to this game was Mert, who, Şahin told Çağatay, was one of the new boys working on his skimming trade. Mert also introduced his new girlfriend, Sanem. She dazzled Mert, while the ostentatious wealth of his companions dazzled her.

  Sanem already knew the profiles of some of the people in the executive box. It was not difficult wheedling secrets out of Mert. Not only was he a chatterbox by nature, but he was desperate to impress his young paramour, whom he considered way out of his league. Seeing powerful men like Şahin and his well-built sidekick Çağatay strut around the executive box must have been confirmation for Sanem that little Mert really did have some impressive contacts. If, that is, the Fenerbahçe game was not an episode from Mert’s dream.

  Life had been good for Mert. He and Sadun were starting to make serious money from the Akbank scam. As an active informant for National Intelligence, he enjoyed wide-ranging protection and he was highly regarded by Cha0, the key player on DarkMarket. But above all else, he was spending every day and night with a fabulous, beautiful young woman who seemed to be similarly smitten.

  Summer had arrived and Mert decided to capitalise on his good fortune by taking a holiday in Antalya at the coveted Adam & Eve Hotel, where designers had successfully mated a high budget with singularly poor taste. Huge infinity pools lapped at an atrium with ever-changing light shows, while the rooms were known for the countless mirrors, conducive to much high-energy sex. None of this came cheaply. Rooms started at $400 a night, while visitors noted that one could quickly rack up huge bills with the extras. But for Turkey’s young, beautiful or rich, it was the holiday destination of the season.

  As soon as Mert and Sanem had checked in, they ran into Çağatay, who had also flown south for the summer. Çağatay explained to a tubby bespectacled gentleman accompanying him that Mert had been assisting the Cha0 team with ‘administrative matters’. The tubby gentleman squinted at Mert before exclaiming, ‘Wait a minute? I’ve known this guy since he was a kid in shorts! What the hell are you doing in this business?’ And Mert responded as he always did by giggling and smiling mischievously.

  As he and Sanem headed to their bedroom, Mert leaned over and said, ‘The second guy? That was Lord Cyric.’ Sanem wanted to know whether Cyric was more powerful than Cha0. Mert assured her that he wasn’t, but he remembered that she was interested in power first and money second.

  Mert was in heaven and in love. He was a moneyed man, respected by criminals and the intelligence service alike, and to the outside world he had an impressive job running the IT department at Fox Turkey. Furthermore, he was spending his summer lounging around the Adam & Eve Hotel with his hot new girlfriend. It couldn’t get any better.

  And it didn’t – in retrospect, August 2007 represented the brief golden age of Mert Ortaç’s dream world, in which his fantasy projections coincided for once with reality. Almost as soon as he returned to Istanbul, matters began slipping out of his control and, as summer turned to autumn, dark shadows started to spread. Sanem and Mert were wont to take expensive shopping trips to places like the island of Mykonos in neighbouring Greece. The pair would drop thousands of euros in a day, which placed a strain even on Mert’s well-stuffed treasure chest. His resentment at what he regarded as her profligacy was matched by her growing irritation with his secrets and lies.

  In a typically convoluted episode, Mert was detained for having allegedly stolen ¤5,000 from a friend of Sanem’s brother. His detention proved to be the last straw for Fox Turkey, which dismissed him. More ominously, National Intelligence finally decided that he had become a liability who was no longer worth protecting. Out of the blue, he felt suddenly very exposed, as well as being deprived of two important sources of income.

  On remand, he stepped up his carding activities with Sadun, thanks to the continuing vulnerability of the Akbank’s systems. Desperation translated into nervousness, compounded by the miserable discovery that Sanem was having an affair. The subsequent bust-up was a tempestuous business and bitter accusations were hurled back and forth. Mert believed that she had stolen large sums of money from him. She must have thought he was quite simply insane.

  With his world suddenly falling apart, Mert travelled south for the New Year to consider his next move. On the road, he received further bad tidings – Sadun had been arrested and the police had already raided Mert’s flat, brandishing a warrant for his detention. Had he stayed in Istanbul he would already be under lock and key. As so often when faced with a tough situation, Mert’s decision was to keep digging until he was well and truly underground.

  Returning under an assumed name to Istanbul, he started to plot an escape strategy. Using one of his many false IDs, he applied for and received a new passport, before bribing a consular official at the French Embassy in order to secure a visa. He then embarked on a tortuous journey via the French Caribbean territory of Martinique and Paris to Alès, a sleepy town lying fifty miles north of France’s Mediterranean coast.

  Mert was isolated. He possessed limited funds, barely spoke a word of French and, even more unsettling, he had no ready access to the Internet. At least he was able to console himself with the knowledge that he was safe. And so, with nothing else to do, Mert sunk into an extended period of rest and relaxation.

  After the harum-scarum experience of being a fugitive from Turkish justice while feuding with his ex-lover, he soon regarded Alès as a welcome refuge. For the first time in months, maybe years, he could dispense with the half-truths, the deception, the thieving and the prevarications. He could cease the extreme compartmentalisation that his multiple online and offline personalities demanded and seek his real essence – provided, of course, he still had a recognisable essence. Perhaps the time had come to make a break from the madness: time to go straight, find a proper job and settle down with a decent woman. If he played his cards wisely, all this lay within his grasp.

  Then one morning at around eight o’clock there was the knock on the door.

  Mert was lying in bed sipping some coffee. He had never received visitors here in Alès and was not expecting them. Throwing on his dressing gown, he shuffled towards the door and opened it to two men who were carrying backpacks. ‘Hello, Mert! How are you?’ said the first one in Turkish. In return, Mert muttered feebly, ‘Je ne comprends pas . . .’ ‘Come on, Mert,’ said the second man in English, ‘we know who you are. It would be in your interest to invite us in.’

  As they sat with mugs of coffee around the kitchen table, one of the men pulled out a folder and put it on the table. Mert had the first man down as a second-generation immigrant to America from Turkey because he spoke colloquial Turkish, but with an accent and occasional grammatical errors. The second guy, who did most of the talking, was American.

  Mert was presented with alternatives: ‘Either you help us unconditionally or we are giving this folder to the Sécurité.’ Mert flicked through the pages of French credit cards, which he and Sadun had skimmed after they had wormed their way into the innards of the Akbank’s computer system. The two men reminded him that in France he could receive up to eight years for just one credit-card fraud.

  This was Hobson’s choice, but before he consented, Mert demanded to know who the two men represented. American law enforcement came the reply. ‘And what,’ Mert continued, ‘do you want from me?’

  ‘Go on, Mert, have a wild guess!’

  Mert, irritated and frightened, shook his head.

  ‘We want you to give us Cha0.’

  33

  RETURN TO HADES

  As the three men discussed Cha0 and his possible whereabouts, Mert could tell from their questions and comments that they knew neither Cha0’s identity nor Lord Cyric’s. The two agents told Mert that he would have to return to Turkey, re-establish himself on DarkMarket and flush out Cha0 and his colleagues. They surprised him even more by telling him that one of their people controlled the DarkMarket server. Thus they could easily help to get him back on the boards.

  As far as M
ert could ascertain, the FBI now wanted to move in on all the remaining central players on DarkMarket: Cha0, Lord Cyric, Master Splyntr, Shtirlitz and Grendel. They had not told him how exactly, but he was evidently supposed to be instrumental in all this. It was not a prospect he relished, but then neither was a spell inside one of France’s prisons, which were rumoured to be among the most unforgiving in Western Europe.

  The American agents offered Mert some vague promises and armed him with a phone number and email address for Lucy Hoover, the Assistant Legal Attaché at the US Embassy in Istanbul. He was also given an email account, sadinsider@gmail.com (Mert chose the name), through which he could leave messages for her.

  Mert’s sojourn in the Languedoc is the second episode from his dream world that is not verifiable. But he did establish contact with Lucy Hoover of the FBI, who was in Turkey at the time.

  Mert had been away for two months when he arrived back on 2nd March 2008. The first thing he had to do was devise a plan of action. He decided to approach the news organisation and TV station, Haber 7, offering them an interview in which he promised to reveal the secrets of the carding world and DarkMarket. His aim, perhaps unwisely, was to put the frighteners on Cha0, to let him know that information about his operation was leaking out and that the police might well be investigating him.

  In his innocence – which, despite everything, was still an integral part of his character – Mert assumed that Cha0 would not be able to establish who this mystery hacker offering interviews to the press actually was. But Mert had not reckoned with Haber 7 taking a sneaky photograph of him at the McDonald’s in Kadıköy where he and their journalist met. Once that was published, Cha0 knew who had been blabbing. Mert was firmly in the big man’s sights.

  With a warrant out for his arrest and Sadun under lock and key, Cha0, Lord Cyric et al. would have known that Mert was vulnerable to pressure from law enforcement. The interview reinforced those suspicions. So instead of returning to the DarkMarket board directly, Mert made contact with a young hacker friend of his called Mustafa, who was also known to Cha0. Mustafa was, by all accounts, keen to develop his skills in the easy money culture of carding and cybercrime.

  Mustafa’s family came from Antalya, which also gave Mert an excuse to get out of Istanbul where he felt insecure. He stayed in the south for more than a month, back in his favourite part of the country.

  Mustafa worked on DarkMarket using the nickname MYD, and he developed a good working relationship with Cha0. What Mert did not know, however, was that Mustafa had warned Cha0 that Mert appeared to be stalking him.

  Mustafa arranged to meet Cha0 up in Istanbul, and so he and Mert headed back north. Mert had kept Lucy Hoover informed of his movements and alerted her that he was preparing to meet Cha0. The Americans needed to get a sighting of Cha0 and to establish both his coordinates and his communications infrastructure. Mert, for once, was keeping a promise – leading the Americans to their quarry. Cha0 had instructed Mustafa to meet his people outside a Burger King not far from Göztepe suburban rail station, which is on the Asian side of Istanbul, a couple of miles from Fenerbahçe’s stadium.

  When they reached Göztepe, they found Hakan Öztan, a big bull of man who had acted as Çağatay’s minder when the two were in prison together and now offered the same services to Şahin as well. The bodyguard took them both to a house named Sözdener Apartments in the wealthy middle-class district of Suadiye, some two miles away. The rooms were sparsely furnished and not especially welcoming. Hakan told the two men to stay put and that somebody would be in touch with them.

  No longer under the protection of open spaces, still less of National Intelligence, Mert was now worried that Çağatay was on his way to sort him out. Unbeknownst to him, Mustafa had placed a trojan virus on Mert’s laptop on the instructions of Cha0, and that infection was now revealing to Cha0 all of Mert’s secrets, a dense jungle of duplicity. Cha0 was not only a master criminal; he was also an unforgiving one. He now had solid evidence that Mert was working for the police. Mert assumed (and certainly hoped) that Lucy Hoover had somehow organised surveillance of the apartment, but he could not see any signs of it. So if Çağatay, Şahin, Hakan or any combination of the three turned up, he was in serious trouble.

  At ten o’clock on Sunday morning, 18th May 2008, Mert was alone when the doorbell rang at Sözdener Apartments. He opened up to find Hakan standing in front of him. His visitor didn’t speak, but strode brusquely past Mert, closing the door behind him. Mert said cheerfully that he had been expecting him. Hakan glared at him. ‘One minute,’ he said. Then he opened the door and in walked Çağatay. Mert’s colour changed from red to purple to white.

  Çağatay pushed Mert into a chair and started slowly pacing up and down in front of him, ritually intoning, ‘Mert . . . Namert . . . Mert . . . Namert’ – a play on words in Turkish in which the antonym of the word mert (courageous) is namert (cowardly).

  Then Mert found himself on the floor being kicked in his stomach, chest and legs. Two more heavies walked in, threw a blanket over his head so that he could not recognise them and joined in the beating. Occasionally Mert caught a glimpse of a gun being pointed at his head.

  He blacked out. When he came to, he was still on the floor, but he noticed a video camera filming everything that was going on. By placing the trojan on Mert’s laptop, Cha0 had not only been able to access information about the relationship with Lucy Hoover, but would also have discovered that National Intelligence had been running Mert (albeit with only partial success).

  ‘Right,’ said Çağatay, who, acting as master of ceremonies, switched on the record button. ‘Now you are going to tell us the whole story from beginning to end.’ And so Mert went through his Looking Glass tale, finishing at about three o’clock in the morning. They wanted to know everything – about the spooks, the carding with Sadun, the DarkMarket exploration, the girlfriend – and not one detail was left out.

  The thugs finally went to sleep, except that one was always awake to ensure that whenever Mert nodded off, they could rouse him with a shower of kicks and punches.

  At midday on Monday, Şahin called, and Çağatay placed him on speaker phone. By this time Mert’s will had been broken. He assumed he was going to be killed. He was not surprised when Şahin told him to repeat everything he had already said. It was all filmed. At the end, Şahin spoke. ‘Okay, now is the time for your punishment,’ he said without irony, ‘I want you to do everything that Çağatay tells you to do and I will judge the outcome.’

  Çağatay told Mert to stand up and strip. Fearing that he was about to be gang-raped, Mert finally snapped. ‘Oh, for God’s sake, just put a bullet through my head,’ he pleaded. ‘What the hell do you think you are doing with me?’

  ‘Shut up,’ Çağatay retorted. ‘You’ve got nothing to worry about. We’re not a bunch of shirt-lifters. Keep your boxers on and accept your punishment!’ On the phone to Şahin, Çağatay now scrawled the infamous piece of paper that branded Kier or Mert Ortaç a traitor and a snitch. This is how the myth of Kier was established. The journalist from Haber 7 had found Mert’s name on a website alongside the nickname ‘Kier’. In fact, Mert had never, and would never, use this name – his real nick was SLayraCkEr. But after Çağatay took the photograph, journalists, police and carders around the world would refer to Mert Ortaç as Kier, even though he had never been called that in his life.

  After the photo session, Mert was thrown down onto the floor again and the blanket was tossed over him. ‘Stay here for half an hour and then you can leave,’ Çağatay said. ‘We are leaving you your clothes and we won’t touch your money. You can also have one ID. From now on – for the rest of your life – don’t even think of writing the name Cha0, because if you do, I’ll have my hands round your neck before you take another breath.’ Finally Çağatay could not resist adding a personal note, ‘If it had been up to me, I would have killed you here and now. But the man likes you. Be grateful and keep your mouth shut.’ (Çağatay himself consid
ered any idea that he might want to murder someone like Mert – a little squit in his eyes – laughable.)

  Half an hour later the battered Mert Ortaç, with just fifty dollars in his pocket, stumbled out of the apartment and headed for the national bus station, from where he caught a ride to the town of Izmir. Here he would lick his wounds and wonder what on earth he should do next. It was obvious: he would go underground. Mert disappeared for the last time – until he was arrested many months later while applying for a passport under a different name in November 2008.

  Further strange tales inhabit Mert’s dream world – neither reality nor fantasy – but, for our purposes, this is where it ends.

  34

  TURKEY SHOOT

  Before Mert was finally arrested, Inspector Bilal Şen had no idea whether the hacker was on the run, still a prisoner or simply dead. He did know, however, that time was not on his side. The only option open to the officer was to continue to track down Cha0 as efficiently and patiently as possible. At least he now had a photograph and a number for the man sending the skimmer, and he was convinced that this would eventually lead him to Cha0. Because the henchman who had delivered the skimmer was using one of the phone numbers that he had registered with the shipping company, the police were able to ‘triangulate’ the suspect – in other words, they could spot which cellphone masts the device was accessing. They soon had an accurate idea both of where he was and of the pattern of his movements.

  Before long they had a second sighting and were able to put a tail on him. Sure enough, within a matter of days the man had led them to a villa in Tuzla, a distant suburb of Istanbul that lay about fifteen miles down the Asian coast. Home to one of Turkey’s largest naval bases, this area, once famous for its fishing, was one of only a handful in the city that had not been completely dominated by new buildings. With its spacious houses with their colourful exteriors, it was a highly sought-after neighbourhood, peopled largely by wealthy families.