In a broken-down speedboat off the coast of Cuba, Marty and Dana Gottesfeld watched the sun creep closer to the horizon. Salty wind whipped Dana's chestnut-colored hair as her husband buckled himself into an orange life jacket. The facts were stark and unavoidable: Their boat was stuck in the middle of the ocean, and Marty was a wanted man.
It was supposed to be a day of celebration. Exactly one year earlier, the two had married in a small ceremony in Pompano Beach, where Marty's adoptive parents had retired. But now, as the sky grew dark the night of their first anniversary, they knew they were in deep shit.
For Marty, it was a foreboding turn in a life he'd worked so hard to attain. Abandoned by his mother at a young age, the brilliant 31-year-old had gone from college dropout to six-figure systems engineer at a tech firm. He'd met the woman of his dreams and settled into a comfortable upper-class life in a Boston suburb. And then the FBI closed in. With the threat of arrest hanging over his head, Gottesfeld and his new bride had plunked down $4,000 for a red-striped speedboat and left behind everything they knew.
Now, adrift in the Atlantic, their desperation was rising. Finally, they made the decision that would change everything. They put out a distress call on their tiny boat's radio.
A few miles away, families on the Disney Wonder were settling in for a live performance of Toy Story: The Musical when the cruise ship began to shake. An employee hopped onto the stage and explained the ship was slowing to rescue another vessel.
He insists he's a "hactivist" participating in an online form of civil disobedience.
tweet this
As crew members hoisted up the couple, they couldn't help but notice the two reeked of the sea. The newlyweds claimed to have left Key West earlier that day, but their stench suggested they'd been gone much longer. Inside their unregistered, uninsured boat were navigation tools and mementos: a passport, a Cuban wind chart, a wedding album. The two were escorted to a cabin, where a suspicious guard stood at attention outside. The cruise workers would soon learn the truth about their new passengers: The next morning, as the ship sailed into PortMiami on February 17, 2016, FBI agents swarmed the dock and handcuffed Marty.
Gottesfeld, the feds told reporters, was an Anonymous hacker who'd maliciously taken down Boston Children's Hospital's website, costing the hospital hundreds of thousands of dollars and hampering doctors. "It was tremendously disruptive," prosecutor Adam Bookbinder said at a bond hearing after the arrest. "There's no excuse."
But Gottesfeld's story is far from that clear-cut. Where the government claims he's a dangerous cybercriminal, he insists he's a "hactivist" participating in an online form of civil disobedience. The real story, he says, is the way Boston Children's treated Justina Pelletier, a teenage girl whose parents said she was being abused at the hospital. The cyber-attack was only meant to help draw more attention to the controversial case, Gottesfeld says, and didn't do real harm to the hospital or its patients.
"I was seriously concerned Justina would never recover physically or mentally from the trauma she was being put through, and it was even possible she could die," he explained in a letter from jail last year.
As Gottesfeld awaits a trial that could send him to prison for 25 years, his case sheds light on a decades-old cybercrime law that some say comes down too harshly on online activists — and that has already led to one prominent suicide. Gottesfeld himself has gone on a 100-day hunger strike. His case could have huge ramifications on future hactivism cases, but his risks rise each day as he wastes away in jail.
"If defending Justina's life was wrong," he says, "then I don't want to be right."
From a young age, Gottesfeld showed hints of the stubbornness that would one day fuel his defiant stand against authorities. As a toddler, he jumped so hard in his bouncing seat that he nearly destroyed the door frame from which it hung. If someone turned off the TV while he was watching, he'd get up and flip it back on. At baseball practice, he balked when it was his turn to field; he just wanted to hit.
He was a brainy kid but a mediocre student, although he showed an early interest in computers. His fascination was encouraged by his grandfather, who worked as a computer programmer before such a title even existed.
"When he was like 5, my parents bought him a little toy computer thing that you buy kids, and then at 6, he was taking them apart, and at 7, he was building them," says his aunt, Lisa Brown, a computer science researcher at IBM.
Though Gottesfeld grew up in Massachusetts, his story begins in Pompano Beach, where his great-grandmother once owned a beachside condo. His mother, Wendy, had been visiting her in Florida when she met a younger man who remains mostly unknown to the family three decades later. The two wed in Palm Beach County in the summer of 1983, and a baby came along nine months later.
While Gottesfeld's 29-year-old mother was excited to have her first child, her husband was less enthusiastic. The pregnancy ended the short-lived marriage, and Wendy moved back home to Massachusetts with her parents, who by then were 54 with four grown kids of their own.
Jay and Gloria Gottesfeld — the couple who would actually raise Marty — were college sweethearts who'd met while studying mathematics at Brooklyn College. Both members of the bridge club, the two had won a local tournament in the spring of 1951 and traveled together to compete in the final round of the National Intercollegiate Bridge Tournament in Chicago. They came in second place, fell in love, and married soon after.
The couple had been empty-nesters for years when their daughter Wendy came home with a baby. The three of them adjusted to life with a newborn, but as Marty grew older, his mother's mental health deteriorated. After a short hospitalization, Wendy moved to a nearby town and allowed her parents to formally adopt her 12-year-old son.
"She was around during that period, but she was sort of in the background, not really acting like a mother much," says Brown, Wendy's sister. "I think their relationship really faded when she wasn't living there anymore. I don't think Marty ever saw her once that happened, and once he got older, he didn't want anything to do with it."
"Time was running out, so I acted in the way I was best qualified."
tweet this
For Jay and Gloria, the step back into parenthood was difficult. They did their best with Marty, but the situation created an unspoken tension within the family that hung like an ever-present storm cloud.
"It was hard for them, and they didn't always do it as tactfully and gently as you would like," Brown says. "I think it was very hard on Marty too... He has a little bit of a chip between having a mother who was really dysfunctional and not having a father. That's a really hard thing."
As a teen, Gottesfeld worked as a lifeguard, joined the wrestling team, and practiced judo. He fell in love for the first time with a girl he met at a summer computer program at Carnegie Mellon. He considered joining the military and often went out of his way to thank men and women in uniform, sometimes to the point that his need to say something would embarrass whomever he was with.
In 1999, he enrolled in Phillips Exeter Academy, an upper-crust boarding school in New Hampshire, where he took English and physics with Mark Zuckerberg. Though he admired the other computer science students, he believed the instructors were inept. Gottesfeld lasted only a couple of years, leaving in 2001 after administrators disciplined him for hacking into the school's network — he says in order to expose security vulnerabilities.
"I think some of them are actually jealous of and subconsciously trying to compete with their own students, whose talent far outstrips that of the vast majority of the faculty," he later wrote of the experience on an online message board.
After graduating from the local public high school, Gottesfeld started his freshman year at Drexel University but soon decided the structure of college wasn't for him. At 18, he dropped out and immediately landed a gig as a senior systems engineer. Over the next decade, he advanced quickly through the tech world. "He always made a good living," said his adoptive father, Jay.
Shortly before his 30th birthday, Gottesfeld got a message on OkCupid from Dana Barach, a Los Angeles native studying sociology at Brandeis University outside Boston. The two quickly hit it off — he liked her confidence and assertiveness, and she was drawn to his warm personality and intellect. They began dating in February 2013.
"He was just this guy who was very clear at thinking and filled with love and compassion," Dana says. "I'd never come across somebody like him."
After graduating that spring, Dana returned home to California, where a troubling situation involving her brother would spark the couple's turn toward hactivism.
That summer, she and her father drove to Utah, where her brother had been placed in a residential treatment center for teens with behavioral issues. Dana knew her brother had struggled academically and been caught smoking pot, but the conditions at his new school, Logan River Academy, seemed extreme. He claimed he spent 80 percent of his time there in "devo," the school's form of solitary discipline, and said his peers were often physically restrained by staff. One time, he'd even seen a suspicious-looking pool of blood on the floor.
"I definitely felt uncomfortable from what I saw, but I was reassured after talking to his therapist that the kids were only put in restraints if they are violent and only to restrict them from harming others," she recalls.
But when she moved back to Massachusetts with Marty, the staff at Logan River refused to patch her through to her brother. Marty told Dana that something didn't smell right. A deep dive on Google confirmed their fears: Dozens of former students had posted online about mistreatment and abuse at the Utah facility. (Officials with Logan River have called the allegations "false, inaccurate, and misleading"; the school has been under new ownership since October 2016.)
Incensed by the situation, the couple put up an online petition and started a social media campaign to shut down Logan River. One week later, Dana's parents moved her brother to another school.
The family drama spurred a new mission for the couple. Each day when Marty got home from the tech firm and Dana from her job as a project coordinator, the two spent hours poring over the internet for information about the troubled-teen industry. At one point, a PBS documentary about an embattled Montana facility drove them to tears.
"It's an industry based on marketing materials, with no regulations," Dana says.
Shortly after Dana returned from California, the two learned about a case just down the road in Boston that horrified them. Fourteen-year-old Justina Pelletier had been diagnosed by Tufts doctors with mitochondrial disease, a rare disorder where the body can't produce enough energy. But when her parents took her to Boston Children's Hospital to see a specialist, physicians there said her condition was psychiatric. The family tried to take the teen back to Tufts but was stunned to find out that BCH had filed a medical child abuse case, forcing the girl into state custody instead. Doctors at the children's hospital took her off her medications and kept her in a locked psych ward for more than a year, where the onetime figure skater became wheelchair-bound. One nurse later described her treatment as "torture."
Though the hospital has declined to comment in detail about her case, citing confidentiality rules, the local media jumped on the story as the family raised protests. Everyone from the Boston Globe to Glenn Beck's conservative website the Blaze published articles about the hospital's history of filing for custody of minor patients, a practice so common it had been nicknamed a "parent-ectomy."
For many reasons, Justina's story resonated with the Gottesfelds. Marty identified with the lonely struggle of being separated from parents, while Dana thought of her brother's painful Utah experience.
The two were so worried they drove to FBI headquarters to beg for an investigation. Despite growing protests from pundits such as Beck, the Department of Children and Families dug in its heels. In March 2014, a Massachusetts judge granted the state agency permanent custody of Justina, saying he believed the Pelletiers' failure to cooperate with hospital staff had impeded their daughter's progress.
Marty and Dana were infuriated. "Time was running out," Marty would later explain. "So I acted in the way I was best qualified."
The first sign of trouble for Boston Children's came in an anonymous post on Pastebin, an online bulletin board. Threatening to "retaliate using whatever means necessary," the author published the personal addresses and phone numbers of Pelletier's doctor and the judge who had ruled against her parents. A few days later, a YouTube video featuring B-roll of masked Anonymous members demanded Justina's release.
"Test us and you shall fail," a robotic voice taunted.
By 2014, the tropes of Anonymous were well known: figures in Guy Fawkes masks making bold threats with distorted voices online. But this case was different: It was the first time the figure behind the murky video was targeting a hospital.
Anonymous started around 2003 on 4chan, an online message board where the emerging collective existed mostly to troll. But over the years, the group grew more involved in social justice, protesting corporate America and foreign governments. Its largest battle, against the Church of Scientology, drew protesters from around the world.
Before becoming obsessed with the Pelletier case, Gottesfeld didn't know much about Anonymous. But after posting the online petitions against Logan River, he began to receive some support from the group. He appreciated their willingness to take action, even on unpopular topics. The way he saw it, he'd already tried every traditional means of helping Justina: the cops, the feds, the media. It hadn't worked. Anonymous seemed like the next best bet.
"They were the only ones willing to do anything," he later wrote. "I only took up the Guy Fawkes mask after every law enforcement agency refused to help the kids."
So Gottesfeld began planning: How to hit BCH where it hurt, in a way that would really draw attention to Justina's case? He found the perfect target: one of the hospital's scheduled online fundraising drives.
"I felt that to have sufficient influence to save Justina from grievous bodily harm and possible death... I'd have to hit BCH where they appear to care the most — the pocketbook and reputation," he wrote.
"I only took up the Guy Fawkes mask after every law enforcement agency refused to help the kids."
tweet this
Gottesfeld knew that going after a hospital was controversial. In fact, the plan crossed a line even among many Anonymous members. "To all the 'Anons' attacking the CHILDREN'S HOSPITAL in the name of Anonymous — IT IS A HOSPITAL: STOP IT," the prominent @YourAnonNews account tweeted.
But Gottesfeld was undeterred. Raising awareness for Pelletier was worth the risk. In early April 2014, he began the attack in earnest, flooding the hospital's website with torrents of traffic. Known as a "low-level distributed denial-of-service attack," or a DDoS, the bombardment overwhelmed the network with so much activity that it crashed. On April 19, the hospital's public website and fundraising portal were knocked offline. Unsure what the hacker would do next, BCH took down the rest of its network as a precaution.
Inside the hospital — a 395-bed, Harvard-affiliated facility ranked as the top children's hospital in the nation — the effects of the shutdown were real. The hospital's email went offline; doctors and nurses could communicate only by phone. "Clinicians could create and print prescriptions but could not route them electronically to pharmacies," said Daniel Nigrin, the hospital's chief information officer.
After a few days — and plenty of media coverage — Gottesfeld backed off.
For a few months, it seemed like he was off the hook. By the time Justina was returned home to her parents, Gottesfeld had yet to hear from the FBI. Although the judge in Justina's case said he had changed his mind based on the improved cooperativeness of her parents, Gottesfeld still felt like he'd made a difference.
"The point had been made. Justina wasn't defenseless. Under the banner of Anonymous, she and other institutionalized children could and would be protected," he later wrote.
As Justina's case came to an end, though, the FBI was quietly pursuing its case against the hacker. With a search warrant in hand, 14 investigators raided Gottesfeld's apartment on October 1, 2014, after tying the initial YouTube threat to his IP address. A week later, he received a letter informing him he was the target of a federal investigation.
Marty and Dana continued working and tried to maintain some semblance of a normal life. In February 2015, they married in a small ceremony in Pompano Beach. If anything, Dana said she felt more reassured than ever that Marty would advocate for her and protect her regardless of their circumstances.
Toward the end of that year, the couple met with their lawyer to discuss Gottesfeld's options and even met with the FBI to discuss a plea. The negotiations continued into January 2016, right as the couple was celebrating Dana's 26th birthday. Then, on January 15, the two showed up at work for the very last time.
Those close to Dana and Marty feared the worst when they didn't return after the Martin Luther King Jr. holiday weekend. Marty's employer called police, while Dana's mother filed a missing person's report after noticing her daughter hadn't used her cell phone. Officers were dispatched to the couple's apartment but found it empty.
Unbeknownst to everyone, the two had withdrawn thousands of dollars in cash, bought an unregistered boat, and driven to Florida.
Four weeks later, they emerged from the sea.
On a Wednesday afternoon two months after his capture, Gottesfeld sat uncomfortably before a federal judge at the John Joseph Moakley Courthouse, a stately brick building overlooking Boston Harbor.
It was April 27, 2016, a cool but sunny day that hinted at the promise of spring. Two years had passed since the cyber-attack at Boston's Children's Hospital, and lawyers on opposing sides had convened to decide whether Gottesfeld could be trusted to post bond and go home to await trial.
The government argued the DDoS attack jeopardized patient care and left hospital administrators scrambling, and painted Gottesfeld as a loose cannon who had left the country before he was even arrested. What was stopping him from running again?
"Mr. Gottesfeld was only arrested because of bad luck," said Adam Bookbinder, head of the cybercrimes unit for the U.S. Attorney's Office in Massachusetts.
Gottesfeld's attorney, a New Yorker nicknamed "the Troll's Lawyer" for his defense of hackers, pointed out that the couple hadn't been charged with a crime and weren't under any travel restrictions when they took their boat trip. Moreover, he argued his client was not a criminal, but an idealist taking a public stance on behalf of a vulnerable child.
"This was a very controversial thing, her being held in the custody of Boston Children's Hospital," the attorney, Tor Ekeland, told the judge. It was a losing position: Gottesfeld was once again cuffed and carted back to jail, this time indefinitely.
In the grand scheme of things, Gottesfeld's attack was a small-potatoes effort with a short-lived effect; even Bookbinder, the lead prosecutor, conceded it "was not, you know, a cyber 9/11." But the case could have long-term ramifications: If Gottesfeld takes the case to trial, he could set a legal precedent for other U.S. hactivists. The argument that his actions were legally defensible as protected free speech is a claim U.S. courts have yet to definitively rule on.
DDoS attack organizers can face decades in prison.
tweet this
The law used to prosecute Gottesfeld has long been criticized for likening hackers to hardened criminals. Enacted in 1986, the Computer Fraud Abuse Act (CFAA) criminalizes those who access a protected computer without authorization. Weirdly enough, Matthew Broderick might be to blame. For years, Florida Rep. Bill Nelson had been sounding the alarm about computer fraud, but his one-man crusade garnered almost no support until President Ronald Reagan watched Broderick's movie WarGames, in which the actor portrays a teenage hacker who accidentally starts World War III. Soon clips of the film were played at congressional hearings. Within the year, the CFAA was on the books.
Since then, the law has been amended at least nine times, including in the post-9/11 Patriot Act, which doubled the maximum penalty from five years to ten years for first-time offenders. Despite those changes, the CFAA's power continues to lie in its vagueness. In recent years, it's even given the feds leeway to go after employees who break their companies' computer policies and MySpace users who set up fake accounts.
The CFAA has also been used to lodge criminal cases against Anonymous hackers such as the so-called PayPal 14, who launched a DDoS attack on PayPal after the company stopped allowing donations to WikiLeaks in 2010. Dubbed "Operation Payback," the campaign brought down PayPal's servers for four days, reportedly costing the company $5.6 million. Though the hackers likened the attack to a digital sit-in, taking the case to trial to make that argument proved too risky. With the threat of 15 years in prison, 13 of the defendants pleaded guilty to lesser charges, while another was sentenced to house arrest in a separate case.
Because so few computer fraud cases go to trial, there's little precedent for Gottesfeld's argument that they're a legitimate form of protest. But some foreign courts have bought that idea. In 2001, German hackers went after Lufthansa over the airline's role in deporting asylum-seekers. The group's ringleader was initially charged with coercion, but an appellate court overturned his conviction, finding his attack was intended to start a public conversation.
"When companies that profit off deportations build their biggest branches online, then one has to also protest exactly there," the German appellate judge wrote.
In the United States, though, online activists face serious prison time — far more than in-person protesters. A run-of-the-mill charge of trespassing or resisting arrest typically yields a fine and at most a few months in jail, while DDoS attack organizers can face decades in prison.
Judges have also regularly forced hacktivists to repay the companies they've targeted. In 2013, Wisconsin truck driver Eric Rosol was forced to pay $183,000 to Koch Industries, which he had targeted over its backing of anti-union politicians. Another judge ruled two Anonymous members were on the hook for tens of thousands of dollars of damages claimed by the Church of Scientology following a 2008 DDoS attack.
"What it is is a direct fine for protest, pay to play," says Molly Sauter, author of The Coming Swarm: DDoS Actions, Hacktivism, and Civil Disobedience on the Internet. "It's chilling. It chills free speech and chills any type of online activism."
The most contentious CFAA case came in 2011 with the arrest of 24-year-old Aaron Swartz, a cofounder of Reddit who helped create the RSS subscription feed. A longtime advocate of open records, Swartz was arrested January 6, 2011, after running a script to download more than four million articles from the JSTOR, a database of scholarly journals freely available to most American students. He had argued that the papers, "our entire scientific legacy," should be publicly accessible.
JSTOR didn't want to press charges, but the U.S. Attorney's Office in Massachusetts nevertheless saddled Swartz with 13 felony charges. U.S. Attorney Carmen Ortiz infamously argued that "stealing is stealing whether you use a computer command or a crowbar."
Swartz's supporters were outraged after learning he had hanged himself in his Brooklyn apartment in January 2013, three months before his case was scheduled to go to trial. Although hactivists rarely receive the maximum penalty, he faced 35 years in prison and up to $1 million in fines. His family faulted the government's "prosecutorial overreach" for his death.
The case was fresh in Gottesfeld's mind when he, too, was arrested by Ortiz's office in February 2016. Seven months later, his prospects became even more complicated: In an op-ed published in the Huffington Post, Gottesfeld admitted to masterminding the BCH attack and explained his reasoning behind it.
The way Gottesfeld sees it, the only way to stay true to his cause is to be honest about his role in the attack. In a letter from New York's Metropolitan Correctional Center — the same jail where Colombian drug mafioso Joaquín "El Chapo" Guzmán was being held in isolation — Gottesfeld called his indictment a "cowardly act."
"I believe [Ortiz] is attempting to rewrite history by using my case to justify her abhorrent treatment of Swartz and Boston Children's near-homicide of Justina," he wrote. "If Superman came to Boston, I bet she'd have him indicted for violating FAA regulations and then deported in Kryptonite handcuffs for illegal immigration."
Boarding a 5 a.m. flight from Boston, Dana hurried to get to Florida to see her dying father-in-law. Suffering from end-stage liver disease, Jay Gottesfeld had been given just a few days to live.
With six minutes to spare before Marty's jail phone cut off and less than 5 percent battery on her phone, Dana rushed up to her in-laws' second-floor apartment and held the speaker to Jay's ear as he lay in his favorite recliner, morphine pumping through his bloodstream. Marty told his father he loved him. The 86-year-old died an hour later.
Now in his 16th month of pretrial detention, Gottesfeld has paid a high personal price for his fight against the government. The death of his adoptive father on March 25 was the second loss of a close family member since Gottesfeld had been jailed; his biological mother, Wendy, passed away shortly after he was arrested.
His incarceration has also come at a cost to his family. Two weeks before he would die, Jay Gottesfeld sat in the same brown recliner while his wife, Gloria, pulled an envelope off a side table and read a snippet from Marty's most recent letter.
"I wanted to join the military and serve my country as a child, and it turns out I have put on a uniform to do just that, only my uniform is orange," Marty had written. "Anyway, please don't worry. You and Dad raised a tough, determined young man of principles."
Gloria, clearly distraught, folded up the letter.
"She misses him terrible," her husband finally said.
"Twenty-five years is what you get for murdering someone. It just seems like this is a bit excessive."
tweet this
Jay's death just 15 days later left unfinished business between the grandparents and their adopted son. Though the elderly couple was aware that Marty was accused of computer hacking, they hadn't pressed for many details, and Dana had been too nervous to tell them of the possible 25-year sentence. The judge's order denying Marty's request to attend the memorial service in Florida was just another blow to the newly widowed Gloria.
Prosecutors in the case declined to speak to New Times because of the open case. But the government has argued that Gottesfeld's motives don't matter; BCH suffered real damages from his attack, prosecutors say, and he broke federal law. "This was a significant, very significant disruption for the hospital and can't be excused because Mr. Gottesfeld didn't happen to like, and maybe some other people didn't happen to like, how the courts dealt with [the Pelletier] matter," U.S. Attorney Bookbinder said at Gottesfeld's bond hearing.
It's unclear exactly how the government will proceed. Computer fraud cases almost always end with a plea deal, but Gottesfeld has insisted he won't take one. "I have committed no crime, so no negotiations and no pleas," he says.
Since he's been in jail, Gottesfeld's childhood stubbornness has reached new heights. In October, he began a 100-day hunger strike, subsisting only on Gatorade and chicken broth. The stunt ended in January, but not before it landed him in solitary confinement, with the state threatening to force-feed him if necessary.
Although they don't support the cyber-attack he is charged with, Gottesfeld's extended family members says they sympathize with his crusade and are certain his tactics were well-intentioned. Still, they remain in disbelief that the law could crack down so hard.
"I understand his frustrations, but I do think the government's response seems heavy-handed," says Ben Brown, Marty's biological cousin and adoptive nephew. "Twenty-five years is what you get for murdering someone. It just seems like this is a bit excessive."
As for the Pelletiers, the family has since filed a malpractice lawsuit against Boston Children's Hospital for violating their daughter's civil rights. BCH has denied any mistreatment of Justina, though many details of her care remain under wraps because of medical privacy laws and the pending legal case.
With no hopes of an immediate release, Gottesfeld has options that are about as limited as they were on the broken speedboat. He can plead guilty to a crime he does not believe he committed in exchange for a reduced sentence, or he can wait months for a trial and hope his federal public defender is up to the task.
"If it doesn't go as I expect, I am OK, but not thrilled, with the possibility I'll give my life for this cause. I'd be in great company with Aaron," he wrote in a recent letter.
Talk like that scares Dana — her husband's detention has been a crash course in exactly how inept the jail system is at treating inmates for depression or suicidal thoughts. Gottesfeld has told his wife of at least five suicides or suicide attempts in the two months since he was transferred from the New York prison to a county jail in Massachusetts.
Despite their separation, Dana says she has no plans to leave the marriage. To the young couple, the ordeal has been tough but worth it.
"If people knew about this case, I think a lot of them would say, 'I would have done the same thing.' It's come at a high cost," she says, "but at least we can sleep at night."
