In 2011, a group of young hackers, known in the hacking underworld as the Xbox Underground, infiltrated the networks of some of the gaming industry’s biggest names, including Epic Games and Microsoft. Their campaign of digital theft and fraud would eventually draw the attention of federal prosecutors and lead to arrests, a dramatic border-crossing attempt, and a tragic ending for one of its key members. Long before the Xbox 360 became the center of a federal case, David Pokora was a young programmer in the making. By the age of three, he was already mastering first-person shooter games on his parents’ computer, and his passion for programming only grew from there.
On a family trip to a village in Poland, without internet access, he learned Visual Basic, and by the time he returned, he was completely hooked on coding. When Pokora got his first Xbox, he spent countless hours playing Halo 3, his favorite game. But he soon became curious about how the console worked and found an online community of hackers who shared his interest. It was there he met Anthony Clark, an 18-year-old hacker, and the two began working on a program that would let Pokora modify the game, adding special skills to the main character.
With a development kit in hand, Pokora spent hours altering the game’s mechanics, turning blue skies to rain and adding digital landscapes. The hack that made the Xbox Underground notorious became known as JTAG, short for Joint Test Action Group, an industry body that had recommended adding certain connections to all printed circuit boards in the mid-1980s. When the vulnerability became widely known, Xbox 360 owners rushed to exploit it. Pokora and Clark offered their services, sometimes for $50 to $150, providing “infections” that allowed characters to keep special abilities even when playing unblocked games.
The motivation wasn’t always money. Pokora later said he was driven by the rush of making a $60 million blockbuster game behave the way he wanted, even though he knew his business was illegal and violated numerous copyrights. He interpreted the lack of action from game companies as a green light, but that would not hold up in court. In 2010, another hacker, 14-year-old Dylan Wheeler from Australia, obtained a list of passwords for Epic Games’ public forums.
He discovered the password for an Epic Games IT employee’s personal account, and soon he and David were inside the Epic network. Wheeler asked for David’s help in extracting Halo cards from the partially open partner internet network and breaking into the secure internal network that held sensitive company information. David, curious despite the clear illegality, agreed to help. One of the gang members, who went by the online name “pakora,” later in 2011 downloaded a copy of Gears of War 3 and a significant amount of confidential data about Epic Games’ upcoming projects.
He forwarded the game to their distributor, Justin May, who then sold it. The breach was serious enough that federal prosecutors launched a case against the gang in the wake of the Gears of War leak. The authorities had been tracking the group for a while. In February 2013, they raided Pokora’s house in Perth, Australia, seizing his computers and equipment.
The case relied heavily on an informant known only as “Person A,” who is widely believed to be a hacker named Justin May. At the time, May himself was on trial for allegedly robbing Cisco and Microsoft of equipment, and he remained silent when asked if he was an insider. David Wheeler, meanwhile, was arrested in Madison, Wisconsin, in March 2013, after moving there to escape the scrutiny following an earlier FBI raid. He was living what seemed like a new life as a programmer at a small game studio when the feds showed up.
He had been on the run, scared enough by the first raid to leave the Xbox hacking scene behind. At his court appearance, Wheeler faced charges of wire fraud, identity fraud, and conspiracy to commit theft of trade secrets. He was ordered to be detained pending trial, and while being transported, he made a desperate move. He paid a friend to drive him toward the Canadian border, but the trip failed when Canadian border officials stopped him.
Faced with capture, Wheeler pulled out a knife and stabbed himself several times, deciding that was his only way out. He survived and was taken to an Ontario hospital, where he was saved, then released and sent back to the United States. While in custody, Wheeler was sent to the Federal Detention Center in Philadelphia. He spent most of his time in the computer room, reading email and listening to MP3s.
But his time there was not peaceful. One day, while waiting for a console to open, a mentally unstable prisoner hit him in the face. Wheeler fought back to avoid looking weak, and the fight only ended when a security guard used pepper spray. After serving his prison sentence, Wheeler spent months in an immigration detention facility in New York and New Jersey, awaiting deportation to Canada.
During that time, he maintained that he had done nothing wrong. He argued that Electronic Arts’ terms of service stated that FIFA coins had no real value, so he felt his actions did not constitute fraud. His legal team also believed he had excellent grounds for appeal, arguing that prosecutors had failed to prove Electronic Arts had suffered actual harm. But Wheeler never got that chance.
On February 16, 2017, about a month before he was scheduled to be incarcerated, Wheeler died at his home. His relatives said his death was accidental, the result of a lethal interaction between alcohol and medications. He had just turned 27 and left an estate worth more than $4 million. David Pokora ultimately received a sentence of 18 months in prison, while others involved received similar or longer terms, with one accomplice getting 24 months.
When he was released, federal agents praised him, with one saying, “He’s a very talented guy who went down a bad path. Often when investigating these things, you can’t help but admire a certain level of brilliance and creativity. ”
The Xbox Underground’s story is not just one of hacks and heists. It is a cautionary tale about the fragility of digital security and the reckless ambition of young hackers who saw themselves as above the law.
Their exploits forced companies to upgrade their security, but they also left a trail of legal consequences and personal tragedy that none of them could have foreseen.