It was easy to file away Kim Anh Vo as a textbook teenager.
A high school student in Hephzibah, Ga., located 20 minutes southwest of Augusta, she had long black hair that draped down her back before ending in dyed blond strands. She brought home As and Bs to her mother and father, and each night the family’s oldest child slept in a bed piled with stuffed animals. Computers were her only hobby, her parents recently told the Augusta Chronicle.
“She a good girl,” her father, Long Vo, told the newspaper.
But Kim Anh Vo allegedly used her Internet connection to move through some of the Web’s darkest provinces, where she had an identity that harshly contrasted with her Georgia childhood.
“LOL,” Vo wrote in an online group chat on April 5, 2016, when she was still in high school. “I am Isis.”
On Tuesday, the Justice Department announced that Vo, now 20, has been arrested and charged with conspiring to provide material support to the Islamic State. She was arrested in Georgia and will face her charges in New York City. If convicted, she could face a maximum sentence of 20 years in prison.
According to a recently unsealed federal indictment, Vo was allegedly a member of the United Cyber Caliphate, a hacker group pledged to the Islamic State. Vo and others are accused of leveraging 21st century tech in the service of the extremist group’s global aims. Prosecutors say they flooded social media with violent propaganda memes, hacked the personal information of thousands of Americans to create “kill lists,” and communicated and recruited on encrypted messaging services.
But Vo apparently was eventually compelled — whether by conscience or other circumstances — to stop her online activities. Court documents indicated Vo herself approached federal authorities in July 2017 and offered to tell them about her time behind the keyboard for the Islamic State.
“She said it was a long time ago,” her father said to the Chronicle regarding the activity in which his daughter is now accused of engaging.
In addition to tracking Vo’s own time working in the digital trenches of global terrorism, the indictment also offers a surprising snapshot of the Islamic State’s online “e-jihad” operation.
When the Islamic State splashed into the geopolitical scene in 2014 with the militant group’s capture of Iraqi territory, the organization distinguished itself with its advanced sense of social media and propaganda.
But as the Vo indictment outlines, the Islamic State also used the Internet for various aspects of their mission, from setting up websites with battlefield updates for followers, to tips on how extremists could communicate online without popping up on the radar of law enforcement.
By 2014, the Islamic State had also gotten into hacking with a branch called the Islamic State Hacking Division, according to the indictment. Run by a British-born Pakistani named Junaid Hussain, the group was able to creep into sensitive databases and steal the personal information of 1,351 U.S. service members and government employees.
Hussain was killed August 2015 by a targeted U.S. airstrike in Raqqa, Syria. In response, his hacking collective re-branded as the Islamic Cyber Army, and the new group announced on Twitter it was calling for “all supporters hackers [sic] to join us and work with us to target Crusader alliance.”
By April 2016, this group announced that a number of different Islamic State-supported hacking groups would pull together under the same umbrella — the United Cyber Caliphate (UCC). According to the indictment, the new consolidations included hacking groups called the Ghost Caliphate Section, Sons Caliphate Army and the Kalachnikv E-Security Team.
Vo — who went online by a number of handles including “F@ng,” “Zozo,” “Miss. Bones,” and “Kitty Lee” — was allegedly a member of the Kalachnikv E-Security Team. The indictment does not say how she originally became involved in e-jihad.
“I didn’t retire LOL,” she allegedly messaged to other Islamic State hackers in November 2016 in a discussion of the new UCC organization. “F@ng lives on. But I will take a new name . . . but it’ll be something similar. Just so I can bring on a more mass destruction.”
According to the indictment, Vo’s “duties included, among other things, recruiting others to join the group and editing and translating messages that the UCC disseminated online.”
The indictment also alleges, “Although Vo worked principally as a recruiter for the UCC, she also helped the group’s hacking efforts. In particular, when the UCC decided to hack a particular website, Vo would communicate that to one of the group’s hackers . . . After . . . [they] completed the mission, Vo would then report that face to one of the UCC leaders . . . who would publicize the cyber attack.”
In early 2017, Vo allegedly recruited a 14-year-old male from Norway to work with the UCC.
“[L]OL dude you look normal as hell,” she wrote to the teen in an online conversation, according to the criminal complaint. “I wouldn’t expect you to support dawlah,” she said, using a variation of an Arabic word for “state.”
“But here I am,” the 14-year-old replied, adding a grinning squinting face emoji to the message.
The federal complaint alleges that Vo invited the teenager from Norway into the UCC. “You can join the media division in UCC and the hacking side,” she wrote on Feb. 5, 2017.
She later then opened a group chat between herself, the 14-year-old and another UCC hacker.
“Ok,” Vo wrote in the group chat and using the n-word, “we here.”
“UCC HOOD AGAIN OR WHAT,” the UCC hacker chimed in.
“Yeah we hood . . . in UCC,” Vo allegedly replied, the indictment said. “Yeah boss.”
“SO WHAT CAN HE MAKE FOR US?” the UCC hacker asked about the teenager from Norway. According to the complaint, the Norwegian minor eventually created a video calling on supporters to attack employees of an unnamed New York nonprofit that had released information on the Islamic State’s hacking efforts.
The complaint also alleges that Vo was involved in the April 2017 release of a “kill list” of more than 8,000 names, including thousands of American citizens. Islamic State propaganda called on supporters to murder the people on the list in “lone wolf” attacks. The information was hacked from an American business, the FBI later determined.
Three months after the release of the kill list, Vo contacted the FBI and voluntarily shared information on her hacking activities. On Tuesday afternoon, Vo appeared briefly in a U.S. District Court in Augusta.
She is being transported to New York City, where she will be prosecuted in the Southern District of New York. It is unclear whether she has an attorney.