Ghost in the cell

In the summer of 2015, Stan Transkiy was 16 years into a life sentence, and he had finally found a way to occupy his time. Inside the Marion Correctional Institution, which sits on green farmland off a series of quiet roads in rural Ohio, he had carved out a job running a recycling program, a gig that earned him nicknames like “The Garbage Man.” It was an apt description: Transkiy, bald and bearded, sometimes worked 14 hours straight and sorted, by his estimate, tens of thousands of pounds of trash over the years. He did the job well, according to an inmate job evaluation, even if he sometimes took work problems too personally.

Marion was an improvement over Transkiy’s previous facility, Lebanon Correctional Institution. State inspectors had lauded Marion for “innovative thinking” that “infuses the environment.” In addition to the recycling initiative, the prison ran programs in education, aquatics, news, and gardening. It even hosted a TEDx event — part of a series of talks that, in 2013, drew Orange Is the New Black author Piper Kerman to speak alongside inmates and staff and eventually offer writing lessons in the facility.

One day in August, Transkiy heard a voice boom over the prison intercom asking for Randy Canterbury, an employee at an outside nonprofit called RET3 who oversaw the prison’s recycling initiative. One by one, Transkiy watched as men he worked closely with were called into mysterious interviews with prison and state authorities. Someone was looking into wrongdoing tied to the recycling program.

Soon, Transkiy himself was called into an office, where state investigators grilled him. Did he know Canterbury’s computer password? Did he understand how firewalls work? Would he take a polygraph? Staff threw him into a segregated section of the prison called O Block, and when he was called back to the office nine days later, a state trooper questioned him as a phone rang in the background. “Obviously, Stan, the whole computer situation, you’re aware of that,” the trooper said, according to a transcript of the conversation. “You’re aware they were found.”

Transkiy was being questioned about an extraordinary form of contraband. Someone had hidden refurbished computers in the ceiling of the prison. They’d somehow obtained a login to the prison’s network, gaining access to the inner workings of the facility, including databases on inmates and the tools for creating passes needed to enter restricted areas. The computers also granted access to the outside world, which someone had used to apply for credit cards using the stolen identity of a prisoner. The scheme extended from the prison, to a community nonprofit, to multiple banks — all done under the noses of an oblivious prison staff. When investigators laid out the contours of the plot, Transkiy said he couldn’t believe it. “This is... this is... this is bullshit basically,” he stammered out. “This is something, you know, that’s... that’s... that’s not real.”

When the results of the state’s investigation became public in April of this year, the state inspector general compared the incident to Hogan’s Heroes, with prison staff acting in the role of the incompetent, outmaneuvered overseers. While there’s an element of truth to the characterization, interviews with inmates, investigators, and staff, as well as written correspondence and thousands of pages of previously unpublished public records, also reveal a complex crime requiring considerable technical savvy. Together, they show how a progressive facility had difficulty implementing and securing technology that provided novel opportunities for learning, as well as mischief. “Our inmates are way smarter than our technical people, you know,” one investigator later said during an interrogation. “So we’ve got a huge problem there.”

Transkiy worked on the recycling program alongside two talented colleagues, Scott Spriggs and Adam Johnston, who’d spent time together inside Lebanon. Spriggs and Johnston were close friends. Spriggs explained that both were incarcerated at 18, in the early 2000s, and their crimes and sentences were similar: murder and related charges that meant a minimum of decades behind bars, perhaps their entire lives. Both showed a magnetic attraction to computers and shared a reserved demeanor, Spriggs told me. “Zen” was the word Transkiy used to describe Johnston. “Very few things bother him,” he said.

Johnston, a fit, light-haired man convicted of a brutal drug-linked murder, was an avid reader, and his personal tastes skewed toward genre. In an online pen pal profile, he wrote that he loved reading sci-fi and fantasy, especially Game of Thrones. He’d played the guitar for about 20 years, and developed an interest in astronomy and philosophy. He also stayed in contact with his mother, Karen Gallienne.

Gallienne lived two hours away, in a quiet neighborhood outside Dayton, and visited the prison regularly. By 2015, Johnston had been in prison for 15 years, but called home frequently, affectionately referring to his mother as “woman.” After she told Johnston over the phone how she had intervened in an episode of familial drama, he told her, “You done started a shit storm, woman, huh?” Other times, they’d reminisce: on one call, Gallienne recalled seeing fish tanks inmates kept at the prison, and watching one fish attempt an escape, leaping out of the tank and flopping on the floor helplessly.

Johnston and Spriggs both had prior technical experience from their time together at Lebanon. Spriggs went through a training course in C and C++. He also learned database creation and worked on manual data entry for clients like the AFL-CIO, who contracted with the prison through an outside company. With some of the other skills he learned in lockup, he built a program to clean up damaged sound files and, later, made an image-retrieval system for a Georgia sheriff’s office.

Johnston, Spriggs says, learned Visual Basic — something simple to start, although both seemed to quickly improve at their crafts. Spriggs eventually became the server and network administrator with a prison program, and helped build new computers for the IT department, which gave him a mastery over hardware as well. According to one inmate’s statement, the two also had a side business, burning and selling mysteriously purloined CDs with video games or porn. (Spriggs denies this, and Johnston didn’t respond to letters.) When the two weren’t programming, they would cook or work out together. “Both of us were looking to learn whatever we could that would help us if we were ever to go home,” Spriggs told me.

Prison authorities are, at best, ambivalent about inmates’ access to technology, but facilities are now experimenting with computer education programs and even limited internet access. In recent years, there’s been a sea change in approaches, according to a 2015 Department of Education report, which highlighted Ohio’s particularly forward-looking policy. Corrections departments are finally seeing how computers are vital tools for education, and increasingly essential for inmates hoping to make a clean return to society, although concerns about security persist.

Marion’s Green Initiative, which encompassed programs like gardening and aquaculture, looked like a shining example of a progressive prison curriculum. Transkiy ran recycling, Johnston was treasurer, and Spriggs worked on IT.

“This prison isn’t like what you see on TV or in the movies,” the warden, a former social worker, said onstage at the 2012 TEDx event, casually dressed in shorts and a green polo. “Its staff are different. Its men in blue are different.” He said that he joined Marion to make it “cutting-edge.” If the higher-ups didn’t like it, he reasoned, they could fire him. The prison had recently completed 509,000 hours of community service in a year.

The facility partnered with nonprofits like RET3, which worked with inmates to pull apart old computers, then organize and send back the sorted pieces. Inmates in the program were also instructed to look for high-end, salvageable machines that could be reused inside Marion. Sometimes, though, electronics were used for unsanctioned purposes. Spriggs and Transkiy say SD cards loaded with porn were somehow smuggled in so the explicit videos could be secretly played on a Nintendo Wii. Inmates had thumb drives loaded with porn and entertainment like newly released movies, and rented out access to the files. At one point, as a former staff member at the facility remembered it, inmates set up a showing of The Fast and the Furious — not an older entry in the series, but one that had just been released in theaters.

It’s not uncommon for a prison to have its own black market micro-economy, even if Marion’s seemed especially vibrant. But the desktops stashed in the ceiling were an order of magnitude above thumb drives and CDs, as investigators were soon to discover.

On July 3rd, 2015, the corrections department’s newly installed electronic security system sent out an alert to the support team. A computer using the login “canterburyrl” — the login for RET3’s Randy Canterbury — was exceeding its usage limits. Over the next few days, the situation became more concerning. “On Friday afternoon I received 7 hacking alerts for the user (canterburyrl) as well as 59 proxy avoidance alerts,” an IT staff member wrote in an email to the department’s CIO on July 6th. The user had spent hours going through flagged sites, like file-sharing services, and attempted to avoid detection through proxies.

The exact location of the user was a mystery, though, and so was the operator. Canterbury, who declined to comment for this story, wasn’t difficult to eliminate as a suspect; he didn’t even work on Fridays, when the first alert came in. But it was hard to go much further until the state IT team, remotely assisting since the first security alert, came up with a name attached to the PC, which included the sequence “lab9.”

When the computer name came in, Gene Brady, who worked in IT at Marion, immediately knew where to go. “There’s only one place in the institution I have PCs named in that fashion, and that is in the staff computer lab on the third floor,” he told investigators. But there were only six computers up there, not nine, like the naming convention suggested.

The third floor area known as P3 had a reputation at Marion. Some called it “the ivory tower,” which could have alluded to its status as a place for training, or the fact that it was sequestered. One black inmate told investigators that the real reason it earned that name was because “that’s all that was up there was the good-ol’ boys, or all of the white guys.”

But Brady couldn’t track down exactly where the offending computer was. Finally, the state IT team determined the switch and port the computer was plugged into. To find the offending machine, Brady took an analog approach: following wires.

“We had pulled the cable and we started tracing the cable through the ceiling,” an inmate who had been recruited for the job told investigators. The network hub was a mass of wires — blue, orange, green — organized without any obvious reason. Brady traced one line to a part of the ceiling above a small training room closet. He pulled in a ladder and removed a tile from the drop ceiling. Inside, there was a Dell computer tower. Then he uncovered another.

Brady alerted the staff, and a lieutenant squeezed into the cramped space, snapping photos to document what they’d found. A couple of inmates pulled down the computers, and carted them away. Brady later told investigators that he didn’t realize just how troubling the discovery was. “It didn’t click for me that, oops, this might be a crime scene until after we had found everything,” he said. “And a couple days later, I went, ‘Ah, shit.’”

Staff spent the next few days going back and forth over what to do. An IT employee flagged the identification placards attached to the ceiling computers. One was from a local school district; another came from a company in the area.

It wasn’t until August 7th when the corrections department’s chief counsel, a man named Stephen Gray, was informed of the discovery. “When I found out about it, I said, ‘You know, there could have been some illegal activity associated with this ‘cause we don’t know what the inmates were doing,’” he said later. He drafted a notice to state investigators.

“You’ve got to be kidding me,” the state inspector general, Randall J. Meyer, remembers thinking when he read the note. Meyer was familiar with Marion Correctional. In 2014, the facility was at the center of a bizarre financial aid fraud scheme, in which someone had stolen inmates’ identities. Meyer appointed a field investigator, who worked on the case with the state’s highway patrol.  

A forensics team moved in to examine hardware in the facility. With a compromised network, the crime scene was huge. Investigators eventually seized hundreds of hard drives from Marion in the arduous process of documenting the prison’s computers. According to an email summary of one day’s work, they got through more than 50 before stopping at midnight.

Meanwhile, investigators spent weeks interviewing anyone who might have information about the computers, questioning everyone from inmates to the warden about where the computers came from, and who may have hidden them in the ceiling. If the investigation was proper in scope, however, there was sloppiness in its execution. Officials placed inmates under suspicion in segregation, but failed to segregate them from each other; Transkiy says he shared a cell with Johnston. In its publicly released summary, the investigators said they sent the inmates to new facilities when it “became apparent” they could still coordinate answers to interrogation questions. At one point, the team sealed off areas in the prison that may have held evidence, and informed the warden that they were not to be entered. A prison official went into the space anyway; the warden said they needed some files.

It was the forensics team that uncovered the most important clue. The computers hidden in the ceiling had everything an aspiring hacker could need: encryption tools, a version of the Tor browser, even tools for email spamming and password-cracking. But one program was paydirt: a desktop-to-text-message service.

The texting service revealed conversations between Adam Johnston and Karen Gallienne. In one text, Gallienne sent Johnston an address, which Johnston told her “sounds really close to your house.” The forensics team also discovered the applications to banks for credit cards under the name Kyle Patrick, a prisoner in the Ohio system.  

Investigators turned to recordings of calls that Johnston had made to Gallienne from the prison. Combined with the contents of the computers, they painted a damning picture. On one call, Gallienne explained that she’d received a credit card rejection letter from Chase, as the applicant didn’t have an established credit history. “All right. I figured,” Johnston told her. “I’m figuring it out. Slowly but surely.” Later, a card for Kyle Patrick arrived, and Gallienne read off the numbers to her son.  

On a cool November day, four months after the discovery of the computers, investigators made their way to Gallienne’s home. State highway patrol officers searched the house, grabbing electronics and uncovering the credit card for Kyle Patrick. Then they sat down with Gallienne and Johnston’s brother, Jason. A highway patrol trooper led the questioning, and didn’t play coy about Johnston. “Obviously, through the course of our investigation it was found that you’ve been involved in aiding him with identify theft,” he said to Gallienne. “Were you aware of that?”

She denied it, saying Johnston had only sent the credit card “to try to help me.” He “sells stuff in there ‘cause he has equipment, guitars, just stuff like that,” she said. The card was only a way to send her some of that money.

All of that was “fine and dandy,” the trooper told her, but what about the name on the card, Kyle Patrick? “Why wouldn’t he put that card in your name?” he asked.

“Because he said that it would be bad to put it in my name.”

“And why would that be?”

Gallienne paused.

She explained that Johnston wouldn’t go into the detail, but she admitted to giving him the name and address of a neighbor, who wasn’t involved except as a place to deliver the mail. When the credit card came, she got it through him. All her son told her was “‘Don’t worry about it,’” she told the investigators. “That’s all he ever said. What am I supposed to do when he texts me? Just say don’t text me again? I mean, this is my son.”

As the interrogation went on, the investigators pushed harder. “What’s the worst thing you’ve ever been in trouble for?” the trooper asked.

“Nothing,” Gallienne said. “I’ve never been in trouble.”

“No speeding tickets?”

“Not since I was 16.”

“You know what identity theft and fraud is?”

“Yes, I do.”

“Especially when it involves financial institutions?”

“Yes, I do. I’m sure it’s really bad.”

“And what is that? Would you say felony level?”

“Probably.”

“Okay. He’s already doing life.”

“I know.”

“You think you could do 18 months at Marysville?”

“Me? No.”

“You’re how old?”

“54.”

“Be kind of hard to do 18 months at 54 years old,” the trooper said. “Don’t you think?”

Investigators moved to interview Johnston, who, in the meantime, had been moved two hours northeast to Grafton Correctional Institution, another facility in the Ohio prison system. But he was reluctant to talk. Before he would explain what happened, he said, he wanted “some assurances” about his mother.

The investigators said they couldn’t do it; he had involved her in felonies. When Johnston kept asking why he should cooperate, an investigator invoked his betrayal of Gallienne. “She couldn’t believe,” he said about Johnston’s mother. “She kept on saying, ‘He would never put me in harm’s way or in danger.’ I’m like, ‘We’re sitting right here, Karen.’ I said, ‘Obviously he did. He doesn’t care enough not to put you in harm’s way or in danger.’” He said Johnston’s brother — “the one you bad-mouth on the phone all the time,” the “piece of shit that you talk about and trash” — sat there stunned, but “at least he has enough sense not to get your mom involved in shit.”  

The state IT official in charge of monitoring the corrections department’s network was present at the interrogation, and he told Johnston that admitting to the crime would bode well for Gallienne. “It’s kinda like a fish fry,” he said. “You know, you get a lot of fish, you’re full, you don’t eat all the other fish. Fill the prosecutor’s belly up with some fish.”

Johnston eventually relented and admitted to the deed, though his confession sounded incomplete. When investigators asked whether he had acted alone — and told him they had information from a confidential informant that he hadn’t — Johnston asked whether they had a confession or evidence from the alleged accomplice. When they said no, he told them, “I put them up there then,” referring to the computers in the ceiling.

The scheme Johnston sketched out showed resourcefulness. He had swiped some refurbished computers from RET3 that Spriggs had built for use inside the prison. When Canterbury left the P3 area unsupervised, Johnston brought them in and hooked them up in the ceiling for remote access. He said he “shoulder surfed” Canterbury’s password, casually leaning in while he was typing and memorizing the characters. (Meyer says he believes Canterbury may have handed over the password, but no proof of that materialized.)

With remote access, Johnston could access the prison staff network from a nearby office, where he was already allowed. No one on staff walking by would blink if they saw him working there. He said he stole the personal inmate information from an internal system called DOTS. That information was redacted, but Johnston simply viewed the code on the page.

How was Johnston able to move a computer from the RET3 area to P3?

“In a cart,” he told investigators.

One of his gigs in prison involved carting around hygiene products to hand out to inmates in the recycling area. To get to P3, he had to get through a “crash gate” — a guarded area that included a metal detector. He told investigators that he stuffed the computers in a box with hygiene products — “it looked pretty legit,” he said — and was waved by. Transkiy, Johnston said, was totally unaware. When investigators asked about whether Spriggs was involved, he said they’d have to ask him. Spriggs denied any involvement. He was described as complicit in the state’s final report, but the inspector general’s office later told me he was only linked to building the computers, and Spriggs says he wasn’t aware of what they were used for.

The fraud was only one part of the scheme. Johnston admitted to using password recovery software to steal other administrative network logins (he denied using them), and was even printing his own forged passes for access around the facility. He claimed that he only used those to speed up the process for legitimate work. An inmate caught up in the investigation was found in possession of a thumb drive loaded with porn, which Johnston admitted to downloading. The setup was partly to blame for the pirated films and porn readily available in the prison. But Johnston was more ambitious: he said he was planning on filing some fraudulent tax returns to get some money, but it never got that far. He was “no expert,” he said.

“Oh, but you’re so smart,” one of the investigators told him. “You are smart. I know you’re smart.”

“If I was smart I wouldn’t be here talking to you guys right now,” Johnston replied.

In August, I visited state inspector general Meyer at his office, in a high-rise across the street from the Columbus statehouse building. The afternoon I arrived, the small office was almost empty.

Meyer has the square jaw and buzzed hair that, if you were to catch on a cable TV roundtable, would suggest law enforcement before he said anything. He drew me to a window and we looked down at the statehouse building, its round top illuminated in the sun. Meyer told me he sometimes hosts foreign visitors, and when he explains his job he jokes how it involves “literal oversight” of the government. “I’ve never stopped being surprised,” he told me, but he admitted this case — and the media reaction to it — was “very unique.” Meyer questioned whether inmates with life sentences should have access to reintegration training programs. If they weren’t ultimately contributing to the outside economy, what was the point?

The fallout from the crime began almost immediately. Before the investigators’ report on the computers was released, many staff members involved either retired or resigned from their posts. The warden moved out of corrections and to a program for the developmentally disabled. Canterbury now works at a county recycling program in the state. The results of the report could still lead to criminal charges, most likely for Johnston, and perhaps Gallienne. Meyer told me charges were being considered based on allegedly neglectful conduct by employees like the warden, but that they seem unlikely to stick. Two of the inmates I spoke with emailed me with an update in September. They’d heard someone else had been caught at Marion with illicit USB drives, possibly with hacking tools loaded on to them. (The prison did not respond to a request for comment.)

Johnston, Spriggs, and Transkiy were “rode out,” as it’s called, to other facilities. For Transkiy, it was clear that being separated from Marion’s programs was a momentous loss. When he was first incarcerated, he says, he was involved in drugs and running with the wrong crowd. He declined to talk about the details, but reportedly killed the owner of a computer company where he worked, part of a bizarre series of crimes in the local industry. After a decade in prison, his security level was lowered, and he was sent to Marion.

“When I arrived at the MCI, there were very few meaningful jobs available to someone with a lot of time,” he wrote me. For six months, he walked the track at the prison, before starting work on the fledgling recycling program. He took pride in some of the local media coverage it eventually garnered.

Transkiy says he didn’t know anything about the ceiling computers, though he’d had suspicions something was afoot; there were red flags like “long work hours by lazy people.” He says he passed a polygraph and no evidence linked him to the con. Regardless, he hasn’t fared well. The investigators found that he had used Canterbury’s computer, a violation of the rules, even though Transkiy says it was little more than sometimes using the mouse, and always supervised.

Before the programs at Marion started, there was nothing like them in the system, Transkiy says. “Therefore, there were simply no policies or protocols to accommodate all our needs and to address all issues and concerns,” he wrote me. “What I am trying to say, is that it is important to understand that MCI Green Initiative just grew too fast for security to properly address all the issues.” And maybe the whole thing was simply an unfortunate consequence of being on the vanguard of education. Michelle Tolbert, a researcher and author of the Department of Education report on electronics in prisons, suggested to me that there are bound to be speed bumps “when you’re on the forefront of anything.”

In a letter that Transkiy shared with me, Johnston apologized for the mess he’d made. “I know I ruined your life man,” he wrote to Transkiy. "I’m sorry. I’ll make it up to you someday.”

Later in the letter, Johnston’s mind turned to the future. Transkiy, he suggested, should try to get to Grafton Correctional when his security level was lowered again. Like Marion, he wrote, it has some great programs.