Mohamad, my hacker, had an air of desperation about him. When he got emails in English announcing that he was a lottery winner, or promising him access to a fat bank account, he asked me to translate them word for word.
“!!!پول !!!پول” he’d write. “Money!!! Money!!!” He needed money to take care of his mom.
Negar Mottahedeh is a cultural critic and film theorist specializing in interdisciplinary and feminist contributions to the fields of Middle Eastern Studies and Film Studies.
Sign up to get Backchannel’s weekly newsletter.
I insisted that the emails were a waste of time. He wanted the words anyway. The government of Iran knew he was a hacker, he complained, and had frozen his bank account. He’d gotten a tattoo and now couldn’t land a government job. Iran didn’t get startup culture. His father tormented him. He felt trapped. Now he had me, a contact in the United States, and he saw a path out of Iran and into a new life.
I met Mohamad four months ago when I discovered that my Instagram account had been hacked. I was early to Instagram, a feat that allowed me to nab the handle for my popular first name: @negar. I’d become attached to my account. But in mid April I’d opened up the app and noticed that my username had changed. I wasn’t @negar anymore: I was @negar76795, with all my personal information and 6,300 followers. At first I assumed it must be some routine maintenance. But I noticed that no one else had a modified handle. I reported the incident to Instagram but heard nothing back.
My old handle, @negar, now had no posts, but it did have a link to another Instagram account with the name of a famous Iranian hacker who was wanted by the FBI. The posts on that account were filled with angry comments from people complaining about getting hacked.
I was nervous about contacting him—but I was more annoyed about my loss. So I sent a direct message to the account. No reply. Feeling emboldened and increasingly pissed off, I went back to my stolen account and DMed it, accusing its possessor of theft.
Minutes later, I got a response: A single heart emoji.
The heart emoji struck me as perverse. But it also showed me that I was dealing with a person who was willing to connect. So I wrote again and demanded my handle back.
That’s when Negar introduced herself. She said she was my hacker’s girlfriend, and my handle was his gift to her. The hacker had plucked my name out of Instagram like a wildflower—a simple romantic gesture.
This wasn’t the first time I’d received contact from strangers in my home country. I left Iran when I was seven years old; my parents lifted our family to Norway, making the possibility of returning to the country of my birth after the 1979 revolution risky, if not impossible.
Now, as a professor who lives in New York, I receive emails all the time from students in Iran. I rarely know how to respond. Usually, they’re looking for help, and I know I can’t do much to help them. So I leave the letters unanswered. But this time, I, too, needed something from the person on the other side of the screen.
Negar asked me where I lived; I told her that I lived in New York. She asked questions in broken English; I told her to write in Persian. My father had taught me how to read and write—I knew her language. She told me she had no idea the handle had been stolen.
“Forgive me,” she wrote in Persian, “My boyfriend will kill me if I give it to you. He could make a lot of money here if he sold it.”
I wasn’t ready to forgive anything, really, but that afternoon I found myself thinking of her. She was an inquisitive girl, curious and compassionate. It struck me that she was who I might have been had my family stayed in Iran—curious about the world, but lacking opportunities to explore it.
As I headed to the subway, I wondered what she would think of New York and thought how much she might like to see the city. I sent her a short video of the musician who was strumming his guitar, leaning on the subway door that was across from me.
She laughed. “Thank you! You’re so kind.”
Then a moment later… “Do you have an orange top on?”
I did. She must have caught my reflection in the window behind the performer. I was surprised she was paying such close attention. That’s what I’d do, too: Look for those odd, peripheral details.
After about a day of messaging back and forth, Negar offered to sell my handle back to me. It would cost $1,600—a discounted rate, she said, given the value of my five-letter handle and the popularity of our shared name.
“$1,600? You’re pulling my leg, right?” I messaged back. She seemed nice enough, but I recoiled at the idea of rewarding her boyfriend for his theft.
There was another option. Maybe, she asked, I could procure a “Blue Tick” for the hacker in exchange for my handle. I was puzzled, so she pulled up Emma Watson’s account and Zara’s official page, and sent me a screenshot in which she had circled the blue “verified badge” with its tiny checkmark beside their handles. “A Blue Tick!”
“Oh,” I said, “I have one of those on Twitter.” I hesitated to say more, afraid that her boyfriend would go after me on Twitter, too. I scurried around the web for any information on acquiring Blue Ticks. “The Blue Tick is difficult to get for Instagram,” I wrote back.
She suggested that if I could get it for celebrities, instead, she could line up a few clients to pay her while I did the legwork. I didn’t see any easier options for getting @negar back, so I said I’d do it.
Then the tone shifted. The hacker wanted to talk to me directly about getting Blue Ticks. But he wanted to talk over Telegram.
In Iran, Instagram and Telegram are the only social platforms where you can evade government censorship. Telegram doesn’t provide you with video messaging and calls like Skype and Whatsapp, but it does let you exchange text and voice messages. I was cautious in response. I worried that by switching to Telegram, a platform I barely knew, he was leading me into some kind of trap.
The first time we talked, he sent me a voice message. His voice was surprisingly low and monotone. He was polite, weighing every word. He identified himself as Admin 1, using the English word, “Admin,” as if it meant something very important, like “VIP.” His real name was Mohamad.
Mohamad himself told me he was studying software at a university. He wanted to know if, as a professor, I could find a way for him to leave Iran and come to the US. His prospects weren’t good on the free market in Iran.
“You know I have accounts with over one million followers. If you help me come to the States, I’ll help you build an Instagram page with over a million followers too,” he told me.
“Well,” he hesitated, holding back a giggle, “I’ll come, but on one condition. That you don’t strangle me with your own hands,” he said adding a laughing emoji.
I knew we were going to get along.
“OK,” I wrote him back in English, with a laughing emoji. We’d established rapport.
Mohamad described his mother’s Persian stews, served with saffroned long grain rice. He sounded happiest when he was with her by the Caspian Sea, as opposed to when he was in Tehran for school, living with his father, the wife beater.
I started searching Reddit for any clues about how to get a Blue Tick. I soon found a thread in the r/Instagram/ subreddit in which people had been tagging a guy named “Chris” for months. Chris was a former Facebook contractor who seemed to know how to reach people at Instagram to resolve issues with hacked accounts.
It was Friday, and Chris told me it would take about four business days to recover my hacked account and process my request for a blue tick. I DMed @negar and asked for details on the hacker’s celebrity clients—their pages, Wikipedia entries, and so on.
Negar was well prepared. She lined up details on Mohamad’s three celebrity clients. She also sent along the hacker’s own details. Curious, I looked up Mohamad’s page on Instagram. He had 448,000 followers and a whole slew of attributes to go with his handle:
“Hack and Security”
… in that order.
There was little else on his page: no pictures of himself; no banter with friends in the comments. Nothing to give me a sense of who he was.
How good of a hacker was he, really? Who were his friends? What sorts of things did he enjoy? What were he and Negar like when they were together? Not knowing him unsettled me. So I was determined to find out.
Mohamad was curious about me, too. It was odd, considering that I was much older than him. It felt like he wanted a trusted friend—someone he could use as a sounding board. He chose me.
He needed money, but more than that, he wanted to find a way out of Iran. He asked me about student visas, tourist visas, work visas; he’d send me links or screenshots with sections circled in red ink, asking me to read through them for him. He discussed his marriage options. Could he find an American girl to marry so he could stay in the US after he got there? Or could I maybe adopt him?
Those were his more optimistic days. But life was hard for a young hacker.
In late April, one of Mohamad’s many Instagram accounts was hacked. His 500,000 followers now belonged to another hacker who used the account to advertise sports cars. Mohamad asked me to draft a report to an Instagram “Admin” on his behalf.
“Write in Latin,” he’d say. I guess he meant English, as opposed to Persian script. His English wasn’t strong enough to write hacking complaints to Instagram.
He promised me that he’d give me my handle as long as I helped him escape the misery that his life had become.
He stayed up on his more gloomy nights, usually while he was alone at home at his dad’s telling me about his parents’ divorce and his new, malicious stepmom. It was late in New York, and even later in Iran, but on those nights, I stayed up too. Worried.
He told me about his poverty-stricken mother, and his dad who would come home while Mohamad was talking to me and beat his hands and feet so badly he’d need to go to the hospital for treatments. He sent me pictures of his bloodshot eye after one of his dad’s attacks. One night, he wrote to say that he was heading to the hospital. Later, he sent me a picture of the IV over his hospital bed.
I’d listen, help with the translations, and console him over the situation with his parents. The vivid sense of anguish in his voice when he messaged wouldn’t let me just ignore the pain he was suffering, nor could I disregard the fact there were over 35 years of US-led sanctions that had conditioned the hardships he was now experiencing. These were realities I was lucky enough to have escaped, having left Iran before the 1979 Revolution.
So it wasn’t until he deactivated my account that we had a falling out.
He prepared me for the deactivation a couple of days before he actually did it. He kept telling me it was no longer safe for him to keep the @negar account active. Other hackers were constantly trying to hack into the account and take the handle from him. He couldn’t protect it from them anymore, and his only solution was to deactivate it.
“Negar, be reasonable! If I don’t protect your handle it’ll get hacked and you won’t ever get it back. I’ll give it back to you when I see you. Give me 40 days to get over there. I’ll secure the handle and give it back to you. What do you say? Talk to me! Are we friends? Answer me!”
I only half believed him.
As long as I could see the @negar page, I could make sure that it was still under his control. I could also DM his girlfriend, and I liked that as a safety net. But with @negar deactivated, there was nothing to prove my hacker hadn’t sold the handle off to the highest bidder.
We quarreled. I would refuse to answer. I’d demand proof that he hadn’t sold my handle. He’d offer to reactivate it just to prove he wasn’t lying. He wanted to explain things; he wanted to reason with me. I’d tell him I was sleeping. I’d send him sleeping cat emojis.
Then late one night—his night—I heard something different in the background when he messaged me. There wasn’t the usual sound of conversation between his sister Sara and their mom. There was hip hop playing. It was loud and I loved it.
“That’s my friend Sadegh,” Mohamad told me. “He is here tonight. We’re playing football on my laptop.” He sent me a picture of his open laptop resting on the Persian rug on his living room floor. “Do you want him to freestyle for you?”
“Yes,” I typed.
I was being coy.
“OMG!” I thought to myself, “Totally!”
Mohamad sent me a file of the song that was playing in the background. Then Sadegh himself came on and freestyled in Persian.
That was it. My hacker had me back.
“You’re just like me. You love music. I couldn’t live without these words,” he said.
I sent Mohamad some songs of my own—old Persian pop he likely hadn’t heard before. It was from before his time, produced in Tehrangeles in the 1980s when Persians had populated Los Angeles and Iran had gone into isolation following the American hostage crisis. I also sent him 1980s American pop. His six-year-old sister really loved the American songs.
I got my handle back on the day the President of the United States came to visit New York.
There were six protests going on around the city. I was streaming the protests to Periscope and taking pictures to send them to Mohamad, along with sound bites of voices chanting and people banging pots and pans. I hoped it would distract him from what was happening at Facebook headquarters in California.
Knowing how devastated I was about my hacked account, a journalist friend had sent me a video of a minor YouTube celebrity’s own adventures chasing down a three-letter handle. In it, he described how a guy named Jay, at Facebook, had managed to retrieve the handle for him within a couple of hours.
I had to find Jay. I looked all over Twitter. Then I checked Linkedin, where I discovered that my friend Karen and Jay were connected.
Karen was the first girl I met when I came to the US for college in the late 1980s. We became fast friends back then. And she was the one who ultimately introduced me to my new superhero, Jay. Jay had joined a professional development program for young adults called “Year Up.” There, he met a bunch of people, including my friend Karen, with backgrounds that were different than his. He got his first Facebook internship through the program, and later landed a job as a VIP Ops Technician at Facebook.
There was nothing like the “Year Up” program in Iran to give Mohamad a leg up. And as he mentioned when I asked him about starting his own tech business in Iran, “Iranians don’t understand tech startups.” He’d have a tough time finding a sponsor.
I emailed Jay three “PASSWORD RESET” emails that had, by some force of miracle, not been deleted from my email system years ago. They were my only proof that the @negar handle had been on my Instagram account forever. Jay asked me to create a new email address that had never been associated with Instagram at all…and BOOM! There was @negar, liberated from my Instagram hacker’s claws.
My hacker, Mohamad, was the first to congratulate me on its return.
He felt sad, of course. “There’s no way you’re going to help me now that you have your handle back,” he wrote to me later. “You’re the best friend I’ve ever had. But you’re going to disappear now that you have what you want.”
I wasn’t so sure. I worried about the terrifying life my hacker lived, split between his dad’s world and his mom’s. I worried about his possibilities and the kind of future he would have in Iran. He had so many dreams, so much talent, and such drive. From where I stood, he was playing a pretty risky hand.
But by robbing me of my online identity, my hacker had unshuttered a window to life in the country of my birth. While I had been barred from my home as a young child, my new setting was chock-full of luck. With my Instagram hacker in my life, my fortuitous situation stared me in the face. Looking at myself through his eyes, my life was abundant. I felt fortunate. I wasn’t about to give up the friendship I had forged with my hacker for anything.