Just google “Hamed Al-Khabaz Dawson College” for one of the most controversial tech stories to come out of Montreal this decade.

It was late January 2013 when Al-Khabaz, now 23, finally decided to go the press.

As a student at Montreal’s Dawson College CEGEP school, he cleverly gained access to the college’s online administration system, then provided by a company called Skytech. Hoping to develop a mobile app for students, Al-Khabaz told school administrators how easily he could access the personal information of 250,000 Dawson College students, like SIN numbers, credit card numbers, purchase receipts and more. He called it “sloppy coding,” hoping to help the school create a more secure portal.

Let’s just say it didn’t go over too well.

Skytech’s CEO Edouard Taza accused him of a “cyber attack,” and the college expelled him for a “serious professional conduct issue.” The National Post dropped a juicy story that exploded all over media outlets from coast-to-coast.

Al-Khabaz was a 20-year-old, shaggy-haired Canadian news sensation.

Six months after that, I reported for the Financial Post that Al-Khabaz had moved on from the incident, founding his own startup that would aggregate peer-to-peer travel accommodations. Local investors were impressed. The venture, called Outpost Travel, ultimately landed $200,000 in venture capital.

Today Al-Khabaz skypes us from Boulder, Colorado where he and cofounder Andrew Lockhead work out of the notable TravelPort Labs Accelerator program, run by Techstars alum. Together Al-Khabaz and Lockhead cofounded stay22, which is improving in all the areas Al-Khabaz failed with Outpost Travel.

While Outpost Travel tried to aggregate vacation rentals like Airbnb, taking a small cut off transactions, stay22 offers a platform where people can search for places to stay close to events they attend. They’ve already worked with large Montreal events like C2 MTL and Startupfest.

TravelPort, meanwhile, might be the best thing that’s happened to them. The publicly-traded giant is a commerce platform that acts as a sort of “backbone” for travel purchases made online. They provide about $33,000 in seed money for the young companies like stay22 at the accelerator.

“We get the same mentors from Techstars and the same network. Without this accelerator we wouldn’t be where we would be today, which is amazing. We’re in a very strong position,” said Al-Khabaz.

So how did this self-described hacker kid, once described as a “cyber threat,” go from a CEGEP-expellee to hotshot startup founder? Not to mention being invited to work out of Boulder, one of the United States’ nests for emerging tech talent.

Let’s start with his parents, a pair of Shia Muslims who fled Iraq in the early 1990s. Al-Khabaz’s dad was educated in the United States as a doctor at Indiana State University. He returned to Iraq only to be imprisoned for seven years based on, according to Hamed, his religious beliefs. Today we know that Saddam Hussein’s regime brought about the deaths of at least 250,000 Iraqis and committed war crimes in Iran, Kuwait (both of which places Al-Khabaz had family) and Saudi Arabia. Human Rights Watch and Amnesty International issued regular reports of widespread imprisonment and torture.

The couple landed in Montreal in 1992 while Mrs. Al-Khabaz was pregnant with Hamed, soon to witness the Montreal Canadiens win the Stanley Cup. Today the family still lives in the primarily government-subsidized housing in Montreal’s Little Burgundy.

Hamed’s world changed with the advent of dial-up Internet, when he was 13. He shared the family’s computer with his brother.

“I knew even back then the Internet was a library with all this knowledge I could learn. I slowly got into programming and then into hacking, and it excited me to go out, break stuff and discover things.”

Like many kids, his first forays into computers was through gaming. He learned how to hack computer games like WarCraft and CounterStrike.

“I actually coded in C++ and injected code libraries into the game and released stuff in the public chat forums. I was 16 and people in these forums would tell me it was awesome.”

Al-Khabaz wasn’t accepted to Dawson College’s Computer Science program out of high school, mostly because his grades in classes like french were poor. Math, though, came easy to him. He settled for social studies for a year at Dawson and was able to transfer to Comp Sci after.

And then came the Skytech mess. Al-Khabaz said he had already coded several mobile apps, and he wanted to code one for the “omnivox” student admin system, built by Skytech.

In order to do that he had to scrape user data and figure out how to log a user in. It came too easy - he said “anyone with a basic knowledge of computers” could gain access to the personal information of any student in the system.

“As I did my research on how their website was structured, I figured out that I could access anybody’s data really easily. That’s when I brought it up to the school and they didn’t like it, but they said ‘Ok cool, thanks, we’ll take care of it,'” he said.

But Al-Khabaz, perhaps from intellectual curiosity or a refusal to stop when told to stop, kept logging in to see if anything was being done. But he made it obvious that it was him through the IP he was using, making it clear he wasn’t trying to hide anything.

Five weeks later he got kicked out of the school after teachers voted on his dismissal. Some teachers took the fight public on social media, telling students who to side with. Al-Khabaz told the National Post that his academic career was “completely ruined” after finding a serious problem and trying to help fix it.

But soon things charged in his favour. Job and scholarship offers flooded in, including from Taza, the man Al-Khabaz had accused of using threats of jail time to coerce him into signing a non-disclosure agreement.

He didn’t even tell his mom, and for three months while he was barred from attending any college, Al-Khabaz faked going to school in the mornings.

But all things must pass, and eventually nothing really happened. He was still expelled from the school and he gravitated towards the startup life. At Outpost Travel, Al-Khabaz “f—- up a lot of times,” and learned the cost of acquiring a user in the travel space was much more expensive than in, say, social media.

“He had a big time passion for cutting edge tech and building things that other people simply couldn’t build and he was like a true dev. A true maker who was curious about everything from a technical standpoint,” said Ilan Saks, the CEO of Toronto-based Stacked HR. In 2013, Saks chose Al-Khabaz as winner at a student startup contest he was sponsoring. “On the other hand he know he had a lot to learn and he asked questions. He had the entrepreneurial sprit that you’d look for.”

Still, Outpost Travel ran out of money within a year and a half.

“We had an amazing team and we built a stellar product. We had competitors from Silicon Valley just copying every move we did and we were leading the space, but at the end of the day it didn’t work out. I didn’t know the mechanics of a travel startup,” Al-Khabaz told MTLinTECH.

Today he feels way ahead of the game. And at 23, he’s young and extremely hungry. Just last week stay22 processed $25,000 worth of bookings. The startup is growing 17 per cent week-over-week and recently closed a large, unnamed partner.

And if life is all about risk, Al-Khabaz is fine with that.

“Startups are risky and I like risk for some reason. Hacking and penetrating systems was all about risk and that’s what you need in startups,” he said.

“My family always tells me to get a goddman job for $200,000 in Silicon Valley or whatever, and I’ve had a lot of offers, but I always thought I’m optimizing for learning right now. I’m 23 and theres so much to learn. If I keep failing until 29 or 33, I’ll say, okay, I’ll get a job. But right now it’s the best time to the these risks.”

To risk!