Hacking Legend's Sign-Off ------------------------- By Greg Miller March 18, 1999 Four years after FBI agents burst into a North Carolina apartment and captured the nation's most notorious computer hacker, the saga of the man they hunted down-Kevin David Mitnick-seems finally to be nearing a conclusion. Mitnick and federal prosecutors signed a plea agreement this week that sources said will keep the accused hacker in prison for roughly one more year. In addition, Mitnick will likely be barred from ever profiting from his story, and restricted from so much as touching a computer for at least three years after his eventual release. The agreement, which still requires the approval of a federal judge and comes just weeks before his trial was to begin, brings the curtain down on an era. More than even Mitnick seems able to comprehend, he has come to personify both the golden age of hacking and the intense public paranoia that accompanied the dawn of the personal computer revolution. Mitnick's heyday as a hacker is over, but he remains the ultimate digital boogeyman. The San Fernando Valley native's dubious career spans two decades, and by the early 1990s he had become a hacker legend by swiping computer secrets from big corporations and leading the FBI on a two-year chase. Since then, others have made millions of dollars telling his story while he spent the past four years penniless in jail. A movie about his capture is due out this year. And legions of modern hackers have made him a misunderstood martyr, tearing down prominent Web sites to erect profanity-laced protests in his name. "The Mitnick case is the last vestige of hacker hysteria from the late 1980s and early 1990s," said Mike Godwin, longtime general counsel for the Electronic Frontier Foundation, an Internet civil liberties group. "It's not that there won't be more hackers. It's just that cops and the media have moved on. They're more worried about gambling and porn sites and domain name registrations. But Mitnick was demonized in that era, and there's still a lot of people who want to take a piece of him." Southland Was Hotbed of Hacking Mitnick, now 35, has never seen the shopping, chatting, humming mecca that is today's Internet. His days are ruled by the routines of the Metropolitan Detention Center in Los Angeles, where he has been held without bail on a 25-count indictment that includes 14 counts of wire fraud and eight counts of illegal possession of computer files and passwords stolen from such companies as Motorola Inc. and Sun Microsystems Inc. He trades adult magazines and other jailhouse currency for other inmates' phone time so he can spend hours talking with supporters, and also keeps in close touch with his parents, who divorced when he was 3. His father is a general contractor who still works in the San Fernando Valley. His mother, who raised him almost single-handedly, is now a waitress at a casino in Las Vegas. Mitnick grew up in Southern California at a time when the region was emerging as the stage for a handful of hackers whose collective notoriety has not been rivaled since. There was Kevin Poulsen, who, along with fellow hacker Ron Austin, tied up phone lines at radio stations during call-in contests. By improving the odds that they would be the lucky caller, the two collected prizes ranging from a pair of Porsches to Hawaiian vacations. There was Justin Petersen, a hacker playboy who raided phone company offices and pleaded guilty of trying to transfer $150,000 out of a Southern California bank. He is best known, however, for pursuing his illicit hacking habit even while he was working as an FBI informant, gathering evidence against Mitnick and others. And then there's Mitnick. A high school dropout, he was not the most technically gifted but was a master of "social engineering," or using guile and disguise to talk others into lowering their electronic defenses. "All hackers are like locksmiths," said Poulsen, who himself spent five years in prison and now writes about technology for ZDTV Online and Wired magazine. "They know how to install a lock, how to take apart a lock and how to put together a lock. But Mitnick was also very good at getting someone on the other side of a door to simply open the lock." At first, Mitnick's hacks were little more than juvenile pranks. He set up celebrities' home phones so that they were asked to deposit a coin whenever they tried to make a call, for instance. But his habit escalated, until he became primarily interested in pilfering hacking tools-mostly software and cell phone equipment-from big companies and computer experts. He was known for studying a company's organizational chart, mastering its employees' lingo, then posing as a field technician calling the home office for a needed access code. Between 1981 and 1988, he was arrested for hacking at least four times, culminating in a one-year prison sentence for stealing software from Digital Equipment Corp. While on supervised release from that sentence, Mitnick took a job with a private investigations firm in Los Angeles. Suspicious that Mitnick's new employer was taking advantage of his hacking skills, the FBI launched an investigation in 1992. True to form, Mitnick was onto the Feds almost as quickly as they were onto him. He put together his own private dossier on the agents, conning information out of their families and, colleagues say, even eavesdropping on the agents' phone conversations. On Christmas Eve in 1992, Mitnick tried to trick employees at the state Department of Motor Vehicles to fax driver's license photos of the agents to a Kinko's copy center on Sepulveda Boulevard. Suspicious of the request for what computer records flagged as undercover ID photos, the DMV set a trap. Instead of sending photos of the agents, DMV faxed back a photo of "Annie Driver," a fictional character the agency uses for instructional purposes. Shirley Lessiak, a DMV special investigator, was assigned to stake out the Kinko's store to see who would come to collect the pictures. Hours later, Mitnick strolled in, picked up the envelope, looked at its contents and shuddered. Suspecting he was being followed, Mitnick headed toward the back door of the Kinko's, then back toward the front, and kept reversing course in an effort to flush out his pursuer. Lessiak nearly stumbled into him, but pretended to be a customer. Mitnick finally left through the back door, grabbed a pay phone and watched Lessiak approach. "He tossed the papers at me," said Lessiak, who didn't learn until later that she was face-to-face with a notorious hacker. "I grabbed for them and that gave him a second or two head start. He ran, and he ran faster than I did." Mitnick kept running for the next two years. He Never Tired of the Thrill Hackers tend to romanticize themselves and are fond of describing their efforts as "the pursuit of knowledge" in its purest form. But that often means engaging in electronic trespassing, or "hacking," through a system's defensive barriers. A typical goal is to get "root" on a computer system, meaning access at such a basic level that the hacker can move about the system unrestricted. Mitnick was known for using such access to swipe software and snoop on others' e-mail. He seemed never to have tired of the thrill this gave him. For most hackers, "it's like any other thrilling sport-after a while it becomes old hat and boring," said Lewis DePayne, Mitnick's longtime hacking colleague. "But for Kevin, it never became boring or old hat." For Mitnick and others, hacking was an all-consuming endeavor, a laborious and often tedious process of gathering tips from others, sifting through phone company trash bins in search of discarded manuals, and sneaking into campus computer rooms for precious time on the mysterious machines. These days, hacking is being overrun by a generation derisively dubbed the "script kiddies." Almost every suburban kid has an online connection, and the Internet has eliminated the drudgery-some would say the discipline-of the hacking craft. Thousands of paint-by-number hacking programs, or "scripts," are available free on dozens of Web sites. Many of these programs can be aimed at thousands of computer systems simultaneously, virtual search engines for security vulnerabilities. Predictably, the number of security breaches reported has soared, according to the Computer Emergency Response Team at Carnegie Mellon University. A CERT official said there were more than 2,500 incidents reported in 1998, compared to just hundreds in the late 1980s. Even so, hacker hysteria is waning. The crippling electronic blow that once seemed so imminent has never materialized. Experts say this probably has less to do with improvements in computer security than the fact that hacking is by and large a juvenile pursuit, and few among its ranks have both the skill and inclination to be destructive. More than ever, hacking is a hobby populated by the likes of a pair of teenagers in Cloverdale, Calif., who-using scripts from various Web sites-recently broke into Pentagon computers and bumbled around low-security files before getting caught. "It's getting to the point that anybody can be a hacker," said Dane Jasper, chief executive of a Santa Rosa, Calif.-based Internet service provider who helped catch the teenagers. "Kevin Mitnick was far more talented than these joy riders." But Mitnick, like the Cloverdale teens, was caught. And who knows what deterrent effect that has had. Security Expert Joins the Hunt Mitnick had been on the run for almost two years when, on Christmas Day in 1994, someone hacked into the computer system of Tsutomu Shimomura, a security expert at the San Diego Supercomputer Center. Convinced that Mitnick was the culprit-which remains unprovenShimomura set out to help the FBI catch him. Using an array of high-tech surveillance equipment, Shimomura and FBI agents traced Mitnick's online activities first to a cellular phone "cell" in North Carolina. From there, they zeroed in on the apartment complex where, even with the FBI closing in on him, Mitnick continued to dial in to computer networks through his modem. When the FBI barged in on Mitnick's apartment just after midnight on Feb. 15., he is said to have vomited. In his apartment, authorities say, agents seized cell phone equipment, computers with thousands of illicit files, as well as phony IDs, resumes and job applications. A friend of Shimomura, New York Times technology writer John Markoff, got exclusives on both the chase and the capture. "A Most Wanted Cyberthief," the paper proclaimed in a front-page headline, was finally behind bars. The story touched off a media frenzy. Newspapers and television news crews flocked to the scene. Shimomura was hailed as the ultimate cybersleuth. And soon, he and Markoff were splitting a book deal and movie rights reportedly worth more than a million dollars. Mitnick never physically harmed anyone, and he appears never to have profited from his hacking. In fact, officials from some companies Mitnick allegedly targeted say he was mainly a nuisance. "The real damage was loss of productivity and hassles," said Phil Karn, a senior engineer at Qualcomm Inc., a San Diego-based cellular phone manufacturer. "I don't want to condone what Mitnick did, but he's really not public enemy No. 1." Nevertheless, Mitnick was soon being portrayed in ads for Markoff and Shimomura's book as a hacker who "could have crippled the world." Predictably, enmity toward Markoff is intense in the Mitnick camp. Mitnick's father says Markoff has "made a monster" of his son, whom he believes would be in far less trouble if Markoff hadn't sensationalized the case. Late last year, a group of hackers shut down the New York Times Web site, temporarily replacing it with a profane anti-Markoff rant. Case Centers on Theft of Software Markoff today says he has a certain amount of sympathy for Mitnick, "but I don't think what he did was benign. He was stealing information. I think he did a tremendous amount of damage to the Internet community." For all the drama of the Mitnick-Shimomura face-off, it has proven to be inconsequential in terms of his case. Mitnick has not been charged with many of the allegations that topped Markoff's stories, including Mitnick's alleged possession of 20,000 credit card numbers. Indeed, he has not even been charged with hacking Shimomura. Instead, the government's case centers on allegations that Mitnick stole millions of dollars worth of cell phone and computer software-mostly tools for reprogramming phones and other hacking endeavors-while he was on the run from the FBI. Their evidence consists mainly of seized files and taped telephone calls. The plea agreement, filed under seal in federal court in Los Angeles on Tuesday, would impose approximately a five-year sentence. With 35 months in jail that would be credited toward that sentence, and assuming good behavior, he could be out within a year, sources said. But for years beyond his release, he will remain separated from the world of computers that has often seemed more indispensible to him than even family or friends. If he is caught using a computer, he could be sent back to prison. In a recent court appearance, Mitnick looked trim, although his puffy face belied his lifelong weight problem. His dark, bushy hair was brushed back. He wore metal-framed glasses and a wrinkled blue pinstriped suit. Under some circumstances, Mitnick can seem almost meek. He has a soft, passive manner that many-including, evidently, his victims-find disarming. But he can also be petty, manipulative and obsessive. Once, when a friend refused to allow Mitnick to use an employer's computers for his hacking habit, Mitnick took revenge in typical fashion. Posing as an IRS agent, Mitnick phoned the friend's employer to tell him that the friend was in serious tax trouble. The friend, Lenny DiCicco, later returned the favor by telling the FBI about Mitnick's forays into the computer systems of Digital Equipment. Hacking was such an addiction for Mitnick that he couldn't even give it up to save a brief marriage to a woman named Bonnie Vitello in the 1980s. Even as that relationship was crumbling, Mitnick was known for sneaking away to hotel rooms for hacking binges. Since his capture, Mitnick has transferred that obsessiveness to his legal plight. Most defendants will read important legal documents three or four times, one advisor said, but Mitnick pores over the same document 40 or 50 times. "He doesn't compute things the way you and I do," the advisor said. "He is immersed in minutiae, can't theorize and is linear to the extreme." Backers Keep the Legend Alive Mitnick's closest companion for nearly 20 years, Lewis DePayne, also describes their relationship as one-dimensional: "It wasn't a close relationship. I wouldn't go on vacation with him or anything because he was always focused on computers." DePayne is a co-defendant in the Mitnick case on lesser charges. Asked if they had shared any happy times together, DePayne said, "Yeah, there were great times, but nothing I'd want published." Kevin Mitnick, who declined requests for interviews, has been missing from the computer underground for years. But in many ways, he casts a bigger shadow across Cyberspace now than he ever did. His backers pass out "Free Kevin" virtual stickers, post transcripts of every court appearance, and track his time served down to the second in a ticker at http://www.kevinmitnick.com. Nor was Mitnick forgotten when his Southern California peers recently staged something of a reunion. Petersen, the informant other hackers love to hate, skipped out on his probation late last year. Within days, Austin was giddily spreading the news on a Web site that mocks Agent Steal-Petersen's self-proclaimed moniker-as "Agent Squeal." And Poulsen began filing reports from the Sunset Boulevard bars and clubs that Petersen frequents. Before he was recaptured, Petersen posted his own online updates on a Web site he operates, and fired off e-mail missives to a Mitnick mailing list, taunting the jailed hacker he was once hired to help catch. "Yeah, I got tired of my probation officer's B.S.," he wrote. "So in the meantime, let the U.S. Marshals look for me. I'm not really trying to hide. I just won't be using a cell phone and pissing off Shimomura. hahahahaha."