Every journalist worth his salt knows Adam Penenberg
as the Forbes reporter who uncovered Stephen Glass's fabrications in
The New Republic. Penenberg has turned his investigative talents to the
world of corporate spies in Spooked: Espionage in Corporate America (Perseus
Publishing), which he coauthored with a real-live spook, Marc Barry. Since his
coauthor was less known to the media world, we thought you might enjoy meeting
As founder of C3I Analytics (a corporate intelligence
firm), Marc Barry has many identities: environmentalist, venture capitalist,
headhunter. But in his own home, he's a gym addict, a collector of sixties-era
Pop Art furniture and the only person to have written three state laws without
a law degree.
Marc Barry's spacious loft in New York's Little Italy
is populated in all its corners by jewel-toned psychedelic couches, curvaceous
green and purple Ultrasuede-covered chairs, and not much else. He could share
a decorator with Austin Powers, or A Clockwork Orange's Korova Milkbar.
"I view this stuff as functional art," he says. Pointing at the bright,
sleek lounges, he remarks," I'm waiting for a guy I know to come over and
see these. The biggest piece of that fabric I'd ever seen before was just about
enough to cover that tongue chair over there. He bought it from a dealer in
France, and I envied him. He paid twelve thousand dollars for it. When he sees
this, he'll have a conniption fit." He lounges with his feet up on the
couch in question.
MB: Tell me how you and Adam collaborated on the
Barry: Adam was the
co-writer and it was his whole idea to do the book. I'm good at what I do, but
I mean, the book could not have been written without him, especially as far
as the whole structure of the book goes. I handled all the technical aspects.
I did the sourcing. But all the character stuff was written by Adam. Anything
where you see two people talking in a room, that's Adam. I'm the parts about
where corporate intelligence came from, the CIA's involvement, the National
Security Administration's (NSA) involvement. That's what I know. Adam's very
good at getting in people's heads, putting down how it was done, what was happening-that's
not something I can do. I can write a narrative of things that happened to me
and I can do it in the third person. But I frankly wouldn't have done it for
the money they were offering.
MB: In Chapter 4, "The Kite", which
The New York Times Magazine excerpted, you pose as an environmentalist
and the president of a fake company. Do you often assume false identities in
Barry: Well, in my work I've posed as a venture
capitalist, as a recruiter, a headhunter. I've met people who thought
they were interviewing for a job, and in reality I was debriefing them on who
they were actually working for. I've set up front companies. They're very elaborate
and convoluted ruses. But the point of that chapter ("The Kite") is
that you don't always need that. Sometimes if you have a telephone and you know
exactly where the information is, it's easy to bang it out.
I would rather they'd chosen the chapter called "The
Intelligencing of Corporate America," or the Motorola chapter ("Motorola:
First in Business Collection"). Those were both more technical. I hate
pandering to the lowest common denominator. What do I care whether a bunch of
stupid people understand or not? Unfortunately, that's who the publisher wants
you to write to-Horatio the Hornblower, standing in Barnes & Noble. They're
trying to get him to plunk down his $26.50. I'm really amazed at how low the
bar is in publishing.
I think people in my industry are going to read the book,
and they are going to laugh, because it doesn't tell nearly enough.
MB: Are you satisfied with how the book turned
out? Is there anything you would have done differently?
Barry: I just wish I was free to speak more candidly
about what I know. If I could talk about the things that I have done in my career,
there'd be congressional hearings. There's nothing that corporate America is
doing that is less ruthless than what the US intelligence community-the CIA
or the NSA or the DIA-is doing. And there's just so much hypocrisy involved.
It's all hidden behind layers of nondisclosure agreements.
I don't see anything wrong with what they're doing either.
The trouble I see is that nobody will own up to it. I mean, I've got money in
the stock market. I think the average person wants companies to be using competitive
I've had board members of SCIP (the Society of Competitive
Intelligence Professionals) asking me to do some pretty dubious things because
they don't want to get caught doing it themselves. That's what bothers me. They
should just own up to what they're doing. If you don't agree with it, fine.
If you resent me for talking about it, that's fine too, but don't deny it. Don't
sit there and tell me it doesn't exist when it does. Then you're creating a
scenario where I have to prove you wrong. And if I have to prove you wrong,
that's going to be ugly.
MB: If everyone owned up to it, it wouldn't be
Barry: Well, we're in such a PR-driven society. If it seems like it might
result in some bad publicity, they don't want to do it. The C.I. industry itself
is so concerned with image, and so concerned with cultivating an industry and
making it more user-friendly and more palatable to a broader cross section of
other industries that they want everyone to think that it's all warm and fuzzy.
The leaders of the SCIP community will say, "Oh, our intelligence is all
open source, nothing that could be remotely considered underhanded," and
that's just not true. And granted, there is a lot out there. There's more information
than most people realize out there, if you know where to look. But certain things,
like Merck's new synthetic fluid for the knee that hasn't even passed clinical
trials yet-you're not going to get that information unless you bamboozle it
out of somebody. You're not going to get that without deception. And that's
what I excel at.
MB: Tell me about your company, C3I Analytics.
I hear you're building a war room?
Barry: Basically 75 percent of what we're doing
right now is competitive intelligence. The other 25 percent is a joint venture
I'm involved in with Raytheon. They're an enormous defense contractor-the guys
who build satellites for the CIA. We're talking about building a $12 million
war room. There's only one other facility like it in the world-the LIWA (Land
Information Warfare Activity) center, owned by the Army. There's 24 feet of
panoramic video screens going around the room, and supercomputers capable of
dragging in huge nets of raw data from the world press and public files.
We can also do things like scenario war-rooming, where,
say, Texaco wants to know about a huge oil reserve in the Caspian Sea. And Shell
Oil gets control of it. So Texaco wants to know what's going to happen to prices
globally. We can take all the elements in play, turn it into a scenario and
run it. The idea is to provide big picture analysis. We can videoconference
between 500 people in various parts of the world-everything from that to weather
patterns. The guy who designed the war room, I've been told, actually designed
the set for Star Trek: The Next Generation. It's very space-age looking. It's
got a captain's chair.
In May when we were writing the manuscript, it said it
was going to cost 7 million dollars. Now it's up to 12. My guess is by the time
this thing is built, it's probably going to cost 15 or more.
It should be a lot of fun. It's going to be my New York
Times obituary-"that name sounds familiar, who's that? Oh the guy that
built that war room." We're charging clients a million dollars a year.
We're going to handle everything from trademark counterfeiting to merging to
MB: When you were in high school, did you think,
"I'm going to grow up and build a war room?"
Barry: That was the last thing on my mind. I was
drinking and going to strip clubs, hanging out with my friends. I'm in the business
for the cerebral aspects of this. They have it, they're going to hide it-how
am I going to get it? Every chase, every caper I do is totally different. It
never gets boring. I mean, I can go to a party and I'll know a little bit about
a million different subjects.
I enjoy when people hide something and it's up to me
to try to get it out of them. It's funny, because I hate it in my personal life.
I rationalize all the duplicity and underhandedness by saying, "If I'm
not doing it in my personal life, then I'm cool."
I have a very compartmentalized life. That's why this book is getting kind of
tricky. It's crossing the line. It's turning into my life.
MB: Do you feel like they're trying to sell this
book based on your mystique?
Barry: I'm no different than anybody else. They
try to sell you as this larger-than-life character, and I can understand the
reasons for that. It's just hard to deal with at times. Sometimes I don't feel
like playing spy. Most of the people I get talking to me are like, "So,
do you bug telephones?" Jesus, how about a token for the cool machine!
If I did do those things, I wouldn't tell you. There's
a lot more to it. I specialize in "humint"-human intelligence, eliciting
from people. That other thing is "sigint," signal intelligence. It's
a different deal. And then they're like, "Oh, fascinating," and they
scribble in their notebooks. My friends down in D.C. and I goof on that. It
sounds really pompous, but we say to each other, "If they really knew what
went on ."
Running phone tolls and things like that are just starting
to come out now. I've been running people's phone tolls for years! I used to
do that on girlfriends, girls I just met. Then I found out how bad that is.
It really ruins the relationship because then you have this profile of what
she is. It robs you of all the magic of getting to know somebody. When you run
somebody, you know their whole life history. If they're fibbing or embellishing,
you know that too. You're like, "Don't give me that, I've got your ten-year
address history right here!"
Adam Penenberg is a well-known
investigative journalist. He currently writes for Time and Fortune,
and was on staff at Forbes magazine and Forbes.com. His work has also
appeared in the New York Times, Wired, and Playboy. He
resides in New York City.
Marc Barry is an intelligence
practitioner and a national expert on intellectual property. He is the founder
of C3I Analytics, a corporate intelligence firm in New York City. His clients
are Fortune 400 companies.
An excerpt from Spooked: Espionage in Corporate America
by Adam L. Penenberg and Marc Barry
Chapter 9: "Chief Hacking Officer"
Marc Maiffret, his hair purple, spiky, and coated
in gel, doesn't look like an operative paid to steal what a Kashmiri terrorist
believed was top-secret U.S. military software. Partial to black pants and silk
button-down shirts, Maiffret likes "to dress like Nicholas Cage,"
but at five foot six he's built more like a neo-Gothic version of Barney Rubble.
It has come as no surprise to the twenty-year-old cybersavant
known as "Chameleon" that life is a numbers game. For as long as he
can remember, the digital intruder turned Internet security guru has existed
in a netherworld of digits. Zeroes and ones "that I manipulated and that
manipulated me," strung together in the language of binary code, the basis
of the commands he used to forge the applications that underlie the operating
systems that serve as the brains of the computer networks he breaks into.
Chameleon, who specializes in tearing apart Microsoft
software for security holes, says "I didn't graduate from MIT with top
honors. My world has revolved around breaking software and systems while the
security professionals' world has revolved around fixing and securing their
systems against me and my attacks-attacks they know nothing about."
Now, as a cofounder of eEye, a top Internet security
consulting firm, he has become one of those computer security
pros he used to outfox. Maiffret has business cards, but that doesn't mean he
has gone mainstream. After all, they read, "Chief Hacking Officer."
He, and antiestablishment propeller-heads like him, with hacker handles like
"Jericho," "Dildog," "Punkis," and "Tweety
Fish," personify why corporate espionage has not yet been retrofitted for
But how tempting it must be for corporate America. Already
most companies store vast caches of valuable data-including personnel records,
customer billing, confidential financial information, confidential blueprints,
marketing plans, and technologies in the R&D stage-in their computer networks.
From a remote location anywhere in the world, a skilled digital intruder could
sneak into a corporate network by tricking the network software to run his commands
and not those of the system administrator. Once inside, he could jump from machine
to machine, copying documents and confidential e-mail. A world of bits and bytes,
since he leaves his bounty behind as well as taking it with him, a company wouldn't
even know it had been hacked-unless the perp bragged.
"I think as businesses move more data online,
their competitors will find it tempting to hire hackers," says Dale Coddington,
systems security engineer for eEye Digital Security. "Since the FBI's track
record catching them is less than stellar, there's little chance a well-trained
hacker will get caught. With such low risk and high reward, it's inevitable
some company is going to get burned through cyberspace. The question is, will
it even know about it?"
Since the dawn of electronic time (the 1960s) computer
hackers have roamed "cyberspace"-even before that word was first coined
by sci-fi writer William Gibson in the 1984 paperback Neuromancer. At first
the Internet connected a select group of universities and research institutions;
the term "hacker" was either used to describe someone with a bad golf
swing or a geek who explored the innermost workings of computer systems. In
neither instance was a hacker a lawbreaker. He usually attained his skills by
spending thousands of hours spelunking through large networks, studying how
they were cobbled together. The invention of the World Wide Web in 1989 changed
all this. At first the Information Superhighway was a mere backcountry road,
riddled with potholes and service disruptions. As late as 1996 most Americans
had never heard of the web, the word "browser" was used to describe
someone wandering around a store without a plan, and few corporations maintained
a presence in cyberspace.
As the 1990s hustled forward companies began to recognize
the inevitability of business-to-consumer e-commerce, and by 2000 there were
millions of web sites, many of them belonging to corporations and small businesses,
as well as universities, research centers, think tanks, mom-and-pop operations,
religious and political zealots, porn providers, online scammers and hate groups,
newspapers, magazines, and publishing houses, hackers, and music and software
pirates, as well as your regular Joe and Josephine Q. Public.
But more web sites means more computer assaults. In
1988, the first year for which statistics are available, there were 6 reported
hacking incidents, according to CERT (part of Carnegie Mellon University's Software
Engineering Institute). Four years later there were 773. The year 1995 saw 2,412
attacks launched on computers, with the number quadrupling to 9,859 in the year
1999. The first quarter of 2000 continued this trend, setting a pace that should
easily eclipse 10,000 hacks for the year. And these are just the reported ones.
The Pentagon alone suffers hundreds of attacks a week, as do scores of other
government and military sites. Motorola, the New York Times, and Yahoo! are
just a few of the companies that have had their web sites taken over by obstreperous
Greater global interconnectedness isn't just part of
a cybergeek's daily musings, it has also been working its way into the mainstream.
Horror flick sequels specialist Wes Craven (director of Scream et al. and numerous
Nightmares on Elm Street) says: "I look at computers and their growing
global linkage as the beginning of neural pathways to planet consciousness.
It began with the telegraph, the foundation for using numbers to convey information,
to the computers of today. The way that computers are growing closer together,
linked by the Internet, creates a digital central nervous system. There's a
brain forming around the skin of the planet."
Trippy, maybe. But this greater human virtual connectivity
comes at a price: security. The ease with which a massive wave of "denial
of service" (DOS) attacks were launched against powerhouse e-commerce success
stories in February 2000 illustrates that everyone, even the richest corporation,
is equally vulnerable in cyberspace. Yahoo!, E*Trade, Amazon, Buy.com, and a
score of other sites were hit with a hailstorm of tiny electronic packets containing
anticorporate messages. The company's routers and servers hyperventilated from
the onslaught, slowing traffic to a crawl and in some cases shutting down the
network. In real-world terms it was the equivalent of a million irate PC owners
simultaneously dialing twenty frazzled tech-support operators. The result: a
stream of busy signals and a whole lot of frustrated customers.
"Hackers have known for a long time a large-scale
DOS like this could be done, but no one's had the chutzpah to do it before,"
says Tweety Fish, a member of "Cult of the Dead Cow," an underground
hacker organization the DOS attackers sent greetings to within the code used
to flood targets. (Dead Cow members had nothing to do with it.)
Computer security company ICSA estimates there are 1
million hackers around the globe, many of them "script kiddies," or
wannabees who wouldn't know computer code from Morse code but who get behind
corporate firewalls by relying on point-and-click
software available from hacker sites on the Internet-free for the asking, for
those who know where to surf.
But don't expect corporations to turn to hackers to
find out what rivals are up to any time soon. Corporate suits don't trust computer
culture kids like Maiffret, and have even less desire to work with them; usually
corporate IT departments' interface with his kind is when the company's home
page has been graffitied by some "script kiddie." When companies hire
computer experts from the outside, it is usually for computer forensics, another
hot field. This is used to catch a disgruntled employee stealing data, or to
nab someone distributing confidential material via e-mail. In 1998 Maiffret
was hired to gather evidence for a civil suit. The client's spiteful ex-lover
had stolen the license for a valuable microsurgical clamp from his company,
AroSurgical of Newport Beach, California. Maiffret specially coded software
to monitor her corporate e-mail account, hoping she would be reckless enough
to continue using it. He was pleased when she did, dialing in from home. Maiffret
didn't monitor her outgoing e-mail but he could see the incoming messages.
Every ten minutes the program would check her e-mail
account, make copies, and send them to us, a program that it took me about forty-five
minutes to code. We could have used the Microsoft Outlook program, but I didn't
want files removed from the server, because then she wouldn't have gotten her
mail and gotten suspicious.
One of the e-mails came from a company she had solicted
that mentioned the existence of the document and would they be interested in
talking. AroSurgical got an injunction, barring her from using the pilfered
license, and eEye got to bill $240 an hour.
Maiffret believes he has the creativity to solve almost
any problem on the fly-and that's because of his hacker roots. But many computer
security firms claim they won't hire people like him. They say they are fearful
of a criminal past.
ISS, an Internet security company headquartered in Atlanta,
has for years decried the use of hackers by its competitors. The company guarantees
its employees have pure pasts by conducting extensive background checks. But,
points out Space Rogue publisher of the Hacker News Network and a member of
the L0pht Heavy Industries, a hacker think tank in Boston, companies already
hire hackers, they just don't know it.
"There is no national hacker registry to
check on someone's hacker status," says Space Rogue, who, along with other
members of L0pht, testified before Congress in 1998 about threats to the National
Electronic Infrastructure. "Any company that comes out and claims, 'We
do not hire hackers' is deluding itself," he continues.
ISS CEO Christopher Klaus, who kicked off his company
in 1994 with a single product, calls hiring hackers "a questionable practice,
which could lead to tremendous legal liability." The $3 billion company,
housed in Atlanta, refers to itself as "the world's leading provider of
security management solutions for the Internet," claiming more than 5,000
customers, including twenty-one of the twenty-five largest U.S. commercial banks,
nine of the ten largest telecommunications companies, and more than thirty-five
government agencies. Klaus, himself a reformed hacker who used the identity
"Coup" would have a lot to lose if he brought in the wrong guys.
But ISS has in fact hired a half a dozen or more known
hackers in recent years, some who have the reputation for being quite malicious,
including one who goes by the name "Prym" and has been linked to a
number of high-profile assaults on corporate, government, military, and proenvironmental
web sites: "Phree Kevin Mitnick or we will
club 600 baby seals," the nasty teen once scrawled across GreenPeace's
home page. (At the time hacker Kevin Mitnick was in prison, and a major cause
Klaus admits Prym was on ISS's payroll but "it
was mutually decided we would part company. He no longer works at ISS."
Another ISS employee edited the hacker 'zine Phrack, and at least two others
coded hacker software exploits that somehow got into the wild. These exploits,
some computer professionals say, were responsible for thousands of successful
computer attacks over an eighteen-month period. Although Klaus says that he
knew nothing about the extracurricular hacktivities of some of the young professionals
he hired for his "X-Team," a much-hyped special security unit within
the company, it's been an open secret in hacking circles for years.
Hackers like Maiffret detest law enforcement, distrust
government, and can't stand corporations. Even when one of their own-Coup-turned
corporate, he became, in their eyes, a hypocrite by disavowing his roots. Hackers'
currency is up-to-the-second information, the lifeblood of their vocations.
Who'd want to help a corporation make money? Besides, those who come equipped
with the highest hacker skill levels often carry on two lives: In the virtual
world they are shadowy figures who explore the farthest reaches of cyberspace
for security holes. They create new scripts, sometimes malicious, contact software
vendors to warn them about flaws in their products, set up web sites to comment
on the scene, and publish copies of hacked corporate home pages (available at
They are often computer activists with a bent for anarchy.
Information, the old hacker credo goes, wants to be free. In the real world,
however, that same information about hacking and security vulnerabilities reaps
them six-figure salaries as network consultants. Just because they are upper-income-earning,
tax-paying, law-abiding citizens when they are not wired into their computers
doesn't mean they have changed their worldviews. Hacking isn't just the accumulation
of a special set of skills, it's a way of life, an obsession, more a new type
of millennial philosophy than a job description at an "information resource"
No one better personifies this than Dildog, also a member
of Cult of the Dead Cow, who was lounging in his hotel suite at the 1999 Defcon
hacking convention, a smile smeared on his face. Being Las Vegas in July, the
temperature outside is 100 degrees, but Dildog was air-conditioned cool. The
unveiling of his latest software upgrade for "Back Orifice," a not-so-subtle
dig at Microsoft's Back Office, had been a rousing success. The software is
a corporate spook's hottest fantasy tool. Once installed on a target's computer
network (it could be secretly planted merely by sending it as an e-mail attachment)
it gave the user total access and control. From a remote location, a spy could
explore every nook and cranny of the system and analyze every single activity,
as if he were the systems administrator. He could capture all passwords and
keystrokes, copy all documents and files, hop unhindered from machine to machine,
from web server to e-mail files, surf through databases containing vast caches
of credit cards, and wiggle his way into vast stores of personal information
gathered from customers. The software also came equipped with programs that
could turn on and control built-in microphones and PC cameras without the user
knowing. Anyone could be watched and recorded at any time. Call it the Corporate
But that's not why Dildog, who earns big bucks at an
established technology company, created it. Although software makers, computer
security companies, antivirus makers, and law enforcement claimed the release
of Back Orifice 2000 was just a way for hackers to legitimize illegal computer
intrusions, Dildog says he is just trying to point out potential problems with
Microsoft's software. Computer security companies are "afraid to admit
that their detection system is horribly and possibly irreparably flawed,"
he says. "[They] give people the impression their software 'raises the
bar' against the average hacker. Unfortunately, this also fools people with
really critical networks into thinking that this software is sufficient to protect
them. People trusting this stuff to protect them <el> are in for a surprise."
A gaggle of followers, most of them in their twenties
and dressed in noir black, with tattoos, piercings, and scraggly hair, waited
for Dildog in his hotel suite. They sat cross-legged on the carpet, availing
themselves to a well-stocked minibar piled high with bottles of vodka, bourbon,
and whiskey. Of the 3,000 hackers, crackers, geeks, "scene whores"
(hacker groupies), computer security professionals, journalists, undercover
cops, and federal agents who attended the 1999 Defcon hacker convention, 2,000
of them had crammed into a conference room at the Alexis Park Hotel to watch
the BO2K release. The year before, Cult of the Dead Cow had chosen Defcon to
promote the first version of its Back Orifice. Written by fellow Cult member
Sir Dystic, it worked on Windows 95 and 98 machines by secretly creating a back
door so that a remote user could control all functions on those computers.
The upgrade Dildog-coded version had been designed to
work with networks that run on Windows NT, and it camouflaged itself extremely
well. Cult of the Dead Cow members didn't travel all the way to Las Vegas to
disappoint. They kicked off the conference with a laser light show, culminating
in a deafening electronic moo sound. The crowd gyrated and cheered. Then, while
Dildog and his associates explained their don't-blame-us-if-Microsoft-products-suck
philosophy, a CD-ROM label was projected on the wall behind them, a cow head
spinning and spinning. At the end of the presentation, Cult members flung two
dozen CD-ROMS containing the Back Orifice update. The crowd surged forward.
Antivirus makers and computer security company reps watched closely, hoping
to later corral someone with a copy. The first one to crack the program would
win bragging rights, their names in a press release, perhaps even a mention
in some magazine or newspaper articles as heros who thwarted the evil intentions
of the Cult of the Dead Cow hacker gang.
An employee of ISS threw himself into the mob and somehow
snagged a copy. Within twenty-four hours, the company would crack parts of the
program and release an application that could identify it. At the time, Dildog
didn't know this, and even if he had he wouldn't have cared. In an earlier Internet
conversation, according to [Dildog?], an ISS employee had approached him and
asked how much of a bribe it would take for him to pass the company an advance
copy of the software, he claims. "Money doesn't motivate us," he said,
but as a joke the Cult sent the ISS minion back a note saying it would take
$1 million and a monster truck. Later, Cult members would be chagrined to discover
the original discs dispersed at Defcon had been infected with the Chernobyl
computer virus. "Very embarrassing," Tweety Fish admits.
Although ISS had been more than happy to play up the
fact that it could detect the software, Dildog fully expected companies would
not only reverse-engineer it, they would soon come up with a removal tool. That
was why he'd released his software as "open source," which meant hackers
the world over could tweak the code to suit their needs. From previous experience,
Dildog figured BO2K would then spread like a virus, morphing into perhaps dozens
of different versions. He counted more than 300,000 downloads of the original
Back Orifice, which ran solely on Windows 95 and 98 and was spread primarily
by e-mail attachment. Who knew how many other copies had been spread friend
to friend, hacker to hacker, "cracker" to victim? Dildog didn't care.
Like Louis Malle, the French film director who once said, "I like confusion,
but it drives the crew crazy," Dildog enjoyed anarchy and confusion, believing
the question was usually more important than the answer.
In a hacker's eyes, only one thing could be worse than
dealing with a corporation, and that would be breakfasting with law enforcement.
A number of geeks complain that FBI agents have stormed into their homes waving
warrants and confiscating computers. "And the feds never seem to get around
to returning your stuff either," says Maiffret, who was raided by the feds
in 1998. "Even if they did give it back, the way technology changes it
would just be old tech anyway. So it's really a way of them to punish you without
actually having to go to the trouble of taking you to court." Just dealing
with an allegation can cost $2,000 to $5,000, and perhaps $20,000 to deal with
more serious legal issues. Or more.
Kevin Mitnick's defense team, which was paid a fraction
of what it usually earns to defend the star-crossed computer addict, billed
the government for 3,000 hours of work over three years, but put in more than
double that. At the usual L.A. lawyer rates, that would have meant Mitnick's
bill, if he'd paid legal retail, would have topped $2 million. Why did his case
drag on so long? Because "prosecutors [were] trying to make an example
of him," surmises Jennifer Granick, a San Francisco lawyer who has defended
a number of hackers.
What had Mitnick done to land him five years in jail?
The indictment alleged he had copied proprietary computer and cell-phone software
code from Motorola, Nokia, and Sun, worth, the government claimed, $80 million.
In essence, prosecutors were charging him with economic espionage before there
was a law against it. Mitnick, who was sentenced to a halfway house as a teenager
for treatment for an obsession with computers, admits he hoarded this information
but never shared it with anyone. He claims he wanted to study it.
"When he was in jail his eyes would shine
whenever we would talk about computer code," says Brian Martin, aka "Jericho,"
webmaster of attrition.org, a site that tracks computer crime, and a former
member of the Mitnick defense's computer forensics team. How did Mitnick, known
less for his computer skills and more for his verbal dexterity, score his software
fix? With Motorola, he says, it was easy. One day on his way home after work
he stopped at a pay phone and, posing as an engineer, demanded the source code
to a new cell phone. "A few minutes later I called back and was told it
was already being transmitted to an online account I'd given them," Mitnick
says. By the time he got home he had scored the blueprints to Motorola's latest
For a pretty abstract kind of crime, the government's
tactics were heavy-handed, as if it were dealing with a terrorist. Mitnick wasn't
just denied bail, he was denied a bail hearing. Donald Randolph, Mitnick's court-appointed
attorney, says he had never heard of that before in his twenty-five years of
practice. It took almost a year, and a number of motions filed by Randolph,
before the prosecution turned over the nine gigabytes of electronic evidence
it had accumulated, so the defense could prepare its case. Prosecutors were
reluctant to give Mitnick a laptop to prepare his defense. Much of the rationale
for the delay was the unfounded fear that somehow Mitnick could-without a modem-wreak
cyberhavoc from prison. Indeed, prison officials had imbued Mitnick with powers
befitting James Bond. He was once stowed in solitary confinement because prison
officials were afraid he could turn his walkman into an FM transmitter that
could be used to bug the warden's office.
When legal historians look back on Mitnick's case, they
may be left scratching their heads over some of Judge Mariana Pfaelzer's odder
rulings. It is with the issue of encryption that the Mitnick case really broke
new ground. "This may be the first case in which encryption issues were
litigated in a criminal arena," says Randolph of the Santa Monica, California-based
firm Randolph & Levanas. "But get ready, it's going to be a regular
issue starting now." Especially after the Department of Justice had for
a time tossed around a very bad idea called the "Cyberspace Electronic
Security Act." The bill was scary for a number of reasons. It would have
permitted investigators to secretly enter your home, your private property,
and search through your computer, or even install software without your knowledge
that could intercept your keystrokes-your passwords, private e-mail conversations
and online chats, or override encryption programs. Fortunately, after word of
the proposal leaked out and met a storm of resistance, the Department of Justice
quietly buried it.
But it continued to be concerned that criminals will
rely more and more on encryption. Unfortunately, its proposed solution would
have been like using satellite surveillance to nab a purse-snatcher. Of course,
the irony was not lost on hackers: the Department of Justice was asking permission
to breach Americans' computer systems while at the same time they went after
people who breached Americans' computer systems, American companies, and the
With Mitnick, the issue centered around a section of
encrypted data found on the laptop in his possession when he was arrested in
1995. Since the prosecution couldn't crack the code, they said they wouldn't
turn it over to the defense as discovery until Mitnick handed over the encryption
key. The judge agreed. "In essence, the prosecution was arguing that their
ignorance provides the justification for withholding evidence," Randolph
says. "To the best of our knowledge, never before had this tactic been
attempted." The reason Mitnick's attorneys wanted to see the evidence,
besides their constitutional right to do so, was to see if there was any evidence
that would point to Mitnick's innocence. If, for instance, he got Motorola cell
phone source code from a source other than Motorola, he would not be guilty
of computer fraud. (He might have been in receipt of stolen property, but that
would have been a misdemeanor.) And Motorola's source code, and Sun's and Nokia's,
had been floating around hacker circles for years.
What was the result of the well-publicized treatment
Kevin Mitnick received? Hundreds of attacks on corporate, government, and military
web sites protesting his treatment, with web sites like kevinmitnick.com and
freekevin.com spreading the latest Kevin Mitnick news. Much of the reporting,
naturally, derided law enforcement.
Martin even posted this joke on attrition.org: The NSA,
the CIA, and the FBI all want to prove they are the best at apprehending criminals,
so the president gives them a test. He releases a rabbit into the forest and
commands each of them to catch it. The NSA places animal informants throughout
the forest, and interrogate all plant and mineral witnesses. After three months
of extensive investigations, they conclude that rabbits do not exist. The CIA,
after two weeks with no leads, burns down the forest, killing everything in
it, including the rabbit, which an unnamed agency source announces had it coming.
The FBI takes only two hours to emerge from the forest with a badly beaten bear.
The bear is yelling: "Okay, okay, I'm a rabbit, I'm a rabbit."
Hackers are always on red alert for the FBI. In fact,
when Maiffret was contacted over the Internet by the alleged terrorist Khalid
Ibrahim, a member of Harkat-ul-Ansar, a militant Indian separatist group on
the State Department's list of the thirty most dangerous terrorist organizations
in the world, he assumed Ibrahim worked for the feds. There are myriad reasons
law enforcement has not been up to the task of combating digital crime. First,
there is the dot com brain drain. The best and brightest take their pensions
and jump to tech companies that pay three times their annual government salary.
(You never hear of a top chief technology officer leaving his six-figure job
to take a position with the FBI.) Or they start their own consultant firms.
Law enforcement agents are also hampered by the realities of cyberspace. Unlike
a crime scene in the real world, you can't seal off the entire
computer network to a massive e-commerce site like Yahoo! Traditional crime-solving
methods that have proved successful against terrorism and street crime don't
work in the vagaries of cyberspace. Yet the FBI is stretched so thin, it often
sends street agents to cover computer crime cases, the type of people who wouldn't
know a URL from a UFO. Which is why the Bureau is viewed in such a dim light
online. "The FBI is clueless when it comes to hackers," says Martin.
"Their idea of a crime strategy is to track down rumors over the Internet
in the hopes that someone is dumb enough to admit something."
This was the method they used to track who they thought
had committed the February 2000 denial of service attacks. A week after the
first wave, the FBI thought it had found its malicious geek: a pimply faced
twenty-year-old "script kiddie" with low-level computer skills who,
investigators believed, launched the electronic barrage from his job in tech
support at a major auto parts supplier in Dearborn, Michigan. Although speculation
had been running wild as to the identity of the culprit, hackers, crackers,
pirates, and thieves treading on the seamy side of cyberspace were committing
"serial bragging": taking credit for the attacks on hacker chat channels.
Many had blithely assumed the name "MafiaBoy," one of the potential
perps mentioned in a stream of news stories about the investigation. There were
dozens of MafiaBoys running around the Internet in the days and weeks after
the DOS. But one hacker wannabe stood out from the rest. "Pig Farmer,"
also known as "Eurostylin" and "Bean Farmer," had e-mailed
Martin at the attrition site (he said he was a fan) right after the first wave
of attacks, bragging about his exploits. When he couldn't answer simple questions
about the assaults, however, he was dismissed as yet another crackpot craving
As the real culprits unleashed torrents of electronic
packets at more e-commerce sites over the course of the week-Amazon, Charles
Schwab, Datek, ZDNet, and Lycos, among many others-Pig Farmer widened his contacts,
sending mail from America Online to dozens of journalists in the hopes someone
would listen to him. But nobody would. In an Internet Relay Chat (IRC) with
some alleged cronies, Pig Farmer, ostensibly named because his parents have
a farm where they raise pigs, beans, and corn, wrote: "I have sent 15 journalists
an e-mail so we can get our message out. They have not responded to us, but
the ones who have say we are not legit but we'll show them." He also brashly
claimed he would hit CNN and Time Warner the next day, and they were attacked.
When Martin asked him after the first wave of attacks
why he was doing this, Pig Farmer responded: "If you notice the targets,
They are all PUBLICLY traded companies, This was an attempt to put a "Scare"
into internet stock holders." But without hard evidence, Martin still couldn't
be sure. He then passed on the e-mail that Pig Farmer had sent him to James
M. Atkinson, founder of Granite Island Group of Gloucester, Massachusetts, a
company that specializes in technical surveillance countermeasures. Atkinson,
in addition to conducting bug sweeps of corporations, is also an expert hacker
tracker. Because Atkinson has close ties to law enforcement, he knew agents
had nothing on Pig Farmer, and was floundering in its investigation of the DOS
attacker. All he had to start with was Pig Farmer's e-mail, which was a shame.
It was no way to conduct an investigation. But Atkinson decided he would donate
a few days of his time to see if he could help out.
It took almost no time for him to locate Pig Farmer's
file directories and home page on AOL, complete with pictures of a barn, trailer,
and souped-up car. Atkinson, who conducted hundreds of analysis projects like
this, was not in the business of catching digital criminals. His company focused
on bug sweeps, wiretap detection, and protecting corporations and government
agencies from illegal surveillance or technical espionage.
"It took me 23 minutes to find out who the
guy was," Atkinson says. "The way you catch mischief makers is you
look for minutiae and small mistakes they make. When Pig Farmer reached out
to media people, he left a trail that led back to him."
On the AOL home page, Atkinson found a photo of a bright
red 1999 Dodge sports car with chrome wheels and, most important, tinted windows.
Pig Farmer had deleted the license number from the photo, but he kept the car
waxed and shiny and Atkinson was able to extract an image of his target by taking
a photo of his car with a Sony digital camera using a flash in bright sunlight.
Pig Farmer had received a ticket for the tinted windows, something he seemed
proud of since he tried to unsuccessfully scan the image into his home page.
But the file got corrupted. Of a 680-kilobyte file, only 630K got through. Atkinson
downloaded the entire site into his Silicon Graphics workstation and recovered
the fragments of the damaged document. On the ticket, he had eradicated his
name and address, but not the number on the ticket, nor the license number of
his car, the date, or the time. Atkinson made a call to the Michigan State Police
and within nineteen minutes an officer phoned back with the potential perp's
name, address, and other relevant information.
Pig Farmer "bragged about the attacks before, during
and after," Atkinson says. "He seemed to do everything he could to
draw attention to himself." With Janet Reno screaming behind the scenes
that she wanted to hold a press conference announcing an arrest, the FBI got
more than a dozen subpoenas and brought Pig Farmer in for questioning. But it
didn't take long for agents and Department of Justice attorneys to realize all
they had was a twenty-year-old hacker wannabe who had wasted their time. Pig
Farmer had been reading everything he could of the DOS attacks through the media,
then immediately crowed about it online in chat channels and through e-mails.
If bragging were a crime, Pig Farmer might be serving a life sentence. Instead,
the feds had to let him go.
Of course, "if hackers didn't brag, I wouldn't
have a job," says a man who goes by the initials "J3," who trolls
the hacker underground, monitoring discussion channels on Internet Relay Chat,
checking out the latest info on "phreaking,"-cracking the phone system-dialing
up bulletin boards and checking out web sites that offer password-cracking software
and how-to guides. For J3 this isn't just a hobby, it's a job. The computer
security firm ICSA hired him to as a kind of hacker spy. When he gets wind of
a new security hole, he passes the information on to ICSA's tech staff so that
the company can either develop a defense or tip off software makers before the
flaw can be exploited. "I've found a company's entire password file posted
to a web site, or that hackers have root in a network or that a merchant site
with a database of credit cards has been compromised," he says. "I
then contact the companies and warn them."
Yet the hacks keep on coming, and law enforcement has
had little success in catching those responsible. That indicates that despite
the contentious relationship between hackers and corporate America it's only
a matter of time before spies turn to the Internet to syphon away valuable R&D
from business competitors. It doesn't take William Gibson-like imagination to
see why cyberspace will be the corporate battleground of the future.
The rise of colossal databases and innovations in data-sifting
technologies have created an informational glut, with the spread of the web
the final step. A talented hacker can uncover corporate secrets instantly with
a few taps of the keyboard. For decades this information rested in remote mainframes
difficult to access, even for the ones who put it there, or were filed away
in dusty cabinets at corporate headquarters. The move to desktop PCs and local
servers in the 1990s has distributed this data far and wide. Computers now hold
half a billion bank accounts, half a billion credit card accounts, 200 million
credit history files (approximately one for each American over eighteen), hundreds
of millions of mortgage and retirement funds, medical claims, and more. That's
just on the consumer end. There are also thousands of corporate computer networks
accessible from the outside over phone lines, since its employees have to be
able to dial in remotely. But letting in some and keeping out others, while
providing basics like e-mail and Internet surfing, is challenging. No amount
of computer security has been able to keep hackers out. If a company has a web
site, it is vulnerable to a computer miscreant sneaking in right through the
company's virtual welcome mat: its home page.
This was how a lone fifteen-year-old tenth-grader from
suburban America cracked India's most important nuclear research center in Bombay
in May 1998. He was watching TV coverage of India's underground nuclear tests
and for some reason it stuck in his craw. He was not sure exactly why. After
all, he was much too young to remember Hiroshima, Nagasaki, and the Cuban Missile
Crisis. He couldn't even find India on the map. Some Third World hole that couldn't
even feed its own people was getting into a nuclear arms race with Pakistan
and China. The more he thought about it, the madder he got, so he decided to
wreak vengeance on the Indians. And he would accomplish this without leaving
his bedroom. In cyberspace, where the young hacker spent much of his life, he
went by the nick "t3k-9," pronounced "Tech-9." He was especially
adept at cracking passwords and log-ins, the keys to illegally accessing computer
systems. On this particular day, t3k-9 stomped upstairs carrying his favorite
hack snacks-chocolate Poptarts, Coca-Cola, and sour jawbreakers-and went to
his bedroom, where he booted up his computer and listened to the comforting
squawk of his modem. He checked in with search engine Infoseek, and plugged
in ".in atomic," the equivalent of typing "India, atomic research."
One of the first sites to come up was India's Bhabha Atomic Research Center
(BARC), which he read had been instrumental in helping India develop the A-bomb.
He pointed and clicked his way to the BARC site and
accessed the John the Ripper DES Encryption Cracker software he had downloaded
off the Internet, where literally thousands of complex hacker applications and
"how-to" guides are available from web sites and hacker chat channels.
The password cruncher worked by setting up a phony log-in program so that BARC
thought it was accepting a connection from a friendly machine. Then, by brute
force, the cruncher tried every single combination of letters and numbers until
it hit the jackpot.
First, the application ran through all the lettered
combinations at the speed of digital light-a, b, aa, bb, cc-then after going
through the entire alphabet, backtracking to ab, ac, ad, and so forth. t3k-9
had also added special customized word lists that combine letters and numbers
he'd downloaded over the course of his travels. Forty-five seconds after he'd
started, t3k-9 was amazed to discover that he'd cracked one of the passwords.
He was inside India's number one atomic research network. His eyes bugged. He
checked the password: "ANSI." Someone's name, he thought, the same
as the log-in prompt. He couldn't believe his luck. The administrator hadn't
followed standard password selection rules, which would have meant complex strings
of numbers and letters-more difficult to crack because the longer it takes,
the greater the likelihood you'll get caught.
t3k-9's first step was to download all the passwords
and log-in names. Then he installed a back door that would enable him to gain
entry into the system without being detected. After that, he consulted the network
map, which was open to public display. He headed over to the web server and
read through e-mails written in scientific geek-speak, then riffled through
some documents on particle physics. Boring stuff, he thought. He decided to
get out while the getting was good, downloading a few e-mails and a scientific
document for souvenirs. Then, after erasing logs to ensure no one would be able
to track him, he logged off.
If he'd kept this to himself, no one would have ever
known. And in the days to follow, India's top nuclear research facility would
probably never have suffered the ignominy of perhaps 100 hackers running roughshod
through its computer network like gangs on a rampage. But t3k-9 couldn't keep
mum. He did what every self-respecting hacker would do. He bragged. He posted
the whole BARC password file-all 800 passwords and log-in names-on one of the
hacker channels. Immediately, hackers began accessing this information and attacked
Bhabha. Within days hackers from all over the world were wilding through the
research center's computer systems, deleting files and copying e-mails, including
one that questioned the legitimacy of one of the explosions, and tearing down
the web site, replacing it with a mushroom cloud and a giggly greeting. If t3k-9
had been a terrorist or corporate spy instead of a kid who found physics papers
lame, who knows what he could have downloaded?
Thus far, corporations have shown much less imagination
than t3k-9, although they are beginning to keep tabs on their rivals over the
Net: "We know our competitors check out our web site because we track their
domain names," says Michael Renda, a manager of Internet projects at AlliedSignal.
"And of course, we do the same to them." The Net makes it a snap to
check out a competitor-its prices, customer lists, suppliers, distributors,
and new product information, because companies are caught between two conflicting
missions: providing customer and partner information available over the Internet
and at the same time protecting their proprietary information.
DuPont on its web site offers anyone with access to
a computer and a modem a list of every factory and yarn spinner the company
uses in the production of the fabric CoolMax, which is used in athletic apparel.
"They list factories and yarn spinners, their addresses, plant managers,"
says Mary Ellen Bates of Bates Information Services of Washington, D.C. "You
can call suppliers-are they paying you enough, asking you to provide a new fabric,
threatening to move operations to Shanghai? If you want to make a competing
product you try to schmooze the plant managers. I don't see why it's beneficial
to DuPont to display this kind of stuff."
Rumors abound on the Net about hackers being hired by
corporations to steal proprietary information or money, but cases that come
to public light are rare. Companies have been known to get victimized over the
Internet in other ways, however. Until recently corporations parked whole divisions
of employees and their direct report chain on their web sites, along with corporate
profiles and résumés. Boeing on its web site listed the personnel
of whole divisions, hundreds and hundreds of workers, including those who worked
on technology used in the space shuttle. The Aerospace company's web site used
to be "a gold mine for a competitor that would like to hire away staff
who come with lots of sensitive information," says Robert D. Aaron of the
Atlanta-based research firm Aaron/Smith Associates. "And you know who to
talk to about each person. You can call up their boss, work your way up the
organizational chart, and find out information about an executive, his background,
how he is to work for." Eventually Boeing got wise and pulled this material.
To a hacker like Chameleon, however, accessing harder-to-get
information requires more talent and skill. Before Maiffret escaped a severe
addiction to hacking to grab a lucrative chunk of the dot com craze, he spent
most of his days locked in his room in the southern Californian suburban home
he shared with his mother and sister, plugged into his computer for thirty-six-hour-long
hack sprees, probing networks to learn about the latest architectures, Internet
servers, software exploit scripts and techniques, coding and decoding software,
chatting up girls via e-mail and instant messaging, including one virtual relationship
that he says ended disastrously, and dissecting back issues of Phrack, an online
Only when he couldn't keep his eyelids propped open
any longer would he pull himself away from his virtual existence, crawl across
the carpet to a corner of his room, and curl up on a comforter to catch some
REM. "I preferred sleeping on the floor because I rarely slept," Maiffret
recalls. School wasn't relevant. He stopped attending. The twenty-four-hour
clock lost meaning; his life had been shaped into two seamless parts: cyberspace
Not only was Chameleon known for his technical skills
and respected as an "elite," or in the digital lexicon of the Net,
"3l33t" hacker, he also viewed himself as a kind of twenty-first-century
electronic poet and political activist. When he cracked a U.S. Department of
Defense web site dedicated to artificial intelligence, he wrote: "It's
funny how people go through life searching for the truth, yet when they find
it they wish they hadn't searched for it. The truth is a virus and people don't
want to get it. Live and deal with the truth, because sooner or later you will
have to face it." For fun, Chameleon slipped in a piece of software that
played the whistley theme to the X-Files every time someone accessed the page.
His first brush with fame came when he was seventeen,
and ironically, for something he didn't do. At the time, Chameleon was affiliated
with a hacker band called "Noid," with whom he had penetrated dozens
of corporate networks, joyriding around the computers, riffling through servers
and files, "to see how things worked," Maiffret says. At the time,
the big news in computer security was that a hacker group called the Masters
of Downloading (MOD) had stolen a piece of military software called DEM, or
the Defense Information Systems Network Equipment Manager.
CBS News managed to get word to MOD, but since members
were based in Europe, they told CBS to talk to Chameleon. Since he didn't want
to do the show alone, Chameleon grabbed his roommate, a "phone phreaker"-someone
who manipulates the telephone system to get what he wants-and they marched down
to the studio. To protect their identities their faces were shadowed and voices
modulated. But Chameleon had no intention of saying anything remotely incriminating,
at least nothing true, so he lied. "I never
claimed I stole the software; I said MOD did it, because that was true. But
I did say I was a member of MOD. Man, and man, what a stupid lie!"
Shortly afterward Chameleon was pinged online. Someone
by the name of Ibrahim told him he wanted the software. He kept messaging Chameleon,
saying he'd pay good money for it. "At first I thought it was a guy messing
with me; happens all the time on IRC," Chameleon says. "I played along,
even though I thought it was b.s. But then the guy told me to check a P.O. box"
three towns over from where Chameleon lived in Irvine, California.
When he got there, he peered inside the box. The lone
piece of mail was a pink slip. A certified letter. This meant you had to sign
for it. Which meant if the guy was an undercover agent, Chameleon could be in
big trouble. He and his Noid boys had been extra busy lately, having defaced
a slew of web sites in recent weeks. "We had gone on a spree, 10 or 12
sites, including the Army, Navy, Air Force-hell, we hacked one of each of the
three branches of the military," Chameleon says. But he also realized his
interactions with Ibrahim had been 100 percent legal, at least from his side.
"Even if he was FBI, I hadn't given him software or anything," Chameleon
says. So he opened up the box, grabbed the pink slip, marched up to the counter
and accepted two $500 money orders. Written on the envelope was a pager number,
a contact in Chicago. Chameleon wadded up the envelope and chucked it in the
Okay, maybe the guy is a terrorist, Chameleon thought,
or maybe he's FBI. Nevertheless, he filled out the money orders and cashed them
at a bank down the street. "I would never rip anyone off but I had no problem
doing it to a terrorist. Besides, that was a hell of a lot of money for me back
then," he says. He took most of his booty and bought a Nintendo 64 game
for his mentally handicapped sister, since "the doctors told me any toy
that requires hand-eye coordination would be good for her." He used the
rest to tool around town and fly up to San Jose to visit a friend. Meanwhile
Ibrahim kept trying to raise him over IRC, the messages becoming more threatening.
"I gave you money and what the fuck? I don't want to have to go back to
my people and tell them you ripped us off," Ibrahim wrote.
Afraid, Chameleon stopped venturing online.
But this didn't prevent him from waking up with a jolt
a few mornings after, a gun nuzzling his temple.