Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground (2 page)

Then one of the geeks did something the cowboys weren’t expecting: He stood up. Tall and broad shouldered, Max Butler cut a quietly imposing figure that was enhanced by his haircut, a spiky punk-rock brush that added three inches to his height. “Waver?” Max asked calmly, feigning ignorance of the Boise slang for New Wave music fans and other freaks. “What’s that?” The two cowboys blustered and swore, then finally drove away with a screech of tires and the waving of mud flaps.

Since they met one another in junior high, Max had become the unofficial bodyguard in the klatch of fellow computer nerds in Meridian, Idaho, a bedroom community then separated from Boise by eight miles of patchy farmland. The town fathers had named Meridian a century earlier for its placement directly on the Boise Meridian, one of the thirty-seven invisible north-south lines that form the Y-axes in America’s land survey
system. But that was probably the only thing geeky about the town, where the high school rodeo team got all the girls.

Max’s parents had married young, and they’d moved to Idaho from Phoenix when he was an infant. In some ways, Max combined their best qualities:
Robert Butler was a Vietnam veteran and enthusiastic technology buff who ran a computer store in Boise. Natalie Skorupsky was the daughter of Ukrainian immigrants—a humanist and a peacenik, she liked to relax in front of the
Weather Channel and nature documentaries. Max inherited his mother’s clean-living values, eschewing red meat, cigarettes, and alcohol and drugs, except for an ill-fated experiment with chewing tobacco. From his father, Max acquired a deep passion for computers. He grew up surrounded by exotic machines, from giant business computers that could double as an office desk to the first suitcase-sized “portable” IBM compatibles. Max was allowed to play with them freely. He started programming in BASIC at the age of eight.

But Max’s equilibrium disappeared when his parents divorced in his fourteenth year. His father wound up in Boise, while Max lived in Meridian with his mother and his younger sister, Lisa. The divorce devastated the teenager and seemed to reduce him to two modes of operation:
relaxed, and full-bore insane. When his manic side flared, the world was too slow to keep up; his brain moved at light speed and focused like a laser on whatever task was before him. After he got his driver’s license, he drove his silver Nissan like the accelerator was a toggle switch, speeding from stop sign to stop sign, wearing lab goggles like a mad scientist conducting an experiment in Newtonian physics.

As Max protected his friends, they tried to protect Max from himself. His best buddy, a genial kid named Tim Spencer, found Max’s world exciting but was constantly reining in his friend’s impetuousness.
One day he emerged from his home to find Max standing over an elaborate geometric pattern burning in the lawn. Max had found a canister of gasoline nearby. “Max, this is our house!” Tim shouted. Max sputtered apologies as the pair stamped out the blaze.

•  •  •

It was Max’s impulsive side that made his friends resolve not to tell him about the key.

The Meridian geeks had found the key ring in an unlocked desk at the back of the chemistry lab. For a time, they just watched it, sliding open the desk drawer when the lab instructor wasn’t around and checking to see if it was still there. Finally, they swiped it, smuggled it from the lab, and discreetly began testing its keys against various locks on the Meridian High campus. That was how they discovered that one of the keys was a master key to the school; it opened the front door and every door behind it.

Four copies were made, one for each of them: Tim, Seth, Luke, and John. The key ring was returned to the darkness of the chem lab desk after being carefully wiped down for fingerprints. They all agreed that Max must not know. A master key to the high school is a very special talisman that must be wielded with great care—not squandered on foolishness. So the juniors vowed to save the key for an epic senior-year prank. They would sneak into the school and hijack the PA system, blaring music into every classroom. Until that day, the four keys would stay in hiding, a burden borne in silence by the four of them.

Nobody liked keeping secrets from Max, but they could see that he was already on a collision course with the school’s administrators. Max scoffed at the curriculum, and while instructors droned on about history or sketched equations on the blackboard, Max would sit at his desk thumbing through computer printouts from dial-up bulletin board systems and the pre-Web Internet. His favorite read was an online hacker newsletter called
Phrack
, a product of the late-1980s hacking scene. In its plain, unadorned text, Max could follow the exploits of editors Taran King and Knight Lightning, and contributors like Phone Phanatic, Crimson Death, and Sir Hackalot.

The first generation to come of age in the home computing era was tasting the power at its fingertips, and
Phrack
was a jolt of subversive, electric
information from a world far beyond Meridian’s sleepy borders. A typical issue was packed with tutorials on packet-switched networks like Telenet and Tymnet, guides to telephone-company computers like COSMOS, and inside looks at large-scale operating systems powering mainframe and mini-computers in air-conditioned equipment rooms around the globe.

Phrack
also diligently tracked news reports from the frontier battleground between hackers and their opponents in state and federal law enforcement, who were just beginning to meet the challenges posed by recreational hackers. In July 1989, a Cornell graduate student named Robert T. Morris Jr. was charged under a brand-new federal computer crime law after he launched the first Internet worm—a virus that spread to six thousand computers, clogging network bandwidth and dragging systems to a halt. The same year, in California, a young Kevin Mitnick picked up his second hacking arrest and received one year in prison—a startlingly harsh sentence at the time.

Max became “Lord Max” on the Boise bulletin board systems and delved into phone phreaking—a hacking tradition dating to the 1970s. When he used his Commodore 64 modem to scan for free long-distance codes, he had his first run-in with the federal government: A Secret Service agent from the Boise field office visited Max at school and confronted him with the evidence of his phreaking. Because he was a juvenile, he wasn’t charged. But the agent warned Max to change course before he got in real trouble.

Max promised he’d learned his lesson.

Then the unthinkable happened. Max noticed an odd shape on John’s key ring and asked what it was. John confessed the truth.

Max and John entered the school that very night and went berserk. One or both of them scrawled messages on the walls, sprayed fire extinguishers in the hallways, and plundered the locked closet in the chemistry lab. Max carted off an assortment of chemicals and piled them into the backseat of his car.

Seth’s phone rang early the next morning. It was Max; he’d left Seth a gift in his front yard. Seth walked out to find the bottles of chemicals sitting in a pile on his lawn. Panicked, he scooped them up and took them into the back, where he grabbed a shovel and started digging a hole.

His mother stepped out back and caught Seth in the act of burying the evidence.

“You know I have to tell the school now, right?” she said.

Seth was brought into the principal’s office and interrogated, but he refused to name Max. One by one, the other Meridian High geeks were dragged in by the school’s uniformed security officer for questioning, some in handcuffs. When it was John’s turn, he spilled the beans. The school called the police, who found a telltale yellow iodine stain in the back of Max’s Nissan.

The chemical theft was taken very seriously in Meridian. Max was expelled from school and prosecuted as a juvenile. He pleaded guilty to malicious injury to property, first-degree burglary, and grand theft, and spent two weeks at an in-care facility under psychiatric evaluation, where the staff diagnosed him as bipolar. His final sentence was probation. His mother sent him to Boise to live with his father and attend Bishop Kelly, the only Catholic high school in the state.

Max’s first criminal conviction was a minor one. But the impulsiveness and mischievousness that spawned it ran deep in Max’s personality. And he was destined to hold a lot more master keys.

HIS is the Rec Room!!!!

This large, darkened room has no obvious exits. A crowd relaxes on pillows in front of a giant screen TV, and there is a fully stocked fridge and a bar
.

Those words welcomed visitors to TinyMUD, an online virtual world contained in a beige computer the size of a minifridge squatting on the floor of a Pittsburgh graduate student’s office. In 1990, hundreds of people from around the globe projected into the world over the Internet. Max, now a freshman at Boise State University, was one of them.

The Internet was seven years old then, and about three million people had access through a measly
three hundred thousand host computers at defense contractors, military sites, and, increasingly, colleges and universities. In academia, the Net was once seen as too important to expose directly to undergraduates, but that was changing, and now any decent U.S. college allowed students online. MUDs—“multi-user dungeons”—became a favorite hangout.

Like most everything else on the pre-Web Internet, a MUD was a purely textual experience—a universe defined entirely by prose and navigated by simple commands like “north” and “south.” TinyMUD was distinct as the first online world to shrug off the Dungeons and Dragons–inspired rules that had shackled earlier MUDs. Instead of limiting the power of creation to select administrators and “wizards,” for example, TinyMUD granted all
its inhabitants the ability to alter the world around them. Anyone could create a space of his own, define its attributes, mark its borders, and receive visitors. Inhabitants quickly anointed the user-created recreation room the world’s social hub, building off it until its exits and entrances connected directly to TinyMUD spaces like Ghondahrl’s Flat, Majik’s Perversion Palace, and two hundred other locales.

Also gone from TinyMUD was the D & D–style reward system that emphasized collecting wealth, finishing quests, and slaying monsters. Now, instead of doing battle with orcs and building up their characters’ experience points, users talked, flirted, fought, and had virtual sex. It turned out that freeing the game from the constraints of Tolkienesque roleplay made it more like real life and added to its addictive power. A common joke had it that MUD really stood for “multi-undergraduate destroyer.” For Max, that would prove more than just a joke.

At Max’s urging, his girlfriend Amy had joined him in one of the TinyMUDs.
*
The original at Carnegie Mellon University had closed in April, but by then the same free software was powering several successor MUDs scattered around the Net. Max became Lord Max, and Amy took the name Cymoril, after a tragic heroine in Michael Moorcock’s Elric of Melniboné series of books and short stories—some of Max’s favorites.

In the stories, Cymoril is the beloved of Elric, a weak albino transformed into a fearsome wizard emperor by dint of a magic sword called Stormbringer. To Max, the fictional sword was a metaphor for the power of a computer—properly wielded, it might turn an ordinary man into a king. But for Elric, Stormbringer was also a curse: He was bound to the sword, fought to tame it, and was ultimately mastered by it instead.

Elric’s epic, doomed romance with Cymoril was very much of a piece with the fraught, uncompromising vision of romantic love Max had formed after his parents’ divorce: Cymoril meets her fate during a battle between Elric and his hated cousin Yyrkoon. Cymoril pleads with
Elric to sheath Stormbringer and stop the fight, but Elric, possessed by rage, presses on, striking Yyrkoon with a mortal blow. With his last breath, Yyrkoon exacts a heartbreaking revenge, pushing Cymoril onto the tip of Stormbringer.

When she first met Max, Amy thought he was cool, rebellious, and kind of punky—different from the usual Boise crowd. But as they spent every free moment together, she began to see a darker, obsessive side to his personality, particularly after he introduced her to the Internet and TinyMUD.

At first Max was thrilled that his girlfriend shared his passion for the online world. But as Amy started making friends of her own in the MUD, including guys, he became jealous and combative. To Max it made no difference if Amy was cheating on him in the virtual world or the real one: It was cheating either way. He tried to get her to stop logging on, but she refused, and the couple began arguing online and off.