Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground (3 page)

Eventually, Amy’d had enough; they were arguing about a stupid computer game? On a Wednesday night in early October 1990, the couple were in another user’s room in TinyMUD when Cymoril finally told Lord Max that she wasn’t sure they really belonged together after all.

It was Max’s first serious relationship, and his reaction was powerful. They had sworn to spend their lives united. Now they should both die, rather than be parted, he wrote in the MUD. Then he got explicit, telling her how he’d kill her. Other users watched with growing concern as his raging took on the tone of a serious threat. What should they do?

One of the in-world wizards got Max’s Internet IP address from the server—a unique identifier that was easily traced to Boise State University. The MUDers looked up the phone number for the Ada County Sheriff’s Department in Boise and called in a warning that a potential murder-suicide was unfolding.

The year had begun hopefully for Max. He excelled at the part-time job his dad gave him at his computer store, HiTech Systems, performing clerical work, making deliveries in the company van, and assembling PC-compatible computers in the shop. And he managed to stay clean of probation violations—though he’d stopped taking his bipolar medication; his father didn’t want him drugged, and, anyway, Max didn’t agree with the diagnosis.

He began dating Amy in February of 1990, four months after meeting her at the Zoo, a dance club in Boise that catered to an underage crowd. A year younger than Max, she was blond, blue-eyed, and, when he first saw her, on the arm of Max’s friend Luke Sheneman, one of the former Meridian key bearers. As Max finished up his last year in high school, they began getting serious.

Max did nothing in half measures, and his devotion to Amy was absolute. She planned on attending Boise State University, so Max applied there, postponing his dream of attending CMU or MIT. He brought her home to meet his computer, and the couple played Tetris together. Their relationship was everything his parents’ hadn’t been. They both thought it would never end.

His old friends barely saw him over summer break. Then the fall term began at Boise State. Max declared a major in computer science and enrolled in a battery of courses: calculus, chemistry, and a computer class on data structures. Like all students, he was given an account on the school’s shared UNIX system.
Like a few of them, he started hacking the computer right away. Max’s path was eased by another student, David, who’d already
worried his way into a bunch of the faculty accounts. They spent hours in the BSU terminal room, staring at the luminous green text of the terminals and banging on the clacky keyboards. They’d skim through faculty e-mail boxes while holding long, silent conversations, shooting messages back and forth across the room through the computer. David struggled to keep up with Max’s overclocked mind and typing speed, and Max would often get impatient. “What are you waiting for?” Max would type when David fell behind in the conversation. “Respond.”

A little local hacking was generally tolerated by administrators. But then Max started poking at the defenses of other Internet systems, earning him a brief ban from the BSU computer. When his access was restored, he was back on TinyMUD, fighting with Amy.

The sheriff called BSU’s network administrator at two in the morning to tell him about the murder-suicide threat. The police wanted a copy of Max’s computer files to examine for evidence—a request that raised difficult privacy issues for the college. After some discussion with the university’s lawyer, administrators decided not to voluntarily hand over anything. Instead, they’d preserve Max’s files on a computer tape and lock Max out of the computer at once.

Amy worried about what Max might do next, even as she pressed through the slow process of breaking up with him. She still cared about Max, she’d later testify, and was afraid he’d really hurt himself.

Max continued to call her after the TinyMUD incident, and the conversations followed a predictable pattern. Max would start off nice—showing the friendly, caring side that his friends and family knew well. Then he’d escalate into self-pity and threats before hanging up in anger.

On October 30, Max told Amy he wanted to talk to her in person. Still hoping to end the relationship amicably—she was bound to see Max on campus, and she didn’t want him hating her—Amy agreed to come over.

Max had just moved back to his mother’s home in Meridian, a ranchstyle house on a quiet street a block from his old high school. He met Amy at the door, and after reassuring her that he wouldn’t do anything crazy, she followed him to his bedroom at the back of his house. His mother was out, and his fourteen-year-old sister was watching TV.

His bed was still disassembled, so they sat together on the mattress on the floor and began discussing their feelings. Amy admitted that she’d met another boy in TinyMUD. His name was Chad, and he lived in North Carolina. The relationship had moved beyond the keyboard; they’d sent each other photos in the mail, and she’d been calling him on the phone.

Max struggled to control his feelings, holding back tears. He felt betrayed, he said. At the same time, he couldn’t quite believe what he was hearing. He asked her for Chad’s phone number, produced a calling card, and dialed his online rival.

A strained three-way conversation followed; Max introduced himself to Chad and then let Amy take over. She told Chad how she felt. Then Chad asked Amy for her phone number. She gave it to him, and the conversation drifted into an idle banter that only added to Max’s agitation. He grabbed at the phone and hung it up.

Amy watched Max carefully as his breathing intensified and his eyes darted around the room.

“I’m going to kill you,” he finally said. “I’m going to—you’re going to die now.”

She told Max that she didn’t feel like she’d betrayed him, and she wouldn’t apologize. Max began trembling. Then his hands were around her throat and he was pushing her down onto the mattress.

“Fine,” she said. “Why don’t you just kill me then?”

Once Max regained his self-control, he wanted Amy out of his sight. He pulled her from the mattress, pushed her out of his bedroom, and shuffled her through the house and out the front door.

“Go, now,” he said. “Just get out, because I don’t want to kill you. But I might change my mind.” Amy jumped into her car and took off fast.

As she headed back to Boise, she replayed the events in her mind. Lost in thought, she didn’t see the other car until she was slamming into it with a jolt and the crunch of metal against metal.

Both cars were totaled, but no one was seriously hurt. When Amy’s parents learned about the confrontation at Max’s house, though, they began to fear for her life. A week after the accident, Amy went to the police, and Max was arrested.

Max told his friends that Amy was exaggerating the incident. In Amy’s version of events, Max had kept her prisoner in his bedroom for an hour, his hands returning to her throat repeatedly, at one point briefly cutting off her breathing. In Max’s version, he’d put his fingers loosely on her throat for one minute, but he hadn’t choked her, and she was always free to leave. Amy said Max continued to phone her obsessively after the incident, issuing more threats; Max said he left her alone after pushing her out of his house. As far as Max was concerned, Amy was sacrificing him to get out of trouble for her car accident.

The county prosecutor offered Max a misdemeanor deal. But a month before he was scheduled to receive a forty-five-day slap on the wrist from the judge, Max—free on his own recognizance—spotted Amy walking hand in hand with a new boyfriend down University Avenue.

Once again, Max’s emotions overrode his common sense. On impulse he pulled his father’s repair-shop van onto a lawn and caught up with the couple on foot. His body was tight with tension as he circled the pair.

“Hi,” he said.

“You’re not supposed to be around me,” Amy said in protest.

“Don’t you remember what we used to have?”

Amy’s escort spoke up, and Max gave him a warning: “Better watch yourself, friend.” Then he stalked off. A moment later, the roar of an engine. Max was back in the van, zooming across the center line toward the
couple on the sidewalk. He passed close enough for Amy to feel the wind from the van as it tore off.

The deal was canceled. The district attorney stretched the law to slam Max with a felony charge of assault with a deadly weapon—his hands. It was a questionable charge: Max’s hands were no deadlier a weapon than anyone else’s.

The prosecution offered him a new deal: nine months in jail, if Max would admit to choking Amy. He refused. After a three-day trial, and just an hour and a half of deliberation, the jury found him guilty. On May 13, 1991, Tim Spencer and some of the other Meridian High geeks sat in the courtroom and watched as Judge Deborah Bail sentenced their friend to five years in prison.

ax found Tim Spencer’s house perched at a summit in the hills separating the suburban sprawl of the San Francisco Peninsula from the quiet, undeveloped towns clinging to the Pacific coast. But “house” was too small a word. It was a villa, six thousand square feet sprawling across a fifty-acre plot overlooking the sleepy coastal town of Half Moon Bay. Max passed through the entranceway columns to the double front doors and entered the cavernous living room, where a curved wall of windows stretched from floor to ceiling.

It was a year after his parole, and Max had come to San Francisco to start over. Tim and some of his friends from Idaho had been renting the house they called “Hungry Manor,” the name a reference to their first enterprise when they’d migrated to the Bay Area a year earlier. They’d planned to bootstrap into the Silicon Valley economy by forming a computer consulting business called the Hungry Programmers—will code for food. Instead, the valley quickly metabolized the geeks into full-time employment, and the Hungry Programmers morphed into an unofficial club for Tim’s friends from Meridian High and the University of Idaho, two dozen in all. Hungry Manor was the group’s party house and home to five of them. Max would be the sixth.

Max walked into Hungry Manor with few belongings but lots of baggage, not least a deep bitterness over his treatment by the justice system. In
1993, while Max was on his second year in prison,
Idaho’s Supreme Court ruled in a similar case that hands “or other body parts or appendages” couldn’t be considered deadly weapons. That meant Max should never have been convicted of aggravated assault. Despite the ruling, Max’s own appeal was denied on procedural grounds: The judge conceded that Max was technically not guilty of the felony for which he was serving time, but his old lawyer had failed to raise the issue in an earlier appeal, and it was too late now.

When Max was finally paroled on April 26, 1995, he left knowing that he’d served more than four years in the Idaho State Penitentiary for what, by law, should have been a misdemeanor worth sixty days in the county jail. He’d served hard time on an unjust sentence, while beyond the prison fence his friends had gone off to college, earned four-year degrees, then left Idaho to start promising careers.

He’d moved in with his dad near Seattle, and Tim, Seth, and Luke drove up from San Francisco for a reunion party of the old Meridian High geeks. They marveled at Max’s prison-enhanced physique and his seemingly boundless optimism, despite having no degree and a serious felony conviction on his record. Max knew it was a time of opportunity: A British computer scientist had created the World Wide Web three months after Max’s sentencing. Now there were nearly nineteen thousand websites, including one for the White House. Dial-up Internet service providers were surfacing in every major city, and America Online and CompuServe were adding Web access to their offerings.

Everyone was going online; Max was no longer the weirdo, addicted to a network nobody had heard of. Now, it turned out, he’d been at the head of a pack that was growing to include millions of people. Yet, thanks to his record, Max struggled to win computer employment in Seattle, working odd tech-support jobs through a temp agency.

Online, Max was hanging out in some rough neighborhoods. Looking for the technical challenges his day jobs denied him, Max returned to a network of chat rooms called IRC, Internet relay chat, a surviving
vestige of the old Internet of his teenage years. When he’d gone to prison, IRC had been a social hotspot. But with the gentrification of the Net, most inhabitants moved uptown to easy-to-use instant messaging clients and Web-based chat systems. Those who remained on IRC tended to be either hard-core geeks or disreputable sorts—hackers and pirates scheming in the forgotten tunnels and alleyways below the whitewashed, commercialized Internet growing above them.

Max fancied himself an invisible, spectral presence in cyberspace. He chose “Ghost23” as his IRC identity—23 was his lucky number, and among other meanings it was the I Ching hexagram representing chaos. He floated into the IRC “warez” scene, where scofflaws build their reputations by pirating music, commercial software, and games. There, Max’s computer skills found an appreciative audience.
Max found an unprotected FTP file server at an ISP in Littleton, Colorado, and turned it into a cache for stolen software for himself and his new friends, stocked with bootlegged copies of programs like NetXray, Laplink, and Symantec’s pcAnywhere.