The Fugitive Game: Online With Kevin Mitnick (23 page)

MIN: 206-310-4335
ESN: XXXXXXXX
Dialing: 303-757-2227

Young wants to tail him. His wife has other ideas.

"What about that movie you promised me?"

The couple drive to the small, alternative movie theater in time to
catch the seven o'clock show. For dinner, they grab a little pasta at the
nearby Italian restaurant with the opera singers. But their after-dinner
entertainment is back on Brooklyn Street. Young parks in the school
lot. It's the late show, starring Brian Merrill, at about 10:30 p.m.

"So what has this guy done?" Mrs. Young asks her husband.

Young runs down the little he knows about Brian Merrill, and
Mrs. Young is anything but impressed.

"Why do you even bother?" she asks. "He seems so small-time."

"He's bigger than you think," Young tells her. "This guy's on the
brink of what's possible."

"SHHHHHHHHHHHHH!"

Mrs. Young turns to her husband. "What's that noise?"

"That's him," he says with a smile. "He's dialing a modem."

Time passes. To Mrs. Young, the modem tone sounds soft, invis-
ible, like a breeze.

"Is he still on?"

"Yeah," he answers.

And then, suddenly, nothing.

"There he is!" Young says.

Out on the street, the now familiar Brian Merrill, a cell phone
against his ear. The time is 10:50 p.m. He's making another call.

MIN: 206-310-4335
ESN: XXXXXXXX

Dialing: 303-757-2227

Young knows this number. It's a voice line in Denver.

Young and his wife trail slowly in the Jeep, pass Merrill at the
Burger King, and pull into the Jack In the Box lot.

But the Skip Jacker takes an unexpected turn and walks straight
toward the couple. Young snaps the laptop shut and shoves the Dop-
pler directional finder down on the floor.

"Quick, give me a kiss," Young whispers.

Oblivious, Brian Merrill strides by.

"Where do you think he's going?" Mrs. Young asks, pressed
against her husband.

Seconds later, the couple follow on foot, half a block behind.
Young drags his wife into a doorway when they seem a little too
close for comfort, but they don't have long to wait to find out where
he's going. The Skip Jacker's human; the Skip Jacker needs food. On
this Saturday night, a couple of minutes before 11 o'clock, he walks
into Taco Bell.

"Keep walking!" Young urges his wife.

She wants a closer look. It's only natural. But Young tugs her
across the street, into a covered construction walk. They watch.

The Skip Jacker waits in line, orders, sits down, and eats, alone.

Young turns to his wife. "This guy doesn't have much of a social life."

A pattern? Mrs. Young wonders. He walked to the fast food joint
as if he'd done it dozens of times.

The bounty hunter thinks about what he's seeing. Fast food, no
sign of a car, an ordinary basement apartment. Whatever this Skip
Jacker is doing, he's not getting rich by ripping off cellular calls.

Suddenly, he leaves Taco Bell and turns to the right, onto
Brooklyn.

Young and his wife hop back in the Jeep and tail him. The Skip
Jacker snaps out his cellular. The L.A. roamer number pops up on
Young's laptop. This time, the call doesn't go through.

They keep following, approaching the Skip Jacker's block. He's
less than a hundred feet away.

"What does he look like to you?" Young asks.

"He's got curly hair, glasses," his wife says.

The Skip Jacker turns and stops. He stares right through Mrs.
Young.

"This guy's got the make on us," she whispers.

Kevin Mitnick is on the phone laughing uncontrollably.

It's Sunday evening, October 22. My wife and I just finished
watching
60 Minutes.
But Kevin Mitnick's got some real news. Mit-
nick's just hacked a hacker.

"We didn't get everything," Mitnick chuckles. "But we got the
stuff on the Oki phones."

The Oki is a cellular phone popular with hackers because of its
easy programmability. In other words, it can be hacked.

The victim is Mark Lottor, codefendant and former roommate of
Kevin Poulsen. (Charges against Lottor will be dismissed in 1996.)

"Lewis called him first," Mitnick explains excitedly. "He called
him on his cellular phone, on Mark's [Lottor's] phone, and said,
'Can I look at something on your machine?' " Mitnick chortles.
"Lottor was belligerent. He was getting perturbed."

How does Mitnick think people should react when De Payne de-
mands they open up their computer files?

"I figured he would be smart. I did a full investigation on him. I
spent a day of research in case he might use personal names or per-
sonal information for certain directories. I knew his parents, his girl-
friend. ..."

Mitnick isn't kidding. He's a dedicated hacker. When he picks a
target, he's thorough.

"His girlfriend's into art history. I looked at her account. It con-
tained her feelings about Mark. . .."

I try not to listen to the personal details. Lottor isn't just a name to
me, I've interviewed him in person several times, eaten dinner with
him, been to the condo where he keeps his impressive computers and
cellular phones.

"Lottor had his own Ethernet network tied to the Net," Mitnick
continues, describing the technical details of his hack. "Lottor runs
the provider. I narrowed it down, how his Ethernet connection
works, everything."

Mitnick chuckles. "Someone got in there seven times in a space of
a week —

"Could I see a menu, please?"

Without a pause, Mitnick's talking to somebody else.

"Sure," bubbles a waitress. I try but can't identify an accent.

"That's my suitcase there," Mitnick says protectively.

Suitcase? Are the feds onto Mitnick's new location? Or does he
always bring his suitcase, perhaps with his laptop and a scanner for
countersurveillance ?

"So then I phoned Lottor direct," Mitnick continues with his story.
"And he started getting belligerent, giving me false information."

Attitude. Mitnick phones a hacker under federal indictment and
orders him to hand over his computer files — or else. Mitnick has no
mercy.

"The guy [Lottor] is a hacker just like me," Mitnick rationalizes.
"He's not an innocent person. He's cracked Pac Bell. He's a hacker,
he hates authority. I'm just having fun with the guy. He's making
money, selling his Oki 900 program.

"I was interested to see if he reverse engineered the whole thing.
Man, he did!"

Mitnick still hasn't fully explained what Lottor's Oki software and
interface device does, but Lottor himself has told me it enables hackers
or cops to put people under surveillance. Hooked up to a HP Palmtop
or other small PC, Lottor's souped up Oki can follow a cellular call in
progress, picking up each handoff as the caller moves through the
cellular network. The phone can also be used to intercept and eaves-
drop on those very same calls. In other words, it's a mobile, low-cost,
illegal countersurveillance and eavesdropping system.

But that's just the part Lottor and his associates offer for sale.
What Mitnick wants is Lottor's reverse engineering of the phone's
basic operations. One reason he's switching to the Oki phone is
because it can transmit data at a fast 14.4 KBs (kilobytes per second),
more than ten times faster than the cellular phone he's been using. But
if Lottor has truly reverse engineered the phone, it means Mitnick
may be able to program it to do whatever he wishes. Maybe he wants
to program other people's ESNs into its memory to make free cellular
calls? Or perhaps he wants to add a security routine so if the phone
falls into federal hands the ESNs are automatically erased?

Mitnick orders. "Yeah, I'd like a Garden Burger, fries, and a large
Diet Coke."

Kevin Mitnick is in an American burger joint with his suitcase,
complaining about how hard it is for a cyberfugitive to find a good
attorney.

"Even Shapiro working with Simpson, he's asked for more
money. These attorneys don't care. I don't know if anybody has
defended a case that might take multiple jurisdictions: Finland, the
United Kingdom, Japan. A lot of countries want my ass. Somebody
did Nokia mobile phones in Finland. Somebody got into their com-
puters. They're out for blood. Man, I need another planet," Mitnick
sighs.

"Maybe I should go to France, join the French Foreign Legion,"
Mitnick considers, then thinks twice about the wild idea. "They send
you into covert missions. That would be a problem. I'm not going to
look into mine fields."

"So where are you thinking of going?"

"Brazil. Argentina. I can't tell you what I'm thinking!"

Ivan Orton, a fortyish, red-
haired prosecuting attorney in
the King County, Washington, Prosecutor's fraud division, sits on a
stool and peers down at his 486 PC, its screen oddly recessed into an
architect's drafting table. Behind him sits a 2.86 PC that answers his
phone, and a CD-ROM PC. There's a worn leather sofa, and a deli-
cately carved armoire with the half dozen suits, shirts, and ties he
wears for the few days he must appear in court. Boxes of documents
clutter his office.

Todd Young of the Guidry Group is on the line. It's the morning
of October 26. Nineteen days have passed since Young first found
the Skip Jacker, and Orton listens carefully to the familiar political
Ping-Pong game. Young and his client, CellularOne, have run out of
places to turn. It's a story the prosecutor has heard before. Orton's
the guy people call when the cops tell them to get lost.

After hanging up, Orton walks down the hall to his boss. Orton
could care less about CellularOne billing losses. What intrigues the
prosecutor is the idea that criminals can disguise their cellular calls.
His gut tells him that soon all kinds of fraud will revolve around cell
phones.

"Somebody's out cloning phones," Orton tells his boss, filling him
in on the bureaucratic wrangling. The Secret Service isn't interested

because the case doesn't meet its $25,000 threshold. Seattle PD de-
clined because they felt the Secret Service was trying to pass along its
"garbage." But Orton's boss doesn't care about the politics. He tells
Orton to change Seattle PD's mind.

Superior Court Judge Larry Jordan sits in his chambers and scans the
records of pirated calls, and the lengthy, precise description of the
suspect and his residence at 5227 Brooklyn Avenue. Ivan Orton,
Todd Young, Kevin Pazaski, and Detective John Lewitt of the Seattle
Police Department look on expectantly. Jordan flips to the last page
of the affidavit for a search warrant and signs on the line marked
"Judge."

It's Thursday, October 27, 1994, about 1 p.m., and Ivan Orton is
making things happen. He's convinced Seattle PD to execute the
search, and now they've got a signed search warrant. But still,
they're running out of time. Young is leaving the country on Friday
to teach a cellular fraud seminar in London. If they don't execute the
search fast, the Skip Jacker might split Seattle for good.

Detective Lewitt returns to his office at the Public Safety building
in downtown Seattle, logs onto a terminal, enters his ID code, and
taps in the name: Brian Merrill.

10/27/94 13:11:14 FROM ACCESS — DATABASE ID: DOL

FOR UNIT: RTW8

D. WASPD00W8.OLN/MERRIBD080559

NO COMPUTER RECORD FOUND.

Nothing. Lewitt pages down the screen.

** NO WACIC WANTED, MISSING OR RESTRAINING

ORDER RECORDS FOUND ** CHECKING NCIC

***DOC LOCATOR FILE HAS BEEN CHECKED ***

NO RECORD FOUND

QW.WASPD00W8.MERRILL, BRIAN D.080559

102794-130955

The detective keeps checking. Only one Brian Merrill is even
close. The hair color is off, the 1959 birthdate is a little too old, but
it's all he's got. Lewitt does another search. Could it be the same
Merrill? Lewitt's unsure. He pulls up the arrest record, a juvenile
charge.

Maybe it's the Brian Merrill they're looking for. Maybe it isn't.

■ ■ ■

Sergeant Ken Crow of Seattle PD, a trim forty-nine-year old with a
prominent nose, points to his hastily drawn diagram on the white
board. He's mapped out 5227 Brooklyn. Red felt pen for the build-
ing, blue for the front and side streets and the alley behind. Black X's
mark the agents and cops positioned south on 47th, in the alley, and
sprinkled through the building. Crow hands out the photos Lewitt
snapped half an hour ago, views of the alley, the main street and the
stairs.

Todd Young glances around the crowded north precinct confer-
ence room in amazement. He figured they'd round up a couple of
cops for the 6 p.m. briefing. But four Secret Service agents? And
that's just the feds! Young is surrounded by the entire Seattle PD
fraud unit: one captain, two sergeants, three detectives, two uni-
formed Seattle PD officers for backup, and one detective specially
trained to take down computers. Fifteen troops all told, counting
Young and Pazaski.