The Fugitive Game: Online With Kevin Mitnick (30 page)

"I can't tell you," I tell Mitnick. "But when people say things like
that, I think it has to do with our modern world. If somebody wants
to cause problems for somebody, they can obviously do it remotely
from thousands of miles away in an untraceable fashion. You're not
breaking somebody's leg or physically hurting them, but you can
certainly irritate them and cost them some time and even money. It
costs money to fix phones that are disconnected or accounts that are
closed."

"Accounts that are closed," Mitnick repeats, his voice pitching
higher. "Yes, it does!"

"It does."

"Houses that get moved!" Mitnick whoops. "You go on vacation
and when you get back, all you have is an empty lot!"

Mitnick can't stop laughing. I am too, but listening to Mitnick in
stitches, I can't help but wonder if he's ever actually pulled off this
incredible prank. I ask him.

"My other friend would do it in a second if he had the capability.
He would do it in a second! I can say the word "go" and there would
he like twenty people he would do it to. That's cold. I would never
do that. Some people he messes with, I approve of. Some I just say,
'Ah, have fun at it.' Who am I to judge?"

"What do you think about the fear out there that our world has
changed?"

"Yeah . .. That's why they're instilling fear of the unknown.
That's why they're scared of me. Not because of what I've done, but
because I have the capability to wreak havoc."

Afternoon,
January 19,1995

I try to make sense of Mitnick's
rambling calls: his anger at
U.S.
News & World Report
for dubbing him the world's most wanted
hacker, his sudden declaration that it's gotten too dangerous to
phone me, and then, what sounded like a crisis. That was strange,
talking to Mitnick at the very moment he learned his freedom may
be in jeopardy.

I also heard more proof of something I've long suspected, a tight
web of betrayal and denial that binds Lewis De Payne and Kevin
Mitnick. Why won't the world's most feared hacker confront his old
friend? At first, I chalked it up to to denial, but it's more than that.
De Payne must know too many of Mitnick's crimes, including ones
the authorities haven't caught on to. Perhaps Mitnick won't con-
front De Payne because he doesn't trust him.

To the public, Mitnick's a dark wizard of high tech, toying with
the FBI and major corporations. But the Mitnick I know is also a
lonely fugitive looking for somebody to talk to. Mitnick clearly
doesn't know what's good for him. He keeps confiding in an old
friend who gets his kicks out of putting him at greater risk, and now
he's taking another leap of faith, talking to me, a journalist. Mitnick
is no genius, but to me, that only heightens the dangers he symbol-
izes. If Kevin Mitnick can threaten the information superhighway,

then what does that say about who else may be threatening our elec-
tronic world?

Just now Mitnick boasted he could hack the federal witness pro-
tection program. If I were a former mob guy in the program and
Kevin Mitnick hacked for the Mafia, I wouldn't feel too safe right
now. It's a system, like any other system, and Kevin Mitnick under-
stands how computers and people work. Mitnick's told me that the
security claims of nearly every major Internet provider are an illu-
sion. I know firsthand that at least part of that claim is true. Why
might not Mitnick and other hackers be capable of far greater intru-
sions?

Still, I can't take anything Mitnick says at face value. He flaunts
his social engineering abilities, and there's no reason I shouldn't be a
prime target. He's constantly trying to diminish his crimes and exag-
gerate those of his enemies. But while I think Mitnick's a greater
danger to the public than he would have me believe, I suspect there's
some truth to what he says about his enemies. This morning, he
hinted that his NSA hacker nemesis isn't one of the good guys. Mit-
nick claims Shimomura helped write the OKI phone code that Mit-
nick swiped from Lottor last fall. He's linking Shimomura to Lottor,
a hacker under federal indictment.

But why would Shimomura flirt with the law and collaborate with
an indicted hacker? And how does Mitnick know so much about
Shimomura? Like his work number, his home number, his mom's
number.

What other Shimomura secrets does Kevin Mitnick have up his
sleeve?

■ ■ ■

The phone rings again, as it often does around 1:30 p.m. any day
except Sunday. It's the time hackers in jail are in the mood to chat.
Today, the automated Sprint operator is offering a collect call
from Kevin Poulsen at Mitnick's old haunt, the Los Angeles Metro-
politan Detention Center. Poulsen's working on his fourth year be-
hind bars, and he's still facing another federal case. He sounds
optimistic, and frankly I don't understand. Because he's been await-
ing trial, Poulsen's never enjoyed a federal camp like the Ivan

Boeskys and Michael Milkens of the 1980s. Kevin Poulsen's four
years in the 1990s have been hard time. He hasn't studied anything,
worked on a degree, or picked up a hobby. He smokes, reads a lot,
and beats everyone at Ping-Pong and chess. He has no plans because
he can't survive inside dreaming about the future when he doesn't
know if he's got one.

The light is already fading outside when the phone rings again.
"Sorry," says Mitnick, as if there hadn't been a two-hour gap in our
conversation. "I had to reroute my communications. I'm going to
have to give two weeks' notice just because of someone's
stupidity!"

If this is true, Mitnick is a remarkable hacker. Not only does he
work for a living when he's a fugitive, but he gives two weeks' notice
like a responsible employee.

"So before we got cut off, I said I guess you don't like me reading
your mail."

I say nothing.

"You're asking me about privacy? The only way to obtain privacy
is PGP [Pretty Good Privacy, a publicly available, powerful, non-
government form of encryption]. But you better not use PGP on the
host, you better use it on your home system. All these idiots! They
put their workstations on the Internet, and then they run their PGP
software on their UNIX box, right, and I just backdoor PGP, so it
stores their pass phrase somewhere."

Mitnick is saying that many people are just asking for hackers on
the Internet to backdoor their copies of PGP and swipe their secret
PGP keys. He's right. If they simply kept their PGP software and
keys on a machine not connected to the Internet, their encrypted files
would be a lot safer.

"What's that crunching sound on the line? What are you snack-
ing on?

"Caviar!" Mitnick declares with flourish.

"I'm eating caviar crunches and running your credit report."

I ignore the comment. "Let me ask you this —"

"If you don't write a
good
article, you're going to be
history."

I laugh. Mitnick laughs. Did he just threaten me?

"I'm just kidding," Mitnick quickly adds, becoming serious. "I
don't want to influence the way you write your story."

"If somebody wanted to protect themselves from cyberspace in-
trusions, what would you suggest they do?"

"Where people get hurt is their money," Mitnick says with au-
thority. "If you hurt their credit profile, it's a bitch to straighten out.
A way to protect yourself? It's hard if they mess with your credit."

"You mean I couldn't call up TRW [the national credit reporting
company] and say, 'I write about hackers, and who knows, one of
them might not like me one day?' "

"They're [TRW] secure,
very
secure," Mitnick snickers. "You
can call TRW up and ask them how to run credit reports and they
don't even ask who you are."

I laugh.

"You don't believe me," Mitnick snaps.

"No, I
do
believe you! What about your bank account?"

"The bank is vulnerable. I remember somebody who worked at a
private investigation company," Mitnick recalls, referring obliquely
to himself. "They used to track down accounts. The clients would
give them paperwork, say a lease on property. Then you'd get a bank
in Canada that wouldn't tell you anything. So then this person went
to the Xerox machine with a letter of release. He photocopied the
person's signature onto the letter of release and faxed it. This guy
accepted the signed letter from this person, saying, 'Please release my
bank records.' It worked like a charm," Mitnick chuckles. "If they
accept it over electronic media you're in trouble. . . ."

Mitnick's reliving the excitement, talking faster.

"They can send letters to your mortgage company that say 'Fuck
you.' They can send letters to your creditors, letters to all your busi-
ness relationships, saying, 'You're fucked. I'm
not
paying you.' All
these creditors start doing foreclosures. You can imagine the
head-
aches.
Everything is phone, mail, or signature."

"What about somebody trying to get access to funds in Bank of
America?"

"That's where they're worried," Mitnick says, never revealing ex-
actly who
they
are. "I was going to work in wholesale banking. I
would have been in charge of securing their wholesale banking net-
working. An executive let me look through their manuals." He
laughs heartily. "I think they thought that was a mistake."

Mitnick flushes the toilet.

"Who was that?" I ask, referring to the bank executive.

"Sandy. One of the past presidents of information security, Secu-
rity Pacific."

Now I can hear Mitnick tapping away on his keyboard.

"You're logging in while we're speaking. You're multiprocess-
ing?"

"I'm reading your e-mail," Mitnick teases.

"It's probably pretty boring today. So what were you going to do
at the bank?"

"I was going to be writing policies, I was learning about banking
security systems."

"So you would eventually have been doing security?"

"They were hiring me into the information security department as
a security analyst. I told Lenny [an old accomplice] if I get the job
I'm not going to hack anymore. I met the president, Ed, the president
of the area," Mitnick recalls nostalgically. "Three interviews. Then,
she [Sandy, the president of information security] called me."

Mitnick, half laughing, mimicks how the bank vice president
asked him if he had ever "dug in anyone's garbage cans." Mitnick
says he joked that was only when he was "looking for food." An
hour later personnel called and told him his references didn't
check out.

The incident happened years ago, but Mitnick's bitterness makes
it sound like yesterday. "Lewis was one of the references, but they
were all legit. On the application I marked 'never convicted.' I was
not convicted in the Santa Cruz case! All the juvenile stuff was
sealed. I didn't lie! It was sealed. When it is sealed you can legally
answer no."

■ ■ ■

"So what can I do to protect my credit? Can I ask TRW to do any-
thing?"

"There's a service. It's called "Protect My Friend Service," Mit-
nick chuckles. "You pay me a certain fee per month and I make sure
nobody causes you problems."

"Is this the Capone program?"

"Yeah. It's a new program. It was developed throughout the years
to protect stores and stuff, and now we're going into the computer
age."

Mitnick can't stop laughing. I can't either.

"I think you really need this service!" Mitnick howls.

"So what sort of services are provided?"

Mitnick catches himself, holding back the laughter. "Don't print
that
shit because someone's actually going to believe it!"

"There's nothing I can do, huh?" I say. "I can't call up TRW —"

"Protect it? No. It's already protected," Mitnick says facetiously.

"What would have to happen for there to be better protection for
the average —"

"The CEOs of these companies to get fucked
themselves,"
Mit-
nick thunders. "Somebody that counts. But you can install the best
security system there is and someone can find a way through. There
is no way. Just make it harder, so they go to the next guy.

"Seriously, if you wrote anything bad ... I don't want to preju-
dice you in any way." Mitnick reassures me. "I would never attack
you.
Unless ..
."

"Unless?"

Mitnick's voice is icy. "Unless you set me up so that I'd make calls
and everything."

"I don't play that game."

"And you're working for the government, coaxing me to call
you."

"I don't play that."

"I don't think you're doing it. I don't wanna taint your story. I
don't have enough time to mess with people because my own life is
too messed up," Mitnick grumbles.

This is supposed to put me at ease? Kevin Mitnick won't hack me
because he doesn't have the time.