The Fugitive Game: Online With Kevin Mitnick (56 page)

Kevin's mother, a slender woman in her early fifties, was down—

stairs in the waiting room wearing a purple sweater dress and flashy
costume jewelry. She too had been forced to hire an attorney and
travel from Vegas. She hadn't talked to Schindler, but Mitnick's
father believed the prosecutor had an agenda apart from getting the
hacker's immediate family to betray their kin. "They're trying to
break his support network, wear him down," he charged. "That's
what it's all about."

A few hours later, Schindler faxed a press release and a federal
indictment to reporters at the
Wall Street Journal,
the
Los Angeles
Times,
and numerous other members of the media. Richard Sherman,
Mitnick's attorney, was not faxed a copy of the indictment, and the
hacker had no idea he'd been indicted.

The twenty-five-count indictment against Mitnick and De Payne
was most remarkable for what it didn't say. Though De Payne was
indicted on fourteen of twenty-five counts, specific crimes alleged
against De Payne were included in only one count and, notably, there
was no charge of conspiracy against either defendant. The govern-
ment alleged De Payne had made a pretext call to con Nokia Mobile
Phones into mailing its software to a Compton, California, hotel, but
I recalled that Mitnick and De Payne had claimed that the call was a
prank to gauge the FBI's reaction. Although no software was ever
picked up, the government still considered the social engineering
attempt a crime. De Payne's main offense appeared to be "aiding and
abetting," allegedly providing Mitnick with cellular phones with
"stolen" electrical serial numbers and allowing him to use his Net-
com account to transfer some of his fraudulently obtained propri-
etary software.

Notably missing were any charges that Mitnick had a profit mo-
tive or had stolen or used credit card numbers. There were no
charges related to any Christmas breakins or death threats against
Tsutomu Shimomura. Nor did the government mention or give the
smallest credit to Shimomura. A close inspection revealed what ap-
peared to be a surgical removal of charges that might have been
tainted by Shimomura's involvement. Mitnick's alleged breakins to
the Well in Sausalito, for example, weren't included. But if the strat-
egy was to prevent Shimomura from being called by the defense, the

government may have left a door open. Netcom, in San Jose, one of
the sites where Shimomura had intercepted Mitnick's communica-
tions, was listed in the indictment as one of the victims.

The indictment, including charges for unauthorized access devices,
computer fraud, wire fraud, and interception of wire or electronic
communications, appeared disorganized and seemed to lump to-
gether alleged serious felonies and the equivalent of hacker misde-
meanors. The major alleged offenses were the misappropriation of
copies of the proprietary software of Motorola, Nokia, Fujitsu Ltd.,
Novell, and NEC Ltd. But the indictment was laid out in such a way
that it appeared at first glance that Mitnick had copied the software
of Sun Microsystems, too. Boilerplate language stated that each of the
six "victim companies" spends "substantial sums in developing its
computer software" and, in all but one case, licenses its "proprietary
software for a fee."

The actual counts of the indictment, however, made it clear that
Mitnick's alleged crime against Sun was at worst the unauthorized
possession of two hundred passwords on Sun's computers. Indeed,
eight of the counts were for having unauthorized passwords on the
computers of Sun, Novell, Fujitsu, NEC, Motorola, and the Univer-
sity of Southern California — the hacker equivalent of speeding
tickets. Instead of charging those as misdemeanors for "trafficking in
user names and passwords" under Title 18, 1030, Schindler claimed
they were 1029 access device violations, each with a twenty-year
maximum penalty. Nine counts were for eight social engineering
phone calls by Mitnick and one by De Payne to arrange the transfer of
a victim company's software. Six counts documented the alleged
illegal transfers, and one count was for either preventing the use of or
damaging the computers of USC and creating a loss of more than
$1,000.

Nokia, Europe's largest maker of cellular phones, acknowledged
Mitnick had illegally transferred the source code that operates its
cellular phones and other wireless products from Salo, Finland, to
USC. The company detailed the second social engineering "prank"
call De Payne allegedly made four months after Mitnick already
had the goods. De Payne was apparently impersonating K. P.
Wileska, the company's president, and an official indicated that the

company knew immediately that the caller's accent didn't match that
of the Fin.

Motorola, a $30 billion corporation, clarified the indictment. Far
from getting accounts to internal Motorola systems, as claimed in the
indictment, Mitnick had used an ordinary packet sniffer program to
pilfer common Internet accounts, mainly on university systems used
by Motorola employees. "No confidential information was compro-
mised," said an official. "It was a nuisance, not a major loss." The
revelation raised the specter that the government may have wrongly
characterized the other company accounts Mitnick garnered as being
on internal corporate systems. Mitnick's misappropriation of Mo-
torola's software, the centerpiece of the indictment, was also consid-
ered overblown by the company. "He did move a block of code, not
considered critical at the time, and we subsequently found no pattern
of abuse or fraud," said the official. Nor did the official see how
cellular source code taken from Motorola or any other of the victim
companies could have profited Mitnick. "The contest may have been
more important than the result. Like his Digital case, this software
was of no use to anybody else."

The billions of dollars of losses Kent Walker, the former U.S.
Attorney, had trumpeted in the
New York Times
had apparently
dropped a thousandfold to "millions" in the government's press
release. The social engineering counts seemed to belie Mitnick's sta-
tus as the nation's most wanted hacker. Oddly, some of the most
detailed parts of the indictment described Mitnick's low-tech tele-
phone tricks and numerous aliases. But the government press release
ignored this contradiction, publicizing the "vast scope of Mitnick's
alleged computer hacking while he was a fugitive from justice" and
writing of how criminals using a lone computer and modem can
"wreak havoc around the world." It was an ironic choice of terminol-
ogy, since Shimomura had described his own program as one that
could "wreak havoc on the Internet community." And there was
more irony in the indictment's repeated references to Mitnick using
"unauthorized" hacking programs. What were Shimomura's hacking
programs? Authorized?

The last line in the press release warned ominously that "the inves-
tigation is continuing." Friday afternoon Mitnick phoned again,

and I asked why he thought there was no charge for his alleged break-
ins to the Well. "They intend to indict me in Northern California," he
answered drearily. "They're saving charges to indict me later. They'll
save a San Diego charge to indict me in San Diego too. Schindler told
me if I didn't sign the plea he'd drag me around the country."

Mitnick still didn't even have a copy of the indictment, and was
now left without an attorney. Sherman had informed him that he'd
have to solely represent De Payne to avoid a possible conflict of
interest. At Mitnick's request, the Raleigh public defender's office
was on the phone to the Los Angeles public defender's office. Nor-
mally, Los Angeles would be eager to take on a high-profile defen-
dant. But Maria Stratton, head of the office, informed Raleigh that
one of her forty-three public defenders had represented Lenny
DiCicco, a codefendent in Mitnick's 1989 case. Although DiCicco
was not involved in the new California indictment, Stratton refused
to represent Mitnick.

Mitnick, scheduled to be arraigned with De Payne on Monday,
September 30, still had no attorney. The press began to kick in.
Schindler provided Reuters with the juicy quote that played in papers
around the country. "The statutes provide for sentences in excess of
two hundred years," said the Assistant U.S. Attorney, adding that a
judge would have to decide the ultimate sentence. Some papers
quoted Schindler, while others just flatly announced the authorities'
claim that Mitnick could face as much as "two hundred years of
prison time." A spokeswoman at Nokia believed Mitnick's crimes
were serious but termed the government's statement "ridiculous."

The idea that someone like Mitnick, whose problems began to spin
out of control when his probation officer wouldn't let him work with
computers, could be handed a life sentence for his hacking escapades
seemed Kafkaesque. But then this was the Kevin Mitnick case. Govern-
ment hyperbole and hardball tactics were par for the course. And there
was every indication that the game was only going to get rougher. "I
figure they'll keep indicting me" — in other jurisdictions — "for five
years," Mitnick told me the night before his arraignment. "Justice isn't
the issue. They're sending a message."

October 1996

Based on interviews with the following individuals: Jim Murphy and
Joe Orsak of Sprint Cellular; Tsutomu Shimomura; Mark Lottor;
Kevin Mitnick; Justin Petersen; Intrepid; the maitre d' at the Rain-
bow Bar and Grill; Grant Strauss; Phillip Lamond; Erica; Kevin
Poulsen; Detective Bill Spradley, LAPD; Ron Austin; anonymous
friends of Justin Petersen; Henry Spiegel; Lewis De Payne; Susan
Headly (Thunder); Allan Rubin, Mitnick's former attorney; Mark
Kasdan of Teltec; Bonnie Vitello, Mitnick's ex-wife; Reba Varta-
nian, Mitnick's grandmother; Bob Arkow, Mitnick's boyhood
friend; Chris Goggans; Drunkfux; Eric Heinz Sr.; Ed Lovelace, Cali-
fornia Department of Motor Vehicles; anonymous Beverly Hills de-
tective.

Visits to Raleigh, North Carolina, Henry Spiegel's Hollywood
home, Oakwood Apartments, Teltec, Malibu Canyon Apartments,
and Lewis De Payne's apartment allowed for firsthand physical de-
scription. Technical and background information was culled from:
the FBI record of items seized in De Payne's apartment; a copy of the
Pacific Bell SAS manual; interviews with Graystone Electronics, the
makers of the Cellscope; the Mitnick federal indictment;
Newsweek; the
New York Times;
the
Los Angeles Times;
the
Los Angeles Daily
News; Spectacular Computer Crimes,
by Jay Bloombecker; Adam

Mitnick's death certificate; Los Angeles criminal and civil court files;
Cyberpunk,
by Katie Hafner and John Markoff; Joseph Wernle's
Sprint and MCI phone bills; a copy of Chris Goggans's videotape of
Petersen at Summer Con '92.; Lewis De Payne's computer records.

Based on interviews with: Ron Austin; Justin Petersen; Kevin Poul-
sen; Fernando Peralta, Social Security Administration; Kevin Mit-
nick; Lewis De Payne; David Schindler, Assistant U.S. Attorney, Los
Angeles; Bonnie Vitello; Richard Sherman, Lewis De Payne's attor-
ney; John Markoff of the
New York Times;
Kevin Pazaski of Cellu-
larOne; a Well technical support person; Brent Schroeder; Neil Clift,
English security expert; Todd Young of the Guidry Group; Mrs.
Young; Mark Lottor; Ivan Orton; Detective John Lewitt, Sergeant
Ken Crow, Detective John Moore, and Detective Linda Patrick,
Seattle PD; David Drew, manager of Lynn Mar apartments.

Source material and research included: visit to Seattle; Todd
Young Cellscope demonstration; Richard Sherman's letter to Janet
Reno; Ron Austin's memo to the FBI;
Wired
magazine article, "Cel-
lular Phreaks & Code Dudes"; transcript of Petersen bail revocation
hearing; Lewis De Payne's recording of his oath with Mitnick; the
Los Angeles Daily News;
the
Los Angeles Times;
Joseph Wernle's
phone records; Petersen and Austin federal indictments; Petersen's
memoirs; federal statutes;
Spectacular Computer Crimes;
Susan
Headly; the
London Observer,
"To Catch a Hacker"; Special Agent
Kathleen Carson's September 1994 letter to Neil Clift; Lewis De.
Payne's e-mail; congressional testimony on Oki scanner; promo-
tional copy of Mark Lottor's altered Oki scanner software/interface;
Young affidavit; Graystone Electronics interview; Seattle court doc-
uments.

Based on interviews with: Kevin Mitnick, Ron Austin, John Mark-
off, Neil Clift, Lewis De Payne, Mark Lottor, Kevin Poulsen,
Tsutomu Shimomura, Peter Moore of
Playboy
magazine.