The Fugitive Game: Online With Kevin Mitnick (41 page)

"Well, the formula is sugar, sugar, and caffeine, isn't it?"

"I want it down to the real formula, the secret formula."

"What's that funny noise?"

"It's the up arrow key," Mitnick says. "I'm reading mail. Junk mail."

"What kind of system is it?"

"God! Always a question! I don't know what type of PC it is. It's
not even marked."

"But do you have modem access at the library?"

"No. That'd be nice," Mitnick reflects. "You can search on articles
and CD-ROMs, phone book directories, and all that sort of stuff."

"They have CD-ROM at this one?"

"Yeah. That should narrow it down for you. It's pretty cool."

The hacker's fingers click the keys again.

"I'm on Infotrack right now," Mitnick says. "I'm looking at Poul-
sen."

"Well, there might be a match between us," I say, meaning he
may find a reference to an article I wrote.

"Oh yeah," Mitnick remembers. "Because of that 'Last Hacker.'
Why did you call it that title?"

"You never read the story. It was the last line in the story."

"Hey!" Mitnick laughs. "Turn on your modem and I'll find it on
your PC."

"It's not there anymore."

"Not there? What do you use, WordPerfect or Word?"

I pause a second. I'm not sure I want Mitnick to know what pro-
gram I'm using.

"Word."

"I use WordPerfect."

"Uh-oh. We're incompatible."

"It's OK," Mitnick says. "I have a conversion program."

Mitnick's feeling clever and in control. He didn't just outsmart the
feds by passing a security clearance in Seattle. He also led them on a
wild goose chase to Israel just by pretending to be hot for some
Israeli girl.

"Idiot [Neil] Clift comes to the conclusion, 'Oh! He's going there,
he's on his way.' So then they phone up the authorities in the States
and say, 'Oh! This guy's on the way to Israel.' They notify the Israel
law enforcement people that I'm on my way."

"Do you actually know this person?"

"No! No! But they [the FBI] believe I did. Right? [I did it] Just to
see what the reaction would be. And of course, they took it hook,
line, and sinker."

"They [the FBI] just think you know her?"

"I
know
they do! It's great!"

"What does she look like?"

"I have no idea. I just know her e-mail address," Mitnick pauses,
sounding perturbed at himself. "I shouldn't have told you. I
should've kept that secret."

"I don't like this," Mitnick interjects. "This guy walks back here,
checks me out, then walks away. That's weird."

"Some guy's checking you out?"

"Yeah, because I guess anyone on a cell phone is suspicious, you
know?"

"They got a call," I joke. "Find the guy with the cell phone. He's
back researching things on the terminal."

Mitnick doesn't find this funny.

"Yeah, well, he'd have a lot of libraries [with a full CD-ROM
setup] to call — a
lot
of libraries!"

The truth is, in Raleigh, North Carolina, there are only two.

• a ■

"I've got call waiting and somebody's been calling me over and over
again and I haven't been picking it up," I tell Mitnick.

The hacker jokes that I'm working for the feds, trying to keep him
on the line so they can trace his call. "The guy at the company says,

'We got it, so hang up! Call Jim there in the Sacramento SCC
[switching control center]!'

"Jim?" I ask, puzzled.

"Jim, that's the guy that handles Mill Valley [my hometown] eve-
nings," Mitnick responds as if it's common knowledge.

"Really?"

"Yeah, serious as a heart attack."

"Why up in Sacramento?"

"Because at night and on the weekends they cut over to Sacra-
mento. Yeah, the good ole guy's here at the DMS ioo [telephone]
switch." Mitnick chuckles. "Does what he's told. You know what
I'm saying?"

"Yeah, I probably do."

Has Mitnick wiretapped my phone?

■ ■ a

We've been chatting for two and a half hours straight, except for the
short break when Mitnick's battery died and I forgot to hang up the
phone. I'm hungry and decide to spend some time with my family.
We say goodbye, but before the call ends I ask Mitnick why he
seemed so suspicious the other night. "You said I didn't tell you
something the other night."

"Yeah, you still didn't," Mitnick says, sounding cool and distant.

"What?"

"You didn't tell me what state Markoff thinks I'm in."

Markoff has been telling other hackers that Mitnick is in Colo-
rado.

"Well, I can't," I answer.

"He didn't tell you you can't, did he?" Mitnick prods.

"No. But he didn't tell me anything. I had my own sources."

"I want to have fun with him," Mitnick laughs, imagining the
possibilities. "Wherever he thinks I am, I think all the calls should
originate from there. It'd be interesting to see what he thinks. I'm
just curious. I hope it's a nice place."

February 15, 1995

" Yes, hello?" mumbles a

groggy Lewis De Payne. It's
well past midnight, the morning of February 15, 1995.

"This is a collect call," says the operator. "Caller, what's your
name?"

"Kevin."

"Will you pay?"

"Yeah," says De Payne.

"I just was arrested by the FBI tonight. I'm in jail in Raleigh,
North Carolina."

"Wow. OK."

"I just thought you ought to know," Mitnick warns his hacker
buddy. "I'm in custody, the FBI and U.S. Marshals."

"Really? Wow. That was when?"

"Tonight, about four or five hours ago."

"Wow!"

"Do you have three-way calling?" Mitnick asks his friend.

■ ■ ■

Five hours later, at 8:30 a.m., Pacific time, Ivan Orton, the prosecu-
tor in Seattle, calls to tell me the news. David Schindler, the Assistant
U.S. Attorney in Los Angeles, phones around 9:30 a.m. By noon one

of my hacker sources calls back with the inside scoop. Mitnick, it
seems, was arrested by a Japanese security expert who had the help
of a reporter.

I think back. Just two days ago, on Monday, I had returned
Markoff's Saturday afternoon call. He wasn't in, bur he phoned
back while I was out to lunch, and left what seemed at the time a
strange message. Markoff said his father was ill, thanked rne pro-
fusely for returning his call, and told me to '"take care." The odd
thing was he sounded happy. He'd never been personal or emotional
before, certainly not in a phone message.

To check if Markoff has been in Raleigh all week, I phone the San
Francisco bureau of the
New York Times
and explain that Markoff
has been trying to reach me. The receptionist says I'm not alone.
John Markoff has been out all week on a big story, and even she
doesn't know where he is.

About noon, I reach William Berryhill Jr., Chief Marshal of the
Eastern District of North Carolina. In his southern drawl, Berryhill
runs down the facts as he knows them: Mitnick's early-morning ar-
rest, his appearance a few hours ago before a federal magistrate, his
scheduled detention hearing Friday morning. Berryhill is friendly,
but he explains there isn't a lot more he can say. "On the average
John Doe, the Raleigh-Durham Task Force would issue the press
release," explains Berryhill. "But because this guy is so high profile
it's coming directly out of main Justice."

Several hours later, just before I drive to the airport to hop on a
red-eye, David Schindler returns my afternoon calls. John Markoff
was in Raleigh, North Carolina, as the capture unfolded, and by the
tone of Schindler's voice, the government isn't too happy about what
happened.

■ ■ ■

By midafternoon, just fifteen hours after his capture, Kevin Mit-
nick is making waves on the Internet. The Well has created a dis-
cussion group, or "thread," for its subscribers to post their
comments publicly about what the provider calls the "Netwide
Security Incident."

At precisely 2:32 p.m, Bruce Katz, heir to the Rockport shoe fortune and the Well's eccentric CEO, launches the thread with a de-
scription of his company's critical role in Mitnick's arrest.

#1

Announcement from The WELL Management
February 15, 1995
2:30 PM

On January 27 it was discovered that The WELL was experiencing
unauthorized entry to its computers. This was first noticed as an
accumulation of files in several seldom used accounts.

... By Monday we had contacted Computer Emergency Response
Team (CERT) and leading security specialists, including Tsutomu
Shimomura.... Shortly after that we brought in specialists and
equipment... . We initiated round-the-clock staffing to monitor
any unauthorized activity in detail ... we found private files and
proprietary source code from other systems and sites being trans-
ferred through The WELL. . .. [W]e contacted other sites involved
and cooperated with the US Attorney's Office to identify the indi-
viduals) responsible for these system violations.

With the help of computer security specialists and with the volun-
tary cooperation of various sites, authorities succeeded in arresting
a suspect at 2am EST, Feb. 15.

We have learned a great deal about security during the last few
weeks and we will be taking a series of measures to tighten the
WELL's security. But having said that, it also needs to be said that
public computing systems are by their very nature impossible to
entirely secure. This is especially true in an open system like
ours. ...

We have pledged not to mention the other sites whose systems were
compromised, but suffice it to say that the files that were stolen
from their systems may have represented millions of dollars worth
of information....

Bruce R. Katz
CEO, The WELL

So the Well, known as the most pro-hacker, antigovernment pro-
vider on the Internet, helped bring Shimomura and the FBI together
to track Mitnick. Who would have thought it possible? Within min-
utes of Katz's disclosure, a Well member jumps on the bandwagon
and launches a warning and a damage report:

#7

CHANGE ALL YOUR PASSWORDS NOW!...

Well

Netcom

CO Supernet. ..

Motorola

Intermetrics

Berkeley

But some begin to wonder why so much is being made of the break-
ins. David Lewis, a former Well employee, asks why something
wasn't done about the Well's compromised security months ago.

#32

Interestingly enough ... WELL Support was aware of probable
hacking problems as early as November. This one is wondering
why it took so long to have WELL technical folks respond. ..."

No sooner is that concern raised than a members says that hacking
the Well is "hardly big news... ." But it is big news to Well manage-
ment, apparently. One Well manager curtly replies to Lewis that he's
asked the staff and "no one knows, or remembers, what you are
talking about." Well management considers the attacks a very se-
rious matter. So too does the FBI. Another user posts the FBI's latest
update on the arrest.

#62

[From the FBI in North Carolina]

PRESS RELEASE

At 1:30 a.m., today, February 15, 1995, agents of the FBI arrested
KEVIN MITNICK, a well-known computer hacker and federal fu-
gitive. The arrest occurred after an intensive two-week electronic
manhunt led law enforcement agents to MITNICK's apartment in
Raleigh, North Carolina.. ..

In this latest incident, MITNICK is alleged to have electronically
attacked numerous corporate and communications carriers located
in California, Colorado, and North Carolina where he caused sig-
nificant damage and stole proprietary information. One of the at-
tacked sites was the San Diego Supercomputer Center (SDSC), and
Tsutomu Shimomura, a system administrator at SDSC, provided
significant assistance to law enforcement personnel during the in-
vestigation. ...

At 5:05 p.m., Lewis logs on to defend himself. Well management is
making him out to be a liar or a kook. He's saying that the Well's
thousands of subscribers have been vulnerable to attack since at least
last November, and the Well knew all about it. He's not backing
down.