The Hacker Crackdown

by Bruce Sterling

  Mentor was particularly well-qualified for this task. Naturally, he knew far more about computer-intrusion and digital skullduggery than any previously published cyberpunk author. Not only that, but he was good at his work. A vivid imagination, combined with an instinctive feeling for the working of systems and, especially, the loopholes within them, are excellent qualities for a professional game designer.

  By March 1st, *GURPS Cyberpunk* was almost complete, ready to print and ship. Steve Jackson expected vigorous sales for this item, which, he hoped, would keep the company financially afloat for several months. *GURPS Cyberpunk,* like the other GURPS "modules," was not a "game" like a Monopoly set, but a *book:* a bound paperback book the size of a glossy magazine, with a slick color cover, and pages full of text, illustrations, tables and footnotes. It was advertised as a game, and was used as an aid to game-playing, but it was a book, with an ISBN number, published in Texas, copyrighted, and sold in bookstores.

  And now, that book, stored on a computer, had gone out the door in the custody of the Secret Service.

  The day after the raid, Steve Jackson visited the local Secret Service headquarters with a lawyer in tow. There he confronted Tim Foley (still in Austin at that time) and demanded his book back. But there was trouble. *GURPS Cyberpunk,* alleged a Secret Service agent to astonished businessman Steve Jackson, was "a manual for computer crime."

  "It's science fiction," Jackson said.

  "No, this is real." This statement was repeated several times, by several agents. Jackson's ominously accurate game had passed from pure, obscure, small- scale fantasy into the impure, highly publicized, large- scale fantasy of the Hacker Crackdown.

  No mention was made of the real reason for the search. According to their search warrant, the raiders had expected to find the E911 Document stored on Jackson's bulletin board system. But that warrant was sealed; a procedure that most law enforcement agencies will use only when lives are demonstrably in danger. The raiders' true motives were not discovered until the Jackson search- warrant was unsealed by his lawyers, many months later. The Secret Service, and the Chicago Computer Fraud and Abuse Task Force, said absolutely nothing to Steve Jackson about any threat to the police 911 System. They said nothing about the Atlanta Three, nothing about *Phrack* or Knight Lightning, nothing about Terminus.

  Jackson was left to believe that his computers had been seized because he intended to publish a science fiction book that law enforcement considered too dangerous to see print.

  This misconception was repeated again and again, for months, to an ever-widening public audience. It was not the truth of the case; but as months passed, and this misconception was publicly printed again and again, it became one of the few publicly known "facts" about the mysterious Hacker Crackdown. The Secret Service had seized a computer to stop the publication of a cyberpunk science fiction book.

  The second section of this book, "The Digital Underground," is almost finished now. We have become acquainted with all the major figures of this case who actually belong to the underground milieu of computer intrusion. We have some idea of their history, their motives, their general modus operandi. We now know, I hope, who they are, where they came from, and more or less what they want. In the next section of this book, "Law and Order," we will leave this milieu and directly enter the world of America's computer-crime police.

  At this point, however, I have another figure to introduce: myself.

  My name is Bruce Sterling. I live in Austin, Texas, where I am a science fiction writer by trade: specifically, a *cyberpunk* science fiction writer.

  Like my "cyberpunk" colleagues in the U.S. and Canada, I've never been entirely happy with this literary label -- especially after it became a synonym for computer criminal. But I did once edit a book of stories by my colleagues, called *MIRRORSHADES: the Cyberpunk Anthology,* and I've long been a writer of literary-critical cyberpunk manifestos. I am not a "hacker" of any description, though I do have readers in the digital underground.

  When the Steve Jackson Games seizure occurred, I naturally took an intense interest. If "cyberpunk" books were being banned by federal police in my own home town, I reasonably wondered whether I myself might be next. Would my computer be seized by the Secret Service? At the time, I was in possession of an aging Apple IIe without so much as a hard disk. If I were to be raided as an author of computer-crime manuals, the loss of my feeble word-processor would likely provoke more snickers than sympathy.

  I'd known Steve Jackson for many years. We knew one another as colleagues, for we frequented the same local science-fiction conventions. I'd played Jackson games, and recognized his cleverness; but he certainly had never struck me as a potential mastermind of computer crime.

  I also knew a little about computer bulletin-board systems. In the mid-1980s I had taken an active role in an Austin board called "SMOF-BBS," one of the first boards dedicated to science fiction. I had a modem, and on occasion I'd logged on to Illuminati, which always looked entertainly wacky, but certainly harmless enough.

  At the time of the Jackson seizure, I had no experience whatsoever with underground boards. But I knew that no one on Illuminati talked about breaking into systems illegally, or about robbing phone companies. Illuminati didn't even offer pirated computer games. Steve Jackson, like many creative artists, was markedly touchy about theft of intellectual property.

  It seemed to me that Jackson was either seriously suspected of some crime -- in which case, he would be charged soon, and would have his day in court -- or else he was innocent, in which case the Secret Service would quickly return his equipment, and everyone would have a good laugh. I rather expected the good laugh. The situation was not without its comic side. The raid, known as the "Cyberpunk Bust" in the science fiction community, was winning a great deal of free national publicity both for Jackson himself and the "cyberpunk" science fiction writers generally.

  Besides, science fiction people are used to being misinterpreted. Science fiction is a colorful, disreputable, slipshod occupation, full of unlikely oddballs, which, of course, is why we like it. Weirdness can be an occupational hazard in our field. People who wear Halloween costumes are sometimes mistaken for monsters.

  Once upon a time -- back in 1939, in New York City -- science fiction and the U.S. Secret Service collided in a comic case of mistaken identity. This weird incident involved a literary group quite famous in science fiction, known as "the Futurians," whose membership included such future genre greats as Isaac Asimov, Frederik Pohl, and Damon Knight. The Futurians were every bit as offbeat and wacky as any of their spiritual descendants, including the cyberpunks, and were given to communal living, spontaneous group renditions of light opera, and midnight fencing exhibitions on the lawn. The Futurians didn't have bulletin board systems, but they did have the technological equivalent in 1939 -- mimeographs and a private printing press. These were in steady use, producing a stream of science-fiction fan magazines, literary manifestos, and weird articles, which were picked up in ink-sticky bundles by a succession of strange, gangly, spotty young men in fedoras and overcoats.

  The neighbors grew alarmed at the antics of the Futurians and reported them to the Secret Service as suspected counterfeiters. In the winter of 1939, a squad of USSS agents with drawn guns burst into "Futurian House," prepared to confiscate the forged currency and illicit printing presses. There they discovered a slumbering science fiction fan named George Hahn, a guest of the Futurian commune who had just arrived in New York. George Hahn managed to explain himself and his group, and the Secret Service agents left the Futurians in peace henceforth. (Alas, Hahn died in 1991, just before I had discovered this astonishing historical parallel, and just before I could interview him for this book.)

  But the Jackson case did not come to a swift and comic end. No quick answers came his way, or mine; no swift reassurances that all was right in the digital world, that matters were well in hand after all. Quite the opposite. In my alternate role as a sometime pop-science journalist, I
interviewed Jackson and his staff for an article in a British magazine. The strange details of the raid left me more concerned than ever. Without its computers, the company had been financially and operationally crippled. Half the SJG workforce, a group of entirely innocent people, had been sorrowfully fired, deprived of their livelihoods by the seizure. It began to dawn on me that authors -- American writers -- might well have their computers seized, under sealed warrants, without any criminal charge; and that, as Steve Jackson had discovered, there was no immediate recourse for this. This was no joke; this wasn't science fiction; this was real.

  I determined to put science fiction aside until I had discovered what had happened and where this trouble had come from. It was time to enter the purportedly real world of electronic free expression and computer crime. Hence, this book. Hence, the world of the telcos; and the world of the digital underground; and next, the world of the police.

  PART THREE: LAW AND ORDER

  Of the various anti-hacker activities of 1990, "Operation Sundevil" had by far the highest public profile. The sweeping, nationwide computer seizures of May 8, 1990 were unprecedented in scope and highly, if rather selectively, publicized.

  Unlike the efforts of the Chicago Computer Fraud and Abuse Task Force, "Operation Sundevil" was not intended to combat "hacking" in the sense of computer intrusion or sophisticated raids on telco switching stations. Nor did it have anything to do with hacker misdeeds with AT&T's software, or with Southern Bell's proprietary documents.

  Instead, "Operation Sundevil" was a crackdown on those traditional scourges of the digital underground: credit-card theft and telephone code abuse. The ambitious activities out of Chicago, and the somewhat lesser-known but vigorous anti- hacker actions of the New York State Police in 1990, were never a part of "Operation Sundevil" per se, which was based in Arizona. Nevertheless, after the spectacular May 8 raids, the public, misled by police secrecy, hacker panic, and a puzzled national press-corps, conflated all aspects of the nationwide crackdown in 1990 under the blanket term "Operation Sundevil." "Sundevil" is still the best-known synonym for the crackdown of 1990. But the Arizona organizers of "Sundevil" did not really deserve this reputation -- any more, for instance, than all hackers deserve a reputation as "hackers."

  There was some justice in this confused perception, though. For one thing, the confusion was abetted by the Washington office of the Secret Service, who responded to Freedom of Information Act requests on "Operation Sundevil" by referring investigators to the publicly known cases of Knight Lightning and the Atlanta Three. And "Sundevil" was certainly the largest aspect of the Crackdown, the most deliberate and the best-organized. As a crackdown on electronic fraud, "Sundevil" lacked the frantic pace of the war on the Legion of Doom; on the contrary, Sundevil's targets were picked out with cool deliberation over an elaborate investigation lasting two full years. And once again the targets were bulletin board systems. Boards can be powerful aids to organized fraud. Underground boards carry lively, extensive, detailed, and often quite flagrant "discussions" of lawbreaking techniques and lawbreaking activities. "Discussing" crime in the abstract, or "discussing" the particulars of criminal cases, is not illegal -- but there are stern state and federal laws against coldbloodedly conspiring in groups in order to commit crimes. In the eyes of police, people who actively conspire to break the law are not regarded as "clubs," "debating salons," "users' groups," or "free speech advocates." Rather, such people tend to find themselves formally indicted by prosecutors as "gangs," "racketeers," "corrupt organizations" and "organized crime figures." What's more, the illicit data contained on outlaw boards goes well beyond mere acts of speech and/or possible criminal conspiracy. As we have seen, it was common practice in the digital underground to post purloined telephone codes on boards, for any phreak or hacker who cared to abuse them. Is posting digital booty of this sort supposed to be protected by the First Amendment? Hardly -- though the issue, like most issues in cyberspace, is not entirely resolved. Some theorists argue that to merely *recite* a number publicly is not illegal -- only its *use* is illegal. But anti-hacker police point out that magazines and newspapers (more traditional forms of free expression) never publish stolen telephone codes (even though this might well raise their circulation). Stolen credit card numbers, being riskier and more valuable, were less often publicly posted on boards -- but there is no question that some underground boards carried "carding" traffic, generally exchanged through private mail. Underground boards also carried handy programs for "scanning" telephone codes and raiding credit card companies, as well as the usual obnoxious galaxy of pirated software, cracked passwords, blue-box schematics, intrusion manuals, anarchy files, porn files, and so forth. But besides their nuisance potential for the spread of illicit knowledge, bulletin boards have another vitally interesting aspect for the professional investigator. Bulletin boards are cram-full of *evidence.* All that busy trading of electronic mail, all those hacker boasts, brags and struts, even the stolen codes and cards, can be neat, electronic, real- time recordings of criminal activity. As an investigator, when you seize a pirate board, you have scored a coup as effective as tapping phones or intercepting mail. However, you have not actually tapped a phone or intercepted a letter. The rules of evidence regarding phone-taps and mail interceptions are old, stern and well- understood by police, prosecutors and defense attorneys alike. The rules of evidence regarding boards are new, waffling, and understood by nobody at all.

  Sundevil was the largest crackdown on boards in world history. On May 7, 8, and 9, 1990, about forty- two computer systems were seized. Of those forty- two computers, about twenty-five actually were running boards. (The vagueness of this estimate is attributable to the vagueness of (a) what a "computer system" is, and (b) what it actually means to "run a board" with one -- or with two computers, or with three.) About twenty-five boards vanished into police custody in May 1990. As we have seen, there are an estimated 30,000 boards in America today. If we assume that one board in a hundred is up to no good with codes and cards (which rather flatters the honesty of the board-using community), then that would leave 2,975 outlaw boards untouched by Sundevil. Sundevil seized about one tenth of one percent of all computer bulletin boards in America. Seen objectively, this is something less than a comprehensive assault. In 1990, Sundevil's organizers -- the team at the Phoenix Secret Service office, and the Arizona Attorney General's office -- had a list of at least *three hundred* boards that they considered fully deserving of search and seizure warrants. The twenty-five boards actually seized were merely among the most obvious and egregious of this much larger list of candidates. All these boards had been examined beforehand -- either by informants, who had passed printouts to the Secret Service, or by Secret Service agents themselves, who not only come equipped with modems but know how to use them.

  There were a number of motives for Sundevil. First, it offered a chance to get ahead of the curve on wire-fraud crimes. Tracking back credit-card ripoffs to their perpetrators can be appallingly difficult. If these miscreants have any kind of electronic sophistication, they can snarl their tracks through the phone network into a mind-boggling, untraceable mess, while still managing to "reach out and rob someone." Boards, however, full of brags and boasts, codes and cards, offer evidence in the handy congealed form. Seizures themselves -- the mere physical removal of machines -- tends to take the pressure off. During Sundevil, a large number of code kids, warez d00dz, and credit card thieves would be deprived of those boards -- their means of community and conspiracy -- in one swift blow. As for the sysops themselves (commonly among the boldest offenders) they would be directly stripped of their computer equipment, and rendered digitally mute and blind. And this aspect of Sundevil was carried out with great success. Sundevil seems to have been a complete tactical surprise -- unlike the fragmentary and continuing seizures of the war on the Legion of Doom, Sundevil was precisely timed and utterly overwhelming. At least forty "computers" were seized during May 7, 8 and 9, 1990, in
Cincinnati, Detroit, Los Angeles, Miami, Newark, Phoenix, Tucson, Richmond, San Diego, San Jose, Pittsburgh and San Francisco. Some cities saw multiple raids, such as the five separate raids in the New York City environs. Plano, Texas (essentially a suburb of the Dallas/Fort Worth metroplex, and a hub of the telecommunications industry) saw four computer seizures. Chicago, ever in the forefront, saw its own local Sundevil raid, briskly carried out by Secret Service agents Timothy Foley and Barbara Golden. Many of these raids occurred, not in the cities proper, but in associated white-middle class suburbs -- places like Mount Lebanon, Pennsylvania and Clark Lake, Michigan. There were a few raids on offices; most took place in people's homes, the classic hacker basements and bedrooms. The Sundevil raids were searches and seizures, not a group of mass arrests. There were only four arrests during Sundevil. "Tony the Trashman," a longtime teenage bete noire of the Arizona Racketeering unit, was arrested in Tucson on May 9. "Dr. Ripco," sysop of an outlaw board with the misfortune to exist in Chicago itself, was also arrested -- on illegal weapons charges. Local units also arrested a 19-year-old female phone phreak named "Electra" in Pennsylvania, and a male juvenile in California. Federal agents however were not seeking arrests, but computers.

  Hackers are generally not indicted (if at all) until the evidence in their seized computers is evaluated -- a process that can take weeks, months -- even years. When hackers are arrested on the spot, it's generally an arrest for other reasons. Drugs and/or illegal weapons show up in a good third of anti-hacker computer seizures (though not during Sundevil).