Best American Magazine Writing 2013

by The American Society of Magazine Editors

  Kim maintains that the real issue is a lack of understanding of the Internet. He was simply operating a hard-disc drive in virtual space. There’s no arguing that Megaupload wasn’t a legitimate cyberlocker, storing data for millions of individuals. Megaupload server logs show addresses that trace back to Fortune 100 companies and governments around the world. It’s also obvious that Megaupload was one of many Internet sites that stored, and profited from, copyright-infringing material. The only question is whether Kim and company bear criminal responsibility for that duality.

  The law addressing this balance between the rights of copyright holders and Internet service providers was signed by President Clinton in 1998. The Digital Millennium Copyright Act provides ISPs with “safe harbor” from liability, so long as the provider doesn’t know for certain which, if any, of its stored material is copyright-infringing and “expeditiously” removes infringing material following a takedown notice.

  The act was tested in June of 2010, when a U.S. district court ruled that YouTube was protected by safe harbor against a $1 billion suit by Viacom; Google employees simply could not be expected to make tough, and often impossible, calls as to which clips of, say, Jersey Shore, had been uploaded without permission.

  The DMCA was intended to clear up the gray areas of Internet law. But by making ignorance of its own business a cloud storage provider’s only defense, the law created a brand-new gray area, leaving in place an Internet where piracy was blatant big business. The world still hadn’t worked out how to have data storage that was both private and policed. Lawmakers attempted to tackle that issue this year with the antipiracy SOPA/PIPA measures, but millions of Internet freedom advocates shouted it down and on January 20 the legislation died; Kim was raided that same week. “The U.S. showed the world they don’t need SOPA or a trial to control the Internet,” Kim says. “They did it with guns.”

  The DOJ claims Megaupload was anything but ignorant of the pirated material on its site. In fact, the indictment claims, Megaupload’s generals engaged in illegal file-sharing themselves, encouraged it with an incentive program that paid cash for popular content, and were slow and selective in complying with takedown notices, only pulling infringing content and dropping the incentive program when the company was at the peak of its power. Megaupload counters that policing the billions of files on its service would be both impossible and a violation of their customers’ privacy, that they did their best to comply with takedown notices as the law required, and that they had reasonable expectations of the same DMCA safe harbor afforded to YouTube.

  But unlike the Viacom versus YouTube case, the charges against Megaupload are not civil but criminal; the key players aren’t being sued, they’re facing jail. Not for the first time, Kim finds himself embroiled in a criminal case based on uncertain tech precedent. Does safe harbor even apply in a criminal case? It’s not clear that a criminal statute against second-party copyright violation even exists. Welcome to the grayest gray zone on the Internet.

  At the heart of the DOJ’s case is the concept of “willfulness.” It’s a question of whether the Megaupload boys knew they were criminals. And for that reason, much of the focus has been on the character of Kim Dotcom himself.

  Dotcom does have several criminal convictions in Germany, a history of working at the edges of the technologically possible and legally permissible, and a bad-boy reputation. What’s less clear is whether this patchwork description makes Dotcom a Don Corleone or a Da Vinci.

  “They probably thought, this guy’s fucking crazy and illegal, and we will find so much shit on him once we open it up,” Kim says. “They thought I was an easy target. They thought I was a joke. But they underestimated me, man. Everything they’re saying about me is ten years old. What they didn’t know is, I’m the cleanest guy out there.”

  Dotcom wipes the sweat from his forehead and refolds his black facecloth. “That’s the funny part of all this,” he says. “Everyone thinks they know me. But nobody really knows me at all.”

  Kim was nineteen the first time he was sent to jail. The charge was “handling stolen goods,” but it wasn’t as simple as that; the German court simply didn’t have a word for this new crime of hacking.

  Growing up in the northern German city of Kiel with his mother and alcoholic father, Kim was in trouble before he even discovered computers. As he sits with me at the table long after the maids have cleared the plates and his wife and business partners have gone to bed, Kim speaks haltingly of a childhood “filled with fear” and a father who would beat his mother while drunk or dangle young Kim over the balcony, Michael Jackson–style. “I wanted to be the one who would fix everything,” Kim says. “I thought if I tried hard enough, I could reengineer my father or, later, convince my mother to get back with him.” His stratagems didn’t work, but the trauma imprinted on his personality. “I had all the fear I could handle by the time I was six,” Kim says. “It made me strong.”

  The kid who emerged from this childhood was smart and willful, unafraid of adults and unimpressed with their authority. He didn’t have much interest in their schools either, the arbitrary courses or the magic supposedly conferred by a degree. Kim preferred to sleep late and skip class; his inattentiveness got him sent from high school back to middle school. He says his difficult behavior landed him in a psychiatrist’s office. The man gave him some tests; Kim stole the doctor’s wallet and took his friends out for ice cream.

  He was around eleven when he saw his first Commodore C-16 in a shop window, running a demo of some pixelated game. He hectored his mother until she finally bought it for him. It sat on his desk, a puzzle asking for his solution in BASIC, interesting in a way school never could be. A friend in school had a tool called ICE on a floppy disk. It allowed him to make copies of games, simply by removing a line of code.

  Nobody called that piracy. The point was unfettered access. The point was the possible. One of Kim’s schoolmates had described an online Shangri-La called X.25—basically a pre-Internet closed network. Kim bought himself a 2400-baud modem, the kind where you stick a phone handset into a rubber coupler. “I was in my new world.” He didn’t want to be anywhere else.

  “X.25 was quite hard to get into—you needed the code—but once you got in, the people there were very open about how to hack various things, sharing access numbers, speaking freely.” Kim sat silently lurking, absorbing the information. But before long he started his own attacks.

  One of the recurring hacks was a backdoor attack on corporate PBX systems—a company’s internal phone and data exchange. “Back then, there really was no concept of a system administrator,” he says. “Very few admins even knew how to change the default passwords. It never occurred to them that a kid might try to break in. It was like moving to some little Swedish village with no locks on the doors. You got in, became a super-user, and basically owned the network. It was a bonanza.”

  Most of the early PBXs were across the ocean, in Manhattan’s 212 area code, and required an expensive long-distance call. Luckily Kim had access to a hacker BBS forum for exchanging stolen calling-card numbers too.

  He loved crawling through a new company’s data, paying special attention to outgoing modem calls, which would lead him to even more PBXs. Kim wrote a little script and set it running at night, dialing up numbers, jiggling the knobs of the back doors; the next day he’d have access to 800 accounts, complete with usernames and passwords. He was building an army. “You find this world as a teenager, fourteen, fifteen years old? You don’t even think about going to school now, man. Who gives a shit about that?” Kim just wanted to stay inside, controlling a virtual world as he’d never been able to control his own. His exploits made him seem dangerous and cool to his friends, a hero. And the hacker scene fed perfectly into his sense of the world as being us-versus-them.

  The scam that got him arrested focused on the pay-by-the-minute phone chat lines popular in the early nineties. These were the German equivalent of 1-900 party lines that the phone com
pany charged as a long-distance call, usually at around $1.20 a minute. The operator of the line received a percentage from the local telecom, about 15 cents a minute per caller; the more callers, the more money the party line owner made. So Kim set up his own party line in the Netherland Antilles. Then he generated massive caller traffic using stolen calling-card numbers from the hacker bulletin boards.

  “It worked really well,” Kim says. He says he made more than 75,000 Deutschmarks (or about $195,000 today)—“which at the time was a huge amount of money, because I was a kid. I wanted to buy more modems for my BBS, a better computer—nice stuff to advance my capacity.”

  In 1993, three years into the scam, Kim got caught. He was arrested and spent four weeks in jail as a juvenile. Kim says he was “scared to shit” in jail but found it interesting too. “I had all these visitors, grown-ups from MCI and AT&T, coming just to talk to me.” He was shocked that these so-called experts from major corporations had no idea how a PBX operated, much less how it could be hacked. “It was like I was speaking Chinese,” Kim says. “It was unbelievable.” It was also a potential business.

  He partnered with fellow hacker and coding genius Mathias Ortmann to form Data Protect, one of the world’s first white-hat consultancies, charging hundreds of dollars an hour to tell businesses how to protect against people like themselves. Their former colleagues in the hacker community thought of them as traitors. Kim and Ortmann thought they were growing up.

  The German media quickly discovered the teenage wunderkind, and Kim discovered he enjoyed the spotlight. “The hacker was the new magician,” Kim remembers. “They treated you like you must be a fucking genius, man. But all I did, I scanned message boards. I got passwords. Any monkey could do that. There was nothing genius about it. But you get addicted to the headlines, people saying nice things, telling you you’re smart.”

  The gun was loaded: Kim had the needs of an outsider and the cred of a rock star. He had contempt for the system and the tools to beat it. He felt powerful and reckless and was being told he was smarter than the rest of the world. He was in his early twenties and getting paid, buying expensive custom cars and fine suits, renting yachts, throwing money around nightclubs, swaggering. Growing up he’d never felt particularly special. Now he had girls. He had a posse. He was featured in German magazine spreads.

  By 1997 Kim took it upon himself to make his own headlines, launching a website about his life and philosophy. He called it Kimble.org, for his hacker name, Kimble—as in The Fugitive’s Richard Kimble. Kim liked that his real name was inside it, and he identified with the movie about a good guy misunderstood and persecuted.

  A decade before Facebook made online oversharing the norm, Kim used Kimble.org to showcase his life. It was also one of the first websites to incorporate Flash. “The Internet was just ugly fonts with underlined blue links,” Kim says. “People would come to my site, see it moving and animated and colorful, and think—what is this? They’d never seen anything like it.”

  There were videos of Kim, photos of Kim. Kim as an icon of success, an inspiration. Kim with women. Kim on a mountaintop. Kim in a black suit. Kim in a white suit. Kim on a jet. He rounded out the site with motivational lists like “10 Rules of Success.”

  “People thought I started the site to promote my ego,” Kim says. “But it was to motivate people.” He knows it sounds silly, but that’s what he was, or wanted to be anyway—a motivational figure, a Gates, a Jobs, a Branson, Tony Robbins, and Donald Trump. The photos and videos, the posing and bragging and clowning—these were a clarion call for nerd confidence, an enticement to take a risk and achieve. As he was doing.

  By 2000, Kim had sold most of his stake in Data Protect and started a private capital investment fund. He had particular interest in a company called LetsBuyIt.com—a sort of proto-Groupon, ten years too early. Kim invested in shares of the company, believing that he could simplify its interface and make it a success. Then he announced his plan to raise another $50 million to fund it. The company stock jumped 220 percent, and Kim sold some shares at a profit.

  “I was chilling in Bangkok when I heard the news,” he says. He was being accused of insider trading. He says he didn’t consider acting on his own plans to be insider trading and was committed to the company; apparently, the securities regulators were less sure. The story of yet another crazy caper by the flamboyant Kim Schmitz created a media frenzy, and a German TV station sent a team to interview the famous genius in his presidential suite at the Bangkok Grand Hyatt. “I was really angry and a little cocky,” Kim concedes. “I told them that if this is how Germany treats their entrepreneurs, I don’t know if I ever want to be in Germany again. And that was a mistake.”

  German television replayed the images of the rich young troublemaker talking smack from a luxury suite in Thailand, acting like he was beyond the reach of German laws. A German prosecutor set out to prove him wrong and asked for Kim’s arrest; the German embassy in Bangkok revoked his passport. Now Kim was in Thailand as an illegal alien. Thai police cuffed him in his suite and led him to an immigration prison. “This wasn’t a normal jail,” Kim says. “This was fucking crazy. I’m wearing a custom suit. I’m thrown into a place, eighteen guys sleeping on a concrete floor, everyone in sweaty shirts, it’s forty degrees Celsius and smells like shit. I’ve got mosquitoes eating me, the food comes in a bucket.”

  Kim’s lawyer told him he could fight in court and win—he’d be out in a month. Kim hoped he was kidding. Germany was offering a two-day travel document if he’d agree to come home. Kim said, “Let’s go.” He was escorted onto a plane by two German policemen. The press were waiting.

  This was big news in Germany—the biggest insider trader in history, accused of violating a law that was only a few years old. “The headlines all said something about me being fat, ‘the downfall of the loudmouth,’ like that,” Kim says. “My lifestyle and Kimble.org had painted a target on my back.” They called him a megalomaniac, a swindler, the “hacker king.”

  Kim was considered a flight risk and spent five months in jail before being offered probation and a small fine if he’d plead guilty. “I was just tired,” Kim says. “I knew I was finished in Germany anyway.” And he knew Kimble.org was finished as well—there was no chance of his being an inspiration to anyone now. “So I took the deal. And there’s nothing I regret more. Because if I hadn’t pled, I wouldn’t have had that ‘career criminal’ label. And I wouldn’t be here today.”

  There is only one area in which Kim embraces an illicit identity: He has a rabid need for speed. He doesn’t drink or do drugs, but he drives unapologetically fast. Driving is his vice, an addiction to the rush of velocity and control of a graceful machine. Kim says that before he left Germany he tried to set a record for points against his license, “speeding past red-light cameras, flashing thumbs-up, getting off the exit, and doing it again.” In road rallies, he’s been known to bump cars or use the sidewalk to take the lead. His style is described by some as fearless, by others as reckless, and by all his competitors as truly good.

  Beginning in 2001 he and his computerized Mercedes “mega-Car” were a regular in the Gumball 3000 rally, a quasi-legal rich man’s Cannonball Run. Videos from the time show an outrageous Kim, often in the company of scantily clad women and sometimes sporting a replica Nazi helmet and the trophy. In 2004 he wanted to start his own rally, at a more mega-ultimate level.

  “The Ultimate Rally was supposed to be Gumball on steroids,” Kim says. He’d host it somewhere like North Korea and attract professional drivers from Formula One with a million dollars cash awaiting the winner. Kim saw a business based on video rights, films, and sponsorship.

  Kim and his new partner, Bram van der Kolk, drummed up interest by sending out videos of Kim’s racing exploits, often by e-mail. The problem was, the video attachments were too big, and the e-mails kept bouncing. Clearly, there had to be a better way to share large files online.

  They called their solution Megaupload. The ch
arges against the company describe their technology concisely: “Once that user has selected a file on their computer and clicks the ‘upload’ button, Megaupload.com reproduces the file on at least one computer server it controls and provides the uploading user with a unique Uniform Resource Locator (‘URL’) link that allows anyone with the link to download the file.”

  “It was a little idea,” Kim says. “At that point we honestly never expected to do anything more with it.”

  At first Kim used Megaupload to generate buzz around the Ultimate Rally, offering $5,000 for the best street-racing videos. “All of a sudden you have all these car people uploading videos and linking to them to share with friends,” Kim says. Soon they were pushing the limits of their servers.

  This had potential beyond racing videos, he began to realize. File sizes were getting bigger; HD had gone mainstream. The future was obvious. He never would have seen it if he was still in Germany, if his old business hadn’t been destroyed. The cloud was the future. “I decided, fuck Ultimate Rally,” Kim says. From then on, he would be all Megaupload. But he would no longer be Kim Schmitz.

  Schmitz was his father’s name. The last time he’d seen the man, he was being interviewed by a German television station. He seemed to be living in a garden shed, weathered and ravaged by drink. He told the interviewers that his hotshot son never came to see him. “How could they let him just say that, man?” Kim asks. He looks away. “It wasn’t right.” Kim got some letters after that but never responded. “I don’t know, maybe he’s dead now,” he says, blinking hard.

  Kim had left that world behind. His new business was a fresh start that promised to rebrand him as a dotcom giant. Why shouldn’t the world know him as a giant Dotcom? A URL was just a location, a phone number was too. But what was a name? He was honestly surprised nobody had thought of doing it sooner.