Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker (4 page)

“No, they’re only for our registered students.”

Giving up easily isn’t one of my character traits. “At my high school, the computer lab shuts down at the end of the school day, three o’clock. Could you set up a program so the high school computer students could learn on your computers?”

He turned me down but called me soon after. “We’ve decided to give you permission to use our computers,” he said. “We can’t give you an account because you’re not a student, so I’ve decided to let you use my personal account. The account is ‘5,4’ and the password is ‘Wes.’ ”

This man was chairman of the Computer Science Department, and that was his idea of a secure password—his first name? Some security!

I started teaching myself the Fortran and Basic programming languages. After only a few weeks of computer class, I wrote a program to
steal people’s passwords: a student trying to sign on saw what looked like the familiar login banner but was actually my program masquerading as the operating system, designed to trick users into entering their account and password (similar to phishing attacks today). Actually, one of the CSUN lab monitors had given me a hand debugging my code—they thought it was a lark that this high schooler had figured out how to steal passwords. Once the little program was up and running on the terminals in the lab, whenever a student logged in, his or her username and password were secretly recorded in a file.

Why? My friends and I thought it would be cool to get everyone’s password. There was no sinister plan, just collecting information for the hell of it. Just because. It was another of those challenges I repeatedly put to myself throughout the entire early part of my life, from the time I saw my first magic trick. Could I learn to do tricks like that? Could I learn to fool people? Could I gain powers I wasn’t supposed to have?

Sometime later one of the lab monitors ratted me out to the system administrator. Next thing I knew, three campus police officers stormed the computer lab. They held me until my mom came to pick me up.

The department chairman, who had given me permission to use the lab and let me log in on his own account, was furious. But there wasn’t much he could do: in those days, there were no computer laws on the books so there was nothing to charge me with. Still, my privileges were canceled, and I was ordered to stay off the campus.

My mom was told, “Next month a new California law goes into effect making what Kevin is doing a crime.” (The U.S. Congress wouldn’t get around to passing a federal law about computer crime for another four years, but a litany of my activities would be used to convince Congress to pass the new law.)

In any case, I wasn’t put off by the threat. Not long after that visit, I found a way to divert calls to Directory Assistance from people in Rhode Island, so the calls would come to me instead. How do you have fun with people who are trying to get a phone number? A typical call in one of my routines went like this:

At this point the caller was usually either baffled or indignant.

The reactions I got were hilarious.

In those days, two separate phone companies served different parts of the Los Angeles area. General Telephone and Electronics Corporation (GTE) served the northern part of the San Fernando Valley, where we lived; any calls over twelve miles were charged at a long-distance rate. Of course I didn’t want to run up my mom’s phone bill, so I was making some calls using a local ham radio auto patch.

One day on the air I had heated words with the control operator of the repeater over what he labeled “weird calls” I was making. He had noticed I was regularly keying in a long series of digits when I was using the auto patch. I wasn’t about to explain that those digits I was entering allowed me to make free long-distance calls through a long-distance provider called MCI. Though he had no clue about what I was actually doing, he didn’t like the fact that I was using the auto patch in a strange way. A guy listening in contacted me afterward on the air, said his name was Lewis De Payne, and gave me his phone number. I called him that evening. Lewis said he was intrigued by what I was doing.

We met and became friends, a relationship that lasted for two decades. Of Argentinean heritage, Lewis was thin and geeky, with short-cropped black hair, slicked down and brushed straight back, and sporting a mustache that he probably thought made him look older. On hacking projects, Lewis was the guy I would come to trust most in the world, though he came with a personality filled with contradictions. Very polite, but always trying to have the upper hand. Nerdy, with his out-of-fashion clothing choice of turtlenecks and wide-bottomed trousers, yet with all the social graces. Low-key yet arrogant.

Lewis and I had similar senses of humor. I think any hobby that doesn’t provide some fun and a few laughs now and then probably isn’t worth the time and effort you put into it. Lewis and I were on the same wavelength. Like our “McDonald’s hacks.” We found out how to modify a two-meter radio so we could make our voices come out of the speaker where customers placed their orders at the drive-through of a fast-food restaurant. We’d head over to a McDonald’s, park nearby where we could watch the action without being noticed, and tune the handheld radio to the restaurant’s frequency.

A cop car would pull in to the drive-through lane, and when it got up to the speaker, Lewis or I would announce, “I’m sorry. We don’t serve cops here. You’ll have to go to Jack in the Box.” Once a woman pulled up and heard the voice over the speaker (mine) tell her, “Show me your titties, and your Big Mac is free!” She didn’t take it well. She turned off the car, grabbed something out of her trunk, and ran inside… wielding a baseball bat.

“Complimentary apple juice” was one of my favorite gags. After a customer placed an order, we’d explain that our ice machine was broken, so we were giving away free juice. “We’ve got grapefruit, orange, and… oh, sorry, looks like we’re out of grapefruit and orange. Would you like apple juice?” When the customer said yes, we’d play a recording of someone peeing into a cup, then say, “Okay. Your apple juice is ready. Please drive forward to the window and pick it up.”

We thought it would be funny if we drove people a little nuts by making it impossible to place their order. Taking over the speaker, each time a customer pulled up and placed an order, a friend of ours would repeat the order, but in a strong Hindi accent with hardly a word understandable. The customer would say he couldn’t understand, and our friend would say something else just as impossible to understand, over and over—driving customers crazy, one after the other.

The best part was that everything we said at the drive-through also blared out over the speaker outside, but the employees couldn’t override it. Sometimes we’d watch the customers sitting outside at the tables, eating their burgers and laughing. No one could figure out what was going on.

One time, a manager came out to see who was messing with the speaker. He glanced around the parking lot, scratching his head. There was no one around. The cars were empty. No one was hiding behind the
sign. He walked over to the speaker and leaned in close, squinting, as if he expected to see a tiny person inside.

“What the fuck are you looking at?!”
I shouted in a raspy voice.

He must’ve jumped back ten feet!

Sometimes when we were playing these pranks, the people who lived in the apartments nearby would stand on their balconies, laughing. Even people on the sidewalk were in stitches. Lewis and I actually brought friends along with us several times, because it was so hilarious.

Okay, childish, but I was only sixteen or seventeen at the time.

Some of my escapades weren’t quite as innocent. I had a personal rule about not entering any phone company facilities, tempting though it would be to actually gain access to the systems and maybe read some phone company technical manuals. But, as they say, it was less like a rule for me than a guideline.

One night in 1981, when I was seventeen, I was hanging out with another phone-phreaker buddy, Steven Rhoades. We decided to sneak into Pacific Telephone’s Sunset-Gower central office, in Hollywood. Since we were already phone phreaking, strolling into the phone company
in person
was the ultimate hack. Access was by pressing the right code numbers on the outside door’s keypad, and we social-engineered the code without a problem, letting us walk right in.

My God—how exciting! For us, it was the ultimate playground. But what should we look for?

A large man in a security guard’s uniform was making his rounds of the building and came upon us. He was built like a nightclub bouncer or an NFL lineman—very intimidating. Just standing quietly, hands at his sides, he could scare the pants off you. Yet somehow, the tighter the situation, the calmer I seem to get.

I didn’t really look old enough to pass for a full-time employee. But I dived in anyway. “Hi,” I said. “How’re you tonight?”

He said, “Fine, sir. May I see your company ID badges please?”

I checked my pockets. “Damn. I must have left it in the car. I’ll just go get it.”

He wasn’t having any of that. “No, you’re both coming upstairs with me,” he said.

We didn’t argue.

He brings us to the Switching Control Center on the ninth floor, where other employees are working.

Heart pounding. Chest heaving
.

A couple of switch techs come over to see what’s going on. I’m thinking that my only option is to try to outrun the rent-a-cop, but I know there’s slim chance of getting away. I’m desperate. It feels like there’s nothing between me and jail but my social-engineering skills.

By now I know enough names and titles at Pacific Telephone to try a ploy. I explain, “I work at the COSMOS in San Diego, and I’m just showing a friend what a central office looks like. You can call my supervisor and check me out.” And I give him the name of a COSMOS supervisor. Thank God for a good memory, yet I know we don’t look like we belong there, and the story is lame.

The guard looks up the supervisor’s name in the intercompany directory, finds her home phone number, and places the call.
Ring, ring, ring
. He starts with an apology for calling so late and explains the situation.

I say, “Let me talk to her.”

He hands me the phone, which I press hard against my ear, praying he won’t be able to hear her voice. I ad-lib something along the lines of, “Judy, I’m really sorry about this—I was giving my friend a tour of the switching center and left my company ID card in the car. The security guard is just verifying I’m from the COSMOS center in San Diego. I hope you won’t hold this against me.”

I pause a few beats, as if listening to her. She’s ranting. “Who
is
this? Do I know you? What are you doing there?!”

I start in again. “It was just that I had to be here in the morning anyway, for the meeting on that new training manual. And I have a review session with Jim on Monday at eleven, in case you want to drop in. You and I are still having lunch on Tuesday, right?”

Another pause. She’s still ranting.

“Sure. Sorry again for disturbing you,” I say.

And then I hang up.

The guard and switch techs look confused; they were expecting me to hand the phone back to the security guard so she could tell him it was okay. You could just see the look on the guard’s face: Did he dare disturb her a
second
time?

I tell him, “She sure was upset at being woken up at two thirty in the morning.”

Then I say, “There’s just a couple other things I want to show my friend. I’ll only be another ten minutes.”

I walk out, Rhoades following close behind.

Obviously I want to run but know I can’t.

We reach the elevator. I bang the button for the ground floor. We sigh with relief when we get out of the building, scared shitless because it was such a close call, happy to be out of there.

But I know what’s happening. The lady is calling around desperately, trying to find somebody who knows how to get the phone number for the guard’s desk at the Sunset-Gower CO, in the middle of the night.

We get to the car. I drive a block away without turning on my headlights. I stop and we sit there, watching the front door of the building.

After about ten minutes, the burly guard comes out, looking around in every direction but knowing damned well we’re long gone. Of course, he’s wrong.

I wait until he goes back inside, then drive away, turning on my headlights after rounding the first corner.

That was too close. If he had called the cops, the charge would have been breaking and entering, or even worse, burglary. Steve and I would have been headed to Juvenile Hall.

I wouldn’t be going back into a telephone company facility again anytime soon, but I was keen to find something else—something big—to challenge my ingenuity.