Show Notes

The following presentation is not suitable for young children. Listener discretion is advised.

Cold Open

Michael Stanfill woke one morning to find the lights in his small, dim apartment didn’t work. When he went to check his landline, there was only silence. 

The year was 1994 and Michael had just signed a 6-month lease at “The Lakes.” It was a nice, sprawling apartment complex in Northeast Raleigh, North Carolina. Michael was 31 years old, tired, and down on his luck. 

In his new apartment, Michael had just unpacked boxes of electronics: phones, computers, monitors, meters of wire and cable. Sweat started to bead down his face when he realized none of the equipment would be operable without power. No phones. No computers. No internet. 

To the casual observer, this might be a good chance to “unplug,” relax and disconnect from technology for a while. But Michael isn’t normal. He has a dark secret, a dark obsession. He has to stay online. Without access to computers or telephones, he is a nobody. 

Michael stepped outside his apartment. He strolled to a bank of payphones near the leasing office at “The Lakes.” He dialed the number for Carolina Power & Light. 

The employee who fielded his call sensed something wasn’t right. Maybe it was Michael’s panicked tone. But most likely, it was the case of identity fraud Carolina Power & Light were informed about. 

The employee notified Michael he was going to need to speak to her supervisor. Michael felt a tightness in his chest. He looked around the parking lot. Was someone watching him? 

When the supervisor at Carolina Power & Light got on the line, Michael was peppered with questions: What was his full name, where was he from, who had he worked for...But Michael kept his cool. Until the supervisor delivered the news...

“There’s another Michael Stanfill in Portland, Oregon,” the supervisor said. “The Portland Stanfill says someone has stolen his identity.”

Not sure what to say, the “Michael” in Raleigh replied, “that’s impossible, let me fax you a copy of my driver’s license.”

And that’s when it dawns on Michael that he was caught in a trap.

Because the Michael in Raleigh, NC wasn’t really Michael. 

In some circles, his name was “The Condor,” and he was revered as the most successful, bad-ass hacker that ever roamed the wild frontier of the early internet. 

To some though, he was the most dangerous man in America, capable of hacking into the Department of Defence’s mainframe to launch a few nukes and kick-off World War Three. 

His real name was Kevin Mitnick. And, on that cold February day, he was on the run from the  FBI for hacking and computer fraud. On top of that, he had a $1,000,000 reward for his arrest courtesy of the California DMV for fraud. He was the most wanted hacker in the world. 

15 years of bad choices, inflated egos, relentless curiosity, and compulsion brought Kevin to that payphone, committing identity fraud and lying through his teeth to get power back to his computers and telephones. 

Dropping the payphone receiver and letting it dangle by its cord, Kevin felt his world collapsing, a delicate house of cards held together by false identities and obscuring his cell phone signal.

He needed a new identity. Fast.

It was only a matter of time before the FBI zeroed in on his location.  

Can the most wanted hacker in the United States evade the FBI? Will the U.S. eliminate the threat of nuclear annihilation caused by hacking? Will Kevin ever stop running and use his computer superpowers for good?

I’m Keith Korneluk, and this is Modem Mischief.

You're listening to Modem Mischief. In this series we explore the darkest reaches of the internet. We'll take you into the minds of the world's most notorious hackers and the lives affected by them. We'll also show you places you won't find on Google and what goes on down there. This is the story of Kevin Mitnick

[THEME MUSIC]

Act 1

Kevin Mitnick grew up fascinated by magic. Born into a working-class Jewish family in Van Nuys, California in 1963, Kevin’s childhood wasn’t always easy. His father left home when he was three and his mother worked at a local deli most hours of the day. 

Kevin was a shy, overweight child with massive horn-rim glasses. He and his mother bounced around from apartment to apartment, up and down Los Angeles’s San Fernando Valley. Life was chaotic, uncontrollable, and unpredictable. His mother’s boyfriends and husbands abused or molested Kevin. He developed mistrust and hatred for authority figures. 

But for Kevin, magic was his reprieve from a life that felt entirely out of his control. With sleight of hand tricks, magicians could make objects disappear and reappear at their command. Kevin watched magicians stun and delight crowds with their deception. And, for Kevin, that forbidden knowledge and control that magic granted the magician were all too enticing. 

By age 10, Kevin spent as much time out of the house and away from the abusive father figures. He frequented magic shops or simply rode the bus around Los Angeles for hours at a time. It was on one fateful bus ride that the driver introduced Kevin to the concept of amateur radio, better known as ham radio.

For the average ham radio operator, it was a hobby that allowed you to meet new people, listen in on conversations, and chat with folks without paying a phone bill. But for a young Kevin Mitnick, radios were a new frontier, a chance to learn and explore.

By the time he was 13, Kevin was taking classes at night school, learning the ins and outs of radio circuits, regulations, and morse code. During the day, he’d cut class and ride the bus to Henry Radio, a West Los Angeles ham radio store. 

Kevin also frequented the Survival Bookstore in North Hollywood. Looking up to masters of manipulation and subterfuge like Houdini and T.V. show private detectives, Kevin consumed books like The Big Brother Game, a handbook for committing fraud and evading authorities. Before Kevin even entered high school he knew how to completely obscure his paper trail and assume a new identity — valuable skills later in his life.

This fervor for mastering radio circuitry quickly changed by the time Kevin was enrolled at Monroe High School in Sepulveda, California. While other kids were studying, playing football, or learning automobile maintenance, Kevin walked around with his handheld ham radio. This caught the attention of another student named Steven. An arrogant bastard at best, Steve loved taking other students to his radio antenna-studded car during lunch. He showed off all the equipment and tricks he could do with a phone. 

For example, Steven knew how to get anyone’s phone number in L.A., including the likes of Lucille Ball and Bruce Springsteen. He could change people’s phone numbers, hide his phone number, and more. Steven was what you’d call a phone phreak — someone who manipulates phone companies and networks to their advantage. And Kevin, seeing the power and magic in the phone system, wanted in.

Steven taught Kevin some basic tricks, but wouldn’t disclose everything. So, left on his own, Kevin realized he had a knack for getting people to trust him. While Steve had some technical prowess with phone codes, Kevin simply conned people to get information from them. Kevin knew that if he was confident and established credibility in the eyes of others, he could get almost any piece of information from a phone technician or lineman — unlisted phone numbers, addresses, billing information, whatever the phone company knew, Kevin could get it from them. This technique of information gathering would later be called “social engineering,” and even at age 14, Kevin was an expert social engineer. 

The thrill of knowing something that very few others knew how to do continued to drive Kevin. He was part of an elite group of geeks: he was a phone phreak. 

But using this knowledge, harnessing the power of having unfettered access to telecommunications across the U.S., manifested itself in rather juvenile ways. After all, Kevin was only 14. 

While Kevin was conning a phone operator using an autopatch on his ham radio to make long-distance calls, another ham radio operator tuned in. Realizing that Kevin was capable of manipulating phone operators and could use an autopatch, the man reached out to Kevin over the radio and gave Kevin his phone number.

The man’s name was Lewis De Payne, who also went by his hacking name Roscoe. Lewis kept his hair slicked back straight, rocking a mustache, bell bottoms, and turtlenecks. He turned Kevin onto pranking people with the power of their radios and phones. 

One day, Kevin and Lewis decided to modify a radio so they could broadcast their signal into a drive-through speaker. The two teens parked across the street from a Mcdonald’s. Kevin sat in the front seat of his car, sweating in the LA heat. Kevin’s 5-watt radio seriously overpowered the cheap radio headsets that McDonald’s employees have.

Kevin and Lewis slump down into their car’s seats, stealthily eyeing the drive-through intercom and speaker. When a car pulled up, Kevin saw the attractive woman behind the steering wheel.  He leaned into the radio,  “Hey, welcome to McDonald’s. If you show us your titties, you get a free big mac!” Kevin watched with glee as she grimaced and threw the car into park. She got out, grabbed something from her trunk, and marched into the McDonalds. Kevin and Lewis burst into laughter. 

When a cop car rolled through the drive-through, this time Lewis grabbed the radio’s microphone. When the cop rolled down his window, he shouted into the mic, “Hide the cocaine, hide the cocaine!” 

Kevin and Lewis would use thick Hindi accents to make it impossible for people to order. They’d offer people free apple juice and then play a recording of someone peeing in a cup. And all the while, the staff at McDonald’s helplessly watched angry customers berate and yell at them for how rude they were. 

Not willing to take another moment of pranks, the McDonald’s manager inspected the parking lot. He looked for someone on their phone, but he never checked across the street. Kevin and Lewis, couched safely in their car, couldn’t stop laughing at the exasperated manager pacing up and down the parking lot in the afternoon sun.

With no sign of any radio operators in the parking lot, the manager suspected there’s someone or something at the intercom. Peering into the speaker, bending his ear closer and closer to the metal shielding, the manager looked into the darkness beyond the metal grill of the speaker. 

And that’s when Kevin shouted  into his mic, “What the fuck are you looking at?!” The manager flew backward across the parking lot, scared and stunned. Kevin and Lewis cracked up laughing. 

These mostly innocent hijinx went on for a while with Kevin and Lewis. Lewis was satiated with pulling pranks and psyching people out, but Kevin was starting to get hungrier. Never satisfied with just staying at one level, in one place, he wanted to learn the next trick, unlock the next level of knowledge. 

By the time he was 17, Kevin had graduated high school with a GED and was taking computer classes at Pierce College. Kevin had learned how to gain admin access to an early operating system called RSTS/E made by Digital Equipment Company on any computer. He used the L.A. Unified School District computers, community college computers, and eventually USC and UCLA computers to hack into secure networks — all thanks to Kevin’s social engineering skills.

While Kevin’s bread and butter was still phone phreaking, he became increasingly interested in hacking computer networks. Governments, companies, and just about everyone was starting to store secret or confidential information on computer networks. And because there was so much important information on these networks, no one wanted to lose or compromise any of it.

That’s exactly how Kevin exploited so many technicians and system administrators at companies. 

One of the earliest times Kevin broke into a company’s network was with U.S. Leasing, a San Francisco-based company that sold electronic equipment, rail cars, and computers. Kevin was still only 17-years-old, but he had an insatiable thirst for knowledge. 

To get onto the secure network, Kevin would call a system administrator and tell them he was from DEC support — remember DEC? The people who make the operating system that Kevin knows like the back of his hand? — “There’s been a catastrophic bug in your operating system…you could lose all the data,” he’d say. 

Kevin exploited the fear of losing information so that he could in turn gain confidential information. At U.S. Leasing, one particular system admin was so scared of losing data that they fed Kevin the password to the system manager. In a matter of minutes, Kevin installed a “backdoor” on their system which allowed him to access the network anytime and from any computer.

Lewis and Kevin were thrilled to have pulled off a hack that seemed so adult, so secret-agent that they could hardly believe it. 

Kevin shared the credentials to use the backdoor with Lewis, who in turn wrote them down. Unfortunately for both Lewis and Kevin, there was a third person who wanted to get in on the two boys’ fun. Her name was Susan Thunder. An L.A. streetwalker, rock-n-roll groupie, sex worker, and budding hacker, Susan befriended Lewis and the two started dating. 

Susan was tall, towering over both of the boys at 6’2”. Her interest in computer hacking most likely had a financial motive, although her hacking career was fairly short-lived. In 1981, though, she was turning tricks to save up for a personal computer — a small fortune back in the day. When she was with Lewis, though, she was able to use his computer. She was captivated by his ability to manipulate secure networks. She was so interested that she swiped the backdoor access to U.S. Leasing. 

As time went on, though, Lewis and Susan’s relationship started to deteriorate. Susan noticed that Kevin was taking up so much of Lewis’s time and that Lewis was more interested in hacking with Kevin than with her. This spark of jealousy bloomed into a wrathful fire in just a few weeks. 

When the relationship soured between Lewis and Susan, she took to accosting and accusing Lewis of child molestation on a public messaging board popular with phone phreaks: 8BBS.  

Susan also expressed her frustration at Kevin — the boy that Lewis had spent most of his time with. Susan cut the lines to Kevin’s mother’s house, and she used the backdoor access to U.S. Leasing to print out hundreds of fliers on the printers. All the pages said was “MITNICK WAS HERE / MITNICK WAS HERE / FUCK YOU / FUCK YOU.” 

When Kevin and Lewis met up, they started to worry about Susan’s behavior. Calling her bluff and hoping that she would back off, Lewis filed a civil harassment complaint. When Susan was called into court, the hearing officer warned her and asked her to cease her behavior. She nodded and was dismissed.

Now that Kevin and Lewis had Susan off of their backs, they were ready to pull off another hack. The two boys were sitting at Shakey’s Pizza Parlor on Memorial Day weekend enjoying a couple of slices of pizza. There were two dozen other phone phreaks who showed up, and they were all joking around about the ultimate hack: gaining access to COSMOS, the Computer System for Mainframe Operations at Pacific Telephone. Even though Kevin and Lewis had done it before, they were hoping to amaze some fellow phone phreaks. They were going to penetrate the network...that night. After all, the COSMOS building was just down the street from the Shakey’s Pizza. 

After some unsuccessful dumpster-diving to find passwords or keycodes, Kevin, Lewis, and their phone phreak friends walked right into the lobby of the building. Kevin sauntered up to the security guard and explained the situation. He was an employee who wanted to show some friends where he worked.

The security guard barely batted an eye, waving Kevin and his friends through to the building’s interior. Kevin knew exactly where to go to get to the COSMOS room thanks to previous conversations with Pacific Telephone technicians: room 108. 

Once Kevin and his pals entered room 108, they immediately started grabbing folders, brochures, manuals, any piece of confidential or secret information that wasn’t nailed down was stuffed into a suitcase Lewis found in the room. Kevin knew that with the manuals, he could learn all of the codes and commands only technicians knew how to use. With the manuals, he wouldn’t need to scam people for information — he could just make whatever call or connection he wanted.

When Kevin got home, he made Lewis take all the manuals and hide them for the time being. Unfortunately, Lewis either didn’t hide them well enough or he told too many people about them. Because before long, Susan Thunder heard about the COSMOS break-in. Her chance for getting back at Kevin and Lewis had come.

With barely any hesitation and full of wrath from the civil harassment complaint, Susan Thunder scheduled a meeting with Los Angeles District Attorney Investigator Bob Ewan. 

In her meetings with Ewan, Susan began divulging the details of Kevin and Roscoe’s hacks. As he listened to Susan, Ewan started to see pieces of a strange hacking puzzle come together: the bizarre messages at the U.S. Leasing office, the complaints from the phone companies, and now a case of missing computer manuals at PacBell’s central office. The two names that kept coming up in Susan’s story? Kevin Mitnick and Lewis De Payne. 

As if that wasn’t enough, Susan did a bit of her own social engineering to get what she wanted — which was to get Kevin and Lewis imprisoned. She told Ewan that she had downloaded and printed missile-firing parameters and maintenance schedules for intercontinental ballistic missiles. And, while she wasn’t capable of doing anything with the information, she convinced Ewan and the other DA investigators that Kevin was certainly capable of taking that information and starting World War III. She added that Kevin is big, 200-plus lbs, and could be armed with a “logic bomb” — but, of course, she failed to elaborate that a logic bomb is a piece of software that can delete data on a computer if certain conditions are met. It wasn’t an actual explosive at all. 

Ewan, based on Susan’s description, saw Mitnick as a major threat to national security — a terrorist, possibly. 

A few weeks later, Kevin was driving home from his work at Stephen Wise Temple in Bel Air when he passed an old, nondescript Crown Victoria. Three men sat inside the car. As Kevin drove by and looked into the car, three sets of aviators stared back at him, following Kevin’s car down the street. It was all too obvious that they were cops.

Kevin peaked in his rearview mirror to see if the Crown Vic was following him. The car pulled out of its parking spot and immediately started following him. Then, he saw the driver attach a portable police light onto the hood of the car. Soon the light was flashing. Just as Kevin was pulling onto the 405 freeway, the cop car passed him and forced him onto the shoulder.

The three men jumped out of the Crown Vic. They drew their guns, demanding that Kevin get out of the vehicle. He complied. They slapped handcuffs on him and hauled him into the back of the undercover police cruiser. 

(Beat)

Kevin’s first trial was largely uneventful — except for the possible threats Kevin posed to telecom systems across the world. Susan’s tall-tales she told the DA’s office made an impact. And, even though there was no evidence that Kevin used the computer manuals to steal credit card information or defraud PacBell customers, the prosecution argued Kevin was dangerous. But, there also wasn’t evidence that Kevin profited from the U.S. Leasing office hack. So, the judge thought, why was this juvenile delinquent hacking?

At the hearing, the Juvenile Court Judge ruled Kevin be sent to a facility in Norwalk, CA for a 90-day psych evaluation. The eval was to determine whether Kevin needed to be rehabilitated. The cold steel bars slammed shut on Kevin, in the first of many more jail sentences that would plague Kevin’s life. 

Act 2 

After Kevin’s first jail stint  in 1981, the law never took its eyes off of him. Like a father weary of their own child’s power, the full weight of the justice system monitored Kevin’s activities. 

When Kevin finished the 90-day psych eval, the Califonia Youth Authority recommended that he be released on probation. He was also required to attend psychological counseling. When Kevin sat down for his first counseling session and explained he was on probation for hacking, the counselor, Roy Eskapa, was shocked. So used to working with addicts and violent sex offenders, Roy was delighted to have such a bright kid in his office. 

In some ways, Roy only fanned the flames of Kevin’s ambitions. Rather than uncovering some               psychological yearning to control, Roy and Kevin talked shop about phone phreaking during their sessions from 1981-82. 

So, as Kevin’s probationary period came to end, he figured he could dip his toes back in the world of hacking. After all, even his counselor thought it was cool — and certainly not as serious as other crimes. 

To assist him in future network hacks and data collection, Kevin partnered up with Lenny DiCiccio. Lenny was tall, young, athletic, and had access to the computers that Kevin desperately needed. For work, Lenny was a computer operator at Hughes Aircraft, which gave him access to Dockmaster. In the ’80s, Dockmaster was essentially owned by the National Security Agency. When Kevin and Lenny conned an NSA employee into handing over their credentials, the two hackers quickly realized they had just infiltrated one of the most secure government agencies in the world. 

Kevin and Lenny did do much with the access — it was more of a trophy, a badge of honor that they had cracked the code, that nothing and no one could stop them.

Building on this momentum, Kevin and Lenny schemed up a way to break into the Pacific Bell’s Switching Control Center System. Different regions of the U.S. had specific SCCSs, so if Kevin hacking into enough systems, he’d have unlimited access to all telephone lines — including lines in the Pentagon. 

In some ways, it was like a video game, with each control center a new level in a cybersecurity puzzle. But for Kevin, it was also sticking it to the very government that locked him up for exploiting their own weaknesses. 

In the same way that Kevin betrayed the trust of hundreds of telephone operators, technicians, and IT staff, he violated the security of the nation’s most secure information. It was this power and control that Kevin sought out in hacking — that, and...well, he had a lot of fun doing it. 

For the next few years, Kevin continued gaining access to Switching Control Center Systems. Coincidentally, he also met his now ex-wife Bonnie during this time. They moved in together, started spending more time together, and eventually talked about getting married. 

But during their relationship, Kevin couldn’t stop the obsession with hacking and control. He lied about where he was at night, telling Bonnie he was taking classes at UCLA when in reality, he would drive over to meet Lenny at Hughe’s aircraft and hack until sunrise.

By the time Kevin had a personal computer in 1986, he spent as much time as possible in front of the screen. He carried out a series of hacks on a company called Santa Cruz Operations, looking for a way to better understand the operating system the phone company control centers used. 

When Santa Cruz Operations found out Kevin had hacked their systems, the Santa Cruz police drove down to L.A. to seize all of Kevin’s files at the apartment he shared with Bonnie, including all the information on the telephone company control centers.

Fearing criminal charges from the Santa Cruz Operations hack, Kevin proposed to Bonnie. Because the law allows for confidential marital communications priveledges, Kevin saw marriage as a way to insulate Bonnie and himself from incriminating each other. Their wedding was held at a minister’s house in Woodland Hills. Kevin’s grandma, mother, and mother’s boyfriend watched as Kevin said “I do” to Bonnie, who was wearing flip flops, jeans, and a t-shirt. None of her family attended. 

Lucky for both Kevin and Bonnie, though, they never had to use their martial communications privileges. Santa Cruz Operations dropped the charges in exchange for Kevin consulting their security team on how he breached their network. When Kevin went to pick-up his seized property from the Santa Cruz Police, he realized something horrific: the police had passed all of his information along to PacBell — the very company who operated the switching control centers. He hoped nothing would come of it, but only time would tell.

The situation with Santa Cruz Operations was an incredibly close call. It cost Kevin and Bonnie all of their savings. They moved in with Kevin’s mom to save some money. For most people, losing all your money and endangering your wife with prison time might make you think twice about life choices. But Kevin isn’t most people. 

Instead of dialing back on hacking, Kevin dove deeper into cyberspace. When he wasn’t working, he was hacking. He and Bonnie grew increasingly distant. Slowly, she watched the man she once loved disappear into wires, terminals, and modems of his all-night hacking benders.

By 1988, Kevin was collaborating with Lenny, Lewis, and a few other hacker friends on their biggest job yet: hacking into Digital Equipment Corporations network. The goal was to copy their new VMS operating system so they could study it and find flaws. If Kevin and his accomplices knew all of the flaws, then all of Digital Equipment Corporations computer networks would be accessible to them. 

There was just one wrinkle in the whole plan. Kevin’s friendship with Lenny was on the rocks. For years, the two hackers had a symbiotic relationship: Kevin used Lenny’s computer access at Hughes Aircraft, while Lenny got to leach some of the techniques and glory off of Kevin. 

But this dynamic ended when the FBI questioned Lenny. Lenny lost his job as a result of using the Dockmaster to get into the NSA network. 

To add insult to injury, Kevin started pushing Lenny’s buttons a little — testing to see how his ego held up under scrutiny. 

Kevin and Lenny had friendly wagers and bets while they worked on the Digital Equipment Corp hack. In between cracking access codes and sweet talking system admins, the two hackers placed bets on each other. As Kevin’s hacking prowess increased, Lenny’s losses on wagers also increased.

As the weeks went on, Lenny’s debt to Kevin grew...and grew...and grew. Lenny grew increasingly annoyed and resentful at the know-it-all 25-year-old Kevin. 

Gaining greater satisfaction over the emotional toll he was taking on Lenny, Kevin called the accountant at Lenny’s new workplace and told her he was an IRS agent with a wage garnishment order on Lenny — . When the accountant informed Lenny that the IRS had contacted the company, Lenny knew exactly who was pranking him.

Kevin’s problem, time and time again, was that he never walked away. He loved pushing the envelope, taking things too far. And with Lenny, he certainly crossed a line that he could never come back from. 

Lenny’s frustration culminated in confessing to his boss that he and Kevin had been using company property to hack into Digital Equipment Corp. Lenny’s boss notified Digital Equipment Corp. Eventually, the FBI got involved. They had Lenny wear a wire, and asked him to testify against Kevin once a trial started. Lenny was all too enthusiastic to get back at Kevin for his mind games.

After Lenny successfully recorded Kevin hacking into Leeds University to study their operating system, the FBI had enough information to arrest Kevin.

A few days later, Lenny called Kevin to tell him he had the money to settle his debt. More than pleased that he was finally going to get paid, Kevin met Lenny at the parking garage at Lenny’s workplace. 

As soon as Kevin stepped out of his car, engines roared through the parking garage. Kevin was stunned. All around him, cars were blocking entrances and encircling him and Lenny. But as the FBI agents announced themselves and drew weapons, Lenny slinked back behind the agents. Kevin got played. He had pushed too many buttons, and now he was paying the price. Lenny danced in the garage as Kevin was handcuffed and led away to Terminal Island Federal Prison. 

During his initial detention hearing, Assistant U.S. Attorney Leon Weidman layered on allegations of hacking into the NSA and stealing access codes, tampering with arrest records, harassment, and more. Kevin knew these allegations were false, but the judge and the prosecutor couldn’t make sense of all the information they had. It was 1988 and most people were technologically illiterate, especially older generations. For the prosecutor, all he saw were possible threats and a terrorist in the making. 

The hearing culminated with the prosecution arguing that Kevin could “whistle into a telephone and launch a nuclear missile from NORAD.” Kevin knew this was ridiculous since NORAD’s network was completely insulated and didn’t operate on public telephone lines. But, the Judge was convinced that Kevin was a danger to society. 

Kevin was eventually held without bail in solitary confinement — the only place far away from phone access at the Federal Metropolitan Detention Center in L.A. By the time sentencing came around, the judge ordered Kevin to one year in prison with another 6 month supervised release in a halfway home. 

During his prison sentence, Bonnie visited Kevin when she could. Kevin promised her he wouldn’t hack again, wouldn’t go down that road. But Bonnie was barely holding on. When Kevin was finally released into the halfway house, a probation officer visited Bonnie at her apartment to inspect and approve Kevin’s future living situation. That’s when Bonnie decided it was too much. A few days later, she filed for divorce. 

In just a few years, Kevin would come to learn that Bonnie and his old hacking pal Lewis became lovers. 

(beat)

During Kevin’s time at the halfway house, a facility called Beit T’Shuvah, which in Hebrew translates to House of Repentance, Kevin transformed himself. He took part in a 12-step program to work through his compulsive computer hacking. He started eating healthier and shedding much of the weight he had carried since he was a teenager. Kevin was turning a new page in his life. Gone were the all-night hacking sessions, the conning, the deception. Kevin was living in truth and acceptance, putting his hacking days behind him…

Or so he thought. 

(beat)

On December 26, 1994, a 30-year old computational physicist named Tsutomu Shimomura was preparing to volunteer with the Lake Tahoe, California, ski patrol. He was a slim, laid-back man with long, jet-black hair. During most of the year, he worked at the San Diego Supercomputer Center at the University of California, San Diego. During his 15-year career in computing, he developed a reputation as an eminent cyber security expert. 

As he’s packing his skis into his car, Tsutomu gets a phone call from one one of his graduate students, Andrew Gross. Andrew explains that Tsutomu’s personal computer at his San Diego home had been compromised — as in, someone was stealing research and moving it off of Tsutomu’s computer.

The only reason Andrew knew this was happening is because of a program that Tsutomu installed on his computer. The program, called “cron” that emailed system logs to Andrew. When the system logs showed new, unexplained activity, Andrew knew he needed to call Tsutomu. 

By the end of the day, Tsutomu discovered that hundreds of files and software programs had been remotely stolen from his computer — including a method for obscuring your phone’s serial number through an early cell phone made by OKI. 

Tsutomu knew the information that was stolen, if it fell into the wrong hands, could be used for fraud and becoming virtually undetectable. Tsutomu needed to find whoever stole the information and would dedicate the next two months of his life to finding the hacker.

By late-January of 1995, Tsutomu received a rather serendipitous call. It was from The WELL, an early virtual community website that housed forums, email accounts, and web pages. 

Administrators from The WELL had found hundreds of megabytes of data — which, in 1995, was a massive amount of data. And all of the data had Tsutomu’s name on it. 

Not wasting a single moment, Tsutomu rushed up to Sausalito, just on the north side of the Golden Gate Bridge in San Francisco. Situated on the quaint Northern-California town’s waterfront, Tsutomu set up a complex monitoring system at the WELL’s headquarters. Between Tsutomu, his assistant Andrew, and another security consultant, there were three laptops plugged into the WELL’s computer network — again, this was a rare occurrence in 1995. 

With the three computers dialed into the network, Tsutomu cloaked himself and his associates so they could monitor the stolen files and see who was looking through them. As the team of three waited, they realized that the hacker had actually hacked the computer that protected Motorola’s network. Tsutomu figured the hacker used the same technique on Motorola that was used on his own computer. 

In real-time, Tsutomu was watching the situation deteriorate and get out of control. If they didn’t move faster, the hacker could disappear with all of Tsutomu’s files. 

Tsuutomu and his team couldn’t confirm it for sure, but based on the kind of attacks and the data that was stolen, it was most likely a fugitive who was on the FBI’s most wanted list since 1992: Kevin Mitnick. 

Act 3 

From 1992 to February of 1995, Kevin Mitnick stayed on the FBI’s most-wanted list. Elusive, slippery, and hiding in plain sight, he deployed all of his hacking and social engineering prowess to remain undetectable.

It’s likely he could have stayed a specter, lurking on the fringes of the internet and penetrating the very core of a rapidly digitizing corporate America. But his decision to hack Tsutomu Shimomura’s computer was something Kevin would come to regret.

Before hacking Tsutomu, Kevin had a few slip-ups, like the Carolina Power & Light incident. In all of these mistakes, he was able to cover his tracks quickly. He’d reinvent himself at the drop of a hat, taking advantage of outdated bureaucracy. At the time, birth and death records weren’t tracked nationally at the time, meaning if someone was born in North Dakota and died in California, North Dakota wouldn’t necessarily know if that person was indeed dead. But, it took more than conning the system: it took betraying the trust of hundreds of people in Kevin’s life for him to get so far. 

So when he hacked into Tsutomu’s computer from North Carolina at the end of 1994, Kevin made the final mistake of his criminal career. 

Through early 1995 Kevin continued to log onto The WELL, make calls, and even monitor the email account of New York Times technology writer John Markoff — the journalist who introduced the world to Kevin on the front page of the Times. But while Kevin snooped around, Tsutomu and his team watched his every move. 

When Kevin tried going to a secure website he and one of his hacker buddies communicated on, he noticed something troubling: the data logs showed someone else had logged in with his credentials. That’s when the paranoia set in.

Kevin decided to check on the phone company’s central switch that he had hacked — just to see if anything was out of the ordinary. As he logged into the network and sifted through those data logs, his paranoiac fears became justified: there was a trap-and-trace activated on the modem he was using. That meant that some law enforcement group was recording all of his activity. 

To get a better handle on the situation, Kevin called the Network Operations Center for the phone company he was using. Pretending to be from the security division, he tried to find out how long the trap-and-trace had been placed on his modem. But when he asked the operator about the trap-and-trace, she grabbed her supervisor. The supervisor grilled Kevin, asking for his callback number and his boss. The supervisor told Kevin he can’t give him the information and ends the call. 

The walls started closing in for Kevin. He’d had close calls, but he always had control of the situation — usually he was two steps ahead of his pursuers. But for the first time in what felt like lifetimes, Kevin felt behind, losing control of his carefully constructed life. His digital movements were being tracked...were his physical movements being tracked, too?

(Beat)

For five hours, Tsutomu talked with a Sprint Cellular technician in Raleigh. He was attempting to determine whether the cellular tower that Kevin’s signal came from was located in Colorado, Minneapolis, or Raleigh. Because, according to Kevin’s cell phone activity, it was coming from towers in all three states. 

Tsutomu knew he wasn’t in all three states. He just had to cross-reference numbers to determine which tower was broadcasting the original signal and not just a re-broadcast. After the lengthy call with Sprint, Tsutomu had the information he needed. The signal was indeed coming from a tower close to the Raleigh-Durham airport. 

By 1 a.m. on Monday, February 13, Tsutomu was riding around Northern Raleigh in a van piloted by a Sprint technician. Tsutomu had flown into Raleigh earlier that night, fueled by the possibility of catching the man who violated his computer network. The darkness obscured the van’s movements as it circled the suburbs of Duraleigh Hills. 

From the passenger seat, Tsutomu’s computer emitted a soft glow. His dark hair fell in front of his face as he watched a meter display readings. The laptop was hooked up to a cellular frequency direction-finding antenna. As the van moved through neighborhoods and apartment complexes, the meter on Tsutomu’s laptop showed that the frequency they were looking for was getting closer. 

Suddenly, the meter on the laptop lit up, hitting max-signal just as the van pulled into the Players Court, a nondescript apartment complex in a quiet part of town — save the jumbo jets landing just three miles away at the airport. 

Somewhere, hidden away in the building, was the man the FBI had been hunting for years. Tsutomu, like a faithful tracking dog, had located the den. Now he just had to wait for the FBI to capture their prey.

(Beat)

On February 14, after spending a Valentine’s Day evening working out, Kevin parked his car outside his apartment at the Players Club. Kevin didn’t notice the FBI surveillance van sitting just beside him. He didn’t notice the agents waiting in their unmarked cars. And, he certainly didn’t think this lonely Valentine’s Day was going to be his last day of freedom in the 20th century. 

As he booted up his computer, an awful feeling in his stomach grew. Kevin started moving files around in the WELL, trying to cover his tracks as best as he could.  He wondered if he was being overly cautious. He knew the authorities moved slowly. They were tracking his movements, sure. But there was legalese that needed to be sifted through, bureaucratic tape to be crossed, before the FBI could move in — or so he thought.

When he tried logging onto some of the other networks he had access to, he noticed his backdoor access had been removed. Had a telephone company filed a hacking complaint with the feds? Was another hacker screwing with him? Both? Something entirely different?

Kevin couldn’t shake the feeling of being trapped, being behind, being stalked. At around 1:00 a.m., Kevin stepped outside to see if anyone was watching him or his apartment. He looked up and down the parking lot — no one. But he failed to see the U.S. Marshal who thought it was awfully suspicious that a person, at 1 in the morning was peaking outside and scanning the parking lot. 

Kevin went back inside his apartment. A false sense of security washed over him: he couldn’t see anyone out there, so surely there wasn’t anyone out there. He hopped back on his computer and continued covering his tracks on the WELL. Immersing himself back into cyberspace calmed and allowed him to take his mind off of the paranoia. But by 1:30, Kevin heard a loud knock on his door. Focused on his computer, he asked, “Who is it,” not registering how odd it was that someone was knocking on his door this late at night.

When they announced they were FBI, Kevin knew he was fucked. Then they announced they’re looking for Kevin Mitnick. Moving quickly, he turned his computer off and hid his cell phones. He stalled the agents for as long as possible, contemplating whether he could actually tie his bedsheets together to escape out the balcony. But it was all hopeless. The jig was up. He called his mom, telling her he loved her and that he was going away for a long time.

As the FBI agents continue knocking, Kevin cracked the door open to convince them he is not the man they are looking for. The FBI agents immediately busted into the apartment, blowing past Kevin. They executed an illegal search at first, for which Kevin calls them out on, but the lead agent is able to get a new, correct warrant within minutes.

Then the agents found the phones. The computer equipment. The bogus driver’s licenses of Kevin’s past identities. And while all of these things were suspicious and were things Kevin would have, they didn’t have anything that definitively proved that the man in front of them was Kevin. They almost gave up — but then one of the agents searched an old ski jacket in Kevin’s closet. Tucked away in an inner zipper pocket, was a pay stub made out to Kevin Mitnick. It was the nail in the coffin. Within a few minutes, Kevin was led out of his apartment in leg irons, cuffs, and a bell chain, looking more like a cannibal or terrorist than a non-violent hacker.

(beat)

The following day, Kevin was arraigned at the Wake County Courthouse in downtown Raleigh. The courtroom was electric, bubbling with journalists both inside and outside. The Magistrate ordered that Kevin be held in solitary confinement, without bail, and without access to any telephones. 

As Kevin was led out of the courtroom, he walked toward a man he had never met or seen in person. But, based on his appearance, Kevin knew exactly who it was: Tsutomu Shimomura. They nod to each other, acknowledging that the game of cat and mouse is over. Tsutomu had won. 

The charges against Kevin stretched back for years. They ensnared Kevin’s old hacking pal Lewis De Payne, too. Between them, there were  25 counts of computer crimes including possession of unauthorized access devices, computer fraud, causing damage to computers, wire fraud, and interception of wire or electronic communications. 

For the years that followed, Kevin and his attorney appealed the denial of bail. The federal prosecutors argued that Kevin was a flight risk, and, if he was able to leave the country, he would disappear forever.

While Kevin and his legal team fought for his freedom, a dedicated group of hackers, ex-phone phreaks, and other internet activists started a grassroots movement: Free Kevin. For the “hacktivists” that were a part of the free Kevin movement, they saw that the punishment didn’t fit the crime. Kevin, never physically harming anyone or hacking for financial gain, faced a multi-year sentence. 

Holding a citizen for years in pre-trial, in solitary confinement, denying him bail seemed like a gross abuse of the justice system for the Free Kevin Movement. 

For over four years, Kevin insisted he was not guilty of the charges against him. But, as the reality set in that the government was not going to back down, Kevin decided to plead guilty to 5 of the 25 felony charges. At the end of the day, Kevin served a total of four and a half years pre-trial and an additional eight months afterward. 

When he was released on January 21, 2000, Kevin was forbidden to use a computer or cell phone. As books and even a feature-length movie were released about his crimes, Kevin was barred from ever profiting off of media related to his criminal activity for seven years.

Between the media restriction and the inability to use computers, Kevin was robbed of his ability to make a living doing what he knew best. 

If he ever did get access to a computer, would he turn to the dark side of hacking again? Had the government left him no choice, pushing him around and leaving him to fend for himself — even if that meant he had to break the law? 

Act 4

Within two months of walking out of prison, Kevin received a letter addressed from US Senator Fred Thompson. Seeing the letter as out of the ordinary, Kevin opened it cautiously, still scarred by his previous interactions with the government. As Kevin read the letter, he was shocked. He was being asked to testify before a Senate committee on cyber attacks. 

Kevin was terrified of public speaking but somewhere deeper, he felt honored that the government recognized his expertise in hacking. In his testimony, Kevin answered questions about the deeply compromised public telephone system, the internet, and what future hacking threats would be. In the Q&A section of the testimony, Senator Lieberman went on to call Kevin “arguably the most notorious computer hacker in the world,” a moniker that stuck with him for the rest of his life.

Soon after the Senate committee testimony, the world of public speaking and consulting opened its doors to Kevin. Even if he couldn’t use a computer during his supervised release, he could consult governments, businesses, and people on how to keep their information safe. 

By inviting Kevin to testify in congress, the U.S. government recognized that Kevin’s prowess and knowledge were invaluable, needed, and necessary. Building off of this momentum, Kevin opened up his own consulting business, advising organizations across the world on how to protect themselves from people like him. It’s like they say, it takes one to know one.

(Beat)

Today, Kevin could be anywhere. Most likely, he’s leading a group of hackers to penetrate a companies network using social engineering techniques, conning people out of information the exact same way he did nearly 40 years ago.

The only difference?

Kevin gets paid by the company to hack them — as a security consultant, of course. So, even though Kevin’s still hacking, he’s decided to use his hacking skills for good, for the ensured security of organizations around the world. 

CREDITS

Thanks for listening to Modem Mischief. Don’t forget to hit the subscribe button in your podcast app now, so you don’t miss an episode.

Modem Mischief is supported by you, our listeners, and the best way to support us is to tell your friends. Share the show with your friends, enemies and family, and find us on social media @modemmischief.

Another way to help is to support us on Patreon or consider a paid subscription on Apple Podcasts or Spotify. For as little as $5 per month, you will receive an ad-free experience as well as bonus episodes. Find out more at modemmischief dot com.

In some cases we can’t know exactly what happened so we use dramatic reenactments. However, our show is heavily researched and sourced. Sources for this episode are available on our website.

Thanks for listening.

Modem Mischief is brought to you by Mad Dragon Productions and is created, hosted and produced by me, Keith Korneluk. Additional writing and research by Jonah Svihus. Edited, mixed and mastered by Greg Bernhard. The theme song is composed by computerbandit. For more information, visit us online at modemmischief dot com.