Ghost in the Wires: My Adventures as the World's Most Wanted Hacker

by Kevin D. Mitnick

had lost my access to a great system, but in the late 1970s and the beginning of the 1980s, the world of personal computing went through a dramatic transition period, bringing the first desktop machines that included a monitor or even had one built in. The Commodore PET, the Apple II, and the first IBM PC began to make computers a tool for everyone, and to make computers much more convenient for heavy users… including computer hackers. I couldn’t have been happier.

got into U.S. Leasing’s system using a tactic that was so ridiculously easy I should have been embarrassed to try it. It went like this.

“This is [whatever fictitious name popped into my head at that moment], from DEC support. We’ve discovered a catastrophic bug in your version of RSTS/E. You could lose data.” This is a very powerful social-engineering technique, because the fear of losing data is so great that most people won’t hesitate to cooperate.

With the person sufficiently scared, I’d say, “We can patch your system without interfering with your operations.” By that point the guy (or, sometimes, lady) could hardly wait to give me the dial-up phone number and access to the system-manager account. If I got any pushback, I’d just say something like, “Okay, we’ll send it to you in the mail” and move on to try another target.

Shortly after, the two of them had a falling-out and parted company, I guess with some bad feelings. She then took revenge on me. To this day, I don’t know why I was the target, unless perhaps she thought Lewis had broken up with her so he could spend more time with me, hacking, and so blamed me for the breakup.

Susan waged a vendetta against me for some time, disrupting my phone service, and giving the phone company orders to disconnect my telephone number. My one small act of revenge came about by chance.

By May 1981, still age seventeen, I had transferred my extracurricular studies to UCLA. In the computer lab, the students were there to do homework assignments or to learn about computers and programming. I was there to hack into remote computers because we couldn’t afford a computer at home, so I had to find computer access at places like universities.

Just as I had in Mr. Christ’s computer lab in high school, I would pick up the handset and flick the switch hook, which had the same effect as dialing.

Flashing nine times in quick succession, equivalent to dialing the number “9,” would get me a dial tone for an outside line. Then I would flash ten times, equivalent to dialing “0,” for an operator.

When the operator came on the line, I’d ask her to call me back at the phone number for the modem at the computer terminal I was using. The computer terminals in the lab at that time did not have internal modems. Instead, to make a modem connection, you had to place the telephone handset into an adjacent acoustic coupler, whic...

I guess it just never occurred to me that a student at one of these computer labs might overhear what I was doing and blow the whistle on me.

Not until the evening when I was sitting at a terminal in a lab at UCLA. I heard a clamor, looked up, and saw a swarm of campus cops rushing in and heading straight for me. I was trying hard to appear concerned but confident, a kid who didn’t know what the fuss was all about.

They pulled me up out of the chair and clamped on a pair of handcuffs, closin...

Yes, California now had a law that criminalized hacking. But I was still a juvenile, so I...

Yet I was panicked, scared to death. The duffel bag in my car was crammed with printouts revealing all the companies I had been breaking into. If they searched my car and found the treasure trove of printouts and understood what it was, I’d be facing a lot worse than any punishment they might hand out for using the school’s computers when I wasn’t a student. One of t...

In the end, UCLA didn’t find anybody who could make sense of my printouts. The university never filed any charges. No action at all beyond referring my case to the county Probation Department, which could have petitioned Juvenile Court to hear the case… but didn’t.

The conversation inevitably got around to one of my favorite targets, COSMOS, the Computer System for Mainframe Operations, the Pacific Telephone mission-critical system that could bestow so much power on any phreaker who could access it.

As we started talking, I realized the building that housed COSMOS was nearby, only a few miles away. I figured if a few of us went over there and had a go at a little Dumpster-diving, we might find some useful information.

She ratted us out to the phone company. On a hot summer evening several days later, as I pull out of the parking lot to drive home from my job, as a telephone receptionist at the Steven S. Wise Temple, I pass a Ford Crown Victoria with three men inside. (Why

No way am I going to try to run. I pull over. The car pulls up behind me. The three guys leap out. They start running toward me. They’re drawing their guns!!! They’re shouting, “Get out of the car!” In an instant, I’m in handcuffs. Once again they’re closed painfully tight.

One of the guys shouts in my ear, “You’re gonna stop fucking around with the phone company! We’re gonna teach you a lesson!” I’m so scared I start crying.

Another car pulls up. The driver hops out and runs toward us. He’s shouting at the cops, “Search his car for th...

Now I’m practically laughing through my tears. A logic bomb is a piece of software, but these guys don’t seem to know that. They think I’m carryi...

The Juvenile Court judge who heard my case seemed puzzled: I was charged with being a hacker, but I hadn’t stolen and used any credit card numbers, nor had I sold any proprietary software or trade secrets.

had just hacked into computers and phone company systems for the sheer entertainment. The judge didn’t seem to understand why I would do such things without profiting from my actions. The idea that I was doing it for fun didn’t seem to make sense.

The truth was, I broke into the phone system for the same reason another kid might break into an abandoned house down the block: just to check it out. The temptation to explore and find out what’s in there was too great. Sure, there might be danger, but taking a risk was part of the fun.

The prosecutor claimed that in my hacking I had damaged computer systems at U.S. Leasing. I hadn’t, but it wouldn’t be the last time I was accused of this.

The other kids were there for crimes like assault, rape, murder, and gang hits. These were juveniles, sure, but they were even more violent and dangerous because they felt invincible.

I wrote a daily letter home, beginning each with “Kevin Mitnick held hostage–Day 1,” “Day 2,” “Day 3.” Even though Norwalk is actually in LA County, it was an hour and a half drive for my mom and her mother, my “Gram.” Loyal beyond my deserving, they came every weekend, bringing food; they would always leave their homes early enough to be the first in line.

At the end of my ninety days, the California Youth Authority recommended that I be released to go home on probation, and the judge accepted the recommendation.

Her phone stopped working one day; months later, I learned that after the phone company fixed her line, they told her they didn’t know why it had gone dead. She figured it must have been me and put a notation in my record that would become accepted as fact and used against me. Too many times in those days, unexplained failures in technology anywhere would be attributed to me.

When I explained that I was on probation for phone phreaking, his eyes lit up. “Have you heard about ITT?”(The initials stood for International Telephone and Telegraph.)

“Do you know where I can get any codes?” He was asking me about ITT access codes. Once you had a code, you could simply dial a local ITT access number and punch in the access code, followed by the long-distance number you wanted to call. If you used someone else’s code, your call would be billed to that poor subscriber, and you wouldn’t have to pay a cent. I smiled. Roy and I were going to get along just fine.

he wrote a letter to the judge, explaining that I was driven to hack not by malicious or criminal motives, but by a compulsive disorder. I was, he said, “addicted” to hacking.

When the judge heard the diagnosis of addiction and realized that I suffered from an ailment, she accepted our plea agreement.

A little exploring had turned up the tempting fact that a building called Salvatori Hall had a group of DEC TOPS-20 mainframes that were connected to the Arpanet, the precursor of the Internet.

Even though we had system administrator privileges, the system was configured to encrypt all passwords.

When I searched that account’s email, it was chock-full of messages handing out usernames and passwords in plain text. Jackpot!

Doing my best, I picked up the printout and carried it back to where Lenny and I were working. A while later, two campus cops charged into the room and rushed directly toward Lenny and me, shouting, “Freeze!”

Apparently I had become notorious. They knew which of us was their real target, and they knew my name. Later, I learned that one of the administrators, Jon Solomon, had been at the same DECUS convention that Lenny and I had attended days earlier. Jon saw me in the computer lab and recognized me. He called Dave Kompel, who had been part of the group that challenged me to break into DEC’s RSTS/E Development system when I was a student at Monroe High School. Kompel told him to call the campus police and have me arrested.

They grabbed the stack of printouts with all those passwords. Because I was already on probation, I knew this meant serious trouble. The cops hustled Lenny and me to their on-campus headquarters and handcuffed us to a bench, then disappeare...

Pissed, the cops demanded, “Where’s the key?” They took each of us to the bathroom for a strip search and were mystified when they couldn’t find it.

I walked into work. My Juvenile Probation Officer, Mary Ridgeway, was waiting with two detectives.

who had a university account but in fact worked at the Pentagon.

When the police discovered that, they fed the story to the media, and the newspapers ran overblown articles mangling the facts, claiming I had hacked into the Department of Defense. Totally untrue, but a claim that still follows me today.

After sentencing, I was transferred once again to the facility in Norwalk, for classification. I took refuge in the library and then realized it had a very good collection of law books. They became my new focus.

A number of the kids in custody there wanted to file appeals or find out what rights they had, and I began lending a hand by doing research for them.

The library’s collection turned out to include the procedural manuals governing the California Youth Authority. How convenient, I thought. They’re going to let me find out how they’re supposed to be doing things, so I can look for flaws and loopholes. I dived in.

But whaddaya know? In the CYA procedural manuals, I found a list of the factors that must be taken into consideration in deciding which facility a youth should be sent to. He should be close to his family. If he was a high school graduate or had received a GED, he should be at a facility that offered college programs—which Preston certainly did not.

The facility should be chosen based on his propensity for violence and whether he was likely to try to escape. I had never even been in a fist fight, and had never attempted an escape. Underlying it all, according to the manual, the goal was rehabilitation. Great. I made copies of these pages.