Ghost in the Wires: My Adventures as the World's Most Wanted Hacker

by Kevin D. Mitnick

Meanwhile Lenny’s accessing of Dockmaster had not gone unnoticed. NSA traced the break-in back to Hughes, which in turn traced it back to the computer room where Lenny was working on the night I visited. Security at Hughes questioned him first, then the FBI summoned him for an offi...

Lenny told the agents he and I had never done anything with Dockmaster. He was grilled several times by Hughes management. He stood his gr...

Clearly, he was desperately trying to come up with an excuse why he lied to Federal agents.

The visitors’ log showed that a Kevin Mitnick had indeed signed in as a guest of Lenny’s. Of course he was summarily canned from Hughes.

Two years later I would be accused of possessing secret access codes for the NSA, when I actually only had the output of a “whois” command—which showed the names and telephone numbers of registered users with accounts on Dockmaster—so...

asking her not to stop any of my programs that were running at a higher priority, and her replies were friendly enough. I asked her out to dinner. She said, “I can’t. I’m engaged.” But I had learned from my hacking not to give up easily; there’s usually a way.

A couple of days later I asked again about dinner, and told her she had a beautiful smile. And whaddaya know? This time she accepted.

Later, she told me she thought her fiancé might be lying to her about his finances—what cars he owned and how much he owed on them. I told her, “I can find...

I had lucked my way into accessing TRW, the credit-reporting company, while still in high school. Nothing clever about this. One night I went out to the back of Galpin Ford in the San Fernando Valley and dug through the trash. It took about fifteen minutes, but my little Dumpster-diving expedition paid o...

In those days, TRW was very helpful to its clients. If you called in and gave a merchant’s name and the correct access code, and explained that you didn’t know the procedure, the nice lady would talk you through every step of getting a person’s credit report. Very helpful to real clients, very helpful as well to hackers like me.

So when Bonnie said she’d like me to look into what her boyfriend was really up to, I had all the tricks I needed. A call to TRW and a few hours on the computer gave me his credit report, his bank balance, his property records.

Suspicions confirmed: he was nowhere near as well-off as he had been claiming, and some of his assets were frozen. DMV records showed he still had a car he told Bonnie he had sold. I felt bad about all this—I wasn’t trying to un...

Within two or three weeks, when she had gotten over her initial emotions about the breakup, we started dating. Though six years older than I was and considerably more ex...

She was fascinated by my ability to gather information on people. And one thing more, a coincidence I still laugh at: my new girlfriend was having her salary paid and her tuition covered by one of my principal lifelong hacking targets, the phone company GTE.

After finishing the prescribed half year for my certificate at the computer school, I ended up staying on a bit longer. The system admin, Ariel, had been trying to catch me getting administrator privileges on the school’s VM/CMS system for months.

He finally nailed me by hiding behind a curtain in the terminal room while I was snooping inside his directory, catching me red-handed. But instead of booting me out of the program, he offered me a deal: he was impressed with the s...

How about that: the school was training students in the esoteric knowledge of computers, but recruiting a student to improve its own security. That was a big first for me. I took it as a compliment and accepted the assignment. When I finished the project, I graduated with honors. Ariel and I eventually became friends.

The Computer Learning Center had an inducement it used for signing up students: a number of high-profile companies made a practice of hiring its graduates. And one of them was Bonnie’s employer, GTE, my hacking target for so many years. How fantastic was that!?

After interviewing with GTE’s IT Department, I was brought back for an interview with three people from Human Resources, then offered a job as a programmer. Dreams really did come true! No more hacking for me—I wouldn’t need it. I’d be get...

Cool new job, a daily quick stroll to the cafeteria for lunch with my girlfriend, a legitimate paycheck—I had it made. Walking through the offices, I’d smile at the hundreds of usernames and passwords that were right in front of my nose, written out on Post-it notes. I was like a reformed drunk on a Jack Daniel’s distillery tour, confident but nearly dizzy from imagining “What if?”

Bonnie and I would regularly have lunch with a friend of hers, a guy from their Security Department. I was always careful to turn my ID badge around; he obviously hadn’t caught my full name when we were introduced, so why let him read it on my badge like a billboard flashing “Phone Company Public Enemy #1”?

But only a week after I started, my new boss dropped a bomb on me. He handed me a security form for an all-access badge that would grant me entry to the data center twenty-four/seven, since I would be on call for emergencies. Immediately, I knew I was going to get canned; as soon as staff from GTE Security looked at my form, they’d recognize my name and wonder how I had bypassed all of their security checks and actually been hired—as a programmer, no less.

A couple of days later, I went to work with a bad gut feeling. Later that morning, my supervisor sent for me, and his boss, Russ Trombley, handed me my paycheck plus severance pay, saying he had to let me go because my references had not checked out. An obvious ruse. I had provided the names only of people who would say good things about me.

was escorted back to my desk to gather my personal effects. Within minutes, a posse from Security showed up, including the guy who had been having lunch with Bonnie and me. A couple of them started searching my box of floppies for any company property. Whatever. There was none, just legitimate software. The whole posse walked me to the door and all the way to my car. ...

I heard later that the guys from Pacific Bell Security razzed the hell out of their buddies at GTE, thinking it was hilarious that any company could be stupid enough to hire the notorious phone phreaker Kevin Mitnick—whom Pacific Bell had been keeping a file on for years.

One step back and one step forward. A Computer Learning Center instructor who also worked at Security Pacific National Bank as an Information Security Specialist suggested I apply for a job there. Over a period of weeks, I had three sets of interviews, the last one with a vice president of the bank. Then a fairly lengthy wait. Finally the phone call came: “One of the other candidates has a college degree, but we’ve decided you’re the person we want.” The salary was $34,000, which for me was great!

Remember that article in the Los Angeles Times, which covered my juvenile arrest and printed my name, a violation of law as well as a violation of my privacy because I was a minor? Well, one of the people at Security Pacific National Bank remembered that article, too.

The day before I was to start, I got a strange call from Sandra Lambert, the lady who’d hired me and who founded the security organization Information Systems Security Association (ISSA). The conversation was actually more like an interrogation:

My attempt at humor fell. She said good-bye and hung up. I received a phone call from Human Resources the next day withdrawing the employment offer. Once again, my past had come back to bite me in the ass.

Sometime later, media outlets received a press release from Security Pacific National Bank announcing a $400 million loss for the quarter. The release was a phony—it wasn’t really from the bank, which had not in fact lost money in that quarter. Of course the higher-ups at the bank were sure I was behind it.

was spending so much time at her place that I began moving some of my clothes there. We never really decided, Okay, let’s live together. It just sort of happened.

We loved biking together. We loved going to the beach with a bottle of wine. We loved hiking in the Chantry Flat, in Arcadia, a beautiful area with waterfalls that’s right in Los Angeles County but feels like being in a forest—really cool, such a refreshing escape for a pale guy like me who sat in front of a computer all day and all night.

I didn’t even mind that she was a lazy housekeeper, with a big pile of her dirty clothes usually occupying space on the bedroom floor. I’ve never been a neat freak like my parents, but I do like things tidy and organized. The two of us were alike in so many other ways tha...

But it was a deception—the first time in our relationship that I was, in a sense, cheating on her. I’d go out three evenings a week saying I was going to class, and instead I’d drive over to Lenny DiCicco’s work and hack with him until almost sunup. It was a pretty rotten thing to do.

On the nights when I didn’t go out, I’d sit at my computer in the apartment, using Bonnie’s telephone line for hacking while she read by herself, watched television by herself, and then went to bed by herself. I could say it was my way of handling the disappointment of those two almost-but-oh-never-mind jobs, but I’d be lying. Sure, I was having problems handling the massive disappointment. But that wasn’t the reason. The real reason was simply that I was in the thrall of a powerful obsession.

I was twenty-three years old, living in my girlfriend’s apartment and spending virtually every waking hour on my computer. I was David on my PC, attacking the Goliath networks of the major telephone companies throughout the United States. The phone company control systems used a bastardized version of Unix, which I wanted to learn more about.

A company in Northern California called Santa Cruz Operations, or SCO, was developing a Unix-based operating system called Xenix for PCs. If I could get my hands on a copy of the source code, that would give me a chance to study the inner workings of the operating system on my own computer.

At one point while immersed in studying the details of SCO’s system trying to locate the source code I wanted to study, I noticed a system admin was watching my every move. I sent him a message, “Why are you watching me?” To my surprise, he answered: “It’s my job,” his message said.

Just to see how far he’d allow me to go, I wrote back that I wanted my own account on the system. He created an account for me, even giving me the username I requested: “hacker.” Knowing that he’d be keeping the account under surveillance, I just distracted him by poking around at nothing in particular. I was able to locate the code I wanted, but in the end I never tried to download it because the transfer would have taken forever over my 2,400-baud modem. But that wasn’t going to be the end of this tale.

Bonnie came home from work one day at the beginning of June to find everything in disarray: we had been robbed. She paged me, I called, and I cou...

I asked her to check my coat pocket for the money I’d been saving for our wedding. But then she noticed that my stash of hundred-dollar bills—totaling about $3,000—had been neatly laid out...

We hadn’t been robbed; we’d been raided. By officers of the Santa Cruz Police Department. Santa Cruz! I knew it had to be connected to my nighttime hacking excursion...

When Bonnie said my computer and disks were gone, my world immediately crumbled. I told her to quickly pack some clothes and meet me. I knew there would be a lot of trouble coming my way. I...

Bonnie joined me at a local park, and my mom came, too. I told them both it wasn’t a big deal, since I had just poked around—I hadn’t damaged any of the SCO ...

The next morning she called her work and asked to take some vacation time for a family emergency. Her boss told her that some police officers had shown up, wanting to interview her. My first thought was that since I had been hacking from her apartment and on her telephone, they were assuming that she was the hacker. But then I concluded that their strategy was probably to use arresting my girlfriend as a bargaining chip: “Admit everything or your girlfriend goes to jail.”

I spent the next few days calling lawyers, explaining the situation, making plans. The way Bonnie remembers it, “We cried a lot together but we stuck by each other.”

Aunt Chickie drove Bonnie and me down to the Los Angeles County Sheriff’s West Hollywood station. We turned ourselves in, and Chickie immediately posted our bond, $5,000 each. Somehow the police neglected to fingerprint and photograph us. Because of this major procedural error, there was no arrest record created for either of us. Still today, there is no official record that I was ever arrested on the Santa Cruz Operations charge. Please don’t tell anyone.

Over the next few months, for every appearance we had to make in the Santa Cruz courts, I had to buy four round-trip airplane tickets—Bonnie was using a different attorney—plus spring for hotel rooms, a rental car, and meals. Both of the attorneys had required a retainer up front.

So we didn’t have the money anymore for a proper wedding, but it was worse than that. There isn’t any loving, romantic way to put this: I told Bonnie we needed to get married so she couldn’t testify against me, and also so she could visit me if I landed in jail, which was looking like the way things were headed. I gave Bonnie a diamond engagement ring, and we were married by a minister who conducted weddings in his home in Woodland Hills.

None of Bonnie’s family joined us; her mother was understandably furious at the situation I had landed her daughter in.