Read Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker Online
Authors: Kevin Mitnick,Steve Wozniak,William L. Simon
Tags: #BIO015000
Eric had told Lewis and me that Poulsen’s radio contest gambit was based on hacking into the phone company switch at the central office that handled the radio station’s lines. I thought there might be a way to do the same kind of thing without even having to mess with the switch. KRTH broadcast from offices not too far from Dave’s, and both were served by the same central office.
To start, I’d need a phone number other than the 800 number the disk jockey gave out on the air. Calling an internal department at PacBell, I asked for the “POTS number” for the 800 number. (“POTS” stands for—are you ready for this?—“plain old telephone service”; it’s a standard, everyday term used around the phone company.) I needed the POTS number because the 800 number used for the radio contest had a “choke” placed on it, limiting the flow of calls that could come in from each part of the station’s broadcast area, and my plan wouldn’t work if any of my calls were being choked. The lady I was talking to didn’t even ask what my name was or whether I worked for Pacific Bell; she just gave me the number.
At Dave Harrison’s, I programmed the speed calling feature on four of his phone lines, so that all I had to do to dial directly in to the POTS number at the radio station was press “9#.” I was counting on the fact that calls routed through the 800 number would take just a bit longer to connect. Then, too, the numbers for Dave’s office were switched through the same central office as the station’s POTS number, meaning that our calls would be completed instantaneously. But would those minuscule advantages, plus using multiple telephone lines, be enough to make a difference?
Once this was all set up, Lewis, Terry Hardy, Dave, and I each sat at a phone, ready to call. We could hardly wait for the contest to be announced. Caller number seven was always the winner. We just had to keep calling in until one of us was the seventh caller.
As soon as we heard the cue to start calling—the jingle “the best oldies on radio”—we quickly punched in “9#.” Every time we got through and heard the DJ say, “You’re caller number ____,” and give a number less than seven, we’d disconnect and quickly dial “9#” again. Over and over.
The third time I speed-dialed, I heard, “You’re caller number seven!”
I shouted into the phone,
“I won! No way, I won? Are you kidding me? I can’t believe it! I never win
any
thing
!” We all stood up and high-fived. The prize was $1,000, and we’d agreed to share it. Whenever any of us won, we’d put our winnings in the pot.
After our first four wins, we knew the system was working, but we faced a new challenge: the radio station rules said that no one person could win the contest more than once a year. We started offering a deal to family, friends, and anyone else we knew well enough to think we could trust: “When the check arrives, you keep $400 for yourself and pass the other $600 along to us.”
Over the next three or four months, we won that contest about fifty times. In the end, we stopped only because we ran out of friends! It’s a shame Facebook didn’t exist yet—we would have had a lot more friends to work with.
The real beauty of it was that it wasn’t even illegal. I confirmed with an attorney that as long as we weren’t illegally accessing phone company equipment or using a friend’s identity without permission, it wasn’t fraud. Even when I first got the POTS number, I didn’t misrepresent myself as a phone company employee; I just asked for the number, and the lady gave it to me.
Technically, we were obeying the rules of the game, as well. The radio station had a rule that a person could win only once per year. We abided by that. We were simply exploiting a loophole. We never broke any of the rules.
Once I surprised myself by taking a long shot. The station provided a phone number you could call to listen to its shows over the telephone. I called in from my mom’s living room in Las Vegas, and when the contest came on, I called in, not really imagining I could reach the station just in time to be caller number seven. But then I heard the magic words, the congratulations… followed by the announcer’s asking, “What’s your name?” I hemmed and hawed until I thought of a friend we hadn’t used
yet. I gave his name and covered the awkward pause by blurting out, “I’m so excited, I could hardly say my own name!”
The four of us each cleared nearly $7,000 from the whole thing. At one point, when I met Lewis in a restaurant and gave him his share, it was such a lot of cash that I felt like I was making a payoff in a drug deal or something.
I used a big chunk of my share to buy my first state-of-the-art laptop, a Toshiba T4400SX featuring a 486 processor that ran at what was then an impressive speed, a snappy 25 megahertz. I paid $6,000. And that was the wholesale price!
It was a sad day when we ran out of people we could trust to cooperate.
One night not long after we got into the radio contest business, I was driving back to my dad’s apartment when an idea popped into my head, a scheme that might give me some breathing room while I tried to get to the bottom of the Eric Heinz / Mike Martinez / Joseph Wernle / Joseph Ways mystery.
My idea was that Lewis would casually, in passing, let slip a piece of information about me to Eric. He’d say something like, “Kevin is thinking about working with some hackers in Europe. He’s sure this is gonna make him very rich.”
What I figured was this: whatever the Feds already had on me would seem like small beans next to the prospect of catching me red-handed in the middle of a big hack, stealing a load of dollars or Swiss francs or deutsche marks from some financial institution or corporation. They would want to keep close tabs on me but would be willing to wait patiently until I had pulled off this big one, anticipating how they’d swoop in, recover the money, and parade me in handcuffs before the hungry media people and the hungry-for-scandal public: the FBI saving America from another villain.
And while they were waiting for me to arrange the hack, I hoped,
my supervised release would come to an end. It seemed like a great delaying action to buy myself some extra time.
Lewis’s attorney, David Roberts, couldn’t see anything wrong with this plan. Lewis and I met and discussed the details with him on several occasions. It wouldn’t be a violation of any law for Lewis to tell this lie, because he wouldn’t be telling it directly to a Federal agent.
My supervised release was due to end in another several months. By the time the Feds finally lost patience with waiting for my European hack to happen, those months would have passed, and it would be too late for them to simply pick me up and ship me back to prison for violation of the terms of my release.
Would they really wait that long? I could only hope so. Lewis reported a couple of days later that he had mentioned my big European hack to Eric, who had pressed him for details. Lewis told him that I had said it was so big, I didn’t want to tell him any more about it.
Spring had turned into summer, and I was beginning to feel settled in as a Los Angelino once again. But my living arrangements needed some attention. At first, moving in with my dad had felt like a way to begin making up for all those years when he was living two thousand miles away and building a life with a new family. I had taken over Adam’s room, partly out of a sense of wanting to help my dad and be with him in that difficult time after Adam’s death, and because I was hoping we would become closer.
But it hadn’t worked out as I had hoped, not by a mile. We had some good times together but we also had long stretches that felt more like my early years, when our relationship was a battlefield covered with land mines.
We all make concessions when we live with others. And though it’s a cliché, it’s also true that we don’t get to pick our relatives. But somewhere there’s a line in the sand between what we choose to ignore and put up with, and what makes the days seem just too annoying. As various women in my life have made perfectly clear, I’m not so easy to live with myself, so I’m sure the fault here wasn’t all on one side.
It finally got to the point where I couldn’t take it anymore, irked by my dad’s frequent complaints that I spent too much time on the phone, but even more irked by his fetish for precision. I like to live in a clean and straightened-up place, but for him it was an obsession. If you remember Felix, the character in
The Odd Couple
, played by Jack Lemmon in the movie and Tony Randall on television, you’ll recall that he was a neat freak with an obsessive aversion to the least disarray.
Felix was a pussycat compared with my dad.
One example will prove my point: my father actually used a tape measure to make sure that the hangers in his closet were evenly spaced at exactly one inch apart.
Now multiply that fussiness and apply it to every detail in a three-bedroom apartment, and you’ll begin to understand the sort of nightmare I was living.
In the spring of 1992, I gave up and decided to move out. I was happy to stay in the same complex, close enough to see my dad regularly but not so close that I was still living under his thumb. I didn’t want Dad to think I was turning my back on him.
I was stunned when the lady in the rental office told me there was a waiting list and it might be a couple of months before a unit became available for me. Thankfully, I wasn’t stuck at my dad’s: Teltec’s Mark Kasden agreed to let me move into his guest bedroom until my name came to the top of the waiting list for a unit of my own.
After I settled into my new digs, I embarked on another counter-surveillance project. From Dave Harrison’s office, using my new laptop, I decided to see what I could pick up by using SAS to listen in on the phone conversations of Pacific Bell’s manager of Security, John Venn. I popped onto Venn’s line every now and then. Usually when I stumbled across a call in progress, it was about nothing of much interest, and I’d only half listen while doing something else.
But one day that summer I popped in on his line when he was in the middle of a conference call with several colleagues. If this were a scene in a movie, you’d probably groan because the chance of its really happening would seem so remote. It really
did
happen, though: my ears pricked up when one of the men mentioned “Mitnick.” The conversation was fascinating, revealing… and encouraging. It turned out these guys had no idea how I was defeating all their systems and traps, and that really irritated them.
They talked about needing ideas about how they might be able to set a trap for me, something that would give them hard evidence against me that they could then turn over to the FBI. They were wondering what I might try next, so they could have something in place to catch me red-handed.
Somebody suggested a plot for trapping me that was way stupid. I was dying to bust into their conversation and say, “I don’t think that would work. This Mitnick guy is pretty clever. You never know—he could be listening to us right now!”
Yes, I had done other things every bit as gutsy and reckless as that, but this time I managed to resist the temptation.
On the other hand, I was less resistant to doing something gutsy when asked by someone in need. One Thursday at the beginning of June, on a day when I hadn’t gone in to work because I had some errands I needed to do, I got a frantic phone call from Mark Kasden: Armand Grant, the head of Teltec, had just been arrested. His son Michael and Kasden were trying to raise bail, but they’d been told it might take as much as a day and a half after they posted bail before he would be released.
I said, “No problem. Let me know when that’s done, ’cause once he gets bail, I’ll get him walked out of there in about fifteen minutes.”
Kasden said, “That’s impossible.”
But knowing how law enforcement people respected rank, I just called another jail in northern Los Angeles—Wayside—and asked, “Who’s the lieutenant on duty there this afternoon?” They gave me his name. Then I called the Men’s Central Jail, where Grant was being held. I already knew the direct-dial internal number for the Warrants Division. When a lady answered, I asked for the extension at Receiving and Discharge. For somebody like me, in a situation like this, there were advantages in my actually having been through the jail system. I told her I was Lieutenant So-and-so (using the name I had just been given) at Wayside. “You have an inmate whose bail is supposed to be posted. He’s working as an informant on a case for us, and I need to get him out immediately” and gave her Grant’s name.
The sound of computer keys came over the telephone. “We just got the order, but we haven’t entered it yet.”
I said I wanted to talk to her sergeant. When he came on the line, I gave him the same pitch and said, “Sergeant, can you do me a personal favor?”
“Yes, sir,” he said. “What do you need?”
“Once the man’s bond is posted, can you personally walk him through the whole process and get him out as soon as possible?”
He answered, “No problem, sir.”
I got a call from Michael Grant twenty minutes later to say that his father was out.
Gsig cof dsm fkqeoe vnss jo farj tbb epr Csyvd
Nnxub mzlr ut grp lne?
I
f I could help Grant with so little effort, how come I still didn’t have the lowdown on Wernle? Fortunately, I was about to unlock that secret.
Eric kept talking about having to go to work, but he would always change the subject whenever I asked what he did.