Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker (58 page)

I told Brad that I had read the script and found it to be mostly false and defamatory. I said I was planning to hire an attorney. Brad said the production company would gladly pick up my attorney’s fees; they would prefer to settle with me as soon as possible, rather than run the risk that a court case might delay the release of the film.

Two well-known Los Angeles libel attorneys, Barry Langberg and Debbie Drooz, saw that some, though not all, of the absurdly false stuff was removed from the script. They also secured a decent settlement for me, though I’m not allowed to disclose the details.

Because that settlement came in before my criminal case was resolved, there was some concern that the judge might seize the money as part of a restitution payment. My attorney declared the income in camera (meaning for the judge’s eyes only), and the judge allowed me to keep it private. So the prosecutors never learned that I had received money from the producers of the film.

In the end, the movie version of
Takedown
was so widely panned on its own merits that it was never distributed theatrically in the United States. As I understand it, after a few faltering attempts in French theaters, it went straight to DVD.

Meanwhile, my attorney had appealed Judge Pfaelzer’s “no bail hearing” ruling to the Ninth Circuit Court of Appeals, which ruled in an unpublished opinion that I was a flight risk and a danger to the community, completely sidestepping the question of whether the government had to prove this in a hearing. We then took it all the way to the U.S. Supreme Court, with my attorney sending the brief to Justice John Paul Stevens. He took an interest and recommended that my case be heard, but when he sent it to the full Court for a decision about putting it on the calendar, his colleagues declined.

Not long after that, I was alarmed to hear that the government prosecutors were alleging I had caused damages in the mind-boggling amount of over $300 million. Of course, there was absolutely no foundation for this figure. My lawyer quickly pointed out that corporations are required by the Securities and Exchange Commission to report material losses to their stockholders, but not one of the companies in any of its quarterly or annual reports had ever claimed the loss of a single penny as a result of my hacking.

Just a few weeks after I was arrested, FBI Special Agent Kathleen Carson had been working to come up with these greatly exaggerated loss numbers. An internal Sun Microsystems memo showed she had told Lee Patch, vice president of Sun’s Legal Department, that the Solaris source code I had copied could be valued at $80 million, which would have called for the harshest sentence for fraud under the Federal sentencing guidelines—so it doesn’t take a genius to figure out how she came up with that number. When she asked Sun to put a dollar value on the loss associated with the break-in, she advised that the figures should be based on the value of the source code.

This was like nabbing someone for stealing a can of Coke and demanding that he repay the cost of developing Coca-Cola’s secret formula!

Someone at the FBI had decided that the best way to inflate the claim for damages was for the companies to report how much it had cost them to
develop
the software I copied. But they still had their software. They were not deprived of it, so it doesn’t justify claiming a loss equal to the value of developing the source code. A reasonable figure would have been the value of a source code
license
, which was probably under ten thousand dollars.

However much they wanted to punish me, we all knew that the companies’ actual losses were far, far less than alleged. If anything, they amounted to the man-hours spent investigating my intrusions, reinstalling the operating system and application software in any system I had compromised, and whatever licensing fees they charged customers to purchase a source code license.

The $300 million claim against me for damages was so outrageous that it motivated my supporters to ramp up the “Free Kevin” movement. Every time the government did something that reeked of unfairness, the numbers of my supporters only grew. “Free Kevin” was now a growing grassroots movement that had spread across the country—and even reached as far away as Russia!

When Eric organized a protest, the television news showed crowds parading with “Free Kevin” picket signs outside Federal courthouses in fifteen different cities, from Portland, Maine, to Los Angeles, from Spokane to Atlanta, and in Moscow, near the Kremlin. Eric recapped the unfairness in
2600
magazine:

Since February 15, 1995, Mitnick has been held in a pretrial facility with no bail hearing for possession of software allegedly worth millions of dollars. But the companies asserting this have never proven these claims nor have they reported these “losses” to their stockholders, as is required by law. Computer and legal experts generally agree that it’s very unlikely there really was any real damage and that the high numbers assume every file and its associated research were wiped from existence. In actuality, no such damage was ever reported. Yet, Mitnick remains imprisoned as if this was what happened.

My supporters wanted the government to respect my constitutional right to the presumption of innocence and a fair trial within a reasonable time.

As I understood it, the “Free Kevin” demonstrators in these cities around the world didn’t necessarily think that all the charges should be dropped and I should be allowed to walk out of prison scot-free. But they objected to the obvious unfairness in the case: the denial of a bail hearing; the illegal search and seizure; the defense’s lack of access to evidence; the court’s refusal to pay my court-appointed attorney’s fees, which effectively denied me representation for four months; and the claims of hundreds of millions of dollars in damages for copying source code.

When people realized what was happening, momentum started to grow. The press was writing about the protests. People were putting “Free Kevin” bumper stickers on their cars and in shop windows. There were even people walking around in “Free Kevin” T-shirts and wearing “Free Kevin” badges and pins.

During the court protests, I looked out the small window of my prison cell and actually saw an airplane dragging a “Free Kevin” banner. I had to pinch myself. I couldn’t believe it was really happening.

Over the previous four years, I’d had to deal with libelous reporters, uncomprehending judges, superstitious Marshals, manipulative friends, and exploitative filmmakers fanning the flames of the Myth of Kevin Mitnick for their own agendas. The idea that there were people out there who could finally see what I’d been going through brought me much comfort.

The support was so encouraging, in fact, that it motivated me to gear
up for the fight. I’d found a recent case in the prison’s law library that had convinced me I might be able to beat the most serious charges.

When I told my lawyer Donald Randolph that I’d found a legal precedent that could change everything, he said, “Let me worry about that, Kevin. I’m the lawyer.” But when I showed him the case, his eyes widened.

In 1992, an IRS agent named Richard Czubinski had used his access to IRS computers to snoop into the tax returns of various political figures, celebrities, and other government officials. He did it out of curiosity. He was charged, like me, with computer and wire fraud, and convicted in December 1995. After being sentenced to six months in prison, he successfully appealed his case. The Federal appellate court held that Czubinski, like me, had never intended to either use or disclose the information but had simply accessed it
for his own curiosity
. He won the appeal, his convictions were reversed, and he never went to prison.

With such a clear legal precedent, I believed we had a chance to beat the government’s case. I eagerly told my attorney that I wanted to go to trial. The strategy I proposed was this: I’d admit to hacking but argue that I was not guilty of wire or computer fraud because, like Czubinski, I had done it merely to satisfy my own curiosity.

Randolph agreed that Czubinski’s case set a perfect precedent for my defense. But there was a bigger problem. Randolph hesitated slightly before he told me what it was; I could see he was trying to be tactful. It seemed to be time for him to say something that, until now, had been left unsaid.

One of the government prosecutors had been urging my attorney for weeks to persuade me to take a plea. Over the last few days, he’d even resorted to ultimatums: if I didn’t agree to plead guilty and settle the case, he warned, the government would put me through a revolving door of criminal trials. If they lost in one jurisdiction, they’d try me in another; if they won, they’d press for the maximum sentence. It wouldn’t matter to them whether or not they got convictions because they’d have me locked up without bail the whole time.

I was ready to fight. But now my own attorney, Randolph, was telling me, as tactfully as he could, “I think you should take the plea.”

And then he explained: “If we go to trial, you’ll have to testify. And that will leave you open to cross-examination about other things…”

Those “other things” were all the wild stories that had circulated for years about my hacking, the rumors that I had gotten into the CIA, the
FBI, and even NORAD. Not to mention the many other things I
had
done in my hacking career but not been charged with: manipulating phone company switches all across America; getting information from the California DMV; tapping into an FBI informant’s phone call; listening to voicemail messages of Pacific Bell security agents. And so much more.

I could see what Randolph meant. During the cross-examination by the prosecutor, I could open myself up to other charges because the government could ask me anything related to my hacking activities if I took the stand. We didn’t really want to get into all of that.

So I took the plea, with terms
much
better than those of the original plea I had been offered nearly three years earlier.

As for my conditions of supervised release, for three years I wouldn’t be permitted to touch any electronic devices, such as a computer, cell phone, fax machine, pager, word processor, and so on, without the prior written permission of my Probation Officer. Even worse, I was forbidden to access a computer
through a third party
. The government didn’t even want me to make an airline reservation without asking permission first. So how, I wondered, was I supposed to find work? I also wouldn’t be able to act as a consultant in any computer-related activity. The many, many conditions placed on my release seemed unreasonably harsh, and a number of them were so broad that I worried I might violate them inadvertently.

The government set these broad conditions not only to punish me, but also because they were trying to cover all the bases to prevent me from finding loopholes, ways around the restrictions.

In the end, on March 16, 1999, I signed the deal. The prosecution this time was willing to go with a “binding” plea agreement, which meant that Judge Pfaelzer would have to sentence me to the agreed terms, or I could withdraw my plea and go to trial. I pled guilty to seven counts handpicked by government prosecutors in Northern and Southern California (other jurisdictions also wanted a piece of me), which included wire fraud (social-engineering people over the phone into sending me source code), computer fraud (copying source code), possession of access devices (passwords), and interception of data communications (installing network sniffers to grab passwords).

During the settlement discussions, the prosecution asked for $1.5
million in restitution payments. Fortunately, Federal law required the court to take into account my ability to pay, so even though Judge Pfaelzer surely wanted to come down hard on me, she had to take my potential earnings into consideration. Because of my onerous conditions of release, the Probation Office calculated that I would be able to get only a minimum-wage job like flipping burgers. So Judge Pfaelzer based the amount of my restitution on the Probation Office’s projection of my earning minimum wage over a three-year period. Instead of the millions proposed earlier, I was ordered to pay $4,125.

After my release, I asked my dad to put my Lompoc Prison ID card up for auction on eBay for me. When eBay administrators yanked it down because it didn’t meet the company’s “community standards,” they did me a huge favor. That act generated a media feeding frenzy. The story was quirky enough that it became a top news item on CNN. I then put the card on Amazon, where it was once again yanked for the
same
reason (thank you, Amazon!). A guy in Europe finally snapped it up for a whopping $4,000—way more than I’d ever expected to get.

With a big smile on my face, I brought the proceeds into the Probation Office, along with the extra $125, and paid off the restitution order. I like to think that made my Lompoc ID a sort of “get out of jail free” card.

The government was furious over that little stunt: the Bureau of Prisons publicly stated that the card was “our property,” and tried to figure out a way to seize the money. I never heard another word about it.

On August 9, 1999, I was officially sentenced to an additional forty-six months in custody, consecutive to the twenty-two months I received for violating my supervised release and making free cellular phone calls. Since I’d already spent four and a half years in jail waiting, my time was almost up.

Several weeks later I was transferred to the Federal Correctional Institution in Lompoc, where I was met by a trio of men in suits. I’d find out later that they were the unit manager, the captain (the head of security for the prison), and an associate warden. I knew this probably wasn’t what happened to every arriving prisoner.