The Hacker Crackdown Part 26

No mention was made of the real reason for the search.

According to their search warrant, the raiders had expected to find the E911 Doc.u.ment stored on Jackson's bulletin board system.

But that warrant was sealed; a procedure that most law enforcement agencies will use only when lives are demonstrably in danger. The raiders'

true motives were not discovered until the Jackson search-warrant was unsealed by his lawyers, many months later. The Secret Service, and the Chicago Computer Fraud and Abuse Task Force, said absolutely nothing to Steve Jackson about any threat to the police 911 System. They said nothing about the Atlanta Three, nothing about Phrack or Knight Lightning, nothing about Terminus.

Jackson was left to believe that his computers had been seized because he intended to publish a science fiction book that law enforcement considered too dangerous to see print.

This misconception was repeated again and again, for months, to an ever-widening public audience. It was not the truth of the case; but as months pa.s.sed, and this misconception was publicly printed again and again, it became one of the few publicly known "facts" about the mysterious Hacker Crackdown. The Secret Service had seized a computer to stop the publication of a cyberpunk science fiction book.

The second section of this book, "The Digital Underground,"

is almost finished now. We have become acquainted with all the major figures of this case who actually belong to the underground milieu of computer intrusion. We have some idea of their history, their motives, their general modus operandi.

We now know, I hope, who they are, where they came from, and more or less what they want. In the next section of this book, "Law and Order," we will leave this milieu and directly enter the world of America's computer-crime police.

At this point, however, I have another figure to introduce: myself.

My name is Bruce Sterling. I live in Austin, Texas, where I am a science fiction writer by trade: specifically, a CYBERPUNK science fiction writer.

Like my "cyberpunk" colleagues in the U.S. and Canada, I've never been entirely happy with this literary label-- especially after it became a synonym for computer criminal.

But I did once edit a book of stories by my colleagues, called Mirrorshades: the Cyberpunk Anthology, and I've long been a writer of literary-critical cyberpunk manifestos.

I am not a "hacker" of any description, though I do have readers in the digital underground.

When the Steve Jackson Games seizure occurred, I naturally took an intense interest. If "cyberpunk" books were being banned by federal police in my own home town, I reasonably wondered whether I myself might be next. Would my computer be seized by the Secret Service? At the time, I was in possession of an aging Apple IIe without so much as a hard disk.

If I were to be raided as an author of computer-crime manuals, the loss of my feeble word-processor would likely provoke more snickers than sympathy.

I'd known Steve Jackson for many years. We knew one another as colleagues, for we frequented the same local science-fiction conventions.

I'd played Jackson games, and recognized his cleverness; but he certainly had never struck me as a potential mastermind of computer crime.

I also knew a little about computer bulletin-board systems.

In the mid-1980s I had taken an active role in an Austin board called "SMOF-BBS," one of the first boards dedicated to science fiction.

I had a modem, and on occasion I'd logged on to Illuminati, which always looked entertainly wacky, but certainly harmless enough.

At the time of the Jackson seizure, I had no experience whatsoever with underground boards. But I knew that no one on Illuminati talked about breaking into systems illegally, or about robbing phone companies. Illuminati didn't even offer pirated computer games. Steve Jackson, like many creative artists, was markedly touchy about theft of intellectual property.

It seemed to me that Jackson was either seriously suspected of some crime--in which case, he would be charged soon, and would have his day in court--or else he was innocent, in which case the Secret Service would quickly return his equipment, and everyone would have a good laugh. I rather expected the good laugh.

The situation was not without its comic side. The raid, known as the "Cyberpunk Bust" in the science fiction community, was winning a great deal of free national publicity both for Jackson himself and the "cyberpunk" science fiction writers generally.

Besides, science fiction people are used to being misinterpreted.

Science fiction is a colorful, disreputable, slipshod occupation, full of unlikely oddb.a.l.l.s, which, of course, is why we like it.

Weirdness can be an occupational hazard in our field. People who wear Halloween costumes are sometimes mistaken for monsters.

Once upon a time--back in 1939, in New York City-- science fiction and the U.S. Secret Service collided in a comic case of mistaken ident.i.ty. This weird incident involved a literary group quite famous in science fiction, known as "the Futurians," whose membership included such future genre greats as Isaac Asimov, Frederik Pohl, and Damon Knight. The Futurians were every bit as offbeat and wacky as any of their spiritual descendants, including the cyberpunks, and were given to communal living, spontaneous group renditions of light opera, and midnight fencing exhibitions on the lawn. The Futurians didn't have bulletin board systems, but they did have the technological equivalent in 1939--mimeographs and a private printing press. These were in steady use, producing a stream of science-fiction fan magazines, literary manifestos, and weird articles, which were picked up in ink-sticky bundles by a succession of strange, gangly, spotty young men in fedoras and overcoats.

The neighbors grew alarmed at the antics of the Futurians and reported them to the Secret Service as suspected counterfeiters.

In the winter of 1939, a squad of USSS agents with drawn guns burst into "Futurian House," prepared to confiscate the forged currency and illicit printing presses. There they discovered a slumbering science fiction fan named George Hahn, a guest of the Futurian commune who had just arrived in New York. George Hahn managed to explain himself and his group, and the Secret Service agents left the Futurians in peace henceforth.

(Alas, Hahn died in 1991, just before I had discovered this astonishing historical parallel, and just before I could interview him for this book.)

But the Jackson case did not come to a swift and comic end.

No quick answers came his way, or mine; no swift rea.s.surances that all was right in the digital world, that matters were well in hand after all. Quite the opposite. In my alternate role as a sometime pop-science journalist, I interviewed Jackson and his staff for an article in a British magazine.

The strange details of the raid left me more concerned than ever.

Without its computers, the company had been financially and operationally crippled. Half the SJG workforce, a group of entirely innocent people, had been sorrowfully fired, deprived of their livelihoods by the seizure. It began to dawn on me that authors--American writers--might well have their computers seized, under sealed warrants, without any criminal charge; and that, as Steve Jackson had discovered, there was no immediate recourse for this.

This was no joke; this wasn't science fiction; this was real.

I determined to put science fiction aside until I had discovered what had happened and where this trouble had come from.

It was time to enter the purportedly real world of electronic free expression and computer crime. Hence, this book.

Hence, the world of the telcos; and the world of the digital underground; and next, the world of the police.

PART THREE: LAW AND ORDER

Of the various anti-hacker activities of 1990, "Operation Sundevil"

had by far the highest public profile. The sweeping, nationwide computer seizures of May 8, 1990 were unprecedented in scope and highly, if rather selectively, publicized.

Unlike the efforts of the Chicago Computer Fraud and Abuse Task Force, "Operation Sundevil" was not intended to combat "hacking" in the sense of computer intrusion or sophisticated raids on telco switching stations.

Nor did it have anything to do with hacker misdeeds with AT&T's software, or with Southern Bell's proprietary doc.u.ments.

Instead, "Operation Sundevil" was a crackdown on those traditional scourges of the digital underground: credit-card theft and telephone code abuse.

The ambitious activities out of Chicago, and the somewhat lesser-known but vigorous anti-hacker actions of the New York State Police in 1990, were never a part of "Operation Sundevil" per se, which was based in Arizona.

Nevertheless, after the spectacular May 8 raids, the public, misled by police secrecy, hacker panic, and a puzzled national press-corps, conflated all aspects of the nationwide crackdown in 1990 under the blanket term "Operation Sundevil." "Sundevil" is still the best-known synonym for the crackdown of 1990. But the Arizona organizers of "Sundevil"

did not really deserve this reputation--any more, for instance, than all hackers deserve a reputation as "hackers."

There was some justice in this confused perception, though.

For one thing, the confusion was abetted by the Washington office of the Secret Service, who responded to Freedom of Information Act requests on "Operation Sundevil" by referring investigators to the publicly known cases of Knight Lightning and the Atlanta Three.

And "Sundevil" was certainly the largest aspect of the Crackdown, the most deliberate and the best-organized. As a crackdown on electronic fraud, "Sundevil" lacked the frantic pace of the war on the Legion of Doom; on the contrary, Sundevil's targets were picked out with cool deliberation over an elaborate investigation lasting two full years.

And once again the targets were bulletin board systems.

Boards can be powerful aids to organized fraud. Underground boards carry lively, extensive, detailed, and often quite flagrant "discussions" of lawbreaking techniques and lawbreaking activities. "Discussing" crime in the abstract, or "discussing" the particulars of criminal cases, is not illegal--but there are stern state and federal laws against coldbloodedly conspiring in groups in order to commit crimes.

In the eyes of police, people who actively conspire to break the law are not regarded as "clubs," "debating salons," "users' groups," or "free speech advocates." Rather, such people tend to find themselves formally indicted by prosecutors as "gangs," "racketeers," "corrupt organizations" and "organized crime figures."

What's more, the illicit data contained on outlaw boards goes well beyond mere acts of speech and/or possible criminal conspiracy. As we have seen, it was common practice in the digital underground to post purloined telephone codes on boards, for any phreak or hacker who cared to abuse them. Is posting digital booty of this sort supposed to be protected by the First Amendment?

Hardly--though the issue, like most issues in cybers.p.a.ce, is not entirely resolved. Some theorists argue that to merely RECITE a number publicly is not illegal--only its USE is illegal. But anti-hacker police point out that magazines and newspapers (more traditional forms of free expression) never publish stolen telephone codes (even though this might well raise their circulation).

Stolen credit card numbers, being riskier and more valuable, were less often publicly posted on boards--but there is no question that some underground boards carried "carding" traffic, generally exchanged through private mail.

Underground boards also carried handy programs for "scanning" telephone codes and raiding credit card companies, as well as the usual obnoxious galaxy of pirated software, cracked pa.s.swords, blue-box schematics, intrusion manuals, anarchy files, p.o.r.n files, and so forth.

But besides their nuisance potential for the spread of illicit knowledge, bulletin boards have another vitally interesting aspect for the professional investigator. Bulletin boards are cram-full of EVIDENCE.

All that busy trading of electronic mail, all those hacker boasts, brags and struts, even the stolen codes and cards, can be neat, electronic, real-time recordings of criminal activity.

As an investigator, when you seize a pirate board, you have scored a coup as effective as tapping phones or intercepting mail.

However, you have not actually tapped a phone or intercepted a letter.

The rules of evidence regarding phone-taps and mail interceptions are old, stern and well-understood by police, prosecutors and defense attorneys alike.

The rules of evidence regarding boards are new, waffling, and understood by n.o.body at all.

Sundevil was the largest crackdown on boards in world history.

On May 7, 8, and 9, 1990, about forty-two computer systems were seized.

Of those forty-two computers, about twenty-five actually were running boards.