Kevin Mitnick

• 1. Introduction

  ›

  Kevin Mitnick was twelve years old when he asked a Los Angeles bus driver where he could buy a ticket punch. His stated reason was "a school project." The driver told him. Then a dumpster beside the bus company garage supplied the rest, a heap of unused transfer slips. With the punch and the slips, he could ride any bus in the greater Los Angeles area. Nothing had been broken into. One plausible sentence, said to the right person, had opened the whole system. That instinct, getting people to hand over what a system was built to protect, runs through everything that followed. Later, the FBI would pursue him. A federal judge would sentence him. Writers and filmmakers would argue over who he really was. Was he a dangerous criminal, or a skilled trespasser punished far beyond his deeds? And how did the same man end up paid to teach others how to defend against his own methods?

  6119599

• 2. A Boy Called Condor

  ›

  Kevin David Mitnick was born on the 6th of August 1963 in Van Nuys, Los Angeles. His father was Alan Mitnick and his mother was Shelly Jaffe. His maternal grandmother, Reba Vartanian, was part of the family picture too. Mitnick was Jewish and grew up in Los Angeles.

  At James Monroe High School in North Hills, he became a licensed amateur radio operator with the callsign WA6VPS. Years later, after his imprisonment, the license was restored under a new callsign, N6NHG.

  He also gave himself a nickname. After watching the movie Three Days of the Condor, he began calling himself "Condor." The handle stayed with him in the hacking world.

  His schooling continued at Los Angeles Pierce College and then at USC. Between those stretches, he also worked as a receptionist at Stephen S. Wise Temple in Los Angeles, a quiet job beside the life he was about to lead.

  9505126

• 3. The Ark and the Run

  ›

  In 1979, at the age of 16, Mitnick got hold of a telephone number through a friend. It led to the Ark, the computer system Digital Equipment Corporation, known as DEC, used to develop its RSTS/E operating system software. He broke into DEC's network and copied the company's software.

  That act caught up with him in 1988, when he was charged and convicted. The sentence was 12 months in prison, followed by three years of supervised release.

  Near the end of that supervised release, he hacked into Pacific Bell voicemail computers. A warrant was issued for his arrest, and Mitnick fled. He remained a fugitive for two-and-a-half years.

  The United States Department of Justice later described what he did in that time. It said he gained unauthorized access to dozens of computer networks. To hide where he was, he used cloned cellular phones. He copied valuable proprietary software from some of the country's largest cellular telephone and computer companies. He also intercepted and stole passwords, altered networks, and broke into private emails to read them.

  The chase ended in 1995.

  213396164

• 4. Raleigh and the Plea

  ›

  On the 15th of February 1995, the Federal Bureau of Investigation arrested Mitnick at his apartment in Raleigh, North Carolina. The pursuit had been well publicized. The federal offenses covered the two-and-a-half years of hacking, including computer fraud and wire fraud. Agents found cloned cell phones, more than 100 cloned cellular phone codes, and several pieces of false identification.

  In 1998, he was charged in the United States District Court for the Central District of California. There were 14 counts of wire fraud and eight counts of possessing unauthorized access devices. The list also included intercepting wire or electronic communications, unauthorized access to a federal computer, and causing damage to a computer.

  A plea bargain followed in 1999. Mitnick pleaded guilty to four counts of wire fraud, two counts of computer fraud, and one count of illegally intercepting a wire communication.

  Judge Mariana Pfaelzer handed down 46 months in federal prison. She added 22 months for breaking the terms of his earlier supervised release. He admitted that violation, which also reached other systems. He admitted, too, to associating with known hackers, here his co-defendant Lewis De Payne.

  Mitnick was diagnosed with Asperger syndrome. It was never used as evidence, because he pleaded guilty before any trial took place.

  The sentence was only part of the story. The conditions of his confinement drew attention of their own.

  24303829

• 5. Solitary and Supervision

  ›

  Mitnick spent five years in prison. Four-and-a-half of those years came before trial. Eight months were spent in solitary confinement.

  According to Mitnick, the reason was a claim made to a judge. Law enforcement officials, he said, convinced the court that he could "start a nuclear war by whistling into a pay phone." The implication was that he might dial into the NORAD modem from a prison payphone and whistle to launch nuclear missiles.

  Separately, a number of media outlets reported that the prison where he was held had no kosher meals available.

  He walked out on the 21st of January 2000. Freedom came with limits. His supervised release ran until the 21st of January 2003, and at first he was forbidden to use any communications technology except a landline telephone.

  The plea deal added another restraint. Under a variation of the Son of Sam law, he could not profit from films or books based on his criminal activity for seven years.

  Then, in December 2001, a judge of the Federal Communications Commission ruled that Mitnick was sufficiently rehabilitated to hold a federally issued amateur radio license.

  43034537

• 6. The Contested Case

  ›

  Supporters of Mitnick made a pointed argument. Although he was convicted of copying software unlawfully, they said his punishment was excessive. They also said many of the charges were fraudulent and rested on no actual losses.

  The dispute reached the coverage of the case, the books, and the films. The case itself tested new laws written to handle computer crime. It also raised public awareness of the security of networked computers. Today, the Mitnick story is often cited as an example of how news media can influence the people enforcing the law.

  Two men who took part in the pursuit, John Markoff and Tsutomu Shimomura, wrote the book Takedown about his capture. Other books followed a similar path. Cyberpunk, by Katie Hafner and John Markoff, appeared in 1995. In 1996 came The Cyberthief and the Samurai by Jeff Goodell, and The Fugitive Game by Jonathan Littman.

  In 2000, a film based on Takedown arrived under the title Track Down in the United States. Skeet Ulrich played Mitnick, and Russell Wong played Shimomura. The DVD was released in September 2004.

  Mitnick also took the microphone himself. From 2000 to 2002, he co-hosted DarkSide of the Internet, a two-hour weekly radio program on KFI in Los Angeles.

  In 2016, he appeared in Werner Herzog's documentary Lo and Behold, Reveries of the Connected World.

  395655755

• 7. Teaching the Defense

  ›

  In 2002, Mitnick co-founded Defensive Thinking Inc with Alex Kasperavičius. Their main product was the Certified Social Engineering Prevention Specialist program, known as CSEPS. It was a multi-module security-awareness course and professional certification aimed at defending against social engineering.

  The curriculum covered pretexting, elicitation, psychological manipulation, dumpster diving, and weaknesses within organizations. It was offered as a two-day boot camp at roughly US$1,500 per attendee. Its clients included branches of the United States Air Force and the United States Marine Corps.

  Mitnick's wider work covered security consulting, penetration testing, and social engineering training for companies and government agencies. In 2003, he testified before the United States House Committee on Financial Services about computer security and identity theft.

  He ran Mitnick Security Consulting LLC. He was also part owner and Chief Hacking Officer at KnowBe4, a provider of security awareness training and simulated phishing tests. Parts of the original CSEPS material were folded into KnowBe4's offerings.

  Another role sat on the advisory board of Zimperium, a mobile security company that specializes in mobile intrusion prevention.

  44454869

• 8. His Own Words

  ›

  Mitnick wrote four books with William L. Simon and Robert Vamosi. Three dealt with computer security and one told his own story.

  The Art of Deception, subtitled Controlling the Human Element of Security, appeared in 2002. The Art of Intrusion followed in 2005, promising the real stories behind the exploits of hackers, intruders and deceivers. In 2011 came Ghost in the Wires, whose subtitle promises his adventures as the world's most wanted hacker. The Art of Invisibility arrived in 2017.

  By then, Mitnick lived in Las Vegas, Nevada. On the 16th of July 2023, he died of pancreatic cancer at a hospital in Pittsburgh, Pennsylvania. He was 59.

  He was married to Kimberley Mitnick, who was 36 at the time and pregnant with their first child, a son. She remains active in the cybersecurity and hacking communities.

  5960616252