[00:02.640 --> 00:03.820]  This is something else.
[00:04.280 --> 00:05.180]  Welcome to everybody.
[00:05.360 --> 00:06.160]  Thanks for coming out.
[00:06.400 --> 00:09.620]  We're having a fantastic time at the Fifth HOPE.
[00:11.400 --> 00:13.000]  I know it's a little tight in here.
[00:13.140 --> 00:14.120]  I know it's a little hot.
[00:14.360 --> 00:23.040]  I got a couple of small requests and the fellows in the orange shirts, everyone's volunteer in the conference, the fellows in the orange shirts are the security volunteers.
[00:23.040 --> 00:27.280]  They're going to be following up by asking for this.
[00:27.820 --> 00:29.360]  What we need are two things.
[00:29.360 --> 00:38.120]  One is for people with the cameras, the tripods from the press to go to the center post, third post there, and back, please.
[00:39.260 --> 00:45.380]  The other thing that we need is an aisle for fire exit on this side.
[00:45.460 --> 00:47.040]  I know a lot of people are standing over there.
[00:47.240 --> 00:53.180]  We're going to be going through and asking you to try to either scoot in or scoot back or scoot otherwise.
[00:53.200 --> 00:53.960]  And I apologize.
[00:53.980 --> 00:54.780]  I know it's difficult.
[00:54.800 --> 00:56.240]  I know it's hot and so forth.
[00:56.240 --> 00:58.680]  But we're all trying to be polite and helpful.
[00:58.940 --> 01:00.120]  And thanks for your cooperation.
[01:02.300 --> 01:04.160]  That's the introduction to the introduction.
[01:05.640 --> 01:09.620]  As you know, let me just tell you where we're at.
[01:09.820 --> 01:11.080]  We're Friday keynote.
[01:11.500 --> 01:14.340]  We got Saturday and Sunday still to come.
[01:14.600 --> 01:16.580]  We got 24 hour movie room.
[01:17.040 --> 01:19.000]  We're just about to put a sign up.
[01:19.120 --> 01:19.760]  It was downstairs.
[01:20.040 --> 01:21.200]  We're moving it to the Madison room.
[01:21.320 --> 01:23.060]  We got a third track unscheduled.
[01:23.060 --> 01:26.360]  If you'd like to sign up, you got something to say, sign up.
[01:26.620 --> 01:27.340]  Give a talk.
[01:27.460 --> 01:28.120]  Give a tutorial.
[01:28.300 --> 01:28.800]  Give a workshop.
[01:29.080 --> 01:33.320]  24 hour access there for a third track workshop.
[01:34.300 --> 01:37.040]  Lockpick session is, I think, done for this afternoon.
[01:37.240 --> 01:38.720]  We're going to be having more lockpick workshops.
[01:38.980 --> 01:41.980]  Stay tuned tomorrow for announcements about those times and places.
[01:41.980 --> 01:50.800]  So we have a lot of things going on as well as a live broadcast of Off the Hook in this room from 8 till 10 p.m.
[01:51.040 --> 01:53.600]  And continued sessions in this room and the other room throughout.
[01:54.100 --> 01:55.640]  A lot of excitement going on.
[01:57.820 --> 02:02.440]  Now to provide the real introduction, Emmanuel Goldstein.
[02:12.010 --> 02:12.450]  Wow.
[02:16.730 --> 02:17.750]  This is amazing.
[02:17.750 --> 02:18.350]  Look at this.
[02:18.490 --> 02:19.370]  All the way back to the end.
[02:20.110 --> 02:20.550]  Welcome.
[02:21.210 --> 02:22.350]  Welcome to the Fifth HOPE.
[02:22.490 --> 02:22.830]  We're here.
[02:29.080 --> 02:34.660]  I just got to say, this marks the culmination of months of work with a very dedicated group of people.
[02:35.460 --> 02:38.200]  The decorations, I think, have been absolutely amazing.
[02:38.740 --> 02:40.060]  Second floor, 18th floor.
[02:40.880 --> 02:44.680]  AV, we've scrambled to put together a team and it's working out great.
[02:45.280 --> 02:49.280]  I just want to give a hand to all those people and security for keeping things working.
[02:49.680 --> 02:49.900]  Thank you.
[02:53.820 --> 02:55.740]  And there's a couple of reminders to folks.
[02:55.900 --> 03:01.820]  Just make sure that as we ask for the aisle to be kept clean, keep the hotel happy.
[03:02.240 --> 03:05.140]  Everyone's been behaving great so far and we just want to keep that up.
[03:05.560 --> 03:06.740]  They've been really good to us.
[03:07.380 --> 03:09.520]  And I think the weekend is going great.
[03:09.620 --> 03:11.420]  Compared to the last hope, I think we're already...
[03:11.420 --> 03:14.900]  We have more people or getting close to more people in the whole weekend.
[03:15.520 --> 03:17.040]  And we have so much more to come.
[03:17.180 --> 03:18.600]  We have the Off the Hook show later tonight.
[03:18.840 --> 03:20.420]  We have Steve Wozniak tomorrow.
[03:20.900 --> 03:21.720]  Jell will be out for Sunday.
[03:22.540 --> 03:28.240]  But now, for today, we have something that we have never been able to have before.
[03:28.460 --> 03:32.320]  Because back in the first hope, back in 1994, Kevin was in prison.
[03:33.120 --> 03:34.600]  And after that, he...
[03:34.600 --> 03:34.940]  Actually, no.
[03:35.000 --> 03:36.080]  In 1994, he was on the run.
[03:36.120 --> 03:37.320]  In 1997, he was in prison.
[03:37.460 --> 03:38.020]  And then there was...
[03:38.480 --> 03:40.960]  There was always a reason for Kevin not to be here.
[03:40.960 --> 03:44.320]  But there's no more reason for him not to be here.
[03:44.460 --> 03:46.020]  So, he is here finally.
[03:46.240 --> 03:46.880]  This is...
[03:48.000 --> 03:49.200]  This is the culmination.
[03:49.740 --> 03:52.020]  And it's the reason we started the HOPE conference in the first place.
[03:52.020 --> 03:53.160]  To get Kevin Mitnick to New York.
[03:53.380 --> 03:53.780]  And...
[03:53.780 --> 03:54.640]  Well, we did it.
[03:55.380 --> 03:57.940]  I also just want to intro a couple of really special people.
[03:58.460 --> 03:59.960]  Kevin's mother and grandmother are here.
[03:59.960 --> 04:01.080]  I think it's...
[04:01.600 --> 04:02.300]  I think it's...
[04:02.940 --> 04:03.380]  And...
[04:07.670 --> 04:17.410]  Throughout the entire ordeal of Kevin's imprisonment and prosecution, they have been the strength behind everything.
[04:18.070 --> 04:19.910]  As far as Kevin standing up to...
[04:19.910 --> 04:20.670]  For his rights.
[04:20.890 --> 04:22.650]  Just knowing that there are people out here supporting him.
[04:22.770 --> 04:23.710]  They've always been there.
[04:23.870 --> 04:25.390]  And they've been a real inspiration to me, too.
[04:25.390 --> 04:29.150]  Just people who really understand what's going on.
[04:29.570 --> 04:30.990]  What he is accused of.
[04:31.050 --> 04:31.610]  What he did.
[04:31.810 --> 04:32.950]  What's unfair about it.
[04:33.370 --> 04:33.850]  And it's just...
[04:33.850 --> 04:34.710]  I think that makes all the difference.
[04:34.750 --> 04:35.850]  When you have people who...
[04:35.850 --> 04:36.910]  Who give a damn.
[04:37.030 --> 04:38.010]  Who are standing behind you.
[04:38.090 --> 04:38.670]  So, I just want to...
[04:38.670 --> 04:40.070]  I want to thank you two for being there.
[04:40.190 --> 04:40.850]  And for being here.
[04:42.250 --> 04:42.610]  And...
[04:47.090 --> 04:51.190]  And we can also say Kevin is the only hacker to bring his mom and grandmother to a conference.
[04:53.330 --> 04:53.910]  All right.
[04:54.250 --> 04:56.550]  And with that, the words I've been wanting to speak for 10 years.
[04:56.770 --> 04:58.370]  Ladies and gentlemen, Kevin Mitnick.
[05:02.010 --> 05:02.810]  Thank you.
[05:02.950 --> 05:03.370]  Thanks, Eric.
[05:04.650 --> 05:05.150]  Very good.
[05:05.370 --> 05:05.550]  All right.
[05:05.670 --> 05:06.010]  Thanks, Kevin.
[05:12.070 --> 05:12.470]  Wow.
[05:18.570 --> 05:20.030]  It's finally good to be home.
[05:24.990 --> 05:27.890]  Well, first of all, I want to thank everyone for showing up for my talk.
[05:28.210 --> 05:30.270]  It's great to be back home again.
[05:30.970 --> 05:35.730]  And I want to thank everyone for all their support they've given me over the years.
[05:36.150 --> 05:39.150]  And today, my talk is going to be a little bit different.
[05:39.270 --> 05:42.630]  I usually talk for companies and conventions and stuff like that.
[05:42.710 --> 05:44.390]  But I'm going to talk about me.
[05:44.830 --> 05:46.410]  And the stuff that I've been through.
[05:46.810 --> 05:47.790]  And where I'm going.
[05:47.970 --> 05:51.070]  And some entertaining stories I think everyone will relate to and enjoy.
[05:52.730 --> 05:56.630]  And I guess I am the only first hacker to bring my mom and grandmother to a conference.
[05:56.630 --> 05:57.890]  And so...
[06:00.650 --> 06:01.590]  It's kind of interesting.
[06:02.210 --> 06:03.630]  Anyway, I think I was born...
[06:05.090 --> 06:09.350]  By the way, my talk is going to last for about probably an hour, 15 minutes to an hour and a half.
[06:09.430 --> 06:10.970]  And I'm going to have a 30 minute Q&A.
[06:11.090 --> 06:13.790]  Just so everyone's aware of the time constraints here.
[06:14.370 --> 06:21.090]  I think I was born as a hacker because at 10 years old, I was fascinated with magic.
[06:21.090 --> 06:21.990]  I love illusions.
[06:22.330 --> 06:29.010]  And I would hang out at the corner magic store for hours and hours just to find out the secret to a magic trick.
[06:29.690 --> 06:33.350]  I always wanted a bite of the forbidden fruit, the forbidden apple.
[06:33.590 --> 06:38.430]  And I always was in pursuit of information that should be secret, but for entertainment.
[06:38.430 --> 06:39.590]  I loved doing illusions.
[06:39.810 --> 06:42.550]  I loved pulling pranks on friends and family.
[06:44.150 --> 06:53.430]  So about two years later, the first system I hacked wasn't a computer, wasn't a telephone, but was the Los Angeles RTD.
[06:54.310 --> 06:55.270]  Do you know what RTD is?
[06:55.370 --> 06:57.250]  The Rapid Transit District.
[06:57.830 --> 07:00.910]  So as a young kid, my hobby was riding buses.
[07:01.310 --> 07:05.510]  I used to ride buses around all the way through Los Angeles and San Bernardino.
[07:05.890 --> 07:11.290]  My mom worked long hours as a single mother supporting me, so Kevin had to find something entertaining to do.
[07:12.450 --> 07:17.150]  So one day I'm sitting at the back of the bus, and I'm looking at the transfer.
[07:17.310 --> 07:20.670]  You know how you could pay a certain fee and you could buy a transfer to transfer on a different line?
[07:21.090 --> 07:26.590]  I'm looking at it, and it has a special punch, and it's punched with the date and the direction you're going.
[07:27.190 --> 07:29.450]  And you could use this as a ticket to get on the next bus.
[07:30.090 --> 07:34.930]  So I'm thinking to myself, about 11, 11 and a half years old, this is kind of interesting.
[07:35.830 --> 07:42.390]  So I go up to the bus driver, as I'm about to get off the bus, and I go, hey, sir, where do you get these punches?
[07:42.550 --> 07:46.950]  I'm doing a special project for school, and I like the kind of shapes these are.
[07:46.990 --> 07:48.030]  These are really cool shapes.
[07:48.110 --> 07:49.390]  Where can I buy one of these punches?
[07:50.770 --> 07:53.950]  And he told me the name of the store in downtown Los Angeles.
[07:54.210 --> 07:54.570]  I get that.
[07:54.650 --> 07:56.870]  That was the first time I did social engineering, 11 years old.
[07:58.130 --> 08:01.790]  So I go to the store in downtown LA, and I buy myself a nice shiny punch.
[08:01.790 --> 08:03.450]  And I go, wow, this is cool.
[08:03.530 --> 08:04.670]  I can punch my own transfers.
[08:05.690 --> 08:07.650]  The problem was, is I didn't have any transfers.
[08:08.970 --> 08:14.110]  So I was thinking, my grandmother lived about two miles away from the RTD bus depot.
[08:14.350 --> 08:16.890]  And I was thinking, you know, human nature, people are lazy.
[08:17.310 --> 08:23.230]  So I think these bus drivers, probably after a long day of riding that bus, they take these transfers they haven't used, and they just throw it in the trash.
[08:24.490 --> 08:27.070]  So Kevin, at 11 and a half, became a dumpster diver.
[08:28.730 --> 08:32.250]  And I went into the RTD trash and fished out all these blank transfers.
[08:32.670 --> 08:35.070]  And I used to punch my own transfers and ride the bus system.
[08:35.970 --> 08:40.350]  Bus drivers knew what I was doing, because they'd see me boarding the bus, and I'd have the outline of the punch.
[08:40.790 --> 08:41.150]  Right?
[08:42.810 --> 08:47.290]  And I'd be so bold sometimes to punch another transfer on the bus for somebody else.
[08:48.970 --> 08:51.910]  And the driver thought it was cute.
[08:52.250 --> 08:52.470]  Right?
[08:53.790 --> 08:55.010]  Everyone thought it was cute.
[08:55.330 --> 08:57.330]  No one told me I was defrauding RTD.
[08:57.590 --> 08:57.750]  Right?
[08:59.570 --> 09:07.350]  And I guess I have a little bit of a photographic memory, because I actually ended up memorizing the entire schedule for every bus in Los Angeles County.
[09:07.350 --> 09:13.510]  So if I knew I had to go from point A to point B, I knew what time to be at what place without referencing any type of schedule.
[09:14.350 --> 09:15.930]  So that was kind of interesting.
[09:17.430 --> 09:20.550]  One day I was riding the bus, and I met this other guy who was a ham radio operator.
[09:21.230 --> 09:26.110]  And this bus driver says, hey, kid, I found this radio on the back of the bus.
[09:26.170 --> 09:26.610]  Do you know what it is?
[09:26.670 --> 09:30.150]  And he held up an HT, Motorola HT.
[09:30.210 --> 09:31.830]  And I go, oh, that's a police radio, I'm thinking.
[09:31.990 --> 09:32.490]  Well, that's cool.
[09:32.550 --> 09:33.470]  I'd like to listen to police.
[09:35.350 --> 09:36.990]  And he goes, no, this is a ham radio.
[09:37.030 --> 09:40.530]  So he introduced me to the hobby of amateur radio.
[09:41.570 --> 09:46.550]  And I was so intrigued, not with the radio, but of the auto patch capability.
[09:46.710 --> 09:48.310]  That's making phone calls over radio.
[09:48.370 --> 09:49.710]  I thought the auto patch was cool.
[09:49.950 --> 09:51.670]  I could have this little HT handheld.
[09:51.930 --> 09:53.250]  This is like 20 years ago.
[09:53.410 --> 09:55.010]  And I could dial any phone number.
[09:55.390 --> 09:57.730]  And I thought that was, wow, I want to be able to do that.
[09:57.730 --> 09:58.350]  Right?
[10:00.090 --> 10:02.190]  So, I won't go into my auto patch stories.
[10:02.350 --> 10:03.450]  That will be for the next talk.
[10:03.850 --> 10:12.910]  But my most, the most fun I had with a radio, before I get into phones and computers, was the drive up windows at McDonald's.
[10:14.550 --> 10:21.850]  Because you can clip a wire in certain radios, like the Alinko radio, and you can go out of band and transmit on any frequency.
[10:22.330 --> 10:24.070]  So we used to have fun at McDonald's.
[10:24.190 --> 10:26.890]  So the customer drive up to the drive up window.
[10:27.310 --> 10:29.430]  And we now become the McDonald's employee.
[10:29.650 --> 10:30.630]  Because we have more power.
[10:31.610 --> 10:32.530]  Can I take your order, sir?
[10:33.190 --> 10:34.910]  Yes, I like a Big Mac, Large Fry, Large Coke.
[10:35.290 --> 10:37.290]  Oh, I'm sorry, we have changed our menu.
[10:37.370 --> 10:39.750]  And now we offer super taco, burritos.
[10:40.310 --> 10:42.430]  And we don't offer any sodas anymore.
[10:42.450 --> 10:43.170]  It's only juices.
[10:43.530 --> 10:44.970]  We drive customers crazy.
[10:45.290 --> 10:48.510]  Even to the point, and don't forget, we're young at this time, right?
[10:48.570 --> 10:49.270]  So we're a little bit crazy.
[10:49.610 --> 10:56.590]  We actually, with a micro cassette tape recorder, record ourselves, like one of us recorded ourselves urinating in the toilet.
[10:56.590 --> 10:57.630]  So you have the sound on tape.
[10:59.250 --> 11:00.070]  Driver comes up.
[11:00.870 --> 11:01.710]  Yes, sir, may I help you?
[11:02.050 --> 11:04.310]  Yes, I'd like to get a Big Mac and a large soda.
[11:04.510 --> 11:07.010]  Well, sir, we only have apple juice today.
[11:07.270 --> 11:08.430]  And our ice machine's broken.
[11:09.230 --> 11:11.490]  But we can get you a large apple juice, and it's on the house.
[11:11.610 --> 11:12.050]  Would you like that?
[11:12.090 --> 11:12.630]  Oh, yes, sir.
[11:12.710 --> 11:12.890]  Okay.
[11:13.110 --> 11:13.630]  Well, hold on.
[11:13.830 --> 11:15.630]  Is that small, medium, or large?
[11:15.710 --> 11:17.110]  And we play the tape, right?
[11:19.410 --> 11:23.530]  We drove one McDonald's so crazy that the manager came out.
[11:23.650 --> 11:26.110]  We're like a block away doing this, right?
[11:26.490 --> 11:27.450]  Manager comes out.
[11:27.570 --> 11:29.090]  He's looking in the parking lot.
[11:29.290 --> 11:31.290]  He sees no one, right?
[11:31.590 --> 11:36.630]  And he's looking around, and he's scratching his head, and he walks up to the speaker, right?
[11:37.390 --> 11:40.410]  And he has his face on the speaker, and I go, what the F are you looking at?
[11:40.570 --> 11:41.150]  This guy...
[11:43.270 --> 11:45.930]  This guy jumped back 30 feet.
[11:51.450 --> 11:52.890]  Don't tell the FCC on me.
[11:53.050 --> 11:53.850]  They already don't like me.
[11:56.710 --> 11:58.970]  So let's fast-forward a little bit to high school.
[11:59.450 --> 12:00.630]  I'm a ham radio buff.
[12:00.630 --> 12:01.490]  I'm really into radio.
[12:01.730 --> 12:03.050]  I'm into playing with the auto patch.
[12:03.270 --> 12:08.370]  And I meet this other kid whose dad's a ham radio operator, and he was what they call the phone phreak.
[12:08.890 --> 12:13.230]  So he wanted to borrow my radio in exchange for showing me stuff about phones.
[12:13.330 --> 12:14.770]  And I could really care less at the time.
[12:15.090 --> 12:17.010]  But then he started showing me some neat stuff.
[12:17.230 --> 12:25.490]  How he can call a secret number in the phone company, and he can give the phone number, and the operator would immediately give the name and address without asking any questions.
[12:25.570 --> 12:26.510]  It was called the CNA Bureau.
[12:27.290 --> 12:31.310]  How he was able, he'd say, give me the name of a family member that has an unlisted telephone.
[12:31.590 --> 12:34.230]  And he would call a bureau called the NumPub Bureau.
[12:34.230 --> 12:39.130]  And he'd be able to sweet-talk them out of getting an unlisted telephone number of a family member.
[12:40.050 --> 12:43.990]  And the really thing that intrigued me is he said, I have this secret test number.
[12:44.170 --> 12:49.790]  You call this test number, you hear a tone, and you put it in five digits, and you can call anywhere in the world for free.
[12:50.950 --> 12:52.410]  Later on, I found out that was Sprint.
[12:52.790 --> 12:54.330]  And it wasn't calling for someone for free.
[12:54.450 --> 12:55.290]  Somebody was paying the bill.
[12:55.430 --> 12:56.750]  But I'm a high school kid.
[12:56.770 --> 12:57.270]  I didn't know.
[12:59.810 --> 13:03.570]  So, when I started in phones, I was really learning about the telephone network.
[13:03.570 --> 13:05.250]  I had a passion for technology.
[13:05.250 --> 13:06.770]  It was just, it was fascinating.
[13:06.770 --> 13:16.270]  And the people I read about, like John Draper, Captain Crunch, who I know is here, and Steve Wozniak, I read about their experiments with the phone system.
[13:16.270 --> 13:17.310]  And it kind of intrigued me.
[13:17.390 --> 13:18.950]  And I wanted to learn more, more, and more.
[13:20.350 --> 13:23.390]  So, the route I took was a very risky route.
[13:24.470 --> 13:30.530]  And this is where I first learned about social engineering, because to learn about the phone company wasn't like you can go down and get a manual.
[13:30.750 --> 13:34.790]  I did read the Bell Technical journals at UCLA Library.
[13:34.790 --> 13:35.610]  That was pretty cool.
[13:35.930 --> 13:44.530]  But a lot of it was about pretending to be another employee, calling up another department within the phone company, and sweet-talking them of how to do something.
[13:45.030 --> 13:47.790]  Like, I have this customer's phone was disconnected by mistake.
[13:47.790 --> 13:48.830]  How do I reconnect it?
[13:49.110 --> 13:51.130]  And then learning about their internal operations.
[13:51.330 --> 13:55.290]  That's where I first learned about social engineering back in the late 70s.
[13:56.530 --> 13:58.330]  But then I got a little bit more bold in that.
[13:58.490 --> 14:02.570]  I wanted, I really wanted to learn about, you know, the equipment, how it worked.
[14:03.230 --> 14:18.310]  So, in late one night, around one in the morning, I guess it's an action I still regret today, is a friend of mine, who was also a phone phreaker at the time, decided we're going to take a self-guided tour of the Hollywood Gower Central Office in Hollywood,
[14:18.430 --> 14:18.730]  California.
[14:18.730 --> 14:20.190]  So, we acquired the door code.
[14:20.890 --> 14:23.770]  So, we're in the central office, and we're walking around.
[14:23.770 --> 14:25.110]  It's a nine-story building.
[14:25.290 --> 14:31.930]  And when I get to the fifth floor, this big, bulky security guard says, Son?
[14:32.550 --> 14:33.430]  Uh, yes?
[14:33.830 --> 14:34.810]  He goes, Who are you?
[14:35.050 --> 14:36.050]  Oh, this is Adam.
[14:36.090 --> 14:37.790]  I'm with the Cosmos Center in San Diego.
[14:37.870 --> 14:40.450]  I'm just taking my friend here on a little tour of a phone company.
[14:40.450 --> 14:41.150]  He's kind of interested.
[14:41.350 --> 14:43.050]  And my friend looked 15 years old.
[14:43.370 --> 14:44.730]  He says, Do you have a badge?
[14:45.370 --> 14:46.090]  I go, Yeah, sure.
[14:46.150 --> 14:46.430]  No problem.
[14:46.570 --> 14:48.490]  And I go, Oh, man.
[14:48.550 --> 14:49.390]  I just slept in my car.
[14:49.630 --> 14:50.550]  Uh, I'll go get it.
[14:50.550 --> 14:51.030]  I'll be right back.
[14:51.370 --> 14:51.970]  He goes, No, no.
[14:52.110 --> 14:52.710]  You come with me.
[14:53.530 --> 14:54.790]  Brings me up to the ninth floor.
[14:55.910 --> 14:57.390]  And then there's other people there.
[14:58.030 --> 14:58.990]  And they go, Who are you?
[14:59.270 --> 15:00.190]  Who do you work for?
[15:00.290 --> 15:01.010]  The 20 questions.
[15:01.490 --> 15:02.830]  And I'm calm as can be.
[15:03.150 --> 15:04.190]  Work in the Cosmos Center.
[15:04.230 --> 15:04.790]  Here's the address.
[15:04.910 --> 15:05.610]  Who's your supervisor?
[15:05.770 --> 15:06.790]  Give them the name of the supervisor.
[15:06.790 --> 15:09.890]  Because I already had memorized this information from before.
[15:10.410 --> 15:12.230]  So he goes, Well, I'm going to call your supervisor right now.
[15:12.730 --> 15:14.050]  I go, Well, it's two in the morning.
[15:14.190 --> 15:15.430]  She's going to get pretty pissed off.
[15:15.730 --> 15:17.350]  He goes, Well, you don't have any idea.
[15:17.470 --> 15:18.250]  We don't know who you are.
[15:18.990 --> 15:20.070]  Okay, call the supervisor.
[15:20.910 --> 15:21.570]  He counts on the phone.
[15:21.670 --> 15:21.970]  He calls.
[15:22.190 --> 15:24.090]  He gets the supervisor's home phone number.
[15:24.810 --> 15:25.490]  Calls her at home.
[15:25.570 --> 15:26.130]  Wakes her up.
[15:27.030 --> 15:29.830]  And says, Yeah, I have one of your employees here named Adam.
[15:29.870 --> 15:31.910]  And he's giving a tour at two in the morning?
[15:32.290 --> 15:33.310]  What's going on with this?
[15:34.730 --> 15:36.530]  And she somehow, she goes, Oh, yeah.
[15:36.610 --> 15:37.890]  I do have an Adam working for me.
[15:38.090 --> 15:41.710]  And then I said to the gentleman, the security guy, I said, Well, can I talk to my boss?
[15:42.650 --> 15:43.470]  So he goes, Sure.
[15:43.570 --> 15:44.370]  And he hands me the phone.
[15:45.190 --> 15:46.250]  And I go, Oh, hi.
[15:46.550 --> 15:47.470]  And we're talking.
[15:47.550 --> 15:48.490]  She's going, Who are you?
[15:48.650 --> 15:52.190]  And I say, Yeah, I am sorry that he interrupted your sleep.
[15:52.190 --> 15:54.790]  And I will have that report, you know, Tuesday morning.
[15:54.950 --> 15:56.770]  And, you know, how'd your vacation go?
[15:57.030 --> 15:57.890]  And she's going, Who are you?
[15:57.910 --> 15:58.350]  What's your name?
[15:58.430 --> 15:58.850]  Who are you?
[15:58.850 --> 16:00.010]  And I'm having a call.
[16:00.150 --> 16:03.730]  And I'm pressing it to my ear so they can't hear her side, right?
[16:05.710 --> 16:06.730]  And I said, Great.
[16:06.870 --> 16:08.330]  Well, I'll see you Monday.
[16:08.670 --> 16:09.290]  Have a good day.
[16:09.370 --> 16:10.150]  And I hang up the phone.
[16:11.190 --> 16:13.430]  And I know I have 10 minutes to get out of there.
[16:14.250 --> 16:16.610]  So I calmly go, See, I told you who I was.
[16:16.690 --> 16:17.830]  I'm really sorry I didn't have my badge.
[16:18.250 --> 16:19.810]  Can you just, I'll just be another half hour.
[16:19.890 --> 16:20.890]  Can I show my friend around the building?
[16:22.490 --> 16:23.650]  And, Okay, go ahead.
[16:24.010 --> 16:28.350]  So we go and instead of going on a self guided tour, I decided to make a beeline right out of that building.
[16:28.530 --> 16:30.010]  Go to the elevator down, out.
[16:30.210 --> 16:33.290]  And my friend and I sit in a car across the street and we're just watching the door.
[16:33.670 --> 16:37.450]  About 15 minutes later, that same guard bursts out of the door and he's looking all around.
[16:39.570 --> 16:40.290]  Crazy stuff.
[16:40.930 --> 16:48.870]  I mean, I caused so much, I guess, such a pain in the ass to the phone company that they eventually had to take out our telephone.
[16:48.870 --> 16:54.370]  I was at home living with my mom as a teenager and the phone company actually removed our phone.
[16:54.570 --> 16:55.310]  Can you imagine that?
[16:56.270 --> 16:57.750]  They said, No phone for Mitnick.
[16:59.070 --> 17:01.030]  And I was thinking, I go, This is not fair.
[17:01.950 --> 17:03.730]  So I lived in Unit 13.
[17:04.030 --> 17:08.250]  And they actually had it blocked off at line assignment, which is a special division of the phone company.
[17:08.310 --> 17:08.690]  No phone.
[17:09.610 --> 17:10.030]  Okay.
[17:10.570 --> 17:15.430]  So I call up their facilities department and I tell them there's a new unit being installed, 12B.
[17:17.730 --> 17:18.170]  Okay.
[17:20.050 --> 17:21.990]  So someone might move into 12B shortly.
[17:21.990 --> 17:24.150]  So you just should allocate it if they need service.
[17:24.890 --> 17:27.030]  You know, the customer might install the phone there.
[17:27.610 --> 17:28.770]  I wait about three days.
[17:29.090 --> 17:30.430]  I go to the hardware store.
[17:30.590 --> 17:31.390]  Go get 12B.
[17:31.710 --> 17:32.670]  Take off 13.
[17:33.130 --> 17:34.130]  Put on 12B.
[17:37.350 --> 17:38.930]  Phone company was not happy.
[17:39.050 --> 17:40.590]  About three months later they figured it out.
[17:40.730 --> 17:42.130]  They yanked out that phone again.
[17:44.250 --> 17:48.230]  I think anyone in that apartment building, they had to go through security before they could get a phone line.
[17:50.130 --> 17:51.850]  I don't know why these guys don't have a sense of humor.
[17:54.110 --> 17:55.610]  So that's, so I'm in high school.
[17:56.210 --> 17:59.350]  I'm really into phones, into switching and learning how this stuff worked.
[17:59.350 --> 18:05.350]  And that's when the phone company was going from step-by-step crossbar to ESS, electronic switching systems.
[18:07.070 --> 18:10.670]  And computers kind of were the front ends that controlled these devices.
[18:11.190 --> 18:13.490]  And I like to pull pranks on friends.
[18:13.490 --> 18:16.410]  So I always like to get access to the switch electronically.
[18:18.570 --> 18:24.910]  So, when I was in high school, this friend introduced me to the computer instructor and tried to get me into the class.
[18:25.150 --> 18:26.710]  And the instructor goes, well, do you have trigonometry?
[18:26.890 --> 18:27.450]  What are your prerequisites?
[18:28.370 --> 18:31.710]  I go, no, I didn't have those mathematical prerequisites, but I'd still like to take class.
[18:31.730 --> 18:32.270]  Can you let me in?
[18:32.370 --> 18:33.150]  He goes, well...
[18:33.150 --> 18:36.830]  And then my friend says, oh, show him some of that phone phreaking stuff.
[18:37.890 --> 18:38.510]  I go, cool.
[18:38.570 --> 18:41.930]  So I start showing the teacher some of the cute things I could do with the phone.
[18:42.510 --> 18:44.390]  And he waves the prerequisites, right?
[18:44.810 --> 18:45.690]  So I go, oh, that's cool.
[18:46.210 --> 18:47.310]  So first assignment.
[18:47.890 --> 18:51.230]  Write a basic program that finds the first hundred Fibonacci numbers.
[18:52.430 --> 18:52.870]  Boring.
[18:53.470 --> 18:57.570]  I decided, my first program was to write a login simulator.
[18:57.870 --> 19:07.910]  So when the teacher would dial-up to the PDP-11 off-site, he'd be talking to my program instead of the operating system and giving me the password that he was using.
[19:09.250 --> 19:12.070]  And it would store his password in the file and would go ahead and log him in.
[19:12.210 --> 19:15.690]  And every time I'd go up to him and give him his new password, it would drive him crazy.
[19:17.870 --> 19:20.350]  Even to the point he'd put it on paper tape.
[19:21.090 --> 19:23.050]  Like the password, the six character password.
[19:23.170 --> 19:25.850]  This is the RSTS/E operating system for all your old timers out here.
[19:26.450 --> 19:29.350]  And then every day I'd remember the configuration of the holes.
[19:29.890 --> 19:30.650]  And, you know, write it down.
[19:30.750 --> 19:31.150]  I'd get friends.
[19:31.270 --> 19:33.010]  Oh, what's the second line we write down?
[19:33.070 --> 19:34.510]  Then we'd figure out the password, right?
[19:35.910 --> 19:37.130]  So I got bored with it.
[19:37.190 --> 19:38.730]  They had an HP-2000 at school.
[19:38.990 --> 19:42.210]  And a lot of us used to play games like Star Trek, Zork, Adventure.
[19:42.810 --> 19:45.310]  But USC always had the better games.
[19:46.490 --> 19:51.390]  And our modem at the school, we had an Olivetti 110 baud terminal.
[19:51.730 --> 19:53.190]  So to dial-up to the school...
[19:53.190 --> 19:54.610]  Can you imagine 110 baud these days?
[19:55.790 --> 19:57.090]  We couldn't dial outside.
[19:57.530 --> 19:59.050]  We could only dial within the campus.
[19:59.690 --> 20:01.370]  So what I used to do is call the operator.
[20:01.690 --> 20:02.870]  Hi, this is Mr. Crist.
[20:03.330 --> 20:04.670]  I'm trying to get an outside line.
[20:04.770 --> 20:06.010]  Can you connect me to such and such number?
[20:06.690 --> 20:08.870]  And then they'd be able to dial in to USC.
[20:09.210 --> 20:11.390]  And we'd be able to play the games they had on their computers.
[20:12.250 --> 20:14.690]  So the teacher got wind of this because it was a teletype terminal.
[20:14.810 --> 20:17.570]  He'd go back on the paper and go, What are you up to again, Kevin?
[20:17.730 --> 20:18.750]  And it'd drive him crazy.
[20:19.910 --> 20:21.490]  So one day he walks into class.
[20:22.370 --> 20:23.970]  And he announces, he gets everyone together.
[20:24.090 --> 20:26.650]  He goes, I found the solution to stop Kevin.
[20:29.530 --> 20:31.190]  And he holds up a telephone lock.
[20:32.250 --> 20:33.530]  And this is a dial telephone.
[20:34.510 --> 20:37.690]  And he proudly places the lock in the number one position.
[20:37.850 --> 20:39.250]  He has a big smile on his face.
[20:40.050 --> 20:41.970]  And I go, this is going to be fun.
[20:44.710 --> 20:48.870]  So I go, Mr. Crist, what's the phone number to the main school?
[20:49.090 --> 20:49.930]  I forgot what it was.
[20:50.090 --> 20:51.330]  And he proudly gives me the number.
[20:51.370 --> 20:52.710]  I said, hey, you want to see a neat trick?
[20:53.210 --> 20:54.850]  I pick up the phone and I pulse out the number.
[20:55.970 --> 20:58.150]  He got so angry, the teacher.
[20:58.410 --> 20:59.450]  His face turned red.
[20:59.450 --> 21:00.190]  Then it turned white.
[21:00.370 --> 21:02.330]  Then he ripped out the phone and threw it across the room.
[21:05.920 --> 21:08.800]  So, as you can see, I started off on a good foot.
[21:10.080 --> 21:10.600]  All right.
[21:10.880 --> 21:11.880]  So my first hack.
[21:12.360 --> 21:15.500]  You know, people don't know, like, the first time I hacked into a system.
[21:15.980 --> 21:23.340]  And I met the system admin who was the administrator of the LAUSD, Los Angeles Unified School District's computer.
[21:23.540 --> 21:27.120]  And these guys were really clever with computers.
[21:27.200 --> 21:28.920]  These guys were, like, you know, true hackers.
[21:29.400 --> 21:31.440]  And I wanted to learn from these guys.
[21:31.440 --> 21:33.220]  So I wanted to become a member of their peer group.
[21:34.220 --> 21:36.300]  And these guys were into hacking RSTS/E.
[21:36.660 --> 21:39.720]  And they were into hacking different types of DEC operating systems.
[21:41.040 --> 21:43.880]  So they had a friend that worked for RSTS/E development.
[21:44.200 --> 21:47.860]  And they obtained the dial-up number to the system.
[21:48.460 --> 21:51.420]  And this was the system where they did development on this operating system.
[21:51.980 --> 21:59.540]  So they said, they said, Kevin, if you can get into that system, you can join our group and we can share information.
[21:59.900 --> 22:03.960]  I'm thinking to myself, I don't know much about, you know, hacking at the time.
[22:04.660 --> 22:06.880]  I don't know much about that particular operating system.
[22:07.000 --> 22:07.980]  All I have is dial-up number.
[22:08.080 --> 22:08.460]  What am I going to do?
[22:08.540 --> 22:09.180]  Guess the password?
[22:09.300 --> 22:10.280]  This is what I was thinking to myself.
[22:12.000 --> 22:16.140]  So I did a little bit of research and I found out one of the developers' names was Anton Chernoff.
[22:16.860 --> 22:24.000]  And I called the main number at DEC and found out the name of the person that was responsible for administrating the system.
[22:25.020 --> 22:26.080]  So I figured I'd give it a shot.
[22:26.940 --> 22:28.380]  I call up the system administrator.
[22:29.200 --> 22:30.620]  I go, hey, Greg, this is Anton.
[22:30.780 --> 22:31.940]  I said, what's going on with the system?
[22:32.460 --> 22:33.320]  He goes, what are you talking about?
[22:33.320 --> 22:36.320]  I try to log into my account, 1,113.
[22:37.360 --> 22:39.300]  It's not letting me and I have work to do.
[22:39.760 --> 22:40.860]  He goes, well, hold on a second.
[22:40.960 --> 22:43.360]  And he comes back and he goes, you don't have 1,113.
[22:43.460 --> 22:44.880]  You have this other account number.
[22:45.000 --> 22:48.580]  I said, no, I know I have that one, but I also have 1,113 because I'm working on a special project.
[22:49.560 --> 22:51.620]  And I said, and he goes, and I go, what's going on?
[22:51.660 --> 22:54.180]  He goes, well, for some reason, the account doesn't exist.
[22:54.700 --> 22:55.920]  I said, well, can you create it for me?
[22:55.940 --> 22:56.700]  I'm really in a rush.
[22:57.540 --> 22:58.780]  He goes, what password do you want?
[22:59.160 --> 23:00.040]  I go, jellyfish.
[23:00.920 --> 23:01.200]  Okay.
[23:01.800 --> 23:02.720]  He goes, okay, great.
[23:03.220 --> 23:04.020]  He goes, thank you.
[23:04.140 --> 23:04.700]  And I go, thank you.
[23:04.760 --> 23:05.340]  The call ends.
[23:05.840 --> 23:06.580]  I dial-up.
[23:06.680 --> 23:07.200]  I'm all happy.
[23:07.780 --> 23:09.160]  I put in 1,113.
[23:09.200 --> 23:10.060]  I put in jellyfish.
[23:10.060 --> 23:11.380]  And it says, dial-up password.
[23:12.260 --> 23:12.540]  Oh.
[23:13.420 --> 23:14.540]  I didn't know they have a dial-up password.
[23:14.960 --> 23:16.080]  So I called the guy back.
[23:16.500 --> 23:18.720]  And I go, what's up with the dial-up password?
[23:20.320 --> 23:21.520]  Did it change last month?
[23:21.680 --> 23:22.180]  He goes, yeah.
[23:22.240 --> 23:22.960]  Didn't you get the email?
[23:23.040 --> 23:23.480]  I go, no.
[23:23.740 --> 23:24.520]  What's going on?
[23:25.000 --> 23:26.080]  He goes, it's buffoon.
[23:27.080 --> 23:27.780]  I go, okay.
[23:27.780 --> 23:28.800]  Thanks.
[23:30.080 --> 23:31.160]  That's a true story.
[23:31.260 --> 23:31.800]  It was buffoon.
[23:33.540 --> 23:41.240]  So that was my first hack into DEC and actually I was into their network for many, many years.
[23:41.240 --> 23:53.800]  And then I, what my goal was as a hacker was to find, what my goal was at the end of the day was everything was in the furtherance of becoming better at the skill of circumventing security.
[23:54.100 --> 23:58.160]  Finding a way to pick the lock in the quickest way, in the most effective way possible.
[23:58.760 --> 24:05.700]  And at the time, VMS, which is a different operating system manufactured by DEC, was closed-source.
[24:05.900 --> 24:06.440]  It's like Windows.
[24:07.020 --> 24:11.160]  Unless you get the access to the source code they publish after ripping it off, you never will see it.
[24:13.920 --> 24:18.200]  And what I did is I made another stupid decision in my life and I figured, hey, I'm going to go get the VMS source code.
[24:20.100 --> 24:27.800]  So, I ended up getting the source code, I get it transferred to USC because I didn't have enough storage on my laptop to hold the whole source code tree.
[24:27.880 --> 24:38.360]  So I figured I'd leave it on USC and I'll look through the code, it was BLIS-32, and I'll look for comments on any security patches that were applied and then I'd be able to work the patch backwards to what the hole was.
[24:38.360 --> 24:41.500]  Or I'd be able to identify holes that they haven't even figured out yet.
[24:41.820 --> 24:42.960]  So that was my goal.
[24:43.160 --> 24:49.460]  And I figured it would be much safer for me to look through the source code tree on USC's computers than it would be on DEC's.
[24:49.700 --> 24:51.360]  There was less chance of detection.
[24:52.840 --> 24:59.480]  So my cohort that was working with me on this, another fellow hacker that I met in high school, he ratted me out to the feds.
[24:59.720 --> 25:00.620]  It's a long story.
[25:01.220 --> 25:06.400]  And then one day, he calls me up on the phone and says, listen, Kevin, I need you to come to my office.
[25:06.400 --> 25:11.200]  I need a couple of those disks that have some information that we worked on before.
[25:13.060 --> 25:18.980]  So one Friday night, five o'clock in the afternoon, I drive down to his office and I go into the underground parking garage.
[25:19.140 --> 25:20.760]  And surprisingly, he was like outside.
[25:21.580 --> 25:22.940]  And I go, hey, Lenny, come here.
[25:23.720 --> 25:25.840]  And he goes, oh, yeah, do you have your blue bag with you?
[25:26.260 --> 25:27.060]  I thought that was kind of weird.
[25:27.080 --> 25:27.980]  I go, yeah, I brought the disk.
[25:28.300 --> 25:29.900]  So I go into the trunk to get my disk.
[25:30.180 --> 25:33.160]  And then all of a sudden, all these cars start screeching, right?
[25:33.520 --> 25:34.320]  So it was a setup.
[25:34.540 --> 25:35.620]  It was a FBI.
[25:36.840 --> 25:43.620]  And they promptly arrested me and took me down to Terminal Island Federal Prison in San Pedro, California.
[25:44.440 --> 25:47.020]  And all I was concerned about is how much is my bail?
[25:47.540 --> 25:48.600]  Because I want to get out of here.
[25:49.900 --> 25:51.180]  So I stayed there the weekend.
[25:52.740 --> 25:57.000]  And Monday morning, they take me down to the FBI office and they take photographs.
[25:57.420 --> 26:01.480]  Have you ever seen that electronic terrorist photograph that the media loves to use?
[26:01.660 --> 26:03.960]  That was that photograph back in 1988.
[26:05.240 --> 26:06.200]  So they take me down.
[26:06.240 --> 26:07.100]  They take me down to court.
[26:07.680 --> 26:09.280]  And I'm thinking, fine, they go to court.
[26:09.420 --> 26:10.220]  They'll set the bail.
[26:10.360 --> 26:10.940]  I'll get out.
[26:11.020 --> 26:11.920]  It will be a done story.
[26:12.940 --> 26:14.080]  So I show up at court.
[26:14.960 --> 26:18.580]  And they introduce me to this public defender who spoke to me about for five years.
[26:18.600 --> 26:18.920]  Five minutes.
[26:19.640 --> 26:21.420]  And he didn't even know how to turn on a computer.
[26:21.620 --> 26:23.840]  The only question was, do you have a passport?
[26:24.280 --> 26:27.360]  I go, yeah, but my family will bring it if that's an issue.
[26:27.840 --> 26:28.880]  So we go into court.
[26:29.900 --> 26:30.740]  My family's there.
[26:31.300 --> 26:33.440]  I'm sitting down and I'm expecting bail to be posted.
[26:33.440 --> 26:34.180]  I'm out of here.
[26:36.640 --> 26:37.640]  Prosecutor stands up.
[26:38.040 --> 26:38.780]  Goes, your honor.
[26:39.680 --> 26:45.460]  Not only do we have to hold Mr. Mitnick in detention, but we have to make sure he can't get access to a telephone.
[26:46.300 --> 26:53.600]  Because if he can get access to a telephone, he could pick up the phone and call into NORAD, and he could whistle the codes to launch a nuclear weapon.
[26:55.980 --> 26:59.140]  And I'm thinking to myself, I go, nobody could be that stupid.
[27:00.300 --> 27:01.200]  Nobody could be that stupid.
[27:01.360 --> 27:06.320]  And your honor, we have evidence that Mr. Mitnick has compromised the security of the National Security Agency.
[27:07.060 --> 27:11.400]  And even though this hearing is open to the public, we feel comfortable we can discuss this.
[27:11.760 --> 27:16.180]  And so, they found a file on one of those floppy disks called NSA.txt.
[27:16.580 --> 27:18.900]  And what I did, there was a system called DOCMASTER.
[27:19.200 --> 27:22.420]  It was run by the National Computer Security Center, and I did a WHOIS on it.
[27:22.760 --> 27:25.760]  Remember the old days how you'd be able to list out the registered users of the house?
[27:26.020 --> 27:28.960]  Well, I captured the output into a file called NSA.txt.
[27:29.600 --> 27:34.660]  And the prosecutor turned that into, I compromised the security of the National Security Agency.
[27:35.900 --> 27:37.500]  They talked about war games.
[27:37.960 --> 27:42.080]  And how the movie War Games is probably based on what I could do.
[27:42.220 --> 27:45.620]  And they were scaring the heebie-jeebies out of this federal magistrate.
[27:47.280 --> 27:55.920]  So, at the end of the day, the prosecutor asked for a special detention order that they keep me away from every electronic device in detention.
[27:56.240 --> 27:57.200]  And no bail.
[27:58.100 --> 28:00.220]  And so, they placed me in the only place they could put me.
[28:00.320 --> 28:00.660]  The hole.
[28:01.000 --> 28:02.800]  Which is a solitary confinement.
[28:03.200 --> 28:05.640]  And I was in the hole for about nine months.
[28:05.780 --> 28:06.880]  I would say about eight and a half months.
[28:07.340 --> 28:09.620]  And that's where you're locked down 23 hours a day.
[28:09.800 --> 28:15.380]  And they let you out for about an hour a day in an equally sized room, but it's outside where you can get fresh air.
[28:16.100 --> 28:21.320]  I remember going to the shower, which was like ten feet away.
[28:21.440 --> 28:28.380]  They'd actually have you stick your hands through this trap door, and they'd handcuff you, stick your legs or your feet through another door.
[28:28.500 --> 28:29.900]  They'd put leg irons on you.
[28:30.080 --> 28:32.900]  They'd walk you ten feet to another cell that was a shower.
[28:33.160 --> 28:35.300]  They'd lock you in there and then they'd take off the handcuffs.
[28:35.800 --> 28:36.180]  Right?
[28:36.480 --> 28:38.140]  That's how high security it was.
[28:38.460 --> 28:41.580]  And after about eight and a half months, I started to get a little bit crazy.
[28:42.140 --> 28:45.460]  So, the government went to my attorney and said, Hey, we have a deal for your client.
[28:45.680 --> 28:46.520]  He pleads out.
[28:46.940 --> 28:48.060]  Twelve months in custody.
[28:48.520 --> 28:50.160]  Immediately we'll put him in a general population.
[28:50.340 --> 28:53.520]  We'll recommend Lompoc Camp, which is like going on vacation.
[28:54.040 --> 28:55.100]  And it's a done deal.
[28:55.300 --> 28:56.480]  Or your client could fight.
[28:56.820 --> 28:58.000]  We'll keep him in the hole.
[28:58.740 --> 29:03.820]  And if he does get convicted and we sentence him, we're going to ask the judge to keep him there for a sentence.
[29:04.360 --> 29:06.380]  And so, what would any sane person do?
[29:06.440 --> 29:07.840]  I sign to get the hell out of there.
[29:08.780 --> 29:12.380]  So, in 1990, I was released from Lompoc Camp.
[29:13.560 --> 29:16.300]  And the camp was... I was there for about four months.
[29:16.960 --> 29:18.000]  So, I'm released.
[29:20.020 --> 29:22.740]  1991, I get a phone call from my brother.
[29:23.220 --> 29:24.120]  My half-brother.
[29:25.300 --> 29:29.960]  And he says his girlfriend called him because she has a friend in San Diego named Eric Hines.
[29:30.880 --> 29:32.800]  And Eric always wanted to meet me.
[29:33.400 --> 29:34.860]  And he's a hacker himself.
[29:34.860 --> 29:36.740]  And he just wanted to see what I'm up to these days.
[29:37.840 --> 29:39.080]  And my brother warned me.
[29:39.180 --> 29:41.600]  He goes, I'd be careful because this girl that...
[29:42.120 --> 29:43.240]  I know isn't...
[29:43.240 --> 29:44.600]  You know, isn't that honorable?
[29:44.860 --> 29:46.600]  I go, well, what can it hurt to talk to this guy?
[29:48.420 --> 29:49.580]  So, I called this other guy.
[29:49.760 --> 29:51.920]  I was given the phone number to this guy named Henry Spiegel.
[29:52.980 --> 29:54.060]  Who was in Hollywood.
[29:54.680 --> 29:56.820]  And every time I wanted to get hold of Eric, I'd have to call Henry.
[29:57.600 --> 29:59.840]  To eventually that Eric gave me his pager number.
[30:00.940 --> 30:03.040]  And Eric was always asking, like, probing questions.
[30:03.180 --> 30:04.460]  Like, what are you up to these days?
[30:05.560 --> 30:07.160]  Who do you associate with?
[30:07.520 --> 30:09.420]  And I go, well, I'm not doing anything illegal.
[30:09.420 --> 30:13.240]  I'm just curious what you have to tell me.
[30:14.300 --> 30:18.140]  We decided to meet for dinner one night at a hamburger hamlet in LA.
[30:19.340 --> 30:25.160]  And he tells us about this system that Kevin Poulsen and him found called SAS.
[30:25.640 --> 30:31.500]  And with this system, you could secretly monitor anybody within PacBell service area.
[30:31.760 --> 30:33.400]  And you could even seize their dial tone.
[30:33.700 --> 30:37.020]  I mean, it was like this system that had hardly no security.
[30:37.240 --> 30:39.260]  And the power was, you know, pretty compelling.
[30:39.300 --> 30:41.860]  Especially when you could monitor data at 1200 baud.
[30:43.220 --> 30:44.940]  So I go, wow, that's kind of interesting.
[30:45.080 --> 30:46.180]  Kind of piqued my interest.
[30:46.740 --> 30:51.480]  Even though I was on supervised release and I was kind of out of the scene for about a year and a half.
[30:53.500 --> 30:57.200]  So I decided, I was kind of suspicious about this guy, Eric.
[30:57.560 --> 30:59.480]  And I wanted to find out who he really was.
[31:01.460 --> 31:05.760]  So at the time, the PUC didn't tariff caller ID in California.
[31:06.040 --> 31:06.660]  You couldn't get it.
[31:07.580 --> 31:09.440]  The service was there, just couldn't get it.
[31:10.020 --> 31:13.260]  So since PacBell didn't implement it, I decided I would.
[31:14.080 --> 31:17.400]  So I got into the switch and I put caller ID on a friend's number in LA.
[31:18.000 --> 31:19.120]  And he had a device.
[31:19.120 --> 31:24.580]  And at 3:30 in the morning, I paged Eric to my friend's number.
[31:24.840 --> 31:25.740]  Like a wrong number.
[31:26.500 --> 31:27.520]  Eric called it.
[31:27.960 --> 31:29.420]  And it displayed his number.
[31:30.080 --> 31:31.360]  And I got it.
[31:31.920 --> 31:33.600]  Then I turned the caller ID off.
[31:34.960 --> 31:40.820]  So when I looked at that number through my phone-phreaking knowledge, I was able to determine what address that phone number worked at.
[31:40.940 --> 31:42.660]  And it was the Oakwood Apartments in Los Angeles.
[31:44.560 --> 31:46.100]  So I call up the Oakwood management.
[31:46.320 --> 31:49.020]  And I go, hey, this is Jerry over in Oakwood, Seattle.
[31:49.400 --> 31:54.880]  I have a customer who says that he's already renting with you in Los Angeles.
[31:54.880 --> 31:56.480]  And he's putting in an application over here.
[31:56.940 --> 31:58.220]  And our system's down.
[31:58.320 --> 31:59.300]  Can you pull his rental application?
[32:00.120 --> 32:03.300]  So the nice lady on the other end of the phone pulls his rental application.
[32:03.660 --> 32:05.720]  And proceeds to read me everything on the rental app.
[32:07.000 --> 32:10.840]  And when she got down to employment, there was only one phone number there.
[32:10.980 --> 32:13.060]  But it was listed as self-employment.
[32:13.640 --> 32:14.680]  I still remember the number.
[32:14.960 --> 32:17.020]  213-507-7782.
[32:18.980 --> 32:20.020]  And I go, that's interesting.
[32:20.020 --> 32:20.840]  I don't know that number.
[32:20.880 --> 32:22.920]  So I decide I'm going to pull the phone records.
[32:23.160 --> 32:23.860]  The cell phone.
[32:23.980 --> 32:24.660]  It was a cell phone.
[32:24.940 --> 32:28.500]  I was going to pull the records and see, you know, what interesting numbers I could find.
[32:28.540 --> 32:29.180]  Who is this guy?
[32:30.340 --> 32:35.200]  The other interesting thing is that number that I ID'd wasn't listed in the name of Eric Hines.
[32:35.380 --> 32:37.100]  But it was in the name of Joseph Wernell.
[32:37.860 --> 32:39.040]  And I thought that was odd.
[32:39.200 --> 32:40.620]  When one person lived in that apartment.
[32:41.760 --> 32:43.080]  So I pull the phone records.
[32:43.520 --> 32:45.920]  And immediately, I find out something's wrong.
[32:46.000 --> 32:48.180]  I see this number on there over and over and over again.
[32:48.580 --> 32:51.380]  310-477-6565.
[32:52.340 --> 32:56.560]  That number happens to be the telephone number for the Los Angeles headquarters of the FBI.
[32:57.340 --> 32:59.560]  Once I saw that, I knew something was very wrong.
[33:01.880 --> 33:04.700]  So then, I start digging a little deeper.
[33:05.220 --> 33:08.960]  And I decide I was going to pull the Social Security records.
[33:08.960 --> 33:11.680]  So I can find out where this Eric Hines had worked before.
[33:12.320 --> 33:13.420]  It's called a deckway.
[33:13.560 --> 33:15.700]  And you can find out where somebody's worked since 1978.
[33:16.820 --> 33:18.680]  So I find out the mother's maiden name.
[33:18.800 --> 33:19.540]  The father's name.
[33:20.120 --> 33:22.980]  The birthplace was Pennsylvania for this guy, Joseph Wernell.
[33:23.600 --> 33:26.900]  And then I proceeded to find out, try to track down the parents.
[33:28.800 --> 33:31.820]  And the mother's name was Mary Eberly.
[33:32.080 --> 33:36.660]  And the father's name, I think, was Joseph Wernell Sr. So I go on to some databases.
[33:36.660 --> 33:39.440]  And I find out another Joseph Wernell in the same city.
[33:40.580 --> 33:43.980]  That the social security record indicated was the father and the mother.
[33:43.980 --> 33:47.340]  And I call up and I said, yeah, may I speak to Mr. Wernell, please?
[33:47.640 --> 33:48.320]  Well, who's calling?
[33:48.740 --> 33:49.840]  Social Security Administration.
[33:50.240 --> 33:51.100]  Well, how can I help you?
[33:51.340 --> 33:55.300]  I think we got a record skewed on this benefit application.
[33:55.360 --> 33:56.740]  And I'm just trying to straighten it out.
[33:57.480 --> 33:59.180]  May I speak to Mary Eberly, please?
[33:59.580 --> 34:00.620]  Oh, well, she's my sister.
[34:00.920 --> 34:01.900]  Oh, she's not your wife?
[34:02.320 --> 34:03.240]  No, she's my sister.
[34:03.900 --> 34:04.560]  I go, oh, okay.
[34:05.240 --> 34:08.040]  Well, here's another person on here listed as Joseph Wernell.
[34:08.120 --> 34:08.480]  Who's that?
[34:09.180 --> 34:10.180]  He goes, well, that's me.
[34:10.340 --> 34:11.980]  I go, is there another Joseph Wernell that's younger?
[34:12.840 --> 34:13.680]  He goes, no.
[34:14.080 --> 34:16.040]  I go, does Mary Eberly have a son?
[34:16.940 --> 34:17.720]  He goes, oh, yeah.
[34:17.820 --> 34:19.340]  Her son's name is Joe Ways.
[34:19.460 --> 34:20.920]  But he's an FBI agent in LA.
[34:22.600 --> 34:24.240]  Oh, Joe Ways.
[34:24.480 --> 34:27.960]  So, Joseph Wernell is a cover identity for Joe Ways.
[34:28.320 --> 34:30.320]  So, then I knew something was very wrong.
[34:31.220 --> 34:41.160]  So, in my, I guess, my obsessive little behavior finding out the answer to this problematic question of who Eric Hines was, I decided I'm going to get DMV photographs.
[34:43.060 --> 34:48.660]  So, I call up Department of Motor Vehicles in Sacramento, and I give them the proper requester codes.
[34:49.300 --> 34:57.000]  And I have them fax over the driver's license photographs for Joseph Ways, Joseph Wernell, and Eric Hines.
[34:58.540 --> 35:00.600]  And I had them go to a Kinko's in Santa Monica.
[35:01.600 --> 35:06.320]  So, they went ahead and faxed it, and it came out really grainy, and the fax was terrible.
[35:06.860 --> 35:08.640]  And I couldn't see the pictures, clearly.
[35:09.180 --> 35:13.000]  So, I figured, I'll try in another week, and with another fax machine probably would be better.
[35:13.980 --> 35:17.400]  So, I decided, a week passes, and I figured, I want to get those photographs again.
[35:19.300 --> 35:22.940]  So, I decided to go to a different Kinko's in Studio City, California.
[35:25.260 --> 35:31.780]  So, Christmas Eve, 1992, I show up at that Kinko's, and I go in, and it's super busy.
[35:33.220 --> 35:35.920]  And I'm really anxious just to get the photograph and get out of there.
[35:36.820 --> 35:40.380]  So, I'm by the counter, and nobody's there.
[35:40.940 --> 35:42.620]  So, I figured, okay, I'll just grab the fax.
[35:42.660 --> 35:43.960]  I'll leave a couple bucks, and I'll be out of there.
[35:43.960 --> 35:44.320]  It's done.
[35:44.420 --> 35:44.900]  I don't want to wait.
[35:45.500 --> 35:46.740]  I go behind the counter.
[35:47.600 --> 35:52.440]  I go to the file and pull out the fax for the name that I used to request it from the DMV.
[35:52.680 --> 35:56.860]  And it was a picture of this old woman, like a textbook.
[35:57.120 --> 35:59.960]  And I'm pissed, because I have somewhere to get going.
[36:00.040 --> 36:06.040]  I have to get to somewhere at a certain time, and now I have to call back these incompetent people at DMV, because they screwed up.
[36:06.520 --> 36:14.740]  So, I'm looking for a phone in the Studio City Kinko's, and I'm walking back and forth, because there's no phone there for customer use, and I'm trying to contemplate what I should do.
[36:15.280 --> 36:22.820]  Little did I know, I had DMV investigators and FBI that were also in that Kinko's that were following me back and forth, right?
[36:23.720 --> 36:33.580]  So, I go out to the payphone outside, when I got my thoughts together, I figured I'd call these people up and give them my two cents, because they can't even fax over a photograph correctly.
[36:34.780 --> 36:40.740]  So, I get on the payphone, I'm right outside the Kinko's, and I don't put a diamond, of course, I use a calling card, right?
[36:43.500 --> 36:57.440]  Not on my calling card, but I call up DMV, and all of a sudden, all these people in suits come out, and they're looking at me, and I'm holding the fax.
[36:58.440 --> 36:59.820]  And I go, yeah, can I help you?
[37:00.860 --> 37:04.340]  And they go, yeah, we're with the DMV, we want to have a conversation with you.
[37:04.800 --> 37:07.480]  And I hang up the phone, and I go, really?
[37:07.900 --> 37:08.680]  I go, well, guess what?
[37:08.760 --> 37:10.000]  I don't want to have a conversation with you.
[37:10.040 --> 37:11.980]  And I threw the fax up, and I ran.
[37:14.400 --> 37:15.880]  And, you know, Stairmaster does wonders.
[37:15.960 --> 37:18.480]  I should do a commercial for Stairmaster, because I used to do it every day.
[37:18.480 --> 37:20.880]  And I beat them in the foot race.
[37:30.800 --> 37:31.320]  Yeah.
[37:32.120 --> 37:36.340]  So I figured that's a good time to go underground.
[37:36.760 --> 37:40.340]  I figured that something serious was going to happen with the...
[37:40.340 --> 37:45.040]  Now I knew that Eric Hines was definitely either an FBI agent or an informant.
[37:45.040 --> 37:48.300]  And I knew that... I knew I was a target.
[37:48.940 --> 37:53.120]  And at the time, I was really scared of being put into solitary confinement again.
[37:53.260 --> 38:01.660]  Because if you're ever locked up in a room that's like, say, 10 by 6 for 23 hours a day for eight and a half straight months, you'd probably feel the same way.
[38:02.500 --> 38:05.260]  So I decided to change my name.
[38:05.620 --> 38:06.840]  And I moved to Denver.
[38:07.460 --> 38:09.160]  And I became Eric Weiss.
[38:12.160 --> 38:13.980]  And I worked at a law firm.
[38:14.620 --> 38:15.260]  And, you know, it's funny.
[38:15.340 --> 38:16.700]  Does anyone know who Eric Weiss is?
[38:17.500 --> 38:18.200]  Harry Houdini.
[38:18.240 --> 38:19.100]  Harry Houdini.
[38:19.760 --> 38:21.720]  I thought it was funny the FBI didn't.
[38:24.480 --> 38:25.760]  There's the theme of magic.
[38:25.800 --> 38:26.800]  It was an illusion, right?
[38:27.960 --> 38:29.720]  So I'm in Denver.
[38:30.320 --> 38:32.600]  And I decided, hey, I'm on the run.
[38:32.800 --> 38:33.640]  My hobby's hacking.
[38:33.940 --> 38:34.760]  So what the hell?
[38:34.840 --> 38:35.560]  I have nothing to lose.
[38:35.600 --> 38:38.760]  I'm just going to work by day, legitimately, earn a living.
[38:38.780 --> 38:40.820]  And by night, I continue my hacking hobby.
[38:42.360 --> 38:44.740]  So I'll just tell you the story of one of those.
[38:45.660 --> 38:46.380]  It's Motorola.
[38:47.020 --> 38:49.760]  I had a friend that worked in the law firm.
[38:50.160 --> 38:53.620]  And he had the brochure for the new MicroTac Ultralight.
[38:54.020 --> 38:56.240]  And I thought, hey, this is a really cool cell phone.
[38:56.640 --> 38:57.900]  I'd like to know how it works.
[38:57.900 --> 39:03.720]  You know, because the hacker mine, it wasn't about, I wanted to start up a competing company and call it Cabarola.
[39:04.020 --> 39:06.200]  I wanted to learn how this system worked.
[39:06.720 --> 39:09.500]  So what a better way than to get access to the firmware.
[39:10.760 --> 39:12.780]  So it was snowing in Denver that day.
[39:12.780 --> 39:15.180]  And I left the office around 3 p.m.
[39:15.220 --> 39:17.540]  and I lived on 16th Street in Denver.
[39:18.040 --> 39:20.000]  It's about a 17-minute walk from home.
[39:20.600 --> 39:25.460]  So I pick up my cell phone, which was a Novotel.
[39:25.460 --> 39:28.680]  And I call the 800 number from Motorola Corporation.
[39:29.680 --> 39:30.560]  The lady answers.
[39:30.860 --> 39:33.700]  I go, hey, this is Rick with engineering at Arlington Heights.
[39:34.020 --> 39:36.920]  Do you know how I can get hold of the Pacific subscriber group?
[39:37.600 --> 39:39.900]  The people that handle the cellular phone R&D?
[39:40.600 --> 39:43.660]  She goes, no, sir, but all our cellular phone stops handle out of Schaumburg, Illinois.
[39:44.440 --> 39:45.380]  I go, great, do you have that number?
[39:45.800 --> 39:46.400]  I go, certainly, sir.
[39:46.400 --> 39:48.020]  It's 708 blah, blah, blah, blah, blah, blah.
[39:49.440 --> 39:50.340]  Call that number.
[39:50.880 --> 39:52.640]  I go, hi, this is Rick over in Arlington Heights.
[39:52.800 --> 39:57.200]  I'm trying to find who's project manager of the Pan American Cellular Subscriber Group.
[39:57.880 --> 39:59.000]  She goes, well, hold on, sir.
[39:59.160 --> 40:00.920]  And I'm transferred around, transferred around.
[40:02.860 --> 40:06.620]  Finally, I get transferred to the vice president of R&D for cellular.
[40:07.740 --> 40:08.860]  I go, hey, how you doing?
[40:08.940 --> 40:09.720]  He goes, great, who's this?
[40:09.920 --> 40:11.420]  I go, this is Rick over in Arlington Heights.
[40:11.840 --> 40:14.400]  I go, do you know who works on the MicroTac Ultralight project?
[40:14.760 --> 40:16.420]  Well, that's Pam, she works for me.
[40:16.740 --> 40:18.040]  He goes, well, can I help you?
[40:18.080 --> 40:19.960]  I go, well, no, is there any way, can I talk to Pam?
[40:20.320 --> 40:22.620]  He goes, sure, her number is extension 2345.
[40:23.180 --> 40:24.700]  I go, great, thanks, have a great day.
[40:24.920 --> 40:25.540]  He goes, thank you.
[40:25.920 --> 40:26.300]  Call ends.
[40:27.340 --> 40:29.560]  Next call to Pam, that's extension 2345.
[40:30.380 --> 40:31.960]  Instead of getting Pam, I get a voicemail.
[40:32.480 --> 40:33.340]  Hi, this is Pam.
[40:33.580 --> 40:34.740]  I just left on vacation.
[40:34.940 --> 40:36.800]  I'll be back on July 29th.
[40:36.940 --> 40:40.100]  If you need any help, please call Alicia at extension blah, blah, blah.
[40:41.400 --> 40:42.680]  I go, wow, that's interesting.
[40:42.860 --> 40:43.620]  So I end the call.
[40:43.620 --> 40:45.540]  And I'm walking home in the snow, by the way.
[40:46.060 --> 40:47.180]  I call Alicia.
[40:47.560 --> 40:48.200]  I go, hi, Alicia.
[40:48.660 --> 40:49.420]  She goes, hi, who's this?
[40:49.520 --> 40:50.600]  I go, it's Rick over in Arlington Heights.
[40:50.600 --> 40:51.080]  How are you doing?
[40:51.400 --> 40:51.960]  She goes, great.
[40:52.100 --> 40:53.700]  I go, did Pam leave on vacation yet?
[40:54.140 --> 40:57.600]  Because I was supposed to talk to her and I don't, and she said she might be going and I wasn't sure.
[40:57.740 --> 40:58.820]  She goes, oh, yeah, she left.
[40:59.620 --> 41:00.380]  I go, wow.
[41:00.940 --> 41:06.680]  She was supposed to take care of something for me, but she said if she didn't have time to do it, that you would help me out, that you're the person to contact.
[41:07.760 --> 41:09.100]  She goes, yeah, how can I help you?
[41:09.100 --> 41:14.800]  I go, well, do you know where the latest revision of the firmware for the MicroTAC Ultralight, do you know where that is on the server?
[41:15.220 --> 41:16.360]  She goes, well, I work in development.
[41:16.540 --> 41:19.220]  I said, well, she doesn't know, I don't know where it is, but I'll find it for you.
[41:20.040 --> 41:30.220]  She goes, she was looking around on the different systems and found a script in Pam's account that actually extracted the latest source code release and put it into a directory on her local machine.
[41:31.060 --> 41:33.620]  She goes, oh, okay, what do you want me to do next?
[41:33.740 --> 41:36.080]  And I go, well, do you know how to use, like, tar in gzip?
[41:37.160 --> 41:37.980]  She goes, what's that?
[41:39.120 --> 41:40.180]  I go, well, let me show you.
[41:40.720 --> 41:46.400]  So I walk her through the steps of taking the whole source code tree and making one nice little file that's tarred in gzipped.
[41:47.660 --> 41:51.760]  I go, great, well, you know how to help me a lot, Pam, if you can transfer that file to me?
[41:52.640 --> 41:54.120]  She goes, sure, how do I do it?
[41:54.180 --> 41:55.900]  I go, do you know of a program called FTP?
[41:58.340 --> 42:00.100]  She goes, yeah, that's a file transfer program.
[42:00.100 --> 42:00.960]  I said, precisely.
[42:01.740 --> 42:05.760]  And I'm thinking as I'm walking, I never expected this to work.
[42:06.000 --> 42:07.260]  This was all extemporaneous.
[42:07.580 --> 42:12.720]  So I'm thinking, where can I have a transfer to that doesn't go back to Eric Weiss or Kevin Mitnick or anything?
[42:12.980 --> 42:17.020]  So I remembered I knew an account at Colorado SuperNet, which was an ISP in Denver.
[42:17.400 --> 42:21.340]  And I remembered the account name and password.
[42:21.340 --> 42:23.960]  I also remembered the IP address, thank God.
[42:24.100 --> 42:31.400]  Because I was thinking, giving this lady to FTP the source code to, you know, supernet.colorado.edu would have been, you know, a big red flag.
[42:32.100 --> 42:36.220]  So instead, I say, okay, I'm going to have you open up an FTP session.
[42:36.360 --> 42:37.220]  And she types FTP.
[42:37.340 --> 42:38.020]  I go, okay, open.
[42:38.120 --> 42:39.280]  I give her the IP address.
[42:40.240 --> 42:42.100]  And it just sits there dead as a doornail.
[42:43.000 --> 42:44.120]  She goes, it's not working.
[42:44.380 --> 42:47.920]  She goes, maybe this could be a security related issue.
[42:48.520 --> 42:49.140]  I go, really?
[42:49.240 --> 42:50.260]  And she goes, yeah, let me put you on hold.
[42:50.300 --> 42:51.480]  I'm going to talk to my security administrator.
[42:51.480 --> 42:52.580]  I go, no, no, no, no.
[42:52.700 --> 42:53.440]  And she puts me on hold.
[42:54.720 --> 42:56.720]  And I'm ready to hit the end button on the phone.
[42:57.340 --> 42:57.660]  Right?
[42:59.140 --> 43:00.940]  And she comes back five minutes later.
[43:01.800 --> 43:05.360]  She said she couldn't get hold of the security administrator, but she spoke to the system administrator.
[43:05.360 --> 43:06.780]  And it is a security issue.
[43:07.480 --> 43:12.560]  And since the file is being transferred outside of Motorola's campus, you have to use a special proxy server.
[43:12.880 --> 43:15.980]  But he was kind enough to give me the username, password to the proxy server.
[43:18.600 --> 43:19.800]  And I'm looking at my phone.
[43:19.960 --> 43:21.740]  I go, can this be real?
[43:23.800 --> 43:33.000]  So, by the time I put my key into the front door, I had Motorola's source code for that firmware sitting on an anonymous account at Colorado SuperNet.
[43:33.520 --> 43:33.920]  Right?
[43:35.340 --> 43:38.460]  Yeah, Motorola definitely wasn't happy about that one.
[43:39.440 --> 43:40.920]  So, later on, I moved to Seattle.
[43:41.000 --> 43:45.280]  And I'm just going to give you some highlights because I want to get through this in an hour and a half.
[43:46.240 --> 43:49.080]  And one day, I am walking down the street.
[43:49.280 --> 43:52.420]  This is on Brooklyn Avenue in Seattle, in the U District.
[43:52.740 --> 43:56.100]  And I pull out my cell phone, which, by the way, was a cloned cell phone.
[43:56.160 --> 43:58.760]  I changed the ESN phone number every day.
[43:59.200 --> 44:01.960]  And walking down the street, I see this, like, military helicopter.
[44:02.280 --> 44:05.100]  And it looks like it's going to land in the school campus over here.
[44:05.160 --> 44:05.900]  And the school was closed.
[44:06.340 --> 44:07.080]  So, I sit there.
[44:07.180 --> 44:07.740]  I pull it out.
[44:08.240 --> 44:08.900]  I'm walking down.
[44:08.960 --> 44:10.340]  I initiate a phone call.
[44:10.460 --> 44:13.320]  And all of a sudden, this helicopter stops and starts coming down.
[44:14.460 --> 44:15.740]  And I go, no!
[44:16.140 --> 44:16.420]  Right?
[44:16.720 --> 44:17.560]  So, I ran.
[44:17.940 --> 44:19.060]  Turned off the cell phone.
[44:19.400 --> 44:20.900]  I went a couple blocks away.
[44:21.400 --> 44:22.840]  And I go, this can't be real, right?
[44:23.060 --> 44:24.440]  I turn on the cell phone.
[44:24.440 --> 44:25.700]  And all of a sudden, hear...
[44:25.700 --> 44:27.560]  doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo!
[44:29.000 --> 44:30.100]  I go, no!
[44:30.680 --> 44:31.740]  This can't be real.
[44:32.960 --> 44:34.200]  Turn off the cell phone again.
[44:34.520 --> 44:35.920]  And I go, three blocks.
[44:36.540 --> 44:37.540]  In some other direction.
[44:37.680 --> 44:38.320]  I turn it on.
[44:39.340 --> 44:40.860]  Doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo-doo.
[44:41.600 --> 44:42.620]  Something's wrong here.
[44:44.100 --> 44:47.200]  A couple weeks later, I'm at Kinko's, working on my resume.
[44:47.540 --> 44:53.760]  Because I quit this job at this... I worked at this hospital as a help desk administrator, and the job was, you know, boring.
[44:53.880 --> 45:03.840]  I got tired of people calling up saying they, you know, they stuck their floppy disk between, you know, the two openings on the computer system and didn't get in the floppy drive right, and I'd have to go take it out.
[45:05.140 --> 45:10.620]  So, I quit that job, and I was at Kinko's, working on my resume, and I was sitting there listening to the secret service frequencies.
[45:11.480 --> 45:20.180]  And I'm listening to the surveillance, they're waiting for this guy at this, somewhere in Seattle, and they're sitting there, and I'm listening, and this lady next to me goes, she goes, what are you listening to?
[45:20.620 --> 45:21.860]  I go, oh, that's the U.S.
[45:21.980 --> 45:22.500]  Secret Service.
[45:22.660 --> 45:23.640]  They're about to bust somebody tonight.
[45:23.820 --> 45:24.420]  She goes, really?
[45:24.520 --> 45:24.780]  Oh, yeah.
[45:24.920 --> 45:26.460]  I go, but that guy's going to have a bad day.
[45:26.620 --> 45:27.440]  And we're both laughing.
[45:35.200 --> 45:38.760]  So, then I heard one of the agents go out and said, maybe he's at the computer store.
[45:38.760 --> 45:41.340]  And then right away, I'm listening for that.
[45:42.220 --> 45:44.060]  Then I get interested in the conversation, right?
[45:44.860 --> 45:49.780]  So, a few hours later, I'm done working on my resume to get it printed on the ivory linen and stuff.
[45:49.800 --> 45:53.340]  And then I decide to walk on the opposite side of the street, home.
[45:53.920 --> 45:57.900]  And walking on the opposite side, I see a van sitting in front of the apartment, two people in there.
[45:58.080 --> 46:02.160]  I go around the block, and I notice my lights were off in my apartment.
[46:02.940 --> 46:04.240]  And that was kind of strange.
[46:04.700 --> 46:07.280]  I say, but the manager's light on the second level was on.
[46:07.300 --> 46:08.380]  So, it wasn't a power failure.
[46:09.680 --> 46:12.940]  So, eventually, I got enough guts to go up to the managers, and I knock down his door.
[46:13.060 --> 46:14.340]  This is like after midnight.
[46:15.020 --> 46:16.720]  And I go, hey, this is Brian.
[46:16.920 --> 46:17.980]  I had a new name, Brian Merrill.
[46:18.880 --> 46:20.000]  He's not a magician, by the way.
[46:21.740 --> 46:23.520]  And I go, did you let someone in my apartment?
[46:24.100 --> 46:25.820]  He goes, no, but they let themselves in.
[46:25.920 --> 46:28.040]  Secret Service, FBI, and Seattle Police.
[46:29.020 --> 46:31.860]  And, oh, by the way, they said they want you to call them when you get home.
[46:33.660 --> 46:34.480]  I go, oh, really?
[46:34.640 --> 46:35.680]  I go, do you have the phone number?
[46:35.980 --> 46:37.780]  He goes, no, but they left you a business card.
[46:38.180 --> 46:39.500]  Down, okay, I'll go right to it.
[46:40.100 --> 46:42.260]  Needless to say, I decided not to go to my apartment.
[46:42.660 --> 46:43.560]  And I left Seattle.
[46:44.760 --> 46:44.820]  Yeah.
[46:47.320 --> 46:48.780]  Had abandoned all my stuff, too.
[46:50.000 --> 46:51.120]  So, let's fast-forward.
[46:51.820 --> 46:55.000]  And there's a lot of stuff to tell, but I can't bore you guys with everything.
[46:55.460 --> 46:56.640]  Let's go into 1995.
[46:58.720 --> 47:00.280]  I was in Raleigh, North Carolina.
[47:01.320 --> 47:04.980]  And I remember talking to Emmanuel the night before my bust.
[47:05.120 --> 47:06.340]  I was talking to him.
[47:06.520 --> 47:07.900]  I called him up to say hello.
[47:08.140 --> 47:09.200]  They let him know how he was doing.
[47:09.440 --> 47:15.720]  And unbeknownst to me, Tsutomu Shimomura and John Markoff of the New York Times was eavesdropping on that communication.
[47:17.400 --> 47:22.700]  So around 1:30 in the morning, 1:30 in the morning, I got a knock on the door.
[47:23.400 --> 47:25.220]  And I just got done working out at the gym.
[47:25.760 --> 47:28.060]  And to me, it felt like 9 in the evening.
[47:28.200 --> 47:29.360]  It didn't feel like 1:30 in the morning.
[47:30.900 --> 47:32.760]  And without even thinking, I go, who is it?
[47:34.340 --> 47:34.660]  FBI.
[47:35.720 --> 47:36.320]  Oh, no.
[47:36.720 --> 47:37.580]  I go to the phone.
[47:37.700 --> 47:38.360]  I call my mom.
[47:38.520 --> 47:39.220]  I call my grandmother.
[47:39.240 --> 47:43.200]  I call my lawyer and say, hey, I'm in North Carolina and the FBI is at my door.
[47:43.380 --> 47:44.280]  I think something's wrong.
[47:48.500 --> 47:49.740]  So, I go, who is it?
[47:49.900 --> 47:50.460]  What do you want?
[47:52.300 --> 47:53.420]  Are you Kevin Mitnick?
[47:54.200 --> 47:54.800]  No, man.
[47:55.020 --> 47:56.180]  Do you guys check the mailboxes?
[47:56.300 --> 47:56.900]  I'm Brian.
[47:57.100 --> 47:57.700]  You got the wrong door.
[47:58.640 --> 47:59.280]  I'm asleep.
[47:59.460 --> 48:00.140]  Come back later.
[48:02.200 --> 48:03.740]  Okay, I think I'll wait for about 10 minutes.
[48:03.940 --> 48:04.300]  Come back.
[48:06.740 --> 48:07.460]  Knock again.
[48:08.780 --> 48:09.140]  Yes.
[48:09.920 --> 48:11.360]  Can we talk to you for a moment, sir?
[48:12.400 --> 48:13.340]  What do you want now?
[48:14.400 --> 48:16.000]  Well, we really want to talk to you.
[48:16.080 --> 48:16.720]  It's really important.
[48:18.160 --> 48:19.560]  I figured I'd crack the door.
[48:19.780 --> 48:20.960]  I'd crack the door and...
[48:21.920 --> 48:24.140]  About 12 people end up in my studio apartment.
[48:25.160 --> 48:26.740]  They go, sir, are you Kevin Mitnick?
[48:27.040 --> 48:28.440]  I go, I just told you no.
[48:29.080 --> 48:30.580]  Do you have any identification, sir?
[48:30.660 --> 48:31.280]  Yes, absolutely.
[48:31.440 --> 48:34.620]  And I pull out my new North Carolina driver's license with a new name on it.
[48:35.100 --> 48:36.040]  My picture, of course.
[48:37.660 --> 48:39.940]  And the FBI agent examines it closely.
[48:40.100 --> 48:41.980]  He goes, well, sir, you just got this about two weeks ago.
[48:42.300 --> 48:44.320]  Okay, yeah, it's the law in North Carolina when you move.
[48:44.580 --> 48:45.380]  You have to get...
[48:45.380 --> 48:46.580]  You have to change your residency.
[48:46.580 --> 48:47.360]  You have to get a new license.
[48:47.500 --> 48:48.200]  He goes, well, where are you from?
[48:48.260 --> 48:48.780]  I go, Nevada.
[48:49.820 --> 48:52.040]  So then the agent starts searching around my apartment.
[48:53.000 --> 48:55.340]  And they go, excuse me, are you looking through my stuff?
[48:56.420 --> 48:57.520]  And he goes, yeah.
[48:57.600 --> 48:58.920]  And I go, do you have a warrant?
[48:59.780 --> 49:04.660]  And they hand me this piece of paper that says, USB Kevin Mitnick, no address.
[49:05.380 --> 49:08.600]  I go, first of all, I'm not this Mitnick guy.
[49:09.040 --> 49:11.920]  And second of all, this doesn't look like a search warrant.
[49:12.120 --> 49:13.160]  I mean, it doesn't have an address.
[49:14.460 --> 49:16.200]  He goes, no, it's a search, sir.
[49:16.280 --> 49:17.720]  And I go, no, you're not searching here.
[49:17.760 --> 49:18.940]  And I get my attorney on the phone.
[49:20.140 --> 49:21.100]  And I go, hi, John.
[49:21.240 --> 49:23.860]  This is, I think, Len is the name I was using.
[49:24.220 --> 49:25.720]  And he talks to the agent.
[49:26.220 --> 49:27.840]  And he demands to get a search warrant.
[49:28.860 --> 49:30.460]  So the case agent left.
[49:31.180 --> 49:33.700]  And this one agent decides he's going to go through my briefcase.
[49:34.040 --> 49:39.080]  And I knew that I didn't want him to go through my briefcase because of something I had in there, other identity stuff.
[49:40.020 --> 49:43.640]  So as he's looking through my briefcase, I go up and I slam it shut and I lock it.
[49:45.180 --> 49:47.100]  And he goes, he gets very angry.
[49:47.640 --> 49:50.680]  And he goes, you open this up right now or else I'm breaking into it.
[49:51.260 --> 49:53.980]  I said, I can't stop you from breaking into it, but I'm not opening it.
[49:54.320 --> 49:57.860]  And, of course, they never did because they would need a search warrant to open it.
[49:58.720 --> 50:02.680]  So eventually, about an hour and a half later, they're searching.
[50:02.880 --> 50:05.040]  I'm yelling at them to get the F out of my apartment.
[50:05.500 --> 50:06.720]  And I'm not this Mitnick guy.
[50:07.440 --> 50:11.080]  So they handed me, they got all in a circle and put me in the middle of the circle.
[50:11.540 --> 50:13.560]  And they had this piece of paper they were looking at.
[50:14.600 --> 50:15.900]  And it was a U.S. Marshalls Most Wanted poster with my picture on it.
[50:20.240 --> 50:21.380]  So, but I looked different.
[50:21.540 --> 50:23.380]  I had a mustache, I had very long hair.
[50:23.620 --> 50:26.220]  I could easily fluctuate my weight to change my looks.
[50:26.460 --> 50:27.960]  So I didn't look anything like the picture.
[50:28.620 --> 50:29.600]  So they hand it to me.
[50:29.720 --> 50:30.960]  They go, doesn't this look like you?
[50:31.740 --> 50:33.560]  So, of course, I take it and study it.
[50:33.880 --> 50:35.000]  What do you think I'm going to say, right?
[50:35.440 --> 50:38.480]  I say, no, it doesn't look like me at all.
[50:39.620 --> 50:43.820]  And they go, about after 15 minutes, they're confused.
[50:44.120 --> 50:49.000]  And they go, well, sir, frankly, we don't know if you're Kevin Mitnick, but we want to do something.
[50:49.100 --> 50:54.000]  We want to take you down to our FBI office and fingerprint you.
[50:54.160 --> 50:55.780]  And we'll do a fingerprint comparison.
[50:56.580 --> 50:58.740]  I said, why didn't you guys think of this earlier?
[50:59.080 --> 51:03.860]  Why do you put me through this three hours of this shenanigan when you could have just fingerprinted me?
[51:04.040 --> 51:06.940]  In fact, why don't we schedule an appointment tomorrow morning at 10 a.m.?
[51:11.920 --> 51:13.020]  They weren't having that.
[51:14.860 --> 51:16.880]  They figured they wanted those fingerprints now.
[51:18.700 --> 51:22.920]  So, in the middle of all that, an agent was searching my closet, found a leather jacket.
[51:23.040 --> 51:24.280]  In the leather jacket was a wallet.
[51:24.820 --> 51:26.040]  He pulled out the wallet.
[51:26.300 --> 51:29.060]  And I tried to stop him, but I wasn't going to touch a federal agent, of course.
[51:29.320 --> 51:32.220]  And he pulled out these identities with my picture and different names.
[51:33.100 --> 51:34.200]  He goes, what's this?
[51:35.320 --> 51:37.900]  I go, oh, those are my alternate personalities.
[51:40.160 --> 51:41.420]  Then they arrested me.
[51:41.660 --> 51:42.040]  Then they knew.
[51:44.520 --> 51:45.560]  No sense of humor.
[51:47.800 --> 51:51.560]  So, at that time, I was the proud winner of the scapegoat sweepstakes.
[51:52.720 --> 51:57.840]  And that's where I led through my long journey through the federal criminal system.
[51:59.340 --> 52:02.280]  Immediately, I was labeled a computer terrorist by the DOJ.
[52:03.460 --> 52:05.560]  You know, the Osama bin Mitnick of the Internet.
[52:07.720 --> 52:09.320]  And I held some records.
[52:09.480 --> 52:13.860]  I was first placed into solitary confinement in a county jail in North Carolina.
[52:14.360 --> 52:17.780]  And I was forbidden... I was held incommunicado.
[52:18.180 --> 52:25.960]  And after about a week, my attorneys in Los Angeles negotiated a deal that if I waived... essentially waived all my rights, that they would let me out of the hole.
[52:26.840 --> 52:28.800]  And I'd only be allowed to call certain people.
[52:29.340 --> 52:32.360]  So I figured, do I want to spend... do I want to be in the hole for months more?
[52:32.480 --> 52:35.160]  Or do I want to get in the general population and waive the rights?
[52:35.520 --> 52:36.420]  Well, I waived the rights.
[52:36.420 --> 52:36.920]  I signed.
[52:38.180 --> 52:43.000]  And then, I ended up being held... it's kind of... it's a long story, but I'm only going to cover the highlights.
[52:43.120 --> 52:45.980]  For about four and a half years without a bail hearing.
[52:46.240 --> 52:56.400]  Which is actually unconstitutional because everyone that's arrested and accused of any offense is allowed to get a hearing in front of a neutral and detached decision maker.
[52:56.400 --> 53:08.720]  And this is where both sides have the opportunity to determine... to prove to a neutral decision maker whether there's any condition or a combination of conditions that will reasonably assure that the person will appear at trial.
[53:10.080 --> 53:19.420]  And the judge in my case was so poisoned against me because, you know, I could launch nuclear missiles by whistling into a telephone that she decided it wasn't necessary to have a hearing.
[53:20.140 --> 53:21.640]  And we took it all the way up to the U.S.
[53:21.720 --> 53:22.260]  Supreme Court.
[53:22.260 --> 53:30.280]  And Justice John Paul Stevens thought it was a very interesting issue and he referred it to the full court for a hearing, but I didn't get enough votes.
[53:30.840 --> 53:35.460]  So, unfortunately, the Supreme Court pretty much turned their back on the case.
[53:35.620 --> 53:36.940]  Which happens to a lot of people.
[53:37.800 --> 53:41.480]  So, the first record I set was the longest held in pretrial detention.
[53:42.260 --> 53:44.320]  The longest held without a bail hearing.
[53:44.760 --> 53:47.220]  The first defendant to use a laptop in prison.
[53:48.380 --> 53:55.040]  And the laptop was an interesting issue because, for my attorney to prepare an adequate defense, he needed access to the evidence.
[53:55.220 --> 53:56.880]  Well, what evidence do you have against my client?
[53:57.440 --> 53:59.560]  Well, it's all computer-based evidence.
[54:00.060 --> 54:00.540]  Right?
[54:00.760 --> 54:02.640]  And my attorney wasn't a computer expert.
[54:03.140 --> 54:08.800]  None of the computer experts that he found were knowledgeable enough at the time to really analyze and dissect the evidence.
[54:09.360 --> 54:10.760]  So, he needed my help.
[54:10.880 --> 54:13.700]  And explaining to him what was important and what wasn't.
[54:14.460 --> 54:24.460]  So, he argued for years to allow him, his assistants at the office, and myself to be able to review the evidence together.
[54:24.820 --> 54:30.140]  The government, I remember Christopher Painter, who's now the chief of CSIPs.
[54:30.400 --> 54:45.360]  He argued to the judge, if you give Mitnick a standalone computer in custody, that he can and probably will write a worm or a virus, and somehow it's going to find its way off that standalone laptop and wreak havoc upon the free world.
[54:47.300 --> 54:53.380]  Not only that, we believe that he could engineer an escape with a standalone laptop.
[54:53.860 --> 54:57.680]  And I'm thinking to myself, how can they get away with this?
[54:57.680 --> 54:59.340]  In fact, I'll tell you a funny story that just came to mind.
[54:59.600 --> 55:06.880]  Because I was so, like, I couldn't believe the excuses or the arguments that the judge was buying into.
[55:06.920 --> 55:10.800]  So, I figured, the judge needs to hear somebody with a credible background.
[55:11.060 --> 55:16.600]  Somebody that's well-known in the media that she wouldn't believe would BS her or try to pull the wool over her eyes.
[55:17.220 --> 55:23.520]  So, I have a friend, I find the phone number to Steve Wozniak.
[55:23.860 --> 55:26.460]  And I call information over the phone.
[55:26.460 --> 55:29.620]  And I didn't find a Steve, I found a Gary listed.
[55:30.140 --> 55:33.080]  So, I had my friend on a Sunday morning three-way in the number.
[55:33.160 --> 55:34.220]  I figured, I'll ask him.
[55:34.300 --> 55:37.680]  Maybe he'd be kind enough to come to court and he could set the judge straight.
[55:38.840 --> 55:42.860]  So, I called up and some young guy answered.
[55:43.120 --> 55:44.200]  And I go, hey, is Steve there?
[55:44.660 --> 55:45.720]  And he got on the phone.
[55:46.220 --> 55:47.100]  And I go, hi.
[55:47.220 --> 55:48.380]  And he goes, oh, it's Sunday morning.
[55:48.660 --> 55:49.380]  I'm really busy.
[55:49.420 --> 55:50.360]  I can't talk right now.
[55:50.780 --> 55:53.240]  And then I felt embarrassed that it was bothering him.
[55:53.380 --> 55:54.420]  So, I just said, okay, bye.
[55:54.420 --> 55:56.320]  And I hung up the phone.
[55:56.580 --> 56:01.020]  So, that was my, I guess, first time that I met Steve over the telephone.
[56:01.260 --> 56:07.580]  So, never, I was never able to find somebody that would have been credible in the court's eyes.
[56:08.680 --> 56:11.160]  So, what ended up is I had to waive.
[56:11.260 --> 56:15.580]  I was put in the position of waiving my speedy trial rights over and over again.
[56:15.780 --> 56:22.500]  And how I was put in that position is you have a right to a speedy trial under the Constitution and under statutory law.
[56:23.000 --> 56:24.680]  But a defendant could waive that right.
[56:25.300 --> 56:26.960]  And the defendant has a choice.
[56:27.120 --> 56:31.600]  You either go to trial with ineffective counsel that doesn't have any sense of the evidence.
[56:33.060 --> 56:36.120]  Or, you give your attorney time to prepare an adequate defense.
[56:36.620 --> 56:45.400]  And since my attorney had no access to the discovery, I was put into the position, well, you could stand on your rights, Mr. Mitnick, and go to trial immediately.
[56:45.660 --> 56:47.860]  And your attorney has no sense of the evidence you're going to lose.
[56:47.860 --> 56:50.900]  Or I waive my speedy trial rights over and over again.

[00:00.560 --> 00:05.360]  Some of the counts they had charged me with, that I was merely sent certain information by outside parties.
[00:06.160 --> 00:07.020]  Exploratory evidence.
[00:07.980 --> 00:15.320]  So the government argued to the judge that we believe that Mr. Mitnick might have some national security information that's encrypted.
[00:16.960 --> 00:19.320]  We believe that he should provide the key.
[00:19.940 --> 00:24.660]  And once he gives us the key to that material, we'll give him all the discovery.
[00:25.620 --> 00:28.760]  And my attorney is thinking, and I go, I go to my attorney, no, no, no, no, no.
[00:28.860 --> 00:30.200]  I'm not giving up my PGP key.
[00:30.380 --> 00:30.580]  Sorry.
[00:32.820 --> 00:35.840]  So, at the end of the day, the judge wasn't interested in the issue.
[00:35.960 --> 00:37.080]  It was a novel issue at the time.
[00:37.360 --> 00:45.060]  Can they force someone to give up their right against self-incrimination in exchange to getting access to the evidence for a fair trial?
[00:45.800 --> 00:51.280]  The judge basically said, Mr. Mitnick's very clever in encrypting his materials.
[00:51.280 --> 00:55.340]  Unless he gives the government the key, I'm not going to order the government to turn over the discovery.
[00:57.340 --> 01:12.480]  To make a long story short, after about four and a half years of fighting the case, the government approached my attorney and said, listen, if your client wins at trial, what we're going to do is we're going to put them on the bus.
[01:13.080 --> 01:14.800]  And I go to my lawyer, I go, what's the bus?
[01:15.900 --> 01:20.920]  And he goes, the bus is where they just simply put you on a bus to another federal jurisdiction to face more charges.
[01:21.140 --> 01:22.480]  I go, how can they do that?
[01:22.620 --> 01:23.580]  That's double jeopardy.
[01:23.720 --> 01:24.820]  He goes, no, no, no, no, no.
[01:25.160 --> 01:28.200]  And he explained to me, they didn't charge you with all the possible accounts.
[01:28.200 --> 01:36.040]  If you hack into one system, but you make five phone calls that cross state lines to do it, that's five different counts.
[01:36.640 --> 01:39.960]  And they can indict you either at the terminating point or the origination point.
[01:40.540 --> 01:41.680]  So they can do it.
[01:42.200 --> 01:45.740]  So I was basically given a choice, an offer I couldn't refuse.
[01:47.120 --> 01:50.480]  Accept the government's offer or go through a revolving door of trials.
[01:50.820 --> 01:53.480]  And if you accept the government's offer, you'll be out in 10 months.
[01:54.040 --> 01:57.840]  If you don't accept the government's offer, there'll be no light at the end of the tunnel.
[01:58.900 --> 02:03.960]  So I decided in 1999 to finally accept the government's offer.
[02:04.780 --> 02:07.180]  And a lot of people ask me, what was prison like?
[02:08.540 --> 02:11.080]  Well, to sum it up, it was boring.
[02:11.580 --> 02:12.640]  It was depressing.
[02:13.100 --> 02:17.700]  It wasn't dangerous like you'll see on the movie, like America Me, because I was in federal custody.
[02:20.300 --> 02:26.860]  But it was like a helpless feeling of not knowing what's going to happen with your future for years.
[02:27.080 --> 02:33.420]  I'm not talking about months or days or weeks, but for years, basically serving out a federal prison sentence before you're even convicted.
[02:34.680 --> 02:41.100]  I used to spend most of my time in the law library trying to find cases to assist my lawyer.
[02:41.240 --> 02:43.060]  My lawyer was a publicly appointed attorney.
[02:43.740 --> 02:45.160]  So his time was very limited.
[02:45.540 --> 02:46.720]  I would talk to friends.
[02:46.940 --> 02:47.900]  I'd talk to my family.
[02:48.300 --> 02:49.520]  I'd talk to different lawyers.
[02:49.680 --> 02:50.560]  I'd talk to supporters.
[02:50.980 --> 02:52.680]  Which brings me to the Free Kevin movement.
[02:54.620 --> 03:01.020]  is I have a deep gratitude for everyone who has shown me support over the years.
[03:01.240 --> 03:03.580]  I mean, I used to get letters.
[03:03.840 --> 03:08.180]  I even got to the point where I'd get so much mail that they would have to print it out.
[03:08.540 --> 03:11.440]  Friends would print out the email and send it to me in custody.
[03:11.960 --> 03:17.640]  And then what would happen is the prison wouldn't allow me to receive this mail because they thought it was written in secret code.
[03:19.100 --> 03:22.100]  So I'd try to find out what the secret code is and they would see the MIME headers.
[03:22.820 --> 03:27.580]  Because you're sending a MIME compliant message to a non-compliant, you know, MIME...
[03:29.980 --> 03:30.580]  Excuse me.
[03:33.240 --> 03:34.900]  To a non-compliant system.
[03:35.240 --> 03:37.820]  And they'd see the MIME headers and they'd go, Oh, this is secret code.
[03:37.860 --> 03:38.660]  We can't let them have it.
[03:39.920 --> 03:48.200]  So the Free Kevin movement really helped me, besides my family, helped me get through this very tough time in my life.
[03:48.280 --> 03:49.880]  Not knowing what was going to happen to me.
[03:50.240 --> 04:02.020]  I was, you know, pretty scared because of the rumors and the myths that were created about me in the press.
[04:02.600 --> 04:06.800]  And I decided I'm not going to get really into John Markoff during this talk because I think everybody has heard it.
[04:06.980 --> 04:11.280]  And they can go and read my forbidden chapter on the Internet.
[04:11.900 --> 04:14.080]  But I do want to tell one funny story that happened in prison.
[04:14.180 --> 04:15.660]  It's kind of funny now, but it wasn't funny then.
[04:16.600 --> 04:20.820]  I was at the law library, as I did every time I can get time in the law library.
[04:20.980 --> 04:24.460]  I'd go down and look at cases to assist in my defense.
[04:25.280 --> 04:28.600]  And I was taken back up to the housing unit and they wouldn't let me in.
[04:28.600 --> 04:31.620]  And I see that they're taking everything out of my room.
[04:32.300 --> 04:33.920]  And they're packing everything up.
[04:35.380 --> 04:36.740]  And I go, what's going on?
[04:36.820 --> 04:37.640]  They go, you're going to the hole.
[04:38.560 --> 04:39.520]  They go, what am I going to the hole for?
[04:39.680 --> 04:40.520]  You're a security threat.
[04:42.160 --> 04:44.520]  And in my cell, they found contraband.
[04:45.400 --> 04:49.360]  After they decided to search it for the security threat, they found 74 cans of tuna.
[04:49.660 --> 04:53.800]  You weren't allowed to have these metal cans because you can take it and use it as a shank.
[04:54.220 --> 04:58.740]  But I used to, you know, buy these cans from the sentence inmates.
[04:59.100 --> 05:00.560]  And you're not allowed to have one can.
[05:00.760 --> 05:04.280]  But I concealed all these cans like in Ritz cracker boxes and Pop-Tart boxes.
[05:04.520 --> 05:07.740]  And they were all there in front of them, but so much in front of them that they never saw them.
[05:08.320 --> 05:10.020]  But if they found them, they would just take them.
[05:11.080 --> 05:14.160]  So, at first they said, oh, we caught you with contraband.
[05:14.680 --> 05:18.840]  And then eventually when my attorney got to the bottom of it, this was what happened.
[05:18.840 --> 05:20.680]  He actually talked to the warden's assistant.
[05:21.540 --> 05:38.980]  And the warden's assistant told them, well, the reason we put Mr. Mitnick in solitary, I was in there for another week, was because we had information that we thought he was going to modify his AM-FM Walkman radio to become a transmitter and bug the warden's office.
[05:41.960 --> 05:45.880]  Now, the warden's office was outside the security perimeter of the prison.
[05:46.360 --> 05:51.720]  So, I would actually have to break out, plant the bug, and go back into prison.
[05:53.220 --> 05:59.940]  But what really takes the cake is there was a group out from 2600 Magazine that came out to picket in front of the prison.
[06:00.780 --> 06:01.220]  Right?
[06:01.340 --> 06:02.820]  And we're holding a big Free Kevin banner.
[06:04.660 --> 06:11.860]  And somebody was bold enough to take a Free Kevin bumper sticker and stick it on the glass outside the prison to one of the doors.
[06:13.100 --> 06:18.660]  So, later on that night, these, like, four lieutenants come to the room and they barge in.
[06:19.180 --> 06:20.120]  How did you do it?
[06:25.700 --> 06:26.640]  I'm good, aren't I?
[06:30.280 --> 06:32.000]  These guys watch too much MacGyver.
[06:36.750 --> 06:40.650]  Let's talk a little bit about the federal sentencing guidelines, and I'll be brief here.
[06:41.550 --> 07:02.250]  Is the loss that I allegedly caused a lot of my victims was really exaggerated by the federal government because to really make me an example and give me the longest prison sentence possible, the loss, the amount of damages that are caused, largely reflect what type of sentence a person will get.
[07:04.370 --> 07:15.870]  So, what the FBI did is they solicited the companies that were involved in my case to say that I caused a loss exceeding at least $80 million in each case.
[07:16.570 --> 07:28.830]  And those loss letters were eventually published by 2600 Magazine, and the prosecutors were so upset that they tried to get the judge to hold my attorney in contempt of court for releasing this information.
[07:29.950 --> 07:33.250]  But the... pretty much the beans were spilled and there was nothing they can do.
[07:34.850 --> 07:39.770]  And what they did, what the government's theory is, because don't forget attorneys, all they have is arguments.
[07:40.410 --> 07:47.370]  So they wanted to come up with a theory or an argument to convince a federal court judge that I caused these atrocious losses.
[07:48.330 --> 07:55.970]  And the only way they were able to do it is what I did is I got into a lot of different companies that developed either operating systems or cell phones.
[07:56.450 --> 07:58.350]  And what I would do is I'd look at the source code.
[07:58.830 --> 08:05.250]  Because if you remember in the beginning of my talk, I was interested in becoming the best at circumventing security, and I wanted to look at the source.
[08:06.450 --> 08:12.150]  So what the theory the government used was nobody can buy the source code.
[08:12.270 --> 08:13.930]  It was like the company's crown jewels.
[08:14.310 --> 08:18.670]  Even though Kevin didn't distribute it, sell it, or intend to use it, he still looked at it.
[08:19.070 --> 08:29.030]  And so we believe that companies like Motorola, companies like Novell, companies like SGI, had lost their initial R&D investment in the source code.
[08:29.950 --> 08:30.510]  Right?
[08:30.630 --> 08:31.770]  For me just looking at it.
[08:32.110 --> 08:42.890]  It's like getting a pirated copy of a Steven Spielberg movie before it's released and watching it, oh, and now you're responsible for millions of dollars that it took to make the movie.
[08:44.610 --> 08:54.010]  And what ended up happening is in signing my plea agreement, I just said I caused a loss between 5 and 10 million dollars just to settle the case.
[08:54.310 --> 08:59.270]  The government said in their press releases it exceeded 300 million dollars.
[09:00.170 --> 09:06.910]  At the end of the day, the restitution that I had to pay back was 4,125 dollars.
[09:08.810 --> 09:15.230]  If the loss was 4,125 dollars, I would have served no prison time on the sentencing guidelines.
[09:17.810 --> 09:25.490]  So, another interesting issue of the loss is all the companies that were involved in my case were publicly traded corporations.
[09:26.210 --> 09:40.550]  And under Rule 12G, Security and Exchange Commission, any time a business suffers a material loss, you have to report it to your shareholders so they can make best decisions on whether they want to continue investing in your company.
[09:40.890 --> 09:50.450]  So, my defense team pulled the 10-Ks and 10-Qs, had a research company research their public...
[09:52.070 --> 10:02.990]  not public offerings, but public disclosures thoroughly, and not one of these companies had ever attributed any loss to me in their 10-Ks or 10-Qs.
[10:02.990 --> 10:04.890]  So, that was kind of interesting.
[10:05.150 --> 10:09.250]  So, I always like the old Wendy's slogan, you're like, where's the beef?
[10:10.450 --> 10:15.170]  And the truth of the matter is, I'm sure my activities did cause some of these companies some loss.
[10:15.410 --> 10:16.870]  I don't know what that number was.
[10:17.270 --> 10:22.190]  I don't think it even approaches anywhere near a half a million dollars.
[10:22.530 --> 10:34.850]  But I should have been... my argument is, I should have been punished based on the actual losses that I caused rather than these fictitious numbers that the government tried to bandy about to put me in prison for as long as possible.
[10:35.490 --> 10:36.950]  Because I was the deterrent.
[10:37.270 --> 10:42.470]  I was the guy kind of pinned up on the cross to deter all of you from hacking.
[10:44.590 --> 10:51.990]  So, what... I just want to go over really quick, what are my lessons learned from my experience?
[10:52.830 --> 10:54.990]  One lesson learned is...
[10:57.030 --> 11:06.670]  I know Carrie is here in the audience, she's my webmaster, is you don't ask your webmaster to pull the judge's financial records to find out if she was a shareholder in any of the companies that you were indicted.
[11:08.010 --> 11:13.110]  Because what had happened is one day I show up at court and I had a bright idea.
[11:13.270 --> 11:17.630]  I go, well, this judge really hates me, so let's try to get her off the case.
[11:17.850 --> 11:24.210]  I'm thinking, well, a lot of companies are big name companies that were involved in my case, if she's invested any...
[11:24.210 --> 11:28.110]  if she had any stock or her husband has any stock, I can get her off my case.
[11:28.230 --> 11:29.130]  Brilliant idea, right?
[11:29.810 --> 11:30.170]  Wrong.
[11:31.170 --> 11:37.330]  What happened is the federal judiciary reported it to the judge that somebody from 2600 Magazine requested her financials.
[11:38.050 --> 11:41.230]  So when I showed up in court that day, she was more than livid.
[11:42.190 --> 11:43.770]  And that was a big surprise to me, right?
[11:43.830 --> 11:47.050]  So I'm in court, she goes, Mr. Randolph, who's 2600?
[11:48.170 --> 11:50.750]  And I'm thinking, God, what happened?
[11:51.030 --> 11:54.970]  And she goes, she told the story that somebody had requested her financials.
[11:55.050 --> 11:58.090]  She thinks that I'm behind it.
[11:58.230 --> 12:07.650]  And if anything happens to her credit rating or financial standing in the community, that Mr. Mitnick is somehow involved.
[12:08.810 --> 12:11.010]  Bad thing to piss off your sentencing judge.
[12:11.390 --> 12:12.230]  Not good.
[12:12.550 --> 12:13.190]  Don't do it.
[12:14.450 --> 12:17.250]  Next thing, FBI has no sense of humor.
[12:19.810 --> 12:20.690]  Not at all.
[12:21.010 --> 12:31.470]  In fact, with the Eric Hines thing, remember what I said about the, getting the phone, getting the phone number of that one phone number that belonged to the undercover agent, Joseph Ways?
[12:32.090 --> 12:43.450]  Is what I started doing is I started pulling not only the bills for that telephone number, but every number that called, any cellular phones that were called, I also pulled those bills.
[12:44.170 --> 12:51.770]  And I was able to determine the cell phone number of every agent on the White Collar, the White Collar Crime Squad number 3 in LA.
[12:52.270 --> 12:53.290]  That of the LA Bureau.
[12:53.910 --> 12:56.410]  Actually, like I had pins in a map with their phone numbers.
[12:57.210 --> 13:02.410]  Then I bought this device called a DDI from this guy, Mark, in Milwaukee.
[13:02.570 --> 13:09.310]  And what this DDI device does, you attach it to your computer, and you can monitor the forward control channel of the cell sites in your area.
[13:10.210 --> 13:16.750]  So what I did is I programmed all the FBI agents' phone numbers in this little software configuration menu.
[13:16.750 --> 13:22.770]  So anytime those agents would be in the area, they'd have to, you know, your phone goes in the area, it registers.
[13:23.150 --> 13:24.210]  I see you register.
[13:24.790 --> 13:27.310]  And one day I'm at work and I hear beep, beep, beep, beep, beep, beep, beep, beep, beep.
[13:27.650 --> 13:28.790]  And I go and look at this menu.
[13:29.010 --> 13:30.290]  Oh, Agent McGuire's around.
[13:33.650 --> 13:37.530]  I'll leave him donuts when he comes searches in a couple days because that's the only reason he's here.
[13:39.930 --> 13:40.650]  But, yeah.
[13:41.330 --> 13:45.230]  I'll tell you one funny thing about the search is I was really, really tired.
[13:45.550 --> 13:46.530]  This wasn't done on purpose.
[13:47.250 --> 13:52.530]  And two days later, after the beep, beep, beep, beep, beep, first of all, I got rid of all the contraband that I had.
[13:55.430 --> 13:58.070]  And at 6 in the morning, somebody's trying my door.
[13:58.070 --> 13:59.410]  No knock.
[13:59.650 --> 14:00.350]  Just trying the door.
[14:00.470 --> 14:01.670]  Like a key trying to get in.
[14:02.710 --> 14:06.170]  And immediately, just reactive, I get out of bed.
[14:06.310 --> 14:07.430]  And I sleep nude.
[14:07.830 --> 14:09.030]  For all of you that are interested.
[14:09.810 --> 14:10.210]  And...
[14:12.710 --> 14:14.010]  And I open the door.
[14:14.250 --> 14:16.190]  And there's a female FBI agent standing there.
[14:16.250 --> 14:17.330]  I go, hi, how can I help you?
[14:23.260 --> 14:23.660]  Yep.
[14:25.300 --> 14:28.540]  I wasn't even thinking I wasn't wearing anything because I was so, like, shocked.
[14:28.540 --> 14:30.640]  But then I realized, I go, oh, no.
[14:30.840 --> 14:31.740]  Can I put some clothes on?
[14:35.560 --> 14:43.660]  Hey, my journey through this, through the mirrors, I guess, or through the justice system and my experiences of...
[14:43.660 --> 14:54.960]  You know, I kind of was a hacker for the sheer entertainment value and the quest for knowledge, the pursuit of knowledge, the intellectual challenge, the thrill of being somewhere where I really shouldn't be.
[14:55.260 --> 14:59.000]  Kind of like exploring that abandoned house on the corner when you're not allowed to go there.
[14:59.540 --> 15:00.840]  And that was kind of my mindset.
[15:01.220 --> 15:03.340]  And back in the early days, hacking was a lot...
[15:03.340 --> 15:05.700]  Well, there's a little bit of a dynamic here.
[15:05.820 --> 15:08.980]  Hacking in some respects was easier, but in some respects harder.
[15:10.300 --> 15:12.260]  Back then, there was no tools.
[15:12.640 --> 15:13.760]  You didn't have Nessus.
[15:14.460 --> 15:15.440]  You didn't have Nmap.
[15:15.740 --> 15:20.140]  You didn't have a lot of these tools that you could use to, you know, possibly compromise the system.
[15:20.240 --> 15:21.360]  You did everything by hand.
[15:22.200 --> 15:24.860]  And back in those days, security was really lax.
[15:25.380 --> 15:26.920]  You know, security was really an afterthought.
[15:27.540 --> 15:30.060]  People were really reactive instead of proactive.
[15:30.660 --> 15:40.140]  So what's changed today is you don't even have to know how these exploits or how to analyze a system really works under the hood.
[15:40.340 --> 15:43.420]  You can go download the tools that are prepackaged for you.
[15:43.460 --> 15:45.020]  All you have to do is know how to point and click.
[15:45.680 --> 15:47.860]  And what an IP address is in some cases.
[15:48.220 --> 15:56.520]  But at the same time, it's a little bit harder because businesses, government agencies, and educational institutions are aware of the security threat.
[15:56.760 --> 15:58.180]  So they try to raise the bar.
[15:59.100 --> 15:59.540]  Right?
[16:00.500 --> 16:04.660]  And I want to encourage, you know, all of you out there not to follow in my footsteps.
[16:04.800 --> 16:10.320]  I think I'm extremely lucky to be honored enough to stand here before you all and address you.
[16:11.920 --> 16:14.420]  I kind of, you know, it's kind of unbelievable.
[16:14.420 --> 16:18.900]  Like, you know, at the last hope, I was on supervised release.
[16:19.020 --> 16:21.680]  I couldn't even touch a fax machine without permission.
[16:21.960 --> 16:25.000]  The one before that, I was in federal prison for already three years.
[16:25.180 --> 16:26.860]  And the one before that, I was a fugitive.
[16:27.280 --> 16:27.720]  Right?
[16:28.600 --> 16:31.620]  And the path I took isn't the path to take.
[16:33.100 --> 16:37.580]  So we as hackers might decide we want to compromise the system because it's fun.
[16:38.300 --> 16:43.560]  But unfortunately, the person on the other side of that attack doesn't know your intentions and they freak out.
[16:43.820 --> 16:48.240]  And they spend a lot of money and time trying to figure out who you are, what you did, and how to keep you out.
[16:48.700 --> 16:51.080]  So at the end of the day, you are costing somebody some cash.
[16:51.880 --> 16:52.960]  And that's not a good thing.
[16:53.680 --> 17:06.680]  And today, you can get the same excitement, the same thrill, the pursuit of knowledge, the same thrill of being somewhere where you shouldn't really be in the pursuit of knowledge legally by being a hacker for hire.
[17:07.200 --> 17:11.320]  Now you can take your skills and be a pen-tester, do security assessments.
[17:11.680 --> 17:12.920]  Of course, you have permission.
[17:13.220 --> 17:17.440]  But a lot of times, the person that gives you permission, they won't tell anybody else in the organization that you're testing.
[17:17.740 --> 17:21.020]  So you still get that, like, mission impossible type of attack scenario.
[17:22.660 --> 17:36.740]  So, the motto is, rather than, you know, hack and possibly affect your life in a negative way and end up serving some time, you can hack in a way that's socially productive and where you earn some money at the end of the day.
[17:37.500 --> 17:52.340]  And one thing I do want to say before closing, is how I found myself, I think, in this position, is back when I was in high school, remember I got that A for writing, I got an A for writing that program that stole the teacher's password.
[17:53.400 --> 17:55.400]  Today, if you did the same thing, you'd be expelled.
[17:55.960 --> 17:58.360]  So back in my day, they didn't teach any computer ethics.
[17:59.300 --> 18:01.240]  Ethics, it was, you know, it was okay.
[18:01.400 --> 18:10.920]  You were considered to be the whiz kid or the gifted person or the genius if you can do these types of things, these phone phreaking type of activities and this hacking type of stuff.
[18:11.860 --> 18:14.860]  And you were given the attaboys or the pats on the back.
[18:15.760 --> 18:26.420]  So back in my day, maybe if they had an ethics program or the instructors at school taught some computer ethics, maybe I would have taken a different path.
[18:27.220 --> 18:33.960]  And there's another well-known speaker who speaks on issues of security, mainly check fraud.
[18:34.560 --> 18:46.260]  And his company did a survey of all the different high schools throughout the country and asked the question to high school students, is it okay to break into your fellow students' account?
[18:46.940 --> 18:49.800]  And this was recently done and 48% said yes.
[18:50.200 --> 18:51.060]  It's okay.
[18:51.460 --> 18:55.220]  So if people are of that mindset, well, hell, people are going to continue to hack.
[18:55.500 --> 18:57.760]  So maybe it's a question of ethics.
[18:59.620 --> 19:02.700]  I want to go ahead and leave some time for open Q&A.
[19:02.780 --> 19:05.520]  You're going to have to speak up because I'm a little bit hard of hearing.
[19:06.100 --> 19:10.240]  Because when I was in prison for those four and a half years, I used to listen to my Walkman all the time.
[19:10.340 --> 19:16.540]  And I used to crank up the music to escape the physical place that I was at.
[19:16.540 --> 19:18.220]  And I think I screwed up my hearing a little bit.
[19:19.200 --> 19:22.500]  So I want to thank everybody for being here today.
[19:22.740 --> 19:26.960]  Once again, I want to especially thank Emmanuel Goldstein and everyone from 2600.
[19:27.760 --> 19:29.700]  It's finally great to be at my first hope.
[19:31.360 --> 19:35.280]  And I'm going to ask four trivia questions because I brought presents.
[19:35.380 --> 19:37.600]  I think they're back there if you can get them.
[19:37.680 --> 19:41.200]  I brought four of my books, The Art of Deception.
[19:41.280 --> 19:43.160]  I'm going to ask four Mitnick trivia questions.
[19:43.200 --> 19:44.340]  If you get it right, you get a free book.
[19:44.380 --> 19:44.960]  How about that?
[19:45.660 --> 19:46.320]  All right?
[19:46.720 --> 19:47.480]  Thank you.
[19:52.340 --> 19:53.380]  All right.
[19:54.580 --> 19:56.020]  Let me think of a good question.
[19:56.100 --> 19:57.240]  I don't have these pre-planned.
[19:58.400 --> 19:58.920]  Okay.
[19:59.220 --> 20:01.580]  What was my favorite operating system?
[20:01.800 --> 20:02.160]  Anybody?
[20:02.420 --> 20:02.960]  Raise a hand.
[20:03.800 --> 20:05.300]  Who said VMS?
[20:07.280 --> 20:08.060]  Come down.
[20:08.480 --> 20:09.200]  You got it.
[20:10.040 --> 20:10.480]  Come on down.
[20:15.600 --> 20:16.340]  Where is he?
[20:17.460 --> 20:18.260]  All right.
[20:18.880 --> 20:19.400]  All right.
[20:19.400 --> 20:19.440]  All right.
[20:19.760 --> 20:20.900]  The lights are in my eyes.
[20:20.960 --> 20:21.240]  I'm sorry.
[20:23.020 --> 20:24.800]  So what's another good trivia question?
[20:24.800 --> 20:25.520]  Let me think.
[20:32.280 --> 20:33.560]  What's the first...
[20:33.560 --> 20:36.240]  I said this in my talk, so I'll see how much you guys are paying attention.
[20:36.500 --> 20:37.240]  What's the first...
[20:37.940 --> 20:42.020]  What type of computer terminal did I use when I was in high school?
[20:45.180 --> 20:45.580]  What?
[20:46.940 --> 20:47.800]  Olivetti right there.
[20:48.260 --> 20:48.780]  Come on.
[20:48.940 --> 20:49.600]  You got it.
[20:50.840 --> 20:51.400]  All right.
[20:51.580 --> 20:51.860]  Thank you.
[20:52.820 --> 20:54.000]  What's a good question, Darcy?
[20:56.820 --> 20:58.360]  When's the last time I hacked into your system?
[20:59.540 --> 21:00.220]  That's a bad question.
[21:02.080 --> 21:02.560]  What?
[21:06.130 --> 21:06.870]  Let's see.
[21:07.250 --> 21:09.030]  Should have prepared these ahead of time.
[21:11.550 --> 21:12.030]  When...
[21:12.030 --> 21:12.250]  Yeah.
[21:12.530 --> 21:13.010]  Help yourself.
[21:13.350 --> 21:14.010]  Thank you.
[21:15.530 --> 21:16.010]  When...
[21:16.010 --> 21:19.970]  What is the month, day, and year I was finally able to get back on the Internet?
[21:20.770 --> 21:21.610]  Anyone raise their hand?
[21:22.550 --> 21:22.950]  2003.
[21:23.330 --> 21:23.610]  No.
[21:23.810 --> 21:24.610]  The month, day, and year.
[21:25.130 --> 21:26.190]  The month, day, and year.
[21:26.530 --> 21:26.790]  No.
[21:29.050 --> 21:29.450]  No.
[21:30.510 --> 21:30.790]  No.
[21:31.990 --> 21:32.710]  Anybody else?
[21:33.310 --> 21:35.090]  The day I was able to use the Internet again.
[21:35.150 --> 21:36.670]  January 21st, 2003.
[21:37.110 --> 21:37.310]  Yeah.
[21:37.370 --> 21:37.810]  You got it.
[21:41.030 --> 21:41.610]  Thank you.
[21:41.770 --> 21:42.150]  All right.
[21:44.390 --> 21:46.750]  Now this is for the watchers of the screen savers program.
[21:48.670 --> 21:51.490]  What's the first website I went to when I was finally allowed to use the Internet?
[21:51.490 --> 21:51.770]  Google.
[22:28.910 --> 22:31.770]  And you probably want to come up to the microphone so I can hear you.
[22:32.730 --> 22:35.470]  And I'm here to answer any questions that you may have.
[22:37.590 --> 22:38.690]  Does that microphone work?
[22:39.450 --> 22:39.850]  Okay.
[22:42.250 --> 22:46.310]  Kevin, do you see any technological solution to the social engineering problem?
[22:46.450 --> 22:47.970]  Something we can add on to our phone system?
[22:48.130 --> 22:51.370]  Something we can do using this technology to stop it?
[22:52.130 --> 22:57.230]  Well, the question... oh yeah, the question is, is there any technology that can stop social engineering?
[22:58.350 --> 23:02.330]  The only... I look at it more as like a defense in depth thing.
[23:02.470 --> 23:09.470]  Like for instance, a social engineering attack is to send a target, like for an example, an attachment that contains some malicious code.
[23:09.730 --> 23:21.010]  So if they are running some AV software that catches it after they follow through on the attack, that might stop the attack from succeeding.
[23:21.130 --> 23:22.010]  So you got AV software.
[23:22.010 --> 23:24.210]  The other issue is design.
[23:24.550 --> 23:28.590]  A lot of customer service centers could look up private customer information.
[23:28.790 --> 23:33.770]  And how they verify who you are is by asking a password or a social security number, mother's maiden name.
[23:34.070 --> 23:36.270]  A lot of times the rep could see that right on their screen.
[23:36.890 --> 23:42.870]  It opens and it creates a target rich environment where you can trick the rep into revealing that information.
[23:43.390 --> 23:54.230]  So if they design the system that if a customer called in and the rep asked what your password was and then the rep had to key it in and the system actually did the comparison, that would create a more secure environment.
[23:54.390 --> 23:56.490]  So that's another area where technology could be used.
[23:57.110 --> 23:57.670]  Thank you.
[23:57.830 --> 23:58.230]  You're welcome.
[24:00.330 --> 24:02.750]  Come up to the mic if you want to ask any questions.
[24:04.530 --> 24:05.230]  Hey Kevin.
[24:05.890 --> 24:07.850]  Glad to see that you made it out.
[24:08.510 --> 24:13.550]  I hope this doesn't get you into trouble or anything, but could you whistle that whole nuke thing for us here?
[24:20.730 --> 24:23.030]  I don't think I'm still in tune.
[24:25.390 --> 24:26.450]  But I'll practice.
[24:26.590 --> 24:27.910]  Maybe I'll have the launch CD.
[24:28.290 --> 24:29.110]  There you go.
[24:29.110 --> 24:30.650]  Do the close and cough to sleep.
[24:30.730 --> 24:31.470]  You'll never know the difference.
[24:32.750 --> 24:33.170]  Yeah.
[24:34.190 --> 24:35.230]  We changed the code.
[24:35.330 --> 24:36.210]  I can't whistle it anymore.
[24:36.310 --> 24:36.630]  I'm sorry.
[24:36.830 --> 24:37.610]  Oh, the old one then.
[24:39.830 --> 24:40.830]  Any other questions?
[24:41.850 --> 24:42.670]  Come on down.
[24:44.250 --> 24:48.670]  Was it really you who left those messages on Tsutomu Shimomura's voicemail?
[24:48.810 --> 24:49.250]  Oh, no.
[24:50.110 --> 24:52.910]  In fact, that guy is now, I think, an employee at NetSec.
[24:53.950 --> 24:57.090]  I never met him, but it wasn't me that...
[24:57.090 --> 25:04.870]  There was some voicemail messages that were left on Shimomura's machine, coincidentally, at the same time that JSZ and I attacked his computer system.
[25:05.570 --> 25:17.230]  And it was kind of funny, because once we got into his machine, we were interested in looking at the stuff that he was doing with the Oki 900, him and a guy named Mark Lauder.
[25:17.670 --> 25:24.190]  And Shimomura dumped an image of his firmware, which included the stuff in memory.
[25:24.410 --> 25:28.050]  And we're able to find out the codes that he had for his answering machine.
[25:28.770 --> 25:29.790]  And for his office.
[25:30.170 --> 25:32.570]  The codes were right there, because he saved it in his phone's memory.
[25:33.210 --> 25:35.110]  And so JSZ, we're on a three-way.
[25:35.190 --> 25:36.590]  He's on a pay phone in Beersheva, Israel.
[25:36.690 --> 25:39.070]  I'm in, I think, Denver, Colorado at the time.
[25:39.390 --> 25:41.430]  And I three-way in Shimomura's office machine.
[25:41.990 --> 25:43.870]  And I put in the code to retrieve his messages.
[25:43.890 --> 25:45.090]  And we hear the same messages.
[25:45.490 --> 25:48.490]  And we're thinking, were we somehow logged?
[25:48.610 --> 25:50.050]  Was somebody watching us do this?
[25:50.150 --> 25:51.110]  And did they leave those messages?
[25:51.190 --> 25:53.630]  Because it was like coincidentally within minutes.
[25:54.590 --> 25:56.490]  So, but no, I had nothing to do with it.
[25:56.790 --> 26:01.290]  But the guy that actually did it actually called him and left the messages after I was arrested.
[26:01.550 --> 26:02.530]  And the same voice.
[26:03.250 --> 26:03.730]  You know?
[26:03.950 --> 26:05.590]  So I guess his kung fu is the best.
[26:10.290 --> 26:11.460]  One quick one.
[26:12.040 --> 26:15.800]  Is it true at one point you actually had your own long distance 10X code?
[26:16.560 --> 26:17.000]  No.
[26:17.440 --> 26:21.860]  But I did have my own in PacBell in Southern California.
[26:22.120 --> 26:25.420]  They had special phone numbers, a special prefix for the phone company.
[26:25.520 --> 26:26.680]  They were 811 numbers.
[26:27.100 --> 26:31.020]  So any employee that knew they would dial an 811 prefix would be an internal number.
[26:31.300 --> 26:35.640]  So what I did is I had my own 811 number so I could be any department within the phone company.
[26:35.740 --> 26:35.920]  Okay.
[26:36.060 --> 26:42.260]  Because be aware there was a recording floating around years ago that apparently maybe it was well faked.
[26:42.740 --> 26:45.380]  But apparently it showed somebody dialing a 10X code and a match came up.
[26:45.600 --> 26:50.020]  Instead of saying the name, it came up with your name in the usual bell voice.
[26:50.520 --> 26:51.840]  Oh, thank you for using Kevin Mitnick?
[26:52.000 --> 26:52.740]  Yeah, that thing.
[26:52.860 --> 26:53.000]  Yeah.
[26:53.000 --> 26:56.560]  The real lady that did the AT&T recordings did that recording for a friend of mine.
[26:57.000 --> 26:59.120]  So basically it was always fake in other words.
[26:59.320 --> 26:59.420]  Okay.
[26:59.540 --> 26:59.980]  I'm just curious.
[27:00.280 --> 27:01.140]  No, she really did.
[27:01.200 --> 27:01.920]  It was really her voice.
[27:02.020 --> 27:02.640]  Her name was Pat.
[27:03.020 --> 27:04.200]  Yeah, but I'm saying so.
[27:04.400 --> 27:06.440]  But the fact that you didn't actually have a code set up.
[27:06.560 --> 27:07.540]  It was just a fake thing.
[27:07.560 --> 27:08.200]  No, that was a fake thing.
[27:08.200 --> 27:08.880]  That's what I was curious.
[27:09.020 --> 27:09.240]  Sorry.
[27:09.580 --> 27:09.580]  Myth.
[27:10.380 --> 27:11.100]  Yeah, just a myth.
[27:11.960 --> 27:15.880]  But what we did do is we figured out how we could intercept directory assistance for Rhode Island.
[27:16.420 --> 27:20.380]  So whenever a customer would call in, I got to play telephone operator.
[27:21.800 --> 27:23.300]  Let me guess, tone D.
[27:23.860 --> 27:24.340]  Tone D.
[27:24.880 --> 27:25.160]  Exactly.
[27:25.420 --> 27:29.600]  And after we worked that out, some unsuspecting customer would call and they'd go, what city?
[27:30.040 --> 27:31.160]  Oh, we'd say, what city?
[27:31.380 --> 27:32.360]  And say, Providence?
[27:32.700 --> 27:33.620]  How can I help you, ma'am?
[27:34.180 --> 27:35.040]  They'd ask for a listing.
[27:35.280 --> 27:36.600]  And we'd say, oh, by the way, we're doing a survey.
[27:36.820 --> 27:39.260]  Do you guys have a, do you have a white pages or yellow pages at the home?
[27:40.240 --> 27:40.940]  Oh, yes, we do.
[27:41.020 --> 27:42.220]  Oh, by the way, are you at home now?
[27:42.440 --> 27:42.900]  Oh, yes.
[27:43.140 --> 27:43.840]  Why are you calling me?
[27:46.680 --> 27:50.760]  You know, to the point of, yes, ma'am, that number is 555-215-37.
[27:52.120 --> 27:52.560]  What?
[27:53.380 --> 27:55.220]  555-215-37.
[27:56.420 --> 27:57.980]  I don't, how do you dial a half?
[27:58.160 --> 27:59.160]  Oh, you didn't get the new phone.
[28:02.520 --> 28:04.900]  So, the phone company shut that down in a day.
[28:05.440 --> 28:06.860]  You know, but it was fun.
[28:10.380 --> 28:16.220]  Do you think you've had more effect on the hacker culture as a martyr or as a deterrent?
[28:17.300 --> 28:17.980]  I don't know.
[28:19.500 --> 28:20.340]  That's a good question.
[28:20.480 --> 28:21.480]  Martyr or deterrent?
[28:21.740 --> 28:40.080]  I think, I don't think I was much of a deterrent because if you go to cybercrime.gov and you look at all these hacking cases that were after me, as I think a lot of people have heard of the case, and they're probably extra careful that they don't do things that could,
[28:40.240 --> 28:42.840]  where they could land up in the same place that I was.
[28:43.300 --> 28:45.440]  You know, and hopefully that won't happen today.
[28:45.560 --> 28:54.460]  If somebody does commit some sort of hacking type crime, hopefully they, the government can't pull the wool over the federal judiciary's eyes like they did in my case.
[28:55.000 --> 29:02.160]  So hopefully, I was able to create the sense of awareness to help everybody out there so they don't become the next Kevin Mitnick in that regard.
[29:02.600 --> 29:04.480]  Well, at least we have you for a precedent.
[29:04.820 --> 29:05.120]  What?
[29:05.340 --> 29:06.660]  At least we have you for a precedent.
[29:06.960 --> 29:08.420]  Yeah, that's on the precedent, yeah.
[29:13.920 --> 29:15.200]  Got rude, I like your shirt.
[29:15.440 --> 29:15.940]  Oh, thanks.
[29:16.120 --> 29:17.200]  Hey Kevin, I had a question.
[29:17.460 --> 29:30.460]  Dealing with all this stuff, you know, psychologically and mentally, now that it's over with and you're getting on with your life, what plans and what things are you looking forward to nowadays to make up and rebuild what you've lost?
[29:31.140 --> 29:38.100]  Well, my short-term goals are I'm working on a new book and I do want to mention that to everybody.
[29:38.260 --> 29:43.440]  I'm working on this new book called The Art of Intrusion which is a kind of a sequel to The Art of Deception.
[29:43.760 --> 29:44.840]  And this is going to be different.
[29:45.000 --> 29:47.780]  It's not going to be about social engineering.
[29:47.780 --> 30:03.320]  It's going to be about the innovative, the sexy, the clever, the interest, the most interesting hacks in cyberspace where either the target was particularly interesting or where the attacker used maybe a blended attack.
[30:03.680 --> 30:08.540]  I'm not talking about something that was simply downloading exploit code and running it against a target.
[30:08.660 --> 30:11.420]  I'm something that took some thinking, took some creativity.
[30:11.800 --> 30:15.880]  And I'm still looking for people that would like to come forward and share their stories with me.
[30:15.960 --> 30:20.180]  In fact, the deadline is actually in a week is the last time I'm accepting any stories.
[30:20.300 --> 30:31.760]  So, if any of you would like to meet with me in private while I'm here at the conference, if you guys have any stories that you would like to share, if it makes it into the book, we're paying $200.
[30:32.600 --> 30:35.460]  If it's the best story of all, we're paying $500.
[30:35.860 --> 30:47.460]  And to give you a sense of what the best story is so far, is we got this group of four guys that went to Las Vegas and they got, became very interested in the video poker machines.
[30:47.980 --> 31:00.500]  They bought one, they took it back to New York, they reverse engineered the firmware in the machine, and they were able to develop another program that could find where in the sequence the pseudo random number generator was.
[31:00.740 --> 31:02.440]  And they were able to get a royal flush.
[31:02.540 --> 31:05.860]  They would actually be able to get a royal flush in a certain amount of time.
[31:06.160 --> 31:11.260]  They could set their watches and know in eight minutes and 36 seconds, a royal was going to come up.
[31:11.320 --> 31:14.360]  And they took Vegas for hundreds of thousands of dollars and were never caught.
[31:15.180 --> 31:16.960]  Now, that's a really interesting story.
[31:17.580 --> 31:20.940]  So, it's not, so that, you know, that's a different type of hacking.
[31:21.160 --> 31:23.020]  That's basically finding a flaw in the application.
[31:23.340 --> 31:27.320]  But I'm looking for social engineering, physical, wireless, technical.
[31:27.760 --> 31:28.720]  That's kind of innovative.
[31:28.720 --> 31:45.020]  And if you have a problem sharing your black hat stories, which I think are the most compelling, we all, if you're a pen-tester, and you've used a very innovative and clever and interesting method that you are willing to discuss, I'm also interested in that too.
[31:45.020 --> 31:54.380]  But as far as your question of what I want to do, like in my future, is I want to continue to be a successful author, work in the, work as a consultant in this industry.
[31:55.740 --> 32:01.060]  I kind of put building my company defensive thinking on hold because I'm busy going around.
[32:01.100 --> 32:04.280]  I'm traveling a lot, doing a lot of talks in social engineering.
[32:05.700 --> 32:13.200]  We developed a two-day seminar on how to train companies to be less, to be less resistant to social engineering type of attacks.
[32:13.200 --> 32:23.380]  So the benefit, probably now, the sharing of it and giving that awareness to somebody else is giving you a peace of mind and a benefit from what you've learned so far.
[32:23.580 --> 32:39.540]  Yeah, well basically, I'm taking what I know best, what I have a passion for technology, and trying to use it in a way that helps people and at the same time, gives me that challenge, gives me that thrill, gives me that knowledge that hacking provided for me.
[32:39.680 --> 32:46.740]  Because that's what it provided for me was, again, it was sheer entertainment and this pursuit of knowledge, wanting to know how things worked.
[32:47.600 --> 32:58.060]  And today, unfortunately, the media has changed the term to hacker to mean somebody that's a criminal that uses a computer to steal credit card numbers, for example, which is really unfortunate for us all.
[32:59.180 --> 32:59.700]  Thank you.
[32:59.800 --> 33:00.380]  Hey, thank you.
[33:04.840 --> 33:06.020]  It's good to see you, Kevin.
[33:06.200 --> 33:07.020]  Hey, thank you for coming.
[33:07.020 --> 33:30.400]  After following the story of your life and reading your book and hearing your speech today, it's painfully obvious that people in non-technical positions in corporations have some access to information that is technical and could cause problems with security that they may not even realize the scope of whatever it is,
[33:30.500 --> 33:36.320]  whatever that one little piece of information that they possess, how vital it could be.
[33:37.520 --> 33:57.400]  Now, do you believe that the solution to this sort of a situation would be to hire technical people even for non-technical positions, people who have a hacking background, who understand these things already, even for, say, an accounting position or a human resources position or a secretary,
[33:57.400 --> 33:57.960]  for instance?
[33:57.960 --> 34:10.820]  Or do you feel simply that social engineering training after you hire an employee or other training in these technical skills is sufficient to curtail this problem?
[34:11.080 --> 34:18.760]  Well, first of all, I think the most important thing is to kind of change your corporate culture and get people to internalize that security is important.
[34:18.880 --> 34:30.960]  Because if they don't internalize that behavior, it's basically based on external forces like your boss watching you or management watching you, then as soon as management isn't watching, they basically revert back to what they want to do anyway.
[34:31.320 --> 34:36.400]  So the first major step is getting to internalize that security is an important part of their job.
[34:36.700 --> 34:42.040]  And then secondly, giving them kind of an education of how it works.
[34:42.200 --> 34:46.640]  What are the methodologies, the tactics and strategies that social engineers use?
[34:46.840 --> 34:49.840]  And the most common thing that people are aware of is the Nigerian scam.
[34:50.060 --> 34:51.500]  Because everyone's been the target of it.
[34:51.960 --> 34:59.180]  And once they have kind of the general framework of how social engineering works, then you can put them through some sort of resistance training.
[34:59.500 --> 35:05.960]  It's kind of like inoculation, in a sense, where you try to inoculate them by using certain methods.
[35:06.100 --> 35:10.880]  So they're more aware and more less likely to circumvent security protocol.
[35:11.080 --> 35:17.620]  Because at the end of the day, the attacker wants to convince his or her target to circumvent security protocol.
[35:18.340 --> 35:22.160]  It's really a challenge where you have organizations that don't have a security protocol.
[35:22.300 --> 35:23.240]  They don't have written policy.
[35:23.700 --> 35:25.720]  So if you don't have a policy, you have nowhere to start.
[35:26.160 --> 35:29.560]  And so sometimes it really, they have to build this from the ground up.
[35:29.700 --> 35:35.800]  But putting technical positions, people with like a technical background doing mundane work, I don't think would really work.
[35:35.880 --> 35:37.200]  They'd probably be bored with their position.
[35:37.440 --> 35:38.800]  I don't think it's really necessary.
[35:39.340 --> 35:43.460]  It might be like if they're an accountant, having the technical skills might help them with excel.
[35:43.460 --> 35:47.360]  But I don't think it's really... you have to go to those extremes.
[35:47.640 --> 36:04.220]  I think that once people are introduced to what social engineering is, once they're inoculated, once they understand the methods and tactics that are used, once they could distinguish between what's a legitimate request, and what is a manipulative request,
[36:04.860 --> 36:06.660]  it raises the bar.
[36:06.940 --> 36:09.820]  Because unfortunately, you can't inoculate everybody.
[36:10.300 --> 36:17.180]  There's always going to be somebody that thinks they operate under the illusion of invulnerability, and they can't be tricked.
[36:17.820 --> 36:21.920]  So the first... another first step is demonstrating that everybody's vulnerable.
[36:22.440 --> 36:24.040]  And you do that by burning them.
[36:24.240 --> 36:30.040]  And once they're burned, you know, in a positive way, then they're more likely to learn their lesson.
[36:30.520 --> 36:31.680]  Would that make sense to you?
[36:31.860 --> 36:32.600]  Yes, thank you.
[36:32.720 --> 36:33.160]  Hey, you're welcome.
[36:39.760 --> 36:46.240]  I just wanted to... can you touch upon the part where you were in North Carolina, and they track you by a cell phone?
[36:46.810 --> 36:47.480]  Oh, okay, sure.
[36:47.500 --> 36:56.260]  I mean, can you discuss the difference between back then and today's cell phone with the chip that has the GPS locator?
[36:56.410 --> 36:59.000]  I mean, can you explain how that works or how, like...
[36:59.000 --> 36:59.260]  Yeah, sure.
[36:59.260 --> 37:00.890]  ...how the tracking and...
[37:00.890 --> 37:03.720]  Well, how I was tracked, I was using a...
[37:03.720 --> 37:07.700]  the cell phone protocol that I was using was NAMPS, which is kind of old.
[37:07.890 --> 37:13.600]  That's, yeah, I think they still have it in California, but pretty much it was analog.
[37:14.240 --> 37:15.370]  Cell phone systems.
[37:16.980 --> 37:25.980]  And what had happened is, one of my first things I would do is, when I would move into a different location, I'd immediately compromise the telecommunications infrastructure where I was living.
[37:26.120 --> 37:27.180]  So I'd have complete control.
[37:27.810 --> 37:33.260]  So as soon as I moved to Raleigh, I compromised GTE and had full access to all the switches there.
[37:33.390 --> 37:35.540]  And so, I think it was Southern Bell.
[37:36.460 --> 37:42.870]  And what I did is, I modified the DMS switch, so they couldn't track, do a trace on my calls.
[37:43.180 --> 37:46.180]  It would basically put it into a loop, into nowhere.
[37:46.810 --> 37:51.080]  So it really frustrated the government, because they couldn't get nowhere on tracking me.
[37:51.240 --> 37:54.850]  So, apparently, Shimomura came up with a, a bright idea.
[37:58.150 --> 38:05.760]  Is, based on what we believe Kevin would be calling, what Internet service providers, why don't we do a terminating number search?
[38:06.410 --> 38:10.680]  And then we could locate the, the phone and the ESN that he's currently using.
[38:10.680 --> 38:12.740]  So that's precisely what they did.
[38:12.910 --> 38:14.540]  Is, I would call into, uh, Netcom.
[38:14.890 --> 38:16.930]  And they searched on all the POP numbers.
[38:17.260 --> 38:19.120]  In the local switch in North Carolina.
[38:19.810 --> 38:20.680]  Identified the number.
[38:20.980 --> 38:24.390]  Then they found what cell, cell tower, that I was close to.
[38:24.640 --> 38:25.960]  And went out with the cell scope.
[38:26.180 --> 38:27.450]  And did RDF.
[38:27.600 --> 38:29.720]  And if you know anything about radio.
[38:30.370 --> 38:32.520]  You know, anything that was 800 megahertz range.
[38:32.680 --> 38:35.310]  It's pretty simple to do radio direction finding.
[38:35.520 --> 38:36.960]  And that's how I was identified.
[38:37.530 --> 38:38.410]  In today's world.
[38:39.220 --> 38:41.260]  The cellular systems have evolved in such a way.
[38:41.390 --> 38:42.790]  And now it's easier to track you.
[38:43.410 --> 38:43.830]  Right?
[38:44.140 --> 38:48.500]  Um, and I think AT&T has this friends and family feature.
[38:48.620 --> 38:49.180]  From what I remember.
[38:49.350 --> 38:50.930]  Is if you want to know where you're.
[38:50.960 --> 38:51.700]  That's, that's MCI.
[38:52.000 --> 38:52.220]  What?
[38:52.560 --> 38:53.500]  You're familiar with it?
[38:53.760 --> 38:54.160]  Yeah.
[38:54.330 --> 38:55.180]  So the friends and families.
[38:55.220 --> 38:56.830]  You can find out the GPS location.
[38:57.290 --> 39:00.350]  Of somebody that, uh, has authorized it.
[39:00.830 --> 39:02.040]  But an interesting thing is.
[39:02.080 --> 39:03.140]  I think that could be abused.
[39:03.740 --> 39:06.660]  Because remember when I was tracking the locations of the federal agents.
[39:06.960 --> 39:10.460]  I had access to, uh, AirTouch's network.
[39:10.740 --> 39:12.100]  Of course, illegitimately.
[39:12.370 --> 39:13.580]  And there was a system called NMS.
[39:14.000 --> 39:18.740]  So I could basically, in real time, do an inquiry on a cell number.
[39:19.020 --> 39:23.020]  And it would tell me the last call, incoming, outgoing call.
[39:23.100 --> 39:24.580]  And actually give me the cell.
[39:25.290 --> 39:26.790]  The cell number that it was out of.
[39:26.790 --> 39:27.790]  So I'd look up at a chart.
[39:28.080 --> 39:30.600]  And they'd be able to see the, uh, the physical location of that cell.
[39:30.890 --> 39:32.700]  And within, within real time.
[39:33.080 --> 39:35.240]  So I was able to track anybody on their network.
[39:35.460 --> 39:37.600]  But don't forget, this was, uh, a decade ago.
[39:38.240 --> 39:40.430]  So, if I, that was possible a decade ago.
[39:40.540 --> 39:42.060]  You got to think, well, what's possible today?
[39:42.370 --> 39:45.040]  I think your cell phone is like a, a homing device for you.
[39:45.830 --> 39:46.160]  Exactly.
[39:46.160 --> 39:49.790]  But maybe a better person to talk about wireless tracking technologies is Woz.
[39:50.390 --> 39:53.040]  So, since he's, uh, more familiar with that than I am.
[39:53.260 --> 39:53.810]  All right, thanks.
[39:54.000 --> 39:54.180]  Yeah.
[39:57.270 --> 39:57.970]  Hi, Kevin.
[39:58.130 --> 40:01.350]  I've got a question about your ability to launch nuclear weapons.
[40:02.930 --> 40:04.410]  Actually, it's not totally in jest.
[40:04.770 --> 40:10.870]  You probably seem to have hacked or compromised commercial enterprises, companies.
[40:11.090 --> 40:11.270]  True.
[40:12.730 --> 40:18.450]  Seeing as how we now have the ability to talk via the Internet to just about any country on the planet.
[40:19.010 --> 40:24.550]  Do you think it's absurd at this point to be concerned about the ability of a hacker to launch nuclear weapons?
[40:24.910 --> 40:28.310]  Given the government's ineptitude with most endeavors?
[40:28.850 --> 40:30.110]  Well, I don't know about the U.S.
[40:30.210 --> 40:31.790]  government's controls or countermeasures.
[40:32.210 --> 40:45.230]  But I would have to assume that all the, anything to do with, uh, these type of weapons of mass destruction aren't connected to any type of public network, like the public, uh, the, you know, public switch telephone network or anything.
[40:45.350 --> 40:46.610]  I think they're totally autonomous.
[40:47.070 --> 40:47.890]  That's my belief.
[40:48.070 --> 40:48.710]  But I could be wrong.
[40:48.950 --> 40:49.650]  I don't know.
[40:49.870 --> 40:50.290]  But I think...
[40:50.290 --> 40:50.950]  I worked at the Pentagon.
[40:51.570 --> 40:51.730]  What?
[40:51.910 --> 40:53.450]  I worked at the Pentagon for a year.
[40:54.170 --> 40:58.310]  And the secret network and the non-classified network were bridged frequently.
[40:58.870 --> 40:59.830]  You're talking about SIPRnet?
[41:00.110 --> 41:00.470]  Yes.
[41:00.730 --> 41:00.930]  Oh.
[41:01.250 --> 41:03.630]  Well, I mean, there's always that, that oversight.
[41:03.870 --> 41:18.170]  But just off the top of my head, you would think that it would be a no-brainer to not have a net, any type of systems, SCADA systems or whatever that are connected to any public, public networks that were attached to any of these type of devices.
[41:18.350 --> 41:19.310]  I just think it would be stupid.
[41:20.130 --> 41:22.930]  But then again, people do a lot of stupid things.
[41:23.230 --> 41:23.690]  All right.
[41:23.850 --> 41:24.070]  Thanks.
[41:24.390 --> 41:24.810]  Yeah, you're welcome.
[41:31.450 --> 41:34.710]  Just, uh, a comment on the stupid things with weapons of mass destruction.
[41:34.710 --> 41:44.870]  Throughout the, the Cold War, or the, I mean the Cuban Missile Crisis and a lot of that period, the, the launch code for most of America, most if not all of America's nukes was...
[41:44.870 --> 41:45.310]  Zero through...
[41:45.310 --> 41:46.810]  Zero, zero, zero, zero, zero, zero.
[41:47.630 --> 41:49.210]  And, um, anyway...
[41:49.210 --> 41:49.850]  Well, thanks for that info.
[41:51.450 --> 41:52.830]  The, probably the biggest...
[41:52.830 --> 41:53.950]  I'll have to whistle hex zeros now.
[41:56.110 --> 42:02.550]  Probably the biggest challenge to technical and non-technical hackers is staying entertained and staying out of trouble.
[42:02.790 --> 42:16.890]  What advice do you have for up-and-coming hackers to make an honest living, or at least not too big a dent in their criminal record, and keep themselves occupied, entertained, and out of trouble?
[42:17.450 --> 42:24.390]  Well, nowadays, which wasn't available back when I started, was now computer systems are affordable to anybody.
[42:25.010 --> 42:31.550]  I mean, I couldn't even buy a terminal, a VT100 terminal, if you remember those, those dumb terminals, were over a grand.
[42:31.550 --> 42:34.830]  A Vedic triple-1200 baud modem was, like, $1,500.
[42:35.510 --> 42:36.770]  I couldn't afford it today.
[42:37.350 --> 42:41.590]  People can set up their own networks of running various different platforms.
[42:41.850 --> 42:47.190]  They could set up their own lab and try attacks in their own lab, and they're not affecting anybody else.
[42:47.390 --> 42:57.650]  Of course, the element of exploration, the element of being somewhere where you shouldn't be, is missing from that equation, but at least you're not affecting anybody else, and you're not going to hopefully end up in the can later.
[42:58.330 --> 43:04.510]  Okay, and any career advice that you would give to anyone who's new to hacking, and finds himself talented at it?
[43:04.630 --> 43:08.570]  Yeah, learn a lot about programming, learn a lot about debugging, analyzing code.
[43:09.530 --> 43:21.150]  I mean, I haven't done any coding in years, and I have to get back into it, because, you know, it's an important part of, you know, testing for security failures, is the ability to debug code.
[43:21.270 --> 43:21.610]  All right, thanks.
[43:21.790 --> 43:21.890]  Yeah.
[43:27.180 --> 43:27.580]  Hey.
[43:27.940 --> 43:28.480]  Hey there.
[43:28.480 --> 43:47.180]  As we've seen in your case, in another well-known cases with hackers, there seems to be a problem in the justice system from way over, you know, blown out of proportion treatment in sentences to just maybe an overall ignorance of technology, and I was just wondering if you have any thoughts about that,
[43:47.260 --> 43:49.100]  or see a solution for the justice system.
[43:49.460 --> 43:50.540]  Well, yeah, of course.
[43:50.740 --> 43:56.260]  Well, yeah, I mean, there's been many cases that have been blown out of proportion.
[43:56.260 --> 44:03.380]  Mine, Kevin Poulsen, and I guess the government, I guess the U.S. Attorney's Office, in federal cases, has an agenda.
[44:06.900 --> 44:14.200]  And part of that agenda is, I believe, prosecuting computer-related crimes more vigorously.
[44:16.280 --> 44:19.940]  So, and don't forget, the people that are also the prosecutors have their own agendas.
[44:20.420 --> 44:24.860]  You know, they want to step up the stepping, you know, they want to advance, you know, in their career.
[44:24.860 --> 44:30.600]  And the more people they can put into jail, and the longer they can put them there, the more they advance in their career.
[44:30.780 --> 44:36.220]  And at the same time, you have the true believers that are doing it for truth, justice, and the American way, because they believe it's the right thing to do.
[44:36.480 --> 44:39.780]  So, it's really hard to stereotype, you know, the prosecutors.
[44:39.960 --> 44:45.300]  But what I do have a problem with is things like the PATRIOT Act, things like life imprisonment for hacking.
[44:45.740 --> 44:58.100]  For example, I believe there was an amendment to, I forgot the statute, where you can get life imprisonment without the possibility of parole if you use a computer and you cause serious injury or death to another.
[44:58.920 --> 45:05.620]  So, I had to ask myself the question, well, if you use another tool like a car or a hammer, do you get the same penalty?
[45:05.780 --> 45:14.760]  And the answer was no, at least in California, if you hit somebody with your car and kill them, of course, if it's not intentional, if it's reckless or negligent, you might get three or four years of manslaughter.
[45:15.060 --> 45:21.800]  How come if you used a computer and negligently or recklessly killed somebody or caused them injury, do you get life without the possibility of parole?
[45:22.120 --> 45:28.600]  So, I think there's a big disparity between the types of punishment you can get based on the tool.
[45:28.780 --> 45:30.000]  And I don't think the tool should matter.
[45:30.980 --> 45:32.040]  The tool shouldn't matter.
[45:32.140 --> 45:33.220]  You've got to look at the result.
[45:33.460 --> 45:34.780]  What's the result, not the tool?
[45:35.620 --> 45:38.300]  And it's all about that hocus pocus around computers, right?
[45:38.400 --> 45:39.300]  People are afraid still.
[45:39.520 --> 45:41.180]  Yeah, there's a lot of fear, I guess.
[45:42.160 --> 45:42.940]  Well, thanks.
[45:43.400 --> 45:43.780]  All right.
[45:43.900 --> 45:44.180]  Thank you.
[45:49.330 --> 45:49.910]  Hello.
[45:50.470 --> 45:50.670]  Hey.
[45:51.090 --> 45:51.310]  Okay.
[45:51.650 --> 46:03.510]  Now, my main question actually focuses on something that actually came to mind while I was listening to Bruce Schneier do his speech on security and as far as most of the trade-offs.
[46:03.990 --> 46:04.770]  Or risk, yeah.
[46:05.470 --> 46:19.190]  Now, my main question is, since you've been doing the public speaking, showing other companies that, okay, this is how easy it is to go through and trick people using social engineering.
[46:19.450 --> 46:19.750]  Right.
[46:19.990 --> 46:35.650]  Now, what's to say that you're actually getting through to them instead of, oh, okay, we'll just pay to have you come by, do a speech, just make it look like we care, and then not actually hold anything accountable.
[46:37.830 --> 46:38.350]  Or...
[46:40.090 --> 46:41.650]  Well, you can't do it with one speech.
[46:41.850 --> 46:52.370]  What the speech is, is basically an entertaining, eye-opening experience to really just make people aware of the problem.
[46:52.470 --> 47:00.950]  They're really, the way to hopefully train people in the company environment to resist social engineering is to put them through a security awareness training program.
[47:01.270 --> 47:04.930]  That's a lot more intensive just hearing someone speak for about an hour.
[47:05.350 --> 47:05.370]  Right.
[47:05.570 --> 47:07.410]  And then actually testing them on their knowledge.
[47:07.630 --> 47:21.110]  And even in some situations, because every company's different on their security needs, is actually performing an attack on your own people, kind of like social engineering pen-testing, to see where your weaknesses are.
[47:21.530 --> 47:32.030]  And there's two sides to the message here, because there's been some recommendations that... There's been some recommendations by some of the old timers.
[47:32.190 --> 47:37.850]  Oh, you shouldn't test your own security through social engineering, because that's just going to decrease employee morale.
[47:38.170 --> 47:39.890]  It's going to piss a lot of people off.
[47:40.270 --> 47:46.850]  It's going to, at the end of the day, you know, affect your corporate culture.
[47:47.210 --> 47:48.230]  But I don't agree with that.
[47:48.350 --> 47:54.450]  I think that if companies, they definitely should do the pen-testing on the social engineering side, as well as the technical side.
[47:54.870 --> 48:06.210]  But also, that they should make their people aware that they might be subject to this type of testing, either when they're first hired into the company as part of their new employee orientation, or for existing employees, putting them on notice.
[48:06.250 --> 48:13.390]  Hey, to test our security, you might get a call, a social engineering attack, and we're doing this to increase our security.
[48:13.530 --> 48:17.510]  So we just want to give you a heads up that this is the type of testing we're performing.
[48:17.670 --> 48:21.570]  And if people don't like it, well, they could choose to work there, or they could choose not to.
[48:21.730 --> 48:21.950]  Okay.
[48:22.230 --> 48:22.390]  You know?
[48:23.070 --> 48:23.550]  All right.
[48:23.910 --> 48:24.790]  And I'll shoot this.
[48:24.790 --> 48:26.010]  There's a lot more to the subject.
[48:26.170 --> 48:28.670]  It's just like, yeah, I don't want to take everyone's time up on it.
[48:28.750 --> 48:28.850]  Yeah.
[48:28.970 --> 48:31.670]  And I had a second part, which... Well, what's your second part?
[48:31.770 --> 48:41.370]  Well, the second part was also by the same vein, even if they were to go through the tiger testing, like, say, average Joe Schmo, me, decides to walk into a bank.
[48:41.410 --> 48:49.370]  I notice that there is something wrong with their procedure, or in the case of just waltzing out past the x-ray machine, and I decide to point it out to them.
[48:50.070 --> 49:08.990]  Now, as far as being labeled as a potential enemy combatant of the state, or not actually getting ignored, would there be any other approaches to solving such a problem so that it gets rectified, but by the same token, no one goes to jail or loses their head over it?
[49:09.650 --> 49:11.390]  Yeah, I haven't really thought much about that.
[49:11.470 --> 49:18.570]  You're talking about, like, if you're at an airport and you see a security failure, that somebody can get by, like, the security?
[49:19.090 --> 49:24.870]  Well, that, or even in the company setting, where you're pretty much using the system.
[49:24.870 --> 49:26.910]  At the airport, I mean, I think you're welcome to do that.
[49:26.970 --> 49:28.010]  You might miss your next flight, though.
[49:28.570 --> 49:30.290]  You might want to make your flight two or three hours later.
[49:30.430 --> 49:36.570]  Right, but also... Oh, trust me, after riding Amtrak, that's not a problem.
[49:36.570 --> 49:38.370]  I mean... Right, yeah.
[49:38.470 --> 49:43.750]  I mean, I remember the kid that snuck some... What was it?
[49:43.850 --> 49:44.950]  Stuff on Southwest flight.
[49:45.690 --> 49:49.790]  And I think, you know, he was facing or was convicted of federal charges.
[49:50.190 --> 49:55.030]  I wouldn't go that far to test their security, especially in an industry that right now is really paranoid.
[49:55.650 --> 50:05.030]  But if you see a security failure, I'd certainly try to notify them, maybe by email or by letter, maybe anonymously, might be a good way.
[50:05.190 --> 50:07.590]  So that way, you're not put on some no-fly list.
[50:07.990 --> 50:16.550]  Right, but also, if even if you were to go through such approach and they decide not to heed your advice, then... Yeah, you could lead, you know, what's the old saying?
[50:16.690 --> 50:20.210]  You could lead an animal to the water, but you can't make a drink.
[50:20.670 --> 50:20.850]  True.
[50:21.170 --> 50:21.250]  Yeah.
[50:21.930 --> 50:22.070]  Okay.
[50:22.530 --> 50:22.670]  What?
[50:24.770 --> 50:26.210]  Adrian Lamo comes to mind.
[50:26.710 --> 50:27.210]  All right.
[50:27.270 --> 50:28.750]  Well, thank you very much.
[50:28.930 --> 50:29.030]  Yeah.
[50:29.030 --> 50:29.230]  All right.
[50:29.310 --> 50:29.590]  Thank you.
[50:31.270 --> 50:31.670]  Hi.
[50:31.870 --> 50:32.670]  This will be quick.
[50:32.850 --> 50:33.050]  Okay.
[50:33.450 --> 50:34.190]  Last question.
[50:34.430 --> 50:34.570]  Yeah.
[50:34.730 --> 50:38.250]  Any possibility of you reviving your radio program you did on KFI?
[50:38.850 --> 50:39.650]  Oh, KFI?
[50:39.870 --> 50:40.870]  Or any place else?
[50:40.870 --> 50:43.330]  I haven't thought about getting into talk radio again.
[50:43.510 --> 50:49.530]  I might do so in the future, but Leo Laporte now does a KFI show, and I recommend you listen to it.
[50:49.630 --> 50:51.430]  It's a great show.
[50:51.610 --> 50:53.450]  And hopefully, one day, I'll get back into talk radio.
[50:53.550 --> 50:54.490]  I really enjoy doing it.
[50:56.610 --> 50:58.370]  But I went on to different endeavors.
[50:59.070 --> 50:59.450]  Okay.
[50:59.750 --> 50:59.990]  Okay.
[51:00.290 --> 51:00.650]  Oh, go ahead.
[51:00.910 --> 51:02.170]  Well, just also quick.
[51:02.350 --> 51:09.270]  Is there any possibility of those programs being made available on the Internet or an archive or, you know, CD to buy or something?
[51:09.770 --> 51:11.550]  I haven't really thought about that, but I'll run it.
[51:11.710 --> 51:16.630]  My co-host, Alex, I think, has some copies on DVD.
[51:17.070 --> 51:19.390]  I might ask him about it, if he could post it to the Internet.
[51:19.590 --> 51:24.070]  But then we got to find out if we have permission, because they have commercials in there, stuff like that.
[51:24.070 --> 51:24.850]  Thank you.
[51:24.990 --> 51:25.530]  Thank you.
[51:25.710 --> 51:26.990]  Well, thank you, everybody.
[52:00.800 --> 52:02.080]  Thank you for all the support.
[52:02.080 --> 52:03.720]  And I couldn't have done it without you.
[52:03.860 --> 52:05.780]  And I'll be here for the entire conference.
[52:05.780 --> 52:08.440]  And any of you are welcome to come up to me and talk to me.
[52:10.220 --> 52:14.740]  And again, anybody that's interested in the stories that has anything to contribute, please talk to me as well.
[52:14.800 --> 52:15.620]  Thank you very much, everyone.
[52:15.620 --> 52:15.820]  Thank you.