Your dream world is just about to end.
-- from `Dreamworld', Diesel and Dust.
In another corner of the globe, the British hackers Pad and Gandalf
learned with horror that the Australian authorities had busted the
three Realm hackers. Electron had simply disappeared one day. A short
time later, Phoenix was gone too. Then the reports started rolling in
from newspapers and from other Australian hackers on a German board
similar to Altos, called Lutzifer.
Something else worried Pad. In one of his hacking forays, he had
discovered a file, apparently written by Eugene Spafford, which said
he was concerned that some British hackers--read Pad and
Gandalf--would create a new worm, based on the RTM worm, and release
it into the Internet. The unnamed British hackers would then be able
to cause maximum havoc on thousands of Internet sites.
It was true that Gandalf and Pad had captured copies of various worm
source codes. They fished around inside SPAN until they surfaced with
a copy of the Father Christmas worm. And, after finally successfully
hacking Russell Brand's machine at LLNL, they deftly lifted a complete
copy of the WANK worm. In Brand's machine, they also found a
description of how someone had broken into SPAN looking for the WANK
worm code, but hadn't found it. `That was me breaking into SPAN to
look around,' Gandalf laughed, relaying the tale to Pad.
Despite their growing library of worm code, Pad had no intention of
writing any such worm. They simply wanted the code to study what
penetration methods the worms had used and perhaps to learn something
new. The British hackers prided themselves on never having done
anything destructive to systems they hacked. In places where they knew
their activities had been discovered--such as at the Universities of
Bath, Edinburgh, Oxford and Strathclyde--they wrote notes to the
admins signed 8lgm. It wasn't only an ego thing--it was also a way of
telling the admins that they weren't going to do anything nasty to the
system.
At one university, the admins thought 8lgm was some kind
of weird variation on a Belgian word and that the hackers who visited
their systems night after night were from Belgium. At another uni, the
admins made a different guess at the meaning. In the morning, when
they came into work and saw that the hackers had been playing in their
system all night, they would sigh to each other, `Our eight little
green men are at it again'.
At the University of Lancaster, the hackers wrote a message to the
admins which said: `Don't do anything naughty. We have a good image
around the world, so please don't tarnish it or start making up
stories about us messing up systems. Don't hold your breath for us to
hack you, but keep us in mind.' Wherever they went, their message was
the same.
Nonetheless Pad visualised a scenario where Spaf whipped up the
computer security and law enforcement people into a frenzied panic and
tried to pin all sorts of things on the British hackers, none of which
they had done. The underground saw Spaf as being rabid in his attack
on hackers, based largely on his response to the RTM worm. And Gandalf
had hacked Spaf's machine.
The crackdown on the Australians, combined with the discovery of the
Spaf file, had a profound effect on Pad. Always cautious anyway, he
decided to give up hacking. It was a difficult decision, and weaning
himself from exploring systems night after night was no easy task.
However, in the face of what had happened to Electron and Phoenix,
continuing to hack didn't seem worth the risk.
When Pad gave up hacking, he bought his own NUI so he could access
places like Altos legitimately. The NUI was expensive--about
[sterling]10 an hour--but he was never on for long. Leisurely chats of
the type he once enjoyed in Altos were out of the question, but at
least he could mail letters to his friends like Theorem and Gandalf.
There would have been easier ways to maintain his friendship with
Gandalf, who lived in Liverpool, only an hour's drive away. But it
wouldn't be the same. Pad and Gandalf had never met, or even talked on
the phone. They talked on-line, and via email. That was the way they
related.
Pad also had other reasons for giving up hacking. It was an expensive
habit in Britain because British Telecom time-charged for local phone
calls. In Australia, a hacker could stay on-line for hours, jumping
from one computer to another through the data network, all for the
cost of one local call. Like the Australians, Pad could launch his
hacking sessions from a local uni or X.25 dial-up. However, an
all-night hacking session based on a single phone call might still
cost him [sterling]5 or more in timed-call charges--a considerable
amount of money for an unemployed young man. As it was, Pad had
already been forced to stop hacking for brief periods when he ran out
of his dole money.
Although Pad didn't think he could be prosecuted for hacking under
British law in early 1990, he knew that Britain was about to enact its
own computer crime legislation--the Computer Misuse Act 1990--in
August. The 22-year-old hacker decided that it was better to quit
while he was ahead.
And he did, for a while at least. Until July 1990, when Gandalf, two
years his junior, tempted him with one final hack before the new Act
came into force. Just one last fling, Gandalf told him. After that
last fling in July, Pad stopped hacking again.
The Computer Misuse Act passed into law in August 1990, following two
law commission reviews on the subject. The Scottish Law Commission
issued a 1987 report proposing to make unauthorised data access
illegal, but only if the hacker tried to `secure advantage, or cause
damage to another person'--including reckless damage.2 Simple look-see
hacking would not be a crime under the report's recommendations.
However, in 1989 The Law Commission of England and Wales issued its
own report proposing that simple unauthorised access should be a crime
regardless of intent--a recommendation which was eventually included
in the law.
Late in 1989, Conservative MP Michael Colvin introduced a private
member's bill into the British parliament. Lending her support to the
bill, outspoken hacker-critic Emma Nicholson, another Conservative MP,
fired public debate on the subject and ensured the bill passed through
parliament successfully.
In November 1990, Pad was talking on-line with Gandalf, and his friend
suggested they have one more hack, just one more, for old time's sake.
Well, thought Pad, one more--just a one-off thing--wouldn't hurt.
Before long, Pad was hacking regularly again, and when Gandalf tried
to give it up, Pad was there luring him to return to his favourite
pastime. They were like two boys at school, getting each other into
trouble--the kind of trouble which always comes in pairs. If Pad and
Gandalf hadn't known each other, they probably would both have walked
away from hacking forever in 1990.
As they both got back into the swing of things, they tried to make
light of the risk of getting caught. `Hey, you know,' Gandalf joked
on-line more than once, `the first time we actually meet each other in
person will probably be in a police station.'
Completely irreverent and always upbeat, Gandalf proved to be a true
friend. Pad had rarely met such a fellow traveller in the real world,
let alone on-line. What others--particularly some American
hackers--viewed as prickliness, Pad saw as the perfect sense of
humour. To Pad, Gandalf was the best m8 a fellow could ever have.
During the time Pad avoided hacking, Gandalf had befriended another,
younger hacker named Wandii, also from the north of England. Wandii
never played much of a part in the international computer underground,
but he did spend a lot of time hacking European computers. Wandii and
Pad got along pleasantly but they were never close. They were
acquaintances, bound by ties to Gandalf in the underground.
By the middle of June 1991, Pad, Gandalf and Wandii were peaking. At
least one of them--and often more--had already broken into systems
belonging to the European Community in Luxembourg, The Financial Times
(owners of the FTSE 100 share index), the British Ministry of Defence,
the Foreign Office, NASA, the investment bank SG Warburg in London,
the American computer database software manufacturer Oracle, and more
machines on the JANET network than they could remember. Pad had also
penetrated a classified military network containing a NATO system.
They moved through British Telecom's Packet Switched Stream Network
(PSS), which was similar to the Tymnet X.25 network, with absolute
ease.3
Gandalf's motto was, `If it moves, hack it'.
On 27 June 1991, Pad was sitting in the front room of his parent's
comfortable home in greater Manchester watching the last remnants of
daylight disappear on one of the longest days of the year. He loved
summer, loved waking up to streaks of sunlight sneaking through the
cracks in his bedroom curtain. He often thought to himself, it doesn't
get much better than this.
Around 11 p.m. he flicked on his modem and his Atari 520 ST computer
in the front sitting room. There were two Atari computers in the
house--indicative of his deep enthusiasm for computers since neither
his siblings nor his parents had any interest in programming. Most of
the time, however, Pad left the older Atari alone. His elder brother,
an aspiring chemist, used it for writing his PhD thesis.
Before dialling out, Pad checked that no-one was on the house's single
phone line. Finding it free, he went to check his email on Lutzifer. A
few minutes after watching his machine connect to the German board, he
heard a soft thud, followed by a creaking. Pad stopped typing, looked
up from his machine and listened. He wondered if his brother, reading
in their bedroom upstairs, or his parents, watching telly in the back
lounge room, could hear the creaking.
The sound became more pronounced and Pad swung around and looked
toward the hallway. In a matter of seconds, the front door frame had
been cracked open, prising the door away from its lock. The wood had
been torn apart by some sort of car jack, pumped up until the door
gave way.
Suddenly, a group of men burst through from the front doorstep, dashed
down the long hallway and shot up the carpeted stairs to Pad's
bedroom.
Still sitting at his computer downstairs, Pad swiftly flicked his
modem, and then his computer, off--instantly killing his connection
and everything on his screen. He turned back toward the door leading
to the sitting room and strained to hear what was happening upstairs.
If he wasn't so utterly surprised, he would almost have laughed. He
realised that when the police had dashed up to his bedroom, they had
been chasing every stereotype about hackers they had probably ever
read. The boy. In his bedroom. Hunched over his computer. Late at
night.
They did find a young man in the bedroom, with a computer. But it was
the wrong one, and for all intents and purposes the wrong computer. It
took the police almost ten minutes of quizzing Pad's brother to work
out their mistake.
Hearing a commotion, Pad's parents had rushed into the hallway while
Pad peered from the doorway of the front sitting room. A uniformed
police officer ushered everyone back into the room, and began asking
Pad questions.
`Do you use computers? Do you use the name Pad on computers?' they
asked.
Pad concluded the game was up. He answered their questions truthfully.
Hacking was not such a serious crime after all, he thought. It wasn't
as if he had stolen money or anything. This would be a drama, but he
was easy-going. He would roll with the punches, cop a slap on the
wrist and soon the whole thing would be over and done with.
The police took Pad to his bedroom and asked him questions as they
searched the room. The bedroom had a comfortably lived-in look, with a
few small piles of clothes in the corner, some shoes scattered across
the floor, the curtains hanging crooked, and a collection of music
posters--Jimi Hendrix and The Smiths--taped to the wall.
A group of police hovered around his computer. One of them began to
search through Pad's books on the shelves above the PC, checking each
one as he pulled it down. A few well-loved Spike Milligan works. Some
old chess books from when he was captain of the local chess team.
Chemistry books, purchased by Pad long before he took any classes in
the subject, just to satisfy his curiosity. Physics books. An
oceanography textbook. A geology book bought after a visit to a cave
excited his interest in the formation of rocks. Pad's mother, a
nursing sister, and his father, an electronics engineer who tested
gyros on aircraft, had always encouraged their children's interest in
the sciences.
The policeman returned those books to the shelves, only picking out
the computer books, textbooks from programming and maths classes Pad
had taken at a Manchester university. The officer carefully slid them
inside plastic bags to be taken away as
evidence.
Then the police picked through Pad's music tapes--The Stone Roses,
Pixies, New Order, The Smiths and lots of indie music from the
flourishing Manchester music scene. No evidence of anything but an
eclectic taste in music there.
Another policeman opened Pad's wardrobe and peered inside. `Anything
in here of interest?' he asked.
`No,' Pad answered. `It's all over here.' He pointed to the box of
computer disks.
Pad didn't think there was much point in the police tearing the place
to pieces, when they would ultimately find everything they wanted
anyway. Nothing was hidden. Unlike the Australian hackers, Pad hadn't
been expecting the police at all. Although part of the data on his
hard drive was encrypted, there was plenty of incriminating evidence
in the un-encrypted files.
Pad couldn't hear exactly what his parents were talking about with the
police in the other room, but he could tell they were calm. Why
shouldn't they be? It wasn't as if their son had done anything
terrible. He hadn't beaten someone up in a fist fight at a pub, or
robbed anyone. He hadn't hit someone while drunk driving. No, they
thought, he had just been fiddling around with computers. Maybe poking
around where he shouldn't have been, but that was hardly a serious
crime. They needn't worry. It wasn't as if he was going to prison or
anything. The police would sort it all out. Maybe some sort of
citation, and the matter would be over and done. Pad's mother even
offered to make cups of tea for the police.
One of the police struck up a conversation with Pad off to the side as
he paused to drink his tea. He seemed to know that Pad was on the
dole, and with a completely straight face, he said, `If you wanted a
job, why didn't you just join the police?'
Pad paused for a reality check. Here he was being raided by nearly a
dozen law enforcement officers--including representatives from BT and
Scotland Yard's computer crimes unit--for hacking hundreds of
computers and this fellow wanted to know why he hadn't just become a
copper?
He tried not to laugh. Even if he hadn't been busted, there is no way
he would ever have contemplated joining the police. Never in a million
years. His family and friends, while showing a pleasant veneer of
middle-class orderliness, were fundamentally anti-establishment. Many
knew that Pad had been hacking, and which sites he had penetrated.
Their attitude was: Hacking Big Brother? Good on you.
His parents were torn, wanting to encourage Pad's interest in
computers but also worrying their son spent an inordinate amount of
time glued to the screen. Their mixed feelings mirrored Pad's own
occasional concern.
While deep in the throes of endless hacking nights, he would suddenly
sit upright and ask himself, What am I doing here, fucking around on a
computer all day and night? Where is this heading? What about the rest
of life? Then he would disentangle himself from hacking for a few days
or weeks. He would go down to the university pub to drink with his
mostly male group of friends from his course.
Tall, with short brown hair, a slender physique and a handsomely
boyish face, the soft-spoken Pad would have been considered attractive
by many intelligent girls. The problem was finding those sort of
girls. He hadn't met many when he was studying at university--there
were few women in his maths and computer classes. So he and his
friends used to head down to the Manchester nightclubs for the social
scene and the good music.
Pad went downstairs with one of the officers and watched as the police
unplugged his 1200 baud modem, then tucked it into a plastic bag. He
had bought that modem when he was eighteen. The police unplugged
cables, bundled them up and slipped them into labelled plastic bags.
They gathered up his 20 megabyte hard drive and monitor. More plastic
bags and labels.
One of the officers called Pad over to the front door. The jack was
still wedged across the mutilated door frame. The police had broken
down the door instead of knocking because they wanted to catch the
hacker in the act--on-line. The officer motioned for Pad to follow
him.
`Come on,' he said, leading the hacker into the night. `We're taking
you to the station.'
Pad spent the night in a cell at the Salford Crescent police
station, alone. No rough crims, and no other hackers either.
He settled into one of the metal cots lined against the perimeter of
the cell, but sleep evaded him. Pad wondered if Gandalf had been
raided as well. There was no sign of him, but then again, the police
would hardly be stupid enough to lock up the two hackers together. He
tossed and turned, trying to push thoughts from his head.
Pad had fallen into hacking almost by accident. Compared to others in
the underground, he had taken it up at a late age--around nineteen.
Altos had been the catalyst. Visiting BBSes, he read a file describing
not only what Altos was, but how to get there--complete with NUI.
Unlike the Australian underground, the embryonic British underground
had no shortage of NUIs. Someone had discovered a stack of BT NUIs and
posted them on BBSes across England.
Pad followed the directions in the BBS file and soon found himself in
the German chat channel. Like Theorem, he marvelled at the brave new
live world of Altos. It was wonderful, a big international party.
After all, it wasn't every day he got to talk with Australians, Swiss,
Germans, Italians and Americans. Before long, he had taken up hacking
like so many other Altos regulars.
Hacking as a concept had always intrigued him. As a teenager, the film
War Games had dazzled him. The idea that computers could communicate
with each over telephone lines enthralled the sixteen-year-old,
filling his mind with new ideas. Sometime after that he saw a
television report on a group of hackers who claimed that they had used
their skills to move satellites around in space--the same story which
had first caught Electron's imagination.
Pad had grown up in Greater Manchester. More than a century before,
the region had been a textile boom-town. But the thriving economy did
not translate into great wealth for the masses. In the early 1840s,
Friedrich Engels had worked in his father's cotton-milling factory in
the area, and the suffering
he saw in the region influenced his most famous work, The Communist
Manifesto, published in 1848.
Manchester wore the personality of a working-class town, a place where
people often disliked the establishment and
distrusted authority figures. The 1970s and 1980s had not been kind to
most of Greater Manchester, with unemployment and urban decay
disfiguring the once-proud textile hub. But this decay only appeared
to strengthen an underlying resolve among many from the working
classes to challenge the symbols of power.
Pad didn't live in a public housing high-rise. He lived in a suburban
middle-class area, in an old, working-class town removed from the
dismal inner-city. But like many people from the north, he disliked
pretensions. Indeed, he harboured a healthy degree of good-natured
scepticism, perhaps stemming from a culture of mates whose favourite
pastime was pulling each other's leg down at the pub.
This scepticism was in full-gear as he watched the story of how
hackers supposedly moved satellites around in space, but somehow the
idea slipped through the checkpoints and captured his imagination,
just as it had done with Electron. He felt a desire to find out for
himself if it was true and he began pursuing hacking in enthusiastic
bursts. At first it was any moderately interesting system. Then he
moved to the big-name systems--computers belonging to large
institutions. Eventually, working with the Australians, he learned to
target computer security experts. That was, after all, where the
treasure was stored.
In the morning at the police station, a guard gave Pad something to
eat which might have passed for food. Then he was escorted into an
interview room with two plain-clothed officers and a BT
representative.
Did he want a lawyer? No. He had nothing to hide. Besides, the police
had already seized evidence from his house, including unencrypted data
logs of his hacking sessions. How could he argue against that? So he
faced his stern inquisitors and answered their questions willingly.
Suddenly things began to take a different turn when they began asking
about the `damage' he had done inside the Greater London Polytechnic's
computers. Damage? What damage? Pad certainly hadn't damaged anything.
Yes, the police told him. The damage totalling almost a quarter of a
million pounds.
Pad gasped in horror. A quarter of a million pounds? He thought back
to his many forays into the system. He had been a little mischievous,
changing the welcome message to `Hi' and signing it 8lgm. He had made
a few accounts for himself so he could log in at a later date. That
seemed to be nothing special, however, since he and Gandalf had a
habit of making accounts called 8lgm for themselves in JANET systems.
He had also erased logs of his activities to cover his tracks, but
again, this was not unusual, and he had certainly never deleted any
computer users' files. The whole thing had just been a bit of fun, a
bit of cat and mouse gaming with the system admins. There was nothing
he could recall which would account for that kind of damage. Surely
they had the wrong hacker?
No, he was the right one all right. Eighty investigators from BT,
Scotland Yard and other places had been chasing the 8lgm hackers for
two years. They had phone traces, logs seized from his computer and
logs from the hacked sites. They knew it was him.
For the first time, the true gravity of the situation hit Pad. These
people believed in some way that he had committed serious criminal
damage, that he had even been malicious.
After about two hours of questioning, they put Pad back in his cell.
More questions tomorrow, they told him.
Later that afternoon, an officer came in to tell Pad his mother and
father were outside. He could meet with them in the visiting area.
Talking through a glass barrier, Pad tried to reassure his worried
parents. After five minutes, an officer told the family the visit was
over. Amid hurried goodbyes under the impatient stare of the guard,
Pad's parents told him they had brought something for him to read in
his cell. It was the oceanography textbook.
Back in his cell, he tried to read, but he couldn't concentrate. He
kept replaying his visits to the London Polytechnic over and over in
his mind, searching for how he might have inadvertently done
[sterling]250000 worth of damage. Pad was a very good hacker; it
wasn't as if he was some fourteen-year-old kid barging through systems
like a bull in china shop. He knew how to get in and out of a system
without hurting it.
Shortly after 8 p.m., as Pad sat on his cot stewing over the police
damage claims, sombre music seemed to fill his cell. Slowly at first,
an almost imperceptible moaning, which subtly transformed into solemn
but recognisable notes. It sounded like Welsh choir music, and it was
coming from above him.
Pad looked up at the ceiling. The music--all male voices-- stopped
abruptly, then started again, repeating the same heavy, laboured
notes. The hacker smiled. The local police choir was practising right
above his cell.
After another fitful night, Pad faced one more round of interviews.
The police did most of the questioning, but they didn't seem to know
much about computers--well, not nearly so much as any good hacker on
Altos. Whenever either of the police asked a technical question, they
looked over to the BT guy at the other end of the table as if to say,
`Does this make any sense?' The BT guy would give a slight nod, then
the police looked back at Pad for an answer. Most of the time, he was
able to decipher what they thought they were trying to ask, and he
answered accordingly.
Then it was back to his cell while they processed his charge sheets.
Alone again, Pad wondered once more if they had raided Gandalf. Like
an answer from above, Pad heard telephone tones through the walls. The
police seemed to be playing them over and over. That was when he knew
they had Gandalf too.
Gandalf had rigged up a tone dialler in his computer. It sounded as if
the police were playing with it, trying to figure it out.
So, Pad would finally meet Gandalf in person after two years. What
would he look like? Would they have the same chemistry in person as
on-line? Pad felt like he knew Gandalf, knew his essence, but meeting
in person could be a bit tricky.
Explaining that the paperwork, including the charge sheets, had
finally been organised, a police officer unlocked Pad's cell door and
led him to a foyer, telling him he would be meeting both Gandalf and
Wandii. A large collection of police had formed a semi-circle around
two other young men. In addition to Scotland Yard's Computer Crimes
Unit and BT, at least seven other police forces were involved in the
three raids, including those from Greater Manchester, Merseyside and
West Yorkshire. The officers were curious about the hackers.
For most of the two years of their investigation, the police didn't
even know the hackers' real identities. After such a long, hard chase,
the police had been forced to wait a little longer, since they wanted
to nab each hacker while he was on-line. That meant hiding outside
each hacker's home until he logged in somewhere. Any system would do
and they didn't have to be talking to each other on-line--as long as
the login was illegal. The police had sat patiently, and finally
raided the hackers within hours of each other, so they didn't have
time to warn one another.
So, at the end of the long chase and a well-timed operation, the
police wanted to have a look at the hackers up close.
After the officer walked Pad up to the group, he introduced Gandalf.
Tall, lean with brown hair and pale skin, he looked a little bit like
Pad. The two hackers smiled shyly at each other, before one of the
police pointed out Wandii, the seventeen-year-old schoolboy. Pad
didn't get a good look at Wandii, because the police quickly lined the
hackers up in a row, with Gandalf in the middle, to explain details to
them. They were being charged under the Computer Misuse Act of 1990.
Court dates would be set and they would be notified.
When they were finally allowed to leave, Wandii seemed to disappear.
Pad and Gandalf walked outside, found a couple of benches and lay
down, basking in the sun and chatting while they waited for their
rides home.
Gandalf proved to be as easy to talk to in person as he was on-line.
They exchanged phone numbers and shared notes on the police raids.
Gandalf had insisted on meeting a lawyer before his interviews, but
when the lawyer arrived he didn't have the slightest understanding of
computer crime. He advised Gandalf to tell the police whatever they
wanted to know, so the hacker did.
The trial was being held in London. Pad wondered why, if all three
hackers were from the north, the case was being tried in the south.
After all, there was a court in Manchester which was high enough to
deal with their crimes.
Maybe it was because Scotland Yard was in London. Maybe they had
started the paperwork down there. Maybe it was because they were being
accused of hacking computers located within the jurisdiction of the
Central Criminal Court--that court being the Old Bailey in London. But
Pad's cynical side hazarded a different guess--a guess which seemed
justified after a few procedural appearances in 1992 before the trial,
which was set for 1993. For when Pad arrived at the Bow Street
Magistrates Court for his committal in April 1992, he saw it packed
out with the media, just as he had anticipated.
A few hackers also fronted up to fly the flag of the underground. One
of them--a stranger--came up to Pad after court, patted him on the
back and exclaimed enthusiastically, `Well done, Paddy!' Startled, Pad
just looked at him and then smiled. He had no idea how to respond to
the stranger.
Like the three Australian hackers, Pad, Gandalf and the little-known
Wandii were serving as the test case for new hacking laws in their
country. British law enforcement agencies had spent a fortune on the
case--more than [sterling]500000 according to the newspapers--by the
time the 8lgm case went to trial. This was going to be a show case,
and the government agencies wanted taxpayers to know they were getting
their money's worth.
The hackers weren't being charged with breaking into computers. They
were being charged with conspiracy, a more serious offence. While
admitting the threesome did not hack for personal gain, the
prosecution alleged the hackers had conspired to break into and modify
computer systems. It was a strange approach to say the least,
considering that none of the three hackers had ever met or even talked
to the others before they were arrested.
It was not so strange, however, when looking at the potential
penalties. If the hackers had been charged with simply breaking into a
machine, without intending any harm, the maximum penalty was six
months jail and a fine of up to [sterling]5000. However, conspiracy,
which was covered under a different section of the Act, could bring up
to five years in jail and an unlimited amount in fines.
The prosecution was taking a big gamble. It would be harder to prove
conspiracy charges, which required demonstration of greater criminal
intent than lesser charges. The potential pay-off was of course also
much greater. If convicted, the defendants in Britain's most important
hacking case to date would be going to prison.
As with The Realm case, two hackers--Pad and Gandalf--planned to plead
guilty while the third--in this case Wandii--planned to fight the
charges every step of the way. Legal Aid was footing the bill for
their lawyers, because the hackers were either not working or were
working in such lowly paid, short-term jobs they qualified for free
legal support.
Wandii's lawyers told the media that this showcase was tantamount to a
state trial. It was the first major hacking case under the new
legislation which didn't involve disgruntled employees. While having
no different legal status from a normal trial, the term state trial
suggested a greater degree of official wrath--the kind usually
reserved for cases of treason.
On 22 February 1993, within two months of Electron's decision to turn
Crown witness against Phoenix and Nom, the three 8lgm hackers stood in
the dock at Southwark Crown Court in South London to enter pleas in
their own case.
In the dim winter light, Southwark couldn't look less appealing, but
that didn't deter the crowds. The courtroom was going to be packed,
just as Bow Street had been. Scotland Yard detectives were turning out
in force. The crowd shuffled toward Room 12.
The prosecution told the media they had about 800 computer disks full
of evidence and court materials. If all the data had been printed out
on A4 paper, the stack would tower more than 40 metres in the air,
they said. Considering the massive amount of evidence being heaved,
rolled and tugged through the building by teams of legal eagles, the
choice of location--on the fifth floor--proved to be a challenge.
Standing in the dock next to Wandii, Pad and Gandalf pleaded guilty to
two computer conspiracy charges: conspiring to dishonestly obtain
telecommunications services, and conspiring to cause unauthorised
modification to computer material. Pad also pleaded guilty to a third
charge: causing damage to a computer. This last charge related to the
almost a quarter of
a million pounds worth of `damage' to the Central London Polytechnic.
Unlike the Australians' case, none of the British hackers faced
charges about specific sites such as NASA.
Pad and Gandalf pleaded guilty because they didn't think they had much
choice. Their lawyers told them that, in light of the evidence,
denying their guilt was simply not a realistic option. Better to throw
yourself on the mercy of the court, they advised. As if to underline
the point, Gandalf's lawyer had told him after a meeting at the end of
1992, `I'd like to wish you a happy Christmas, but I don't think it's
going to be one'.
Wandii's lawyers disagreed. Standing beside his fellow hackers, Wandii
pleaded not guilty to three conspiracy charges: plotting to gain
unauthorised access to computers, conspiring to make unauthorised
modifications to computer material, and conspiring to obtain
telecommunications services dishonestly. His defence team was going to
argue that he was addicted to computer hacking and that, as a result
of this addiction, he was not able to form the criminal intent
necessary to be convicted.
Pad thought Wandii's case was on shaky ground. Addiction didn't seem a
plausible defence to him, and he noticed Wandii looked very nervous in
court just after his plea.
Pad and Gandalf left London after their court appearance, returning to
the north to prepare for their sentencing hearings, and to watch the
progress of Wandii's case through the eyes of the media.
They weren't disappointed. It was a star-studded show. The media
revved itself up for a feeding frenzy and the prosecution team, headed
by James Richardson, knew how to feed the pack. He zeroed in on
Wandii, telling the court how the schoolboy `was tapping into offices
at the EC in Luxembourg and even the experts were worried. He caused
havoc at universities all around the world'.4 To do this, Wandii had
used a simple BBC Micro computer, a Christmas present costing
[sterling]200.
The hacking didn't stop at European Community's computer, Richardson
told the eager crowd of journalists. Wandii had hacked Lloyd's, The
Financial Times and Leeds University. At The Financial Times machine,
Wandii's adventures had upset the smooth operations of the FTSE 100
share index, known in the City as `footsie'. The hacker installed a
scanning program in the FT's network, resulting in one outgoing call
made every second. The upshot of Wandii's intrusion: a [sterling]704
bill, the deletion of an important file and a management decision to
shut down a key system. With the precision of a banker, FT computer
boss Tony Johnson told the court that the whole incident had cost his
organisation [sterling]24871.
But the FT hack paled next to the prosecution's real trump card: The
European Organisation for the Research and Treatment of Cancer in
Brussels. They had been left with a [sterling]10000 phone bill as a
result of a scanner Wandii left on its machine,5 the court was told.
The scanner had left a trail of 50000 calls, all documented on a
980-page phone bill.
The scanner resulted in the system going down for a day, EORTC
information systems project manager Vincent Piedboeuf, told the jury.
He went on to explain that the centre needed its system to run 24
hours a day, so surgeons could register patients. The centre's
database was the focal point for pharmaceutical companies, doctors and
research centres--all coordinating their efforts in fighting the
disease.
For the media, the case was headline heaven. `Teenage computer hacker
"caused worldwide chaos"' the Daily Telegraph screamed across page
one. On page three, the Daily Mail jumped in with `Teenage hacker
"caused chaos for kicks"'. Even The Times waded into the fray.
Smaller, regional newspapers pulled the story across the countryside
to the far reaches of the British Isles. The Herald in Glasgow told
its readers `Teenage hacker "ran up [sterling]10000 telephone bill"'.
Across the Irish Sea, the Irish Times caused a splash with its
headline, `Teenage hacker broke EC computer security'.
Also in the first week of the case, The Guardian announced Wandii had
taken down the cancer centre database. By the time The Independent got
hold of the story, Wandii hadn't just shut down the database, he had
been reading the patients' most intimate medical details: `Teenager
"hacked into cancer patient files"'. Not to be outdone, on day four of
the trial, the Daily Mail had christened Wandii as a `computer
genius'. By day five it labelled him as a `computer invader' who `cost
FT [sterling]25000'.
The list went on. Wandii, the press announced, had hacked the Tokyo
Zoo and the White House. It was difficult to tell which was the more
serious offence.
Wandii's defence team had a few tricks of its own. Ian MacDonald, QC,
junior counsel Alistair Kelman and solicitor Deborah Tripley put
London University Professor James Griffith-Edwards, an authoritative
spokesman on addictive and compulsive behaviours, on the stand as an
expert witness. The chairman of the National Addiction Centre, the
professor had been part of a team which wrote the World Health
Organisation's definition of addiction. No-one was going to question
his qualifications.
The professor had examined Wandii and he announced his conclusion to
the court: Wandii was obsessed by computers, he was unable to stop
using them, and his infatuation made it impossible for him to choose
freely. `He repeated 12 times in police interviews, "I'm just
addicted. I wish I wasn't",' Griffith-Edwards told the court. Wandii
was highly intelligent, but was unable to escape from the urge to beat
computers' security systems at their own game. The hacker was obsessed
by the intellectual challenge. `This is the core ... of what attracts
the compulsive gambler,' the professor explained to the entranced jury
of three women and nine men.
But Wandii, this obsessive, addicted, gifted young man, had never had
a girlfriend, Griffith-Edwards continued. In fact, he shyly admitted
to the professor that he wouldn't even know how to ask a girl out. `He
[Wandii] became profoundly embarrassed when asked to talk about his
own feelings. He simply couldn't cope when asked what sort of person
he was.'6
People in the jury edged forward in their seats, concentrating
intently on the distinguished professor. And why wouldn't they? This
was amazing stuff. This erudite man had delved inside the mind of the
young man of bizarre contrasts. A man so sophisticated that he could
pry open computers belonging to some of Britain's and Europe's most
prestigious institutions, and yet at the same time so simple that he
had no idea how to ask a girl on a date. A man who was addicted not to
booze, smack or speed, which the average person associates with
addiction, but to a computer--a machine most people associated with
kids' games and word processing programs.
The defence proceeded to present vivid examples of Wandii's addiction.
Wandii's mother, a single parent and lecturer in English, had terrible
trouble trying to get her son away from his computer and modem. She
tried hiding his modem. He found it. She tried again, hiding it at his
grandmother's house. He burgled granny's home and retrieved it. His
mother tried to get at his computer. He pushed her out of his attic
room and down the stairs.
Then he ran up a [sterling]700 phone bill as a result of his hacking.
His mother switched off the electricity at the mains. Her son
reconnected it. She installed a security calling-code on the phone to
stop him calling out. He broke it. She worried he wouldn't go out and
do normal teenage things. He continued to stay up all night--and
sometimes all day--hacking. She returned from work to find him
unconscious--sprawled across the living room floor and looking as
though he was dead. But it wasn't death, only sheer exhaustion. He
hacked until he passed out, then he woke up and hacked some more.
The stories of Wandii's self-confessed addiction overwhelmed, appalled
and eventually engendered pity in the courtroom audience. The media
began calling him `the hermit hacker'.
Wandii's defence team couldn't fight the prosecution's
evidence head-on, so they took the prosecution's evidence and claimed
it as their own. They showed the jury that Wandii hadn't just hacked
the institutions named by the prosecution; he had hacked far, far more
than that. He didn't just hack a lot--he hacked too much. Most of all,
Wandii's defence team gave the jury a reason to acquit the
innocent-faced young man sitting before them.
During the trial, the media focused on Wandii, but didn't completely
ignore the other two hackers. Computer Weekly hunted down where
Gandalf was working and laid it bare on the front page. A member of
`the UK's most notorious hacking gang', the journal announced, had
been working on software which would be used at Barclay's Bank.7 The
implication was clear. Gandalf was a terrible security risk and should
never be allowed to do any work for a financial institution. The
report irked the hackers, but they tried to concentrate on preparing
for their sentencing hearing.
From the beginning of their case, the hackers had problems obtaining
certain evidence. Pad and Gandalf believed some of the material seized
in the police raids would substantially help their case--such as
messages from admins thanking them for pointing out security holes on
their systems. This material had not been included in the
prosecution's brief. When the defendants requested access to it, they
were refused access on the grounds that there was classified data on
the optical disk. They were told to go read the Attorney-General's
guidelines on disclosure of information. The evidence of the hackers'
forays into military and government systems was jumbled in with their
intrusions into computers such as benign JANET systems, the defence
team was told. It would take too much time to separate the two.
Eventually, after some wrangling, Pad and Gandalf were told they could
inspect and copy material--provided it was done under the supervision
of the police. The hackers travelled to London, to Holborn police
station, to gather supporting evidence for their case. However, it
soon became clear that this time-consuming exercise would be
impossible to manage on an ongoing basis. Finally, the Crown
Prosecution Service relented, agreeing to release the material on disk
to Pad's solicitor, on the proviso that no copies were made, it did
not leave the law office, and it was returned at the end of the trial.
As Wandii's case lurched from revelation to exaggeration, Pad and
Gandalf busily continued to prepare for their own sentencing hearing.
Every day, Gandalf travelled from Liverpool to Manchester to meet with
his friend. They picked up a handful of newspapers at the local agent,
and then headed up to Pad's lawyer's office. After a quick scan for
articles covering the hacking case, the two hackers began sifting
through the reluctantly released prosecution disks. They read through
the material on computer, under the watchful eye of the law office's
cashier--the most computer literate person in the firm.
After fifteen days in the Southwark courtroom listening to fantastic
stories from both sides about the boy sitting before them, the jury in
Wandii's trial retired to consider the evidence. Before they left,
Judge Harris gave them a stern warning: the argument that Wandii was
obsessed or dependent was not a defence against the charges.
It took the jurors only 90 minutes to reach a decision, and when the
verdict was read out the courtroom erupted with a wave of emotion.
Not guilty. On all counts.
Wandii's mother burst into a huge smile and turned to her son, who was
also smiling. And the defence team couldn't be happier. Kelman told
journalists, `The jury felt this was a sledge hammer being used to
crack a nut'.8
The prosecution was stunned and the law enforcement agents
flabbergasted. Detective Sergeant Barry Donovan found the verdict
bizarre. No other case in his 21 years in law enforcement had as much
overwhelming evidence as this one, yet the jury had let Wandii walk.
And in a high-pitched frenzy rivalling its earlier hysteria, the
British media jumped all over the jury's decision. `Hacker who ravaged
systems walks free', an indignant Guardian announced. `Computer Genius
is cleared of hacking conspiracy', said the Evening Standard. `Hacking
"addict" acquitted', sniffed The Times. Overpowering them all was the
Daily Telegraph's page one: `Teenage computer addict who hacked White
House system is cleared'.
Then came the media king-hit. Someone had leaked another story and it
looked bad. The report, in the Mail on Sunday, said that the three
hackers had broken into a Cray computer at the European Centre for
Medium Range Weather Forecasting at Bracknell. This computer, likes
dozens of others, would normally have been relegated to the long list
of unmentioned victims except for one thing. The US military used
weather data from the centre for planning its attack on Iraq in the
Gulf War. The media report claimed that the attack had slowed down the
Cray's calculations, thus endangering the whole Desert Storm
operation. The paper announced the hackers had been `inadvertently
jeopardising--almost fatally--the international effort against Saddam
Hussein' and had put `thousands of servicemen's lives at risk'.9
Further, the paper alleged that the US State Department was so
incensed about British hackers' repeated break-ins disrupting Pentagon
defence planning that it had complained to Prime Minister John Major.
The White House put the matter more bluntly than the State Department:
Stop your hackers or we will cut off European access to our satellite
which provides trans-Atlantic data and voice telecommunications.
Someone in Britain seemed to be listening, for less than twelve months
later, authorities had arrested all three hackers.
Pad thought the allegations were rubbish. He had been inside a VAX
machine at the weather centre for a couple of hours one night, but he
had never touched a Cray there. He had certainly never done anything
to slow the machine down. No cracking programs, no scanners, nothing
which might account for the delay described in the report. Even if he
had been responsible, he found it hard to believe the Western allies'
victory in the Gulf War was determined by one computer in Berkshire.
All of which gave him cause to wonder why the media was running this
story now, after Wandii's acquittal but before he and Gandalf were
sentenced. Sour grapes, perhaps?
For days, columnists, editorial and letter writers across Britain
pontificated on the meaning of the Wandii's verdict and the validity
of an addiction to hacking as a defence. Some urged computer owners to
take responsibility for securing their own systems. Others called for
tougher hacking laws. A few echoed the view of The Times, which
declared in an editorial, `a persistent car thief of [the hacker's]
age would almost certainly have received a custodial sentence. Both
crimes suggest disrespect for other people's property ... the jurors
may have failed to appreciate the seriousness of this kind of
offence'.10
The debate flew forward, changing and growing, and expanding beyond
Britain's borders. In Hong Kong, the South China Morning Post asked,
`Is [this] case evidence of a new social phenomenon, with immature and
susceptible minds being damaged through prolonged exposure to personal
computers?' The paper described public fear that Wandii's case would
result in `the green light for an army of computer-literate hooligans
to pillage the world's databases at will, pleading insanity when
caught'.11
By April Fool's Day 1991, more than two weeks after the end of the
court case, Wandii had his own syndrome named after him, courtesy of
The Guardian.
And while Wandii, his mother and his team of lawyers celebrated their
victory quietly, the media reported that the Scotland Yard detectives
commiserated over their defeat, which was considerably more serious
than simply losing the Wandii case. The Computer Crimes Unit was being
`reorganised'. Two experienced officers from the five-man unit were
being moved out of the group. The official line was that the
`rotations' were normal Scotland Yard procedure. The unofficial word
was that the Wandii case had been a fiasco, wasting time and money,
and the debacle was not to be repeated.
In the north, a dark cloud gathered over Pad and Gandalf as their
judgment day approached. The Wandii case verdict might have been cause
for celebration among some in the computer underground, but it brought
little joy for the other two 8lgm hackers.
For Pad and Gandalf, who had already pleaded guilty, Wandii's
acquittal was a disaster.
On 12 May 1993, two months after Wandii's acquittal, Boris Kayser
stood up at the Bar table to put forward Electron's case at the
Australian hacker's plea and sentencing hearing. As he began to speak,
a hush fell over the Victorian County Court.
A tall, burly man with a booming voice, an imperious courtroom
demeanour and his traditional black robes flowing behind him in an
echo of his often emphatic gesticulations, Kayser was larger than
life. A master showman, he knew how to play an audience of courtroom
journalists sitting behind him as much as to the judge in front of
him.
Electron had already stood in the dock and pleaded guilty to fourteen
charges, as agreed with the DPP's office. In typical style, Kayser had
interrupted the long process of the court clerk reading out each
charge and asking whether Electron would plead guilty or not guilty.
With an impatient wave of his hand, Kayser asked the judge to dispense
with such formalities since his client would plead guilty to all the
agreed charges at once. The interjection was more of an announcement
than a question.
The formalities of a plea having been summarily dealt with, the
question now at hand was sentencing. Electron wondered if he would be
sent to prison. Despite lobbying from Electron's lawyers, the DPP's
office had refused to recommend a non-custodial sentence. The best
deal Electron's lawyers had been able to arrange in exchange for
turning Crown witness was for the DPP to remain silent on the issue of
prison. The judge would make up his mind without input from the DPP.
Electron fiddled nervously with his father's wedding ring, which he
wore on his right hand. After his father's death, Electron's sister
had begun taking things from the family home. Electron didn't care
much because there were only two things he really wanted: that ring
and some of his father's paintings.
Kayser called a handful of witnesses to support the case for a light
sentence. Electron's grandmother from Queensland. The family friend
who had driven Electron to the hospital the day his father died.
Electron's psychiatrist, the eminent Lester Walton. Walton in
particular highlighted the difference between the two possible paths
forward: prison, which would certainly traumatise an already mentally
unstable young man, or freedom, which offered Electron a good chance
of eventually establishing a normal life.
When Kayser began summarising the case for a non-custodial sentence,
Electron could hear the pack of journalists off to his side
frantically scribbling notes. He wanted to look at them, but he was
afraid the judge would see his ponytail, carefully tucked into his
neatly ironed white shirt, if he turned sideways,
`Your Honour,' Kayser glanced backward slightly, toward the court
reporters, as he warmed up, `my client lived in an artificial world of
electronic pulses.'
Scratch, scribble. Electron could almost predict, within half a
second, when the journalists' pencils and pens would reach a crescendo
of activity. The ebb and flow of Boris's boom was timed in the style
of a TV newsreader.
Kayser said his client was addicted to the computer the way an
alcoholic was obsessed with the bottle. More scratching, and lots of
it. This client, Kayser thundered, had never sought to damage any
system, steal money or make a profit. He was not malicious in the
least, he was merely playing a game.
`I think,' Electron's barrister concluded passionately, but slowly
enough for every journalist to get it down on paper, `that he should
have been called Little Jack Horner, who put in his thumb, pulled out
a plumb and said, "What a good boy am I!"'
Now came the wait. The judge retired to his chambers to weigh up the
pre-sentence report, Electron's family situation, the fact that he had
turned Crown witness, his offences--everything. Electron had given a
nine-page written statement against Phoenix to the prosecution. If the
Phoenix case went to trial, Electron would be put on the stand to back
up that statement.
In the month before Electron returned to court to hear his sentence,
he thought about how he could have fought the case. Some of the
charges were dubious.
In one case, he had been charged with illegally accessing public
information through a public account. He had accessed the anonymous
FTP server at the University of Helsinki to copy information about
DES. His first point of access had been through a hacked Melbourne
University account.
Beat that charge, Electron's lawyer had told him, and there's plenty
more where that came from. The DPP had good pickings and could make up
a new charge for another site. Still, Electron reasoned some of the
Crown's evidence would not have stood up under cross-examination.
When reporters from Australia and overseas called NASA headquarters
for comment on the hacker-induced network shutdown, the agency
responded that it had no idea what they were talking about. There had
been no NASA network shutdown. A spokesman made inquiries and, he
assured the media, NASA was puzzled by the report. Sharon Beskenis's
statement didn't seem so watertight after all. She was not, it turned
out, even a NASA employee but a contractor from Lockheed.
During that month-long wait, Electron had trouble living down Kayser's
nursery-rhyme rendition in the courtroom. When he rang friends, they
would open the conversation saying, `Oh, is that Little Jack Horner?'
They had all seen the nightly news, featuring Kayser and his client.
Kayser had looked grave leaving court, while Electron, wearing John
Lennon-style glasses with dark lenses and with his shoulder-length
curls pulled tightly back in a ponytail, had tried to smile at the
camera crews. But his small, fine features and smattering of freckles
disappeared under the harsh camera lights, so much so that the black,
round spectacles seemed almost to float on a blank, white surface.
The week after Electron pleaded guilty in Australia, Pad and Gandalf
sat side by side in London's Southwark dock one last time.
For a day and a half, beginning on 20 May 1993, the two hackers
listened to their lawyers argue their defence. Yes, our clients hacked
computers, they told the judge, but the offences were nowhere near as
serious as the prosecution wants to paint them. The lawyers were
fighting hard for one thing: to keep Pad and Gandalf out of prison.
Some of the hearing was tough going for the two hackers, but not just
because of any sense of foreboding caused by the judge's imminent
decision. The problem was that Gandalf made Pad laugh, and it didn't
look at all good to laugh in the middle of your sentencing hearing.
Sitting next to Gandalf for hours on end, while lawyers from both
sides butchered the technical aspects of computer hacking which the
8lgm hackers had spent years learning, did it. Pad had only to give
Gandalf a quick sidelong glance and he quickly found himself
swallowing and clearing his throat to keep from bursting into
laughter. Gandalf's irrepressible irreverence was written all over his
face.
The stern-faced Judge Harris could send them to jail, but he still
wouldn't understand. Like the gaggle of lawyers bickering at the front
of the courtroom, the judge was--and would always be--out of the loop.
None of them had any idea what was really going on inside the heads of
the two hackers. None of them could ever understand what hacking was
all about--the thrill of stalking a quarry or of using your wits to
outsmart so-called experts; the pleasure of finally penetrating a
much-desired machine and knowing that system is yours; the deep
anti-establishment streak which served as a well-centred ballast
against the most violent storms washing in from the outside world; and
the camaraderie of the international hacking community on Altos.
The lawyers could talk about it, could put experts on the stand and
psychological reports in the hands of the judge, but none of them
would ever really comprehend because they had never experienced it.
The rest of the courtroom was out of the loop, and Pad and Gandalf
stared out from the dock as if looking through a two-way mirror from a
secret, sealed room.
Pad's big worry had been this third charge--the one which he faced
alone. At his plea hearing, he had admitted to causing damage to a
system owned by what was, in 1990, called the Polytechnic of Central
London. He hadn't damaged the machine by, say, erasing files, but the
other side had claimed that the damages totalled about [sterling]250
000.
The hacker was sure there was zero chance the polytechnic had spent
anything near that amount. He had a reasonable idea of how long it
would take someone to clean up his intrusions. But if the prosecution
could convince a judge to accept that figure, the hacker might be
looking at a long prison term.
Pad had already braced himself for the possibility of prison. His
lawyer warned him before the sentencing date that there was a
reasonable likelihood the two 8lgm hackers would be sent down. After
the Wandii case, the public pressure to `correct' a `wrong' decision
by the Wandii jury was enormous. The police had described Wandii's
acquittal as `a licence to hack'--and The Times, had run the
statement.12 It was likely the judge, who had presided over Wandii's
trial, would want to send a loud and clear message to the hacking
community.
Pad thought that perhaps, if he and Gandalf had pleaded not guilty
alongside Wandii, they would have been acquitted. But there was no way
Pad would have subjected himself to the kind of public humiliation
Wandii went through during the `addicted to computers' evidence. The
media appeared to want to paint the three hackers as pallid, scrawny,
socially inept, geeky geniuses, and to a large degree Wandii's lawyers
had worked off this desire. Pad didn't mind being viewed as highly
intelligent, but he wasn't a geek. He had a casual girlfriend. He went
out dancing with friends or to hear bands in Manchester's thriving
alternative music scene. He worked out his upper body with weights at
home. Shy--yes. A geek--no.
Could Pad have made a case for being addicted to hacking? Yes,
although he never believed that he had been. Completely enthralled,
entirely entranced? Maybe. Suffering from a passing obsession?
Perhaps. But addicted? No, he didn't think so. Besides, who knew for
sure if a defence of addiction could have saved him from the
prosecution's claim anyway?
Exactly where the quarter of a million pound claim came from in the
first place was a mystery to Pad. The police had just said it to him,
as if it was fact, in the police interview. Pad hadn't seen any proof,
but that hadn't stopped him from spending a great deal of time feeling
very stressed about how the judge would view the matter.
The only answer seemed to be some good, independent technical advice.
At the request of both Pad and Gandalf's lawyers, Dr Peter Mills, of
Manchester University, and Dr Russell Lloyd, of London Business
School, had examined a large amount of technical evidence presented in
the prosecution's papers. In an independent report running to more
than 23 pages, the experts stated that the hackers had caused less
havoc than the prosecution alleged. In addition, Pad's solicitor asked
Dr Mills to specifically review, in a separate report, the evidence
supporting the prosecution's large damage claim.
Dr Mills stated that one of the police expert witnesses, a British
Telecom employee, had said that Digital recommended a full rebuild of
the system at the earliest possible opportunity--and at considerable
cost. However, the BT expert had not stated that the cost was
[sterling]250000 nor even mentioned if the cost quote which had been
given had actually been accepted.
In fact, Dr Mills concluded that there was no supporting evidence at
all for the quarter of a million pound claim. Not only that, but any
test of reason based on the evidence provided by the prosecution
showed the claim to be completely ridiculous.
In a separate report, Dr Mills' stated that:
i) The machine concerned was a Vax 6320, this is quite a powerful
`mainframe' system and could support several hundreds of users.
ii) That a full dump of files takes 6 tapes, however since the type of
tape is not specified this gives no real indication of the size of the
filesystem. A tape could vary from 0.2 Gigabytes to 2.5 Gigabytes.
iii) The machine was down for three days.
With this brief information it is difficult to give an accurate cost
for restoring the machine, however an over estimate would be:
i) Time spent in restoring the system, 10 man days at [sterling]300
per day; [sterling]3000.
ii) Lost time by users, 30 man days at [sterling]300 per day;
[sterling]9000.
The total cost in my opinion is unlikely to be higher than
[sterling]12000 and this itself is probably a rather high estimate. I
certainly cannot see how a figure of [sterling]250000 could be
justified.
It looked to Pad that the prosecution's claim was not for damage at
all. It was for properly securing the system--an entirely rebuilt
system. It seemed to him that the police were trying to put the cost
of securing the polytechnic's entire computer network onto the
shoulders of one hacker--and to call it damages. In fact, Pad
discovered, the polytechnic had never actually even spent the
[sterling]250000.
Pad was hopeful, but he was also angry. All along, the police had been
threatening him with this huge damage bill. He had tossed and turned
in his bed at night worrying about it. And, in the end, the figure put
forward for so long as fact was nothing but an outrageous claim based
on not a single shred of solid evidence.
Using Dr Mills's report, Pad's barrister, Mukhtar Hussain, QC,
negotiated privately with the prosecution barrister, who finally
relented and agreed to reduce the damage estimate to [sterling]15000.
It was, in Pad's view, still far too high, but it was much better than
[sterling]250000. He was in no mind to look a gift horse in the mouth.
Judge Harris accepted the revised damage estimate.
The prosecution may have lost ground on the damage bill, but it wasn't
giving up the fight. These two hackers, James Richardson told the
court and journalists during the two-day sentencing hearing, had
hacked into some 10000 computer systems around the world. They were
inside machines or networks in at least fifteen countries. Russia.
India. France. Norway. Germany. The US. Canada. Belgium. Sweden.
Italy. Taiwan. Singapore. Iceland. Australia. Officers on the case
said the list of the hackers' targets `read like an atlas', Richardson
told the court.
Pad listened to the list. It sounded about right. What didn't sound
right were the allegations that he or Gandalf had crashed Sweden's
telephone network by running an X.25 scanner over its packet network.
The crash had forced a Swedish government minister to apologise on
television. The police said the minister did not identify the true
cause of the problem--the British hackers--in his public apology.
Pad had no idea what they were talking about. He hadn't done anything
like that to the Swedish phone system, and as far as he knew, neither
had Gandalf.
Something else didn't sound right. Richardson told the court that in
total, the two hackers had racked up at least [sterling]25000 in phone
bills for unsuspecting legitimate customers, and caused `damage' to
systems which was very conservatively estimated at almost
[sterling]123000.
Where were these guys getting these numbers from? Pad marvelled at
their cheek. He had been through the evidence with a fine-toothed
comb, yet he had not seen one single bill showing what a site had
actually paid to repair `damage' caused by the hackers. The figures
tossed around by the police and the prosecution weren't real bills;
they weren't cast in iron.
Finally, on Friday 21 May, after all the evidence had been presented,
the judge adjourned the court to consider sentencing. When he returned
to the bench fifteen minutes later, Pad knew what was going to happen
from the judge's face. To the hacker, the expression said: I am going
to give you everything that Wandii should have got.
Judge Harris echoed The Times's sentiments when he told the two
defendants, `If your passion had been cars rather than computers, we
would have called your conduct delinquent, and I don't shrink from the
analogy of describing what you were doing as intellectual joyriding.
`Hacking is not harmless. Computers now form a central role in our
lives. Some, providing emergency services, depend on their computers
to deliver those services.'13
Hackers needed to be given a clear signal that computer crime `will
not and cannot be tolerated', the judge said, adding that he had
thought long and hard before handing down sentence. He accepted that
neither hacker had intended to cause damage, but it was imperative to
protect society's computer systems and he would be failing in his
public duty if he didn't sentence the two hackers to a prison term of
six months.
Judge Harris told the hackers that he had chosen a custodial sentence,
`both to penalise you for what you have done and for the losses
caused, and to deter others who might be similarly tempted'.
This was the show trial, not Wandii's case, Pad thought as the court
officers led him and Gandalf out of the dock, down to the prisoner's
lift behind the courtroom and into a jail cell.
Less than two weeks after Pad and Gandalf were sentenced, Electron was
back in the Victorian County Court to discover his own fate.
As he stood in the dock on 3 June 1993 he felt numb, as emotionally
removed from the scene as Meursault in Camus' L'etranger. He believed
he was handling the stress pretty well until he experienced tunnel
vision while watching the judge read his penalty. He perused the room
but saw neither Phoenix nor Nom.
When Judge Anthony Smith summarised the charges, he seemed to have a
special interest in count number 13--the Zardoz charge. A few minutes
into reading the sentence, the judge said, `In my view, a custodial
sentence is appropriate for each of the offences constituted by the
12th, 13th and 14th counts'. They were the `knowingly concerned'
charges, with Phoenix, involving NASA, LLNL and CSIRO. Electron looked
around the courtroom. People turned back to stare at him. Their eyes
said, `You are going to prison'.
`I formed the view that a custodial sentence is appropriate in respect
of each of these offences because of the seriousness of them,' Judge
Smith noted, `and having regard to the need to demonstrate that the
community will not tolerate this type of offence.
`Our society today is ... increasingly ... dependent upon the use of
computer technology. Conduct of the kind in which you engaged poses a
threat to the usefulness of that technology ... It is incumbent upon
the courts ... to see to it that the sentences they impose reflect the
gravity of this kind of criminality.
`On each of Counts 12, 13 and 14, you are convicted and you are
sentenced to a term of imprisonment of six months ... each ... to be
concurrent.'
The judge paused, then continued, `And ... I direct, by order, that
you be released forthwith upon your giving security by recognisance
... in the sum of $500 ... You will not be required to serve the terms
of imprisonment imposed, provided you are of good behaviour for the
ensuing six months.' He then ordered Electron to complete 300 hours of
community service, and to submit to psychiatric assessment and
treatment.
Electron breathed a sigh of relief.
When outlining the mitigating circumstances which led to suspension of
the jail sentence, Judge Smith described Electron as being addicted to
using his computer `in much the same way as an alcoholic becomes
addicted to the bottle'. Boris Kayser had used the analogy in the
sentencing hearing, perhaps for the
benefit of the media, but the judge had obviously been swayed by his
view.
When court adjourned, Electron left the dock and shook hands with his
lawyers. After three years, he was almost free of his court problems.
There was only one possible reason he might need to return to court.
If Phoenix fought out his case in a full criminal trial, the DPP would
put Electron on the stand to testify against him. It would be an ugly
scene.
The inmates of HM Prison Kirkham, on the north-west coast of England,
near Preston, had heard all about Pad and Gandalf by the time they
arrived. They greeted the hackers by name. They'd seen the reports on
telly, especially about how Gandalf had hacked NASA--complete with
footage of the space shuttle taking off. Some TV reporter's idea of
subtle irony--`Two hackers were sent down today' as the space shuttle
went up.
Kirkham was far better than Brixton, where the hackers had spent the
first days of their sentence while awaiting transfer. Brixton was what
Pad always envisioned prison would look like, with floors of barred
cells facing onto an open centre and prisoners only allowed out of
their cells for scheduled events such as time in the yard. It was a
place where hard-core criminals lived. Fortunately, Pad and Gandalf
had been placed in the same cell while they waited to be assigned to
their final destination.
After ten days inside Brixton Pad and Gandalf were led from their
cell, handcuffed and put in a coach heading toward the windy west
coast.
During the drive, Pad kept looking down at his hand, locked in shiny
steel to Gandalf's hand, then he looked back up again at his fellow
hacker. Clearing his throat and turning away from Gandalf's difficult
grin--his friend now on the edge of laughing himself--Pad struggled.
He tried to hold down the muscles of his face, to pull them back from
laughter.
A minimum security prison holding up to 632 prisoners, Kirkham looked
vaguely like a World War II RAF base with a large collection of
free-standing buildings around the grounds. There were no real walls,
just a small wire fence which Pad soon learned prisoners routinely
jumped when the place started to get to them.
For a prison, Kirkham was pretty good. There was a duck pond, a
bowling green, a sort of mini-cinema which showed films in the early
evenings, eight pay phones, a football field, a cricket pavilion and,
best of all, lots of fields. Prisoners could have visits on weekday
afternoons between 1.10 and 3.40, or on the weekend.
Luck smiled on the two hackers. They were assigned to the same billet
and, since none of the other prisoners objected, they became
room-mates. Since they were sentenced in May, they would serve their
time during summer. If they were `of good behaviour' and didn't get
into trouble with other prisoners, they would be out in three months.
Like any prison, Kirkham had its share of prisoners who didn't get
along with each other. Mostly, prisoners wanted to know what you were
in for and, more particularly, if you had been convicted of a sex
crime. They didn't like sex crime offenders and Pad heard about a pack
of Kirkham prisoners who dragged one of their own, screaming, to a
tree, where they tried to hang him for being a suspected rapist. In
fact, the prisoner hadn't been convicted of anything like rape. He had
simply refused to pay his poll tax.
Fortunately for Pad and Gandalf, everyone else in Kirkham knew why
they were there. At the end of their first week they returned to their
room one afternoon to find a sign painted above their door. It said,
`NASA HQ'.
The other minimum security prisoners understood hacking--and they had
all sorts of ideas about how you could make money from it. Most of the
prisoners in Kirkham were in for petty theft, credit card fraud, and
other small-time crimes. There was also a phreaker, who arrived the
same day as Pad and Gandalf. He landed eight months in prison--two
more than the 8lgm hackers--and Pad wondered what kind of message that
sent the underground.
Despite their best efforts, the 8lgm twosome didn't fit quite the
prison mould. In the evenings, other prisoners spent their free time
shooting pool or taking drugs. In the bedroom down the hall, Gandalf
lounged on his bed studying a book on VMS internals. Pad read a
computer magazine and listened to some indie music--often his `Babes
in Toyland' tape. In a parody of prison movies, the two hackers marked
off their days inside the prison with cross-hatched lines on their
bedroom wall--four marks, then a diagonal line through them. They
wrote other things on the walls too.
The long, light-filled days of summer flowed one into the other, as
Pad and Gandalf fell into the rhythm of the prison. The morning
check-in at 8.30 to make sure none of the prisoners had gone
walkabout. The dash across the bowling green for a breakfast of beans,
bacon, eggs, toast and sausage. The walk to the greenhouses where the
two hackers had been assigned for work detail.
The work wasn't hard. A little digging in the pots. Weeding around the
baby lettuce heads, watering the green peppers and transplanting
tomato seedlings. When the greenhouses became too warm by late
morning, Pad and Gandalf wandered outside for a bit of air. They often
talked about girls, cracking crude, boyish jokes about women and
occasionally discussing their girlfriends more seriously. As the heat
settled in, they sat down, lounging against the side of the
greenhouse.
After lunch, followed by more time in the greenhouse, Pad and Gandalf
sometimes went off for walks in the fields surrounding the prison.
First the football field, then the paddocks dotted with cows beyond
it.
Pad was a likeable fellow, largely because of his easygoing style and
relaxed sense of humour. But liking him wasn't the same as knowing
him, and the humour often deflected deeper probing into his
personality. But Gandalf knew him, understood him. Everything was so
easy with Gandalf. During the long, sunny walks, the conversation
flowed as easily as the light breeze through the grass.
As they wandered in the fields, Pad often wore his denim jacket. Most
of the clothes on offer from the prison clothing office were drab
blue, but Pad had lucked onto this wonderful, cool denim jacket which
he took to wearing all the time.
Walking for hours on end along the perimeters of the prison grounds,
Pad saw how easy it would be to escape, but in the end there didn't
seem to be much point. They way he saw it, the police would just catch
you and put you back in again. Then you'd have to serve extra time.
Once a week, Pad's parents came to visit him, but the few precious
hours of visiting time were more for his parents' benefit than his
own. He reassured them that he was OK, and when they looked him in the
face and saw it was true, they stopped worrying quite so much. They
brought him news from home, including the fact that his computer
equipment had been returned by one of the police who had been in the
original raid.
The officer asked Pad's mother how the hacker was doing in prison.
`Very well indeed,' she told him. `Prison's not nearly so bad as he
thought.' The officer's face crumpled into a disappointed frown. He
seemed to be looking for news that Pad was suffering nothing but
misery.
At the end of almost three months, with faces well tanned from walking
in the meadows, Pad and Gandalf walked free.
To the casual witness sitting nearby in the courtroom, the tension
between Phoenix's mother and father was almost palpable. They were not
sitting near each other but that didn't mitigate the silent hostility
which rose through the air like steam. Phoenix's divorced parents
provided a stark contrast to Nom's adopted parents, an older, suburban
couple who were very much married.
On Wednesday, 25 August 1993 Phoenix and Nom pleaded guilty to fifteen
and two charges respectively. The combined weight of the prosecution's
evidence, the risk and cost of running a full trial and the need to
get on with their lives had pushed them over the edge. Electron didn't
need to come to court to give evidence.
At the plea hearing, which ran over to the next day, Phoenix's lawyer,
Dyson Hore-Lacy, spent considerable time sketching the messy divorce
of his client's parents for the benefit of the judge. Suggesting
Phoenix retreated into his computer during the bitter separation and
divorce was the best chance of getting him off a prison term. Most of
all, the defence presented Phoenix as a young man who had strayed off
the correct path in life but was now back on track--holding down a job
and having a life.
The DPP had gone in hard against Phoenix. They seemed to want a jail
term badly and they doggedly presented Phoenix as an arrogant
braggart. The court heard a tape-recording of Phoenix ringing up
security guru Edward DeHart of the Computer Emergency Response Team at
Carnegie Mellon University to brag about a security exploit. Phoenix
told DeHart to get onto his computer and then proceeded to walk him
step by step through the `passwd -f' security bug. Ironically, it was
Electron who had discovered that security hole and taught it to
Phoenix--a fact Phoenix didn't seem to want to mention to DeHart.
The head of the AFP's Southern Region Computer Crimes Unit, Detective
Sergeant Ken Day was in court that day. There was no way he was going
to miss this. The same witness noting the tension between Phoenix's
parents might also have perceived an undercurrent of hostility between
Day and Phoenix--an undercurrent which did not seem to exist between
Day and either of the other Realm hackers.
Day, a short, careful man who gave off an air of bottled intensity,
seemed to have an acute dislike for Phoenix. By all observations the
feeling was mutual. A cool-headed professional, Day would never say
anything in public to express the dislike--that was not his style. His
dislike was only indicated by a slight tightness in the muscles of an
otherwise unreadable face.
On 6 October 1993, Phoenix and Nom stood side by side in the dock for
sentencing. Wearing a stern expression, Judge Smith began by detailing
both the hackers' charges and the origin of The Realm. But after the
summary, the judge saved his harshest rebuke for Phoenix.
`There is nothing ... to admire about your conduct and every reason
why it should be roundly condemned. You pointed out [weaknesses] to
some of the system administrators ... [but] this was more a display of
arrogance and a demonstration of what you thought was your superiority
rather than an act of altruism on your part.
`You ... bragged about what you had done or were going to do ... Your
conduct revealed ... arrogance on your part, open defiance, and an
intention to the beat the system. [You] did cause havoc for a time
within the various targeted systems.'
Although the judge appeared firm in his views while passing sentence,
behind the scenes he had agonised greatly over his decision. He had
attempted to balance what he saw as the need for deterrence, the
creation of a precedence for sentencing hacking cases in Australia,
and the individual aspects of this case. Finally, after sifting
through the arguments again and again, he had reached a decision.
`I have no doubt that some sections of our community would regard
anything than a custodial sentence as less than appropriate. I share
that view. But after much reflection ... I have concluded that an
immediate term of imprisonment is unnecessary.'
Relief rolled across the faces of the hackers' friends and relatives
as the judge ordered Phoenix to complete 500 hours of community
service work over two years and assigned him a $1000 twelve-month good
behaviour bond. He gave Nom 200 hours, and a $500, six-month bond for
good behaviour.
As Phoenix was leaving the courtroom, a tall, skinny young man, loped
down the aisle towards him.
`Congratulations,' the stranger said, his long hair dangling in
delicate curls around his shoulders.
`Thanks,' Phoenix answered, combing his memory for the boyish face
which couldn't be any older than his own. `Do I know you?'
`Sort of,' the stranger answered. `I'm Mendax. I'm about to go through
what you did, but worse.'