Contents | Previous: Chapter 6 -- Page 1 The New York Times | Next: Chapter 8 -- The International Subversives
Your dream world is just about to end
-- from `Dreamworld', on Diesel and Dust by Midnight Oil
In another corner of the globe, the British hackers Pad and Gandalf learned with horror that the Australian authorities had busted the three Realm hackers. Electron had simply disappeared one day. A short time later, Phoenix was gone too. Then the reports started rolling in from newspapers and from other Australian hackers on a German board similar to Altos, called Lutzifer.
Something else worried Pad. In one of his hacking forays, he had discovered a file, apparently written by Eugene Spafford, which said he was concerned that some British hackers--read Pad and Gandalf--would create a new worm, based on the RTM worm, and release it into the Internet. The unnamed British hackers would then be able to cause maximum havoc on thousands of Internet sites.
It was true that Gandalf and Pad had captured copies of various worm source codes. They fished around inside SPAN until they surfaced with a copy of the Father Christmas worm. And, after finally successfully hacking Russell Brand's machine at LLNL, they deftly lifted a complete copy of the WANK worm. In Brand's machine, they also found a description of how someone had broken into SPAN looking for the WANK worm code, but hadn't found it. `That was me breaking into SPAN to look around,' Gandalf laughed, relaying the tale to Pad.
Despite their growing library of worm code, Pad had no intention of writing any such worm. They simply wanted the code to study what penetration methods the worms had used and perhaps to learn something new. The British hackers prided themselves on never having done anything destructive to systems they hacked. In places where they knew their activities had been discovered--such as at the Universities of Bath, Edinburgh, Oxford and Strathclyde--they wrote notes to the admins signed 8lgm. It wasn't only an ego thing--it was also a way of telling the admins that they weren't going to do anything nasty to the system.
At one university, the admins thought 8lgm was some kind of weird variation on a Belgian word and that the hackers who visited their systems night after night were from Belgium. At another uni, the admins made a different guess at the meaning. In the morning, when they came into work and saw that the hackers had been playing in their system all night, they would sigh to each other, `Our eight little green men are at it again'.
At the University of Lancaster, the hackers wrote a message to the admins which said: `Don't do anything naughty. We have a good image around the world, so please don't tarnish it or start making up stories about us messing up systems. Don't hold your breath for us to hack you, but keep us in mind.' Wherever they went, their message was the same.
Nonetheless Pad visualised a scenario where Spaf whipped up the computer security and law enforcement people into a frenzied panic and tried to pin all sorts of things on the British hackers, none of which they had done. The underground saw Spaf as being rabid in his attack on hackers, based largely on his response to the RTM worm. And Gandalf had hacked Spaf's machine.
The crackdown on the Australians, combined with the discovery of the Spaf file, had a profound effect on Pad. Always cautious anyway, he decided to give up hacking. It was a difficult decision, and weaning himself from exploring systems night after night was no easy task. However, in the face of what had happened to Electron and Phoenix, continuing to hack didn't seem worth the risk.
When Pad gave up hacking, he bought his own NUI so he could access places like Altos legitimately. The NUI was expensive--about10 an hour--but he was never on for long. Leisurely chats of the type he once enjoyed in Altos were out of the question, but at least he could mail letters to his friends like Theorem and Gandalf. There would have been easier ways to maintain his friendship with Gandalf, who lived in Liverpool, only an hour's drive away. But it wouldn't be the same. Pad and Gandalf had never met, or even talked on the phone. They talked on-line, and via email. That was the way they related.
Pad also had other reasons for giving up hacking. It was an expensive habit in Britain because British Telecom time-charged for local phone calls. In Australia, a hacker could stay on-line for hours, jumping from one computer to another through the data network, all for the cost of one local call. Like the Australians, Pad could launch his hacking sessions from a local uni or X.25 dial-up. However, an all-night hacking session based on a single phone call might still cost him5 or more in timed-call charges--a considerable amount of money for an unemployed young man. As it was, Pad had already been forced to stop hacking for brief periods when he ran out of his dole money.
Although Pad didn't think he could be prosecuted for hacking under British law in early 1990, he knew that Britain was about to enact its own computer crime legislation--the Computer Misuse Act 1990--in August. The 22-year-old hacker decided that it was better to quit while he was ahead.
And he did, for a while at least. Until July 1990, when Gandalf, two years his junior, tempted him with one final hack before the new Act came into force. Just one last fling, Gandalf told him. After that last fling in July, Pad stopped hacking again.
The Computer Misuse Act passed into law in August 1990, following two law commission reviews on the subject. The Scottish Law Commission issued a 1987 report proposing to make unauthorised data access illegal, but only if the hacker tried to `secure advantage, or cause damage to another person'--including reckless damage.2 Simple look-see hacking would not be a crime under the report's recommendations. However, in 1989 The Law Commission of England and Wales issued its own report proposing that simple unauthorised access should be a crime regardless of intent--a recommendation which was eventually included in the law.
Late in 1989, Conservative MP Michael Colvin introduced a private member's bill into the British parliament. Lending her support to the bill, outspoken hacker-critic Emma Nicholson, another Conservative MP, fired public debate on the subject and ensured the bill passed through parliament successfully.
In November 1990, Pad was talking on-line with Gandalf, and his friend suggested they have one more hack, just one more, for old time's sake. Well, thought Pad, one more--just a one-off thing--wouldn't hurt.
Before long, Pad was hacking regularly again, and when Gandalf tried to give it up, Pad was there luring him to return to his favourite pastime. They were like two boys at school, getting each other into trouble--the kind of trouble which always comes in pairs. If Pad and Gandalf hadn't known each other, they probably would both have walked away from hacking forever in 1990.
As they both got back into the swing of things, they tried to make light of the risk of getting caught. `Hey, you know,' Gandalf joked on-line more than once, `the first time we actually meet each other in person will probably be in a police station.'
Completely irreverent and always upbeat, Gandalf proved to be a true friend. Pad had rarely met such a fellow traveller in the real world, let alone on-line. What others--particularly some American hackers--viewed as prickliness, Pad saw as the perfect sense of humour. To Pad, Gandalf was the best m8 a fellow could ever have.
During the time Pad avoided hacking, Gandalf had befriended another, younger hacker named Wandii, also from the north of England. Wandii never played much of a part in the international computer underground, but he did spend a lot of time hacking European computers. Wandii and Pad got along pleasantly but they were never close. They were acquaintances, bound by ties to Gandalf in the underground.
By the middle of June 1991, Pad, Gandalf and Wandii were peaking. At least one of them--and often more--had already broken into systems belonging to the European Community in Luxembourg, The Financial Times (owners of the FTSE 100 share index), the British Ministry of Defence, the Foreign Office, NASA, the investment bank SG Warburg in London, the American computer database software manufacturer Oracle, and more machines on the JANET network than they could remember. Pad had also penetrated a classified military network containing a NATO system. They moved through British Telecom's Packet Switched Stream Network (PSS), which was similar to the Tymnet X.25 network, with absolute ease.3
Gandalf's motto was, `If it moves, hack it'.
On 27 June 1991, Pad was sitting in the front room of his parent's comfortable home in greater Manchester watching the last remnants of daylight disappear on one of the longest days of the year. He loved summer, loved waking up to streaks of sunlight sneaking through the cracks in his bedroom curtain. He often thought to himself, it doesn't get much better than this.
Around 11 p.m. he flicked on his modem and his Atari 520 ST computer in the front sitting room. There were two Atari computers in the house--indicative of his deep enthusiasm for computers since neither his siblings nor his parents had any interest in programming. Most of the time, however, Pad left the older Atari alone. His elder brother, an aspiring chemist, used it for writing his PhD thesis.
Before dialling out, Pad checked that no-one was on the house's single phone line. Finding it free, he went to check his email on Lutzifer. A few minutes after watching his machine connect to the German board, he heard a soft thud, followed by a creaking. Pad stopped typing, looked up from his machine and listened. He wondered if his brother, reading in their bedroom upstairs, or his parents, watching telly in the back lounge room, could hear the creaking.
The sound became more pronounced and Pad swung around and looked toward the hallway. In a matter of seconds, the front door frame had been cracked open, prising the door away from its lock. The wood had been torn apart by some sort of car jack, pumped up until the door gave way.
Suddenly, a group of men burst through from the front doorstep, dashed down the long hallway and shot up the carpeted stairs to Pad's bedroom.
Still sitting at his computer downstairs, Pad swiftly flicked his modem, and then his computer, off--instantly killing his connection and everything on his screen. He turned back toward the door leading to the sitting room and strained to hear what was happening upstairs. If he wasn't so utterly surprised, he would almost have laughed. He realised that when the police had dashed up to his bedroom, they had been chasing every stereotype about hackers they had probably ever read. The boy. In his bedroom. Hunched over his computer. Late at night.
They did find a young man in the bedroom, with a computer. But it was the wrong one, and for all intents and purposes the wrong computer. It took the police almost ten minutes of quizzing Pad's brother to work out their mistake.
Hearing a commotion, Pad's parents had rushed into the hallway while Pad peered from the doorway of the front sitting room. A uniformed police officer ushered everyone back into the room, and began asking Pad questions.
`Do you use computers? Do you use the name Pad on computers?' they asked.
Pad concluded the game was up. He answered their questions truthfully. Hacking was not such a serious crime after all, he thought. It wasn't as if he had stolen money or anything. This would be a drama, but he was easy-going. He would roll with the punches, cop a slap on the wrist and soon the whole thing would be over and done with.
The police took Pad to his bedroom and asked him questions as they searched the room. The bedroom had a comfortably lived-in look, with a few small piles of clothes in the corner, some shoes scattered across the floor, the curtains hanging crooked, and a collection of music posters--Jimi Hendrix and The Smiths--taped to the wall.
A group of police hovered around his computer. One of them began to search through Pad's books on the shelves above the PC, checking each one as he pulled it down. A few well-loved Spike Milligan works. Some old chess books from when he was captain of the local chess team. Chemistry books, purchased by Pad long before he took any classes in the subject, just to satisfy his curiosity. Physics books. An oceanography textbook. A geology book bought after a visit to a cave excited his interest in the formation of rocks. Pad's mother, a nursing sister, and his father, an electronics engineer who tested gyros on aircraft, had always encouraged their children's interest in the sciences.
The policeman returned those books to the shelves, only picking out the computer books, textbooks from programming and maths classes Pad had taken at a Manchester university. The officer carefully slid them inside plastic bags to be taken away as evidence.
Then the police picked through Pad's music tapes--The Stone Roses, Pixies, New Order, The Smiths and lots of indie music from the flourishing Manchester music scene. No evidence of anything but an eclectic taste in music there.
Another policeman opened Pad's wardrobe and peered inside. `Anything in here of interest?' he asked.
`No,' Pad answered. `It's all over here.' He pointed to the box of computer disks.
Pad didn't think there was much point in the police tearing the place to pieces, when they would ultimately find everything they wanted anyway. Nothing was hidden. Unlike the Australian hackers, Pad hadn't been expecting the police at all. Although part of the data on his hard drive was encrypted, there was plenty of incriminating evidence in the un-encrypted files.
Pad couldn't hear exactly what his parents were talking about with the police in the other room, but he could tell they were calm. Why shouldn't they be? It wasn't as if their son had done anything terrible. He hadn't beaten someone up in a fist fight at a pub, or robbed anyone. He hadn't hit someone while drunk driving. No, they thought, he had just been fiddling around with computers. Maybe poking around where he shouldn't have been, but that was hardly a serious crime. They needn't worry. It wasn't as if he was going to prison or anything. The police would sort it all out. Maybe some sort of citation, and the matter would be over and done. Pad's mother even offered to make cups of tea for the police.
One of the police struck up a conversation with Pad off to the side as he paused to drink his tea. He seemed to know that Pad was on the dole, and with a completely straight face, he said, `If you wanted a job, why didn't you just join the police?'
Pad paused for a reality check. Here he was being raided by nearly a dozen law enforcement officers--including representatives from BT and Scotland Yard's computer crimes unit--for hacking hundreds of computers and this fellow wanted to know why he hadn't just become a copper?
He tried not to laugh. Even if he hadn't been busted, there is no way he would ever have contemplated joining the police. Never in a million years. His family and friends, while showing a pleasant veneer of middle-class orderliness, were fundamentally anti-establishment. Many knew that Pad had been hacking, and which sites he had penetrated. Their attitude was: Hacking Big Brother? Good on you.
His parents were torn, wanting to encourage Pad's interest in computers but also worrying their son spent an inordinate amount of time glued to the screen. Their mixed feelings mirrored Pad's own occasional concern.
While deep in the throes of endless hacking nights, he would suddenly sit upright and ask himself, What am I doing here, fucking around on a computer all day and night? Where is this heading? What about the rest of life? Then he would disentangle himself from hacking for a few days or weeks. He would go down to the university pub to drink with his mostly male group of friends from his course.
Tall, with short brown hair, a slender physique and a handsomely boyish face, the soft-spoken Pad would have been considered attractive by many intelligent girls. The problem was finding those sort of girls. He hadn't met many when he was studying at university--there were few women in his maths and computer classes. So he and his friends used to head down to the Manchester nightclubs for the social scene and the good music.
Pad went downstairs with one of the officers and watched as the police unplugged his 1200 baud modem, then tucked it into a plastic bag. He had bought that modem when he was eighteen. The police unplugged cables, bundled them up and slipped them into labelled plastic bags. They gathered up his 20 megabyte hard drive and monitor. More plastic bags and labels.
One of the officers called Pad over to the front door. The jack was still wedged across the mutilated door frame. The police had broken down the door instead of knocking because they wanted to catch the hacker in the act--on-line. The officer motioned for Pad to follow him.
`Come on,' he said, leading the hacker into the night. `We're taking you to the station.'
Pad spent the night in a cell at the Salford Crescent police station, alone. No rough crims, and no other hackers either.
He settled into one of the metal cots lined against the perimeter of the cell, but sleep evaded him. Pad wondered if Gandalf had been raided as well. There was no sign of him, but then again, the police would hardly be stupid enough to lock up the two hackers together. He tossed and turned, trying to push thoughts from his head.
Pad had fallen into hacking almost by accident. Compared to others in the underground, he had taken it up at a late age--around nineteen. Altos had been the catalyst. Visiting BBSes, he read a file describing not only what Altos was, but how to get there--complete with NUI. Unlike the Australian underground, the embryonic British underground had no shortage of NUIs. Someone had discovered a stack of BT NUIs and posted them on BBSes across England.
Pad followed the directions in the BBS file and soon found himself in the German chat channel. Like Theorem, he marvelled at the brave new live world of Altos. It was wonderful, a big international party. After all, it wasn't every day he got to talk with Australians, Swiss, Germans, Italians and Americans. Before long, he had taken up hacking like so many other Altos regulars.
Hacking as a concept had always intrigued him. As a teenager, the film War Games had dazzled him. The idea that computers could communicate with each over telephone lines enthralled the sixteen-year-old, filling his mind with new ideas. Sometime after that he saw a television report on a group of hackers who claimed that they had used their skills to move satellites around in space--the same story which had first caught Electron's imagination.
Pad had grown up in Greater Manchester. More than a century before, the region had been a textile boom-town. But the thriving economy did not translate into great wealth for the masses. In the early 1840s, Friedrich Engels had worked in his father's cotton-milling factory in the area, and the suffering he saw in the region influenced his most famous work, The Communist Manifesto, published in 1848.
Manchester wore the personality of a working-class town, a place where people often disliked the establishment and distrusted authority figures. The 1970s and 1980s had not been kind to most of Greater Manchester, with unemployment and urban decay disfiguring the once-proud textile hub. But this decay only appeared to strengthen an underlying resolve among many from the working classes to challenge the symbols of power.
Pad didn't live in a public housing high-rise. He lived in a suburban middle-class area, in an old, working-class town removed from the dismal inner-city. But like many people from the north, he disliked pretensions. Indeed, he harboured a healthy degree of good-natured scepticism, perhaps stemming from a culture of mates whose favourite pastime was pulling each other's leg down at the pub.
This scepticism was in full-gear as he watched the story of how hackers supposedly moved satellites around in space, but somehow the idea slipped through the checkpoints and captured his imagination, just as it had done with Electron. He felt a desire to find out for himself if it was true and he began pursuing hacking in enthusiastic bursts. At first it was any moderately interesting system. Then he moved to the big-name systems--computers belonging to large institutions. Eventually, working with the Australians, he learned to target computer security experts. That was, after all, where the treasure was stored.
In the morning at the police station, a guard gave Pad something to eat which might have passed for food. Then he was escorted into an interview room with two plain-clothed officers and a BT representative.
Did he want a lawyer? No. He had nothing to hide. Besides, the police had already seized evidence from his house, including unencrypted data logs of his hacking sessions. How could he argue against that? So he faced his stern inquisitors and answered their questions willingly.
Suddenly things began to take a different turn when they began asking about the `damage' he had done inside the Greater London Polytechnic's computers. Damage? What damage? Pad certainly hadn't damaged anything.
Yes, the police told him. The damage totalling almost a quarter of a million pounds.
Pad gasped in horror. A quarter of a million pounds? He thought back to his many forays into the system. He had been a little mischievous, changing the welcome message to `Hi' and signing it 8lgm. He had made a few accounts for himself so he could log in at a later date. That seemed to be nothing special, however, since he and Gandalf had a habit of making accounts called 8lgm for themselves in JANET systems. He had also erased logs of his activities to cover his tracks, but again, this was not unusual, and he had certainly never deleted any computer users' files. The whole thing had just been a bit of fun, a bit of cat and mouse gaming with the system admins. There was nothing he could recall which would account for that kind of damage. Surely they had the wrong hacker?
No, he was the right one all right. Eighty investigators from BT, Scotland Yard and other places had been chasing the 8lgm hackers for two years. They had phone traces, logs seized from his computer and logs from the hacked sites. They knew it was him.
For the first time, the true gravity of the situation hit Pad. These people believed in some way that he had committed serious criminal damage, that he had even been malicious.
After about two hours of questioning, they put Pad back in his cell. More questions tomorrow, they told him.
Later that afternoon, an officer came in to tell Pad his mother and father were outside. He could meet with them in the visiting area. Talking through a glass barrier, Pad tried to reassure his worried parents. After five minutes, an officer told the family the visit was over. Amid hurried goodbyes under the impatient stare of the guard, Pad's parents told him they had brought something for him to read in his cell. It was the oceanography textbook.
Back in his cell, he tried to read, but he couldn't concentrate. He kept replaying his visits to the London Polytechnic over and over in his mind, searching for how he might have inadvertently done250000 worth of damage. Pad was a very good hacker; it wasn't as if he was some fourteen-year-old kid barging through systems like a bull in china shop. He knew how to get in and out of a system without hurting it.
Shortly after 8 p.m., as Pad sat on his cot stewing over the police damage claims, sombre music seemed to fill his cell. Slowly at first, an almost imperceptible moaning, which subtly transformed into solemn but recognisable notes. It sounded like Welsh choir music, and it was coming from above him.
Pad looked up at the ceiling. The music--all male voices-- stopped abruptly, then started again, repeating the same heavy, laboured notes. The hacker smiled. The local police choir was practising right above his cell.
After another fitful night, Pad faced one more round of interviews. The police did most of the questioning, but they didn't seem to know much about computers--well, not nearly so much as any good hacker on Altos. Whenever either of the police asked a technical question, they looked over to the BT guy at the other end of the table as if to say, `Does this make any sense?' The BT guy would give a slight nod, then the police looked back at Pad for an answer. Most of the time, he was able to decipher what they thought they were trying to ask, and he answered accordingly.
Then it was back to his cell while they processed his charge sheets. Alone again, Pad wondered once more if they had raided Gandalf. Like an answer from above, Pad heard telephone tones through the walls. The police seemed to be playing them over and over. That was when he knew they had Gandalf too.
Gandalf had rigged up a tone dialler in his computer. It sounded as if the police were playing with it, trying to figure it out.
So, Pad would finally meet Gandalf in person after two years. What would he look like? Would they have the same chemistry in person as on-line? Pad felt like he knew Gandalf, knew his essence, but meeting in person could be a bit tricky.
Explaining that the paperwork, including the charge sheets, had finally been organised, a police officer unlocked Pad's cell door and led him to a foyer, telling him he would be meeting both Gandalf and Wandii. A large collection of police had formed a semi-circle around two other young men. In addition to Scotland Yard's Computer Crimes Unit and BT, at least seven other police forces were involved in the three raids, including those from Greater Manchester, Merseyside and West Yorkshire. The officers were curious about the hackers.
For most of the two years of their investigation, the police didn't even know the hackers' real identities. After such a long, hard chase, the police had been forced to wait a little longer, since they wanted to nab each hacker while he was on-line. That meant hiding outside each hacker's home until he logged in somewhere. Any system would do and they didn't have to be talking to each other on-line--as long as the login was illegal. The police had sat patiently, and finally raided the hackers within hours of each other, so they didn't have time to warn one another.
So, at the end of the long chase and a well-timed operation, the police wanted to have a look at the hackers up close.
After the officer walked Pad up to the group, he introduced Gandalf. Tall, lean with brown hair and pale skin, he looked a little bit like Pad. The two hackers smiled shyly at each other, before one of the police pointed out Wandii, the seventeen-year-old schoolboy. Pad didn't get a good look at Wandii, because the police quickly lined the hackers up in a row, with Gandalf in the middle, to explain details to them. They were being charged under the Computer Misuse Act of 1990. Court dates would be set and they would be notified.
When they were finally allowed to leave, Wandii seemed to disappear. Pad and Gandalf walked outside, found a couple of benches and lay down, basking in the sun and chatting while they waited for their rides home.
Gandalf proved to be as easy to talk to in person as he was on-line. They exchanged phone numbers and shared notes on the police raids. Gandalf had insisted on meeting a lawyer before his interviews, but when the lawyer arrived he didn't have the slightest understanding of computer crime. He advised Gandalf to tell the police whatever they wanted to know, so the hacker did.
The trial was being held in London. Pad wondered why, if all three hackers were from the north, the case was being tried in the south. After all, there was a court in Manchester which was high enough to deal with their crimes.
Maybe it was because Scotland Yard was in London. Maybe they had started the paperwork down there. Maybe it was because they were being accused of hacking computers located within the jurisdiction of the Central Criminal Court--that court being the Old Bailey in London. But Pad's cynical side hazarded a different guess--a guess which seemed justified after a few procedural appearances in 1992 before the trial, which was set for 1993. For when Pad arrived at the Bow Street Magistrates Court for his committal in April 1992, he saw it packed out with the media, just as he had anticipated.
A few hackers also fronted up to fly the flag of the underground. One of them--a stranger--came up to Pad after court, patted him on the back and exclaimed enthusiastically, `Well done, Paddy!' Startled, Pad just looked at him and then smiled. He had no idea how to respond to the stranger.
Like the three Australian hackers, Pad, Gandalf and the little-known Wandii were serving as the test case for new hacking laws in their country. British law enforcement agencies had spent a fortune on the case--more than500000 according to the newspapers--by the time the 8lgm case went to trial. This was going to be a show case, and the government agencies wanted taxpayers to know they were getting their money's worth.
The hackers weren't being charged with breaking into computers. They were being charged with conspiracy, a more serious offence. While admitting the threesome did not hack for personal gain, the prosecution alleged the hackers had conspired to break into and modify computer systems. It was a strange approach to say the least, considering that none of the three hackers had ever met or even talked to the others before they were arrested.
It was not so strange, however, when looking at the potential penalties. If the hackers had been charged with simply breaking into a machine, without intending any harm, the maximum penalty was six months jail and a fine of up to5000. However, conspiracy, which was covered under a different section of the Act, could bring up to five years in jail and an unlimited amount in fines.
The prosecution was taking a big gamble. It would be harder to prove conspiracy charges, which required demonstration of greater criminal intent than lesser charges. The potential pay-off was of course also much greater. If convicted, the defendants in Britain's most important hacking case to date would be going to prison.
As with The Realm case, two hackers--Pad and Gandalf--planned to plead guilty while the third--in this case Wandii--planned to fight the charges every step of the way. Legal Aid was footing the bill for their lawyers, because the hackers were either not working or were working in such lowly paid, short-term jobs they qualified for free legal support.
Wandii's lawyers told the media that this showcase was tantamount to a state trial. It was the first major hacking case under the new legislation which didn't involve disgruntled employees. While having no different legal status from a normal trial, the term state trial suggested a greater degree of official wrath--the kind usually reserved for cases of treason.
On 22 February 1993, within two months of Electron's decision to turn Crown witness against Phoenix and Nom, the three 8lgm hackers stood in the dock at Southwark Crown Court in South London to enter pleas in their own case.
In the dim winter light, Southwark couldn't look less appealing, but that didn't deter the crowds. The courtroom was going to be packed, just as Bow Street had been. Scotland Yard detectives were turning out in force. The crowd shuffled toward Room 12.
The prosecution told the media they had about 800 computer disks full of evidence and court materials. If all the data had been printed out on A4 paper, the stack would tower more than 40 metres in the air, they said. Considering the massive amount of evidence being heaved, rolled and tugged through the building by teams of legal eagles, the choice of location--on the fifth floor--proved to be a challenge.
Standing in the dock next to Wandii, Pad and Gandalf pleaded guilty to two computer conspiracy charges: conspiring to dishonestly obtain telecommunications services, and conspiring to cause unauthorised modification to computer material. Pad also pleaded guilty to a third charge: causing damage to a computer. This last charge related to the almost a quarter of a million pounds worth of `damage' to the Central London Polytechnic. Unlike the Australians' case, none of the British hackers faced charges about specific sites such as NASA.
Pad and Gandalf pleaded guilty because they didn't think they had much choice. Their lawyers told them that, in light of the evidence, denying their guilt was simply not a realistic option. Better to throw yourself on the mercy of the court, they advised. As if to underline the point, Gandalf's lawyer had told him after a meeting at the end of 1992, `I'd like to wish you a happy Christmas, but I don't think it's going to be one'.
Wandii's lawyers disagreed. Standing beside his fellow hackers, Wandii pleaded not guilty to three conspiracy charges: plotting to gain unauthorised access to computers, conspiring to make unauthorised modifications to computer material, and conspiring to obtain telecommunications services dishonestly. His defence team was going to argue that he was addicted to computer hacking and that, as a result of this addiction, he was not able to form the criminal intent necessary to be convicted.
Pad thought Wandii's case was on shaky ground. Addiction didn't seem a plausible defence to him, and he noticed Wandii looked very nervous in court just after his plea.
Pad and Gandalf left London after their court appearance, returning to the north to prepare for their sentencing hearings, and to watch the progress of Wandii's case through the eyes of the media.
They weren't disappointed. It was a star-studded show. The media revved itself up for a feeding frenzy and the prosecution team, headed by James Richardson, knew how to feed the pack. He zeroed in on Wandii, telling the court how the schoolboy `was tapping into offices at the EC in Luxembourg and even the experts were worried. He caused havoc at universities all around the world'.4 To do this, Wandii had used a simple BBC Micro computer, a Christmas present costing200.
The hacking didn't stop at European Community's computer, Richardson told the eager crowd of journalists. Wandii had hacked Lloyd's, The Financial Times and Leeds University. At The Financial Times machine, Wandii's adventures had upset the smooth operations of the FTSE 100 share index, known in the City as `footsie'. The hacker installed a scanning program in the FT's network, resulting in one outgoing call made every second. The upshot of Wandii's intrusion: a704 bill, the deletion of an important file and a management decision to shut down a key system. With the precision of a banker, FT computer boss Tony Johnson told the court that the whole incident had cost his organisation24871.
But the FT hack paled next to the prosecution's real trump card: The European Organisation for the Research and Treatment of Cancer in Brussels. They had been left with a10000 phone bill as a result of a scanner Wandii left on its machine,5 the court was told. The scanner had left a trail of 50000 calls, all documented on a 980-page phone bill.
The scanner resulted in the system going down for a day, EORTC information systems project manager Vincent Piedboeuf, told the jury. He went on to explain that the centre needed its system to run 24 hours a day, so surgeons could register patients. The centre's database was the focal point for pharmaceutical companies, doctors and research centres--all coordinating their efforts in fighting the disease.
For the media, the case was headline heaven. `Teenage computer hacker "caused worldwide chaos"' the Daily Telegraph screamed across page one. On page three, the Daily Mail jumped in with `Teenage hacker "caused chaos for kicks"'. Even The Times waded into the fray. Smaller, regional newspapers pulled the story across the countryside to the far reaches of the British Isles. The Herald in Glasgow told its readers `Teenage hacker "ran up10000 telephone bill"'. Across the Irish Sea, the Irish Times caused a splash with its headline, `Teenage hacker broke EC computer security'.
Also in the first week of the case, The Guardian announced Wandii had taken down the cancer centre database. By the time The Independent got hold of the story, Wandii hadn't just shut down the database, he had been reading the patients' most intimate medical details: `Teenager "hacked into cancer patient files"'. Not to be outdone, on day four of the trial, the Daily Mail had christened Wandii as a `computer genius'. By day five it labelled him as a `computer invader' who `cost FT25000'.
The list went on. Wandii, the press announced, had hacked the Tokyo Zoo and the White House. It was difficult to tell which was the more serious offence.
Wandii's defence team had a few tricks of its own. Ian MacDonald, QC, junior counsel Alistair Kelman and solicitor Deborah Tripley put London University Professor James Griffith-Edwards, an authoritative spokesman on addictive and compulsive behaviours, on the stand as an expert witness. The chairman of the National Addiction Centre, the professor had been part of a team which wrote the World Health Organisation's definition of addiction. No-one was going to question his qualifications.
The professor had examined Wandii and he announced his conclusion to the court: Wandii was obsessed by computers, he was unable to stop using them, and his infatuation made it impossible for him to choose freely. `He repeated 12 times in police interviews, "I'm just addicted. I wish I wasn't",' Griffith-Edwards told the court. Wandii was highly intelligent, but was unable to escape from the urge to beat computers' security systems at their own game. The hacker was obsessed by the intellectual challenge. `This is the core ... of what attracts the compulsive gambler,' the professor explained to the entranced jury of three women and nine men.
But Wandii, this obsessive, addicted, gifted young man, had never had a girlfriend, Griffith-Edwards continued. In fact, he shyly admitted to the professor that he wouldn't even know how to ask a girl out. `He became profoundly embarrassed when asked to talk about his own feelings. He simply couldn't cope when asked what sort of person he was.'6
People in the jury edged forward in their seats, concentrating intently on the distinguished professor. And why wouldn't they? This was amazing stuff. This erudite man had delved inside the mind of the young man of bizarre contrasts. A man so sophisticated that he could pry open computers belonging to some of Britain's and Europe's most prestigious institutions, and yet at the same time so simple that he had no idea how to ask a girl on a date. A man who was addicted not to booze, smack or speed, which the average person associates with addiction, but to a computer--a machine most people associated with kids' games and word processing programs.
The defence proceeded to present vivid examples of Wandii's addiction. Wandii's mother, a single parent and lecturer in English, had terrible trouble trying to get her son away from his computer and modem. She tried hiding his modem. He found it. She tried again, hiding it at his grandmother's house. He burgled granny's home and retrieved it. His mother tried to get at his computer. He pushed her out of his attic room and down the stairs.
Then he ran up a700 phone bill as a result of his hacking. His mother switched off the electricity at the mains. Her son reconnected it. She installed a security calling-code on the phone to stop him calling out. He broke it. She worried he wouldn't go out and do normal teenage things. He continued to stay up all night--and sometimes all day--hacking. She returned from work to find him unconscious--sprawled across the living room floor and looking as though he was dead. But it wasn't death, only sheer exhaustion. He hacked until he passed out, then he woke up and hacked some more.
The stories of Wandii's self-confessed addiction overwhelmed, appalled and eventually engendered pity in the courtroom audience. The media began calling him `the hermit hacker'.
Wandii's defence team couldn't fight the prosecution's evidence head-on, so they took the prosecution's evidence and claimed it as their own. They showed the jury that Wandii hadn't just hacked the institutions named by the prosecution; he had hacked far, far more than that. He didn't just hack a lot--he hacked too much. Most of all, Wandii's defence team gave the jury a reason to acquit the innocent-faced young man sitting before them.
During the trial, the media focused on Wandii, but didn't completely ignore the other two hackers. Computer Weekly hunted down where Gandalf was working and laid it bare on the front page. A member of `the UK's most notorious hacking gang', the journal announced, had been working on software which would be used at Barclay's Bank.7 The implication was clear. Gandalf was a terrible security risk and should never be allowed to do any work for a financial institution. The report irked the hackers, but they tried to concentrate on preparing for their sentencing hearing.
From the beginning of their case, the hackers had problems obtaining certain evidence. Pad and Gandalf believed some of the material seized in the police raids would substantially help their case--such as messages from admins thanking them for pointing out security holes on their systems. This material had not been included in the prosecution's brief. When the defendants requested access to it, they were refused access on the grounds that there was classified data on the optical disk. They were told to go read the Attorney-General's guidelines on disclosure of information. The evidence of the hackers' forays into military and government systems was jumbled in with their intrusions into computers such as benign JANET systems, the defence team was told. It would take too much time to separate the two.
Eventually, after some wrangling, Pad and Gandalf were told they could inspect and copy material--provided it was done under the supervision of the police. The hackers travelled to London, to Holborn police station, to gather supporting evidence for their case. However, it soon became clear that this time-consuming exercise would be impossible to manage on an ongoing basis. Finally, the Crown Prosecution Service relented, agreeing to release the material on disk to Pad's solicitor, on the proviso that no copies were made, it did not leave the law office, and it was returned at the end of the trial.
As Wandii's case lurched from revelation to exaggeration, Pad and Gandalf busily continued to prepare for their own sentencing hearing. Every day, Gandalf travelled from Liverpool to Manchester to meet with his friend. They picked up a handful of newspapers at the local agent, and then headed up to Pad's lawyer's office. After a quick scan for articles covering the hacking case, the two hackers began sifting through the reluctantly released prosecution disks. They read through the material on computer, under the watchful eye of the law office's cashier--the most computer literate person in the firm.
After fifteen days in the Southwark courtroom listening to fantastic stories from both sides about the boy sitting before them, the jury in Wandii's trial retired to consider the evidence. Before they left, Judge Harris gave them a stern warning: the argument that Wandii was obsessed or dependent was not a defence against the charges.
It took the jurors only 90 minutes to reach a decision, and when the verdict was read out the courtroom erupted with a wave of emotion.
Not guilty. On all counts.
Wandii's mother burst into a huge smile and turned to her son, who was also smiling. And the defence team couldn't be happier. Kelman told journalists, `The jury felt this was a sledge hammer being used to crack a nut'.8
The prosecution was stunned and the law enforcement agents flabbergasted. Detective Sergeant Barry Donovan found the verdict bizarre. No other case in his 21 years in law enforcement had as much overwhelming evidence as this one, yet the jury had let Wandii walk.
And in a high-pitched frenzy rivalling its earlier hysteria, the British media jumped all over the jury's decision. `Hacker who ravaged systems walks free', an indignant Guardian announced. `Computer Genius is cleared of hacking conspiracy', said the Evening Standard. `Hacking "addict" acquitted', sniffed The Times. Overpowering them all was the Daily Telegraph's page one: `Teenage computer addict who hacked White House system is cleared'.
Then came the media king-hit. Someone had leaked another story and it looked bad. The report, in the Mail on Sunday, said that the three hackers had broken into a Cray computer at the European Centre for Medium Range Weather Forecasting at Bracknell. This computer, likes dozens of others, would normally have been relegated to the long list of unmentioned victims except for one thing. The US military used weather data from the centre for planning its attack on Iraq in the Gulf War. The media report claimed that the attack had slowed down the Cray's calculations, thus endangering the whole Desert Storm operation. The paper announced the hackers had been `inadvertently jeopardising--almost fatally--the international effort against Saddam Hussein' and had put `thousands of servicemen's lives at risk'.9
Further, the paper alleged that the US State Department was so incensed about British hackers' repeated break-ins disrupting Pentagon defence planning that it had complained to Prime Minister John Major. The White House put the matter more bluntly than the State Department: Stop your hackers or we will cut off European access to our satellite which provides trans-Atlantic data and voice telecommunications. Someone in Britain seemed to be listening, for less than twelve months later, authorities had arrested all three hackers.
Pad thought the allegations were rubbish. He had been inside a VAX machine at the weather centre for a couple of hours one night, but he had never touched a Cray there. He had certainly never done anything to slow the machine down. No cracking programs, no scanners, nothing which might account for the delay described in the report. Even if he had been responsible, he found it hard to believe the Western allies' victory in the Gulf War was determined by one computer in Berkshire.
All of which gave him cause to wonder why the media was running this story now, after Wandii's acquittal but before he and Gandalf were sentenced. Sour grapes, perhaps?
For days, columnists, editorial and letter writers across Britain pontificated on the meaning of the Wandii's verdict and the validity of an addiction to hacking as a defence. Some urged computer owners to take responsibility for securing their own systems. Others called for tougher hacking laws. A few echoed the view of The Times, which declared in an editorial, `a persistent car thief of [the hacker's] age would almost certainly have received a custodial sentence. Both crimes suggest disrespect for other people's property ... the jurors may have failed to appreciate the seriousness of this kind of offence'.10
The debate flew forward, changing and growing, and expanding beyond Britain's borders. In Hong Kong, the South China Morning Post asked, `Is case evidence of a new social phenomenon, with immature and susceptible minds being damaged through prolonged exposure to personal computers?' The paper described public fear that Wandii's case would result in `the green light for an army of computer-literate hooligans to pillage the world's databases at will, pleading insanity when caught'.11
By April Fool's Day 1991, more than two weeks after the end of the court case, Wandii had his own syndrome named after him, courtesy of The Guardian.
And while Wandii, his mother and his team of lawyers celebrated their victory quietly, the media reported that the Scotland Yard detectives commiserated over their defeat, which was considerably more serious than simply losing the Wandii case. The Computer Crimes Unit was being `reorganised'. Two experienced officers from the five-man unit were being moved out of the group. The official line was that the `rotations' were normal Scotland Yard procedure. The unofficial word was that the Wandii case had been a fiasco, wasting time and money, and the debacle was not to be repeated.
In the north, a dark cloud gathered over Pad and Gandalf as their judgment day approached. The Wandii case verdict might have been cause for celebration among some in the computer underground, but it brought little joy for the other two 8lgm hackers.
For Pad and Gandalf, who had already pleaded guilty, Wandii's acquittal was a disaster.
On 12 May 1993, two months after Wandii's acquittal, Boris Kayser stood up at the Bar table to put forward Electron's case at the Australian hacker's plea and sentencing hearing. As he began to speak, a hush fell over the Victorian County Court.
A tall, burly man with a booming voice, an imperious courtroom demeanour and his traditional black robes flowing behind him in an echo of his often emphatic gesticulations, Kayser was larger than life. A master showman, he knew how to play an audience of courtroom journalists sitting behind him as much as to the judge in front of him.
Electron had already stood in the dock and pleaded guilty to fourteen charges, as agreed with the DPP's office. In typical style, Kayser had interrupted the long process of the court clerk reading out each charge and asking whether Electron would plead guilty or not guilty. With an impatient wave of his hand, Kayser asked the judge to dispense with such formalities since his client would plead guilty to all the agreed charges at once. The interjection was more of an announcement than a question.
The formalities of a plea having been summarily dealt with, the question now at hand was sentencing. Electron wondered if he would be sent to prison. Despite lobbying from Electron's lawyers, the DPP's office had refused to recommend a non-custodial sentence. The best deal Electron's lawyers had been able to arrange in exchange for turning Crown witness was for the DPP to remain silent on the issue of prison. The judge would make up his mind without input from the DPP.
Electron fiddled nervously with his father's wedding ring, which he wore on his right hand. After his father's death, Electron's sister had begun taking things from the family home. Electron didn't care much because there were only two things he really wanted: that ring and some of his father's paintings.
Kayser called a handful of witnesses to support the case for a light sentence. Electron's grandmother from Queensland. The family friend who had driven Electron to the hospital the day his father died. Electron's psychiatrist, the eminent Lester Walton. Walton in particular highlighted the difference between the two possible paths forward: prison, which would certainly traumatise an already mentally unstable young man, or freedom, which offered Electron a good chance of eventually establishing a normal life.
When Kayser began summarising the case for a non-custodial sentence, Electron could hear the pack of journalists off to his side frantically scribbling notes. He wanted to look at them, but he was afraid the judge would see his ponytail, carefully tucked into his neatly ironed white shirt, if he turned sideways,
`Your Honour,' Kayser glanced backward slightly, toward the court reporters, as he warmed up, `my client lived in an artificial world of electronic pulses.'
Scratch, scribble. Electron could almost predict, within half a second, when the journalists' pencils and pens would reach a crescendo of activity. The ebb and flow of Boris's boom was timed in the style of a TV newsreader.
Kayser said his client was addicted to the computer the way an alcoholic was obsessed with the bottle. More scratching, and lots of it. This client, Kayser thundered, had never sought to damage any system, steal money or make a profit. He was not malicious in the least, he was merely playing a game.
`I think,' Electron's barrister concluded passionately, but slowly enough for every journalist to get it down on paper, `that he should have been called Little Jack Horner, who put in his thumb, pulled out a plumb and said, "What a good boy am I!"'
Now came the wait. The judge retired to his chambers to weigh up the pre-sentence report, Electron's family situation, the fact that he had turned Crown witness, his offences--everything. Electron had given a nine-page written statement against Phoenix to the prosecution. If the Phoenix case went to trial, Electron would be put on the stand to back up that statement.
In the month before Electron returned to court to hear his sentence, he thought about how he could have fought the case. Some of the charges were dubious.
In one case, he had been charged with illegally accessing public information through a public account. He had accessed the anonymous FTP server at the University of Helsinki to copy information about DES. His first point of access had been through a hacked Melbourne University account.
Beat that charge, Electron's lawyer had told him, and there's plenty more where that came from. The DPP had good pickings and could make up a new charge for another site. Still, Electron reasoned some of the Crown's evidence would not have stood up under cross-examination.
When reporters from Australia and overseas called NASA headquarters for comment on the hacker-induced network shutdown, the agency responded that it had no idea what they were talking about. There had been no NASA network shutdown. A spokesman made inquiries and, he assured the media, NASA was puzzled by the report. Sharon Beskenis's statement didn't seem so watertight after all. She was not, it turned out, even a NASA employee but a contractor from Lockheed.
During that month-long wait, Electron had trouble living down Kayser's nursery-rhyme rendition in the courtroom. When he rang friends, they would open the conversation saying, `Oh, is that Little Jack Horner?'
They had all seen the nightly news, featuring Kayser and his client. Kayser had looked grave leaving court, while Electron, wearing John Lennon-style glasses with dark lenses and with his shoulder-length curls pulled tightly back in a ponytail, had tried to smile at the camera crews. But his small, fine features and smattering of freckles disappeared under the harsh camera lights, so much so that the black, round spectacles seemed almost to float on a blank, white surface.
The week after Electron pleaded guilty in Australia, Pad and Gandalf sat side by side in London's Southwark dock one last time.
For a day and a half, beginning on 20 May 1993, the two hackers listened to their lawyers argue their defence. Yes, our clients hacked computers, they told the judge, but the offences were nowhere near as serious as the prosecution wants to paint them. The lawyers were fighting hard for one thing: to keep Pad and Gandalf out of prison.
Some of the hearing was tough going for the two hackers, but not just because of any sense of foreboding caused by the judge's imminent decision. The problem was that Gandalf made Pad laugh, and it didn't look at all good to laugh in the middle of your sentencing hearing. Sitting next to Gandalf for hours on end, while lawyers from both sides butchered the technical aspects of computer hacking which the 8lgm hackers had spent years learning, did it. Pad had only to give Gandalf a quick sidelong glance and he quickly found himself swallowing and clearing his throat to keep from bursting into laughter. Gandalf's irrepressible irreverence was written all over his face.
The stern-faced Judge Harris could send them to jail, but he still wouldn't understand. Like the gaggle of lawyers bickering at the front of the courtroom, the judge was--and would always be--out of the loop. None of them had any idea what was really going on inside the heads of the two hackers. None of them could ever understand what hacking was all about--the thrill of stalking a quarry or of using your wits to outsmart so-called experts; the pleasure of finally penetrating a much-desired machine and knowing that system is yours; the deep anti-establishment streak which served as a well-centred ballast against the most violent storms washing in from the outside world; and the camaraderie of the international hacking community on Altos.
The lawyers could talk about it, could put experts on the stand and psychological reports in the hands of the judge, but none of them would ever really comprehend because they had never experienced it. The rest of the courtroom was out of the loop, and Pad and Gandalf stared out from the dock as if looking through a two-way mirror from a secret, sealed room.
Pad's big worry had been this third charge--the one which he faced alone. At his plea hearing, he had admitted to causing damage to a system owned by what was, in 1990, called the Polytechnic of Central London. He hadn't damaged the machine by, say, erasing files, but the other side had claimed that the damages totalled about250 000.
The hacker was sure there was zero chance the polytechnic had spent anything near that amount. He had a reasonable idea of how long it would take someone to clean up his intrusions. But if the prosecution could convince a judge to accept that figure, the hacker might be looking at a long prison term.
Pad had already braced himself for the possibility of prison. His lawyer warned him before the sentencing date that there was a reasonable likelihood the two 8lgm hackers would be sent down. After the Wandii case, the public pressure to `correct' a `wrong' decision by the Wandii jury was enormous. The police had described Wandii's acquittal as `a licence to hack'--and The Times, had run the statement.12 It was likely the judge, who had presided over Wandii's trial, would want to send a loud and clear message to the hacking community.
Pad thought that perhaps, if he and Gandalf had pleaded not guilty alongside Wandii, they would have been acquitted. But there was no way Pad would have subjected himself to the kind of public humiliation Wandii went through during the `addicted to computers' evidence. The media appeared to want to paint the three hackers as pallid, scrawny, socially inept, geeky geniuses, and to a large degree Wandii's lawyers had worked off this desire. Pad didn't mind being viewed as highly intelligent, but he wasn't a geek. He had a casual girlfriend. He went out dancing with friends or to hear bands in Manchester's thriving alternative music scene. He worked out his upper body with weights at home. Shy--yes. A geek--no.
Could Pad have made a case for being addicted to hacking? Yes, although he never believed that he had been. Completely enthralled, entirely entranced? Maybe. Suffering from a passing obsession? Perhaps. But addicted? No, he didn't think so. Besides, who knew for sure if a defence of addiction could have saved him from the prosecution's claim anyway?
Exactly where the quarter of a million pound claim came from in the first place was a mystery to Pad. The police had just said it to him, as if it was fact, in the police interview. Pad hadn't seen any proof, but that hadn't stopped him from spending a great deal of time feeling very stressed about how the judge would view the matter.
The only answer seemed to be some good, independent technical advice. At the request of both Pad and Gandalf's lawyers, Dr Peter Mills, of Manchester University, and Dr Russell Lloyd, of London Business School, had examined a large amount of technical evidence presented in the prosecution's papers. In an independent report running to more than 23 pages, the experts stated that the hackers had caused less havoc than the prosecution alleged. In addition, Pad's solicitor asked Dr Mills to specifically review, in a separate report, the evidence supporting the prosecution's large damage claim.
Dr Mills stated that one of the police expert witnesses, a British Telecom employee, had said that Digital recommended a full rebuild of the system at the earliest possible opportunity--and at considerable cost. However, the BT expert had not stated that the cost was250000 nor even mentioned if the cost quote which had been given had actually been accepted.
In fact, Dr Mills concluded that there was no supporting evidence at all for the quarter of a million pound claim. Not only that, but any test of reason based on the evidence provided by the prosecution showed the claim to be completely ridiculous.
In a separate report, Dr Mills' stated that:
i) The machine concerned was a Vax 6320, this is quite a powerful `mainframe' system and could support several hundreds of users.
ii) That a full dump of files takes 6 tapes, however since the type of tape is not specified this gives no real indication of the size of the filesystem. A tape could vary from 0.2 Gigabytes to 2.5 Gigabytes.
iii) The machine was down for three days.
With this brief information it is difficult to give an accurate cost for restoring the machine, however an over estimate would be:
i) Time spent in restoring the system, 10 man days at300 per day;3000.
ii) Lost time by users, 30 man days at300 per day;9000.
The total cost in my opinion is unlikely to be higher than12000 and this itself is probably a rather high estimate. I certainly cannot see how a figure of250000 could be justified.
It looked to Pad that the prosecution's claim was not for damage at all. It was for properly securing the system--an entirely rebuilt system. It seemed to him that the police were trying to put the cost of securing the polytechnic's entire computer network onto the shoulders of one hacker--and to call it damages. In fact, Pad discovered, the polytechnic had never actually even spent the250000.
Pad was hopeful, but he was also angry. All along, the police had been threatening him with this huge damage bill. He had tossed and turned in his bed at night worrying about it. And, in the end, the figure put forward for so long as fact was nothing but an outrageous claim based on not a single shred of solid evidence.
Using Dr Mills's report, Pad's barrister, Mukhtar Hussain, QC, negotiated privately with the prosecution barrister, who finally relented and agreed to reduce the damage estimate to15000. It was, in Pad's view, still far too high, but it was much better than250000. He was in no mind to look a gift horse in the mouth.
Judge Harris accepted the revised damage estimate.
The prosecution may have lost ground on the damage bill, but it wasn't giving up the fight. These two hackers, James Richardson told the court and journalists during the two-day sentencing hearing, had hacked into some 10000 computer systems around the world. They were inside machines or networks in at least fifteen countries. Russia. India. France. Norway. Germany. The US. Canada. Belgium. Sweden. Italy. Taiwan. Singapore. Iceland. Australia. Officers on the case said the list of the hackers' targets `read like an atlas', Richardson told the court.
Pad listened to the list. It sounded about right. What didn't sound right were the allegations that he or Gandalf had crashed Sweden's telephone network by running an X.25 scanner over its packet network. The crash had forced a Swedish government minister to apologise on television. The police said the minister did not identify the true cause of the problem--the British hackers--in his public apology.
Pad had no idea what they were talking about. He hadn't done anything like that to the Swedish phone system, and as far as he knew, neither had Gandalf.
Something else didn't sound right. Richardson told the court that in total, the two hackers had racked up at least25000 in phone bills for unsuspecting legitimate customers, and caused `damage' to systems which was very conservatively estimated at almost123000.
Where were these guys getting these numbers from? Pad marvelled at their cheek. He had been through the evidence with a fine-toothed comb, yet he had not seen one single bill showing what a site had actually paid to repair `damage' caused by the hackers. The figures tossed around by the police and the prosecution weren't real bills; they weren't cast in iron.
Finally, on Friday 21 May, after all the evidence had been presented, the judge adjourned the court to consider sentencing. When he returned to the bench fifteen minutes later, Pad knew what was going to happen from the judge's face. To the hacker, the expression said: I am going to give you everything that Wandii should have got.
Judge Harris echoed The Times's sentiments when he told the two defendants, `If your passion had been cars rather than computers, we would have called your conduct delinquent, and I don't shrink from the analogy of describing what you were doing as intellectual joyriding.
`Hacking is not harmless. Computers now form a central role in our lives. Some, providing emergency services, depend on their computers to deliver those services.'13
Hackers needed to be given a clear signal that computer crime `will not and cannot be tolerated', the judge said, adding that he had thought long and hard before handing down sentence. He accepted that neither hacker had intended to cause damage, but it was imperative to protect society's computer systems and he would be failing in his public duty if he didn't sentence the two hackers to a prison term of six months.
Judge Harris told the hackers that he had chosen a custodial sentence, `both to penalise you for what you have done and for the losses caused, and to deter others who might be similarly tempted'.
This was the show trial, not Wandii's case, Pad thought as the court officers led him and Gandalf out of the dock, down to the prisoner's lift behind the courtroom and into a jail cell.
Less than two weeks after Pad and Gandalf were sentenced, Electron was back in the Victorian County Court to discover his own fate.
As he stood in the dock on 3 June 1993 he felt numb, as emotionally removed from the scene as Meursault in Camus' L'etranger. He believed he was handling the stress pretty well until he experienced tunnel vision while watching the judge read his penalty. He perused the room but saw neither Phoenix nor Nom.
When Judge Anthony Smith summarised the charges, he seemed to have a special interest in count number 13--the Zardoz charge. A few minutes into reading the sentence, the judge said, `In my view, a custodial sentence is appropriate for each of the offences constituted by the 12th, 13th and 14th counts'. They were the `knowingly concerned' charges, with Phoenix, involving NASA, LLNL and CSIRO. Electron looked around the courtroom. People turned back to stare at him. Their eyes said, `You are going to prison'.
`I formed the view that a custodial sentence is appropriate in respect of each of these offences because of the seriousness of them,' Judge Smith noted, `and having regard to the need to demonstrate that the community will not tolerate this type of offence.
`Our society today is ... increasingly ... dependent upon the use of computer technology. Conduct of the kind in which you engaged poses a threat to the usefulness of that technology ... It is incumbent upon the courts ... to see to it that the sentences they impose reflect the gravity of this kind of criminality.
`On each of Counts 12, 13 and 14, you are convicted and you are sentenced to a term of imprisonment of six months ... each ... to be concurrent.'
The judge paused, then continued, `And ... I direct, by order, that you be released forthwith upon your giving security by recognisance ... in the sum of $500 ... You will not be required to serve the terms of imprisonment imposed, provided you are of good behaviour for the ensuing six months.' He then ordered Electron to complete 300 hours of community service, and to submit to psychiatric assessment and treatment.
Electron breathed a sigh of relief.
When outlining the mitigating circumstances which led to suspension of the jail sentence, Judge Smith described Electron as being addicted to using his computer `in much the same way as an alcoholic becomes addicted to the bottle'. Boris Kayser had used the analogy in the sentencing hearing, perhaps for the benefit of the media, but the judge had obviously been swayed by his view.
When court adjourned, Electron left the dock and shook hands with his lawyers. After three years, he was almost free of his court problems. There was only one possible reason he might need to return to court.
If Phoenix fought out his case in a full criminal trial, the DPP would put Electron on the stand to testify against him. It would be an ugly scene.
The inmates of HM Prison Kirkham, on the north-west coast of England, near Preston, had heard all about Pad and Gandalf by the time they arrived. They greeted the hackers by name. They'd seen the reports on telly, especially about how Gandalf had hacked NASA--complete with footage of the space shuttle taking off. Some TV reporter's idea of subtle irony--`Two hackers were sent down today' as the space shuttle went up.
Kirkham was far better than Brixton, where the hackers had spent the first days of their sentence while awaiting transfer. Brixton was what Pad always envisioned prison would look like, with floors of barred cells facing onto an open centre and prisoners only allowed out of their cells for scheduled events such as time in the yard. It was a place where hard-core criminals lived. Fortunately, Pad and Gandalf had been placed in the same cell while they waited to be assigned to their final destination.
After ten days inside Brixton Pad and Gandalf were led from their cell, handcuffed and put in a coach heading toward the windy west coast.
During the drive, Pad kept looking down at his hand, locked in shiny steel to Gandalf's hand, then he looked back up again at his fellow hacker. Clearing his throat and turning away from Gandalf's difficult grin--his friend now on the edge of laughing himself--Pad struggled. He tried to hold down the muscles of his face, to pull them back from laughter.
A minimum security prison holding up to 632 prisoners, Kirkham looked vaguely like a World War II RAF base with a large collection of free-standing buildings around the grounds. There were no real walls, just a small wire fence which Pad soon learned prisoners routinely jumped when the place started to get to them.
For a prison, Kirkham was pretty good. There was a duck pond, a bowling green, a sort of mini-cinema which showed films in the early evenings, eight pay phones, a football field, a cricket pavilion and, best of all, lots of fields. Prisoners could have visits on weekday afternoons between 1.10 and 3.40, or on the weekend.
Luck smiled on the two hackers. They were assigned to the same billet and, since none of the other prisoners objected, they became room-mates. Since they were sentenced in May, they would serve their time during summer. If they were `of good behaviour' and didn't get into trouble with other prisoners, they would be out in three months.
Like any prison, Kirkham had its share of prisoners who didn't get along with each other. Mostly, prisoners wanted to know what you were in for and, more particularly, if you had been convicted of a sex crime. They didn't like sex crime offenders and Pad heard about a pack of Kirkham prisoners who dragged one of their own, screaming, to a tree, where they tried to hang him for being a suspected rapist. In fact, the prisoner hadn't been convicted of anything like rape. He had simply refused to pay his poll tax.
Fortunately for Pad and Gandalf, everyone else in Kirkham knew why they were there. At the end of their first week they returned to their room one afternoon to find a sign painted above their door. It said, `NASA HQ'.
The other minimum security prisoners understood hacking--and they had all sorts of ideas about how you could make money from it. Most of the prisoners in Kirkham were in for petty theft, credit card fraud, and other small-time crimes. There was also a phreaker, who arrived the same day as Pad and Gandalf. He landed eight months in prison--two more than the 8lgm hackers--and Pad wondered what kind of message that sent the underground.
Despite their best efforts, the 8lgm twosome didn't fit quite the prison mould. In the evenings, other prisoners spent their free time shooting pool or taking drugs. In the bedroom down the hall, Gandalf lounged on his bed studying a book on VMS internals. Pad read a computer magazine and listened to some indie music--often his `Babes in Toyland' tape. In a parody of prison movies, the two hackers marked off their days inside the prison with cross-hatched lines on their bedroom wall--four marks, then a diagonal line through them. They wrote other things on the walls too.
The long, light-filled days of summer flowed one into the other, as Pad and Gandalf fell into the rhythm of the prison. The morning check-in at 8.30 to make sure none of the prisoners had gone walkabout. The dash across the bowling green for a breakfast of beans, bacon, eggs, toast and sausage. The walk to the greenhouses where the two hackers had been assigned for work detail.
The work wasn't hard. A little digging in the pots. Weeding around the baby lettuce heads, watering the green peppers and transplanting tomato seedlings. When the greenhouses became too warm by late morning, Pad and Gandalf wandered outside for a bit of air. They often talked about girls, cracking crude, boyish jokes about women and occasionally discussing their girlfriends more seriously. As the heat settled in, they sat down, lounging against the side of the greenhouse.
After lunch, followed by more time in the greenhouse, Pad and Gandalf sometimes went off for walks in the fields surrounding the prison. First the football field, then the paddocks dotted with cows beyond it.
Pad was a likeable fellow, largely because of his easygoing style and relaxed sense of humour. But liking him wasn't the same as knowing him, and the humour often deflected deeper probing into his personality. But Gandalf knew him, understood him. Everything was so easy with Gandalf. During the long, sunny walks, the conversation flowed as easily as the light breeze through the grass.
As they wandered in the fields, Pad often wore his denim jacket. Most of the clothes on offer from the prison clothing office were drab blue, but Pad had lucked onto this wonderful, cool denim jacket which he took to wearing all the time.
Walking for hours on end along the perimeters of the prison grounds, Pad saw how easy it would be to escape, but in the end there didn't seem to be much point. They way he saw it, the police would just catch you and put you back in again. Then you'd have to serve extra time.
Once a week, Pad's parents came to visit him, but the few precious hours of visiting time were more for his parents' benefit than his own. He reassured them that he was OK, and when they looked him in the face and saw it was true, they stopped worrying quite so much. They brought him news from home, including the fact that his computer equipment had been returned by one of the police who had been in the original raid.
The officer asked Pad's mother how the hacker was doing in prison. `Very well indeed,' she told him. `Prison's not nearly so bad as he thought.' The officer's face crumpled into a disappointed frown. He seemed to be looking for news that Pad was suffering nothing but misery.
At the end of almost three months, with faces well tanned from walking in the meadows, Pad and Gandalf walked free.
To the casual witness sitting nearby in the courtroom, the tension between Phoenix's mother and father was almost palpable. They were not sitting near each other but that didn't mitigate the silent hostility which rose through the air like steam. Phoenix's divorced parents provided a stark contrast to Nom's adopted parents, an older, suburban couple who were very much married.
On Wednesday, 25 August 1993 Phoenix and Nom pleaded guilty to fifteen and two charges respectively. The combined weight of the prosecution's evidence, the risk and cost of running a full trial and the need to get on with their lives had pushed them over the edge. Electron didn't need to come to court to give evidence.
At the plea hearing, which ran over to the next day, Phoenix's lawyer, Dyson Hore-Lacy, spent considerable time sketching the messy divorce of his client's parents for the benefit of the judge. Suggesting Phoenix retreated into his computer during the bitter separation and divorce was the best chance of getting him off a prison term. Most of all, the defence presented Phoenix as a young man who had strayed off the correct path in life but was now back on track--holding down a job and having a life.
The DPP had gone in hard against Phoenix. They seemed to want a jail term badly and they doggedly presented Phoenix as an arrogant braggart. The court heard a tape-recording of Phoenix ringing up security guru Edward DeHart of the Computer Emergency Response Team at Carnegie Mellon University to brag about a security exploit. Phoenix told DeHart to get onto his computer and then proceeded to walk him step by step through the `passwd -f' security bug. Ironically, it was Electron who had discovered that security hole and taught it to Phoenix--a fact Phoenix didn't seem to want to mention to DeHart.
The head of the AFP's Southern Region Computer Crimes Unit, Detective Sergeant Ken Day was in court that day. There was no way he was going to miss this. The same witness noting the tension between Phoenix's parents might also have perceived an undercurrent of hostility between Day and Phoenix--an undercurrent which did not seem to exist between Day and either of the other Realm hackers.
Day, a short, careful man who gave off an air of bottled intensity, seemed to have an acute dislike for Phoenix. By all observations the feeling was mutual. A cool-headed professional, Day would never say anything in public to express the dislike--that was not his style. His dislike was only indicated by a slight tightness in the muscles of an otherwise unreadable face.
On 6 October 1993, Phoenix and Nom stood side by side in the dock for sentencing. Wearing a stern expression, Judge Smith began by detailing both the hackers' charges and the origin of The Realm. But after the summary, the judge saved his harshest rebuke for Phoenix.
`There is nothing ... to admire about your conduct and every reason why it should be roundly condemned. You pointed out to some of the system administrators ... [but] this was more a display of arrogance and a demonstration of what you thought was your superiority rather than an act of altruism on your part.
`You ... bragged about what you had done or were going to do ... Your conduct revealed ... arrogance on your part, open defiance, and an intention to the beat the system. did cause havoc for a time within the various targeted systems.'
Although the judge appeared firm in his views while passing sentence, behind the scenes he had agonised greatly over his decision. He had attempted to balance what he saw as the need for deterrence, the creation of a precedence for sentencing hacking cases in Australia, and the individual aspects of this case. Finally, after sifting through the arguments again and again, he had reached a decision.
`I have no doubt that some sections of our community would regard anything than a custodial sentence as less than appropriate. I share that view. But after much reflection ... I have concluded that an immediate term of imprisonment is unnecessary.'
Relief rolled across the faces of the hackers' friends and relatives as the judge ordered Phoenix to complete 500 hours of community service work over two years and assigned him a $1000 twelve-month good behaviour bond. He gave Nom 200 hours, and a $500, six-month bond for good behaviour.
As Phoenix was leaving the courtroom, a tall, skinny young man, loped down the aisle towards him.
`Congratulations,' the stranger said, his long hair dangling in delicate curls around his shoulders.
`Thanks,' Phoenix answered, combing his memory for the boyish face which couldn't be any older than his own. `Do I know you?'
`Sort of,' the stranger answered. `I'm Mendax. I'm about to go through what you did, but worse.'Contents | Previous: Chapter 6 -- Page 1 The New York Times | Next: Chapter 8 -- The International Subversives