A Most-Wanted Cyberthief Is Caught in His Own Web

<BODY BGCOLOR="#f0f0f0" BACKGROUND="paper.jpg" LINK="#cc0800" VLINK="#808080"> <H1 ALIGN=CENTER>A Most-Wanted Cyberthief<BR>Is Caught in His Own Web</H1> <H2 ALIGN=CENTER>By John Markoff</H2> <P ALIGN=CENTER> <STRONG>Copyright &copy 1995 The New York Times Company</STRONG> <P> Raleigh, N.C., Feb. 15 <P> After a search of more than two years, a team of F.B.I. agents early this morning captured a 31-year-old computer expert accused of a long crime spree that includes the theft of thousands of data files and at least 20,000 credit card numbers from computer systems around the nation. <P> The arrest of Kevin D. Mitnick, one of the most wanted computer criminals, followed a 24-hour stakeout of an apartment building here. <P> A convicted computer felon on the run from Federal law enforcement officials since November 1992, Mr. Mitnick has used his sophisticated skills over the years to worm his way into many of the nation's telephone and cellular telephone networks and vandalize government, corporate and university computer systems. Most recently, he had become a suspect in a rash of break-ins on the global Internet computer network. <P> "He was arguably the most wanted computer hacker in the world," said Kent Walker, an assistant United States attorney in San Francisco who helped run the investigation. "He allegedly had access to corporate trade secrets worth millions of dollars. He was a very big threat." <P> But Federal officials say Mr. Mitnick's confidence in his hacking skills may have been his undoing. On Christmas Day, he broke into the home computer of a computer security expert, Tsutomu Shimomura, a researcher at the federally financed San Diego Supercomputer Center. <P> Mr. Shimomura then made a crusade of tracking down the intruder, a pursuit that led to today's arrest. <P> Mr. Shimomura, working from a monitoring post in San Jose, Calif., determined last Saturday that Mr. Mitnick was operating through a computer modem connected to a cellular telephone somewhere near Raleigh, N.C. <P> Mr. Shimomura was present today at Mr. Mitnick's prearraignment hearing at the Federal courthouse here. At the end of the hearing, Mr. Mitnick, who now has shoulder-length brown hair and was wearing a black sweat suit and handcuffs, turned to Mr. Shimomura, whom he had never met face to face. <P> "Hello, Tsutomu," Mr. Mitnick said. "I respect your skills." <P> Mr. Shimomura, who is 30 and also has shoulder-length hair, nodded solemnly. <P> Mr. Shimomura had flown on Sunday morning to Raleigh, where he helped telephone company technicians and Federal investigators use cellular-frequency scanners to home in on Mr. Mitnick. <P> Mr. Mitnick was arrested at 2 o'clock this morning in his apartment in the Raleigh suburb of Duraleigh Hills, after F.B.I. agents used their scanners to determine that Mr. Mitnick, in keeping with his nocturnal habits, had connected once again to the Internet. Mr. Mitnick, already wanted in California for a Federal parole violation, was charged today with two Federal crimes. The first, illegal use of a telephone access device, is punishable by up to 15 years in prison and a $250,000 fine. The second charge, computer fraud, carries potential penalties of 20 years in prison and a $250,000 fine. Federal prosecutors said they were considering additional charges related to Mr. Mitnick's reported Internet spree. <P> Federal officials say Mr. Mitnick's motives have always been murky. He was recently found to have stashed thousands of credit card numbers on computers in the San Francisco Bay area -- including the card numbers of some of the best-known millionaires in Silicon Valley. But there is no evidence yet that Mr. Mitnick had attempted to use those credit card accounts. <P> Indeed, frequently ignoring the possibility of straightforward financial gain from the information he has stolen, Mr. Mitnick has often seemed more concerned with proving that his technical skills are better than those whose job it is to protect the computer networks he has attacked. <P> Federal officials say the arrest of Mr. Mitnick does not necessarily solve all the recent Internet crimes, because his trail of electronic mail has indicated that he may have accomplices. One of them is an unknown computer operator, thought to be in Israel, with whom Mr. Mitnick has corresponded electronically and boasted of his Internet exploits, investigators said. <P> Still, the capture of Mr. Mitnick gives the F.B.I. custody of a notoriously persistent and elusive computer break-in expert. Raised in the San Fernando Valley near Los Angeles by his mother, Mr. Mitnick has been in and out of trouble with the law since 1981. It was then, as a 17-year-old, that he was placed on probation for stealing computer manuals from a Pacific Bell telephone switching center in Los Angeles. <P> Those who know Mr. Mitnick paint a picture of a man obsessed with the power inherent in controlling the nation's computer and telephone networks. The recent break-ins he is accused of conducting include forays into computer systems at Apple Computer Inc. and Motorola Inc. and attacks on commercial services that provide computer users with access to the Internet, including the Well in Sausalito, Calif., Netcom in San Jose, Calif., and the Colorado Supernet, in Boulder, Colo. <P> To make it difficult for investigators to determine where the attacks were coming from, Mr. Mitnick is said to have used his computer and modem to manipulate a local telephone company switch in Raleigh to disguise his whereabouts. In recent weeks, as an elite team of computer security experts tightened an invisible electronic net around the fugitive, Mr. Mitnick continued to taunt his pursuers, apparently unaware of how close they were to capturing him. About 10 days ago, for example, someone whom investigators believe to have been Mr. Mitnick left a voice-mail message for Mr. Shimomura, a Japanese citizen. The message reprimanded Mr. Shimomura for converting the intruder's earlier voice-mail messages into computer audio files and making them available on the Internet. <P> "Ah Tsutomu, my learned disciple," the taunting voice said. "I see that you put my voice on the Net. I'm very disappointed, my son." <P> But the continued attempts at one-upmanship simply gave the pursuers more electronic evidence. <P> "He was a challenge for law enforcement, but in the end he was caught by his own obsession," said Kathleen Cunningham, a deputy marshal for the United States Marshals Service who has pursued Mr. Mitnick for several years. <P> Mr. Mitnick first came to national attention in 1982 when, as a teen-age prank, he used a computer and a modem to break into a North American Air Defense Command computer. He subsequently gained temporary control of three central offices of telephone companies in Manhattan and all the phone switching centers in California. This gave him the ability to listen in on calls and pull pranks like reprogramming the home phone of someone he did not like so that each time the phone was picked up, a recording asked for a deposit of a coin. <P> But the break-ins escalated beyond sophomoric pranks. For months in 1988, Mr. Mitnick secretly read the electronic mail of computer security officials at MCI Communications and the Digital Equipment Corporation, learning how their computers and phone equipment were protected. Officials at Digital later accused him of causing $4 million in damage to computer operations at the company and stealing $1 million of software. He was convicted in July 1989 and sentenced to a year in a low-security Federal prison in Lompoc, Calif. <P> One of his lawyers convinced the court that Mr. Mitnick had an addiction to computers. In July 1989, after his release from prison, he was placed in a treatment program for compulsive disorders, the Beit T'Shuvah center in Los Angeles. During his six months there, he was prohibited from touching a computer modem. <P> That restriction was a condition of his probation when he was released in mid-1990, and it was for reportedly violating this condition that Federal officials were pursuing him when he dropped out of sight in November 1992. In September 1993, the state police in California also issued a warrant for his arrest. The warrant stated that Mr. Mitnick had wiretapped calls from agents of the Federal Bureau of Investigation to the California Department of Motor Vehicles. He then used law-enforcement access codes obtained by eavesdropping on the agents to gain illegal access to the drivers' license data base in California. <P> <A HREF="tactics.html">Tactics of a High-Tech Detective</A> </BODY>