Kingpin: How One Hacker Took Over the Billion Dollar Cyber Crime Underground (4 page)

It was a mistake. The ISP noticed the drain on its bandwidth and traced Max’s uploads to the corporate offices of CompuServe in Bellevue, where Max had just started working a new temp job. Max was fired. Barely a year after his release from prison, his name was mud.

That was when Max decided to start over again in Silicon Valley, where the dot-com economy was swelling to ripeness and a talented computer genius could pick up work without a lot of questions about his past.

He’d need a new name, unstained by his past folly. Max had been known by a nickname in the joint, one abbreviated from a cyberpunk-themed ’zine he’d published from the prison typewriter:
Maximum Vision
. It was a clean, optimistic name that exemplified everything he wanted to be and crystallized his clarity and hopefulness.

As he left Seattle in the rearview mirror, he said good-bye to Max Butler. From now on, he would be Max Ray Vision.

•  •  •

Max Vision found that life in Hungry Manor was good. Surrounded by rolling meadows on all sides, the house boasted two wings, four bedrooms, a maid’s quarters, a full dining room, a livestock pen, and a brick pizza oven and indoor barbecue in a vented room adjoining the vast, sunlit kitchen. The Hungries had turned the library into a computer lab and server room, packing in a slew of custom-built gaming PCs for recreation. They ran networking cable into every room and energized it with a high-speed Internet link that necessitated the partial shutdown of the 92 freeway as the phone company trenched a new cable run alongside the road. A vintage phone system linked the west wing to the east. As a finishing touch, one of the Hungry Programmers had brought in a hot tub and set it up on the grounds, under the stars.

Max couldn’t have asked for a better launchpad for his new life. One of the resident Hungries got him a job as a system administrator at MPath Interactive, a computer gaming start-up in Silicon Valley that was flush with venture capital. He threw himself into the job. Defying the stereotype of a computer nerd, he drew his greatest satisfaction from his support duties. He liked helping people.

But it wasn’t long before Max’s antics in Seattle caught up with him. One morning, a process server showed up at his cubicle to hand him a $300,000 lawsuit filed by the Software Publishers Association—an industry group that had decided to use his piracy bust to send a message. “This action is a warning to Internet users who believe they can infringe software copyrights without fear of exposure or penalty,” the association proclaimed in a press release.

As the first lawsuit of its kind, the case earned Max Butler a brief write-up in
Wired
magazine and a mention in a congressional hearing on Internet piracy. Max Vision, though, emerged largely unscathed—few in his new life made the connection to the man named in the high-profile lawsuit.

When the press attention faded, the SPA was willing to quietly settle the case for $3,500 and some free computer consulting. The whole affair even had a silver lining. It introduced Max to the FBI.

Chris Beeson, a young agent with the bureau’s San Francisco computer crime squad, gave Max his pitch. The FBI could use Max’s assistance navigating the computer underground. Recreational hackers were no longer a target for the bureau, he said. There was a new, more dangerous breed of computer criminal emerging: “real” criminals. They were cyberthieves, pedophiles, even terrorists. The FBI was no longer chasing people like Max and his ilk. “We’re not the enemy,” said Beeson.

Max wanted to help, and in March 1997 he was formally inducted into the FBI’s Criminal Informant program. His first written report for the bureau was an introductory course on the virus-writing, warez, and computer-hacking scenes. His follow-up report ten days later ran down compromised file-transfer sites—like the one he’d exploited in Seattle—and a music piracy gang called Rabid Neurosis that had debuted the previous October with a bootlegged release of Metallica’s
Ride the Lightning
.

When Max got his hands on a pirated version of AutoCAD that was being circulated by a crew called SWAT, the FBI rewarded him with a $200 payment. Beeson had Max sign the receipt with the bureau’s code name for its new asset: Equalizer.

Max liked the FBI agent, and the feeling seemed to be mutual. Neither of them knew that Chris Beeson would one day put his Equalizer back behind bars and begin Max’s transformation into one of the “real” criminals Beeson had hoped to catch.

ax was building his new life at a time of profound change in the hacking world.

The first people to identify themselves as hackers were software and electronics students at MIT in the 1960s. They were smart kids who took an irreverent, antiauthoritarian approach to the technology they would wind up pioneering—a scruffy counterweight to the joyless suit and lab-jacket culture then epitomized by the likes of IBM. Pranks were a part of the hacker culture, and so was phone phreaking—the usually illegal exploration of the forbidden back roads of the telephone network. But hacking was above all a creative effort, one that would lead to countless watershed moments in computer history.

The word “hacker” took on darker connotations in the early 1980s, when the first home computers—the Commodore 64s, the TRS-80s, the Apples—came to teenagers’ bedrooms in suburbs and cities around the United States. The machines themselves were a product of hacker culture; the Apple II, and with it the entire home computer concept, was born of two Berkeley phone phreaks named Steve Wozniak and Steve Jobs. But not all teenagers were content with the machines, and in the impatience of youth, they weren’t inclined to wait for grad school to dip into real processing power or to explore the global networks that could be reached with a phone call and the squeal of a modem. So they began illicit forays
into corporate, government, and academic systems and took their first tentative steps into the ARPANET, the Internet’s forerunner.

When those first young intruders began getting busted in 1983, the national press cast about for a word to describe them and settled on the one the kids had given themselves: “hackers.” Like the previous generation of hackers, they were pushing the limits of technology, outwitting the establishment, and doing things that were supposed to be impossible. But for them, that involved breaching corporate computers, taking over telephone switches, and slipping into government systems, universities, and defense contractor networks. The older generation winced at the comparison, but from that point on, the word “hacker” would have two meanings: a talented programmer who pulled himself up by his own bootstraps, and a recreational computer intruder. Adding to the confusion, many hackers were both.

Now, in the mid-1990s, the hacking community was dividing again. The FBI and the Secret Service had staged arrests of high-profile intruders like Kevin Mitnick and Mark “Phiber Optik” Abene, a New York phone phreak, and the prospect of prison stigmatized recreational intrusion while raising the risk far beyond the rewards of ego and adventure. The impetus for cracking computers was fading as well: The Internet was open to anyone now, and personal computers had grown powerful enough to run the same operating systems and programming languages that fueled the big machines denied to amateurs. Most of all, there was real money to be made defending computers and none attacking them.

Cracking systems was becoming uncool. Those possessed of a hacker’s mind-set were increasingly rejecting intrusion and going right into legitimate security work. And the intruders started hanging up their black hats to join them. They became the “white-hat hackers”—referencing the square-jawed heroes in old cowboy films—applying their computer skills on the side of truth and justice.

Max thought of himself as one of the white hats. Watching for new types of attacks and emerging vulnerabilities was now in his job description,
and as Max Vision, he was beginning to contribute to some of the computer-security mailing lists where the latest developments were discussed. But he couldn’t completely exorcise Ghost23 from his personality. It was an open secret among Max’s friends that he was still cracking systems. When he saw something novel or interesting, he saw no harm in trying it out for himself.

Tim was at work one day when he got a call from a flummoxed system administrator at another company who’d traced an intrusion back to Hungry.com—the online home of the Hungry Programmers, where they hosted their projects, hung their résumés, and maintained e-mail addresses that would remain steady through job changes and other upheavals. There were dozens of geeks on the shared system, but Tim knew at once who was responsible. He put the sysadmin on hold and phoned up Max.

“Stop. Hacking. Now,” he said.

Max stammered out an apology—it was the burning lawn all over again. Tim switched back to the other line, where the system administrator happily reported that the attack had stopped in its tracks.

The complaint surprised and confused Max—if his targets knew what a good guy he was, they wouldn’t take issue with some harmless intrusions. “Max, you gotta get permission,” Tim explained. He offered some life advice. “Look, just sort of imagine that everyone’s looking at you. That’s a good way to ensure that what you’re doing is correct. If I was standing there, or your dad was standing there, would you still feel the same about doing it? What would we say?”

If there was one thing Max was missing in his new life, it was a partner to share it with. He met twenty-year-old Kimi Winters at a rave called Warmth, held on an empty warehouse floor in the city—Max had become a fixture in the rave scene, dancing with a surprising, fluid grace, whirling his arms like a Brazilian flame dancer. Kimi was a community college student and part-time barista. A foot shorter than Max, she sported
an androgynous appearance in the shapeless black hoodie she liked to wear when she went out. But on a second look, she was decidedly cute, with apple cheeks and her Korean mother’s copper-tinted skin. Max invited Kimi to a party at his place.

The parties at Hungry Manor were legendary, and when Kimi arrived the living room was already packed with dozens of party guests from Silicon Valley’s keyboard class—programmers, system administrators, and Web designers—mingling under the glass chandelier. Max lit up when he spotted her. He led her on a tour of the house, pointing out the geeky accoutrements the Hungry Programmers had added.

The tour ended in Max’s bedroom in Hungry Manor’s east wing. For all of the grandeur of the house, Max’s room had the charm of a monk’s cell—no furniture but a futon on the floor, no comforts except a computer. For the party, Max had trained blue and red spotlights on a bottle of peppermint schnapps—his only vice. Kimi returned for dinner the next night, and there was a single item on his vegetarian menu: raw cookie dough. Max shaved the sugary sludge off in slices and served it to his date with the schnapps. Why, after all, would anyone
not
eat raw cookie dough for dinner, given the option?

Kimi was intrigued. Max needed so little to be happy. He was like a child. When his birthday came soon after the party, she sent a decorated box of balloons to his office at MPath, and Max was moved nearly to tears by the gesture.

She was his “dream girl,” he told her later. They began to talk about committing to a life together.

In September, Hungry Manor’s landlord, unhappy with the programmers’ upkeep of the estate, reclaimed the house, and after a final bash to bid farewell to their communal mansion, the Hungries scattered to rentals throughout the Bay Area. Max and Kimi landed in their own place in Mountain View, a cramped studio in a barracks-like apartment complex alongside the 101 freeway, Silicon Valley’s congested main artery.

Max resumed his work for the FBI, and his haunting of IRC led him
to a new opportunity—his chance to break out as a white-hat hacker. He’d made a friend in the chat rooms who was starting a real consulting business in San Francisco and was interested in bringing Max on board.
Max went up to the city to visit Matt Harrigan, aka, “Digital Jesus.”

Harrigan, just twenty-two, was one of four white hats who’d been profiled in a
Forbes
cover story the previous year, and he’d cannily used his fifteen minutes of fame to win some seed money for a business: a professional hacking shop in San Francisco’s financial district.

The idea was simple: Corporations would pay his company, Microcosm Computer Resources, to put their networks through a real hack attack, culminating in a detailed report on the client’s security strengths and weaknesses. The business of “penetration testing”—as it was called—had been dominated by the Big Five accounting firms, but Harrigan was already signing up clients by admitting something that no accounting firm would ever announce: that his experience came from real-life hacking, and he was freely hiring other ex-hackers.

MCR would be billing out between $300 and $400 an hour, Harrigan explained. Max would work as a subcontractor, making $100 to $150. All for doing two of the things he liked most in the world: hacking into shit and writing reports.