Going to California

The Hacker Crackdown — Sidebar: Information Wants To Be Free

We had a saying: Information wants to be free. This wasn’t to stake out intellectual property with a proud pirate flag but a way to push back on the forces that seemed to want to draw a circle around everything and to charge money to look inside the circle — or simply to restrict it, for no good reason.

EFF-Austin was a separate group from the national EFF. I think the original idea was that individual cities would spin up their own Electronic Frontier Foundation. That didn’t end up happening, though the EFF very kindly let EFF-Austin go on, and they’re still going today. They’re even still using the logo I designed for them.

Naturally, the Steve Jackson Games offices were where the EFF-Austin meetings were often held in the early days. One of their earliest events was a crypto conference, and Steve was wishing he had t-shirts. I told him I’d design one, and maybe 20 minutes later I showed him on the screen what you see here.

I just dug this out of the bottom of my black t-shirt drawer. It is 20 years and one month old.

Bruce Sterling, when I showed him the shirt, read the white text, smiled, then squinted as he began reading the much fainter text in the background.

“Digital money for crypto-anarchy,” he said. “Data havens, privacy?” I’d pulled from my head a long list of fears and movements and dreams and designs that seemed to be spinning out of the larger conversation about encryption that faster and more widely available computers were making possible.

He shook his head and turned away. “I’m done trying to read the rest.” At least he was smiling.

And that was fine. Everyone approved it, and it was cool seeing them at the event. It was my first t-shirt, actually.

It is a little sad that these ideas are still unresolved, twenty years and nearly a month later. They probably won’t be resolved next month, either. I’m afraid we may not be done talking about them in another twenty years.

But that’s all beyond the point. I really just wanted to show off the t-shirt I found.

Standard
Going to California

The Hacker Crackdown — 7

Also, because I can’t leave it alone, where did they store and what did they do with 23,000 floppy disks?

Okay, I’ll leave it alone.

After getting stung by the judge in open courtroom, the defense attorney began their case by making a brief attempt to downplay any harm that might have been done. Then the defense quickly rested. Presumably they weren’t seeing a positive outcome to the trial, and were likely anticipating a sizably punishing judgement against them.

Again proving visionary, the Secret Service lost the case, and they had to pay back the EFF’s legal fees, around $300,000. There were other details as well, most important of which to me was a $50,000 award to Steve Jackson Games.

Most important to everyone else in America, the case would eventually set the first legal precedent that electronic mail has the same rights and protections as physical mail. Thanks, Electronic Frontier Foundation.

Nine or so months before the trial in Spring of 1992, I’d called the Mentor to catch up. When he heard that I was about to walk off campus with a design degree, and he called me over for an interview. A week later I had a job offer at the game company I’d worshipped since I’d turned thirteen. It wasn’t glamorous work, at first, but it got me in the door.

The upside of being in the door was that I was there when $50,000 walked in, along with a few new faces around the office and a fresh idea: What if we spent the Secret Service money setting up a new kind of bulletin-board system? They set up a couple of really beefy machines, with a whole bank of modems behind them. Add in a gigantic pipe to the Internet, also thanks to the phone company, and you could sell Internet access to anyone with a computer and a modem of their own for only $10 a month.

And that’s how in 1993 we started a very early Internet Service Provider called Illuminati Online. I know this was a bit of a long tangent just to give you more context for the rest of my story, but the truth is I can draw a straight line from Secret Service agents barging into a game company, guns drawn, to me ending up in California.

If only it had been as simple as walking a straight line.

Standard
Going to California

The Hacker Crackdown — 6

I loved cyberpunk. It was an alluring nightmare. The dystopias of Blade Runner and Neuromancer and Snow Crash, and even True Names and Max Headroom, were as powerfully sexy as they were also alarming commentary on where things seemed to be heading. Cautionary tales, and terrific high-tech dreams.

Science-fiction, before cyberpunk, had focused on stars and aliens and zap guns and rockets and robots, the post-war flying-saucer spectacle. Star Wars and later Alien rubbed a bit of dirt on science-fiction and made the characters a little less stilted, more approachable, with fewer silver-shiny suits. Cyberpunk took away the rockets and the zap guns and the aliens. People no longer yearned for the stars, but holy crap did we have awesome computers. And terrible corporations have mostly overpowered the world’s governments, strangling humanity at least a little bit, while powerful new things, like early artificial intelligences, begin to appear.

I said that cyberpunk got rid of aliens, but actually I was wrong. Early artificial life forms are the alien beings who our criminal anti-heroes encounter.

Cyberpunk people spend as much time as possible in a virtual world — sometimes a single big one, but more often a lot of little ones (as well as a few secret ones) — where the people you encounter could as easily be on the other side of the world as they might be artificially intelligent.

It’s a world with so many computers, of so many shapes and sizes, that they were essentially disposable. You could get super-expensive ones, still, certainly, but a phone you could dig out of the trash could get you online and keep you mobile while connected, for only a few credits paid ahead.

And once online, if you knew the address of anyone else, you could reach out to them — immediately talk to them, seeing them over video — even play video games with each other and fall in love, or hunt someone, find them, harm them.

Many, many more people in the cyberpunk world have a lot of time on their hands, and a lot of computing power in those hands, and they learn how to do very destructive things. The largest scale operations have turned millions of computers into totally remote controlled instruments of whatever the hell the network’s owner decides they should do, from looking for credit card numbers to looking for spreadsheets at companies which are about to report their quarterly numbers.

We imagined a cyberpunk world of computer criminals, because we were afraid that was where things were headed. And it basically seems to be where we’ve arrived.

The Secret Service went hunting hackers because they were afraid that we had already arrived at a cyberpunk world of computer crime. They spent a crazy amount of money — 150 agents? 23,000 floppy disks? — as part of a massive bet which basically presumed that the world described in cyberpunk science-fiction was as much a reality as technology would meaningfully allow.

How much is 23,000 floppy disks, in terms of data? Depending on the kind of disks they were, it’s between 7–30 gigabytes. In today’s terms, that’s between seven and ten high-definition movies. In the mid-1980s, a name-brand box of 10 disks cost nearly $40. Let’s say they cost $1 each in 1990, so it’s easy to see how much 23,000 floppies worth of storage would cost. In 2013, I can get that same amount of storage in a plastic stick about as long as an infant’s thumb, ordered online and delivered to my home by Google in under 4 hours for $15.

It’s not a terrific stretch to say that we are today not far from the everyday cyberpunk ideal. Most of what I described above is day-to-day reality today for most of the Western nations, and increasingly for most of the rest of the world. There were roughly fifteen times as many computers in the world at the start of 2010 as there were at the start of 1990, when AT&T’s network shouted itself into oblivion for a few hours. That might sound like a lot of computers, but I stopped the numbers at 2010 because that’s about the time phones begin to get counted in the number of “computers” made and shipped. I’m writing this in 2013, and the last three years have seen what we had previously called computers — laptops and still the occasional desktop — dwarfed by tiny, mobile computing products, phones and tablets, which now themselves steadily sprint toward a new evolution.

I love charts.

And simply saying that there are fifteen times as many computers in 2010 than in 1990 doesn’t even scratch the surface of talking about how much more power we have. Our computing power is incredible, and the threats to that power, and our many cat photos, are wide-spread, malicious, and very persistent.

To be fair, science-fiction authors of the 1980s and ’90s were only so visionary. They never considered how much of cyberspace would be filled with advertising, and how unnecessarily clumsy the filtering controls would be, and I don’t think you can blame them because it doesn’t make a lot of sense to me, either — though it is undeniably the current reality.

The agents of the U.S. Secret Service who were responsible for Operation Sundevil should be acknowledged as the futurists they were. They went looking for an emerging threat that looks basically like where we are now. They were right, even though they were twenty years ahead of their time. Maybe they would’ve done better writing science-fiction.

Standard
Going to California

The Hacker Crackdown — 5

The hacking world was a big place, in the extended sense. There were a lot of curious and tech-minded people, almost entirely guys, who had leveraged their interest into great success. It had been rumored that Apple co-founder Steve Wozniak, while in college, had made and sold little tone-generating boxes that would let you make free long-distance calls — and in fact today you can see a Blue Box built by Apple’s co-founder in a museum.

So it really should have been only so great a surprise when, after Steve Jackson spent months merely trying to gain access to the data seized by the Secret Service, a collection of successful hackers including John Perry Barlow, Mitch Kapor, and, yes, Steve Wozniak, put up the money to create an organization called the Electronic Frontier Foundation.

Today, the EFF is a famous lobbying group, with a long history of helping the digital downtrodden. The day after announcing their formation, the EFF announced their first case: Steve Jackson Games versus the U.S. Secret Service.

They spent $200,000 over nearly four years before finally getting the Secret Service into the courtroom, and those were early-1990s dollars. The stated goal of the trial was to establish for the first time that email was not virtual or somehow theoretical, but that it had the same existence as physical mail, and deserved the same protection. And it’s true that electronic mail has a physical manifestation. It sits on a disk in the form of tiny bits of magnetic material, representing either a one or a zero, written by a tiny magnet no differently than a letter written by pen or pencil.

The U.S. Department of Justice defended the Secret Service, saying that email on a server wasn’t private at all, because if you gave your mail to someone else to store then you’d given up any concern about its contents. They probably just forgot about how safety-deposit boxes work, because otherwise putting your private love-letters in a bank vault should be the equivalent of granting the U.S. Department of Justice permission to read them at will.

This was a serious concern, because after days and weeks and finally months of Steve Jackson being told that yes, tomorrow we’ll let you at your data, when he finally got one of his machines back it was apparent that someone working for the Secret Service had read people’s personal emails, and then deleted them. Steve was able to recover the content of the email by having someone perform some minor digital forensics on the disk itself. Clearly some quite personal messages, having nothing to do with the investigation, had been meddled with — again, without a warrant.

Then there was the worst part, really: in America, we don’t suppress publications until after they’ve been published. When you suppress something before it can be published, it’s called prior restraint. This one of the worst forms of censorship. There are exceptions to everything, of course. In the early 1970s, when fighting publication of The Pentagon Papers, which detailed the previous U.S. president’s unconstitutional and immoral behavior leading to what’s now called the American War in Vietnam, the government appealed their case all the way to the U.S. Supreme Court, and they still failed to prove a need for prior restraint. So taking action against a science-fiction game was probably not going to fly.

You might not like something — I might not like a lot of what gets printed, were I were to pay much attention — but you have to let it be published. By grabbing the cyberpunk game and claiming that this was the connection between the Mentor and the Legion of Doom and their raid on a small game company — which had not been explicitly covered in their warrant to search Mentor’s house because when they raided him, they didn’t know where he worked — they had successfully, illegally suppressed a publication. They had performed the late-Twentieth Century analog of marching in and seizing a printing press and told them to stop from preparing to publish their seditious posters that would only stir everybody up.

Years later, Steve Jackson Games published a card game called Hacker, which was a not at all veiled description of how a lot of computer crime at the time was actually managed, using a game mechanism similar to that of Steve’s masterwork game, Illuminati, which also happened to be the name of the bulletin-board system that had been seized by the U.S. Secret Service. It wasn’t a bad game, and made some money, so that’s funny.

The trial itself was short. Every day after the proceedings, Steve and the Mentor would come back from the courtroom, still dressed in their suits, and tell those of us back at the office how the trial was going. Given that the financial disaster on the other side of the raid caused Steve to lay off half of the company, and years later things were still very shaky, we were all interested.

The prosecution spent about two and a half days attacking the Secret Service before resting their case. Before the defense kicked off their side, the judge had a little chat with the agent, Tim Foley, who had led Operation Sundevil and the mayhem that came before it.

It was a made-for-TV moment. We have all kinds of wonderfully colorful language to describe the words that passed between the judge and the lead agent. My English friends might smile and say that the judge was clearly unimpressed with the gentleman in question. I remember hearing that the judge used the word “idiot” to describe the man to his face, but I wasn’t able to turn up a full transcript, so I won’t claim that here.

Happily, Joe Abernathy published a trial report in the Houston Chronicle. From his many great quotes, here’s my favorite exchange, from the third day of the proceedings.

The judge said, “Did it ever occur to you, Mr. Foley, that seizing this material could harm Steve Jackson economically?”

Tim Foley, the Secret Service agent, replied, “No, sir.”

The judge disagreed. “You actually did,” he said, “you just had no idea anybody would actually go out and hire a lawyer and sue you.”

Ouch. And through the rest of the 1990s, the FBI ended up with a clear jurisdiction over computer crime.

Looking back, though, I’m surprised to find that I have some sympathy for the Secret Service. As wrong-headed as they were — and criminal, and unethical, and immoral — in a certain way, they were right.

Standard
Going to California

The Hacker Crackdown — 4

The technical details of how the network attacked itself has been described with tremendous accuracy by Bruce Sterling.

Basically, a bunch of AT&T’s long-distance switches were running recently upgrades code with a tiny bug which caused the switches to reset themselves if two uncommon things happened at the same time.

When the switch starts up, it sends a signal to nearby switches saying, “Hello! I’m here now, and can take calls.” Its neighbors note their new companion. However, here’s the problem: if two phone calls come into switch in the same millisecond, while it is logging a “Hello!” from a new neighbor, it hits the bug and resets itself.

While the switch resets, the phone-call load on its neighbors goes up, making them more likely to get two calls at the same time. And when the crashed switch comes back up, it sends a “Hello!” into the more heavily loaded switches — which crashes them, increasing the load on their neighbors, making those further neighbors more likely to crash when the original switch’s neighbors come back up.

And the wave propagated quickly through the telephone network, crashing switches in far-away cities from the first crash, in Manhattan, even echoing back to crash switches that had previously crashed and restarted. And this went on for some time.

It was a mess. AT&T took out a full-page newspaper ad to apologize for the problem, it was that bad.

At the time, though, this kind of an explanation, even as simple as I’ve tried to make it above, was hard to approach and even harder to accept by the phone-company security people and the law-enforcement authorities of twenty-three years ago. They knew the story: hackers said they would crash the network, the raids on the Atlanta hackers turned up evidence that they knew how to crash the network, and now the network had crashed. Who crashed that first switch that caused all this nonsense? Had hackers stolen the source code, figured out the bug, and sent “Hello!” signals to a bunch of switches until one of them finally fell over?

I don’t know that we ever figured it out. Decades later, coming out of a hacker culture where the only currency was bragging rights, it’s odd that no one ever claimed responsibility for the snowballing phone switch crash of 1990. Either someone is so mortally embarrassed that they won’t talk about it, or were playing around and have no idea what they accidentally did — or hey, maybe it was really a systemic accident.

It’s likely that a set of recently upgraded switches, heavily loaded with holiday traffic, would hit the bug on their own and crash on their own. It doesn’t require the invention of evil hackers.

Evil hackers will be invented later. Don’t worry; we’ll get there.

But instead, the authorities attacked the hackers. At the time, it must have felt great, taking out hacker after hacker and finding little behind the curtains but really geeky people, mostly,  powerless in the real world.

There were other hackers, however, who in the previous ten or so years had generated a lot of currency that was not solely bragging rights, but actual, real-world currency, that you could take out of a bank and strike someone over the head with.

Two months after the crackdown saw the hacking world strike back in the most unexpected way. Or actually, maybe the authorities could’ve expected it. After all, hackers like nothing more than subverting a system by using its own tools against it.

Standard
Going to California

The Hacker Crackdown — 3.5

So there was money in cyberpunk, and a lot of it, especially for the people who had the vision to see where things were going, and when the Secret Service knocked on Mentor’s door, Steve Jackson Games was close to finally sending their cyberpunk game to be printed, which would’ve made them number three to the cyberpunk-game party. More importantly, because they were going through financial straits, Mentor’s book was basically going to save the company.

It’s easy to imagine that the Secret Service and the rest of the law-enforcement agents they corralled into their adventuring party had never heard of cyberpunk. It’s easy to imagine how they could have felt when finally what they were hearing fit the narrative they were expecting: the hacker they were there to bust had been leveraging his evil knowledge to enrich himself in the real world by building an education on the underground into a game.

Keep in mind that Mentor had been merrily shipping books to the Legion of Doom guys in Atlanta, who were avid gamers. When the Secret Service walked away from those busts with boxes of paper evidence, a lot of pages contained cryptically hand-written numbers related to actual hacking efforts, and a lot of pages contained equally cryptic numbers related to the elaborate role-playing games in which the guys were so frequently engaged. Sometimes the same page would even have both kinds of information.

It’s easy to imagine how excited the agents were that the game company was right there, at the bottom of the hill — they could almost see it from where they were — because of what they did next.

I’d done some intern-level work for Steve Jackson Games, and good friends with a good number of people there. I’d spent months helping them plan a convention, and a bit later I ended up spending four and a half years of my life in that building, into which the Secret Service stormed, guns drawn, to raid the place. They broke locks, they engaged in some playful vandalism, and they walked out with every computer that was thought to hold a copy of the cyberpunk book — including the company’s official bulletin-board system — as well as every hard-copy they could find, which was every one that anyone had with the last several months changes, and the game had been changing rapidly. They even took the expensive in-house printer, in case a copy of the book was tucked away in there somewhere.

When Steve Jackson confronted the Secret Service, they told him that the cyberpunk game was a thinly veiled handbook for computer crime. He tried explaining the reality of the situation, that it was science-fiction, but over and over the Secret Service said, “No, this is real.” This was at their office, with his lawyers. They were staring at what was essentially a rather glamorous adventure for Dungeons & Dragons, confusing it for The Anarchist’s Cookbook for a new age. And if the same guys who’d interrogated Mentor had ever gotten a look at the evidence hauled away from the Atlanta hackers, you could sort of see how they were able to jump to that conclusion. After all, it made their story work.

Two months and about a week later, in May of 1990, the Secret Service seemed proud to announce the success of Operation Sundevil, the real hacker crackdown. Everything I’ve told you so far was just a prelude, a bit of research, in advance of the big hammer coming down. Their short press release read, in part, “Our experience shows that many computer hacker suspects are no longer misguided teenagers, mischievously playing games with their computers in their bedrooms. Some are now high tech computer operators using computers to engage in unlawful conduct.”

One hundred and fifty agents across at least twelve cities took down twenty-five bulletin-board systems, capturing 42 computers and as many as 23,000 floppy disks. They executed twenty-seven search warrants, leading to three arrests.

If I had kept doing what I’d been doing in high school, one of those warrants would probably have been for me, even though like most people who had agents appear on their doorstep that day, I hadn’t been stealing anything or hurting anybody. So while I was mad when the Mentor and Erik Bloodaxe and Steve Jackson Games were raided, the hacker crackdown two months later was chilling. Weeks later I moved back to Austin, into uncertain times.

As with Erik Bloodaxe, they never pressed charges against Mentor. And as with all the other innocents who had tens of thousands of dollars in computer equipment taken from them for no good reason, he was expected to suck up his loss — and the disruption to his life, and to his wife’s graduate thesis, and to all the people on his team who had to be laid off at work because the book that was going to save the company would definitely be postponed — because the Secret Service wanted to make it clear that possessing certain simple knowledge was not only anti-social, it was illegal, and it was punishable by whatever they had within arm’s reach to throw at you. They could march into your home and take what they wanted because it was legal, and because they had a story to tell.

Unfortunately for the U.S. Secret Service, while their agents had done the right thing and gotten warrants for their raids on Fry Guy and the Atlanta Three and Terminus and Erik Bloodaxe and the Mentor and at least twenty-seven others, they did not have a warrant for the raid on Steve Jackson Games.

I can’t say that Mentor played them, but something he must have said about his cyberpunk game, or the way he said it, must have caused their frustration with being doubly empty-handed to boil over into a ludicrous rush downhill to a game company’s offices, adrenaline pumping, waving employees away with their pistols while they ransacked the place instead of waiting the short bit of time for a legal warrant to raid Steve Jackson Games. Not that what they ended up doing would have been legal, but we’ll get to that. A legally warranted raid still would have shattered the company, as it would be months before they let Steve access even some of his captured data, and five years before we got our equipment back.

I think the U.S. Secret Service agents were lying to themselves about why they were doing what they were doing. It quickly stopped being about finding out who had crashed the phone network. After a century of authority being leached out of the Secret Service — to the Federal Bureau of Investigation; to the Internal Revenue Service; to the Bureau of Alcohol, Tobacco, Firearms, and Explosives — I think it was a power-play to claim jurisdiction over hacker-related crime.

Sometimes the thing you focus on avoiding is what you end up hitting. On the other side of the Secret Service’s colossal missteps, which I’m not even through cataloging, the FBI have firmly held jurisdiction over “threats to the nation’s cyber-security”. The Secret Service agents were busy-looking but ultimately lazy, and this was coming from someone who knew what lazy-but-busy looked like. It would take a few years before the U.S. Department of Justice made that Secret Service operation and their federal supporters pay for their moral misbehavior, but thanks to what Mentor had set in motion, they would eventually be undone.

More importantly, even after Operation Sundevil, they never found anyone who knew anything about that January’s fateful telephone network crash, in part because their narrative had no room for the idea that the system could have brought itself down — which was, it turned out, exactly what had happened.

Standard