Going to California

Life By The Valley — 2.9

My first day at work in Palo Alto was mostly meeting a lot of people and signing a lot of papers. I’d already met my new boss, Phil Straw, when I was interviewed. He was a quiet, thoughtful, outspoken force of nature.

“Here’s a Phil story, for example,” Doug said, on the way into work that first day. “We’re at dinner, he gets a phone call. After listening for a moment, Phil asks for and gets a few numbers from the person on the other end. Then he pulls out a laptop, reads a few numbers from a spreadsheet, then says, ‘Good luck,’ and hangs up, puts the laptop away. I ask him, ‘What was that all about?’ And he says, ‘Oh, just a mate of mine on a boat. Came up too fast from a dive and felt the nitrogen bubbling up out of his skin. Asked me how far he had to go back down, for how long, to decompress.’ Phil and his friends are serious divers, but you should know he’s the kind of guy who gets phone calls like that.”

And no surprise, Phil now runs a company that makes custom dive computers that manage exactly that kind of thing, diving down to crazy depths and using delicate mixes of different gasses in order to let you stay deeper longer. It also has to let you know how, and how quickly or slowly, to come back up, or else you’ll die.

I’d be making it up if I said I remembered much of what happened that day, but certain moments stayed with me.

I remember being lightly briefed on recommended security protocol, and being relieved that in my general paranoia I was already meeting or exceeding most of their recommendations. But one other person was being on-boarded the same day that I was, a guy with the same initials as me. We signed our paperwork at the same time and, to our mutual horror, discovered that our signatures were identical: DP-identical-sqiggle. As in, we couldn’t tell them apart ourselves. We actually took a step back away from each other, I could feel my eyes growing as wide as I saw his opening up. The next day, we both confessed to each other that we’d spent part of the previous evening practicing new signatures.

Then there was the man I met on the street. Doug and I were on our way to dinner, after my first day at work in Silicon Valley.

“Hey, is that a game store?” I asked. It was the first game store I’d seen since driving up from Austin the day before, though I was sure the San Francisco area had no shortage of them.

“We can head on back after we eat,” Doug offered.

The following block had a “Dianetics and Scientology” sign along half its length. On the corner stood a wild-looking old guy, long white hair whipped to the side by the passing traffic. He bore a sign which read, “Scientologists have space cooties! www.xenu.net.”

“I think that’s Keith,” Doug said with mild surprise. “Well, we can go back and see Keith, too.”

We ate. Then the game store, and Keith.

Doug called out to him as we approached. Keith looked a little leery of us at first, and a little crazy, too. Then he recognized Doug and both the leeryness and his insanity fell away. The two of them did some catching up, I was introduced, and then Keith’s background was made clearer. He’d spent no small amount of time working on Xanadu, a legendary hyper-text project in progress since the ’60s that had finally shipped that week. In 1980, he was made a founder of the L-5 Society, an organization promoting space colonization. In his spare time, he had several large axes he enjoyed grinding.

“What does that mean?” I asked, pointing at one of his other placards. It said, “You mock up your reactive mind.”

“That’s what they tell you after you’ve given them $160,000, that you’ve been in control of yourself all along: you ‘mock up’, or you define for yourself, your ‘reactive mind’, how you interact with the world — see?”

Keith has been increasingly villified by the Scientologists thanks to a long pattern of mutual lawsuits. By the Scientologists’ estimate they’d expended over $350,000 on fighting him in the courts. By his, they’d spent about $2 million.

“Wow,” I said. “Even by their count, that’s two reactive minds worth of cash.”

From around the corner walked a beautiful blonde woman, properly business-suited if not business-minded.

“This is Robin,” Keith said as way of introduction as she passed. “She’s a Scientologist. Robin, these are two of my friends.”

“Hello, Robin,” I said, but she didn’t seem interested in further conversation. She smiled dismissively and pushed the crosswalk button. Her smile faltered only slightly when she realized she’d have to stand there with us for a full traffic-light cycle.

“Robin can’t say ‘Xenu,'” Keith grinned. That got her.

“I think that’s just silly,” she snapped.

“Of course. Xenu is silly.”

“I know,” she sighed with the slowness of someone repeating a mantra designed to sooth anger, “that nothing I could say will make you think any different about Scientology.”

“Oh yes you could!” Keith gushed. “You could make me think it was far worse!” This quickly became one of the most entertaining exchanges I’d personally witnessed in my entire life. Keith turned to the offensive.

“What do you think about [forgotten Scientologist term]? Where they keep you in a chair and put boogers in your mouth?”

“That’s . . . ah, I’ve never heard of that.”

“Oh really? Well you should ask someone about it. If you can get to the Internet, search for it. People who used to be higher-ups in Scientology talk about it a lot.” Robin glanced nervously between him and the other side of the street. The light hadn’t changed yet. She visibly restrained the urge to punch the crosswalk button a few more times. That’s Scientology training for you.

“There’s a professor,” she said in defense, “an Oxford professor emeritus named Brian Wilson.”

“Brian Wilson?” Doug asked. “Of the Beach Boys?”

“OF OX– . . . of Oxford. A professor. He’s done research into apostates, going back to the 13th century, and he found they’re notoriously unreliable sources.”

“One, sure,” Keith gave her. “Two even. But when so many people recount the same story — with minor variations in the details, which accounts for different places doing things differently — then you just can’t discount it.”

The light changed. “Excuse me,” she said over her shoulder while charging across the street. Keith waved one of his picket signs at her.

“Bye,” he called. I’m sure he’ll see her again.

“Bye, Robin,” I said. Then, when she walked out of earshot, “What’s Xenu? Or should I just check out the web site?”

“Oh, you should check out the site. But in brief, L. Ron Hubbard had to stretch for a background for his new religion, and coming from science-fiction as he was . . . . Xenu is the cosmic entity who kidnapped trillions of aliens from the seventy-six inhabited planets closest to us. He trapped them in volcanoes on Earth about eighty-five million years ago — volcanoes that couldn’t’ve existed at the time — and when they were blown up, the alien souls were trapped here forever.

“That’s what they teach you when you get way high up in the organization: you’re filled up inside with alien cooties, and the only way to get rid of them is to, well, give Scientology more money.”

As far as Keith goes, within two years, about three months before the 9/11 terrorist attacks, he would be hunted down in Canada as a terrorist. He joked on an Internet forum that a Scientology office should be hit by a “Tom Cruise missile,” and a group of Scientologists apparently convinced a judge that this was a genuine terrorist threat. Keith fled the charges, and Scientologists tracked him to Canada where they reported him to the authorities as a dangerous man, wanted in the U.S. as a terrorist. Things went really poorly after that. I’ll let a Toronto journalist tell the rest of the story.

And that was probably the most important thing I learned in the depths of my first day in Silicon Valley — also, that I did not have a number for anyone I could call for help in decompressing. I knew I had to be careful; I had no idea what would bubble up, out of my skin.

Going to California

Life By The Valley — 2.8

“When do we start?” I asked my new boss.

“Week or two. Need to get some people back in town, need to get some things sorted out, then we hit it hard.” He puffed his cheeks with air, thinking. “Did Mary talk to you?” he asked.

“Yeah, she said she’d have an assignment for me first thing tomorrow morning, said she’d tell me then what it’d be.”

“Don’t fuck it up,” he said with a smile.

I laughed. Then I realized he was only half joking, before realizing he wasn’t joking at all.

“I’ll do what I can,” I said, getting up to leave his office.

“Oh, don’t do that, mate,” he said with a deeper smile. Then he turned back to his computer and I walked back upstairs to my little cube.

There I found Doug. “Lunch?” he asked.

(If you started reading from the beginning, you may remember a story about a guy who’d been picketing in front of the Scientology headquarters in Silicon Valley. If this were, for example, a book, I would move that story here. I’ve already removed it from its place among the earliest posts. But instead, of simply slipping it in here for the online readers, I’m going to bring it back in as the following post, as a sidebar. If you’ve already read it, you can safely skip it.)

On the other side of a late lunch, there wasn’t much to do. I felt the slight pressure of the money I was being paid, a fantastic sum to me at the time and to many people still today, and wanted to be productive enough to feel I was earning it.

“What can I do?” I asked Doug.

“Well, there’s not a lot going on right now. We have a number of consultants in New York right now — that’s where the corporate office is.” He took a sharp breath through his nostrils. “Have you heard about what’s going on with the company at large?”

I hadn’t.

The company’s full name was Kroll-O’Gara, formed by two companies which had only recently gotten married. Their individual businesses were booming, and there had never been a single, massive, well-rounded security company. Kroll was an old-school detective agency and O’Gara was an old-school armored car company, and between them they bought up some of the major players in other security industries. They purchased Background America to do the basic background checks, they bought a major corporate drug-testing lab, and a couple of other smaller joints. Then they started looking around for what to do for information security. They met up with a little consulting company called Securify—

“Really?” I asked Doug. “They called it ‘Securify’?”

He shrugged. Kroll-O’Gara had bought Securify eight months back, and were busily directing all inquiries about information security to the consulting arm of the Securify body, of which Doug was vice-president. I had been hired into the tiny but growing engineering organization. But the ultimate end-game, I was told, was to spin the information security group, where I worked — the former Securify — back out as a start-up, given that start-ups were hot.

“So,” I asked, “we’re going to use our computer security consulting practice to figure out what people need, and then grow a company around whatever we build?”

“Basically,” Doug said. “Though at this point, the real trick will be getting the board to agree on everything.” He sighed. “The company’s been on such a buying spree, trying to be the big security behemoth where there’s never really been one, that they’re letting themselves be a little distracted at the moment. Kroll was a global detective agency that had been around for something like thirty years, very well-entrenched with a lot of good customers, and O’Gara was an armored car company that traced its history back to the Nineteenth Century. The Kroll-O’Gara board is split between them, so you can imagine how conversations go sometimes.”

A tiny, dark pebble dropped into the pool of my new joy. The ripples it made would echo in my head for nearly a year before I would finally come to terms with how much trouble I was in. I give myself credit for understanding almost immediately what was wrong with the situation, and I forgive myself for not running full-tilt in the opposite direction. My life would simply become too exciting to walk away from.

“Hey, Doug,” I said. “Remember in Cryptonomicon, when one of the guys is comparing the kinds of people you get in tech start-ups to the different races from Lord of the Rings?”

Doug nodded. I went on. “You have Dwarves, who go down into the mines everyday doing the hard work and making the cool tools, occasionally digging out some magical thing that can change the world.”

“Or burn it down,” he said.

“Then you have Elves, who are the sort of snobby, elitist, high-minded architects of grace and beauty. You have Men—” I looked around. “—and occasionally a couple of women, who are the social creatures, making all the deals and organizing the armies. Occasionally you’ll come across a Wizard, who sweeps in looking like a homeless person, draws something on a whiteboard that blows everyone away, and then vanishes into the night. You’ll end up with a couple of Hobbits, who’ve never been out of Hobbiton and have no idea how things actually work and who’ll only survive if they can learn how to roll up their sleeves and dig with the dwarves, deal with the men, and communicate with the elves.” I paused to take a breath.

“Yes,” said Doug. “And your point?”

“Sorry,” I said. “Just got carried away. My point is — first, is that true?”

He coughed a laugh. “Absolutely.”

“So what we have is a company that’s half controlled by a bunch of debonair spy people in pressed suits, smoking cigarettes and thinking abstractly about problems, and you have a bunch of gritty, hammering out armor and chomping on cigars and talking about how much blowing-up their cars can take before getting blown up.”

“I don’t see what you’re—”

“It’s elves and dwarves. The spy people are elves, and the armor people are dwarves. That’s…that’s a gigantic problem.”

“Why is that a problem?”

“Elves and dwarves do not get along,” I said, “never ever. Never will.”

Doug was unperturbed. “We shall see,” he said. “Right now, what do you think about dinner? Jim can join us.”

“Definitely.” I’d been looking forward to catching up with Jim. “How is he?”

“Jim is doing well.” Then with great deliberation, he said, “We have something we have been working on. Would you like to hear about it?”

“Very definitely,” I said.

We met up at the only micro-brewery in Mountain View, Tied House, where Jim and Doug told me what they were up to — what they had been plotting between themselves for years, since way back in what by that point felt like the distant, fog-enshrouded past when we’d been working together at the game company. You won’t believe it. I didn’t.

Wait: I need to back up a step. I haven’t even told you exactly where I’d found myself.


Going to California

Life By The Valley — 2.75

There was this company — big company, well-known company at the time — that sold music online — selling music on physical media; in 1999’s August, Napster, the first major online music sharing service, wouldn’t attract the ire of the music industry for nearly four more months. This company was pretty big at the time, though I don’t even know if they’re around any more. Probably they were bought by somebody at some point.

Anyway, they’d received an email from someone who called himself a freelance information security consultant, about how they had this terrible information security problem. As evidence that there really was a problem, and that he knew what it was, he sent along a file listing tens of thousands of credit card numbers belonging to their customers. For a mere $100,000, wired to a foreign bank account number, he would tell them how to fix their security problem.

Naturally, they were unhappy people, throwing around words like “extortion”. So they had some connection which brought them to us, and we sent out a consultant to see how quickly they could figure out and close the breach.

Our consultant flew to their city that evening on the red-eye, arriving early enough in the morning to have to wait in their lobby while enough people dragged themselves in to work that he could finally gain access to the server room.

He was sort of expecting a bunch of machines, running such a large site. The operation was not a small one at that point. And they did have a bunch of machines holding things like album cover images and track listings and the like, though they only had one Web server that processed purchases. The pages that a user needs to see in order to complete a purchase are pretty lightweight and straightforward, so one beefy machine was able to do it for the whole site.

“And where’s the database?” our consultant asked. It was on the machine, he was told. On that same machine. Our consultant thought, “That’ll be problem — this machine has to be reachable from the public Internet, and the database probably has a port open, and they probably have a shit password on the database, if any, so this guy was probably able to connect straight into the database from wherever he is and trick its gag reflex into vomiting up everything it’s got.” But even though that was in his head, what asked was, “What’s all that beeping?” Because ever since they’d come into the server room, the computer had been beeping in an irregular pattern that did not sound like what you’d want from the machine that made your company millions of dollars every month.

The escorting employee beamed. “Oh,” he or she said, “that’s how we know we’re making money!”

I’m told that the consultant we’d sent did not say, “You’re kidding me,” out loud.

The employee went on. “Our CEO wanted us to have a connection to every sale, so we could understand that what we were doing was affecting people’s lives right then, exactly that second. So every time a sale goes through, he wanted the machine to beep.” I’m told he or she sighed. “Unfortunately, the only way we can know for sure that an order was completed in real-time is to verify with both the Web server and the database. So we needed the database and Web server on the same machine.”

“And the Web server connects to the database over a network port, right?” our consultant asked.

“Of course,” the employee said. “Normally the database would be on a separate box, but we put them on the same machine so we could make a ‘ding’ when an order went through. The Web server connects back to database, sitting on the same machine.”

“So you’ve got one machine, with Web ports and database ports open, sitting on the public Internet.”

The employee nodded. “Our firewall is supposed to be blocking that, though.”

I’m sure our consultant nodded patiently. The firewall, of course, was not. I heard that our guy was out of there after only a couple of hours, though we ended up charging them for a full day. We saved them 95% off of the hacker’s extortion racket, though, and I expect they were glad to pay it.

“So what happened?” I asked my boss.

“Fixed their firewall rules, I think,” said Phil.

“No,” I said, “I mean about all the credit cards that got stolen.”

He shrugged. “They’re already gone, right? And the breach is closed, right? So I don’t think they care.”

“But those card’ll just get sold to the Russian mafia—”

“Uzbekistani, I think,” my boss corrected.

“Whatever. They really don’t care?”

“They care that they took care of the exposure. That’s all they’re required to do.” It varies from state to state in the U.S., but in 1999 the reality was that the Internet had grown up pretty fast. If you hadn’t been paying attention to information security for the last fifteen years, you could be convinced that these problems never could have been predicted.

My eyes drifted to a middle distance, as they usually do when I convince myself that I’m thinking about something in many different ways at the same time. Whether or not I truly am, I have no idea. But sometimes, interesting things come out of these moments.

I said, “So, hackers are war-dialing common ports across a bunch of servers on the Internet — common database ports, for example. And when their script gets a response, it gets logged. Then the hacker comes home from work —”

“Or school.”

“—or school, and they check the list of Internet-accessible databases that their computer found for them during the day. Then they start making money.”

My boss leaned forward. “What we’re wondering,” he said, “is how we get people to scan themselves. Think about it: if you were the CEO or the CIO of a company, and every month you got a report that told you what your network looked like from the outside, maybe you’d feel great. Maybe you’d be interested in paying some small amount for a monthly or weekly scan of your perimeter to make sure some new admin hasn’t opened you up to something horrible since the last time you checked.”

“Because how else would you know?” I said, fully gripped by nausea.

“How else?” Phil asked. “That’s what we’re going to do: we’re going to build a scanner that can check any location on the Internet for known vulnerabilities, assemble a report and tell them how to fix things, if possible.”

I thought about it. “We’re going to create a database of all known vulnerabilities to Internet-facing server software, with nice text describing what they are and how the exploit works, if known, and how to fix it, if there is a fix. And we’re going to scan a bunch of sites constantly, to help them stay secure.”

“That’s the plan.”

The nerve that this touched in me at that moment was old, and went deep.

“We’ll be finding and tracking the open ports on hosts all across the Internet,” I said. “We’ll be uncovering what the Internet truly looks like, its real shape.”

He thought for a moment. “That’s one way to look at it.”

“I’m in,” I said.


Going to California

Life By The Valley — 2.5

“What are we going to do?” I asked my new boss.

“You know about ports, right?”

Now there are so many horrible ways to talk about ports that I’ve had to come up with my own less-bad way to say it.

The way things currently work on the Internet, you have addresses and you have ports. If you’re a computer on the Internet, you have an address, just like how computers networked over phone lines had phone numbers. But the address only gets you there. The same computer can serve up Web pages and manage email, from the same address, so you need some way of as soon as possible getting out of the way whether you’d wanted to talk about email or about the Web, so some years back, purely by convention we started giving each service a number. Each port number is like a different door into the same computer. If you’re running the right service — a Web server on port 80, an email server on port 25 — then you’ve basically opened a door into that computer. The door may not go anywhere, but it’s there.

“I think I know about ports,” I said,

“Like, how many are there?”

“Really? Only a few major ones. But as many as you’d need. Sixty-five thousand.” Because computers are so super-rational as to be completely insane, they believe that 65535 is actually a nice, round number, because that’s how many ports there are.

“Per protocol,” he added.

I nodded. I’d neglected to remember that there were two major core Internet protocols, and they each have more than sixty-five thousand possible ports.

“But that’s not the problem,” he continued. “Or rather, it is the problem. There are so many machines out there with ports open, people have no idea what’s going on inside their companies.”

“What do you mean?” I asked.

“I mean,” he said, leaning forward, “no one has any fucking idea what is actually going on in their network.”

“How can that be possible?”

“It takes knowing what you’re doing,” he said simply. “It takes time, and money, and attention. You have to pay attention, to see what’s going on. If you don’t see it, it’s like it didn’t happen.”

“But people don’t care that what’s happening could be somebody ripping them off?”

“They don’t care until they hear about it.”

It wasn’t what I was expecting to hear. I figured that someone, somewhere, must have their shit together.

“Firewalls?” I asked.

“Requires you to set up the firewall, then watch it, see what it’s doing. And most people have to set the thing up so open that it’s not doing them any good.”

“I’m very surprised.”

He shrugged. “It’s how the world works. Nobody wants to spend money on something until they know it’s costing them money not to. That’s the problem with selling security. You’re doing your job and all you have to say at the end of your day is, ‘Everything’s okay,’ and that’s not getting you more budget, or a raise, or anything. You only get attention when everything’s so fucked up it’s your ass on the line and you’d better get things sorted out right now or you’re done. After that, you go back to a boring life of telling people things are okay, even if you’re pretty sure they’re not — they’re just not on fire.”

“Sounds about right,” I admitted.

“That’s what people usually think when they hear this is a security company. They think we sell security, when nothing close to that could be the case.” He narrowed his eyes. “What do you think we sell?”

“Risk management,” I said.

“Exactly. We don’t tell people we will make them secure, because who wants that responsibility. We sell risk management. You know what we’ve been doing with all the security consultants?”

“I could say ‘security consulting,’ but—”

“Yeah. So we started out as a security consulting firm, information security. We were bought by this big company, Kroll-O’Gara, at the start of the year. They’re trying to make a big play to be a big security vendor. We’re using our contacts to do a bunch of security consulting for many different companies so that we can identify what problems these people are having, what’s consistent across them, so that we can sell them a solution — or make a solution we can sell them, more like.”

“So how many of these consulting gigs have you done so far?”

“Many. And we’ve learned a couple of things. Like, people have no idea what their network is actually doing. When they do know, they have no idea how bad an idea it was to do what they were doing.”

“So you’re talking about a way to help them manage the risk of doing what they’re doing.”


He told me a couple of stories to illustrate his point. Here’s one that I both believe to be true and think I can share.

Going to California

Life by the Valley — 2

Here’s what I was told after my interview, as they presented me with an employment contract and a check for moving expenses, when I asked what I could possibly do for the information security group of an international private detective agency.

“Have you ever heard of Packet Storm?”


“Me neither, but last week I bought it. It was a Web site that was being run for a while by a student at Harvard, a big collection of security information and tools and—”

“You mean hacking stuff?”

“Basically. As he was getting close to graduating, it came to the attention of Harvard that they’d been hosting Packet Storm and they shut the site down. He can’t afford to host it himself, so he sold it to us. He’s shipping us the hard drive. We should have it early next week. So we want to know what’s there, first. Then we need the site redesigned — it needs to look professional — and then all the tools and the scripts and the—”

“Are we talking tutorials or attack tools?”

“It’s a lot of things, I’m sure, but what’s there for certain, I’m not sure.”

“Do you know and you don’t want to say, or do you really not know and you need me to find out?”

“I’m sure I don’t know everything that’s in there.”

Mary smiled lightly.

“So you want me to index and categorize a Web site full of computer cracking scripts—”

“Security tools.”

“—of security tools—”

“And then run it, run the site. Organize everything, manage it, post new things.” She smiled more deeply, as if sharing a secret. “Because we’re not simply buying the hard drive, we’re buying the domain, and one of the most valuable things that we’re getting with that will be the email.”

It took me half a beat. “Because little kids all around the world are constantly emailing their new attacks and exploits and terrible, terrible shit to Packet Storm.”

“Right. And if we can use any advanced information we get coming up from these channels to protect our clients, all the better.”

So they wanted me to do for real, as an adult, what I’d being doing on the sly as far back as high school, collecting and distributing information that many people believed was dangerous but which, for whatever reason, I’d always felt strongly needed to be collected and shared. Or collected, at least — by me, at least.

It’s not that I would do anything with information like that, probably.

When I got to California, on my first day at work, I more formally met my boss, Phil, a Yorkshireman only a little shorter than me but about as broader again across his shoulders than I was. His hairline was a dark, receding buzz that only made his eyebrows seem more severe. He was a serious guy, as I’d find out. He smiled a lot, and he’d joke about things, but he was serious.

We’d met at the interview, though things were different this time. He smiled a little more deeply, in a way that made me feel like I was no longer an outsider. I didn’t just feel like I was talking to a serious person. I was talking to a serious person who was on my side.

“So,” he said. “Bit of a change in plans.”

“Um, okay.”

He winced. “So, the guy who actually owns the Packet Storm project here internally, he’s out of town right now, but he doesn’t want anything to happen on it until he gets back. Sorry.”

“Sorry, how?”

“Well, apparently he’s not impressed that I’ve hired someone to run the site for him.”

“He wants to run it?”

“No. He doesn’t actually want to do any work. He’s off in the middle of fucking Africa watching the eclipse.” I’d heard about the eclipse. Four months before the end of the millennium, and everybody’s talking about the total solar eclipse.

“Wasn’t that a week ago?”

“Something. But if you go all the way to bloody Africa, you stay a while.”


“So, we’re gonna be working on something else.”

“Wait. What’s the deal with Packet Storm?”

“He’s going to run it, with his people, let them do their own thing. He won’t be around much, anyway.”

“Is…is this guy a problem for you?”

Phil shrugged. “Was. He’s a bit of competition.”

“What happened?”

He smiled. “Just got into his machine and fucked with him a bit. Drove him mental over a couple of weeks. I thought, ‘That’s sorted.’ Now I think he suspects and he’s a bit pissed off. So he’s drawing a big line around Packet Storm. We’ll be working on something different.”

“Okay, like what?”

“A service. Something that could make money.” He paused. “I get the impression you know a bit about security tools, eh?”

I winced. “A long time ago—”

“I don’t mean a long time ago. I mean now, recently. You’ve kept your foot in it, have you?”

“Mmm,” I said.

I’d paused, many times, but I’d never truly stopped. I was never malicious, though I was that other, lighter M: mischievous. My drive toward mischief kept me reading certain mailing lists, and at least thinking sideways about how certain new bits of computerdom worked. Here’s an example.

Working my way through college, I’d gotten a job at a computer mail-order parts place. It was probably the most dangerous job of my life. In nearly every room of the joint, somewhere, was a loaded, semi-automatic weapon. The parts company — we sold memory, drives, printers, monitors — was run out of the back of a bankruptcy attorney’s office, and about every six months or so some client’s spouse, or ex-spouse, or creditor or other associate would come by and try to cause trouble. This was in downtown Austin, and nobody batted an eye. The density of weapons was simply so that our boss could most quickly, with the least amount of fuss, be able to discourage someone from making further trouble for themselves.

A woman in the office below us, a divorce attorney, was shot and killed by a client’s husband, who then killed his wife before turning the gun on himself. I was working that day, one thin floor right above them.

I disliked our boss. For such a smart guy, he was kind of dull, but he loved his toys. He let me design his magazine ads, which was how I did my first professional print work, but I had to use one of the crappy black-and-white 13″ monitors on the Macs in the sales room where I spent most days answering phones and taking orders or otherwise coping with angry customers. We had a lot of angry customers. In his office, though, he had two enormous 19″ monitors hooked up to the same computer. He had the biggest, most bad-ass machine I’d ever seen, and he used it to do really simple things with spreadsheets, and to try out all the new junk that people used to send him, to see if he wanted to sell it.

Like the Voice Navigator, the first commercial voice-control system that I ever heard about for the Mac. It was a thin black box with a thin microphone that came up at a 45° angle and ending in a puff of black foam about a foot from your mouth. You’d train it, saying, “Computer, shutdown,” three or four different ways so that it would have some slightly different samples to compare against as it sat there, constantly churning away, listening, in case you wanted it to do something for you. It sounded pretty cool, even though in practice it seldom worked at all, unless you had a really good sample.

One time, on a Saturday, he let me work on the ad on his machine. I’d already turned it into him but he wanted a bunch of changes, so I got to sit in the big leather chair while he cleaned his pistols in the other room, worried that we wouldn’t make the 3 PM FedEx deadline to get our ad in the next issue of MacWorld magazine. Every 15 minutes, his secretary would buzz me on his intercom to ask if I was finished. So when I was done, I figured out how the Voice Navigator worked, and the next time the buzz came through I recorded it, all three buzzes, really good samples, and I assigned them to the Shutdown action.

Days later, he was cursing. He didn’t know nearly as much about computers as he said he did, he just thought they were cool and wanted more than anyone else he knew. He had so much crap jacked into that Mac that it took something like five minutes to fully start up. Shutting down was as major an event, a shifting of applications, all running at the same time, which slowly tried quitting. Shutdown took so long that he never had an opportunity to associate it with the Voice Navigator. All he knew was his intercom would buzz, and he’d turn away from the computer to answer it, usually having to get on the phone after that. Once he was done with his call, he’d turn back to the Mac and it would be off. What the hell?

I caught it in action, one time. The phone buzzed and he looked away, but he kept his hand on his mouse; he’d been irritated for a good couple of days, and he was getting twitchy.

“Uh, huh,” he said over the phone. “Well, tell him he can—wait, hang on.” He squinted into his enormous monitor. “No, computer, don’t lose my changes, save the file. Okay, I’m back with you. Wait.” Under his breath, he muttered as he moved his mouse around to click buttons that were popping up in dialog boxes on screen. “Why are all these programs closing? Yes, save changes. Save changes.” Then he slammed the mouse down against his heavy wooden table so hard that the little circle holding in its rubber ball popped off and the ball that actually fed the motion data up through the mouse fell right out and rolled into the tangle of cables and floppy disks underneath his table. “Goddammit!” he screamed. “Fucking computer. Goddammit.” He remembered he was on the phone. “I’m gonna have to call you back.”

After a wholly unproductive week, he ended up erasing the entire machine, and losing a couple of months worth of data because he was afraid that any backups might also be corrupted. I’ve never heard a man curse that much or that hard in such a short period of time. He wasn’t a poet, he just had a good, workman-like approach to his cursing. I felt entirely justified, even though I hadn’t really done it on purpose. I just thought it’d be funny, especially that his problems stemmed from his inability to troubleshoot a simple problem, compounded by his poor computer hygiene — no one needed that much crap running at once. He so clearly had no idea how anything could possibly go wrong with what he’d made, so he had no idea what was going wrong. It must be some virus that no one knows about, he howled.

Also, I’d found out that he’d ripped me off for about two thousand dollars over a six month period of time, when some manufacturers were giving bonuses to salespeople on the sales of certain items. He told us that the paperwork didn’t go through, when really it had gone through — he’d simply used his own name in filling out all the forms for the five of us who worked for him. Still, I hadn’t meant for it to cause him that much grief. The second time, though — the second time I got to see him running around the office, literally pulling his thin hair out from his scalp, I meant it.

And that was just the kind of stuff you could do if you had hands-on access to someone’s computer. Early applications that connected machines to each other over the Internet were not especially well-coded, early on. As the Internet grew, more computers were connected to other computers, which meant that while more and more people could send each other email, or chat on private relays, it also meant that more and more people could attack random targets, at low cost to themselves and at a potentially high return on their effort — given a good target, or enough crappy ones.

For example, in the mid-1990s there was The Ping of Death. You could craft a couple of malformed packets of data, pop them in digital bottles and float them over to very many machines on the Internet, and when they opened them up to read them they would die. Or rather, the machine’s processing would hang, and you’d have to reboot the machine to get it to do anything again. I first ran into that on a chat client, a crappy little app which was itself vulnerable to a ping attack. If you wanted to kick someone off of a chat line, or out of some games, you could send some very innocuous traffic over the network to their address. At best, from their perspective, it would slow down their interactions, and at best, from your perspective, it would knock them offline.

Sometimes all you had to do was simply send a bunch of packets to the target faster than they could respond, again at least slowing them down but more likely crashing some service on their machine. There was a version of this called a Smurf attack. If you were on the same network as a machine, you could send out a bunch of packets which were fraudulently marked as having been sent by your victim machine, and the barrage of responses from all the hosts who thought the victim wanted something from them would crash the victim. You smurfed your target.

As people wrote more services — more name services, more mail servers, Web servers — the vulnerabilities only got more sophisticated. I could go a couple of months without paying much attention, or trying anything out, but things change so fast, and I’d have hated to have missed much, especially because I was still insatiably paranoid.

“Yeah,” I said offhandedly. “I kept my foot in it, a little bit.”

“How long you been hacking?”

“Since I was fifteen, so: half my life.”

He nodded. “Alright. You can do this. Here’s what we’re going to do.”

Going to California

Life by the Valley

I thought I knew what I’d be doing when I headed out from Austin to the San Francisco Bay Area — what specific job I’d be doing, I mean. I was told one thing, but once I arrived I was told that I would be doing something else, to be explained to me in a few days. Some people were traveling at the moment and wouldn’t be back until the next week, so they wanted me to get settled first, maybe take on a few little jobs here and there while I got to know the place.

Sounds like a relaxing time. But the drive out? It was intense.

It was the perfect topper to all my driving days back in Austin. I loved driving so much that it was how I used to procrastinate, while working at the game company. When it was late, and I needed inspiration to keep going, I would take Sixth Street across town to Red Bud Trail, and drive around in those hilly, moody neighborhoods out there until I spotted a deer. You could usually find several, frozen just off the road, if you kept your eyes open. Once I saw one — a symbol of what, I couldn’t say — I’d feel like I could turn around and come back.

The long, rolling drive out of Austin toward El Paso was an epiphany. Why had I never done it before? Because I’d always been told it would be boring. It wasn’t. It was gorgeous.

I hit El Paso as the late-summer sun was setting. Once you’re west of El Paso, you’re in another state. As a Texan it felt odd, knowing that I’d left my home state behind. Luckily, by the time west Texas dumps you into New Mexico, you’re halfway through New Mexico. I pushed on, given that the third state in my journey was not too far away.

Around midnight, in the middle of nowhere, I was channeled off the empty freeway by a diagonal line of cones into what looked like a truck weighing station where military men stood in small clusters, talking. Some held rifles.

I stopped where it looked like they wanted cars to stop. Holy crap, I thought, am I in a good-enough state to be driving at this point? As I rolled my window down, a man barked, “Where were you born?”

“Carswell Air Force Base, sir,” I said crisply, surprising myself.

He pointed forward while stepping back, circling his other hand to tell me I should move on, so I did, back out into the borderless darkness.

I made it about another hour, to Tuscon Arizona, before giving in to a motel, but six hours later I was back on the road with a full tank of gas and about $22 to get me through the day. I had some snacks, and some water; I could survive until I landed in Los Angeles, about the same time that my Austin bank would close for the day, which was when the rest of my moving expenses would be made available to me in my account.

My dad had recommended that I drive all night and sleep during the day, to avoid the heat. He didn’t know how much I enjoyed the heat. “You don’t want your car breaking down out there,” he’d said. But I had a cell phone and $22, and I wasn’t going to kill a day trying to sleep in Arizona. The drive through the great American desert was excruciatingly beautiful, vast expanse after vast expanse, punctuated by the occasional long rise up into what eventually turns out to be a low hill, after which the land opens back out and you coast on down into the next long, low valley to come.

I stopped at the General George S. Patton Memorial Museum & Gas Station with enough money to fill my tank and maybe grab a snack, though that had been pretty optimistic of me. There was a lot I’d be learning, including how much gas cost in California.

Unfortunately, the only shade for perhaps forty miles in any direction was underneath the gas pump handles. That’s where I surprised a bee, who was probably only looking for a place to cool off for a moment, which stung me.

It didn’t hurt much, but I’d already spent all but $1.70 of my money and couldn’t afford anything to ease a bee sting in any case. But what the hell, I’d suck it up.

Once I got back on the road, I started to notice my finger swelling where it had been stung. Then over the next twenty minutes, the swelling began to spread, from finger to knuckle to the meat between thumb and forefinger. Pulling out my hand-held recorder, I began to tell whoever might find my car on the side of the road about the foolish thing I’d done. If only I hadn’t filled my car all the way up — I could probably still make it to LA on less, right? — or had waited to drive at night, or had simply put everyone off another day before leaving so that I’d be traveling with the cushion of the many thousands of dollars that waited for me only a few hours in the future from where I was clearly about to die, on the side of the road, more than twenty miles from the nearest sign of civilization, not even a shotgun shack, as two-thirds of my hand inflated.

Then as the swelling continued to move, it seemed to lose its energy, diminishing overall. Over hours it faded, and as the low little hillsides cresting the end of every valley grew higher and higher, I finally popped out the other side of one especially tall one and thought, Ah, so that’s as far east inwards as the rain really goes. It was as if I’d punched my way through from desert to dreamland. The ground was lush, like I’d always heard that so much of the land outside of Texas could be. As each successive valley had even more green on the ground, the air rapidly cooling, the views out my dusted windows began to show signs of that most expected of scenery infestations, the suburban communities. They dotted, then they speckled, then they covered.

Throughout, I was talking — mostly crazy things, I’m afraid, muttering to myself. I haven’t been able to bring myself to listen to the tapes, though I have gone so far as to digitize them.

My descent into Los Angeles was the insanity’s last attempt to grip me. As I shot into the city proper, a horrible rhythmic noise echoed in my little car. I honestly couldn’t tell if it was the freeway that was awful, its enormous concrete plates all bowed in nearly exactly the same way, forcing a terrible DRUM-DRUM-DRUM sound into the tires and up through the car’s frame and into my forearms by way of the steering wheel, or if the car had simply taken all the abuse it could and was determined to shake itself to pieces.

Then I landed, in the languid late afternoon, at an apartment complex in north LA, ringed with palm trees, where I met up with an old friend. He and his wife had moved out to California, though they’d targeted Hollywood, not Silicon Valley. They calmed me. It turned out to have simply been a crappy freeway; my car was fine. They took me to a bank machine, where I found that I’d suddenly gone from having less than two dollars to holding on to a lot of money. I bought us dinner, and we laughed for hours — Holy crap, can you believe it? We’re here! Isn’t that amazing? It is; it really is — until one or two or all three of us fell asleep.

In the morning, I woke alone. I locked the door, went out to my car, and made the last, patient leg of the drive, six hours up the incredible coast. The air was like nothing I’d ever felt before, literally cool, while the sun shined bright all day long over green grass, waving in ocean breeze.

I had come through something, somehow. I was no longer going to California. I had arrived.

I still haven’t told you what I was driving out there to do, or what I would then find out they really wanted from me.


Going to California

In-between Days — Sidebar: Drive

I wrote this on December 17, 1996 about my most pressing passion: driving. 

When I am dead, I know what my ghost will do. At the moment of this writing I am, to my knowledge, nowhere near death. I am taking a defensive driving course. Defensive driving is a six-hour prison designed to punish people who have, for whatever reason, made a mistake of some kind while operating a moving vehicle — a car, a motorcycle, a truck, whatever.

The world has tried many things to make me a cautious driver. I can remember, as a child, being forced to watch a movie of cars hitting walls. They were fascinating. Each car would plunge along in slow motion, edging closer to the wall and its eventual doom. As bumper touched brick, a chain of events started which would lead to the front of the car collapsing like an accordion and the dummy behind the wheel smashing through the windshield.

When I was two years old, my parents were in a minor wreck. I’d been in the back seat, straddling the hump in the middle of the floorboard, when all of the sudden — wham! — the car stopped and I flew forward, cracking my little head against the windshield.

In the 1990s, our society insists upon safety seats for young children. Neither have adults been neglected in the search for a safer driving experience. Air bags have become popular in recent years, though recent reports have shown they can be fatal when protecting kids. Seat belts are as far as many people are willing to go, and many belt up only because it’s the law.

In college, in the early 1990s, I had a professor who professed to despise the legal imposition of seat belts. “Seat belts only make people feel safe,” he argued, “and a driver who feels safe is not a careful driver.” If he despised seat belts, he loathed air bags. “Safe drivers allow themselves a certain degree of carelessness, and increasing a person’s feeling of invulnerability only makes him even more lax in his driving.” He was glad to share with us his solution. “Outlaw airbags,” he barked, “and outlaw seat belts, and install a six-inch spike on every steering wheel, extending straight up from the steering column.” All of us in the class grew quiet, nervously rubbing our chests. “That’ll make for some safe drivers,” he concluded smugly. And some stiff arms, I thought.

I do not consider myself to be a reckless driver. However, more than anything else, I love driving — and it’s this passion which I’m sure will some day be my undoing.

I drive a convertible. My mother calls it “pull-me-over” red, and yet the presence of the law has been surprisingly absent from my life. For almost three years, I drove the streets of Austin with relative abandon. My closest friends are my favorite passengers. We whip through twisting roads with our arms in the air, screaming with glee. They call me Six Flags, because going out with me is more than a drive, it’s a ride.

In first grade, the world first strongly suggested caution by striking me down in front of my elementary school. While crossing the street, on my way home for the day, a large American car ended up on top of me somehow. All I remember was crossing the street, and the next thing I knew some woman was screaming. Perfectly calm, I thought, I wonder what’s wrong? She must be screaming for a reason. I opened my eyes, not remembering having closed them, and saw my leg pinned beneath a fat black tire. I was lying in the middle of the road with people gathering around me. It was fairly easy to free myself by slipping my foot from the shoe. Luckily, I’d been wearing metal inserts, so my foot was not crushed. They rushed me to the hospital in an ambulance. It flew down the streets, siren blaring; my six-year-old heart raced.

A few years ago, out late cruising some empty back streets with Dana, we found that the road we were on emptied out to a major intersection. I don’t know how fast I was going, but the speedometer had read 60 before I’d accelerated to better approach the light, which was green. The intersection we shot into has a steep grade that drops off sharply in the middle. However, I didn’t know this at the time. When we hit the grade, entering the intersection, I knew something was up. Instantly, we were airborne, coasting for seconds in the serenity of free fall. We stayed in the air long enough for both of us to realize we were in the air, open our eyes as wide as they would go, turn to one another, and begin screaming. Then gravity enforced its rules, car met pavement and I quickly applied the brakes, my heart racing.

I have been sentenced to defensive driving for making my heart race. It was a beautiful day, and I’d been on my way to my chiropractor to continue working on problems with my jaw. The sun shone brightly, but not too warmly. The car’s top was down. Music played loudly. There was no one else in sight, and I was smiling — as was the police officer standing in the middle of the road, waving me over. He said I’d been going 58 miles per hour in a 35 zone. I thanked him for pulling me over, and accepted the ticket for which I am now paying through my presence at defensive driving school.

Several months before being ticketed, Mentor and I were witnesses to a wreck. It wasn’t a normal wreck, but a one in a million shot, a car wreck so singularly surreal that I remained a calm and sober driver for some time afterwards. It was a beautiful day, and I’d been on my way to drop Mentor off at home before I returned to work. The sun shone brightly, but not warmly. My car’s top was down. Music played loudly. There was a car behind me, approaching very fast — nearly 60 miles per hour, witnesses from another vantage point later recounted. The speed limit was 35 miles an hour. I’d spotted the car in my rear view mirror and glanced in front of me to see what my dodging options were, but when my eyes darted back to the mirror the car had vanished. It was as though God’s hand had descended, picked up the car and prevented it from smashing into us. I was partially correct. Mentor turned in time to see the spectacle of a car in mid-air, upside down, flying just behind and to the left but parallel to us. It’d hit a curb immediately before the short bridge I had almost finished crossing, flipped in the air, and in one single smooth motion flown for several yards before falling into the creek bed beneath the bridge. The sound of the impact was much shorter than I’d expected.

Mentor was the first person to scramble down into the crash site. I parked in front of a day care center where children pressed up against a mesh fence trying to get a glimpse of the awful wreck. The car had landed windshield first on one side of a creek bed, slid on the ground for almost a hundred feet and across the small creek itself, rolling at least once before settling on its side, up against a tree. It was lightly dusted in dirt. Weeds stuck out from the front grill. It looked as though it’d been sitting there for years, discarded long ago, industrial driftwood. Four or five of us gathered around the perfectly silent scene. Up on the bridge, a woman with a cell phone called 911. The driver was still breathing.

Those of us who witnessed the wreck were kept inside the police cordon, up on the bridge. Traffic was routed around the ambulance and firetrucks and police cars. Medics cut away part of the car frame and pulled the young girl out. I remember thinking, Strange, her hairline starts awfully far back. Then I realized it was because she had a very tall forehead. Then I realized that her forehead was so tall because her scalp had been peeled back at least as far as the top of her head. As they finished cutting away the parts of the car frame that’d trapped her inside, they also pulled out most of the detritus that had piled up against the windshield after the car’s final tumble. The girl’s bag fell to the ground, as if purposefully positioned right-side-up for those of us standing on the bridge, a round, yellow “happy-face” purse, smiling up at us.

They brought her up to the ambulance, which was parked right behind us. I turned around to watch while, three feet away, paramedics tied the girl to a board, cut off her clothes from the ankles up and prepared to transport her to a hospital. She was a perfectly healthy girl, perhaps twenty. I needed to know she was going to be okay. My eyes stared at her feet, then slowly moved up the length of her body. I was relieved to see that she looked fine. Her feet looked fine. Her legs looked fine. Her arms and torso looked fine. When I got to her head, my eyes had a hard time looking away. I swallowed and thought, Oh, that’s not right. It will be a long time before I forget what that girl’s face looked like smashing into a windshield and sliding something like a hundred feet across the ground. I don’t know if she survived; they wouldn’t tell us her name.

Only months later, my memories of this event had eroded in my mind: one day I found I had no memory of what I saw above her neck. Today, nearly twenty years later, her head is a white blur, clumsily airbrushed out of my mind.

The world continues to suggest caution, and I am finally old enough to listen. I no longer thrill at flying down a narrow street at speeds far above what you might call legal. Time and experience has dulled most automobile adventures for me, after years of exploring the turns and hills and straightaways of the city in which I live.

But there is one turn. It’s the perfect turn, the driving maneuver against which all other maneuvers must be compared. It’s on my favorite street, the cruising road, Red Bud Trail. I take Red Bud Trail when I require peace. Its windings calm me. I am enraptured by the hypnotic patterns of its turnings, lined on either side by tall pine trees and thick green shrubbery. You will frequently see deer, gracefully frozen, tracking you as you pass.

The turn itself is beautiful for two reasons. First, it’s misleading. After several hills and turns, you’ll see the crest of yet another hill approaching as you climb to the top of one you’re on. But while descending, you’ll see that the next hill — the one you’d thought continued ahead — is instead just a branching of the road. Actually, the road turns very, very sharply right with no warning. Were you to continue barreling ahead, as you had planned, you’d chance slamming into the side of an oncoming car as it navigated the turn from the other direction. You have to react instantly, pulling the steering wheel as far to the right as you can (and, if you weren’t anticipating it, hitting the brakes) while gritting your teeth and hoping to God that you make it.

I’ve never mastered this turn, though I’ve tried countless times at a variety of speeds under many different road conditions. But even though my mind has learned caution and my heart has learned to pace itself, I know for a fact that after I am dead you will spot my ghost tearing down Red Bud Trail, as I myself have done many times before and will do many times yet. No one will be able to stop my wraithly red lozenge of a vehicle as I press its tires against the road, taking that turn over and over again, until I get it right.