The U.S. Code is very inclusive covering:

A large number of foreign countries have adopted similar statutes designed to protect electronic commerce and information stored on computers internally. (13) In many instances these countries cooperate with the United States in order to apprehend hackers operating inside their borders. (14) In 1998, the United Nations proposed that the member states effect a concerted effort to combat computer-related crimes. (15) Such crimes included hacking.

If you suffer damages from hacking, in addition to all of the statutes on your side, you are able to institute a civil suit against a hacker. Of course, most hackers have no money and, therefore, are judgment proof. However, this is not always the case.

What to do about hacking! Well, the best offense is a good defense. Computer owners must protect their systems against hackers. Hacking is so prevalent, that it is wrong to assume that it will not happen to you. Yet, even though keeping hackers away from your data is virtually impossible, you can do much to minimize your risk.

First, you must take formal inventory of all your computer assets -- hardware, software and data. Each item must be classified in terms of sensitivity and criticality. Typically, these assets are given values of 1 to 5 for sensitivity (ranging from not sensitive to extremely sensitive) and criticality (ranging from not critical to extremely critical). From this classification it is possible for you to perform a risk analysis. Most computers have public areas and private areas. For example, in a local area network, the file server might be a public machine while the individual client computers are private machines. The public area is where outsiders may access the system. An outsider should never be given permission to access the private (user) areas. Sensitive and critical data must be kept in private areas -- never in the public area. However tight security may be in the public area, it must be "super tight" in the private areas. Very sensitive material must be encrypted. Very critical material must be stored redundantly.

The first step in securing computers against hackers is establishing physical security. Hackers must never be able to access your computer. In large companies, strangers in business attire often walk from office to office attempting to gather information about the computers. These people have mastered the art of social engineering. For example, even in high security environments, I have been able to walk by the security guards by being friendly and completely believing that I actually belonged there. I was not even challenged. I have called corporate computer rooms at 3:00 AM and persuaded unwary computer operators to provide me with modem access numbers. Company employees must be educated in the familiar wartime doctrine: "Loose Lips Sink Ships!" Physical security is every employee’s responsibility.

The next step is creating a "firewall." A "firewall" is a barrier against unauthorized intrusion. Having a "firewall" on a computer is equivalent to having a lock on a door. Break-ins are possible, but less likely. The most common "firewalls" are software based. They are generally less expensive than hardware "firewalls," but hardware can provide greater security than software. A hardware "firewall" is a separate computer that serves as the interface between the outside world and the computers that process data. All modem and internet connections must be processed through this dedicated computer. The only thing that this computer concerns itself with is security. Every message passing through this computer in either direction must be authenticated. Software and hardware "firewalls" are commonly available for all but the most obscure operating systems. Having a "firewall" is essential to reducing the probability of intrusion.

Next, user identification and authentication procedures must be put in place. The most common operating systems come with common user names such as ‘guest’ and ‘admin’ pre-loaded with no password protection. Often, system administrators are not aware of the existence of these common user accounts. Computers containing sensitive or critical data should never be accessed by unidentified users. Users should be minimally authenticated using passwords. Computers requiring greater security should use biometric identification or physical tokens for authentication. Remember, even computers not connected to the outside world are vulnerable.

No computer can be perfectly secured against break-in by the most persistent hackers. Once the optimal tradeoff between security and functionality has been achieved, methods of detecting intruders and logging their activities must be put in place. All modem lines must have caller ID. Incoming anonymous phone calls must be blocked. Log files must be reviewed on a regular basis. Once intrusion is suspected, user activity auditing must be activated. To apprehend an intruder, software to monitor every keystroke by selected users is often utilized.

How would intrusion be detected? With all of these security measures, only the most sophisticated hackers can break into the system. Initial intrusion into a computer can occur in one of two ways. Either the hacker takes advantage of security flaws to circumvent authentication or masquerades as a legitimate user. Once having initially accessed the system, a hacker can set up mechanisms to avoid future detection. Often, after breaking into a particular computer many times, an adept hacker has multiple "back doors" of entry and numerous user accounts that can be used for future login. After logging onto a particular system whose security is less than perfect, a hacker can "piggyback" onto a computer that "trusts" the computer that the hacker uses for initial entry. Since serial computer hackers are usually also phone phreaks, it is likely that any phone number traced to a hacker would not belong to the actual telephone from which he is calling.

It is actually very hard to detect the presence of a hacker. Generally, while you are working on your multi-user computer, you are oblivious to the activities of other users. A hacker is just another user. You may see some extra hard drive activity (as evidenced by the "little lights" on the computer console), but you often see that extra activity whether or not there is another user on the system. The time to detect a hacker’s presence is when there are very few or no users on the system. Then, a modem light while no users are logged on can be a signal that a hacker is on the system. Intrusion from the internet is not as simple to detect. Hackers often alter the log files to make sure that their presence is undetected. Regular examination of the log files could reveal the presence of a hacker. Of course, some hackers flaunt their activities by leaving telltale files or images that effectively say: "Catch me if you can!"

Hackers usually do not want to intrude upon a system when other users capable of detecting their presence are already logged on. So, for example, the first thing that a hacker might do upon initially accessing a computer could be checking who else is logged on. If the system administrator is working, the hacker usually disconnects immediately. Hackers search a system to find user accounts that have not been used for a long time. The intruder then masquerades as that user. Suddenly, that user’s account gains system privileges.

If an intrusion is detected, should you seal the system or should you encourage the hacker to continue accessing the computer in order to catch the intruder. At first glance, it appears that sealing the system would protect the integrity of your data. However, if a good hacker was able to break-in once, he can break-in again. Hackers often create multiple back doors in a vulnerable computer. Remember, you cannot secure your system against a persistent hacker. Therefore, the only real security available stems from apprehension of the hacker. It follows that if a hacker is allowed controlled access to the system, the probability of capture is greatly enhanced. In this way, the hacker is isolated, and his M.O. can be ascertained.

Once the presence of a hacker is established, he must be tracked. As a starting point, the caller ID information must be recorded. The *57 (official call trace facility) must be activated. If internet hacking is suspected, the IP address must be recorded. The audit trails for the hacker’s activities must be activated. If possible, every keystroke of the hacker must be recorded to be used as evidence. Within one company, I am aware of a method that once a hacker is detected, he is routed to a separate computer. This special computer contains neither sensitive nor critical information. Bait is placed within the system to trap the unwary hacker. Yet, at no time is a known hacker permitted into the main system. Another company actually setup an electronic bulletin board service (BBS) to set a trap for a particular hacker.

Once a hacking incident is detected, C.E.R.T. (the Computer Emergency Response Team) should be consulted. (16) [Additional help from various organizations is available. (17)] Next, the authorities must be contacted. Local police should be contacted first. They should be able to coordinate activities with the FBI if necessary. Formal contact with law enforcement authorities is necessary to secure call tracing to the source and ultimately, search warrants. If intrusion is occurring on foreign shores, the FBI should be able to coordinate efforts with appropriate governments.

Evidence from your computer system must be collected with great care. Remember, this is what will be used during the hacker’s trial once he is captured. However, no matter how strong your evidence is, equally strong evidence must tie the individual to the crime. Since hacking is a remote crime, the perpetrator is invisible. Once the hacker is tracked, a search warrant must be obtained and his computer equipment, magnetic and other data media, and documents must be seized and examined for evidence. A forensic consultant must analyze the seized materials to establish the connection between them and the evidence collected from your computer system.

Prosecuting the Alleged Hacker

Successful prosecution of a hacker depends upon the physical evidence. Because it is a criminal proceeding, guilt (in the United States) must be proven beyond a reasonable doubt. This is not easy. The nexus between the hacking incidents and the hacker must be firmly established. All records concerning the intrusion incidents must be presented. The more detailed the evidence the better. Nothing should have been deleted or tampered with. Today’s judges and juries do not normally have a technical background, although, in this case, it might be better to select a technically savvy jury. The evidence must be presented in such a way as to be understood by the jury. Someone should summarize the evidence in a clear and concise manner. The State must present its findings from the computer materials seized during the search. Expert testimony is necessary to prove that the alleged hacker is the one who perpetrated the intrusion. An expert’s findings, conclusions and opinions are the under pinning of the entire case.

Defending the Alleged Hacker

It is inconceivable that the prosecution would be unable to present a prima facie case against the defendant. Following this presentation, the only good defense would be to create doubt that the intrusion(s) were done by the defendant. Remember, in all but the rarest cases, nobody saw the defendant while in the process of hacking. "It wasn’t me!", is the only defense.

To make its case the defense must mount a detailed attack on the evidence. If an alibi for the defendant can be established for the date and time that even one of the incidents were shown to occur, reasonable doubt has been created. Under these circumstances, the prosecution must put forth a weak "two hacker" theory. After creating an alibi for the defendant at the instance of alleged hacking, a good defense expert can make the remaining prosecution’s evidence collapse like a house of cards.

Other defenses would be to attack the inconsistency of the evidence. In addition, if the evidence is incomplete or does not firmly establish that the defendant is the hacker or that hacking actually took place, the defendant is likely to be acquitted.

Marcus Hess

In 1989, Cliff Stoll told the story of the capture and prosecution of a West German hacker named Marcus Hess. (18) Stoll was an astronomer who designed telescope optics. However, cancellation of a government grant caused him to accept a position as a system administrator of the computer center of the Lawrence Berkeley Laboratory in California. On his first day on the job, he was assigned the apparently mundane job of tracking down an accounting discrepancy on the LBL computers. Stoll was a good detective. He followed every "cyber" trail. His investigation led him to the conclusion that computer security (which was minimal, at best) had been compromised. Not only had a hacker intruded into the system, but he also acquired "root" or system privileges. The hacker would capture many different legitimate user accounts. When one was deactivated, he would go to another. Stoll was also able to figure out how the hacker broke in and what he was doing. LBL was afraid that he could cause severe damage to the computers and considered sealing the system against further intrusion by this individual. However, Stoll and his colleagues convinced their management that sealing off the system would have been impossible. Therefore, a plot was hatched to trap the hacker.

Stoll contacted the local authorities who traced the call to a Tymnet switch in Oakland, California. Tymnet was a "gateway" service that a user called into that routed him to any one of a number of computer systems that also used the service. Tymnet was one of a number of services available that provided local telephone numbers where directly accessing the computer would have been a long distance call. Users normally use packet switching services like Tymnet because long distance computer sessions (owing to the length of time of a session) can be very costly. Because the call came in from Oakland rather than from Berkeley, it was obvious that the hacker was not working locally. Tymnet officials helped LBL with call traces. Sometimes the hacker’s calls appeared to come from the homes of Jack London, Ed Meese and Gertrude Stein. Eventually, with help from AT&T and the FBI, it became obvious that the calls were being "piggybacked" across the entire United States with their origin being Hanover, West Germany. Since this type of hacking was new, total cooperation from the FBI and the West German government was not immediately forthcoming. Eventually, the German authorities were able to break in and catch Marcus Hess in the act.

Hess was a particularly dangerous hacker. His activities began in Hanover and expanded out of the University of Bremen or through the German DATEX-P Network via satellite link or transatlantic cable to the Tymnet International Gateway. From there, he branched out to the Jet Propulsion Laboratories in Pasadena, California and to the Tymnet Switching System. It is from Tymnet that he accessed the LBL computers. His primary use of LBL was to "piggyback" onto ARPANET and MILNET. ARPANET was a civilian wide area network created by the Department of Defense. MILNET was its military counterpart. ARPANET ultimately became the internet that we know today. Through MILNET, Hess was able to attack approximately four-hundred U.S. military computers. These facilities included:

Hess was a computer prodigy who was recruited by the KGB. He was a spy. He sought to obtain U.S. military information and pass it on to the Soviets. He would peruse U.S. computers and gather information usually as mundane as schedules concerning the movement of troops or supplies. Stoll and his colleagues realized that the LBL computers were being used mainly for "piggybacking." At first, when he contacted the security officers at the various compromised military facilities, these officers refused to believe that a hacker could break through the seemingly tight security. Eventually, most of these people cooperated with Stoll.

Stoll hatched an idea to trap the hacker. It was important to keep him online as long as possible in order to effectively trace his calls to their source. To that end, he created records of a "bogus" military project being conducted on the LBL computers. The pretense was that Lawrence Berkeley Laboratories was engaged in an important part of the SDI Star Wars project. Several LBL personnel worked full time creating many letters and memoranda that appeared to be military in nature. Stoll used a separate dedicated computer to monitor and record Hess’ activities. Although a scientist reading this material would have known that the information was worthless, Hess was no scientist. He was just a clever computer hacker. The bait worked, and Hess was ensnared in the trap.

Stoll testified at the trial of Hess in Germany in 1990. Hess was found guilty of espionage and received a one to three year prison sentence. He was eventually released on probation. He now writes networking software for a computer company in Germany.

Cliff Stoll’s detective work in this matter was exemplary. Apprehending Hess was not easy. Law enforcement and government authorities were not always cooperative. Stoll was persistent. He made careful records of Hess’ activities. His computer and logbook evidence was clear and definitive. When Hess was captured in the act, the nexus between him and his activities was firmly established. Here is one of the earliest examples of how a good forensic investigation produced excellent evidence that led to the conviction of a dangerous hacker and an international spy.

Mark Abene (a.k.a. Phiber Optik)

Mark Abene began hacking as a teenager in the 1980’s. He would stay awake most of the night working on his Radio Shack TRS-80 computer. The following day he would sleep through math class. As a youngster, Mark was already adept at social engineering. He would call the New York Telephone business office and, in a deep voice, claim that he was from the Repair Service Bureau. He told the woman on the line that he did not have a directory handy and that he needed a number for a line assignment. (19) He would then call the line assignment office and tell them that he needed a cable-and-pair number for his own telephone number. He later began hacking into the telephone company computer systems such as ICRIS (Integrated Customer Record Information System) and COSMOS (Computer System for Mainframe Operations). His primary objective was to learn more about the telephone system, but he was able to steal service first for himself and then for his friends.

Eventually, through the various BBS’s that were available to hackers, he "hooked up" with the hacker gang called the Legion of Doom (LOD). He was seventeen years old. At this point he adopted the alias of Phiber Optik. Mark believed in the hacker ethic -- to look but not to destroy. Eventually, he began to hack into other hackers’ computer systems. After a number of years, Mark was kicked out of the Legion of Doom because of an argument with its leader. He then formed a new gang called Masters of Deception (MOD). The two gangs became bitter rivals, and gang wars began taking place in cyberspace.

As time went on, telephone company gurus realized that something was going on. They were able to occasionally kick Mark and his friends off phone company computers. However, Mark would always be able to get back on.

Tom Kaiser was a security officer with the New York Telephone Company. He dedicated himself to catch these intruders. Teaming up with an expert named Fred Staples, they monitored the calls of another known hacker, and they found a large number of telephone calls to Mark’s home. In fact, these calls would occur invariably each time after the other hacker would break into the telephone company computers. By this time, Phiber Optik and his friends had penetrated deeply into the phone system. Kaiser was worried. He was concerned that with a single keystroke, the hackers could disrupt phone service to the Wall Street area. He did not need a court order to wiretap Mark’s phone. Ultimately, Kaiser got the U.S. Attorney’s Office involved.

Mark and his friends did not confine their hacking activities to the telephone company. They created problems for AT&T, WNET-TV and Hallmark. The problem was that various MOD members began to boast online about their activities. MOD began breaking into private computer files, rewiring telephone lines and obtaining confidential credit information on individuals. The conflict between MOD and LOD became intense, and all the while, federal agents were monitoring all of the telephone lines and were collecting evidence.

On January 15, 1990, the AT&T computers crashed leaving thousands of customers without long distance service. Mark and his fellow hackers thought that they had caused the crash. AT&T eventually took the blame for the crash. However, two weeks later, armed with a search warrant, the U.S. Secret Service raided Mark’s apartment and confiscated his computer equipment, disks and documents. Shortly thereafter, the apartments of the other MOD members were similarly raided. Soon, many of Mark’s friends signed confessions.

After the raids, the government authorities did nothing for a long time. The raid on his apartment initially scared Mark, but eventually law enforcement inactivity made him confident enough to begin hacking once again. He hacked into the TRW computers. Now the U.S. Justice Department, the FBI and the Secret Service really cracked down. For the first time in U.S. history, the authorities wanted to put wiretaps on computers. (20) In June of 1992, Mark and the other members of the MOD learned that they had become targets of a Grand Jury investigation. (21) Mark was given a court-appointed attorney. As a result of the indictment, Mark could have been sentenced to ten years in prison. Mark became famous. Confident, Mark continued his hacking activities.

Most of the other defendants in the case pled guilty. They all admitted complicity and implicated Mark. Mark pled not guilty and decided to go to trial. The evidence against him was massive. Then, five days before trial, Mark changed his plea to guilty. He was sentenced to serve one year in Pennsylvania’s Schuylkill Prison.

Kevin Mitnick (a.k.a. The Condor)

At the time of the writing of this article, Kevin Mitnick has been imprisoned by the U.S. Government without a trial for almost four years. (22) He was initially held on a fourteen count indictment (23), and charged with possession of unauthorized access devices (24), computer fraud (25), causing damage to computers (26), wire fraud (27), interception of wire or electronic communications, aiding and abetting (28), and causing an act to be done (29). Judge Mariana R. Pfaelzer (30) and Justice Sandra Day O’Connor have both denied bail to Kevin. (31) At times, Kevin was held in solitary confinement because of the unfounded fear that should he even get his hands on a transistor radio, he could cause problems with the prison’s computers. Although massive computer evidence exists against him, Kevin was, until recently, denied access to a computer to review the evidence being presented against him even when the computer was not connected to a modem.

Why the paranoia? Kevin Mitnick is considered by authorities to be the most dangerous hacker to date. Certainly, he is the most notorious.

On September 13, 1998, a group of hackers called HFG attacked the New York Times website and changed its entire appearance. Their message was clear: "FREE KEVIN!" As one drives in various parts of the country, FREE KEVIN bumper stickers can be occasionally seen. The media, including many prestigious newspapers and television stations, is seen to be sympathetic to Kevin.

Kevin David Mitnick began hacking in suburban Los Angeles in the mid-1970’s. He soon joined a group of phone phreaks that congregated in a pizza parlor in Hollywood. His goal was mastery of Pacific Bell’s computers. He would steal service. He would perform many pranks. He seemed to have a mean streak. For example, he would change the status of someone’s home telephone to that of a pay phone so that, when the individual would pick up the phone, he would be asked to deposit twenty cents. (32)

During the 1981 Memorial Day weekend, Kevin and two friends broke into the Pacific Bell COSMOS phone center in downtown Los Angeles. During this burglary, they stole much proprietary information (including password lists and operating manuals). They also tampered with the computers by inserting data that would facilitate later hacking. A telephone company manager soon began an investigation of the incident. He went to the local authorities. The case was solved when the girlfriend of one of his friends went to the police and informed on her boyfriend and others. Kevin was arrested. However, he was lucky that he was only seventeen. (33)

Kevin then became a serial hacker. He adopted the alias: "The Condor." He had several run-ins with the police. In 1983, Kevin was arrested by the campus police of the University of Southern California for using a university computer to hack into the ARPANET. He used the ARPANET to gain access to a computer located in the Pentagon. Kevin served six-months in a juvenile prison in Stockton, California. (34)

After his release, he continued hacking. In December 1987, Kevin was sentenced to 36 months probation for stealing software from the Santa Cruz Operation, a software company in southern California. In 1987 and 1988, Kevin and a friend, Lenny DiCicco, persistently hacked into the computers of Digital Equipment Corporation (DEC) in an effort to secure the source code for the VMS operating system. Scientists at DEC were aware of what was going on, and put up a valiant battle with the hackers. The local police and the FBI became involved. Because of Kevin’s phone phreaking efforts, the FBI was virtually powerless to trace the hackers’ telephone calls. However, even though Kevin and Lenny were friends and accomplices, Kevin made fake calls to Lenny’s supervisors at work telling them that he was a government agent and that Lenny was in trouble with the IRS. DiCicco then confessed to his supervisor who then called the FBI and DEC. Kevin wound up in federal court in Los Angeles. He pleaded guilty to one count of computer fraud and one count of possessing illegal long distance access codes. Kevin’s defense tactic was that he was psychologically addicted to hacking. The case gained nationwide attention. Kevin’s attorney struck a plea bargain that would send him to prison for one year and then to counseling for six months. (35)

After his release, Kevin continued hacking and phreaking. He became the target of an FBI investigation. A federal judge then issued a warrant for Mitnick’s arrest for violating the terms of his 1989 probation. However, when the FBI came to arrest him, he had disappeared. He had several close encounters with the authorities, but he proved to be too clever for them. Kevin continued to elude the FBI until 1995. All the while, he continued his hacking and phreaking activities.

His downfall came as a result of his hacking the personal computers belonging to Tsutomu Shimomura during the Christmas holidays in 1994. Shimomura is a brilliant physicist from Japan, raised in Princeton and living, at the time, in San Francisco. Shimomura is an expert on computer security. (36, 37) Over the next year and two months, Tsutomu Shimomura pursued Kevin Mitnick across the country until he was finally apprehended in Raleigh, North Carolina. Shimomura had help from the FBI as well as from several employees of various local telephone companies. (38, 39)

Shimomura discovered that the hacker who intruded on his computers used a new access technique called IP spoofing. This enabled someone to hack a network server computer by pretending that he was operating from a "trusted" computer. By the middle of January 1995, Shimomura discussed the matter with John Markoff, a New York Times reporter. Eventually, the two of them decided that Kevin was the hacker. This was done through Markoff’s knowledge of Kevin’s M.O. Shimomura carefully collected and recorded evidence about the break-in to his own computers and other systems. At one point, Tsutomu’s personal files were found on another computer that was hacked. It was eventually determined that the hacker was using cellular phones to make his calls. With the help of a Sprint Cellular engineer, the origin of the calls was traced to Raleigh, North Carolina. This engineer was able to narrow the location to within a kilometer. Shimomura went to Raleigh. He was able to further narrow down the source of the phone calls. Warrants were obtained. On February 15, 1996, Kevin Mitnick was arrested by the FBI in his Raleigh apartment. (40)

At the beginning of 1998, the following notice appeared at the Official Kevin Mitnick Website: (41)

		Wanted ASAP: Expert witness for Mitnick trial Computer Expert Witness Needed "Immediately" A computer expert is needed immediately to testify as an expert witness in an ongoing criminal matter in Federal District Court in Los Angeles. Kevin Mitnick is seeking a highly credentialed expert in computer security, telecommunications, system and network administration to testify in this highly publicized computer "hacking" case. This will be a groundbreaking case and is expected to attract significant media coverage. Testimony will be required as early as March 30, 1998 in Los Angeles, California. Further testimony will be needed at trial, later this year. Expert witness fees will be paid by the federal court. Qualified candidates must have an advanced degree and be knowledgeable in DOS, Windows, SunOS, VAX/VMS, and Internet operations. Experience with cellular telephone networks is a plus. Previous expert testimony and/or publication are preferred. Qualified candidates please contact Mr. Mitnick through his appointed defense counsel, Donald C. Randolph, Esq. at (310)395-7900.

Kevin has not yet been tried. What could his defense be? The evidence collected by Tsutomu Shimomura seems overwhelming. Furthermore, much incriminating evidence was found in his Raleigh apartment when he was arrested. I do not believe that the "addiction defense" will work again. A jury would probably not have sympathy for him, and Judge Pfaelzer does not seem to be inclined toward leniency. This case seems to be a prosecutor’s dream.

Mitnick’s court-appointed attorney, Donald C. Randolph, appears to be mounting a defense that Kevin’s constitutional rights have been violated. In an interview with Randolph, Mike Bruner of MSNBC states that "the Mitnick trial will venture into new legal ground... by refusing to plea bargain, hacker aims to set precedent." (42) Randolph goes on to say that Kevin’s indictment now includes twenty-five counts of causing $80 million in damage by breaking into computers belonging to companies such as Motorola, Sun Microsystems, NEC and Novell. He points out that this matter, scheduled for trial in January 1999, will be one of the first major federal hacking cases to go to trial. If convicted, Mitnick could face as much as 200 years in prison. Yet, Kevin refuses to plea bargain.

Whether or not Randolph uses the "nexus" defense, from the materials that I examined, I am not certain that the evidence conclusively proves scientifically that Kevin was the actual perpetrator in all of the criminal charges against him. From a technical viewpoint, there appears to be reasonable doubt.

John Doe

Recently, I was asked to perform a forensic investigation and to testify at a hearing for a young graduate student accused of hacking. I was engaged by the defense. The student, John Doe, completed his undergraduate work at a prestigious university far away from his home. After graduation, he returned home, worked for a year, and then started attending a local graduate school. His field of study was to prepare him for a profession that requires licensing.

John’s undergraduate school permitted him to continue using his computer account at that university to perform research and to receive and send email. At the time, use of the internet was not as prevalent as it is today. Internet service for home computers was not as readily available then as it is now. John either needed to use the internet to access his computer account or he had to incur costly long distance charges. From his experience, he knew that local universities normally permit students of other far away universities to "piggyback" on their computers to reach their own computer accounts when they are on vacation. For these schools, use of the internet is not a significant cost. John also knew the general procedure for doing this. A person wanting to "piggyback" did not have to log onto the local university’s computer. When a user dials the local modem number of the local university, the computer provides him with a front-end greeting. It then asks the user to login. By choosing the correct service, he can connect to any other computer serving on the internet without logging on to the local computer.

John’s graduate school, although closer to home than his undergraduate school, was still a long distance call from his home. Therefore, instead of using his own school’s computer to "piggyback," he located a school closer to his home. Without asking their permission, he repeatedly began to use their computer exclusively for the purpose of communicating with the other computer. Apparently, this local university did not encourage visiting students to "piggyback." Their own students could do this, but it was not anticipated that non-students would use their computers in this way. According to the university, a computer use fee is included in the tuition of all students. Non-students cannot use university computers in this way. They were unaware that their front-end permitted such use of their computers.

Earlier that year, the local university was experiencing problems with a hacker. Their computers used a UNIX operating system. At one point, they noticed that the log files were being deleted. The computer system administrators would restore the files only to find them deleted several days later. They began to notice extensive use of the finger command by a user no longer employed by the university. Administrators found certain programs on their computer that were obviously used to provide ordinary users with "root" privileges. Only hackers would use these programs. The director of the computer center immediately contacted C.E.R.T. The university instituted several measures to protect its computers that included establishing audit trails and even shutting down service for a brief time.

On Christmas Eve, while most students were enjoying their vacations, John used the university’s computers to access his account. From the modem lights, the computer operators noticed that someone was accessing the computer. John was the only person dialing into the system at that time. However, no user was logged on. It was obvious to them that this was their hacker. By examining those processes active on the computer at that moment, they were able to see that this intruder was "piggybacking" onto the computer of John’s undergraduate school. For some reason, they were afraid that the intruder would damage their computer if they shut it down suddenly. Therefore, the sysadmin broadcast a message that the computer was being shut down for maintenance purposes and asking all users to save their files and logoff. John logged off the system.

The director of the computer center call the local authorities who traced the call to John’s home. The police telephoned his home and asked John’s mother whether anyone uses a computer in her household. She confirmed that John uses his PC regularly. Upon hearing about the call, John, thereafter, never accessed the local university’s computer and he stopped using his account at his undergraduate school altogether.

The local university shut down its computer facility for the next two weeks, making computer services unavailable to its students. They cleaned up their files, and they instituted new security measures. One measure was to remove the ability of persons to "piggyback" without logging on. After bringing up service, they never again noticed any hacking on their system.

Armed with a search warrant, the police raided John’s home and seized his computer equipment as well as many of the papers he needed for his current schoolwork. No incriminating evidence was obtained during the search and seizure. Shortly afterwards, a grand jury returned an indictment. Their deliberations were based solely upon information and opinions provided to them by the university.

I interviewed John on a number of occasions for several hours. In my opinion, John did not possess the technical expertise to hack into the university’s computer as charged. When I presented this opinion, the director of the computer center countered that it is easy for someone in an interview to pretend that he has a lower skill level than he actually has. While this is true, I have spent several years interviewing candidates for technical employment in the data processing industry. I was very careful in choosing the questions for John to answer. In addition, John’s explanation of what he did was plausible. I was convinced that he was not the hacker for whom the university was looking. There was another hacker on the system.

By examining the evidence, I concluded that there was no clear connection to John and the hacker other than the fact that John was caught using the computer on Christmas Eve. In fact, John had excellent alibis for times coinciding with many of the university’s alleged hacking incidents. In my opinion, the ex-employee user in whose directories the hacking tool kit was found was just as likely to have been the hacker as was John. The director of the computer center disagreed. He said that this individual was not the type of person who would have been the perpetrator. The manner in which the university collected its evidence and the quality of the evidence was poor. I believe that had the matter gone to trial, John would have been exonerated.

Unfortunately for John, there was a slight chance that he could have been convicted. Had this happened, his chosen career goals would have terminated. The prosecution offered a plea bargain to John that he enter a pre-trial program for first offenders that would expunge any criminal record if he showed rehabilitation over a three year period. The prosecution also conceded that John would not have to plead guilty to the charges. The university objected, but the judge agreed. Under the circumstances, John had no choice and reluctantly accepted the offer.

However, John had to make restitution. The university included in its damages the costs of all the shutdowns, the costs of developing a new security system to keep future hackers away from its computers, and exorbitant billing of its computer room employees at consultant rates. Furthermore, the university failed to provide details for its damage calculations. The defense objected, but the judge was unimpressed. John was required to pay $14,000 to the university. Furthermore, this action did not preclude any future civil suits that the university wanted to bring against John.

Conclusion

Computer hacking is widespread. Despite some agreement with the hacking philosophy by the public and some sympathy for hackers who have been apprehended, it must be remembered that hacking is illegal. The laws are designed to protect people who own and use computers. It is virtually impossible to secure a computer against a persistent hacker. However, it is of equal virtual impossibility for a serial hacker to escape detection and capture. Apprehending the hacker is a difficult task. Even more difficult is the task of collecting and presenting the evidence so that a hacker can be convicted. Conviction depends upon the evidence. Unless the prosecution presents clear and convincing untampered proof that the accused person is a hacker, either guilty individuals will be acquitted or innocent individuals will be wrongly convicted and sentenced. A careful forensic investigation is required in all hacking cases.

© Stanley H. Kremen 1998, All Rights Reserved