father were outside. He could meet with them in the visiting area.
Talking through a glass barrier, Pad tried to reassure his worried
parents. After five minutes, an officer told the family the visit was
over. Amid hurried goodbyes under the impatient stare of the guard,
Pad's parents told him they had brought something for him to read in
his cell. It was the oceanography textbook.
Back in his cell, he tried to read, but he couldn't concentrate. He
kept replaying his visits to the London Polytechnic over and over in
his mind, searching for how he might have inadvertently done
[sterling]250000 worth of damage. Pad was a very good hacker; it
wasn't as if he was some fourteen-year-old kid barging through systems
like a bull in china shop. He knew how to get in and out of a system
without hurting it.
Shortly after 8 p.m., as Pad sat on his cot stewing over the police
damage claims, sombre music seemed to fill his cell. Slowly at first,
an almost imperceptible moaning, which subtly transformed into solemn
but recognisable notes. It sounded like Welsh choir music, and it was
coming from above him.
Pad looked up at the ceiling. The music--all male voices-- stopped
abruptly, then started again, repeating the same heavy, laboured
notes. The hacker smiled. The local police choir was practising right
above his cell.
After another fitful night, Pad faced one more round of interviews.
The police did most of the questioning, but they didn't seem to know
much about computers--well, not nearly so much as any good hacker on
Altos. Whenever either of the police asked a technical question, they
looked over to the BT guy at the other end of the table as if to say,
`Does this make any sense?' The BT guy would give a slight nod, then
the police looked back at Pad for an answer. Most of the time, he was
able to decipher what they thought they were trying to ask, and he
answered accordingly.
Then it was back to his cell while they processed his charge sheets.
Alone again, Pad wondered once more if they had raided Gandalf. Like
an answer from above, Pad heard telephone tones through the walls. The
police seemed to be playing them over and over. That was when he knew
they had Gandalf too.
Gandalf had rigged up a tone dialler in his computer. It sounded as if
the police were playing with it, trying to figure it out.
So, Pad would finally meet Gandalf in person after two years. What
would he look like? Would they have the same chemistry in person as
on-line? Pad felt like he knew Gandalf, knew his essence, but meeting
in person could be a bit tricky.
Explaining that the paperwork, including the charge sheets, had
finally been organised, a police officer unlocked Pad's cell door and
led him to a foyer, telling him he would be meeting both Gandalf and
Wandii. A large collection of police had formed a semi-circle around
two other young men. In addition to Scotland Yard's Computer Crimes
Unit and BT, at least seven other police forces were involved in the
three raids, including those from Greater Manchester, Merseyside and
West Yorkshire. The officers were curious about the hackers.
For most of the two years of their investigation, the police didn't
even know the hackers' real identities. After such a long, hard chase,
the police had been forced to wait a little longer, since they wanted
to nab each hacker while he was on-line. That meant hiding outside
each hacker's home until he logged in somewhere. Any system would do
and they didn't have to be talking to each other on-line--as long as
the login was illegal. The police had sat patiently, and finally
raided the hackers within hours of each other, so they didn't have
time to warn one another.
So, at the end of the long chase and a well-timed operation, the
police wanted to have a look at the hackers up close.
After the officer walked Pad up to the group, he introduced Gandalf.
Tall, lean with brown hair and pale skin, he looked a little bit like
Pad. The two hackers smiled shyly at each other, before one of the
police pointed out Wandii, the seventeen-year-old schoolboy. Pad
didn't get a good look at Wandii, because the police quickly lined the
hackers up in a row, with Gandalf in the middle, to explain details to
them. They were being charged under the Computer Misuse Act of 1990.
Court dates would be set and they would be notified.
When they were finally allowed to leave, Wandii seemed to disappear.
Pad and Gandalf walked outside, found a couple of benches and lay
down, basking in the sun and chatting while they waited for their
rides home.
Gandalf proved to be as easy to talk to in person as he was on-line.
They exchanged phone numbers and shared notes on the police raids.
Gandalf had insisted on meeting a lawyer before his interviews, but
when the lawyer arrived he didn't have the slightest understanding of
computer crime. He advised Gandalf to tell the police whatever they
wanted to know, so the hacker did.
The trial was being held in London. Pad wondered why, if all three
hackers were from the north, the case was being tried in the south.
After all, there was a court in Manchester which was high enough to
deal with their crimes.
Maybe it was because Scotland Yard was in London. Maybe they had
started the paperwork down there. Maybe it was because they were being
accused of hacking computers located within the jurisdiction of the
Central Criminal Court--that court being the Old Bailey in London. But
Pad's cynical side hazarded a different guess--a guess which seemed
justified after a few procedural appearances in 1992 before the trial,
which was set for 1993. For when Pad arrived at the Bow Street
Magistrates Court for his committal in April 1992, he saw it packed
out with the media, just as he had anticipated.
A few hackers also fronted up to fly the flag of the underground. One
of them--a stranger--came up to Pad after court, patted him on the
back and exclaimed enthusiastically, `Well done, Paddy!' Startled, Pad
just looked at him and then smiled. He had no idea how to respond to
the stranger.
Like the three Australian hackers, Pad, Gandalf and the little-known
Wandii were serving as the test case for new hacking laws in their
country. British law enforcement agencies had spent a fortune on the
case--more than [sterling]500000 according to the newspapers--by the
time the 8lgm case went to trial. This was going to be a show case,
and the government agencies wanted taxpayers to know they were getting
their money's worth.
The hackers weren't being charged with breaking into computers. They
were being charged with conspiracy, a more serious offence. While
admitting the threesome did not hack for personal gain, the
prosecution alleged the hackers had conspired to break into and modify
computer systems. It was a strange approach to say the least,
considering that none of the three hackers had ever met or even talked
to the others before they were arrested.
It was not so strange, however, when looking at the potential
penalties. If the hackers had been charged with simply breaking into a
machine, without intending any harm, the maximum penalty was six
months jail and a fine of up to [sterling]5000. However, conspiracy,
which was covered under a different section of the Act, could bring up
to five years in jail and an unlimited amount in fines.
The prosecution was taking a big gamble. It would be harder to prove
conspiracy charges, which required demonstration of greater criminal
intent than lesser charges. The potential pay-off was of course also
much greater. If convicted, the defendants in Britain's most important
hacking case to date would be going to prison.
As with The Realm case, two hackers--Pad and Gandalf--planned to plead
guilty while the third--in this case Wandii--planned to fight the
charges every step of the way. Legal Aid was footing the bill for
their lawyers, because the hackers were either not working or were
working in such lowly paid, short-term jobs they qualified for free
legal support.
Wandii's lawyers told the media that this showcase was tantamount to a
state trial. It was the first major hacking case under the new
legislation which didn't involve disgruntled employees. While having
no different legal status from a normal trial, the term state trial
suggested a greater degree of official wrath--the kind usually
reserved for cases of treason.
On 22 February 1993, within two months of Electron's decision to turn
Crown witness against Phoenix and Nom, the three 8lgm hackers stood in
the dock at Southwark Crown Court in South London to enter pleas in
their own case.
In the dim winter light, Southwark couldn't look less appealing, but
that didn't deter the crowds. The courtroom was going to be packed,
just as Bow Street had been. Scotland Yard detectives were turning out
in force. The crowd shuffled toward Room 12.
The prosecution told the media they had about 800 computer disks full
of evidence and court materials. If all the data had been printed out
on A4 paper, the stack would tower more than 40 metres in the air,
they said. Considering the massive amount of evidence being heaved,
rolled and tugged through the building by teams of legal eagles, the
choice of location--on the fifth floor--proved to be a challenge.
Standing in the dock next to Wandii, Pad and Gandalf pleaded guilty to
two computer conspiracy charges: conspiring to dishonestly obtain
telecommunications services, and conspiring to cause unauthorised
modification to computer material. Pad also pleaded guilty to a third
charge: causing damage to a computer. This last charge related to the
almost a quarter of
a million pounds worth of `damage' to the Central London Polytechnic.
Unlike the Australians' case, none of the British hackers faced
charges about specific sites such as NASA.
Pad and Gandalf pleaded guilty because they didn't think they had much
choice. Their lawyers told them that, in light of the evidence,
denying their guilt was simply not a realistic option. Better to throw
yourself on the mercy of the court, they advised. As if to underline
the point, Gandalf's lawyer had told him after a meeting at the end of
1992, `I'd like to wish you a happy Christmas, but I don't think it's
going to be one'.
Wandii's lawyers disagreed. Standing beside his fellow hackers, Wandii
pleaded not guilty to three conspiracy charges: plotting to gain
unauthorised access to computers, conspiring to make unauthorised
modifications to computer material, and conspiring to obtain
telecommunications services dishonestly. His defence team was going to
argue that he was addicted to computer hacking and that, as a result
of this addiction, he was not able to form the criminal intent
necessary to be convicted.
Pad thought Wandii's case was on shaky ground. Addiction didn't seem a
plausible defence to him, and he noticed Wandii looked very nervous in
court just after his plea.
Pad and Gandalf left London after their court appearance, returning to
the north to prepare for their sentencing hearings, and to watch the
progress of Wandii's case through the eyes of the media.
They weren't disappointed. It was a star-studded show. The media
revved itself up for a feeding frenzy and the prosecution team, headed
by James Richardson, knew how to feed the pack. He zeroed in on
Wandii, telling the court how the schoolboy `was tapping into offices
at the EC in Luxembourg and even the experts were worried. He caused
havoc at universities all around the world'.4 To do this, Wandii had
used a simple BBC Micro computer, a Christmas present costing
[sterling]200.
The hacking didn't stop at European Community's computer, Richardson
told the eager crowd of journalists. Wandii had hacked Lloyd's, The
Financial Times and Leeds University. At The Financial Times machine,
Wandii's adventures had upset the smooth operations of the FTSE 100
share index, known in the City as `footsie'. The hacker installed a
scanning program in the FT's network, resulting in one outgoing call
made every second. The upshot of Wandii's intrusion: a [sterling]704
bill, the deletion of an important file and a management decision to
shut down a key system. With the precision of a banker, FT computer
boss Tony Johnson told the court that the whole incident had cost his
organisation [sterling]24871.
But the FT hack paled next to the prosecution's real trump card: The
European Organisation for the Research and Treatment of Cancer in
Brussels. They had been left with a [sterling]10000 phone bill as a
result of a scanner Wandii left on its machine,5 the court was told.
The scanner had left a trail of 50000 calls, all documented on a
980-page phone bill.
The scanner resulted in the system going down for a day, EORTC
information systems project manager Vincent Piedboeuf, told the jury.
He went on to explain that the centre needed its system to run 24
hours a day, so surgeons could register patients. The centre's
database was the focal point for pharmaceutical companies, doctors and
research centres--all coordinating their efforts in fighting the
disease.
For the media, the case was headline heaven. `Teenage computer hacker
"caused worldwide chaos"' the Daily Telegraph screamed across page
one. On page three, the Daily Mail jumped in with `Teenage hacker
"caused chaos for kicks"'. Even The Times waded into the fray.
Smaller, regional newspapers pulled the story across the countryside
to the far reaches of the British Isles. The Herald in Glasgow told
its readers `Teenage hacker "ran up [sterling]10000 telephone bill"'.
Across the Irish Sea, the Irish Times caused a splash with its
headline, `Teenage hacker broke EC computer security'.
Also in the first week of the case, The Guardian announced Wandii had
taken down the cancer centre database. By the time The Independent got
hold of the story, Wandii hadn't just shut down the database, he had
been reading the patients' most intimate medical details: `Teenager
"hacked into cancer patient files"'. Not to be outdone, on day four of
the trial, the Daily Mail had christened Wandii as a `computer
genius'. By day five it labelled him as a `computer invader' who `cost
FT [sterling]25000'.
The list went on. Wandii, the press announced, had hacked the Tokyo
Zoo and the White House. It was difficult to tell which was the more
serious offence.
Wandii's defence team had a few tricks of its own. Ian MacDonald, QC,
junior counsel Alistair Kelman and solicitor Deborah Tripley put
London University Professor James Griffith-Edwards, an authoritative
spokesman on addictive and compulsive behaviours, on the stand as an
expert witness. The chairman of the National Addiction Centre, the
professor had been part of a team which wrote the World Health
Organisation's definition of addiction. No-one was going to question
his qualifications.
The professor had examined Wandii and he announced his conclusion to
the court: Wandii was obsessed by computers, he was unable to stop
using them, and his infatuation made it impossible for him to choose
freely. `He repeated 12 times in police interviews, "I'm just
addicted. I wish I wasn't",' Griffith-Edwards told the court. Wandii
was highly intelligent, but was unable to escape from the urge to beat
computers' security systems at their own game. The hacker was obsessed
by the intellectual challenge. `This is the core ... of what attracts
the compulsive gambler,' the professor explained to the entranced jury
of three women and nine men.
But Wandii, this obsessive, addicted, gifted young man, had never had
a girlfriend, Griffith-Edwards continued. In fact, he shyly admitted
to the professor that he wouldn't even know how to ask a girl out. `He
[Wandii] became profoundly embarrassed when asked to talk about his
own feelings. He simply couldn't cope when asked what sort of person
he was.'6
People in the jury edged forward in their seats, concentrating
intently on the distinguished professor. And why wouldn't they? This
was amazing stuff. This erudite man had delved inside the mind of the
young man of bizarre contrasts. A man so sophisticated that he could
pry open computers belonging to some of Britain's and Europe's most
prestigious institutions, and yet at the same time so simple that he
had no idea how to ask a girl on a date. A man who was addicted not to
booze, smack or speed, which the average person associates with
addiction, but to a computer--a machine most people associated with
kids' games and word processing programs.
The defence proceeded to present vivid examples of Wandii's addiction.
Wandii's mother, a single parent and lecturer in English, had terrible
trouble trying to get her son away from his computer and modem. She
tried hiding his modem. He found it. She tried again, hiding it at his
grandmother's house. He burgled granny's home and retrieved it. His
mother tried to get at his computer. He pushed her out of his attic
room and down the stairs.
Then he ran up a [sterling]700 phone bill as a result of his hacking.
His mother switched off the electricity at the mains. Her son
reconnected it. She installed a security calling-code on the phone to
stop him calling out. He broke it. She worried he wouldn't go out and
do normal teenage things. He continued to stay up all night--and
sometimes all day--hacking. She returned from work to find him
unconscious--sprawled across the living room floor and looking as
though he was dead. But it wasn't death, only sheer exhaustion. He
hacked until he passed out, then he woke up and hacked some more.
The stories of Wandii's self-confessed addiction overwhelmed, appalled
and eventually engendered pity in the courtroom audience. The media
began calling him `the hermit hacker'.
Wandii's defence team couldn't fight the prosecution's
evidence head-on, so they took the prosecution's evidence and claimed
it as their own. They showed the jury that Wandii hadn't just hacked
the institutions named by the prosecution; he had hacked far, far more
than that. He didn't just hack a lot--he hacked too much. Most of all,
Wandii's defence team gave the jury a reason to acquit the
innocent-faced young man sitting before them.
During the trial, the media focused on Wandii, but didn't completely
ignore the other two hackers. Computer Weekly hunted down where
Gandalf was working and laid it bare on the front page. A member of
`the UK's most notorious hacking gang', the journal announced, had
been working on software which would be used at Barclay's Bank.7 The
implication was clear. Gandalf was a terrible security risk and should
never be allowed to do any work for a financial institution. The
report irked the hackers, but they tried to concentrate on preparing
for their sentencing hearing.
From the beginning of their case, the hackers had problems obtaining
certain evidence. Pad and Gandalf believed some of the material seized
in the police raids would substantially help their case--such as
messages from admins thanking them for pointing out security holes on
their systems. This material had not been included in the
prosecution's brief. When the defendants requested access to it, they
were refused access on the grounds that there was classified data on
the optical disk. They were told to go read the Attorney-General's
guidelines on disclosure of information. The evidence of the hackers'
forays into military and government systems was jumbled in with their
intrusions into computers such as benign JANET systems, the defence
team was told. It would take too much time to separate the two.
Eventually, after some wrangling, Pad and Gandalf were told they could
inspect and copy material--provided it was done under the supervision
of the police. The hackers travelled to London, to Holborn police
station, to gather supporting evidence for their case. However, it
soon became clear that this time-consuming exercise would be
impossible to manage on an ongoing basis. Finally, the Crown
Prosecution Service relented, agreeing to release the material on disk
to Pad's solicitor, on the proviso that no copies were made, it did
not leave the law office, and it was returned at the end of the trial.
As Wandii's case lurched from revelation to exaggeration, Pad and
Gandalf busily continued to prepare for their own sentencing hearing.
Every day, Gandalf travelled from Liverpool to Manchester to meet with
his friend. They picked up a handful of newspapers at the local agent,
and then headed up to Pad's lawyer's office. After a quick scan for
articles covering the hacking case, the two hackers began sifting
through the reluctantly released prosecution disks. They read through
the material on computer, under the watchful eye of the law office's
cashier--the most computer literate person in the firm.
After fifteen days in the Southwark courtroom listening to fantastic
stories from both sides about the boy sitting before them, the jury in
Wandii's trial retired to consider the evidence. Before they left,
Judge Harris gave them a stern warning: the argument that Wandii was
obsessed or dependent was not a defence against the charges.
It took the jurors only 90 minutes to reach a decision, and when the
verdict was read out the courtroom erupted with a wave of emotion.
Not guilty. On all counts.
Wandii's mother burst into a huge smile and turned to her son, who was
also smiling. And the defence team couldn't be happier. Kelman told
journalists, `The jury felt this was a sledge hammer being used to
crack a nut'.8
The prosecution was stunned and the law enforcement agents
flabbergasted. Detective Sergeant Barry Donovan found the verdict
bizarre. No other case in his 21 years in law enforcement had as much
overwhelming evidence as this one, yet the jury had let Wandii walk.
And in a high-pitched frenzy rivalling its earlier hysteria, the
British media jumped all over the jury's decision. `Hacker who ravaged
Share with your friends: |