perhaps a dozen different hackers--maybe more--inside RMIT, the task
of isolating a single cell of two or three organised hackers
responsible for the more serious attacks was not going to be easy.
By the middle of 1991, however, there was a growing reluctance among
some RMIT staff to continue leaving their computers wide open. On 28
August, Allan Young, the head of RMIT's Electronic Communications
Group, told the AFP that the institute wanted to close up the security
holes. The AFP did not like this one bit, but when they complained
Young told them, in essence, go talk to Geoff Huston at AARNET and to
the RMIT director.
The AFP was being squeezed out, largely because they had taken so long
conducting their investigation. RMIT couldn't reveal the AFP
investigation to anyone, so it was being embarrassed in front of
dozens of other research institutions which assumed it had no idea how
to secure its computers. Allan Young couldn't go to a conference with
other AARNET representatives without being hassled about `the hacker
problem' at RMIT. Meanwhile, his computer staff lost time playing
cops-and-robbers--and ignored their real work.
However, as RMIT prepared to phase out the AFP traps, the police had a
lucky break from a different quarter--NorTel. On 16 September, a line
trace from a NorTel dial-up, initiated after a complaint about the
hackers to the police, was successful. A fortnight later, on 1
October, the AFP began tapping Prime Suspect's telephone. The hackers
might be watching the police watch them, but the police were closing
in. The taps led back to Trax, and then to someone new--Mendax.
The AFP considered putting taps on Mendax and Trax's telephones as
well. It was a decision to be weighed up carefully. Telephone taps
were expensive, and often needed to be in place for at least a month.
They did, however, provide a reliable record of exactly what the
hacker was doing on-line.
Before police could move on setting up additional taps in Operation
Weather, the plot took another dramatic turn when one of the IS
hackers did something which took the AFP completely by surprise.
Trax turned himself in to the police.
On 29 October Prime Suspect was celebrating. His mum had cooked him a
nice dinner in honour of finishing his year 12 classes, and then
driven him to Vermont for a swot-vac party. When she arrived back home
she pottered around for an hour and a half, feeding her old dog Lizzy
and tidying up. At 11 p.m. she decided to call it a night.
Not much later, Lizzy barked.
`Are you home so soon?' Prime Suspect's mother called out. `Party not
much fun?'
No-one answered.
She sat up in bed. When there was still no answer, her mind raced to
reports of a spate of burglaries in the neighbourhood. There had even
been a few assaults.
A muffled male voice came from outside the front door. `Ma'am. Open
the door.'
She stood up and walked to the front door.
`Open the door. Police.'
`How do I know you're really the police?'
`If you don't open the door, we'll kick it in!' an exasperated male
voice shouted back at her from her front doorstep.
Prime Suspect's mother saw the outline of something being pressed
against the side window. She didn't have her reading glasses on, but
it looked like a police badge. Nervously, she opened the front door a
little bit and looked out.
There were eight or nine people on her doorstep. Before she could stop
them, they had pushed past her, swarming into her home.
A female officer began waving a piece of paper about. `Look at this!'
She said angrily. `It's a warrant! Can you read it?'
`No, actually I can't. I don't have my glasses on,' Prime Suspect's
mother answered curtly.
She told the police she wanted to make a phone call and tried to ring
her family solicitor, but without luck. He had been to a funeral and
wake and could not be roused. When she reached for the phone a second
time, one of the officers began lecturing her about making more phone
calls.
`You be quiet,' she said pointing her finger at the officer. Then she
made another unfruitful call.
Prime Suspect's mother looked at the police officers, sizing them up.
This was her home. She would show the police to her son's room, as
they requested, but she was not going to allow them to take over the
whole house. As she tartly instructed the police where they could and
could not go, she thought, I'm not standing for any nonsense from you
boys.
`Where's your son?' one officer asked her.
`At a party.'
`What is the address?'
She eyed him warily. She did not like these officers at all. However,
they would no doubt wait until her son returned anyway, so she handed
over the address.
While the police swarmed though Prime Suspect's room, gathering his
papers, computer, modem and other belongings, his mother waited in his
doorway where she could keep an eye on them.
Someone knocked at the door. An AFP officer and Prime Suspect's mother
both went to answer it.
It was the police--the state police.
The next-door neighbours had heard a commotion. When they looked out
of their window they saw a group of strange men in street clothes
brazenly taking things from the widow's home as if they owned the
place. So the neighbours did what any responsible person would in the
circumstances. They called the police.
The AFP officers sent the Victoria Police on their way. Then some of
them set off in a plain car for the Vermont party. Wanting to save
Prime Suspect some embarrassment in front of his friends, his mother
rang him at the party and suggested he wait outside for the AFP.
As soon as Prime Suspect hung up the phone he tried to shake off the
effect of a vast quantity of alcohol. When the police pulled up
outside, the party was in full swing. Prime Suspect was very drunk,
but he seemed to sober up quite well when the AFP officers introduced
themselves and packed him into the car.
`So,' said one of the officers as they headed toward his home, `what
are you more worried about? What's on your disks or what's in your
desk drawer?'
Prime Suspect thought hard. What was in his desk drawer? Oh shit! The
dope. He didn't smoke much, just occasionally for fun, but he had a
tiny amount of marijuana left over from a party.
He didn't answer. He looked out the window and tried not to look
nervous.
At his house, the police asked him if he would agree to an interview.
`I don't think so. I'm feeling a little ... under the weather at the
moment,' he said. Doing a police interview would be difficult enough.
Doing it drunk would be just plain dangerous.
After the police carted away the last of his hacking gear, Prime
Suspect signed the official seizure forms and watched them drive off
in to the night.
Returning to his bedroom, he sat down, distracted, and tried to gather
his thoughts. Then he remembered the dope. He opened his desk drawer.
It was still there. Funny people, these feds.
Then again, maybe it made sense. Why would they bother with some tiny
amount of dope that was hardly worth the paperwork? His nervousness
over a couple of joints must have seemed laughable to the feds. They
had just seized enough evidence of hacking to lock him up for years,
depending on the judge, and here he was sweating about a thimbleful of
marijuana which might land him a $100 fine.
As the late spring night began to cool down, Prime Suspect wondered
whether the AFP had raided Mendax and Trax.
At the party, before the police had shown up, he had tried to ring
Mendax. From his mother's description when she called him, it sounded
as if the entire federal police force was in his house at that moment.
Which could mean that only one other IS hacker had gone down at the
same time. Unless he was the last to be raided, Mendax or Trax might
still be unaware of what was happening.
As he waited for the police to pick him up, a very drunk Prime Suspect
tried to ring Mendax again. Busy. He tried again. And again. The
maddening buzz of an engaged signal only made Prime Suspect more
nervous.
There was no way to get through, no way to warn him.
Prime Suspect wondered whether the police had actually shown up at
Mendax's and whether, if he had been able to get through, his phone
call would have made any difference at all.
[ ]
The house looked like it had been ransacked. It had been ransacked, by
Mendax's wife, on her way out. Half the furniture was missing, and the
other half was in disarray. Dresser drawers hung open with their
contents removed, and clothing lay scattered around the room.
When his wife left him, she didn't just take their toddler child. She
took a number of things which had sentimental value to Mendax. When
she insisted on taking the CD player she had given him for his
twentieth birthday just a few months before, he asked her to leave a
lock of her hair behind for him in its place. He still couldn't
believe his wife of three years had packed up and left him.
The last week of October had been a bad one for Mendax. Heartbroken,
he had sunk into a deep depression. He hadn't eaten properly for days,
he drifted in and out of a tortured sleep, and he had even lost the
desire to use his computer. His prized hacking disks, filled with
highly incriminating stolen computer access codes, were normally
stored in a secure hiding place. But on the evening of 29 October
1991, thirteen disks were strewn around his $700 Amiga 500. A
fourteenth disk was in the computer's disk drive.
Mendax sat on a couch reading Soledad Brother, the prison
letters from George Jackson's nine-year stint in one of the toughest
prisons in the US. Convicted for a petty crime, Jackson was supposed
to be released after a short sentence but was kept in the prison at
the governor's pleasure. The criminal justice system kept him on a
merry-go-round of hope and despair as the authorities dragged their
feet. Later, prison guards shot and killed Jackson. The book was one
of Mendax's favourites, but it offered little distraction from his
unhappiness.
The droning sound of a telephone fault signal--like a busy
signal--filled the house. Mendax had hooked up his stereo speakers to
his modem and computer, effectively creating a speaker phone so he
could listen to tones he piped from his computer into the telephone
line and the ones which came back from the exchange in reply. It was
perfect for using Trax's MFC phreaking methods.
Mendax also used the system for scanning. Most of the time, he picked
telephone prefixes in the Melbourne CBD. When his modem hit another,
Mendax would rush to his computer and note the telephone number for
future hacking exploration.
By adjusting the device, he could also make it simulate a phreaker's
black box. The box would confuse the telephone exchange into thinking
he had not answered his phone, thus allowing Mendax's friends to call
him for free for 90 seconds.
On this night, however, the only signal Mendax was sending out was
that he wanted to be left alone. He hadn't been calling any computer
systems. The abandoned phone, with no connection to a remote modem,
had timed out and was beeping off the hook.
It was strange behaviour for someone who had spent most of his teenage
years trying to connect to the outside world through telephone lines
and computers, but Mendax had listened all day to the hypnotic sound
of a phone off the hook resonating through each room. BEEEP. Pause.
BEEEP. Pause. Endlessly.
A loud knock at the door punctured the stereo thrum of the phone.
Mendax looked up from his book to see a shadowy figure through the
frosted glass panes of the front door. The figure was quite short. It
looked remarkably like Ratface, an old school friend of Mendax's wife
and a character known for his practical jokes.
Mendax called out, `Who is it?' without moving from the sofa.
`Police. Open up.'
Yeah, sure. At 11.30 p.m.? Mendax rolled his eyes toward the door.
Everyone knew that the police only raid your house in the early
morning, when they know you are asleep and vulnerable.
Mendax dreamed of police raids all the time. He dreamed of footsteps
crunching on the driveway gravel, of shadows in the pre-dawn darkness,
of a gun-toting police squad bursting through his backdoor at 5 a.m.
He dreamed of waking from a deep sleep to find several police officers
standing over his bed. The dreams were very disturbing. They
accentuated his growing paranoia that the police were watching him,
following him.
The dreams had become so real that Mendax often became agitated in the
dead hour before dawn. At the close of an all-night hacking session,
he would begin to feel very tense, very strung out. It was not until
the computer disks, filled with stolen computer files from his hacking
adventures, were stored safely in their hiding place that he would
begin to calm down.
`Go away, Ratface, I'm not in the mood,' Mendax said, returning to his
book.
The voice became louder, more insistent, `Police. Open the door. NOW'.
Other figures were moving around behind the glass, shoving police
badges and guns against the window pane. Hell. It really was the
police!
Mendax's heart started racing. He asked the police to show him their
search warrant. They obliged immediately, pressing it against the
glass as well. Mendax opened the door to find nearly a dozen
plain-clothes police waiting for him.
`I don't believe this,' he said in a bewildered voice `My wife just
left me. Can't you come back later?'
At the front of the police entourage was Detective Sergeant Ken Day,
head of the AFP's Computer Crimes Unit in the southern region. The two
knew all about each other, but had never met in person. Day spoke
first.
`I'm Ken Day. I believe you've been expecting me.'
Mendax and his fellow IS hackers had been expecting the AFP. For weeks
they had been intercepting electronic mail suggesting that the police
were closing the net. So when Day turned up saying, `I believe you've
been expecting me,' he was completing the information circle. The
circle of the police watching the hackers watching the police watch
them.
It's just that Mendax didn't expect the police at that particular
moment. His mind was a tangle and he looked in disbelief at the band
of officers on his front step. Dazed, he looked at Day and then spoke
out loud, as if talking to himself, `But you're too short to be a
cop.'
Day looked surprised. `Is that meant to be an insult?' he said.
It wasn't. Mendax was in denial and it wasn't until the police had
slipped past him into the house that the reality of the situation
slowly began to sink in. Mendax's mind started to work again.
The disks. The damn disks. The beehive.
An avid apiarist, Mendax kept his own hive. Bees fascinated him. He
liked to watch them interact, to see their sophisticated social
structure. So it was with particular pleasure that he enlisted their
help in hiding his hacking activities. For months he had meticulously
secreted the disks in the hive. It was the ideal location--unlikely,
and well guarded by 60000 flying things with stings. Though he hadn't
bought the hive specifically for hiding stolen computer account
passwords for the likes of the US Air Force 7th Command Group in the
Pentagon, it appeared to be a secure hiding place.
He had replaced the cover of the super box, which housed the
honeycomb, with a sheet of coloured glass so he could watch the bees
at work. In summer, he put a weather protector over the glass. The
white plastic cover had raised edges and could be fastened securely to
the glass sheet with metal clasps. As Mendax considered his
improvements to the bee box, he realised that this hive could provide
more than honey. He carefully laid out the disks between the glass and
the weather protector. They fitted perfectly in the small gap.
Mendax had even trained the bees not to attack him as he removed and
replaced the disks every day. He collected sweat from his armpits on
tissues and then soaked the tissues in a sugar water solution. He fed
this sweaty nectar to the bees. Mendax wanted the bees to associate
him with flowers instead of a bear, the bees' natural enemy.
But on the evening of the AFP raid Mendax's incriminating disks were
in full view on the computer table and the officers headed straight
for them. Ken Day couldn't have hoped for better evidence. The disks
were full of stolen userlists, encrypted passwords, cracked passwords,
modem telephone numbers, documents revealing security flaws in various
computer systems, and details of the AFP's own investigation--all from
computer systems Mendax had penetrated illegally.
Mendax's problems weren't confined to the beehive disks. The last
thing he had done on the computer the day before was still on screen.
It was a list of some 1500 accounts, their passwords, the dates that
Mendax had obtained them and a few small notes beside each one.
The hacker stood to the side as the police and two Telecom Protective
Services officers swarmed through the house. They photographed his
computer equipment and gathered up disks, then ripped up the carpet so
they could videotape the telephone cord running to his modem. They
scooped up every book, no small task since Mendax was an avid reader,
and held each one upside down looking for hidden computer passwords on
loose pieces of paper. They grabbed every bit of paper with
handwriting on it and poured through his love letters, notebooks and
private diaries. `We don't care how long it takes to do this job,' one
cop quipped. `We're getting paid overtime. And danger money.'
The feds even riffled through Mendax's collection of old Scientific
American and New Scientist magazines. Maybe they thought he had
underlined a word somewhere and turned it into a passphrase for an
encryption program.
Of course, there was only one magazine the feds really wanted:
International Subversive. They scooped up every print-out of the
electronic journal they could find.
As Mendax watched the federal police sift through his possessions and
disassemble his computer room, an officer who had some expertise with
Amigas arrived. He told Mendax to get the hell out of the computer
room.
Mendax didn't want to leave the room. He wasn't under arrest and
wanted to make sure the police didn't plant anything. So he looked at
the cop and said, `This is my house and I want to stay in this room.
Am I under arrest or not?'
The cop snarled back at him, `Do you want to be under arrest?'
Mendax acquiesced and Day, who was far more subtle in his approach,
walked the hacker into another room for questioning. He turned to
Mendax and asked, with a slight grin, `So, what's it like being
busted? Is it like Nom told you?'
Mendax froze.
There were only two ways that Day could have known Nom had told Mendax
about his bust. Nom might have told him, but this was highly unlikely.
Nom's hacking case had not yet gone to court and Nom wasn't exactly on
chummy terms with the police. The other alternative was that the AFP
had been tapping telephones in Mendax's circle of hackers, which the
IS trio had strongly suspected. Talking in a three-way phone
conversation with Mendax and Trax, Nom had relayed the story of his
bust. Mendax later relayed Nom's story to Prime Suspect--also on the
phone. Harbouring suspicions is one thing. Having them confirmed by a
senior AFP officer is quite another.
Day pulled out a tape recorder, put it on the table, turned it on and
began asking questions. When Mendax told Day he wouldn't answer him,
Day turned the recorder off. `We can talk off the record if you want,'
he told the hacker.
Mendax nearly laughed out loud. Police were not journalists. There was
no such thing as an off-the-record conversation between a suspect and
a police officer.
Mendax asked to speak to a lawyer. He said he wanted to call
Alphaline, a free after-hours legal advice telephone service. Day
agreed, but when he picked up the telephone to inspect it before
handing it over to Mendax, something seemed amiss. The phone had an
unusual, middle-pitched tone which Day didn't seem to recognise.
Despite there being two Telecom employees and numerous police
specialists in the house, Day appeared unable to determine the cause
of the funny tone. He looked Mendax dead in the eye and said, `Is this
a hijacked telephone line?'
Hijacked? Day's comment took Mendax by surprise. What surprised him
was not that Day suspected him of hijacking the line, but rather that
he didn't know whether the line had been manipulated.
`Well, don't you know?' he taunted Day.
For the next half hour, Day and the other officers picked apart
Mendax's telephone, trying to work out what sort of shenanigans the
hacker had been up to. They made a series of calls to see if the
long-haired youth had somehow rewired his telephone line, perhaps to
make his calls untraceable.
In fact, the dial tone on Mendax's telephone was the very normal sound
of a tone-dial telephone on an ARE-11 telephone exchange. The tone was
simply different from the ones generated by other exchange types, such
as AXE and step-by-step exchanges.
Finally Mendax was allowed to call a lawyer at Alphaline. The lawyer
warned the hacker not to say anything. He said the police could offer
a sworn statement to the court about anything the hacker said, and
then added that the police might even be wired.
Next, Day tried the chummy approach at getting information from the
hacker. `Just between you and me, are you Mendax?' he asked.
Silence.
Day tried another tactic. Hackers have a well-developed sense of
ego--a flaw Day no doubt believed he could tap into.
`There have been a lot of people over the years running around
impersonating you--using your handle,' he said.
Mendax could see Day was trying to manipulate him but by this stage he
didn't care. He figured that the police already had plenty of evidence
Share with your friends: |