A Give Up Exclusive!
from Spectacular Computer Crimes
by Jay Bloombecker

KEVIN MITNICK: THE WILLIE HORTON OF COMPUTER CRIME?

THE CHARGES

In contrast to the sweeping attacks on Mitnick's character that I heard, and which were widely repeated in the press, the charges filed against Kevin Mitnick at the end of 1988 were narrowly drawn. On December 15, 1988, Mitnick was charged with two counts of computer crime, a violation of federal law.

On December 8, 1988, (according to legal papers he filed) FBI Special Agent Christopher Headrick met with Leonard DiCicco. DiCicco had first called Chuck Bushey, Manager of Investigative Services and Corporate Security, at Digital Equipment Corporation (DEC), to warn him that Kevin Mitnick had been illegally accessing DEC computer systems.

DiCicco, a computer operator at Voluntary Plan Assistance (VPA) in Calabasas, California, told Headrick that he'd been letting Kevin Mitnick use a terminal at VPA. DiCicco and Mitnick had known each other for several years. Mitnick, DiCicco said, used the terminal to gain unauthorized access to DEC facilities in the United States and abroad. DiCicco also claimed that Kevin arranged it so that DiCicco's employer never had to pay for the calls. DiCicco claimed that his friend Kevin changed the telephone charges from VPA's MCI account to other accounts, or to non-existent ones.

Shortly after DiCicco turned Mitnick in, DEC installed a device to monitor and record Mitnick's activities. At one time, as Mitnick hacked away, FBI Special Agent, Gerald Harman, DEC Systems Support Engineer Richard Mautz, and Kent Anderson, head of DEC European Security, observed that Mitnick was accessing a computer system located at Leeds University in England, Mitnick was examining lists of people with access to the Leeds computer system and their access codes. He charged the MCI costs incurred in accessing the Leeds computer to a different account.

Bushey told the FBI that DEC had developed a copyrighted internal security software package. Access to the package was limited to authorized DEC employees. Bushey said the program, called the "Security Software System" had cost more than $1 million to develop. It had not been released to the public or the University of Southern California. The Security Software System had been accessed without authorization four times in 1988. Bushey estimated that reacting to those intrusions and others in the past 14 months had cost DEC over $4 million in computer time lost while machines were not working, employee time spent reacting to the security breaches, and time spent rebuilding certain DEC files.

Tipped off by DiCicco, Bushey found that a copy of the Security Software System had been stored in the University of Southern California computer system. DiCicco assisted Bushey in retrieving it.

The day after his hacking was monitored, Mitnick was arrested. Investigators located a blue bag in his trunk. DiCicco had already told Headrick that Mitnick's blue bag contained disks, notes, and other documentation which Mitnick used to access various computer systems.

FBI Agent Headrick directed that Mitnick's two-door black Nissan Pulsar be impounded at the FBI garage in West Los Angeles, and prepared a search warrant. Once the warrant was ready, on December 14, Headrick searched the blue bag.

He found a summary of the law on computer break-ins. More interesting to him were notes pertaining to the DEC Security Software System which Kevin Mitnick was accused of stealing. There were also other documents and proprietary information available only to authorized DEC employees. When Mitnick was searched, he had 14 MCI access codes in his purse.

Based on these allegations, Mitnick was charged with two counts of computer crime. One count was for defrauding MCI by using MCI's long distance lines without charge. The other count was based on the charge that he stole the Security Software System. Later a third charge was added based on Kevin's possession of the MCI access codes.

Next