Without missing a beat, he answered, "I regret shopping at Hugh's Market. I'm thinking of organizing a hi-tech boycott."
He was referring to his arrest, which went down only after a zealot-bag boy at a Van Nuys, CA supermarket (Hugh's), his resolve boosted by an episode of Unsolved Mysteries that had featured the "criminal," jumped then-24-year-old Poulsen, wrestled the 18-month-long "fugitive" to the ground, and told the agents waiting outside that they could have their suspect now.
Kevin's still kicking himself for returning to Hugh's for the second time that evening, by which time an "associate" of his had warned the FBI that he might be in the vicinity. When I asked him what was so important to buy that he was returning to a supermarket at midnight, he answered, "Do you even have to ask? Condoms, of course."
The FBI - and its eager side kick, California's Pacific Bell telecommunications monopoly - sound pretty sure, if you ask them these days, that in the late evening of April 11, 1991, they put a stop to one of the greatest, most insidious and un-American computer hacker sprees in the history of the Virtual Frontier.
Maybe they have. But 'why?' and 'how' are questions deserving attention, in light of the fact that many people outside of the mainstream press and the security establishment are of the opinion that what Poulsen allegedly did qualifies more for the adjective, 'humorous' than 'wrong'.
What no one questions is that now the feds have on their maximum-security, without bail hands a non-violent, 5'7" possibly genius and definitely funny ex-Silicon Valley "Assistant Programmer" who lingers deep in an Alameda County Jail cell, almost definitely not talking shop with his almost definitely not-white collar neighbors, and wondering when, if ever, his trial is going to start.
Seems the 6th Amendment right to a speedy hearing loses a little weight when one flies from prosecution, as Poulsen, or PFN: UFF-021, as he's known to the people with guns, did after his initial arrest at a Menlo Park, California, storage facility on February 12, 1988. Plus, the defense has requested several of the delays. The latest holdup, in July, pushed the trial date back to October 25. We'll see.
"I've learned a lot from my new neighbors," Poulsen, the quintessential cyberpunk who got his first Silicon Valley job at age 18 and who describes hacking as performance art, said from behind the glass of the maximum security visitor's window. "Now I know how to light a cigarette from an outlet and how to make methamphetamine from chicken stock."
Such activities are a far cry from the mental regimen of the serious cyberpunk, which one ex-hacker described to me as making "the Rubik's Cube look like Go Fish." Sitting down at the computer and examining, let along understanding, systems with literally millions of characters in code is not something, according to Poulsen, which can be described "in a sound bite." Sorry, but that's actually not unlike paging Newton and asking, "hey, Isaac, paraphrase that Calculus thing."
One of Poulsen's co-defendants told me hacking is "a power kind of thing, a challenge. When you're entering things, like actual battle plans, that's more exciting than some video game."
Hacking and the accompanying subculture of pranksters got started soon after personal computers hit the market in the late 1970s, and blossomed throughout the 1980's. One of the most notorious cases of cracking (which is what malicious hacking is pejoratively called by hackers) occurred on 1988, when Robert Morris, a Cornell computer science student and son of a programmer at the National Computer Security Center (a subset of the National Security Agency), created an "Internet Worm." The self-replicating program was designed to penetrate holes in the Berkeley UNIX system and wreak minor havoc, but Morris' programming was flawed, the worm continued to endlessly self-replicate, and wound up affecting in the neighborhood of 6000 computers.
Another noteworthy, if overblown case was the 1986 Pengo incident, where some amateurish German hackers got everyone nervous that they were sequestering American security documents and selling them to the (since renamed) KGB. In the end, a Southern California astrophysicist tracked the guys based on a $0.75 accounting discrepancy, and it turned out that the stuff they were selling, if the Soviets were stupid enough to buy it, was mostly public domain information.
At congressional committee hearings these days hackers are being brought in to demonstrate just how easy it is to eavesdrop on phone conversations and commit on-line bank fraud, "even from abroad" (there are no borders in cyberspace). One congressional aide told me that renegade crackers are "the next great fear after Blind Sheiks."
"The great ones are all obsessed, which is what it's about," Mike Godwin of the on-line civil liberties group Electronic Frontier Foundation (EFF) said. A former friend of Poulsen's went further than that: "It goes beyond hacking with Kevin. He knows how to allow himself to see some really serious things. That's what scares the government. It's like, if you can access the phone lines, I'm not kidding, you can access anything. You can move $1 million from one bank account to another. What he actually did is the tip of the iceberg, which I think is a testament to Kevin's ethics. He knew exactly what he was capable of. If the government only was aware, they'd be thanking him instead of incarcerating him."
David Banisar of another computer group, CPSR, made an observation that I think is worth noting: "the reason that it's tough to rank hackers is that the really great ones don't get caught."
These days, many hackers have legitimized themselves somewhat from the mischievous kid image portrayed in Bloom County's Oliver Wendel Jones character. An electronic "hacker" bulletin board on San Francisco's "The Well" network is a forum where intellectual cyberpunks examine programming, privacy and conspiracy issues such as, "U.S. Launches virus on Iraqi Military Computers," which was a topic up for discussion in July. It's only now starting to become uncommon for a skilled hacker to get hired by a company which becomes aware of, or the victim of, his virtual exploits. In fact, as we shall see, this might be how Poulsen first came to the attention of his Silicon Valley employers.
Some Poulsen defenders explain that he had to flee thanks to what his lawyer hopes to convince a jury was not only a coerced, attorney-absent search of his house on the day of his Feb. 12, 1988 arrest, but also an ensuing search warrant which was issued (and subsequently misused) under circumstances so shaky, untruthful and rife with conflict that all evidence gathered therein should be discounted. Much of the serious evidence against him was gathered from tapes for which authorities had no warrant at all.
The U.S. Attorney's Office sees things a little differently: no one is the Justice department would call Kevin Poulsen's actions funny. Then again, these guys don't see the humor in George Bush arming Iraq weeks before blowing it up, so I suppose we shouldn't expect much. In addition to two separate indictments totaling 33 counts which could technically, but realistically won't put Poulsen away for 100 years (this kitchen sink strategy, evidently, is to saturate the defendant with indictments, in hopes for a plea or conviction on just a few), our Justice Department has other tricks up its sleeve. You might remember Officers Koon and Powell got 30 months for dismantling a human being on videotape. Poulsen is likely to serve upwards of ten years, for abusing machines. In a precedent-setting move, the feds are charging Kevin Lee Poulsen, one time teen-age computer nerd, a post-adolescent who allegedly used his skills to obtain such sensitive National Security information as the phone number of War Games actress and cyberpunk wet dream Ally Sheedy, with espionage. (In the federal penal law books, that's 18 U.S.C.... Section 793(e)). If that charge alone sticks, in case you haven't checked the federal sentencing guidelines lately, Poulsen is looking at from 168 to 210 months in prison (up to 18 years). I'm loath to quote soon-to-be ex-talk show host Arsenio Hall on anything, for any reason, but this is indeed one of those things that makes you go, "hmmmm."
"That's what you call 'stretching' the espionage statues," Godwin of EFF said during a pleasantly bizarre interview from his office in Washington. An attorney, Godwin was extremely helpful in sorting out the legal complexities of this precedent-setting hi-tech case. For a computer expert, however, he had a lot of problems getting the EFF copy machine to work. "These long, multi-count indictments are a prosecution attempt to create a case to fit the conduct," he asserted.
Paul Meltzer, Poulsen's fiery attorney, had even stronger words than Godwin for the espionage charge: "It's ludicrous, it's absurd," he said. "They can't decide if they've got a kid playing in his garage or Julius Rosenberg."
Meltzer said he is "very disturbed by the inability of federal prosecutors to distinguish between assault with a deadly weapon and assault with a computer. I mean, c'mon, the guy's non-violent."
Poulsen, by the way, is also staring down the barrel of a very heavy collection agency, indeed: the federal government stands to bill him in the neighborhood of $5 million dollars for the illicit programming if he's convicted. No wonder he's thinking about getting a movie of his life together, with Robert Di Nero as himself and Herbert Lom (Chief Inspector Dreyfus from the Pink Panther Movies) as the main Pacific Bell investigator in the case. Believe me, as someone who's seen the details, people would go see the film.
It wasn't Sheedy's phone number, nor any of several alleged break-in's to Pacific Bell Warehouses (in one brilliant case with a forged ID badge that fooled every employee in a San Francisco facility while Poulsen waltzed out with sensitive equipment and codes), nor even his possession of Imelda Marcos' private number that solicited Count 12 on the first federal indictment, the espionage charge ("Gathering of Defense Information"). Rather it was Poulsen's alleged sequestering, electronically, of two Air Force Air Tasking Orders from Fort Bragg, NC. These were documents, code named "Caber Dragon", detailing either hypothetical or actual, current or absurdly obsolete (depending on whom one asks) flight patterns during battle exercises. They were also documents which for quite some time nobody in or out of the Air Force could decide were still classified or not.
Few dispute that at least one of the orders was no longer relevant, militarily, and no one, not even the U.S. Attorney handling the case, seriously pretends that this on-line cowboy whose cracker handle was "Dark Dante", intended to show the documents to any power more nefarious than perhaps some girl he was trying to impress.
"It was an intellectual puzzle," Meltzer said of Poulsen's hacking motivation. "This kid has amazing powers of concentration."
"I think there is a misconception out there about what types of crimes fall under the espionage statues," asserted Assistant U.S. Attorney Robert Crow, who is handling the first indictment for the government. "It's not just cloak and dagger spying for a foreign power. He was in possession of sensitive defense data."
I found it amazing that the guy's resolve hasn't been broken after what he's facing (unless all this joking between Kevin, his attorney, and myself somehow covers up the frightening reality of the situation). When I asked him what kind of plans he would have for his life if everything suddenly got very sunny and he found himself scot free, on the outside, his response was again instantaneous. "I'm going to Disneyland," he said. "But they're paying me 50 grand to say that."
Espionage is not the only, shall we say, violation alleged against the two-time Unsolved Mysteries alumnus, also known on various Driver's Licenses and ID badges as John Osterman and Walter Kovacs, (the latter name derived from The Watchmen graphic novel). It was under these and other fictitious names which he and accomplices, one of whose narcing resulted in his arrest by Pacific Bell and FBI agents at Hugh's, won not one, not two, not three, but four radio contest grand prizes in a row from L.A.-area Top 40 stations while Poulsen was on the lam from the first, San Francisco-based indictment. By the way, for any Partnership for a Fun-Free America members who might be reading, Poulsen also played Dungeons and Dragons while growing up. Another soul lost. Let's sue Ozzy Ozbourne.
The radio fraud, in which Poulsen allegedly tapped into phone lines going to the radio stations in order to ensure his fictitious beings' victory, led to a whole new series of federal indictments last April 21, coming out of the U.S. Attorney's Central District Office in L.A. The guy's in big trouble, thanks to the kind of keyboard manipulation and creative genius which led one convicted hacker to ask me, "Why didn't I think of that?" It might be worth noting at this point, that Apple founders Steve Wozniak and Steve Jobs raised money for their fledgling enterprise by selling "Blue Boxes" designed to allow free long distance phone calls for the user in the Ma Bell days.
Poulsen's technique, which allegedly included fake addresses and social security numbers, was so complete that the radio stations, even the ones duped more than once, never knew they were handing over Porches, cash, and all-expenses-paid Hawaiian vacations to the same guy over and over again. As KRTH Program Assistant Beverly Ward put it, "We had no idea anything was going on until we were told." "Anything" was Kevin's sister Debbie winning a trip to Hawaii, and $1000 cash. I asked Ward if the bogus winners of the contests in "The Fraudulent Scheme," as it is described in the indictment, displayed the same inane hyperactive euphoria that most Top 40 listeners seem to when informed that they are grand prize winners, and she said, "It appeared authentic in every way." Can you picture that? "What's your favorite station?" "WHOOOPIE! K-EARTH 101!!! THANK YOU! THANK YOU! I CAN'T BELIEVE it! YES! THANK YOU!!!"
One has to wonder whether Meltzer's line of defense might include having the the jury too amused to convict.
David Schindler, the prosecutor in the second federal indictment against Poulsen when that trial begins (if the San Francisco trial ever gets under way), had a predictable characterization of Poulsen: "Kevin is not just some kid playing around with his computer. He engaged in some very serious conduct." Poulsen faces a couple of extra decades in the federal pen if convicted of even half the charges in the L.A. indictment.
Ward said that station records indicate that the illicitly-won Hawaii trip was used by someone, but that the FBI is still trying to figure out who actually went on the trip. Whether or not it was Debbie Poulsen (whose number as listed in the court records is disconnected), one person close to the case said that there was no way the U.S. Attorney's Office could charge everyone it suspected.
Guess what? Meltzer puts a different spin on the situation than Schindler: "Kevin is woefully misunderstood," said the attorney who took the case pro bono upon a request from the San Jose-based federal public defender's office. "He'd be an amazing guy to sit down with over a beer and talk to for seven or eight hours. The skills and knowledge he possesses are quite remarkable."
___________________________________
Copyright© 1995 Doug Fine, all rights reserved.