Writers Defend Hype on Hackers ------------------------------ By Paul Andrews SEATTLE -- America's most wanted cyberscribes are battling nagging criticism that they overhyped computer crimes to sell books. Computer security expert Tsutomu Shimomura and newspaper technology writer John Markoff signed books in Seattle Thursday as part of a nine-day tour promoting their recently released book, "Takedown" (Hyperion), about computer hacker Kevin Mitnick. Shimomura is the San Diego Supercomputer Center security expert who helped track down Mitnick. Markoff, Shimomura's longtime ski buddy, is a San Francisco-based {New York Times} technology writer. In the fall of 1994, a hacker believed by some Internet service providers to be Mitnick created havoc with the service providers' computer systems, stealing passwords, corrupting files and keeping system operators up all night fending off his attacks. In February 1995, the FBI arrested Mitnick in Raleigh, N.C. He was charged with 23 counts of assorted theft and computer crimes. All but one were subsequently dropped in a plea bargain, and Mitnick is in a Los Angeles jail awaiting a federal court hearing, scheduled for Monday, on the remaining charge. At the time of his arrest, Markoff labeled Mitnick "America's most-wanted cyberthief," and Shimomura was portrayed as a brilliant digital samurai who had tracked down Mitnick on a personal vendetta after the latter attacked Shimomura's own computer. Markoff's coverage contained at least one error and repeated others' exaggerations about Mitnick's prowess. In his work, Markoff asserted that Mitnick had nearly destroyed the WELL, a Sausalito, Calif. online service, an allegation the service has denied. The {New York Times} printed a correction. It was also asserted that Mitnick had himself stolen 20,000 credit-card numbers, but that, too, was later called into doubt when the numbers showed up in others' possession. Other charges -- of $4 million in damage to a Digital Equipment Corp. computer and the possession of corporate trade secrets worth billions of dollars -- were subsequently discredited. There's no question, however, that Mitnick has served jail time and been through numerous scrapes with law enforcement officials over the past 15 years. Defense attorneys once argued successfully that he was a computer addict whose sickness left him not responsible for his actions. No one who has endured a computer virus or hacker attack has much sympathy for intruders such as Mitnick. Shimomura and Markoff said they intended to perform a public service with their book, exposing the mind and methodology of a notorious 32-year-old Los Angeles computer intruder who has spent much of his life making things hard on computer-system operators and law enforcement authorities trying to track him down. But word got out that Shimomura and Markoff had accepted a $750,000 book deal with movie and residual options worth $1 million or so just days after Markoff's front-page stories highlighted the cybersleuthing talents of his collaborator-to-be. The online world smelled a rat. Discussion groups on the Internet and the WELL charged Markoff with conflicts of interest. Shimomura was accused of setting a trap for Mitnick so he could track the hacker down and become a cyberstar. Markoff said they did not pursue the case with the intention of turning it into a movie deal. Once it became evident that such a deal would occur, Markoff and his editors mutually agreed that he would no longer write about the case for the {New York Times.} Another source of contention is the author of a competing book, who has suggested Mitnick did not perform the break-in that led Shimomura into pursuit. "The sophistication of the attack virtually precludes Kevin from having done it without some help," Jeff Goodell told the Associated Press. Goodell wrote Dell Publishing's forthcoming "The Cyberthief and the Samurai." (Shimomura and Markoff said that although Mitnick might have had help, there's no doubt he broke into Shimomura's computer.) Paradoxically, Mitnick has wound up becoming almost a sympathetic character, portrayed as the victim of a couple of self-promoters out to make a buck. "There's some mechanism in American culture that wants to turn criminals into heroes," said Markoff. "And I believe I see this process going on now by which Kevin Mitnick is going to be a genuine American hero." A potential ally to the glamorization is a competing book by Mill Valley, Calif. author Jonathan Littman. "The Fugitive Game" (Little, Brown) shows Mitnick to be a clever, likable if somewhat untrustworthy scam artist with a sense of humor and gift for "social engineering." That's the term used to describe wheedling and lying to corporate and government underlings to obtain what should be protected documents and data. "The simple, unglamorous truth was that Kevin Mitnick, whatever his threat to cyberspace and society, was not that hard to find," writes Littman, who will appear on tour in Seattle on Wednesday. Ironically, both books agree -- despite Markoff's "most-wanted" tag -- that Mitnick was more a "grifter" and small-time con artist than a threat to society. "I don't think hackers do what they do with a charitable philosophy," Littman said, "but they do perform a service. Mitnick has shown that security is not a priority and hackers can read your mail, and that the FBI and others need to get up to speed on this stuff." Markoff defended his stories, saying he was acting as any reporter would in trying to alert the American public to security holes on the Internet. "When the FBI investigated him (Mitnick) and issued a warrant, the warrant was for breaking into a Pacific Bell computer while he was working for this company (a detective agency)," Markoff said. "I don't buy this thing that he's a pristine Robin Hood." In Seattle last fall, Mitnick lived as "Brian Merrill" in a University District apartment for five months while working as a computer assistant at Virginia Mason Medical Center. Detectives working for Cellular One (now AT&T Wireless) tracked the hacker to a basement apartment and kept him under surveillance for two weeks. They did not know it was Mitnick, however, and authorities took no action. It is unlikely Mitnick will ever face charges here. If he is convicted in the federal-court case in Los Angeles and serves time, authorities here doubt they will continue the case. Without Markoff writing about the case for the {New York Times}, one wonders how long the hacker will remain in the public eye. "Whether he is a good guy or bad guy isn't so much the issue," Markoff said. "The issue is Kevin Mitnick as harbinger of this world we're living in. He illustrated a set of vulnerabilities to this network. We're moving all of our commerce into this online world, and the network is not designed to provide the kind of security and privacy it needs to provide." "We wanted to demystify how this is done," Shimomura said. "I wanted to debunk this myth that this guy was a superhacker, that it is impossible to track these hackers down." As if three books were not enough, cyberspace provides more. A World Wide Web page -- http://www.takedown.com -- contains documents and voice recordings of Mitnick not found in any of the books.