Underground: Hacking, madness and obsession on the electronic frontier Part 42

Then it was back to his cell while they processed his charge sheets.

Alone again, Pad wondered once more if they had raided Gandalf. Like an answer from above, Pad heard telephone tones through the walls. The police seemed to be playing them over and over. That was when he knew they had Gandalf too.

Gandalf had rigged up a tone dialler in his computer. It sounded as if the police were playing with it, trying to figure it out.

So, Pad would finally meet Gandalf in person after two years. What would he look like? Would they have the same chemistry in person as on-line? Pad felt like he knew Gandalf, knew his essence, but meeting in person could be a bit tricky.

Explaining that the paperwork, including the charge sheets, had finally been organised, a police officer unlocked Pad's cell door and led him to a foyer, telling him he would be meeting both Gandalf and Wandii. A large collection of police had formed a semi-circle around two other young men. In addition to Scotland Yard's Computer Crimes Unit and BT, at least seven other police forces were involved in the three raids, including those from Greater Manchester, Merseyside and West Yorks.h.i.+re. The officers were curious about the hackers.

For most of the two years of their investigation, the police didn't even know the hackers' real ident.i.ties. After such a long, hard chase, the police had been forced to wait a little longer, since they wanted to nab each hacker while he was on-line. That meant hiding outside each hacker's home until he logged in somewhere. Any system would do and they didn't have to be talking to each other on-line--as long as the login was illegal. The police had sat patiently, and finally raided the hackers within hours of each other, so they didn't have time to warn one another.

So, at the end of the long chase and a well-timed operation, the police wanted to have a look at the hackers up close.

After the officer walked Pad up to the group, he introduced Gandalf.

Tall, lean with brown hair and pale skin, he looked a little bit like Pad. The two hackers smiled shyly at each other, before one of the police pointed out Wandii, the seventeen-year-old schoolboy. Pad didn't get a good look at Wandii, because the police quickly lined the hackers up in a row, with Gandalf in the middle, to explain details to them. They were being charged under the Computer Misuse Act of 1990.

Court dates would be set and they would be notified.

When they were finally allowed to leave, Wandii seemed to disappear.

Pad and Gandalf walked outside, found a couple of benches and lay down, basking in the sun and chatting while they waited for their rides home.

Gandalf proved to be as easy to talk to in person as he was on-line.

They exchanged phone numbers and shared notes on the police raids.

Gandalf had insisted on meeting a lawyer before his interviews, but when the lawyer arrived he didn't have the slightest understanding of computer crime. He advised Gandalf to tell the police whatever they wanted to know, so the hacker did.

The trial was being held in London. Pad wondered why, if all three hackers were from the north, the case was being tried in the south.

After all, there was a court in Manchester which was high enough to deal with their crimes.

Maybe it was because Scotland Yard was in London. Maybe they had started the paperwork down there. Maybe it was because they were being accused of hacking computers located within the jurisdiction of the Central Criminal Court--that court being the Old Bailey in London. But Pad's cynical side hazarded a different guess--a guess which seemed justified after a few procedural appearances in 1992 before the trial, which was set for 1993. For when Pad arrived at the Bow Street Magistrates Court for his committal in April 1992, he saw it packed out with the media, just as he had antic.i.p.ated.

A few hackers also fronted up to fly the flag of the underground. One of them--a stranger--came up to Pad after court, patted him on the back and exclaimed enthusiastically, 'Well done, Paddy!' Startled, Pad just looked at him and then smiled. He had no idea how to respond to the stranger.

Like the three Australian hackers, Pad, Gandalf and the little-known Wandii were serving as the test case for new hacking laws in their country. British law enforcement agencies had spent a fortune on the case--more than [sterling]500000 according to the newspapers--by the time the 8lgm case went to trial. This was going to be a show case, and the government agencies wanted taxpayers to know they were getting their money's worth.

The hackers weren't being charged with breaking into computers. They were being charged with conspiracy, a more serious offence. While admitting the threesome did not hack for personal gain, the prosecution alleged the hackers had conspired to break into and modify computer systems. It was a strange approach to say the least, considering that none of the three hackers had ever met or even talked to the others before they were arrested.

It was not so strange, however, when looking at the potential penalties. If the hackers had been charged with simply breaking into a machine, without intending any harm, the maximum penalty was six months jail and a fine of up to [sterling]5000. However, conspiracy, which was covered under a different section of the Act, could bring up to five years in jail and an unlimited amount in fines.

The prosecution was taking a big gamble. It would be harder to prove conspiracy charges, which required demonstration of greater criminal intent than lesser charges. The potential pay-off was of course also much greater. If convicted, the defendants in Britain's most important hacking case to date would be going to prison.

As with The Realm case, two hackers--Pad and Gandalf--planned to plead guilty while the third--in this case Wandii--planned to fight the charges every step of the way. Legal Aid was footing the bill for their lawyers, because the hackers were either not working or were working in such lowly paid, short-term jobs they qualified for free legal support.

Wandii's lawyers told the media that this showcase was tantamount to a state trial. It was the first major hacking case under the new legislation which didn't involve disgruntled employees. While having no different legal status from a normal trial, the term state trial suggested a greater degree of official wrath--the kind usually reserved for cases of treason.

On 22 February 1993, within two months of Electron's decision to turn Crown witness against Phoenix and Nom, the three 8lgm hackers stood in the dock at Southwark Crown Court in South London to enter pleas in their own case.

In the dim winter light, Southwark couldn't look less appealing, but that didn't deter the crowds. The courtroom was going to be packed, just as Bow Street had been. Scotland Yard detectives were turning out in force. The crowd shuffled toward Room 12.

The prosecution told the media they had about 800 computer disks full of evidence and court materials. If all the data had been printed out on A4 paper, the stack would tower more than 40 metres in the air, they said. Considering the ma.s.sive amount of evidence being heaved, rolled and tugged through the building by teams of legal eagles, the choice of location--on the fifth floor--proved to be a challenge.

Standing in the dock next to Wandii, Pad and Gandalf pleaded guilty to two computer conspiracy charges: conspiring to dishonestly obtain telecommunications services, and conspiring to cause unauthorised modification to computer material. Pad also pleaded guilty to a third charge: causing damage to a computer. This last charge related to the almost a quarter of a million pounds worth of 'damage' to the Central London Polytechnic.

Unlike the Australians' case, none of the British hackers faced charges about specific sites such as NASA.

Pad and Gandalf pleaded guilty because they didn't think they had much choice. Their lawyers told them that, in light of the evidence, denying their guilt was simply not a realistic option. Better to throw yourself on the mercy of the court, they advised. As if to underline the point, Gandalf's lawyer had told him after a meeting at the end of 1992, 'I'd like to wish you a happy Christmas, but I don't think it's going to be one'.

Wandii's lawyers disagreed. Standing beside his fellow hackers, Wandii pleaded not guilty to three conspiracy charges: plotting to gain unauthorised access to computers, conspiring to make unauthorised modifications to computer material, and conspiring to obtain telecommunications services dishonestly. His defence team was going to argue that he was addicted to computer hacking and that, as a result of this addiction, he was not able to form the criminal intent necessary to be convicted.

Pad thought Wandii's case was on shaky ground. Addiction didn't seem a plausible defence to him, and he noticed Wandii looked very nervous in court just after his plea.

Pad and Gandalf left London after their court appearance, returning to the north to prepare for their sentencing hearings, and to watch the progress of Wandii's case through the eyes of the media.

They weren't disappointed. It was a star-studded show. The media revved itself up for a feeding frenzy and the prosecution team, headed by James Richardson, knew how to feed the pack. He zeroed in on Wandii, telling the court how the schoolboy 'was tapping into offices at the EC in Luxembourg and even the experts were worried. He caused havoc at universities all around the world'.4 To do this, Wandii had used a simple BBC Micro computer, a Christmas present costing [sterling]200.

The hacking didn't stop at European Community's computer, Richardson told the eager crowd of journalists. Wandii had hacked Lloyd's, The Financial Times and Leeds University. At The Financial Times machine, Wandii's adventures had upset the smooth operations of the FTSE 100 share index, known in the City as 'footsie'. The hacker installed a scanning program in the FT's network, resulting in one outgoing call made every second. The upshot of Wandii's intrusion: a [sterling]704 bill, the deletion of an important file and a management decision to shut down a key system. With the precision of a banker, FT computer boss Tony Johnson told the court that the whole incident had cost his organisation [sterling]24871.

But the FT hack paled next to the prosecution's real trump card: The European Organisation for the Research and Treatment of Cancer in Brussels. They had been left with a [sterling]10000 phone bill as a result of a scanner Wandii left on its machine,5 the court was told.

The scanner had left a trail of 50000 calls, all doc.u.mented on a 980-page phone bill.

The scanner resulted in the system going down for a day, EORTC information systems project manager Vincent Piedboeuf, told the jury.

He went on to explain that the centre needed its system to run 24 hours a day, so surgeons could register patients. The centre's database was the focal point for pharmaceutical companies, doctors and research centres--all coordinating their efforts in fighting the disease.

For the media, the case was headline heaven. 'Teenage computer hacker "caused worldwide chaos"' the Daily Telegraph screamed across page one. On page three, the Daily Mail jumped in with 'Teenage hacker "caused chaos for kicks"'. Even The Times waded into the fray.

Smaller, regional newspapers pulled the story across the countryside to the far reaches of the British Isles. The Herald in Glasgow told its readers 'Teenage hacker "ran up [sterling]10000 telephone bill"'.

Across the Irish Sea, the Irish Times caused a splash with its headline, 'Teenage hacker broke EC computer security'.

Also in the first week of the case, The Guardian announced Wandii had taken down the cancer centre database. By the time The Independent got hold of the story, Wandii hadn't just shut down the database, he had been reading the patients' most intimate medical details: 'Teenager "hacked into cancer patient files"'. Not to be outdone, on day four of the trial, the Daily Mail had christened Wandii as a 'computer genius'. By day five it labelled him as a 'computer invader' who 'cost FT [sterling]25000'.

The list went on. Wandii, the press announced, had hacked the Tokyo Zoo and the White House. It was difficult to tell which was the more serious offence.

Wandii's defence team had a few tricks of its own. Ian MacDonald, QC, junior counsel Alistair Kelman and solicitor Deborah Tripley put London University Professor James Griffith-Edwards, an authoritative spokesman on addictive and compulsive behaviours, on the stand as an expert witness. The chairman of the National Addiction Centre, the professor had been part of a team which wrote the World Health Organisation's definition of addiction. No-one was going to question his qualifications.

The professor had examined Wandii and he announced his conclusion to the court: Wandii was obsessed by computers, he was unable to stop using them, and his infatuation made it impossible for him to choose freely. 'He repeated 12 times in police interviews, "I'm just addicted. I wish I wasn't",' Griffith-Edwards told the court. Wandii was highly intelligent, but was unable to escape from the urge to beat computers' security systems at their own game. The hacker was obsessed by the intellectual challenge. 'This is the core ... of what attracts the compulsive gambler,' the professor explained to the entranced jury of three women and nine men.

But Wandii, this obsessive, addicted, gifted young man, had never had a girlfriend, Griffith-Edwards continued. In fact, he shyly admitted to the professor that he wouldn't even know how to ask a girl out. 'He [Wandii] became profoundly embarra.s.sed when asked to talk about his own feelings. He simply couldn't cope when asked what sort of person he was.'6

People in the jury edged forward in their seats, concentrating intently on the distinguished professor. And why wouldn't they? This was amazing stuff. This erudite man had delved inside the mind of the young man of bizarre contrasts. A man so sophisticated that he could pry open computers belonging to some of Britain's and Europe's most prestigious inst.i.tutions, and yet at the same time so simple that he had no idea how to ask a girl on a date. A man who was addicted not to booze, smack or speed, which the average person a.s.sociates with addiction, but to a computer--a machine most people a.s.sociated with kids' games and word processing programs.

The defence proceeded to present vivid examples of Wandii's addiction.

Wandii's mother, a single parent and lecturer in English, had terrible trouble trying to get her son away from his computer and modem. She tried hiding his modem. He found it. She tried again, hiding it at his grandmother's house. He burgled granny's home and retrieved it. His mother tried to get at his computer. He pushed her out of his attic room and down the stairs.

Then he ran up a [sterling]700 phone bill as a result of his hacking.

His mother switched off the electricity at the mains. Her son reconnected it. She installed a security calling-code on the phone to stop him calling out. He broke it. She worried he wouldn't go out and do normal teenage things. He continued to stay up all night--and sometimes all day--hacking. She returned from work to find him unconscious--sprawled across the living room floor and looking as though he was dead. But it wasn't death, only sheer exhaustion. He hacked until he pa.s.sed out, then he woke up and hacked some more.

The stories of Wandii's self-confessed addiction overwhelmed, appalled and eventually engendered pity in the courtroom audience. The media began calling him 'the hermit hacker'.

Wandii's defence team couldn't fight the prosecution's evidence head-on, so they took the prosecution's evidence and claimed it as their own. They showed the jury that Wandii hadn't just hacked the inst.i.tutions named by the prosecution; he had hacked far, far more than that. He didn't just hack a lot--he hacked too much. Most of all, Wandii's defence team gave the jury a reason to acquit the innocent-faced young man sitting before them.

During the trial, the media focused on Wandii, but didn't completely ignore the other two hackers. Computer Weekly hunted down where Gandalf was working and laid it bare on the front page. A member of 'the UK's most notorious hacking gang', the journal announced, had been working on software which would be used at Barclay's Bank.7 The implication was clear. Gandalf was a terrible security risk and should never be allowed to do any work for a financial inst.i.tution. The report irked the hackers, but they tried to concentrate on preparing for their sentencing hearing.

From the beginning of their case, the hackers had problems obtaining certain evidence. Pad and Gandalf believed some of the material seized in the police raids would substantially help their case--such as messages from admins thanking them for pointing out security holes on their systems. This material had not been included in the prosecution's brief. When the defendants requested access to it, they were refused access on the grounds that there was cla.s.sified data on the optical disk. They were told to go read the Attorney-General's guidelines on disclosure of information. The evidence of the hackers'