Kevin Mitnick, whose pioneering antics tricking employees in the 1980s and 1990s into helping him steal software and services from major phone and technology companies made him America’s most notorious hacker, has died at age 59.
Mitnick died Sunday in Las Vegas after a 14-month battle with pancreatic cancer, said Stu Sjouwerman, chief executive of security training firm KnowBe4, where Mitnick was director of hacking.
His colorful career, from DIY student to fugitive on the run from the FBI, jailed criminal, and finally respected cybersecurity professional, public speaker, and consulted author by US lawmakers and global corporations, reflects society’s evolving understanding of the nuances of hacking.
Through Mitnick’s career path, and what many see as the unwarranted zeal of the prosecution that put him behind bars for nearly five years until 2000, the public has learned to better distinguish serious computer crimes from the mischievous rowdies of young men bent on proving their hacking prowess.
“He never hacked for money,” said Sjouwerman, who became Mitnick’s business partner in 2011. He was mainly after trophies, mainly cell phone codes, he said.
Much fanfare accompanied Mitnick’s high-profile arrest in 1995, three years after he skipped parole on an earlier computer theft charge. The government accused him of causing millions of dollars in damage to companies like Motorola, Novell, Nokia and Sun Microsystems by stealing software and altering computer code.
But federal prosecutors had a difficult time gathering evidence of serious crimes, and after being jailed for nearly four years, Mitnick reached a plea deal in 1999 crediting him with time served.
Upon his release from prison in January 2000, Mitnick told reporters that «they were simple trespassing offences.» He said: «He wanted to know everything he could about how the telephone networks worked.»
Initially, he was banned for three years from using computers, modems, cell phones, or anything else that could give him access to the Internet, and from speaking in public. Those requirements were gradually eased, but it was not allowed to come back online until December 2002.
Mitnick’s forte was social engineering. He would impersonate company employees to obtain passwords and data, a technique known as pretexting that remains one of the most effective in hacking and usually requires considerable research to pull off successfully.
“Her ingenuity challenged systems, sparked dialogue, and pushed the boundaries of cybersecurity. It will continue to be a testament to the unknown power of curiosity,” tweeted Chris Wysopal, who as a member of the white hat hacking group L0pht testified before the US Senate a few years before Mitnick did the same.
«My hacking activity was really a search for knowledge, the intellectual challenge, the excitement and the escape from reality,» Mitnick said during a March conference. 2000 congressional hearing in response to a question from Sen. Joseph Lieberman, D-Conn., about what motivated him.
In his prepared testimony, Mitnick boasted that he had «successfully penetrated some of the most resilient computer systems ever developed.»
Mitnick had first been arrested for computer crimes at age 17 for brazenly breaking into a Pacific Bell office and taking a handful of manuals and computer codes for digital door locks. That is why he served a year in a rehabilitation center, considered by a federal judge as addicted to computer manipulation.
Mitnick had been raised in the gloomy Los Angeles suburb of Panorama City by his mother, who divorced his father when he was 3 years old. A lonely and overweight teenager, he dropped out of high school and found friends only when he stumbled upon the world of phone phreaks, teens who used stolen phone codes to make free long-distance calls.
Phones led to computers, and Mitnick proved to be a persistent, if not stellar hacker. Captivated by the possibility of using computers to gain access and power, Mitnick began hacking into voicemail and computer systems, going through private files and taunting those who came across him.
But another side of Mitnick became clear in his conversations with investigative journalist Jonathan Littman printed in the mid-1990s in «The Fugitive Game: Online with Kevin Mitnick.» The hacker seems less of a threat than a fearful and disturbed young man, more annoying than vindictive.
And while a computer file containing 20,000 credit card numbers copied from Internet service provider Netcom was found on Mitnick’s computer after a 1994 arrest, there’s no evidence he used any of the accounts.
Mitnick became a cause celebre for hackers who considered his 5-year prison term excessive. Some defaced websites to post messages demanding his release. Among the targets was The New York Times, which some supporters accused of exaggerating the social danger Mitnick represented.
Exaggerated stories of Mitnick’s exploits and abilities also circulated, sometimes fueling hysteria.
One led prison officials to put him in solitary confinement for nine months, Sjouwerman said, because they feared he could start a nuclear war by whistling into a pay phone, emulating a modem «to hack NORAD and fire a ballistic missile.»
Mitnick is the author of «The Ghost in the Wires,» which chronicles his adventures as a wanted hacker, and three other books he co-wrote with others, including «The Art of Deception.»
In addition to his work at KnowBe4, where Mitnick was not involved in day-to-day operations, he ran a freelance penetration testing business with his wife, the former Kimberely Barry.
She is a native of Australia, where the two met.