WEBVTT - Operation Sundevil and the Birth of the EFF - Part Two 0:00:04.040 --> 0:00:07.760 Again text with technology with tech Stuff from stuff works 0:00:07.800 --> 0:00:14.280 dot com. Hey there, and welcome to tech Stuff. I 0:00:14.320 --> 0:00:18.520 am your host, Jonathan Strickland, executive producer at how Stuff Works. 0:00:18.520 --> 0:00:21.880 And in our last episode we started the story of 0:00:22.040 --> 0:00:26.200 Operation Sun Devil and how that leads into the formation 0:00:26.280 --> 0:00:29.440 of the Electronic Frontier Foundation. As it turned out, it's 0:00:29.480 --> 0:00:32.680 a much bigger story than I had originally anticipated, and 0:00:32.720 --> 0:00:38.200 thus necessitated two episodes to talk about this amazing story. 0:00:38.680 --> 0:00:41.840 So here is part two. I hope you guys enjoy, 0:00:42.080 --> 0:00:45.239 and I'm probably gonna start like mid sentence because we 0:00:45.280 --> 0:00:47.760 had to interrupt the last one right in the middle 0:00:47.760 --> 0:00:53.120 of somewhere. So let's go now. On Martin Luther King 0:00:53.520 --> 0:00:58.320 Junior Day in nine So, several months after this raid 0:00:58.400 --> 0:01:01.040 had happened, a T and T E crashed. There was 0:01:01.080 --> 0:01:03.800 a nationwide crash of a T and T S phone service, 0:01:05.200 --> 0:01:08.240 which since Fry Guy had mentioned the possibility of a 0:01:08.319 --> 0:01:12.199 phone service crashing nationwide on fourth of July and Martin 0:01:12.240 --> 0:01:15.679 Luther King Jr. Days another holiday, made the Secret Service 0:01:15.680 --> 0:01:18.880 totally flip out and suspect that the Legion of Doom 0:01:18.920 --> 0:01:22.600 was responsible, and so they stepped up surveillance of the 0:01:22.600 --> 0:01:26.000 group in general beyond the Atlanta three. Remember those are 0:01:26.040 --> 0:01:28.600 just three people who are in this larger hacker group. 0:01:28.640 --> 0:01:32.559 That's that's roster changed regularly. It's not like people would 0:01:33.440 --> 0:01:36.800 become a member of this hacker group for life. That 0:01:37.200 --> 0:01:40.880 list of members changed pretty frequently, uh, And there was 0:01:40.880 --> 0:01:43.640 a lot of turnover. People would go off and form 0:01:43.680 --> 0:01:47.440 splinter groups, or they would just drop out entirely. But 0:01:47.840 --> 0:01:52.400 the Legion of Doom had no responsibility for that phone crash. However, 0:01:52.480 --> 0:01:54.520 things were already getting out of control. There was this 0:01:54.600 --> 0:01:58.320 growing sense of unease and law enforcement. Hackers were getting 0:01:58.360 --> 0:02:02.320 access to critical infrastructure. Now, a lot of that fell 0:02:02.760 --> 0:02:05.920 onto the entities responsible for creating the infrastructure in the 0:02:05.960 --> 0:02:09.320 first place. So, for example, Bell South, which was really 0:02:09.320 --> 0:02:12.480 flipping out when discovered that hackers were reprogramming its digital 0:02:12.520 --> 0:02:17.640 switching systems, had pretty lousy security on some of their systems, 0:02:17.840 --> 0:02:21.920 particularly the Bell South that was focusing in the Atlanta 0:02:22.000 --> 0:02:26.280 and Georgia area. Georgia and Florida area, I should say 0:02:26.639 --> 0:02:29.760 they their security at the time was pretty terrible. They 0:02:29.760 --> 0:02:32.880 had entire phone the computer systems that were not even 0:02:32.919 --> 0:02:37.200 protected by passwords. So once you knew that the system 0:02:37.240 --> 0:02:40.160 existed and you found an entry way into it. It 0:02:40.240 --> 0:02:46.720 was pretty much free gain. And people argued, well, yeah, 0:02:46.760 --> 0:02:49.560 hackers are getting access to this infrastructure, but a large 0:02:49.560 --> 0:02:52.200 part of that is because there's no security on the 0:02:52.240 --> 0:02:56.480 infrastructure infrastructure side, So whose fault is that? Really there 0:02:56.480 --> 0:03:00.360 should be much better security. If you have a a 0:03:00.440 --> 0:03:04.240 bank and there's no back wall to the vault, then 0:03:05.400 --> 0:03:08.040 it's kind of hard to say that, Uh, you know, 0:03:08.120 --> 0:03:10.120 you should expect that money to be there the next 0:03:10.320 --> 0:03:13.040 the next day, and people just walk in through the 0:03:13.040 --> 0:03:18.440 back and take it. So there was definitely a shared 0:03:18.480 --> 0:03:22.160 responsibility here, although ultimately you could argue people who choose 0:03:22.200 --> 0:03:27.160 to infiltrate a system are ultimately responsible. But still there 0:03:27.240 --> 0:03:31.920 was it was complicated, and some folks said that it 0:03:32.000 --> 0:03:34.600 just felt like there was There was the thought of 0:03:34.639 --> 0:03:37.440 someone breaking into a system like that was just outside 0:03:37.480 --> 0:03:39.880 the realm of possibility, not because it was too difficult, 0:03:39.880 --> 0:03:43.760 but just because the system was considered to be so important. 0:03:44.640 --> 0:03:48.000 Who would have the temerity to go in and break 0:03:48.000 --> 0:03:50.840 into such a system. Once bell Seuth became aware that 0:03:50.880 --> 0:03:53.320 this was happening and that it had been going on 0:03:53.400 --> 0:03:55.520 for a while, it's just that again, most hackers were 0:03:55.520 --> 0:03:58.200 smart enough to cover their tracks. Fry Guy was just 0:03:58.280 --> 0:04:01.160 not one of them. The company agan to dedicate time 0:04:01.200 --> 0:04:04.680 and resources hiring on people and having them tracked down 0:04:04.800 --> 0:04:09.560 other instances of abuse. Now across the nation, law enforcement 0:04:09.560 --> 0:04:13.040 officials were closing in on various hackers, many of them teenagers, 0:04:13.680 --> 0:04:18.120 and the Secret Service really were focusing on Erville, Leftist 0:04:18.160 --> 0:04:21.599 and Profit. The Atlanta Three, those members of the Legion 0:04:21.640 --> 0:04:26.960 of Doom. They all three were infamous for exploring systems 0:04:26.960 --> 0:04:31.000 that they had no business being in. But unlike Fry Guy, 0:04:31.040 --> 0:04:34.920 they weren't interested in causing really mischief for stealing money. 0:04:34.960 --> 0:04:37.279 They just wanted to poke around to see what was 0:04:37.320 --> 0:04:40.839 going on. But one of them did do something supremely 0:04:41.040 --> 0:04:45.159 dumb that would cause huge issues for numerous other people. 0:04:45.800 --> 0:04:48.640 And the one who did something supremely dumb was Profit. 0:04:49.000 --> 0:04:51.839 So Erville was kind of a problem because he wasn't 0:04:51.839 --> 0:04:54.360 really considering anything that he had done to have been 0:04:54.400 --> 0:04:58.239 wrong in the first place, which was antagonizing his interrogators. 0:04:59.160 --> 0:05:02.680 But Profit had taken a trophy while exploring what was 0:05:02.720 --> 0:05:07.440 supposed to be a very private computer system, and that 0:05:07.520 --> 0:05:11.719 trophy is what would ultimately lead to a massive sting 0:05:11.760 --> 0:05:15.360 operation that would go far beyond the reach of the 0:05:15.400 --> 0:05:19.880 Secret Service. Now, this actually happened a little bit earlier. 0:05:20.120 --> 0:05:22.240 We had been talking about eighty nine and nine. But 0:05:22.320 --> 0:05:26.600 back in Profit had broken into a Bell South automation 0:05:26.640 --> 0:05:31.839 system called AMSX, which stood for Advanced Information Management System, 0:05:31.880 --> 0:05:34.800 and it was an internal business network at Bell South, 0:05:35.640 --> 0:05:38.160 not terribly interesting. It had a lot of files that 0:05:38.200 --> 0:05:41.040 people within Bell South might need access to. Think of 0:05:41.080 --> 0:05:44.919 like a company intranet has a lot of just you know, 0:05:46.080 --> 0:05:49.640 working documents that you would need access to for whatever reason, 0:05:50.360 --> 0:05:53.600 but nothing that's of particular interest to anyone on the 0:05:53.640 --> 0:05:58.520 outside necessarily. But getting into the system was tricky, not 0:05:58.680 --> 0:06:00.680 due to security because again and this was one of 0:06:00.720 --> 0:06:03.880 those systems that didn't even have password protection, but because 0:06:04.160 --> 0:06:08.160 it was largely invisible. There were no forward facing or 0:06:08.200 --> 0:06:11.120 public facing portals into the system. You had to get 0:06:11.360 --> 0:06:15.159 into a Bell South system and then from their log 0:06:15.240 --> 0:06:20.000 into this other computer system. Uh, it wasn't much of 0:06:20.000 --> 0:06:22.120 a problem for Profit. He was able to compromise a 0:06:22.200 --> 0:06:24.320 valid user I D and then he was able to 0:06:24.320 --> 0:06:27.920 access the am SX system that way, and he did 0:06:27.960 --> 0:06:32.039 so almost a dozen times, and as a trophy, he 0:06:32.160 --> 0:06:34.560 made a copy of a document that he came across. 0:06:34.600 --> 0:06:37.360 He wasn't looking for it, He just saw it and thought, 0:06:37.880 --> 0:06:40.080 I'll make a copy of this to prove that I 0:06:40.160 --> 0:06:43.520 was here. So I when I tell my hacker friends, hey, 0:06:43.560 --> 0:06:46.640 I broke into that system. This is the proof I 0:06:46.680 --> 0:06:51.640 will have. The document he copied was titled Bell South 0:06:51.920 --> 0:06:55.960 Standard Practice six six zero DASH two to five DASH 0:06:56.040 --> 0:07:00.000 one oh four s V Control Office, Administration of Enhance 0:07:00.440 --> 0:07:05.080 nine eleven Services for Special Services and Major Account Centers, 0:07:05.400 --> 0:07:09.040 and it was dated March. This is the e N 0:07:09.640 --> 0:07:14.040 one document, the Enhanced nine one services document. Then he 0:07:14.160 --> 0:07:18.480 made a copy of this document and he stored it 0:07:18.560 --> 0:07:21.360 on an account he had made on a Unix bulletin 0:07:21.440 --> 0:07:24.400 board system called Joel Net j O L n Et, 0:07:25.480 --> 0:07:28.080 and Joel Nett belonged to a guy named Richard Andrews, 0:07:28.200 --> 0:07:31.160 who would end up suffering a huge amount of grief 0:07:31.200 --> 0:07:35.720 for this. And you then have two unauthorized copies of 0:07:35.720 --> 0:07:39.400 this out in the wild, beyond the ones that actual 0:07:39.480 --> 0:07:43.680 BellSouth employees might have had access to. So real BELLSOFF 0:07:43.680 --> 0:07:46.560 employees may have had copies of this on their machines, 0:07:46.600 --> 0:07:53.280 which isn't terribly safe either, but profits certainly wasn't supposed 0:07:53.320 --> 0:07:54.960 to have it, and not only did he have a 0:07:55.000 --> 0:07:58.520 copy on his computer, yet now one on someone else's computer. 0:07:58.640 --> 0:08:01.400 That would be Richard Drew's computer, the one that was 0:08:01.480 --> 0:08:05.760 running this bulletin board system. Well, then Richard Andrews notices 0:08:06.000 --> 0:08:09.200 that there's this new account on joel Net that he 0:08:09.240 --> 0:08:11.840 doesn't recognize, and he gets a little suspicious about it. 0:08:11.920 --> 0:08:14.360 You know, he's the administrator of this bulletin board system, 0:08:14.360 --> 0:08:16.960 so he sees when stuff is going up or down 0:08:16.960 --> 0:08:20.120 on it, and he investigated and saw the copy of 0:08:20.200 --> 0:08:24.520 the document and figured something hinky was going on. So 0:08:24.560 --> 0:08:28.280 then he makes a copy of this file and he 0:08:28.320 --> 0:08:30.080 sends it to a friend of his who worked at 0:08:30.120 --> 0:08:32.520 A T and T. This would be a guy named 0:08:32.600 --> 0:08:36.800 Charles Boykin. Now Boykin was not in voice communication, that 0:08:37.000 --> 0:08:39.520 wasn't the department he worked in, but he immediately knew 0:08:39.559 --> 0:08:43.599 that the document was serious business. Boy can get a 0:08:43.640 --> 0:08:46.160 little upset because he's like, why are people messing with this? 0:08:46.160 --> 0:08:50.560 This is critical stuff? And he decided to consult with 0:08:50.600 --> 0:08:53.600 an A T and T corporate information security officer named 0:08:53.720 --> 0:08:57.880 Jerome Dalton. That meant that Boykin had to make another 0:08:58.000 --> 0:09:01.520 copy of the E nine one document. So you're seeing 0:09:01.520 --> 0:09:05.240 how this is starting to escalate. Dalton would in turn 0:09:05.360 --> 0:09:08.800 send a copy of the file to a telecommunications fraud 0:09:08.880 --> 0:09:12.839 expert named Henry Klipfel. But Clipfel was a happy cat. 0:09:12.920 --> 0:09:16.199 He figured this document was a hacker trophy. It wasn't 0:09:16.240 --> 0:09:21.679 meant to be a guide for some sort of nationwide catastrophe. 0:09:21.960 --> 0:09:25.880 He figured someone broke into the system. This was their 0:09:25.960 --> 0:09:28.000 proof that they did it. So he just kind of 0:09:28.080 --> 0:09:30.040 put it on the shelf and didn't really think about 0:09:30.080 --> 0:09:35.120 it again and wasn't too worried about it until later. Um, 0:09:35.200 --> 0:09:38.720 he just figured it was what it actually was. He 0:09:38.760 --> 0:09:41.560 would sell this for a while, although he would eventually 0:09:41.600 --> 0:09:44.679 become heavily involved in a response team a little bit 0:09:44.760 --> 0:09:47.600 later on. Now we've got a lot more to talk 0:09:47.640 --> 0:09:51.600 about for this whole series of events that would end 0:09:51.679 --> 0:09:57.400 up perpetuating a seriously a series of bad decisions that 0:09:57.480 --> 0:10:00.000 led to the formation of the FF which, by the way, 0:10:00.080 --> 0:10:01.920 it was not a bad decision. It's just that a 0:10:01.920 --> 0:10:04.079 bunch of bad decisions happened and the e f F 0:10:04.320 --> 0:10:07.960 had to come into creation because of it. But before 0:10:08.000 --> 0:10:09.520 I get into that part of the story, let's take 0:10:09.520 --> 0:10:19.360 another quick break and thank our sponsor. All right, let's 0:10:19.360 --> 0:10:23.160 get back to profit profit. What had decided that he 0:10:23.200 --> 0:10:27.200 was going to really revel in his victorious infiltration of 0:10:27.240 --> 0:10:30.240 the Bell South system. He was not aware of this 0:10:30.400 --> 0:10:34.840 leap frogging of the document that was going down the 0:10:34.880 --> 0:10:38.320 line being sent from one person to another, and an 0:10:38.400 --> 0:10:41.320 effort to figure out what exactly is going on here? 0:10:42.160 --> 0:10:46.920 He thought, I wanna, I want to really brag about this. 0:10:46.920 --> 0:10:49.160 This was a big achievement. How can I how can 0:10:49.160 --> 0:10:53.720 I let the community know that I have this this 0:10:54.240 --> 0:10:57.679 amazing document. Well, there was a journalist who was working 0:10:57.800 --> 0:11:03.240 on a publication, a digital publication called Frack. Fracks spelled 0:11:03.240 --> 0:11:05.960 with a pH, so it was a portmanteau of the 0:11:06.000 --> 0:11:11.679 words freak and hack and uh. The journalist used the 0:11:11.720 --> 0:11:17.200 handle night lightning and a night, as in like a 0:11:17.240 --> 0:11:21.199 man dressed up in big old armored underpants, that kind 0:11:21.200 --> 0:11:23.480 of night, which, by the way, you do not want 0:11:23.520 --> 0:11:26.760 to be a night when there's lightning around. That's a 0:11:26.880 --> 0:11:31.400 bad combination. Anyway, night Lightning was writing this publication called Frack, 0:11:31.480 --> 0:11:34.880 which was very popular. It was distributed to multiple bolletin 0:11:34.920 --> 0:11:38.760 board systems across the entire world, primarily the United States, 0:11:38.760 --> 0:11:41.760 but also beyond that, and night Lightning had been bothering 0:11:41.800 --> 0:11:46.280 the Atlanta Three for years about giving the giving the 0:11:46.360 --> 0:11:50.280 publication more information so they could publish stories about them. 0:11:50.360 --> 0:11:54.320 And typically the Atlanta Freight three weren't interested in doing that. 0:11:54.360 --> 0:11:57.720 They just didn't really play ball very much. But Profits 0:11:57.720 --> 0:12:00.120 saw this as being a great opportunity, and so a 0:12:00.120 --> 0:12:05.679 Profit sent a copy of the nine one file tonight Lightning. 0:12:06.920 --> 0:12:10.000 Night Lightning was going to the University of Missouri, and 0:12:10.120 --> 0:12:14.280 so this copy of E nine one one then goes 0:12:14.320 --> 0:12:19.280 on to a computer at the University of Missouri campus. Uh. 0:12:19.440 --> 0:12:22.199 Profit figured that he was pretty safe because no one 0:12:22.240 --> 0:12:25.560 had said anything to him and he wasn't aware of 0:12:25.600 --> 0:12:27.720 this other activity that was going on with the file 0:12:27.800 --> 0:12:31.320 at the time, and then he and night Lightning together 0:12:31.679 --> 0:12:37.640 started to edit down the document. They wanted to publish it. Well, 0:12:37.760 --> 0:12:40.240 night Lightning really wanted to publish it, but Profit was 0:12:40.280 --> 0:12:45.400 scared that one the information inside it could be put 0:12:45.440 --> 0:12:49.480 to malicious use and it could cause a catastrophe. I mean, 0:12:49.520 --> 0:12:55.000 it did involve the emergency phone system in the United States. 0:12:55.040 --> 0:12:57.800 That's a big deal. And two he didn't want anything 0:12:57.800 --> 0:13:02.040 that could ultimately be traced back to him so together 0:13:02.080 --> 0:13:05.480 they edited out all the sensitive information while keeping the 0:13:05.559 --> 0:13:07.160 rest of it as much as they could so that 0:13:07.200 --> 0:13:09.600 they could prove that, yes, this document did come from 0:13:09.640 --> 0:13:11.960 Bell South, but they leave out all the things like 0:13:12.080 --> 0:13:15.880 all the phone numbers for the various officers at Bell South, 0:13:15.920 --> 0:13:18.680 which were part of this document. They didn't want that 0:13:18.720 --> 0:13:21.040 to be revealed to the general public because then a 0:13:21.040 --> 0:13:23.680 bunch of hackers would end up just using those phone 0:13:23.720 --> 0:13:27.480 numbers for various malicious purposes. So they're trying to limit 0:13:28.200 --> 0:13:30.840 the amount of damage that could be done with this document, 0:13:31.040 --> 0:13:34.560 and Frank would end up publishing this edited document on 0:13:34.640 --> 0:13:41.800 February twenty nine. I remember July of that year would 0:13:41.800 --> 0:13:44.600 be when the raid would happen, so this is still 0:13:44.679 --> 0:13:48.760 before the raid that hit fry Guy profit or Vile 0:13:48.920 --> 0:13:52.439 and the Leftist. The Digital dogument was then published to 0:13:52.559 --> 0:13:57.200 one fifty different hacker sites or hacker bolton board systems 0:13:57.240 --> 0:14:00.719 would be more appropriate to say, so it got very 0:14:00.720 --> 0:14:05.000 wide distribution, even though this was an edited down version 0:14:05.160 --> 0:14:08.080 of that document, and at this point law enforcement and 0:14:08.160 --> 0:14:13.800 Bell South had totally gone eight. They flipped their collective lids. 0:14:14.679 --> 0:14:17.880 This is what helped fuel the move to the Legion 0:14:17.920 --> 0:14:21.120 of Doom and Fry Guy sweep At later on that year, 0:14:21.120 --> 0:14:25.000 on July two. It's what really motivated the Secret Service 0:14:25.040 --> 0:14:29.560 to make that make that sting operation. The intrusion was 0:14:29.600 --> 0:14:32.360 a huge problem, but the apparent distribution of what was 0:14:32.400 --> 0:14:38.240 considered a critical document was really the catastrophe in question. 0:14:38.320 --> 0:14:43.600 It It terrified people because here was a sensitive document 0:14:43.800 --> 0:14:48.520 about a critical service and who knows what could happen. 0:14:49.280 --> 0:14:51.320 As far as the Secret Service could tell, there was 0:14:51.400 --> 0:14:54.760 some sort of conspiracy going on among the hacker subculture 0:14:55.280 --> 0:14:58.600 to take down the phone system or the emergency phone 0:14:58.600 --> 0:15:02.440 system specifically, and it was a coordinated attack that was 0:15:02.520 --> 0:15:06.200 going across the nation. It was being spread around, and 0:15:06.280 --> 0:15:10.360 so the Secret Service was highly motivated to pursue this. 0:15:11.240 --> 0:15:15.200 The problem was that they weren't necessarily doing it in 0:15:15.240 --> 0:15:18.040 a way that was technically what you would call legal. 0:15:19.160 --> 0:15:25.560 As it turns out, So you have a a an 0:15:25.720 --> 0:15:33.000 arguably understandable motivation for the Secret Service. They really have 0:15:33.200 --> 0:15:36.520 to buckle down and make sure that the nation is safe. 0:15:37.400 --> 0:15:41.120 Uh You. There, you then have the more mischievous community 0:15:41.160 --> 0:15:43.840 of the hackers who are just kind of reveling in 0:15:43.880 --> 0:15:48.360 this thought that here's this private computer system that's supposed 0:15:48.400 --> 0:15:51.520 to be off limits, and yet a hacker strolled right 0:15:51.560 --> 0:15:55.360 in and took one of these files. Um and both 0:15:55.640 --> 0:16:00.520 groups had totally not really considered the other the motivations 0:16:00.520 --> 0:16:04.520 of the other one. So the hackers were mostly ignorant 0:16:04.680 --> 0:16:06.520 of what was going on with the Secret Service at 0:16:06.520 --> 0:16:10.800 this time, and the Secret Service was just imagining a 0:16:10.880 --> 0:16:14.000 worst case scenario in the case of the hackers, and 0:16:14.040 --> 0:16:17.880 it would lead to enormous problems further down the road. 0:16:18.680 --> 0:16:22.400 And we also know that if you take down a 0:16:22.440 --> 0:16:26.440 digital file once it's been put up online, that's it. 0:16:26.440 --> 0:16:28.880 It's out there. The genie is out of the bottle, 0:16:28.920 --> 0:16:32.000 the cat is out of the bag. You're not getting 0:16:32.040 --> 0:16:35.520 it back because someone's gonna make a copy of it 0:16:35.560 --> 0:16:37.960 and post it somewhere else. We've seen it with videos. 0:16:38.000 --> 0:16:41.640 We've seen it with tweets, We've seen it with social 0:16:41.680 --> 0:16:44.720 media posts, We've seen it with files. It's just once 0:16:44.720 --> 0:16:47.080 it goes up, all it takes is one other person 0:16:47.120 --> 0:16:50.360 to download it and then host it somewhere else and 0:16:50.400 --> 0:16:54.840 it's game over. Then the phone system would crash on January. 0:16:56.840 --> 0:16:59.680 This is after those rates with Fry Guy in the 0:16:59.680 --> 0:17:03.520 atlant A three, and it seemed to prove what Fry 0:17:03.560 --> 0:17:07.159 Guy had been saying. Fry Guy had said that the 0:17:07.440 --> 0:17:10.640 group of hackers, the Legion of Dooms, specifically, we're going 0:17:10.680 --> 0:17:13.719 to end up crashing the phone system. Now, he had 0:17:13.720 --> 0:17:15.119 said it was going to be on the fourth of 0:17:15.200 --> 0:17:18.560 July nine, and instead it happens on Martin Luther King 0:17:18.600 --> 0:17:21.600 Junior Day in nineteen and that's when the poo hit 0:17:21.600 --> 0:17:24.960 the oscillating cooling device, as they say. Three days later, 0:17:25.280 --> 0:17:29.719 January four, people would show up to night Lightning's frat 0:17:29.720 --> 0:17:33.159 house at the University of Missouri. Two of those people 0:17:33.240 --> 0:17:36.880 were Secret Service agents, one was an agent for Southwestern 0:17:36.920 --> 0:17:39.880 Bell and one was a University of Missouri security officer, 0:17:40.320 --> 0:17:45.240 and they accused night Lightning of causing this phone system crash, 0:17:45.640 --> 0:17:49.040 or at least coordinating it. Now, night Lightning had nothing 0:17:49.040 --> 0:17:52.600 to do with the phone system coming down, but, like 0:17:53.080 --> 0:17:57.359 lots of other hackers before, decided to cooperate fully within 0:17:57.560 --> 0:18:01.800 terry Gators, sharing an entire of the subscribers to the 0:18:02.000 --> 0:18:06.800 Fracking Newsletter, or the Frack Newsletter, i should say, and 0:18:07.800 --> 0:18:11.560 that gave law enforcement a ton of other leads to follow. 0:18:12.480 --> 0:18:15.080 Around that same time, agents were starting to do stuff 0:18:15.080 --> 0:18:17.479 that was really causing a lot of concern, not just 0:18:17.520 --> 0:18:22.160 in the hacking community, but in the broader computer industry community. So, 0:18:22.240 --> 0:18:26.600 for example, one target of this investigation was a guy 0:18:26.680 --> 0:18:30.800 named Robert Eisenberg who ran a node. A node is 0:18:31.520 --> 0:18:36.520 part of an interconnected system of message boards, so it's 0:18:36.520 --> 0:18:39.200 like a bolton Board system, but amped up because it 0:18:39.240 --> 0:18:43.320 could actually connect directly to other nodes. Bolton Board systems 0:18:43.320 --> 0:18:45.840 were kind of like an island, right. There was no 0:18:46.200 --> 0:18:49.880 connection directly to other bolton Board systems for the most part. 0:18:50.040 --> 0:18:53.840 There were some exceptions, but generally speaking, it was like 0:18:54.040 --> 0:18:56.879 an individual computer system that you would log into and 0:18:56.920 --> 0:19:00.800 that's all you saw. Nodes were more like web pages 0:19:00.840 --> 0:19:04.359 on the Internet, though not quite as sophisticated as that, 0:19:04.800 --> 0:19:07.400 so sort of somewhere in between a bolton Board system 0:19:07.440 --> 0:19:09.960 and a web page, but they could interconnect with each 0:19:09.960 --> 0:19:14.800 other and allow for direct communication and file transfers between them. 0:19:14.920 --> 0:19:19.359 So Eisenberg was running a node that was a a 0:19:19.560 --> 0:19:24.959 Unix node. It was called Elephant. Eisenberg was targeted because 0:19:25.000 --> 0:19:28.600 a task force out of Chicago, a very active task 0:19:28.640 --> 0:19:31.800 force that was largely responsible for leading some of these 0:19:31.840 --> 0:19:36.920 investigations into hackers, had identified elephant uh the node that 0:19:36.960 --> 0:19:40.840 he was running after performing a raid on a different 0:19:41.080 --> 0:19:47.880 Unix expert called Terminus, or his handle was Terminus. Eisenberg 0:19:47.960 --> 0:19:53.240 was a Unix consultant, and they thought because Terminus was 0:19:53.280 --> 0:19:58.639 connected to this world, that Eisenberg too must be connected 0:19:58.720 --> 0:20:02.160 to it. Eisenberg, though, was a total stand up dude, 0:20:02.280 --> 0:20:05.840 a straight shooter. He was not someone who acted outside 0:20:05.840 --> 0:20:08.679 of the law. He did do some contract work with 0:20:08.760 --> 0:20:12.280 a phone company, and while technically his contract was up, 0:20:12.320 --> 0:20:15.600 he could log into the phone company systems and occasionally 0:20:15.640 --> 0:20:18.080 he would do so. But he wasn't stealing files, he 0:20:18.160 --> 0:20:22.440 wasn't distributing files, he wasn't causing any sort of sabotage. 0:20:23.440 --> 0:20:25.439 So you could argue that he was still being a 0:20:25.480 --> 0:20:28.280 little questionable because he was poking his nose someplace where 0:20:28.280 --> 0:20:31.760 technically he was no longer working. But beyond that, he 0:20:31.800 --> 0:20:35.199 wasn't really doing anything. He wasn't publishing any of that 0:20:35.280 --> 0:20:39.520 on his Bolton board system or his node. Rather, and 0:20:39.960 --> 0:20:43.240 the investigators were asking them all about the legion of Doom, 0:20:43.320 --> 0:20:45.560 and he says, what are you talking about? And they 0:20:45.600 --> 0:20:47.880 started asking about Terminus, and then he said, I don't 0:20:48.280 --> 0:20:50.320 I don't know who you're I don't know these people. 0:20:51.440 --> 0:20:55.720 Then they gave him the actual name for the guy 0:20:55.960 --> 0:20:59.480 who was using the handle, Terminus, and Eisenberg says, oh, yeah, 0:20:59.520 --> 0:21:02.720 that guy. Know that guy because he is an expert 0:21:02.800 --> 0:21:06.560 on this one particular very powerful computer system, and we've 0:21:06.560 --> 0:21:10.440 talked about that, but we've talked as you know, human beings, 0:21:10.480 --> 0:21:14.600 not to hacker handles and otherwise. He really had no 0:21:14.640 --> 0:21:17.200 connection to Terminus or hackers like the Legion of Doom. 0:21:18.040 --> 0:21:21.960 But that didn't stop the government from seizing Eisenberg's equipment 0:21:22.359 --> 0:21:27.439 and the node itself. Eisenberg wasn't arrested, he was not 0:21:27.600 --> 0:21:30.879 charged with any crimes, but the government would end up 0:21:30.880 --> 0:21:34.000 holding onto his equipment for a couple of years, so 0:21:35.080 --> 0:21:38.880 he had no access to things that he he outright owned. 0:21:39.160 --> 0:21:41.680 The government did say that the modem he was using 0:21:41.800 --> 0:21:45.680 was likely hot as in it was stolen property, but 0:21:45.880 --> 0:21:49.640 Eisenberg didn't purchase it as stolen. He wasn't like going 0:21:49.680 --> 0:21:52.800 to some sort of person who's like, hey, this modem 0:21:52.800 --> 0:21:54.560 fell off the back of a truck. He bought it 0:21:55.000 --> 0:21:57.680 second hand. But that's what a lot of hackers were doing. 0:21:57.720 --> 0:22:02.400 They were buying equipment she that was usually equipment that say, 0:22:02.480 --> 0:22:04.960 a university was getting rid of because they were upgrading 0:22:04.960 --> 0:22:08.480 to the next level of equipment, so then they offload 0:22:09.119 --> 0:22:12.080 the stuff that they already had. According to the government, 0:22:12.440 --> 0:22:16.119 the modem that Eisenberg had was likely stolen property, but 0:22:16.200 --> 0:22:20.000 he didn't know that, so he was like, well, I'm sorry, 0:22:20.359 --> 0:22:22.640 I wasn't trying to buy stolen property. I just needed 0:22:22.640 --> 0:22:28.880 a modem. Uh. This whole move of the government taking 0:22:29.560 --> 0:22:33.200 Eisenberg's equipment without charging him of any sort of crime, 0:22:33.800 --> 0:22:38.720 as you might imagine, is problematic because if you assume 0:22:38.800 --> 0:22:43.840 we're in adjust society, which is obviously being very lenient, 0:22:44.800 --> 0:22:48.040 you don't have governments sweep in to take possession of 0:22:48.080 --> 0:22:52.920 someone else's property with no legal justification. But that's totally 0:22:52.960 --> 0:22:55.119 what happened to Eisenberg as well as to other people. 0:22:55.119 --> 0:22:57.960 Eisenberg was not an isolated case. There were other people 0:22:57.960 --> 0:23:01.480 who also had their their various computer systems taken from 0:23:01.560 --> 0:23:06.200 them without any actual evidence that they themselves had done 0:23:06.200 --> 0:23:08.800 any sort of crime. Now, this was largely because there 0:23:08.840 --> 0:23:11.320 was still so much uncertainty about what was actually going on. 0:23:11.440 --> 0:23:13.399 The Secret Service was still trying to figure out is 0:23:13.440 --> 0:23:16.600 there some sort of nationwide conspiracy that's gonna try and 0:23:16.680 --> 0:23:22.680 do the equivalent of a cyber attack on the United States. Uh, 0:23:22.720 --> 0:23:26.080 But they weren't really sure. They didn't have any evidence 0:23:26.119 --> 0:23:28.600 of it apart from the fact that this one emergency 0:23:28.720 --> 0:23:32.040 document had made its way through all these different hacker sites. 0:23:32.560 --> 0:23:35.240 There were also fears that perhaps foreign agents were involved, 0:23:35.240 --> 0:23:40.880 including possibly the involvement of the KGB out of Germany, which, 0:23:40.920 --> 0:23:42.920 by the way, at that time there were two Germany's. 0:23:43.000 --> 0:23:46.560 There was a West Germany in the East Germany. Now 0:23:46.640 --> 0:23:49.280 the days that's not the case, but some of us 0:23:49.320 --> 0:23:51.919 remember when the map was very different in Europe. So 0:23:51.960 --> 0:23:55.480 the fear of what could possibly be was fueling a 0:23:55.520 --> 0:23:58.439 lot of very questionable decisions over at the Secret Service. 0:23:58.680 --> 0:24:01.480 Back to the Legion of Doom, one of the other members, 0:24:02.000 --> 0:24:05.199 not the Atlanta three, but another member who had not 0:24:05.240 --> 0:24:09.160 been picked up in this initial sweep, was known as 0:24:09.359 --> 0:24:14.000 the Mentor. Mentor happened to work at a little company 0:24:14.040 --> 0:24:18.359 called Steve Jackson Games. I mentioned them earlier in this episode. 0:24:19.400 --> 0:24:22.439 Steve Jackson Games had its own little bolton board system 0:24:22.520 --> 0:24:27.679 called Illuminati, which if you know what the Illuminati are 0:24:27.720 --> 0:24:30.640 supposed to be, it's this hidden government organization that supposedly 0:24:30.680 --> 0:24:34.880 was controlling the world. It obviously brings up other questions 0:24:34.920 --> 0:24:37.439 of oh, maybe there is a hacker conspiracy here, but no, 0:24:37.560 --> 0:24:40.440 that was because Steve Jackson Games had a game called 0:24:40.480 --> 0:24:44.360 Illuminati and they named their bolton Board system after it. 0:24:44.359 --> 0:24:47.200 It had nothing to do with any sort of hacker conspiracy. 0:24:47.480 --> 0:24:52.480 Steve Jackson Games just makes games, and that game again, Illuminati, 0:24:52.560 --> 0:24:55.600 the game of conspiracy was what they called their bolton 0:24:55.600 --> 0:24:59.440 Board system. So the Secret Service was getting confused between 0:25:00.040 --> 0:25:03.560 the actual games that Steve Jackson was making and reality, 0:25:04.040 --> 0:25:07.400 kind of similar to what Erville had experienced with those 0:25:07.440 --> 0:25:11.080