Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker

Still
, I told myself, 
there’s always a way
.
Each housing unit at the MDC had a “Public Defender’s phone,” a
telephone with what the phone companies call “direct-connect” service:
when an inmate picked up the handset, he would be connected directly to
the Federal Public Defender’s Office. I knew these were the only phones
available to prisoners that weren’t subject to monitoring—because of
attorney-client privilege. But they were also programmed at the phone
company switch so that they couldn’t be used for incoming calls (“deny
terminate,” in telco lingo), and couldn’t connect to any numbers other than
the main telephone number at the Public Defender’s Office. I’d cross that
bridge when I came to it.
First I needed to get the numbers. It took me only twenty minutes to
social-engineer Pacific Bell and learn the ten direct-connect service
numbers working in the prison.
Next I called the Recent Change Memory Authorization Center
(“RCMAC”). I said I was calling from Pacific Bell’s business office and
requested that “deny terminate” be immediately removed from those ten
numbers. The RCMAC clerk gladly complied.
Then, taking a deep breath, I called the Receiving and Discharge Office
at the prison itself.
“This is Unit Manager Taylor at Terminal Island,” I said, trying to sound
like a bored, frustrated prison drone. Using the name of the Bureau of
Prisons’ main computer system along with Poulsen’s inmate registration
number, I went on. “Sentry is down here. Can you look up reg number
95596-012 for me?”
When the guy at the prison looked up Poulsen’s number, I asked what
housing unit he was in. “Six South,” he said.
That narrowed it down, but I still didn’t know which of the ten phone
numbers was located on Six South.

---

On my microcassette player, I recorded a minute or so of the ringing
sound that you hear on the phone when you call someone. This would only
work if an inmate picked up the phone to call his public defender during
those two or three minutes when I was calling into the phone. I would have
to try many, many times before someone picked up. Another of those times
when it helped to be patient and doggedly determined.
When I hit it just right and an inmate picked up the receiver, I’d let him
hear a few rings on my microcassette player, then I’d stop the ringing and
say, “Public Defender’s Office, may I help you?”
When the inmate asked for his lawyer, I’d say, “I’ll see if he’s
available,” then pretend to go off the line for a minute. I’d come back on,
tell him his attorney wasn’t in at the moment, and ask his name. Then,
nonchalantly, as if I were taking down all the relevant information, I’d ask,
“And what housing unit are you in?”
Then I’d say, “Try calling back in an hour or two,” so no one would
notice that a lot of public defenders never seemed to get their messages.
Each time an inmate did answer, I was able to identify another housing unit
and take that number off my list. Jotting down the details on a notepad, I
was slowly constructing a map of which phone numbers connected to which
inmate housing units. At last, after several days of dialing phone numbers, I
reached an inmate on Six South.
I remembered the internal extension for Six South from when I was in
solitary confinement at MDC. Among the things I had done during that time
to keep my mind active and preserve my sanity was to listen to
announcements over the prison’s PA system and store in my memory every
phone extension I heard. If an announcement said, “C.O. Douglas, call Unit
Manager Chapman on 427,” I’d make a mental note of the name and
number. As I’ve said, I seem to have an uncanny memory for phone
numbers. Even today, years later, I still know quite a few of the phone
numbers at that prison, as well as many dozens, perhaps hundreds, of
numbers for friends, phone company offices, and others that I’ll probably
never have any use for again but that were seared into my brain anyway.
What I needed to do next seemed impossible. I had to find a way to call the
prison itself and make arrangements for a phone call with Kevin Poulsen
that would not be monitored.

---

Here’s how I went about it: I called the main number of the prison,
identified myself as “a unit manager at TI” (Terminal Island Federal
Prison), and asked for extension 366, the number to the Six South guard.
The operator put me through.
A guard answered, “Six South, Agee.”
I knew this guy from when I had been a prisoner there myself. He had
gone out of his way to make my life miserable. But I had to keep my anger
in check. I said, “This is Marcus, in R and D,” meaning Receiving and
Discharge. “Do you have Inmate Poulsen there?”
“Yeah.”
“We have some personal property of his that we wanna get out of here. I
need to find out where he wants it shipped.”
“