Ghost in the Wires: My Adventures as the World’s Most Wanted Hacker

Felicity
. After we met at a studio in Burbank, he invited me to do a small
cameo as an FBI agent on his show 
Alias
, as an in-joke. In a script change, I
ended up as a CIA agent working against the treacherous SD6.
The Federal government refused to give me permission to type on a
working computer for the scene, so the prop master had to make sure the
keyboard was disconnected. I appeared on camera with Jennifer Garner,
Michael Vartan, and Greg Grunberg. It was awesome—one of the most
enjoyable experiences I’ve ever had.
Around the summer of 2001, I got a phone call from a man named Eddie
Muñoz, who knew of my past hacking exploits and wanted to hire me to fix
a rather unusual problem. His highly successful service in providing
“dancers” available on call in Las Vegas had dropped off very significantly.
Eddie felt certain that the Mafia had hacked Sprint’s phone switch and
reprogrammed it so that most of the calls to Eddie’s service would be
diverted to other call-girl services run by the Mob.
Muñoz had filed a complaint with the Public Utilities Commission
(PUC) against Sprint, claiming that his business was suffering because the
company had not secured its infrastructure properly against hackers. He
wanted to hire me as an expert witness for the commission hearing. Initially
I was skeptical that Sprint was at fault for Eddie’s declining revenue, but I
agreed to testify about the company’s vulnerabilities.
During the hearing, I described how I had been hacking into phone
companies for years, including Sprint. I explained that the CALRS system
Sprint used for testing was similar to Pacific Bell’s SAS, but with what I
thought was even better security: anyone trying to access the remote
CALRS test units in each central office had to give the correct response to a
challenge in order to get access. The system was programmed with 
a
hundred
different challenges—double digits from 00 to 99, each of which
had its own response of four hex characters such as b7a6 or dd8c. Hard to
crack… except through wiretapping or social engineering.
The way I’d gotten around it, I told the commission, was by calling the
manufacturer of the system, Northern Telecom, claiming to be with Sprint’s
Engineering Department, and saying I was building a custom testing tool
that needed to communicate with the CALRS test units in each central

---

office. The technician faxed me the “Seed List” of all one hundred
challenges and responses.
One of Sprint’s attorneys challenged my testimony: “Mr. Mitnick is a
social engineer, lying was part of his stock-in-trade, and you can’t believe
anything he says.” Not only did he absolutely deny that Sprint had been
hacked or could be hacked in the future, but he pointed out that I’d literally
written “the book on lying”: 
The Art of Deception
(about which, more in a
moment).
One of the PUC staffers confronted me, saying, “You have offered all
these claims but haven’t offered a shred of evidence. Do you have any way
of proving Sprint can be hacked?”
It was a long shot, but there was just a chance I might be able to prove
it. During the lunch break, I went to a storage locker I had opened while in
Las Vegas just before going on the run. It was crammed with cell phones,
chips, printouts, floppy disks, and more—stuff I couldn’t take with me but
didn’t want to lose and couldn’t risk leaving at my mom’s or Gram’s, where
the Feds might show up with a search warrant and find it all.
Incredibly, in that big pileup of old goods, I found what I was looking
for: a sheet of paper, by now tattered, dog-eared, and dusty, containing the
CALRS Seed List. On my way back to the hearing room, I stopped at a
Kinko’s and had enough copies made for the commissioner, lawyers, clerk,
and staff.
Kevin Poulsen, who by this time had become a highly respected
technology reporter, had flown to Las Vegas to cover the hearing as a
journalist. Here is what he wrote about my return to the witness stand:
“If the system is still in place, and they haven’t changed the seed list,
you could use this to get access to CALRS,” Mitnick testified. “The
system would allow you to wiretap a line, or seize dial tone.”
Mitnick’s return to the hearing room with the list generated a flurry
of activity at Sprint’s table; Ann Pongracz, the company’s general
counsel, and another Sprint employee strode quickly from the room—
Pongracz already dialing on a cell phone while she walked.
The fact that the two Sprint people were ashen-faced as they rushed out
of the room made the situation clear enough: Sprint was probably still using
the same CALRS devices, programmed with the identical Seed List, and

---

Pongracz and her colleague must have recognized that I could hack into
CALRS anytime I liked and gain the power to wiretap any phone in Las
Vegas.
Though I was vindicated, Eddie didn’t fare as well. Proving that Sprint
could be hacked wasn’t the same as proving that the Mob or anybody else
had actually done any hacking to reroute Eddie’s flow of calls and steal
business from him. Eddie was left empty-handed.
In the fall of 2001, a whole new chapter started in my life when I was
introduced to literary agent David Fugate. David thought my story was
extraordinary. He quickly contacted John Wiley & Sons and proposed that I
author a book on social engineering to help businesses and consumers alike
protect themselves against the kinds of attacks I had been so successful at
carrying out. Wiley showed enthusiasm for the deal, and David
recommended a seasoned coauthor named Bill Simon to work with me in
developing the book, which came to be called 
The Art of Deception
.
For most people, landing an agent, a credited coauthor, and a legitimate
publishing deal is the most difficult part of getting a book published. For
me, the question was: how could I write a book without a computer?
I looked at the stand-alone word processors everybody used before the
introduction of personal computers. Since they weren’t even able to
communicate with other computers, I thought I had a pretty solid argument.
So I presented it to my Probation Officer.
His answer was completely unexpected.
He dismissed the word-processor idea and told me I could use a laptop
computer, so long as I didn’t access the Internet and promised to keep it
secret from the media!
While Bill and I were writing our book, Eric Corley released 
Freedom
Downtime
, the documentary about the “Free Kevin” movement. It went a
long way toward counteracting the gross inaccuracies of 
Takedown
. It even
contained footage in which John Markoff admitted that his single source for
claiming I’d hacked into NORAD was a convicted phone phreak known for
spreading false rumors.
When it came out, 
The Art of Deception
quickly became an international
bestseller, published in eighteen foreign editions. Even today, years later,

---

it’s still one of Amazon’s most popular hacking books, and is on the
required reading list in computer courses at a number of universities.
Around February 2003, I was unexpectedly invited to Poland to promote
the book. At my first stop in Warsaw, my host offered four security guys in
suits with Secret Service–type headsets to handle security. I laughed,
thinking it was ridiculous. Surely I didn’t need security.
They escorted me through the back of the building into a huge shopping
mall. The chatter got louder and louder until we walked out into the mall,
where hundreds of fans were pressed up against a rope. When they saw me,
they tried to push forward, and the security staff had to hold them back.
Thinking they must have mistaken me for some international celebrity, I
started looking around for the star myself. But amazingly enough, the
crowd really was there for 
me
.
My book had become the number-one bestselling book in the entire
country, even beating out a new book by Pope John Paul II. One local
offered an explanation: in ex-Communist Poland, if you beat the system,
you were considered a hero!
After a lifetime of hacking, always working either alone or with one