The FBI tracks and visits the 414s, a group of computer hackers in Milwaulkee who have entered dozens of corporate and military computers.

                    CAUGHT IN THE ACT
                     -----------------

       THIS ARTICLE WAS TAKEN FROM 'ENTER' MAGAZINE MARCH 84

           "We really did it this time," Paul's friend said. "The F.B.I
was here today."
           During the first months of 83, Paul, 16, and half a dozen
other boys from Milwaukee had been using their home computers and modems
to break into main frame computers across the country. Most of the boys,
who range in age from 16 to 25, met as members of a local Explorer Scout
troop, where a common intrest in computers drew them together. They
started calling themselves "the 414s" after the Milwaukee area code.
           By the time the F.B.I. succeeded in tracing them in August,
83, through calls the 414s had placed to big computers at the Sloan-Kettering
Cancer Center in New York and the nuclear weapons facility at Los Alamos,
NM, these Milwaukee hackers reportedly had explored more than 60 computer
sys>ems.
           The news about these break-ins sped across the nation like
a summer storm. The 414s were the focus of atention. One of them 17-year-old
Neil Patrick, became a type of instant celebrity, featured on magazine
covers and TV news programs.
           Some people saw the activities of the 414s as simply "teenage
antics" of WarGames- inspired pranks.
           But a number of computer security experts saw the whole event
as more serious. The mainframes could easily have been damaged by inexperienced
users. Valuable files could have been deleted inadvertently. Whole systems
could have been shut down by the 414s instructions. Many people worried
that supposedly secret information was no longer secret.
           In fact, officials at the Sloan-Kettering Cancer Institute
in New York pointed out that the 414s didi about $US1500 worth of damage
by deleting two of the computers daily files. Those files were ones
used to record those who sign on. Paul now says that the 414s deliberately
deleted the files in an atempt to cover up their entry into the system.
           By the time the F.B.I. knocked on Paul's door, he had been
looking into other computers for years.
           "It was the ultimate game," he syas. "It's pretty neat, actually,
to get in there and learn exactly how an entire system works."
           He still thinks breaking into computers is exciting, but
after the F.B.I. began investigating him and the other 414s, he says
he decided ,"It's not worth it. It's not that much fun having the police
and the F.B.I. come over to your house.
           "It never entered my mind ," he says. "You don't think the
police or F.B.I. are ever going to come to your house. It's a big shock
when you see them You're only in your bedroom calling another computer.
           Of all the 414s Paul should have known better. just six months
before the F.B.I. showed up, Paul had gotten into trouble breaking into
the computer at the Milwaukee School of Engineering. He had been entering
the PDP 11 computer once or twice a week for four months. It wasn't
just harmless looking around, either. When the systems operator at the
engineering school discovered Paul had gotten into his computer, he
tried to kick Paul off. Paul got mad and retaliated.
           "I used up all the storage space available on the computer,"
he says. "I just filled it up with a giant file I made and nobody could
save programs."
           That didn't happen just once, but five different times. And
each time, Paul says, it took the chool two or three days to clean out
its system.
           One day Paul came home from school and saw a lot of cars
parked in front of his house. "I thought some neighbour was having a
party," he said, "but when I opened the door there were four detectives
and a guy from the Milwaukee School of Engineering in my living room."
           Other computer friends, Paul says, joked about the incident.
           The engineering school, however, didn't think the intrusions
were funny. The school agreed not to prosecute Paal, but did take his
computer away for 90 days and had his dad pay $500 in restitution.
           Paul got his computer back in late May. Two weeks later,
he started looking around in the Telenet system for computers he could
break into.
           "all my friends were doing it during the time that the engineering
school had my computer," he said "and it was too tempting." And, he
adds,"I didn't really think I was going to get into trouble again if
i didn't screw up anything."
           That's what the other 414s have told reporters. Shortly before
Paul got his computer back, however, Wisconsin had enacted a law that
imposed a penalty of up to nine months jail for unauthorized entry into
someone else's computer. A copy of this law had been put into the computer
system at his high school. Paul read it. He says he understood the law
protected computers from maliciousness.
           But, he says, "Just looking around? That wasn't so clear
to me. I know now it's not okay to go looking at other peoples computers.
It's not your property. It's unethical and you can get caught and get
in trouble."

Detroit Free Press (MI)
August 28, 1983 
Section: WWL 
Edition: METRO FINAL 
Page: 1F 


HIGH-TECH HIJINKS SEVEN CURIOUS TEENAGERS WREAK HAVOC VIA COMPUTER 

COLIN COVERT Free Press Staff Writer 


MILWAUKEE -- The computer raiders weren't whiz kids. They were Explorer
Scouts.  The seven technological guerillas who played "WarGames" with more
than 50 computers are simply bright adolescents with time on their hands,
their parents and lawyers insist. The group, who dubbed themselves "the
414s," after Milwaukee's area code, range in age from 16 to 22.

Over a period of at least a year , they tampered with programs and read
sensitive files in major computer installations across the country. Among
the systems they entered were those of the atomic weapons research lab of
Los Alamos Nuclear Facility, Manhattan's Memorial Sloan-Kettering Cancer
Center, Pacific Security Bank in Los Angeles and scores of other
institutions. Their activities were uncovered in June when a
Sloan-Kettering computer operator found numerous files destroyed.

Computer trespassing of the sort the 414s committed is a crime in 21
states, including Michigan. According to the FBI, the Milwaukee hackers
also may be liable to federal charges of wire fraud (entering a computer
via telephone under false identification) and transporting stolen goods
across state lines. FBI Special Agent-In-Charge Ernest Woodby said it's
unclear whether charges ever will be pressed against any of the group.

Donn Parker, a California computer security consultant, said the 414s fit
the classic profile of computer bandits: "Young, male, intelligent ,
highly motivated and energetic."

Dennis Hill, the supervisor of a Milwaukee computer installation damaged
by one member of the group, sees the invaders as typical all-American
teenagers. "(The boy who invaded Hill's system) was 15 years old at the
time. He had a computer system that was great, and for a 15-year-old,
that's almost as challenging as his first car, as exciting as his first
experience with girls. I think everybody, when you first can drive, will
at least once see how fast the car can go."

The 414s weren't especially knowledgeable about computers. "When I bought
Paul the computer , I hoped it'd be educational," said a chagrined John
Sundquist, whose 16-year-old son was implicated in the investigation. Paul
and another member of the group had joined Milwaukee's Explorer Scout Post
760, sponsored by IBM, to encourage young people interested in careers in
data processing.

The technological trespassing they committed is called "hacking." As the
name suggests, it's like chipping away at a brick wall until a fissure
appears. It can be done by finding an authorized user's password, or
entering the log-in program through a loophole that gives access to the
computer without a password . The practice has only recently come into the
limelight as a result of the movie "WarGames," in which a teenage hacker
unwittingly penetrates a Defense Department doomsday computer and starts
the world on its way to thermonuclear war. But the 414s admit they were
hacking long before the movie appeared.

Their operation was low-budget and their methods unsophisticated, conceded
Neal Patrick, a 17 -year-old member of the 414s who cracked the computer
at Pacific Security Bank in Los Angeles. The 414s used inexpensive
personal computers to establish connections with the larger machines,
Patrick said, and commonly known passwords to get inside them.

The fact that the 414s easily entered scores of computers reveals a level
of negligence among operators of multimillion- dollar computer systems
that would never be tolerated in a night security guard. Each of the firms
the intruders hit made it easy to invade their computers. In effect, they
left the front door open and put out the welcome mat

Several factors tempt young computer enthusiasts to try hacking. The first
line of defense, the security measures designed into the machines by
manufacturers and implemented by the users, are frequently ineffective.
Computer classes give students the expertise to run powerful machines, but
rarely stress the ethics of computer use. And parental supervision of home
computer use is often lacking , because few adults are familiar with the
technology. In the words of Neal Patrick, "I now wish access to these
systems weren't so easy."

The 414s didn't even operate in secrecy. Months before the recent rash of
break-ins, one of the 414s was known to Milwaukee authorities as a
computer vandal. In 1982, Paul Sundquist did nearly $4,000 worth of damage
by deleting computer files at a Milwaukee technical school, an incident
that prompted the Wisconsin Legislature to enact a tough computer crimes
law which includes felony penalties for the worst offenses.

The story of that break-in began one night last fall in the Milwaukee
School of Engineering's Allen Bradley Hall of Science. The third floor of
the tan brick building houses research computers used by the technical
school's faculty and 3,000 students. Early in the fall semester, the
system began acting up in a most puzzling way.

The heart of the school's $400,000 data processing installation is VAX, an
extremely popular computer manufactured by Digital Equipment Corp., a
Massachusetts firm that is America's largest producer of computers after
IBM. The VAX is one of Digital Equipment's biggest sellers, used by many
corporations and research centers nationwide, said Dennis Hill, director
of academic computer services for the Milwaukee engineering school.

The VAX also has a prominent Achilles heel. In September, the former
computer system manager, who is no longer with the school, began receiving
complaints from students and instructors that their computer files had
been altered or deleted altogether. Someone "got into our computer and
went sightseeing," said Hill. "His actions said, 'I'm in; now what's the
next step?' He didn't know what to do. But he tried basic things, using
commands that are common to most systems , like 'copy,' 'delete,' and
'create.' " The intruder was destroying programs and threatening the
entire system, including records of work done by the school's Applied
Technology Center for the Department of Defense.

The trespasser had no need for skulduggery, Hill said. "The phone numbers
for our computers are public information." Calls to the computer "go
straight in," allowing callers to log into the system, he said.

Requesting an account is the next step in getting access to the computer,
Hill said. There are standard accounts on the VAX system, identified by
numbers. They are, in effect , factory-set passwords. It's as if every
Corvette produced by General Motors accepted the same ignition key.

"Typing in '1,2' would open up a major system account on this computer,"
Hill said. "That's the computer manufacturer's designation. If they had a
computer just like this at another company, '1,2' would still be the
system account, unless the owner took the time to change it." The raider
gained access to the computer by using such standard VAX account numbers,
which are not difficult to uncover with some research, Hill said.

WHY DIDN'T the school change its computer access codes to foil intruders?
Ironically, Hill has learned from extensive surveys of security systems
that few computer users get around to devising their own codes.

"In most cases, a customer will get a computer , and he'll be in such a
hurry to get it running and show some productivity for his investment that
he'll neglect a lot of safeguards. He'll leave a lot of the standard
accounts just as they're set up by the manufacturer. They don't bother to
check them, they don't bother to change them, or by the time they change
them, it's too late," he said.

"Once you have the account, the computer asks you for the password, and if
that's incorrect, you'll be logged off," Hill continued. But since
inexperienced new users often use such systems, alarms don't automatically
sound when several log-in attempts fail in a row. Patient hackers can
program their computers to generate thousands of passwords at random and
record those the computers accept. And some user-friendly computers are
even easier to enter . They'll disclose detailed log-in instructions when
users type H-E-L-P, Hill said.

Breaking into the Milwaukee School of Engineering system was almost that
simple. "It was easy to break in. The manager of the system -- who's no
longer here -- had an account on our VAX. The password was his last name,"
Hill sighed.

Computer passwords are often easy to guess, but some are easier than
others. Employing a user's name is equivalent to leaving a key under that
welcome mat.

"If you want to get in, it's standard technique to try the name of the
person running the system," Hill said. Other common ploys are spelling the
name backwards, using the person's initials, birthday or phone number.

"Sure enough, when he typed in D-A-V-I-S," Hill said, snapping his
fingers, "the intruder had control of the system."

ONCE INSIDE, he could change other people's files, read their records,
create accounts, delete accounts, even crash the system, shutting all
computer operations down.

School authorities monitored 24 separate break-ins between September and
early November, when they caught the culprit through a phone trace. It was
Paul Sundquist, then 15, who used the TRS-80 computer his father had
bought for educational purposes.

"He didn't think he was doing any harm, he just thought he was using the
computer like his home computer," said Sundquist's attorney, Jeffrey
Reitz. "But once he got in , he juggled up a number of programs, and it
took a lot of time to figure out what was wrong with them and then to fix
it up again."

John Sundquist, the boy's father, says he doesn't know what Paul's motives
were. "Maybe it was curiosity and showing off to other kids. He can't
rationalize it or make any logic out of it," Sundquist said. "He's caught
up in the hype of the '80s. With this rapidly changing technology, kids
are making the leap into adulthood in one big jump. They can go too far,
too fast."

CRIMINAL CHARGES were dropped in exchange for a promise that Paul would
not repeat his mischief . In December his computer was impounded for 60
days by the Milwaukee School of Engineering, and his parents paid a token
sum of $500 to cover part of the damage he did to the school's computer.

Paul appeared contrite in his interviews with the school's officials,
Reitz said, but "exactly how much repentance a 15- year-old is going to
have for something that causes no visible harm, I don't really know. He
indicated that he would not do something like that again. He understood
that all sorts of damage could be caused with no intent, just the
slightest manipulations. Maybe he did understand, maybe he didn't, maybe
he was just saying that. I really don't know."

Seven months later, a team of FBI agents came to the door of the
Sundquists' modest, north Milwaukee home to ask about the 414s and
computer raids on Los Alamos, Sloan-Kettering, and dozens of other sites.

Paul's uncle, a law clerk who works with Reitz, reacted to the FBI inquiry
with a cry of "Oh, no, not this again," Reitz said. Reitz calls this the
only case of computer crime recidivism his office has encountered.

THE FBI visited Gerald Wondra first. Wondra, 22, a hacker who lives with
his mother in the tidy Milwaukee suburb of West Allis, caused the failure
of a computer system maintaining billing at Memorial Sloan-Kettering
Cancer Center in New York City, according to FBI agent John Sauls.

The computer break -in was discovered in June by Chen Chui, computer
system manager at the cancer center. Chui said the first unauthorized tap
-- the first ever for the center -- occurred June 3 when "the intruder
deleted the user accounting file, thereby causing (the cancer center) to
lose approximately $1,500 in revenues." In the next few days, unauthorized
accounts popped up in the system, as did programs to copy other users'
passwords, giving the intruder access to all their records, an FBI
affidavit stated. The computer was a Digital Equipment Corp. VAX.

Chui deleted the unauthorized accounts, issued new passwords to affected
accounts, and left the intruder a warning message on the computer,
explaining the hazards of crashing the system and offering to give him a
free account if he'd leave the rest of the computer alone. Wondra called
Chui and told him he was "curious, he was just having fun" and was trying
to make the center's computer talk to his own, according to Sauls.

Chui contacted New York City police , the FBI and New York telephone
security officials to put taps on the phone lines the intruder most often
used. The calls were traced to Milwaukee and Wondra, Sauls said.

"He was stunned to see the FBI on his doorstep. This is stuff he's only
seen in the movies," said attorney Paul Piaskoski, who is representing
Neal Patrick as legal counsel, and the entire group as an agent in trying
to sell the rights to their story to Hollywood.

Piaskoski says his client, who has been given immunity from federal
prosecution in exchange for his co-operation, is no crook. "Neal is an
extremely bright 3.7 student at the toughest school in Milwaukee, Rufus
King High School. They call it a magnet school, it's the best school in
the system for these kids who show some promise."

But, Piaskoski continues , you don't have to be extremely bright to do
what he did. Each of the computers the 414s raided, Patrick said, was a
Digital Equipment VAX similar to the one Paul Sundquist cracked at the
Milwaukee School of Engineering.

"In this case all they had to do for access was use a commonly known
default password to get into the system," Piaskoski said. "The system
operators never changed it. It would have taken 30 seconds, $2.50 in labor
time, and none of these kids in Milwaukee would have been into those
computers. I think what he did, under the circumstances, was extremely
ordinary. It's no different than putting a push-button phone in front of a
five-year-old, taking the phone off the hook, and expecting him not to
play with it."

His only motive, Patrick said, was the intellectual challenge of getting
on a closed system and then remaining on it as long as he could,
undetected.

"It was more curiosity than anything else," Patrick said. "It's like a mix
between the curiosity and the challenge. It's like knowing a foreign
language and being able to read all those signs you couldn't read before.
It's the excitement of knowing. Just that, the excitement of knowing. I'm
sure there are people out there who enjoy destroying, but why wreck the
computer when you get the best feeling just by being there?"

THE 414s never deliberately destroyed files in the computers they visited,
he insisted . He called Wondra's deletion of files at Sloan-Kettering an
accident. The group never pulled a prank more serious than creating some
accounts called "Joshua," after the password in the film "WarGames ." And
today, he says in a convincingly exhausted tone, he regrets the whole
thing.

"Right now, it's a mess, to say the least. What I'd really like is just to
get this thing over with. The chance of prosecution does give me a feeling
of wariness."

Beyond the initial excitement of getting into a computer, hacking is
basically a dull hobby, he said. Dialing into the computers was a matter
of trial and eror, Piaskoski said, and "in many cases, they never even
found out what computer they were in. In some cases, by looking around and
seeing where they were, they could tell, 'I'm in a bank system, I'm in a
cement company.' " When Wondra stumbled onto the Sloan-Kettering computer,
he thought he was in the computer of a medical supplies distributor.

The computers they penetrated were just storehouses of dull information,
Patrick said.

"When we were in there, all we did was play a couple games, and that was
it. We'd just look around." He paused for a moment, then offered a warning
. "I'd say the only thing you could really do in there, once you got in,
for the general person, would be destroy. That's about all a person could
do. It's unfortunate that probably the most excitement of breaking into a
computer for a lot of people is to destroy it. Which especially points out
why the security should be beefed up."

Patrick says he's given up hacking for good, and advises other young
computer enthusiasts to follow his example. "Getting caught is not worth
the excitement of being there. Being there is not worth the headaches."

Any time a computer is hooked up to telephone lines to communicate with
the outside world, there's a possibility that someone can break into the
computer by using another one. People familiar with the hacking scene in
Detroit say it doesn't happen often, but the know-how is there.

John Maxfield, who has extensive contacts with computer enthusiasts as
treasurer of the South East Michigan Computer Organization, says there are
perhaps half a dozen hard-core hackers in southeast Michigan "with a
following of 10 to 20 times as many." Several Detroit-area computer
bulletin boards he has seen list the dial-in procedures and passwords to
log on to local school computers and change grades, Maxfield says. "Ninety
percent of the messages I see are just B.S. But 10 percent are serious
business," he said.

Recently, Ann Arbor police captured an electronic Peeping Tom who, for
about a year, had wandered among the files on one University of Michigan
computer system, out of curiosity. "We decided to prosecute because we
take this very seriously ," said Aaron Finerman, the director of the
university's computing center. University policy says a student can be
expelled or a staff member fired for unauthorized browsing. The culprit, a
former student , pleaded guilty to a misdemeanor.

OCCASIONALLY, HACKING is maliciously destructive. Two years ago a hacker
deliberately crashed the bulletin board system of CompuServe, a Columbus,
Ohio, computer data- transmission service that counts a quarter of the
Fortune 500 companies among its customers. "It was the equivalent of
throwing a monkey wrench in the works," said Richard Baker, CompuServe's
editorial director. "Our customers called up by the hundreds." The culprit
was reprimanded but not prosecuted, Baker said.

In fact, prosecutions are rare, for several reasons. Companies hush up
computer trespassing because the incidents are embarrassing and because
they fear admitting their system's vulnerability will encourage copycats
to hack in, said Jack Bologna, president of Computer Protection Systems in
Plymouth, Mich.

"Most police don't feel comfortable with this type of investigation,
either," he continued. "The evidence trail is different. It isn't a pile
of documents, it's blips on a video screen." Unless the incident involves
clear-cut fraud, vandalism or theft, prosecutors also tend to shy away, he
said. Authorities had trouble dealing with the high school student who
used his home computer to enter the names of his teachers into
Philadelphia's list of "most wanted" criminals, because the prank was
difficult to categorize.

Others are looking for free entertainment. "The typical hacker is
searching for games. A lot of companies with more computer capacity than
they need keep games in the memory for the employes and their families to
play. You can't access them until after business hours, but then you're
free to play as much as you like. It's a neat little perk" that hackers
want in on, Archibald said.

For many young hackers, using a computer has such a strong aspect of
game-playing that it's difficult for them to realize the dangerous
real-world implications of their actions. Once inside an unfamiliar
computer system, they may do lots of inadvertent damage searching for
games, he continued. "They're like a raccoon in the kitchen in an old Walt
Disney film, knocking over all the jars and canisters."

AS COMPUTERS proliferate throughout American society, such incidents may
become commonplace. "There's a whole new morality growing up around the
computer," Archibald said. "Pulling one of these stunts isn't like going
into a biker's bar and pouring beer on someone's head. It doesn't take any
courage, just some brains. All this damage is being caused by 118-pound
computer nerds."

The exploits of the 414s have made these concerns a matter of national
debate. Bologna likens the spread of inexpensive computers through society
to a flood of Saturday night specials. Dennis Hill says federal regulation
of computers, though difficult to enforce, might be worth looking into.

The government will be looking into the possibility next month. In
October, the Oversight Committee for the Senate Committee on Governmental
Affairs will hold hearings on the need for computer security in the public
and private sectors. Neal Patrick may testify.

But Joseph Weizenbaum, a professor of computer studies at Massachusetts
Institute of Technology, thinks it already may be too late for
governmental regulation to prevent serious disruptions of the nation's
electronic nervous system. Weizenbaum believes that "in the next 10 years,
we're going to suffer some information catastrophe similar to what
happened in the nuclear area with Three Mile Island. It may well be a
consequence of people entering in an unauthorized and perhaps unskilled
fashion a system and not knowing the rules, and so inadvertently
triggering something pretty awful."

**** 
 

Illustration: Drawing DOMINIC TRUPIANO; Photo New York Times