Kevin Mitnick, who became the quintessential American computer hacker in the mid-1990s when the internet became widely available — obsessed but clever, shy but mischievous, indeterminately threatening — and later leveraged his skills to become the “chief hacker officer” of a cybersecurity firm, died Sunday in Pittsburgh. He is 59 years old.
Kathy Wattman, a spokesperson for the cybersecurity firm he partly owns, know Be4said the cause was pancreatic cancer.
Described by The New York Times in 1995 as “the nation’s most wanted computer criminal,” Mitnick had been on the run for more than two years.
He is wanted for illegally obtaining some 20,000 credit card numbers, some of which belonged to Silicon Valley tycoons; causing millions of dollars in damage to company computer operations; and stealing software used to maintain the privacy of wireless calls and process billing information.
Eventually, he was arrested and jailed for five years. But there is no evidence that Mitnick used the documents he stole for financial gain. He later defended his activity as a high-stakes but ultimately harmless form of gaming.
“Anyone who likes to play chess knows that just beating your opponent is enough,” he wrote in his 2011 memoir, “The Ghost on the Wire.” “You don’t have to plunder his kingdom or seize his assets to be valuable.”
When Mr. Mitnick was arrested in February 1995, the computer age was just getting started. Windows 95 has not yet been released. The Mitnick affair has sparked a disturbing international conversation not just about hacking but about the internet itself.
“The Internet is now seriously overexposed as a media celebrity,” complained Frank Rich, a Times columnist in March 1995, blaming the hoopla surrounding Mr Mitnick.
Mitnick’s most notable crime was his attempt to evade capture by authorities. In 1993, he took control of the California telephone system, which allowed him to wiretap FBI agents hunting him and confuse their efforts to track him. At one point, they raided what they believed to be Mr Mitnick’s home, only to find a Middle Eastern immigrant watching television.
On another occasion, Mr. Mitnick used radio scanners and software to spot FBI agents closing in on him. He fled his apartment, and when authorities arrived, they found a box of donuts waiting for them.
On Christmas 1994, Mitnick ran into trouble when he stole the emails of a fellow hacker named Tsutomu Shimomura and mocked him. When he learned of the attack, Shimomura put his ongoing cross-country ski trip on hold and volunteered to help find Mitnick.
What The Times called a “cyber duel” ensued. Mitnick is an unscrupulous academic who praises his opponent’s technical skills, while Shimomura is a conscientious freelancer who accuses Mitnick of violating the norms of online communities.
“This behavior is unacceptable,” he told The Times.
Using software he designed to reconstruct a user’s computer session, as well as a mobile-phone scanning device, Mr. Shimomura set out to find Mr. Mitnick’s location.
Mitnick was eventually caught by the FBI and charged with illegal use of a telephone access device and computer fraud. “He allegedly obtained corporate trade secrets worth millions of dollars,” San Francisco Assistant U.S. Attorney Kent Walker said at the time. “He’s a very big threat.”
In 1998, while Mitnick was awaiting sentencing, a group of supporters took over the New York Times website for hours, forcing it to shut down. New York Times technology reporter John Markoff, also involved in the dispute, reported shortly after his arrest that Mitnick had obtained Mr. Markoff’s emails in retaliation for Mr. Markoff’s coverage of his activities.
Mr. Mitnick entered into plea deals in 1996 and 1999 that included pleading guilty to computer and wire fraud. He was released from prison in 2000 on the condition that he not use a computer or cell phone for three years without permission from a probation officer.
After he was released from prison, Mitnick read a statement of self-defense. “My crime was simple trespass,” he said. “My case is a case of curiosity.”
Kevin David Mitnick was born on August 6, 1963, and grew up in the Van Nuys area of Los Angeles. His parents, Alan Mitnick and Shelly Jaffee, divorced when he was 3 years old, and he was raised by his mother, a waitress.
Mr. Mitnick was a burly, lonely boy who at age 12 learned how to ride the buses freely using a $15 punch card and blank tickets he found in dumpsters. In high school, he developed a fascination with the inner workings of telephone company switches and circuits. His level of mischief was high, and he managed to program the home phones of people he didn’t like so that every time a call was answered, there would be a recording asking for a 25-cent deposit.
He showed a flagrant willingness to break the law, breaking into Pacific Bell offices as a teenager and stealing technical manuals.
In the late 1980s, he was twice convicted of hacking into company computer systems, leading to prison terms and counseling for his computer addiction.
However, Mitnick often took surprisingly old-fashioned ways of stealing high-tech gadgets. He often posed as an authority figure by phone and e-mail, convincing lower-level company officials to hand over passwords that would have given him access to confidential information.
Mr Mitnick’s first marriage in his early twenties quickly ended in divorce. He met Kimberly Barry at a cybersecurity conference in Singapore in 2015, and the two soon began dating. They married last year after he learned he had cancer. She survived his death and was pregnant with his first child.
The year Mitnick was released, The Times reported an “unusual arrangement” in which he was hired as a cybersecurity consultant by a California university he had “victimized.” Mr Mitnick calls it a “hack for hire”.
It is now commonplace for hackers to find work by exposing loopholes in governments and corporations. KnowBe4, a company partly owned by Mr. Mitnick, describe Claims to be “the world’s largest provider of security awareness training”. The cybersecurity training courses designed by Mr. Mitnick have been used by more than 60,000 organizations, the company said.
In 2017, journalist and author Amy Webb, who wrote about data privacy in The New York Times Book Review, identified the once-hunted hacker by a nickname that would have confused law enforcement officers and newspaper readers in the 1990s: “Internet security expert Kevin Mitnick.”
Livia Albeck-Ripka and mayor of orlando contributed to the report.