11 0100 000 111 010 0 011 0010 000 010 11 10 1101 01 01 1 000 1 1111 01 0 011 1 010 1 1000 000 010 01 00 01 01 011 00 1101 0010 1 010 1 10 0 001101 110010 001101 110010 001101 100 0000 1 10 101 0 111 0 10 010 0101 0000 11 10 001 10 1 011 00 100 1 10 0 00 0 00 1 000
It would be the first time I’d ever been completely on my own. Going to live in Denver without my mom and Gram seemed strange but also exhilarating. When my plane took off from Vegas, I would literally disappear into the ether; once in my new hometown, I’d start hiding in plain sight.
Can you imagine the freedom of starting your life over again, taking on a new name and identity? Of course, you’d miss your family and friends, the comfort of familiar places, but if you could put that part aside for a moment, wouldn’t it feel like a great adventure?
During the flight to the “Mile High City,” I felt a growing sense of anticipation. When the United Airlines plane landed, it was a bit anticlimactic: Denver was overcast and gloomy that afternoon. I got into a cab and asked the driver to take me to a hotel in a good neighborhood where I could rent a room by the week. The place he picked out was in what he referred to as “hotel row.”
I would rate the hotel at about two-and-a-half stars, or something on the order of a Motel 6. It turned out not to offer a weekly rate after all, but with a little persuasion I managed to negotiate one I could live with.
Because of the way the movies portray it, people assume that living as a fugitive means always looking over your shoulder, in constant fear of discovery. In the years that followed, I would have that experience only rarely. For the most part, once I’d established my new identity and solidified it with verifiable, government-issued ID, I felt secure. Just to be on the safe side, I always set up early-warning systems so I’d be tipped off if someone came looking for me. And if I noticed anyone getting close, I would take immediate action. But from the very start, I would be enjoying myself the vast majority of the time.
My first order of business in any new city was to compromise the local phone company so I could prevent anyone from easily tracking me. For starters, I’d need one of the dial-up phone numbers that field techs used to call into the phone company switch. I would get the number for the Central Office that handled the telephone exchanges I wanted to gain control of. I’d call and say something like, “Hi. This is Jimmy over in Engineering. How you doin’ today?”
Then I’d follow up with, “What’s the dial-up for the VDU?”—using the shorthand term for the Visual Display Unit, which gives a tech full access to the switch from a remote location. The neat part was that if the switch was a 1AESS, you didn’t even need a password to access it. Whoever made that decision must have figured that anyone who knew the phone number was authorized.
Usually the guy I got on the line would give me the phone number for dialing into the switch of his Central Office. But if a tech challenged me, I knew enough about the system to make up a plausible excuse on the fly. It might be something like, “We’re setting up a new dial-out system here and programming all the dial-up numbers into our outgoing dialer software. So if any switch engineers have to dial in, they can just instruct the modem to dial a particular office.”
Once I had the phone number for dialing into the switch, I could do pretty much anything I liked. If I wanted to have a series of conversations with someone in, say, Japan, I’d find an unassigned phone number, take it over, add call forwarding, and then activate it to forward any incoming calls anywhere I wanted. Then, from my cell phone, I could make a local call to the previously unassigned phone number and have a clear, direct connection from the switch straight to the guy in Japan, instead of having to deal with an unreliable international cell phone connection.
And I would also routinely use the technique called “masking”—setting up a chain of call-forwarding numbers in switches of several cities in different parts of the country. Then, calling the first number in the chain, my call would be passed along the chain from city to city, ultimately to the number I wanted—making it extremely time-consuming for anyone to trace the calls back to me.
My calls weren’t just free, they were virtually untraceable.
My first morning in Denver, I sat down with a local newspaper and began circling job ads for computer work. I was looking for any company that used my favorite operating system, VMS.
I created a separate résumé for each likely-sounding ad, tailored to the particular qualifications listed. As a rule, I’d read the qualifications they were looking for and tailor a résumé that showed I had around 90 percent of the skills on the company’s wish list. If I claimed every sought-after skill, I figured the HR people or the head of IT might wonder, If he’s that good, why is he applying for such a low-level job?
My résumé would list only a single previous job so I wouldn’t have to create more than one past-job reference. The trick here was to keep copies of all the material I sent out so I’d know what I had written when someone called me in for an interview. Along with the résumé, I’d include a well-polished cover letter to introduce myself.
My skill at writing these phony résumés and letters paid off within a couple of weeks. I was invited for an interview at, of all places, the local office of a prominent international law firm, Holme, Roberts and Owen, which had offices in Denver, Salt Lake City, Boulder, London, and Moscow.
Dressed in a suit and tie and looking, I thought, perfectly suitable for a job in an upscale law firm, I was shown into a conference room to meet with the IT manager, a very friendly lady named Lori Sherry.
I’m good at interviews, but this one was a little more exciting than most as I struggled not to be distracted: Lori was really attractive. But—bummer—she was wearing a wedding band.
She started off with what must be a standard opening: “Tell me a little about yourself.”
I tried for charming and charismatic, the style that the remake of Ocean’s Eleven would capture a few years later. “I broke up with my girlfriend and wanted to get away. The company I was working for offered me more money to stay, but I knew it would be better to start fresh in a different city.”
“Why Denver?”
“Oh, I’ve always loved the Rocky Mountains.”
So, a plausible reason for leaving my last job. Check that one off the list.
For half an hour we went through all the standard things about my short- and long-term goals and other typical interview topics. She took me on a tour of the computer room, and then I was given a four- or five-page written test on my system administrator skills, mostly on the Unix and VMS operating systems. I gave a couple of wrong answers, again so I wouldn’t look overqualified.
I thought the interview had gone well. For job references, I had set up a phony company in Las Vegas, Green Valley Systems, and then rented a mailbox and signed up with an answering service that used live operators, who had instructions to tell callers, “No one is available to take your call right now,” and then ask them to leave a message. After the interview, I started calling the service every hour. The next day, there was a message for me: Lori wanted to speak with Green Valley’s IT director. Excellent!
I had already scouted a hotel with a large lobby that offered acoustics like an office area, and checked that there was a pay phone out of the stream of traffic. (I couldn’t chance calling her on my cloned cell phone because the call would show up on the real cell customer’s bill.) Lowering my voice an octave or so and adopting a bit of a pompous tone, I provided Eric Weiss with a very favorable recommendation.
I got a job offer a few days later at a salary of $28,000—nothing to brag about, but enough to meet my needs.
I was supposed to start work two weeks later. Great: that would give me time to find an apartment, fill it with a load of rental furniture, and then dive into an important project that had been on my mind. My Eric Weiss identity was safe and verifiable. Still, there was already a real Eric Weiss walking around in Portland with the same Social Security number, birth date, and alma mater. That was okay for the time being, since the other Eric lived far enough away that our paths weren’t likely to cross. But I wanted an identity I could safely use for the rest of my life.
Nineteen states, including California and South Dakota, at the time had “open” death records—meaning the documents were a matter of public record, available to anyone. Those states hadn’t yet caught on to how easy they were making things for someone like me. There were other states that would have been more convenient for me to get to, but South Dakota seemed so remote that I figured there was much less chance some other guy in my situation might search its records and come up with one or more of the identities I had found.
Before setting out, a bit of preparation. My first stop was King Soopers supermarket, where there was a machine on which you could enter your own text and instantly print out twenty business cards for five bucks. My new cards read:
ERIC WEISS
Private Investigator
Below those lines were a fake Nevada PI license number, a phony Vegas address, and an office number that went to another live answering service, in case someone decided to check up on me. The monthly thirty-dollar fee was a cheap way to create believability. Which I was going to need.
With the cards in my wallet, I threw a couple of suits and some other clothes and my toilet kit into a bag, boarded a plane for Sioux Falls, and, once there, rented a car to drive to the capital city of Pierre (or “Peer,” as they pronounce it there). The four-hour drive was mostly on autopilot due west into the late-afternoon sun, along flat Interstate 90, with small towns I’d never heard of scattered along the way. Much too rural for this city boy: I was glad I was just passing through.
Here comes the “ballsy” part. The next morning, dressed in the suit I had worn for my law-firm interview, I found my way to the offices of the State Registrar for Vital Statistics, where I asked to speak with someone in charge. Within minutes the Registrar herself walked up to the counter—something I couldn’t quite picture happening in a state like New York or Texas or Florida, where the top official would no doubt be too busy or feel too self-important to meet with anyone lacking important connections.
I introduced myself and handed her my business card, explaining that I was a private investigator from Las Vegas working on a case. My mind flashed back to one of my favorite television shows, The Rockford Files. I smiled as she looked at my card because the quality was about the same as the ones Rockford created using that business-card printer he kept in his car.
In fact, the Registrar wasn’t just willing to see me, she was happy to assist a private investigator in carrying out his research task, which I told her was a confidential investigation into deaths.
“Which person?” she asked, wanting to be helpful. “We’ll look it up for you.”
Umm. Not at all what I wanted.
“We’re looking for people who died from certain causes of death,” I ventured. “So I need to look through all the records for the years of interest.”
Though I was afraid the request sounded a bit strange, South Dakota was a be-friendly-to-your-neighbor kind of place. She didn’t have any reason to be suspicious, and I was ready to accept all the help she was willing to give.
The very friendly Registrar asked me to come around the counter, and I followed her to a separate, windowless room that held the old certificates on microfiche. I emphasized that I had a significant amount of research to do and that it might take me several days. She just smiled and said I might be interrupted if a staff member needed to use the fiche, but otherwise it shouldn’t be a problem. She had one of her assistants show me how to use the microfiche and where to find the films for particular ranges of years. I would be working in the microfiche room, unsupervised, with access to all the birth and death records going as far back as the state had been keeping them. I was looking for infants who had passed away between 1965 and 1975, at an age between one and three. Why would I want a birth year that would make me so much younger than my actual age? Because I could pass for that much younger, and if the Feds ever used age criteria when searching recently issued driver’s licenses in a state where they thought I might be living, they would—I hoped—skip right over me.
I was also looking for a white baby boy with an easily pronounced, Anglo-sounding surname. Trying to pass for Indian, Latino, or black would obviously not work unless I intended to have a good makeup artist follow me around everywhere I went.
Some states were starting to cross-reference birth and death records, probably in an effort to prevent illegal aliens and others from using a birth certificate of a deceased person. When they received a request for a birth certificate, they would first check to make certain no death certificate was on file for that person; if there was, they would stamp DECEASED, in big bold letters, on the copy of the certified birth certificate that they sent out.
So I needed to find deceased infants that met all my other criteria and had been born in a different state. In addition, being super-cautious about this, I had my eye on the future, anticipating that surrounding states might at some point start reporting deaths to each other if the deceased was born in a neighboring state. This could be a major problem—if, for example, I applied for a passport in the future under my new identity. When verifying a passport application, the Department of State checks the validity of the applicant’s birth certificate, and could uncover the fraud if a cross-referencing program were developed in the future. Because I had to avoid such risks, I would only use identities of infants who were born several states away.
I spent an entire week searching with the microfiche. When I found a potential candidate, I would hit the Copy button, and a printer would come to life and churn out a copy of the death certificate. Why did I bother getting as many as I could find? Just for backup, in case I ever found myself needing to change my identity again.
Everyone else in the office was just as warm and friendly as the Registrar. One day, a clerk came up to me and said, “I have a relative in Las Vegas I’ve lost track of. You’re a private investigator, so I wondered if maybe you could help me find him.”
She gave me as many details as she had. That night, in my hotel room, I ran a people search using an information-broker database service to find her relative’s address, and then called line assignment at the local phone company to obtain the unlisted phone number. No big deal. I felt good about helping this lady because everybody had been so kind and helpful to me. I felt I was just repaying them for the favor.
When I handed her the information the following morning, she was so ecstatic that she rewarded me with a big hug, making far more of a fuss over me than I felt I deserved for so little effort. From that moment on, her fellow clerks became even friendlier, inviting me to share their doughnuts and telling me anecdotes about their lives.
Each day as I worked, the nearby printers would be drumming away, printing out certificates that people had requested. The din was annoying. On my third day, getting up to stretch my legs after several hours of sitting, I walked by the printers to take a closer look, and I noticed a pile of boxes sitting by them. When I saw what was in the boxes, my jaw dropped: hundreds of blank birth certificates. I felt as if I had just stumbled on a pirate’s treasure chest as I watched the certificates roll out of the printer.
And yet another treasure: the device for embossing the certificates with the official state seal of South Dakota was kept outside the microfiche room, sitting on a long wooden table. Each clerk would just walk up to the table and emboss a certificate before sending it out.
The next morning the weather turned bitter, with snow flurries and freezing temperatures. Luckily I had thought to bring along a heavy jacket that I put on before going to the State Registrar. I worked through the morning, waiting for the lunch hour. When most of the staff was either out of the office or busy eating and chatting, I draped the jacket over my arm and strolled to the restroom, nonchalantly scoping out where all of the remaining employees were and how distracted or attentive they seemed to be. On my way back to the microfiche room, I walked by the table where the embosser was kept. In a single smooth gesture, without slowing down, I grabbed it, holding it so it was hidden under my jacket, and continued back to the fiche room. Once inside, I glanced out the door: no one was paying any attention.
With the embosser now resting on a table next to a stack of blank birth certificates, I began to emboss the state seal onto them, trying to work quickly but quietly. I was struggling to hold my fear in check. If anyone were to walk in and see what I was doing, I knew I would probably be arrested and carted away.
Within about five minutes, I had a stack of some fifty embossed blank certificates. I headed back to the restroom, on the way returning the embosser to the exact position it had been in before I “borrowed” it. Mission accomplished. I had gotten away with a dangerous task.
At the end of the day, I stuck the embossed certificates into my notebook and walked out the door.
By the close of the workweek, I had the information I needed for numerous identities. Later, I would only need to write the Bureau of Vital Statistics in the state where the child was born and request a certified copy of the deceased’s birth certificate. With it, I would become the new me. I also had fifty blank birth certificates, each neatly embossed with the South Dakota state seal. (Several years later, when the Feds were returning property that had been seized from me, they accidentally gave back the embossed South Dakota birth certificates as well. Alex Kasperavicius, who was picking the stuff up for me, thoughtfully pointed out that they probably didn’t really want to do that.)
The State Registrar employees were sorry to see me go: I had made such a good impression that a couple of the ladies even hugged me as I said good-bye.
That weekend I drove back to Sioux Falls and treated myself to my very first skiing lesson. It was glorious. I can still hear the instructor shouting at me, “Snowplow! Snowplow!” I enjoyed the sport so much that I soon took it up as one of my regular weekend activities. There aren’t many big cities in the United States like Denver, with ski slopes within such easy driving distance.
Not many parents get Social Security cards for their infants. But it’s suspicious for a guy in his twenties to walk into a Social Security office, ask to be issued a card, and say that he has never had one before. So I had my fingers crossed that some of the names I had dug out of the South Dakota files were for deceased tykes whose parents had obtained Social Security numbers for them. As soon as I was back in my new apartment in Denver, I called my buddy Ann at the Social Security Administration and had her check a few of the names with their associated dates of birth to see if a Social had already been issued. The third name, Brian Merrill, was a hit: baby Brian had had a Social Security number. Fantastic. I had found my permanent identity!
There was one more thing I needed to do. I had uncovered a lot of information about the FBI’s operation, yet the key to unlocking the central puzzle had eluded me: who was the guy I knew as “Eric Heinz”? What was his real name?
I’m not even vaguely in his category, but just as Sherlock Holmes’s work was about solving puzzles as much as it was about catching criminals and miscreants, my hacking, too, was always concerned in some way with unraveling mysteries and meeting challenges.
Finally I thought of an avenue I had never explored. Eric had encyclopedic knowledge about the Poulsen case. He claimed to have accompanied Kevin Poulsen on several PacBell break-ins and boasted that the two of them had found SAS together.
Hours and hours online, scouring databases like Westlaw and LexisNexis for newspaper and magazine articles that made any mention of Eric, had yielded nothing. If he had really done the things with Poulsen that he said he had, maybe I could work backward by searching for the names of Poulsen’s other known cohorts.
Eureka! In no time at all, I found an article on LexisNexis that named two Poulsen codefendants, Robert Gilligan and Mark Lottor. Maybe one of these guys was the phony Eric Heinz. I got on the phone immediately, hiding my excitement as I called the law enforcement telephone number at the California DMV and ran both codefendants’ driver’s licenses.
Dead end. One guy was too short to be Eric, the other too heavy.
I kept at it. And then one day, on Westlaw, I found an article that had just been published. A small newspaper, the Daily News of Los Angeles, had carried a story about Poulsen’s case coming up for trial. The piece gave the names of two others charged as Poulsen coconspirators, Ronald Mark Austin and Justin Tanner Petersen.
I was familiar with Austin and knew what he looked like; he definitely wasn’t Eric. But Petersen? Holding my hopes in check and ready to be disappointed again, I called the DMV and had the clerk read me Petersen’s physical description.
She said he had brown hair and brown eyes, was six feet tall, and weighed 145 pounds. I had always thought of Eric’s hair color as being blond, but otherwise the description fit him to a T.
I had finally cracked his cover. I now knew the real name of the man who called himself Eric Heinz. And he wasn’t a Fed; he was just a snitch, trying to trap me and probably as many other hackers as he could to save his own ass.
After all of that work—all of my thinking and worrying about who and what Eric was—I was smiling from ear to ear. I was elated. The FBI was so proud of its global reputation, but hadn’t been able to protect a snitch from being unmasked by one lone hacker.
With my South Dakota research and my weekend of skiing behind me, it was time for my first day of work at the law firm. I was shown to a desk in an office inside the computer room, adjacent to the desks of two other members of the department’s staff, Liz and Darren. Both made me feel welcome, which I was coming to find was typical of Denver, where the people seemed laid-back, open, and friendly. Ginger, although a coworker, had an office on the other side of the computer room; she, too, was very friendly.
I was starting to get comfortable with my new life, while at the same time never forgetting that at any moment I might be forced to run to avoid being locked up again in the tiny coffin of a cell in solitary. Still, working at a law firm came with some unexpected benefits. The firm occupied five floors near the top in the posh fifty-story skyscraper known as the Cash Register building because the top of the building was curved like a cash register. After hours, I’d log on to the Westlaw account and read law books in the law library, researching how to get out of the scrape I had gotten myself into.