IN RETROSPECT, IT seems obvious why so many of the attendees of HoHoCon came down from Boston, and why the ultimate college town would provide so much of the Cult of the Dead Cow’s new blood. Before most Americans had heard of Silicon Valley, the Route 128 band around Boston was sprouting computer and software companies stocked with graduates from local educational institutions, including Harvard and, especially, its Cambridge rival, MIT. Politicians called it the Massachusetts Miracle. Cambridge itself played host to many innovative technology companies, including two that employed members of cDc and their close collaborators. The better known was Lotus Development Corporation, begun in 1982 by engineer Mitch Kapor. Though Lotus made its first program for Apple computers, it scored a runaway hit with Lotus 1-2-3, the first electronic spreadsheet with graphics. The app worked with early versions of Microsoft operating systems running on IBM personal computers, and it gave many people the first compelling reason to buy a PC. It also earned Kapor enough money to fully fund the Electronic Frontier Foundation, the digital rights group that had saved Phrack’s editor from jail.
A few miles away, people who tended to dwell further right on the ideological spectrum were tinkering more quietly. Founded in 1948 by two MIT professors and a former student, BBN Technologies specialized in acoustical engineering before taking on more Pentagon contracts and moving into networking. It helped develop working versions of the internet’s basic communication methods, known as TCP/IP, for the Defense Department’s predecessor to the internet, as well as early versions of email and other programs that remain classified.
As in Texas, bulletin boards provided the early online gathering places in Boston. Most of those that were open to all comers barred discussion of hacking, making them less attractive to cDc members. The anything-goes exception in Boston area code 617 was the Works, founded by future bulletin board historian Jason Scott Sadofsky. Sadofsky had started the Works during high school in Chappaqua, New York, in 1988. He handed it off to a user to run two years later when he moved to Boston for college, where he would preside over the scene starting as an old man of nineteen. The Works ran cDc files, naturally. And it was a gateway to more serious hacking boards. On the Works, the adventurous could find mention of closed boards hosting discourse that was riskier, or that would have been if the proprietors had not closely vetted the participants to screen out cops, snitches, and the overly talkative. Invite-only boards where discussions could wander into legal gray areas included Black Crawling Systems, Calvary, and one called Democracy, which morphed into ATDT, after a modem command for dialing a call. This last was run by roommates who used the handles Magic Man and Darby Crash. In 1991, Boston University grad Darby left town for a job with Microsoft. Under the name J Allard, he would push Bill Gates to put internet functionality in Windows 95 and later run the company’s Xbox division.
John Lester had been on bulletin boards for years from his childhood home in Dartmouth, Massachusetts. He attended MIT and afterward went back for more online fun under the handle Count Zero, from the William Gibson novel. While working at Harvard-affiliated Massachusetts General Hospital on Alzheimer’s research, he wrote technology explainers for both 2600 and Phrack. Magic Man made John a co-sysop of ATDT when Darby Crash moved west, and John inherited the whole thing when Magic Man left for Colorado. Brian Hassick’s Black Crawling Systems was highly technical. Calvary, run by Golgo13, had a tougher crowd: Golgo13 liked to break programs. The login sequence featured a picture of Jesus on the cross and a slogan: “You bring the hammer, we’ve got the nails.”
One day in August 1991 brought everyone together, prefiguring what would become known as the L0pht, the first shared hacker space in the country and a powerful symbol of hacking’s positive potential. John and Darby lived in the same apartment building near Fenway Park, home of the Red Sox. They decided to host a barbecue on their roof to get the regulars on their various boards together, calling it the Grill-a-Thon. Everyone was instructed to bring their own food to cook. For the majority, it was the first time people had ever set eyes on each other, even if they had chatted online for years. It was then John met the mysterious Golgo13, who made quite an impression: Most of the kids were skinny, nerdy, and pale. Golgo13 was a big man who arrived riding a badass motorcycle, looking exactly like the rock-club bouncer they later discovered him to be. Then six-foot-six Luke Benfey, known as Deth Vegetable, showed up and towered over Golgo13, though he was much milder in manner. Soon-to-be cDc members Dan MacMillan and baby-faced Misha Kubecka were also there, and a fourteen-year-old kid with the attitude of a delinquent, Joe Grand, known as Kingpin.
A football game broke out, and Luke carried the ball on a play during which Golgo13 seemed determined to stand out. He launched a flying tackle at Luke as another hacker did the same from the other side, shielded from Golgo13’s view by Luke’s enormous bulk. Luke went down, and Golgo13 got up with a gash over his eyebrow that bled so profusely into his eye that he couldn’t cycle home. Instead, he walked a few blocks to Beth Israel Hospital for stitches and came back for more beer. Grand, in the meantime, had been kicking coal off the roof at people walking below, one of whom had called the cops. The elevator was out of order, so by the time Boston’s finest made it to the roof, they were out of breath and extra mad. John and the others apologized and plied them with sausages. They accepted, but warned: “If we have to come back here again, somebody is going to jail.”
Even without the blood and the cops, it would have been a memorable day. Finding out what people were really like cemented relationships that would last decades; the annual Grill-a-Thons themselves are still going as of 2018.
Soon John moved into Hassick’s building in the South End. Both of their girlfriends complained about the computers and other odd equipment spilling all over their apartments, much of it bought cheap at the MIT flea market for discarded electronics. The two women were trying to start up a business of their own, sewing decorations for hats, and there simply wasn’t enough apartment space for both projects. In 1992, John found an artist’s loft with cracked floors and character a stone’s throw away, on Waltham Street, and all four started using it for their hobbies. It was a loft, but when they referred to it in writing, John called it something tongue-in-cheek: the L0pht, with a zero instead of an O and with the “ph” from phreaking. It was leet speak, the joking “elite” language of hackers. John and Hassick then rented out desks to their friends, including Golgo13, Dan, and Grand, who was brought in as a way of keeping him from following a criminal path. Grand preferred messing with hardware gadgets to software, putting him well ahead of the chip security and maker movements to come. But he had not shed enough of his punk attitude when he met the older hackers. He was getting access to credit bureaus with stolen passwords, pulling information on doctors and dentists, and then calling banks and asking for new credit cards in those names. The turning point came in 1992, after he broke into a Michigan AT&T office, avoiding jail only because he was a juvenile. Grand’s parents let him keep hanging out at the L0pht, realizing the older guys there could help redirect him, and they did.
When the hat business failed and the women moved their stuff out of the L0pht, it made room for a few others. “Brian and I had this vision of it being kind of a clubhouse anarchic learning lab where people could bring hardware and take it apart. We could leverage each other’s expertise as well as existing hardware,” John said. “People who had a lot of potential in certain areas could meet people who could maybe mentor them and introduce them to others.” John and Hassick had just founded the first enduring hacker space in America. For the next eight years, the L0pht would be one of the great hot spots in hacker history. It would host cDc’s first website and eventually share four members with cDc in a kind of coevolution. Admirers founded similar spaces around the country. John saw it as a sort of 3-D bulletin board, a permanent bridge between the digital and physical worlds: “a communal clubhouse / think tank / meeting place / storage place for hardware / communal library” and crash pad.
John had read cDc files on the Works, and he joined Misha and Dan in a Boston delegation to HoHoCon at the end of that year, 1992. He ended up in what he dubbed the “Suite of the Elite,” the biggest and most communal hotel room at the con, which would become a standard feature of any con with a cDc contingent. There too was Kevin Wheeler, Swamp Rat himself. It was late, they were tired, and they chatted about a number of things. Then, John asked casually, “How do you get to be in cDc, anyway?” Kevin explained that since he started it, “it’s just basically if I say you’re in.” Oh, said John. “Could I be in?” Missing the point and responding theoretically, Kevin said: “Yes, you could be in.” Rolling his eyes, John kept going. “May I be in?” And Kevin waived a rule against letting in people who asked to join. “Okay, sure. You’re in the Cult of the Dead Cow.”
Despite the overlap, there were important differences between cDc and the L0pht. The former had no physical place and no rent to pay, and it included a greater variety of people. The lack of an address also made it easier for cDc to stay darker and more mysterious, and more easily associated with the criminal underground, especially when it chose to play that up. But in truth, the L0pht also attracted people with a range of attitudes toward activity that approached or crossed legal lines. There was no one whose chief goal was hacking for profit, but that still left a lot of room for varied approaches. John Lester admits to having used pilfered calling codes, as did pretty much everyone else, to dial into boards long distance as a teen. His best friend and partner in L0pht’s founding, Brian Hassick, said he also bought things with stolen credit cards. And Golgo13 said ATDT, which moved into the L0pht with John, was “an actual den of hackers,” including some who discussed “carding,” as dealing with stolen credit cards was called. On the closed boards, people would share “dial-outs,” codes to punch in from inside a local business’s phone network to make free long-distance calls. “I am not [in] the noble pursuit of making something better, hacking as a way to learn more,” Golgo13 said. “I hack things because I like to screw with stuff.”
Like the much younger Joe Grand, Hassick was trying to move on from a dark history under the handle Brian Oblivion, taken from the movie Videodrome. The son of a Pennsylvania steelworker and a go-go dancer, Hassick had tapped into a neighbor’s phone line so he could “war-dial” numbers from automated modems on two phone lines simultaneously, to see who or what would accept the connection. Hassick got into heating and other systems and once turned off the lights at a mall. He left home at fifteen but stayed in his high school through graduation, when he hopped trains to Seattle for a change of scene. He came back east in 1989. Despite having decent technical skills, he took a job working the overnight shift at a convenience store in Charlestown, the tough Irish neighborhood in Boston shown in movies like The Departed. His store was robbed on his shift twelve times. Hassick was familiar enough with the rules of the street. He gave none of the robbers any trouble.
Hassick and others who would power the L0pht and cDc were born in the period 1969–1971. That made them the perfect age to take advantage of a magic window between when War Games came out, in 1983, and when the Computer Fraud and Abuse Act made unauthorized computer access a criminal act, in 1986. On average, kids born in those years were also more likely to have young parents with a critical view of the US government. Dan MacMillan, the first Bostonian in cDc, was born in 1969, and he epitomized both factors. His father, from blue-collar Cambridge neighbor Somerville, had plenty of friends in the Irish Winter Hill Gang. To avoid a similar fate, MacMillan’s father enlisted in the navy, learning Morse code and cryptography as an entry-level intelligence officer. That led to a CIA analysis job. He saw too much bureaucratic politics inside the agency, grew disillusioned, and quit, preferring to work for himself as a mechanic than to be part of a giant amoral machine.
Dan grew up an independent thinker in Brockton, the same working-class Boston suburb that would produce Napster founder Shawn Fanning. His father didn’t mind spending money for his kid’s computers. Dan had something of an offline life, running track and playing volleyball, but he spent time on bulletin boards and learned enough to get paid for setting up databases for local businesses as a high school sophomore. He quit school to earn an equivalency certificate, and technical courses at a college in Vermont didn’t hold his attention either. Dan’s questionable digital activities before leaving high school included shutting off the school’s heat in the dead of winter on a day he didn’t want to go to class. He also obtained some computer equipment he couldn’t pay for and used red boxes for free phone calls from phone booths. Later, with soft-spoken California transplant Misha Kubecka and others from ATDT, Dan breached various institutions to learn what he could.
With still-developing laws, poor corporate defenses, and few role models beyond Chris Tucker (Nightstalker) and others with antiestablishment Yippie leanings, people drew their own moral lines. Dan said he wouldn’t read others’ email. And, like Hassick, he cared about privacy as a broad social issue, enough so that he and Misha wrote a 1992 text file for Phrack pointing out all the poor controls at a big data broker of the day, Information America. But in addition to faulting the poor security, the article gave strong hints for hackers who might want to research individuals. Among other things, it noted that “initial passwords, which are assigned when an account is first created, are usually composed of the account holder’s first name, or first name plus a middle or last initial.” Later, Dan would regret being so explicit. Even after the file’s publication, he continued to have easy access to the data broker. Once, he used its address database to help his uncle deliver a large number of toilets to someone who had wronged him. Another time, Dan looked up personal information on an actress he thought he might be able to date, but he said he never used the data.
These old-school, semi-public-spirited hackers didn’t like stalkers, professional criminals, or informers like Agent Steal, who had gone to SummerCon and secretly taped cDc members, but failed to catch them confessing to crimes. Steal did turn in Kevin Mitnick, future Wired journalist Kevin Poulsen, and others. All of that “cheapened the scene,” Dan said. “The conceptual stuff in security is more interesting than helping bust people.” He had gotten to know Kevin Wheeler on Demon Roach Underground and again on hacked conference calls. Alliance Teleconferencing was a favorite target. With a hacked account, Dan and others would avoid calling fees by setting up conference lines that were free to call in to for days or weeks. Sometimes only friends and allies were invited. At other times, for fun, the organizers would keep it interesting by conferencing in talk-radio personalities, crazy people, and phone-sex girls.
After Kevin inducted Dan into cDc in 1990, Dan sponsored fellow Bostonian Misha Kubecka, known as Omega. Misha wrote well and took up editing duties on cDc text files, helping set the overall tone. Like others, Misha had followed the credo laid out by early hacker the Mentor, who urged exploration and not destruction. Later, upset by how much personal data was collected by Information America, Misha got very serious about individual privacy while still believing that technical information should be shared: “You could get anything on anyone. It was a shock to White Knight and me and others, and from that moment on, privacy was extremely important for me.”
The last full addition to the L0pht’s first location was Chris Wysopal, who had picked a spot on a Massachusetts map without looking to get a handle that no one else would have: Weld Pond. All the desks were spoken for by then, at $200-per-month rent. So he split a spot with Joe Grand, each paying $100. Chris had grown up more conventionally than the others, and he came across as less rebellious. The son of a General Electric engineer, Wysopal attended a Catholic high school on the North Shore outside Boston, then went to Rensselaer Polytechnic Institute in Troy, New York, which ranked in quality behind only MIT and CalTech in many computer degrees. At RPI he hosted a hacking bulletin board that attracted some from the Legion of Doom, but he didn’t get in much trouble himself. Returning to the Boston area in 1987, Wysopal got a coveted job at Mitch Kapor’s Lotus Development and stayed focused on that. But a few years later, he started hunting for bulletin boards again, landing at the Works and Hassick’s hard-core hacking bulletin board Black Crawling Systems. A few months later, Hassick invited Wysopal to the L0pht as well.
Now including John, Hassick, Golgo13, Dan, Grand, and Wysopal, the L0pht crew would go “trashing,” diving in dumpsters outside phone company central offices or corporate buildings. They were not looking for the carbons of credit card slips, known as “black gold.” They wanted usable equipment, and manuals, and perhaps an internal phone directory—anything that would list what machines and software were running inside and hint at how to get connected and operate once in. But they kept shopping at the MIT flea market too. As much as possible, they wanted their hacking to be on the right side of the law, tinkering with what they owned themselves. “That was the genius of the L0pht that took a while for people to understand,” Wysopal said. “We could learn on our own computers and not have to steal anything.” Staying clean was especially important as the group grew more public with its research, which was generally alarming, since the state of security was appalling. Once, when the group had discovered a vulnerability in Microsoft software, a visiting reporter was confused. “You mean you can break into Microsoft with this?” Well, yes, Wysopal told her. “But you can break into any computer in the world with it.”
The annual Grill-a-Thons continued and spread to the West Coast. But there were other events that sprang up more often. Sadofsky’s the Works began holding small monthly meet-ups in Harvard Square in January 1991 at the urging of Misha. Those soon expanded under John Lester into the area’s 2600 meetings. The gatherings started in Café Aventura, on the second floor of an indoor shopping center called the Garage. When the weather was nice, they often moved to the outdoor tables at Au Bon Pain, across the street from Harvard Yard. Later, when too many people came, the first-Friday meetings moved to the Prudential Center in downtown Boston. It was an unstructured show-and-tell and social hour, with people moving from table to table. After the meetings, smaller groups would head into the Square or to MIT, where they could monkey around with pay phones, explore the tunnels, or abuse the internet terminals in the lab. MIT was home to open-source fanatic Richard Stallman, who didn’t believe in passwords, and the same ethos contributed to what would otherwise have to be seen as very poor security practices. Among them was the lightly guarded secret that any lab terminals would grant internet access to the username “root” and the password “mrroot,” later upgraded to “drroot.” Often enough, old-timers would finish the night at Sadofsky’s apartment. It was on one of those occasions that Misha and Dan MacMillan realized that they had known each other for two years online.
Many in the Works and 2600 crowds were teenagers. One, Limor Fried, began coming as early as age twelve. Known as Lady Ada, she would go on to be a pioneer of the maker movement and the first female engineer to be featured on the cover of Wired, helping educate and inspire with Adafruit Industries. For those handling information as sensitive as unpublished software flaws, twelve or thirteen was too young to trust. So the more experienced hackers would wait until the 2600 meeting wound down and then head off to a nearby bar for what they called 2621—the meeting of the subset old enough to be served alcohol. Only then would they bring out the printouts of the holes they had found and pass them around. The one deemed best earned its maker free drinks. “You didn’t tell anyone. It was like Fight Club,” said participant Jordan Ritter, who belonged to a hacking group called w00w00 and designed the server architecture at Napster for fellow w00w00 member Shawn Fanning.
Even without admittance to Sadofsky’s place or 2621, the monthly meet-ups were a great place to find out about other boards, plan road trips to cons, and hunt for roommates. One of the most noticeable underage regulars was the enormous and exuberant Deth Vegetable, who would become a cDc leader. Born in 1973 and raised in a succession of New England towns, Luke Benfey had managed to talk himself into a slot as co-sysop of the Works, and he seemed to be curious about practically everything. It was a continuation of the liberation he had first felt online. He had been playing with computers from age seven, something made possible by his father’s job at big VAX manufacturer Digital Equipment Corporation. Despite the establishment job and a previous Air Force stint, Luke’s father was an old leftist and self-described beatnik, a Holocaust survivor who had come to America as a teenager. He was therefore preconditioned to be flexible about his son’s confrontations with authority, which began not long after a cousin showed him Phrack. In 1987, Luke’s parents got a $600 phone bill and there was an unpleasant conversation. Like virtually all of his future friends, Luke found other and less legal means to connect. The magic of the early internet meant that other people had grappled with the same issue, figured out what to do, and written text-file tutorials. Luke consumed those, other takes on technology, and anything edgy or funny. By fifteen, he was copying what he thought might be interesting to his own fledgling board, including a grab bag of anarchist files with pipe-bomb instructions.
Luke became a fan of cDc after reading its files on the Works. cDc people had skills but didn’t take themselves seriously: they were an enormous inside joke for hackers. Any industry has its own leading figures, language, and perhaps even running gags. But hackers were especially misunderstood by outsiders, so many bonded by complaining about the misconceptions, incomprehension, and stupidity. cDc managed to make fun of both more self-aggrandizing hackers and the clueless public, making it seem effortless. That was cool.
Luke did a bit of hacking on his own, including trolling around with a bug in the email program Sendmail. In early 1991, he grabbed some file directories from a US military base in Subic Bay in the Philippines, just to see what it was foolish enough to leave accessible. He saw what looked like notes from a Defense Intelligence Agency briefing that described a coming invasion to retake Kuwait from the Iraqis, including names of units that would be involved. After the airstrikes began, Luke realized that he had been looking at the real thing, not just one of many scenarios. Even though he opposed the war, he realized that distributing the plans might mean espionage charges.
With Misha and others vouching for him, cDc took Luke in the next year, and he made his pilgrimage to HoHoCon in 1993, the first time he could afford the trip. “White Knight and Misha and Golgo13 had gone to SummerCon and previous HoHoCons and come back with these amazing stories,” Luke said. “It was dark and mysterious,” a conference for people who probably shouldn’t have conferences. When he got there, Luke tried not to come off too awestruck when hanging out with Jesse and Kevin, who sported reddish blond hair to his midchest, controlled by a cDc-branded baseball cap. “I was part of cDc, but they had been doing it for years, and they were guys I looked up to.”
The living situation in Boston was fluid. In 1993, Luke moved to a place dubbed Messiah Village, sharing space with a group of hackers and goths and oddballs, including future cDc member Sam Anthony, known online as Tweety Fish. Sam got some social conscience from his mother, Amy, an expert in preserving affordable apartments who served as the top state housing executive under Governor Mike Dukakis. Sam was even younger than Luke; born in 1975, he didn’t get a modem until 1989. But he was a fast learner, making it to the Works meet-ups by the following year.
One day at Messiah Village, a crew from the NBC News show Dateline appeared. In 1988, at fifteen, Luke had written a text file that combined a pipe-bomb formula with doggerel about slimming down by losing limbs, producing a piece like Swamp Rat’s gerbil feed file. A board operator in Connecticut copied it. The police had their eyes on that man, and after a fourteen-year-old downloaded it, they busted the operator. News of that bust sparked interest in Luke’s file. Kids searched for it, including three teenagers in Montreal who injured themselves in two pipe-bomb incidents. One lost parts of two fingers. A spate of such occurrences got major press as bulletin boards grew in popularity and parents realized their children were getting access to anarchy files and pornography.
Quite sensibly, most involved with sketchy boards whom Dateline contacted declined to talk. But Luke thought that the issues should have broader debate and that it would be fun to be on television. When the episode aired in September 1994, Luke said he was devastated that kids had hurt themselves, explained that the file was a joke, and argued reasonably against government censorship. Dateline explained that Luke’s handle was Deth Vegetable. The exposure and resulting hand-wringing by outraged politicians, of course, did nothing but tell more teenagers where to look for sketchy material.
A second hacker haven on Mission Hill was nicknamed Hell: it housed future cDc electronics whiz Charlie Rhodes, known as Chuk E, and long-haired San Franciscan Dylan Shea, called FreqOut, who would also join cDc. Dylan had moved up from his second hometown in Madison, Connecticut, and felt lucky to have fallen in with the 2600 crowd. Someone he met at one of the get-togethers taught him how to make a red box for calling anywhere from a pay phone. He and Charlie were enrolled at nearby Wentworth Institute of Technology and had access to a lab where they made circuit boards to mass-produce the devices, selling them to other students for $30 or $50, just enough to afford more gear. They would have felt uncomfortable going for bigger profits, and they took pains to avoid selling to drug dealers, a natural market but an unpleasant one. Poetically enough, Hell caught fire after a suspected arson attack on a nearby triple-decker.
In 1995, the two living groups combined in Allston at a place dubbed New Hack City. It housed Luke, Dylan, Charlie, and Window Snyder, known online as Rosie the Riveter. The Choate-educated daughter of two software engineers, one an immigrant from Kenya, Snyder was analytical, intense, and sardonic, but kind. She was also a fairly rare sight in American hacking circles back then as a black woman. Snyder would go on to play major security roles at both Microsoft and Apple. “That place [New Hack City] was knee-deep in Taco Bell wrappers,” Snyder said. “It was the most disgusting place I ever lived, but also the most fun I ever had.”
The Nielsen television ratings company picked the house for one of its devices, and the group fittingly decided to use its outsize influence for good. The only TV set that the Nielsen people thought was there stayed tuned to the public station constantly, except when a visiting hacker wanted to give another favorite show a boost. Snyder didn’t stay for long, because a boastful hacker named u4ea breached a Pittsfield internet service provider and threatened to do much more. In the ensuing local media frenzy, the Boston Herald identified New Hack City as one of five major Boston hacking groups, adding that its members had been interviewed by police. A resident close to Snyder had been arrested as a teenager and wanted no more of the wrong kind of attention, so they both took off.
The internet, and Microsoft, were about to be everywhere. Netscape, the first browser, made what there was of the web easy to surf. But the mass inflection point came in August 1995, when television talk show host Jay Leno joined Microsoft’s Bill Gates to launch Windows 95 in a media spectacle that would become commonplace for consumer technology releases. The TV commercials were everywhere, playing the last great song by the Rolling Stones, “Start Me Up.” The newspapers and magazines were full of giddy explanations. Everyone’s grandmother now knew about getting online with a computer. Unfortunately, no one was saying she needed to be careful doing so.
As the Cult of the Dead Cow’s technological sophistication had ramped up, its social sophistication now had to ratchet up as well. Not everyone in the Boston scene had serious white-collar tech jobs, but more began to get them as the broad public internet arrived and launched an unprecedented technology boom. Yet many of them had dabbled in crime, and pretty much all of them were friendly with people who had been or were still regularly on the wrong side of the law. To be accepted and admitted by both the hacker world and the straight world was like walking a tightrope over a minefield.
Your hacker buddies wanted you to bring home source code, the programmer’s work product, for a “security audit,” just to be sure you hadn’t botched it or sold out. Your current or future employer wanted you to have experience, but it couldn’t be seen to know too much about how you got that experience. And nobody of any background liked a rat, except the FBI, which was the only element able to put you in jail if you didn’t say what you knew about your friends.
In the 1990s, there was one person who proved able to completely master the worlds of semicriminal hackers, straight security, and the government to boot. The best known of his names is Mudge.