Tactics of a High-Tech Detective

Copyright © 1995
The New York Times Company

DISCOVERING A BREAK-IN: Hundreds of programs and documents are pilfered from the home computer of Tsutomu Shimomura, a computational physicist whose work protects the security of computers and cellular phones. Threatening messages in a computer-altered voice are left at Mr. Shimomura's office.

FINDING THE GOODS: Computer files belonging to Mr. Shimomura are discovered flooding a directory on the Well, a commercial on-line service. Mr. Shimomura, a renowned cybersleuth, is called in to help resolve the breach in security.

PICKING UP THE TRAIL: Using invisible network connections and three laptops, Mr. Shimomura and others monitor the Well service form Sausalito, Calif., siphoning off packets of computer data that look suspicious. Software written by Mr. Shimomura silently captures the intruder's every keystroke and command. Eventually, Mr. Shimomura concludes that the intruder is probably Kevin D. Mitnick, a computer outlaw who has eluded the authorities since late 1992.

GETTING CLOSER: The security team learns that among the intruder's coups is the acquisition of the credit-card number of 20,000 members of Netcom, a nationwide provider of Internet access. The team moves to Netcom's operation center in San Jose, where it continues to monitor network activity. In an effort to hide his whereabouts, the team learns, the intruder has been connecting to Netcom from several of its dial-in phone lines, including those in Denver, Minneapolis and Raleigh, N.C.

TRACING THE PHONE CALLS: With subpoenas from the United States Assistant Attorney General in San Francisco, the team traces the intruder's calls to Netcom, discovering threat someone has tampered with a phone-company switching center in Raleigh. Computer vandals often use this technique to hide their locations by rerouting their telephone calls.

ZEROING IN: Mr. Shimomura flies on Sunday to North Carolina, where he meets technical experts from the Sprint cellular telephone company. While a technician drives around suburban Raleigh, Mr. Shimomura rides along, holding a directional antenna whose signal strength is displayed on a laptop computer screen. By early Monday morning, the search is narrowed to a small apartment complex.

ARRESTING THE SUSPECT: Agents from the Federal Bureau of Investigation surround Mr. Mitnick's building and arrest him at 2 A.M. Wednesday. Mr. Mitnick, who is wanted in California for a Federal parole violation, is charged with two Federal crimes - computer fraud and the illegal use of a telephone access device. At a pre-arraignment hearing in Raleigh, Mr. Mitnick turns to Mr. Shimomura and says: "Hello, Tsutomu. I respect your skills."