Kevin Mitnick, who at the dawn of widespread Internet use in the mid-1990s became the nation’s archetypal computer hacker—obsessive but smart, shy but mischievous, and menacing to an uncertain degree—and who later used his skills to become “chief hacking officer” . of a cybersecurity firm, died Sunday in Pittsburgh. He was 59.
Kathy Wattman, a spokeswoman for the cybersecurity company he co-owns, KnowBe4, said the cause was pancreatic cancer.
Described by The New York Times in 1995 as “the most wanted computer outlaw in the country,” Mr. Mitnick was a fugitive for more than two years.
He was wanted for illegally accessing about 20,000 credit card numbers, including some belonging to Silicon Valley moguls; causing millions of dollars in damage to the Company’s computer business; and stealing software used for maintaining the privacy of wireless calls and processing billing information.
He was eventually caught and spent five years in prison. Yet no evidence emerged that Mr. Mitnick used the files he stole for financial gain. He would later defend his activities as a high-stakes but ultimately harmless form of play.
“Anyone who loves chess knows that it is enough to beat your opponent,” he wrote in a 2011 memoir, “Ghost in the Wires.” “You don’t have to plunder his kingdom or seize his possessions to make it worth your while.”
At the time of Mr. Mitnick’s arrest in February 1995, the computer age was still young; Windows 95 had not yet been released. The Mitnick affair sparked a twitchy international conversation, not just about hacking, but about the internet itself.
“As a media celebrity, the Internet is now seriously overexposed,” Times columnist Frank Rich complained in March 1995, blaming the hoopla surrounding Mr. Mitnick.
Mr. Mitnick’s most spectacular crimes were his attempts to evade arrest by the authorities. In 1993, he was given control of California phone systems, allowing him to eavesdrop on FBI agents chasing him and confuse their efforts to track him down. At one point, they raided what they thought was Mr. Mitnick’s house, only to find a Middle Eastern immigrant there.
On another occasion, Mr. Mitnick, using a radio scanner and software, detected FBI agents approaching him. He fled his apartment and when authorities arrived they found a box of donuts waiting for them.
Mr. Mitnick got into trouble on Christmas Day 1994 when he stole emails from a fellow hacker named Tsutomu Shimomura and taunted him. Upon learning of the attack, Mr. Shimomura suspended a cross-country trip and volunteered to track down Mr. Mitnick.
What The Times called a “duel on the net” ensued. Mr. Mitnick was the amoral savant and praised his opponent’s technical skills, while Mr. Shimomura was the freelance gunfighter with a conscience, accusing Mr. Mitnick of breaking the codes of the online community.
“This kind of behavior is unacceptable,” he told The Times.
Mr. Shimomura, using software he designed that reconstructed a user’s computer sessions, along with cell phone scanning equipment, proceeded to locate Mr. Mitnick.
Mr. Mitnick was eventually caught by the FBI and charged with illegal use of a telephone access device and computer fraud. “He would have had access to trade secrets worth millions of dollars,” said Kent Walker, an assistant U.S. attorney in San Francisco, at the time. “He was a very big threat.”
In 1998, while Mr Mitnick was awaiting sentencing, a group of supporters commandeered The Times website for hours, forcing it to close. A technology reporter for the Times, John Markoff, also became part of the hodgepodge, reporting shortly after the arrest that Mr Mitnick had gained access to Mr Markoff’s email in revenge for Mr Markoff’s coverage of his activities.
Mr. Mitnick reached plea deals in 1996 and 1999, which included pleading guilty to computer and wire fraud. He was released from prison in 2000 on the condition that he not use a computer or cell phone for three years without permission from his probation officer.
After leaving prison, Mr. Mitnick read a self-defense statement. “My crimes were simple transgressions,” he said. “My case is a case of curiosity.”
Kevin David Mitnick was born on August 6, 1963 in the Van Nuys neighborhood of Los Angeles and grew up in that city. His parents, Alan Mitnick and Shelly Jaffee, divorced when he was 3 years old, and he was raised by his mother, a waitress.
Mr. Mitnick was a heavyset and lonely boy who, at the age of 12, figured out how to ride the bus freely with a $15 punch card and blank tickets fished out of a dumpster. In high school, he developed an obsession with the inner workings of telephone company switches and circuits. He played pranks at a high level and managed to program the home phone of someone he didn’t like so that every time the line was picked up, a recording asked for a 25 cent deposit.
He showed a willingness to blatantly break the law by breaking into a Pacific Bell office as a teenager and stealing technical manuals.
In the late 1980s, he was twice convicted of hacking into corporate computer systems, leading to jail time and counseling for computer addiction.
Yet Mr. Mitnick often took a surprisingly old-fashioned approach to high-tech theft. He often posed as authority figures over the phone and in email, persuading low-level corporate officials to hand over passwords that gave him access to classified information.
Mr. Mitnick’s first marriage, when he was in his early twenties, soon ended in divorce. In 2015, he met Kimberly Barry at a cybersecurity conference in Singapore, and the two soon began dating. They got married last year after he learned of his cancer diagnosis. She survives him and is pregnant with his first child.
The year Mr Mitnick was released, The Times reported on an “unusual arrangement” in which he was hired by a California university he had “victimized” to advise on cybersecurity. Mr. Mitnick called it “hiring the hacker.”
Now it is common for hackers to find work by exposing the vulnerabilities of governments and companies. KnowBe4, the company partly owned by Mr. Mitnick, describes itself as “the provider of the world’s largest security awareness training.” The company says a cybersecurity curriculum designed by Mr. Mitnick is used by more than 60,000 organizations.
Writing about data privacy in The New York Times Book Review, journalist and author Amy Webb in 2017 identified that once-hunted hacker with an epithet that would have baffled members of law enforcement and newspaper readers in the 1990s: “the internet security expert Kevin Mitnick.”
Livia Albeck-Ripka And Orlando Mayorquin reporting contributed.
