As a boy, Kevin Mitnick was curious, but puzzles and chess left him cold; he preferred a rather different kind of problem… Before he even came of age, he was convicted of hacking, a crime that at the time didn't even exist in the law books.
Soon he would become the most wanted hacker, “Public Enemy No. 1” (according to the New York Times) and the FBI's greatest challenge. Only to land in prison again, and to walk out as the savior of companies from online criminals.
A life like a movie, you'll say. And films have indeed been made about his life, but… only about part of it. In July 2023, Kevin Mitnick passed away, seemingly having finally found happiness, though he narrowly missed living to see his first child.
The man who coined the term “social engineering,” the teacher of today's hackers and of today's cybersecurity specialists alike, lived his life like a movie worth watching from beginning to end. The way he himself would have told it—the most wanted and most talked-about hacker in history…
Home Alone
Kevin's parents divorced when he was very young. To support him, his mother worked almost around the clock. And from an early age he cared less about playing with friends than about discovering new things.
He loved to travel, but in the 1970s that was anything but cheap for a family like his. So at just 12, Kevin “hacked” the system for the first time. Back then, the Los Angeles bus network used a fare system much like the punched paper tickets Bulgarians knew until only yesterday—except that there the “secret” lay not in the ticket itself but in how the holes were “arranged” on it. With careful planning, the boy managed to find a whole pad of blank transfer slips, then persuaded one of the drivers to show him how the punching system worked, claiming it was for a school project…
The result: Kevin soon had slips for every bus line and began roaming the city at will. For the first time he had pulled off an “attack” we hear more and more about today—social engineering.
The Hacker-in-Chief
“Before long I had memorized the schedules of every bus in the system,” Kevin recalled. “It was an early example of my surprising memory for certain kinds of information; to this day I remember phone numbers, passwords and other things from my childhood.”
Another thing that drew him from an early age, and that would soon emerge in full force, was magic. “Once I learned how a new trick worked, I practiced, practiced and practiced until I had mastered it. To some extent, it was through magic that I discovered the pleasure of fooling people.”
In high school he got hooked on “phone phreaking”—breaking into the telephone system. Back then all communication ran over the familiar analog lines, and this is where we find the prototypes of today's hacking. With various tricks, the kids got themselves free calls they couldn't otherwise afford. The time came for the “magic” to be put into practice—Kevin quickly learned to pass himself off as someone else and get exactly what he was after.
A Gang with a Traitor
He became a virtuoso—creating unlisted phone numbers, calling from other people's numbers, listening in on and cutting off conversations. He grew used to handling complex technical questions; as he himself put it, at the height of this part of his “career,” kid though he was, he knew the phones and the network better than any technician.
Then came the age of computers. The first network he hacked was his own school's. And although he could have bumped up his grades, he didn't. What interested him was the approach to reaching the goal, the process, not the benefits he might reap. Something he would keep explaining for the rest of his life…
In 1980, at 16, Kevin made his first serious break-in, gaining access to the computers on a large company's network. He was part of a group of hackers at the time; they were given away after a typical teenage love drama, and he received his first sentence—three months in a juvenile detention center.
When the Internet Was Young
Then the wheel turned, and although the hacker kept getting better at his craft, the weak link almost always turned out to be someone else. In 1987 he was betrayed by his friend Lenny DiCicco—the two had carried out a string of hacking attacks together. When the FBI came, Kevin asked Lenny, with genuine curiosity, why he had turned him in. “You're a danger to society,” replied his friend of yesterday.
This time Kevin had a skilled lawyer, who argued that his client suffered from a severe addiction to computers, and that the addiction was to blame for the crimes. As a result, the sentence was just a year under lenient conditions.
After he got out, the most active period of our hero's life began. Within days, for some mysterious reason, the phone number of the officer assigned to monitor him was blocked, the judge who had sentenced him woke up locked out of his bank account, and all the data on his case vanished from the court's mainframe.
Bonnie and Kev
Several times Kevin landed jobs as a programmer, but his fame quickly caught up with him. His record stint was at the 20th Century Fox studio—a full two months.
After yet another short spell in the cooler, he decided to try to finish his studies at a new college, where he met the beautiful Bonnie. She impressed him so much that… he hacked her ex-boyfriend's phone to prove to her that the man was cheating on her.
The romance took off; they even started working at the same company… when the police once again sensed he was up to something and seized the hard drives from his home. Guessing what the officers would find, Kevin and Bonnie hastily got married, which legally freed her from any duty to testify against her husband. The marriage lasted… right up until the next time the hacker ended up behind bars.
Mitnick the Beatnik
Where is the line between legend and truth? We'll hardly ever know. Either way, in the early 1990s Kevin became a legend, and he would stay on his pedestal as the most skilled hacker in all of computer history.
He denied a huge share of the episodes he was accused and convicted of. Several times he said he had quit hacking for good, but something always happened to knock him off balance. In the 1980s it was his breakup with Bonnie, and in 1992 his brother died. Kevin had supposedly given up hacking by then and was doing paid consulting, but the news devastated him; he briefly lost 45 kilograms and then… disappeared.
After a series of hacking attacks, he was placed on the federal wanted list. He stayed in hiding for three whole years, living under a false identity. And “working” hard, diving into the technology of mobile phones.
On Christmas Day 1994, however, he made a fatal mistake. He broke into the personal computer of cybersecurity specialist Tsutomu Shimomura, just to mock one of his leading rivals. He even left him an audio file full of insults. But someone else laughed last: Shimomura joined the FBI team on Mitnick's trail, and on February 15, 1995, the hacker was arrested.
“Despite the myth of Kevin Mitnick created by the media, I am not a malicious hacker,” Kevin later wrote. “What I did wasn't even against the law when I started, but it became a crime after new legislation was passed. I kept going anyway and got caught. But the federal government's treatment of me was based not on the crimes, but on making an example of me. I did not deserve to be treated like a terrorist.”
Hacker Won't Peck Out Hacker's Eye
This is where his mythical status was born. During the trial the authorities did everything they could to demonize him. Shimomura, together with John Markoff, wrote the book Takedown, which became a bestseller and the script for a box-office film. Markoff, in turn, was a journalist who had also joined the manhunt and described it on the front page of The New York Times in grandiose terms. The US Department of Justice itself called Mitnick “the most wanted computer criminal in United States history.”
Meanwhile, a mass campaign for his release got underway. Kevin's “colleagues” hacked some of the biggest websites, plastering them with slogans that he had been framed, that he was a scapegoat.
The trial dragged on, and when it finally came to a verdict, the sentence was five years—but the hacker had already served four of them. Which is downright symbolic: had the original charges been upheld, they would have cost him… 300 years behind bars.
Hold My Hat
Kevin walked out of prison as a pop star and made the most of the new role. For three more years he was barred from using electronic devices, so even when he appeared as… a CIA agent in the modest series Alias, he had to use a fake computer prop.
Then the probation period ran out, and Kevin went back to hacking, but from the other side. In his “trade,” “black hats” are the ill-wishers who attack systems in order to abuse them, and “white hats” are those who test security to help companies. Well, with the arrival of the new century Kevin changed his hat (as far as anyone knows) for good. In the last years of his life he founded his own cybersecurity consulting company, became a leading expert on the subject and a popular speaker. In the end he found love again in fashion designer Kimberley, who soon took the surname Mitnick.
By then he was even helping the police. In a small town in Michigan, a phone terrorist surfaced and began a series of bomb threats. The sheriff contacted Mitnick, who explained in detail what data to request from the phone company, and the 15-year-old prankster was soon caught. “Don't thank only me, thank Tsutomu Shimomura too,” Mitnick smiled. With a large dose of irony, because Mitnick accused the journalist Markoff of using entirely made-up facts and creating a wildly exaggerated image that he never managed to escape. And Shimomura, completely undeservedly, got cast as the shining hero.
Final Customs
For nearly a year Kevin fought pancreatic cancer before passing away in July 2023, at 59, just short of the birth of his first child. Leaving behind him the legendary image of the mythical hacker.
Does he deserve it? Undoubtedly. If only because throughout his life he never got rich and never cashed in on the huge breaches he had pulled off. Of course, they were by no means harmless: the damage from the crimes he was convicted of alone exceeds $300 million, and many believe his overall “contribution” is many times larger. Motorola, IBM, Nokia and Sun Microsystems are just some of the companies he managed to “crack.” The list is rounded out by NASA and the Massachusetts Institute of Technology.
And yet… there was a great deal of art in his “work.” He could step into all kinds of roles to gain access to his next target. He became an employee who had forgotten his password, a technician in need of assistance. He even got the better of the FBI's phone network, monitoring communications between the agents hunting him. For him, hacking was always a challenge, an adventure—on both sides of the hat.
“Some people get out of bed every morning dreading their daily work routine, as if they toiled in salt mines,” Kevin wrote. “I've been lucky enough to enjoy my work. You can't imagine the challenge, the reward and the pleasure I felt. I honed my talent in the art called ‘social engineering’: getting people to do things they wouldn't ordinarily do for a stranger—and pay me for it. It wasn't hard for me to perfect it, because my father's side of the family has been in sales for generations, and the art of influence and persuasion may be an inherited trait. When you combine an inclination for deceiving people with the talents of influence and persuasion, you get the profile of a social engineer.”
Hack to Basics
“Anyone who loves playing chess knows that it's enough to defeat your opponent. You don't have to loot his kingdom or seize his assets to make it worthwhile,” he said. What would he advise young people interested in hacking? “Don't follow in my footsteps. Get good at using virtual machines and all the available tools. Dig deep into system administration and the fundamentals before jumping into security.”
“As long as computer code exists, there will be vulnerabilities,” the mythical hacker reassures us in one of his many books.
“What I became convinced of is that it will always be easier to manipulate people than technology,” he said. “Companies spend millions of dollars on protections, encryption and devices, but that money is wasted. None of these measures addresses the weakest link in the security chain—people. Besides, any technology is vulnerable to attack if you have enough time and resources.”
The Trickster
His role in recent years almost feels a bit dull: the wise, battle-scarred figure who looks after… security. Considering that he himself invented and popularized the most common types of attacks in use today.
As he put it himself, “my job now is like Pablo Escobar retraining as a pharmacist.” Rather colorful, wouldn't you say?
Just like his explanations that he did something that wasn't even forbidden back then and undeservedly became the black sheep. In the end, he simply never managed to escape his love of magic. Something there is less and less of in our lives, and in the computer world…
