WEBVTT
00:00:00.000 --> 00:00:00.541
Episode 155 [START OF RECORDING]
00:00:00.541 --> 00:00:03.680
JACK: Sometimes the people I want to talk to on this show are so cool that I want to
00:00:03.680 --> 00:00:05.200
be friends with them. JOE: Check, check.
00:00:05.200 --> 00:00:06.874
JACK: Hey, I m recording. JOE: Cool. Alright, let me get this
00:00:06.874 --> 00:00:10.280
JACK: Where are we going? JOE: Let s go to the lair,
00:00:10.280 --> 00:00:13.520
where the magic happens. JACK: Joe Grand is someone who because
00:00:13.520 --> 00:00:17.840
we have so much in common, I wanted to visit him in person to try to make that extra connection.
00:00:17.840 --> 00:00:22.040
JOE: Alright, here we go. JACK: Whoa, my. Quite the
00:00:22.040 --> 00:00:23.514
place. JOE: Yeah.
00:00:23.514 --> 00:00:26.880
JACK: Display case here, and then you ve got a table here
00:00:26.880 --> 00:00:31.520
with a ton of projects you're working on. JOE: Yeah. So, this is kinda the main table
00:00:31.520 --> 00:00:36.880
that people probably see in videos. I have my computer, my oscilloscope that is my one
00:00:36.880 --> 00:00:42.520
piece of test equipment that I m always using power supply, and a couple different projects;
00:00:42.520 --> 00:00:47.480
some fault injections set up here. All these circuit boards are for a class I m teaching in a
00:00:47.480 --> 00:00:51.560
couple weeks. I have to get those prepared. JACK: He showed me around his office,
00:00:51.560 --> 00:00:56.080
and I think a better description for his office would be a workshop. It s really a place that
00:00:56.080 --> 00:01:00.360
sparks creativity wherever you look. It s full of gadgets and tools that just beckon you to
00:01:00.360 --> 00:01:07.200
pick something up and start building something. JOE: work bench with various pieces of circuitry
00:01:07.200 --> 00:01:10.200
and, yeah, a lot of display stuff also. JACK: [Music] You got your
00:01:10.200 --> 00:01:13.941
YouTube plaque on the wall. JOE: Got the YouTube plaque on the wall, yeah.
00:01:13.941 --> 00:01:17.720
JACK: That s cool. We found some comfy spots to plop down on and have a chat for a while,
00:01:17.720 --> 00:01:22.960
because I wanted to hear all the stories that Joe had. How many books have you written?
00:01:22.960 --> 00:01:29.240
JOE: That s a good question. (INTRO): [Intro music] These are
00:01:29.240 --> 00:01:47.100
true stories from the dark side of the internet. I m Jack Rhysider. This is Darknet Diaries.
00:01:47.100 --> 00:01:57.040
JACK: Hi. JOE: Hey. Hey again.
00:01:57.040 --> 00:01:59.520
JACK: Why don t we start with your name, and what do you do?
00:01:59.520 --> 00:02:04.200
JOE: My name is Joe Grand, and I m a hacker. JACK: [Music] After hanging out with Joe a few
00:02:04.200 --> 00:02:09.080
hours, I think, yeah, he absolutely is a hacker, and I think it s becoming increasingly rare to
00:02:09.080 --> 00:02:14.640
find a hacker in their forties. I think we all rebel as teenagers. We have a lot of that youthful
00:02:14.640 --> 00:02:18.840
energy and are waking up to the world for the first time, and we start ignoring the advice of
00:02:18.840 --> 00:02:23.440
our parents and listen to music which talks about the problems of the world, and we resonate with
00:02:23.440 --> 00:02:29.200
it, and we come of age listening to that stuff, and we either want change or to fight the system.
00:02:29.200 --> 00:02:34.560
For me and for Joe, our teenage rebelliousness began as skateboarders. Back then, there was a
00:02:34.560 --> 00:02:39.600
sense that skaters were counter-culture, not abiding by the rules or the norms of society.
00:02:39.600 --> 00:02:43.440
I remember the first time I fell in love with skaters. It was in middle school, and I saw them
00:02:43.440 --> 00:02:48.080
all outside laying in the grass during lunch. It was fall out, so there were a lot of leaves
00:02:48.080 --> 00:02:51.880
everywhere, and a few of them were throwing leaves at each other and they were rolling around in it.
00:02:51.880 --> 00:02:57.880
Then the bell rang and we all had to go to class. They all looked at each other and silently agreed
00:02:57.880 --> 00:03:02.880
not to brush themselves off and instead come to class as messy as possible, with leaves
00:03:02.880 --> 00:03:07.800
all through their hair and clothes and grass everywhere. One sat in front of me in my class,
00:03:07.800 --> 00:03:14.120
totally a mess, and he paid absolutely no mind to it. He acted as if nothing was going on different,
00:03:14.120 --> 00:03:18.560
and I loved that attitude. It enticed me. It drew me in to not care about how you look or
00:03:18.560 --> 00:03:23.120
any norms or expectations that people have on you, to just be your wild and goofy self.
00:03:23.120 --> 00:03:27.320
There s a sense of freedom in that, and that s when I started hanging out with the skaters,
00:03:27.320 --> 00:03:31.400
and I felt completely at home there. I remained a skater all through middle school
00:03:31.400 --> 00:03:36.080
and high school. Joe and I both got into computers around the same time, too, and for both of us,
00:03:36.080 --> 00:03:40.920
we had just great fun in seeing all that it could do, building things, breaking things, trying just
00:03:40.920 --> 00:03:47.520
about every possible thing that we heard about; bulletin boards, floppy discs, DOS, AOL, IRC, FTP,
00:03:47.520 --> 00:03:54.160
Unix, Windows, programming, electronics, circuits. It was simply great fun to sit down Saturday night
00:03:54.160 --> 00:03:59.120
at a computer and just try to do something new with it, like to try out a new operating system or
00:03:59.120 --> 00:04:04.680
compile a kernel from scratch. We would absolutely try what other people tried before us, things that
00:04:04.680 --> 00:04:11.080
have tutorials for them, but then we d soon find ourselves in areas where no tutorials exist for
00:04:11.080 --> 00:04:16.560
this. No manuals explain what to do here. We were off the map, explorers of the digital
00:04:16.560 --> 00:04:21.440
world, and it felt like we were trying to get computers to do things they weren't intended to
00:04:21.440 --> 00:04:27.240
do, which in my opinion is the definition of a hacker, to push beyond the roadblocks that
00:04:27.240 --> 00:04:33.680
stop you from doing something and to try to get it done anyway. Living in that space is hard, though.
00:04:33.680 --> 00:04:38.040
It s like you're walking in the dark and you're constantly bumping into things. You feel stupid
00:04:38.040 --> 00:04:42.960
for not knowing what to do and just failing again and again, and it s frustrating when it doesn't
00:04:42.960 --> 00:04:49.320
work, and you give up. As a youth, you don t quite know that what you're doing is different than how
00:04:49.320 --> 00:04:53.920
other people are using these tools, so it just feels normal to stumble and struggle with whatever
00:04:53.920 --> 00:04:58.840
technology you have. You get used to that. [Music] But as you learn more about the world
00:04:58.840 --> 00:05:04.800
and grow up, you find your place in it and you try to be good in your domain of expertise. You want
00:05:04.800 --> 00:05:11.440
to find a place where you feel comfortable and confident. It s uncomfortable and hard to learn
00:05:11.440 --> 00:05:16.760
things without instruction manuals or YouTube videos to teach you. So, you wait for others
00:05:16.760 --> 00:05:22.000
to learn the things before you so that they could teach you, which means you lose your edge. You're
00:05:22.000 --> 00:05:26.680
not on the frontier of knowledge anymore. You're not pushing the systems beyond their intended
00:05:26.680 --> 00:05:33.400
purpose. As we get older, we lose that drive and instead just become better at following the rules,
00:05:33.400 --> 00:05:38.880
and as you grow older, you stop rebelling, too, maybe because you're just tired or because you
00:05:38.880 --> 00:05:44.080
just accept that life is going to be unfair. You realize that you have responsibilities, too,
00:05:44.080 --> 00:05:50.800
so you can't afford to get in trouble anymore. You lose that punk side of yourself. But Joe never
00:05:50.800 --> 00:05:57.840
lost that. Joe never turned his curiosity down or off. Joe learned how to feel comfortable walking
00:05:57.840 --> 00:06:04.000
in the dark, bumping into things, failing again and again. In fact, he likes that place. He loves
00:06:04.000 --> 00:06:08.480
that chase of finding the answer somewhere in the muck that nobody else has ever found before,
00:06:08.480 --> 00:06:13.440
that place of pushing things beyond their intended use. He ignores people telling him
00:06:13.440 --> 00:06:18.280
that s impossible . He pushes through roadblocks and just acts like they don t exist. While
00:06:18.280 --> 00:06:24.360
most of us have grown tired of inventing or finding creative ways to solve novel problems,
00:06:24.360 --> 00:06:30.080
Joe has more energy than ever to dance and play in that space, and it s amazing to watch him work.
00:06:30.080 --> 00:06:38.000
JOE: I still have this idealistic view of my little bubble of what a hacker is, and to me,
00:06:38.000 --> 00:06:43.720
it basically is kind of somebody who s questioning the system and curious about
00:06:43.720 --> 00:06:49.280
technology and wanting to learn things and bypassing security. Really, I grew up even
00:06:49.280 --> 00:06:54.360
before I knew what a hacker was, I was pushing people s buttons. I was causing trouble. I had
00:06:54.360 --> 00:06:58.920
this mischievous side, and a hacker JACK: That s what I was gonna ask you.
00:06:58.920 --> 00:07:03.760
As a hacker, have you ever been arrested? JOE: I have been arrested, and it was a great
00:07:03.760 --> 00:07:11.440
lesson and a great experience. It did change some of my behavior, but the hacker mindset
00:07:11.440 --> 00:07:18.480
and that ethos is still with me, and it s been the same since I was a kid. I feel the same way
00:07:18.480 --> 00:07:26.240
that I felt then as a hacker and how I fit into the world and into the society that I do now,
00:07:26.240 --> 00:07:32.080
right? So, even though I got arrested and that changed my perspective a little bit,
00:07:32.080 --> 00:07:39.400
changed my behavior so I wouldn't get arrested again, my mindset is the same, and I don't know
00:07:39.400 --> 00:07:44.280
but I have a sense of like that that s changing with a lot of people, where somebody of my age,
00:07:44.280 --> 00:07:48.720
of my generation who grew up with computers, has maybe a different mindset than people who got into
00:07:48.720 --> 00:07:58.880
it later. I don't really know. I just know how I feel, and I m very kind of rigid in my beliefs as
00:07:58.880 --> 00:08:04.640
a hacker and my responsibilities as a hacker. JACK: In 1982, he got some Atari equipment when he
00:08:04.640 --> 00:08:08.920
was like, eight, nine, ten. He was just mesmerized by the world of electronics. This eventually led
00:08:08.920 --> 00:08:12.880
him to computers, and he got a modem. He could dial out to bulletin board systems and reach
00:08:12.880 --> 00:08:17.360
other computers somewhere else in the world. JOE: Which ultimately led me to hook up with
00:08:17.360 --> 00:08:22.560
some guys that I had met on some bulletin board sytems and was part of a group called
00:08:22.560 --> 00:08:29.800
Renegade Legion. [Music] We wrote some early text files on some phone phreaking, credit card fraud,
00:08:29.800 --> 00:08:34.760
how to break into the CBI credit bureau and pull credit records and then get actual credit cards,
00:08:34.760 --> 00:08:43.440
and things that as a kid didn t seem bad. It was a cool thing. I mean, even now, I don't yes,
00:08:43.440 --> 00:08:50.080
it s a crime. Do I feel bad about it? No. Has it happened to me? Dozens of times my credit
00:08:50.080 --> 00:08:55.800
card has been stolen. It s a fact of life now. JACK: Back then, to hack a system would sometimes
00:08:55.800 --> 00:09:00.640
simply be telling your computer to dial a phone number and it might let you into that system
00:09:00.640 --> 00:09:05.080
without a password, or maybe you could just mash the keyboard and it would let you in. Hacking
00:09:05.080 --> 00:09:09.840
was a lot simpler then, but there really weren't instructions on how to do it. You were kind of on
00:09:09.840 --> 00:09:13.560
your own to discover what was out there. JOE: But yeah, there so, getting into those
00:09:13.560 --> 00:09:19.280
systems, the process basically was like and this was when I was fourteen, fifteen at this point of
00:09:19.280 --> 00:09:24.280
like, alright, let s look through the White Pages, which was the book of everybody in your area.
00:09:24.280 --> 00:09:30.880
Let s find the doctor, let s find the dentist, look up their name in the credit bureau system,
00:09:30.880 --> 00:09:34.520
see what their credit was 'cause you could see their name, their social security number,
00:09:34.520 --> 00:09:39.640
credit rating, what credit cards they had pick the one that had a high credit,
00:09:39.640 --> 00:09:42.680
get all that information, call the credit card company, give them what they needed, and say,
00:09:42.680 --> 00:09:46.440
hey, I m doctor whatever. I m on vacation. Can you I lost my card. Can you send me another
00:09:46.440 --> 00:09:50.840
card? They d send you a new physical card and you d go use it. But that was later on.
00:09:50.840 --> 00:09:55.640
The earlier days, there was a lot of this curious exploration because we would war dial. We would
00:09:55.640 --> 00:10:00.920
take a prefix and say, okay just like in WarGames when David Lightman was trying to find out his
00:10:00.920 --> 00:10:06.000
school computer, I figured if our school computer was connected, it would be within that range. So,
00:10:06.000 --> 00:10:11.600
doing those war-dialing sessions overnight, of course, so my parents wouldn't pick up the
00:10:11.600 --> 00:10:15.640
phone and hear everything, because at that point you still had a automatic you could do automatic
00:10:15.640 --> 00:10:20.840
dialing, but it was still everybody was sharing a single phone line in the house. Then you d wake
00:10:20.840 --> 00:10:25.240
up to a list of phone numbers, and you're trying those and you'd never know what it was. It was
00:10:25.240 --> 00:10:31.600
like this kind of treasure hunt. JACK: [Music]
00:10:31.600 --> 00:10:37.160
Joe grew up in Boston, Massachusetts. JOE: So, as part of joining Renegade Legion so,
00:10:37.160 --> 00:10:41.880
a bunch of teenagers doing stuff online and whatever we thought it would be cool
00:10:41.880 --> 00:10:47.520
for everybody to meet up in person during all of our winter break. Most of us were in high school.
00:10:47.520 --> 00:10:53.400
Some of the guys were a little bit older. One of the guys, whose name was Dr. Death,
00:10:53.400 --> 00:10:58.480
was in Michigan, and that was kind of a central point where everybody else was coming from. So,
00:10:58.480 --> 00:11:02.680
on one of our alliance teleconferences where we re all talking on the phone big party lines and,
00:11:02.680 --> 00:11:06.440
of course, being billed to somebody else, someone s like, hey, we should all get together. So,
00:11:06.440 --> 00:11:11.120
we decided during our school break, everybody meet up at Dr. Death s house, and we d hang
00:11:11.120 --> 00:11:18.040
out. He had an arcade game and a pool table. My parents talked to his parents and they're like,
00:11:18.040 --> 00:11:23.120
okay, this seems like a stable household. So, they actually let me fly to Michigan on my own,
00:11:23.120 --> 00:11:27.960
meet up with all these other hackers. Remember that this was already eight years after I had
00:11:27.960 --> 00:11:33.760
been using the computer. My parents knew what I was up to, but they didn t really know. So, we
00:11:33.760 --> 00:11:37.920
all got together and hung out, and then somebody had an idea of like, hey, let s break into the
00:11:37.920 --> 00:11:43.800
telephone company so we can get some hardware and get some documentation. At the time, the internet
00:11:43.800 --> 00:11:50.520
was starting to kinda be a thing, but not really. This was 92. So, really, it was hackers against
00:11:50.520 --> 00:11:58.560
the phone system. Ma Bell, New England Telephone, 9X Michigan Bell, whatever, Pacific Bell,
00:11:58.560 --> 00:12:05.840
all of those companies, that was the target of phone phreaking, exploring the phone network.
00:12:05.840 --> 00:12:12.120
That was for us, that was kind of the Holy Grail. We went to the hardware store and bought some big
00:12:12.120 --> 00:12:17.560
bolt cutters and some rubber gloves it was like a really bad movie and bought all the equipment
00:12:17.560 --> 00:12:22.720
to break into this place; some automatic center punches to break the windows. So, we basically
00:12:22.720 --> 00:12:27.360
went to the Michigan Bell telephone facility which was down the street from this guy s house,
00:12:27.360 --> 00:12:33.240
and went in and cut through the fence, pulled the fence back. I had this jacket at the time
00:12:33.240 --> 00:12:38.000
that I would wear every single day, and it tore a little hole in the shoulder on my way in. So,
00:12:38.000 --> 00:12:43.360
that was sort of this mark of pride after that. So, we didn t break into the building itself,
00:12:43.360 --> 00:12:48.480
but we smashed the windows of the vans that had all of the in-field equipment.
00:12:48.480 --> 00:12:53.560
JACK: What were you looking for? JOE: Documentation, manuals, hardware,
00:12:53.560 --> 00:12:58.080
telephone test equipment, things that other phone phreakers, other hackers didn t have,
00:12:58.080 --> 00:13:04.320
and took as much stuff as we possibly could. I think there were six of us. One of the guys
00:13:04.320 --> 00:13:10.360
was a larger fellow, so he was our lookout, and he was listening to the scanner radio to see when the
00:13:10.360 --> 00:13:16.920
police were called. Which, it turns out that if you use a scanner radio during committing a crime,
00:13:16.920 --> 00:13:18.920
that s an additional crime. JACK: Really?
00:13:18.920 --> 00:13:22.440
JOE: Yeah, at least at the time. I didn t know that. Especially a scanner radio there was no
00:13:22.440 --> 00:13:27.120
serial number on it 'cause it was scraped off because it was stolen. So, yeah, he ended up
00:13:27.120 --> 00:13:34.160
getting caught. The rest of us got away, but what happened is as we pulled up, next to the telephone
00:13:34.160 --> 00:13:38.360
facility was a park, and there was a nosy neighbor that was like, hey, there was a bunch of rowdy
00:13:38.360 --> 00:13:45.240
kids hanging out in the park. So, they called the police just because they thought kids were hanging
00:13:45.240 --> 00:13:51.000
out after curfew or something. By the time the cops showed up, they had the one guy there. He
00:13:51.000 --> 00:13:55.800
got caught in the car with the scanner radio. The police report when this guy called in said there
00:13:55.800 --> 00:14:00.440
were multiple kids. So, they're basically like, where are your friends? He flipped and was like,
00:14:00.440 --> 00:14:04.720
yeah, there was six of us or however many. We had all gotten home by that time or back to Dr.
00:14:04.720 --> 00:14:10.640
Death s house, and we're like, oh my god, where s this other guy? It turns out he got arrested. Then
00:14:10.640 --> 00:14:15.200
the next day, we all had to turn ourselves in. JACK: This was a pretty awful experience for Joe s
00:14:15.200 --> 00:14:19.840
parents, who had to fly to another state to rescue their son from juvenile detention. I could only
00:14:19.840 --> 00:14:23.280
imagine it s something like the movie Home Alone, where the mom was trying desperately to get home
00:14:23.280 --> 00:14:28.080
to her son. Luckily for him, because he was the youngest of the bunch, they let him off without a
00:14:28.080 --> 00:14:33.860
charge, but the others weren't so lucky. A bunch of them got felonies. Some served jail time.
00:14:33.860 --> 00:14:41.120
JOE: One of our other guys was already under I don't know if it was indictment or investigation
00:14:41.120 --> 00:14:46.240
or something by the Secret Service for some other phone phreaking stuff that we had done as a group,
00:14:46.240 --> 00:14:54.640
as Renegade Legion, and he ended up dying by suicide. That was a real eye-opener of like,
00:14:54.640 --> 00:14:59.040
holy shit, a law-breaker just killed himself over getting arrested?
00:14:59.040 --> 00:15:03.680
JACK: His parents were pretty mad and told him, look, you either need to get a job or take up
00:15:03.680 --> 00:15:08.720
a sport. He didn t want to get a job, so he joined the track team at school and started
00:15:08.720 --> 00:15:15.440
doing a lot of running. This gave him a group of normal friends, not rebels, not skaters,
00:15:15.440 --> 00:15:22.160
not hackers, just normal people. After this scare with the police and running track,
00:15:22.160 --> 00:15:27.880
he did straighten up a bit, which is how he got to join the L0pht. He had to actually tone down his
00:15:27.880 --> 00:15:33.600
rebelliousness to join this hacker space. JOE: So, L0pht or L0pht Heavy Industries was
00:15:33.600 --> 00:15:39.800
really just a safe space, possibly the first hacker space in the US as an organized space,
00:15:39.800 --> 00:15:46.480
and it really was just a clubhouse for seven Boston-area hackers to hang out and explore and
00:15:46.480 --> 00:15:52.120
have a place to play with technology. JACK: What did the space look like?
00:15:52.120 --> 00:15:57.640
JOE: It was very so, if you imagine a cyberpunk movie maybe Hackers;
00:15:57.640 --> 00:16:05.600
maybe the Hackers movie is probably the closest to sort of what it looked like, but it was in it
00:16:05.600 --> 00:16:15.720
was an artist loft space. So, it was a one one big room with old wood floors. There were PCs; Apple,
00:16:15.720 --> 00:16:24.560
Apple IIs, Macs. We had a VAX 11/780, I think. JACK: The L0pht was a magical place with about
00:16:24.560 --> 00:16:29.360
eight members. It was magical because computers weren't that popular yet.
00:16:29.360 --> 00:16:34.360
So, for there to be a space with electronics and computers, it was really ahead of its time. They
00:16:34.360 --> 00:16:39.640
were the weirdo nerds into that geeky stuff. Little did they know, the whole world would
00:16:39.640 --> 00:16:44.360
become weirdo nerds along with them, because we were all destined to buy computers and
00:16:44.360 --> 00:16:48.640
electronics in the coming decades. JOE: I remember seeing Count Zero give
00:16:48.640 --> 00:16:53.680
talks about stuff that we found from the trash or other things that he had been researching,
00:16:53.680 --> 00:16:59.640
and seeing his passion of sharing information in that way, of like, you don t need to hoard
00:16:59.640 --> 00:17:03.608
everything and as kids, we would hoard stuff but then we would trade bits and pieces, 'cause that
00:17:03.608 --> 00:17:09.760
s what would give you this power. But to see him just open up the kimono of like, here s everything
00:17:09.760 --> 00:17:14.360
I learned and maybe somebody can take a piece of that and do something else with it, I thought
00:17:14.360 --> 00:17:20.600
that was such a learning moment for me, and that when I started giving talks as well, it was like,
00:17:20.600 --> 00:17:25.880
alright, if I m gonna talk about something, I want to share as much as I possibly can,
00:17:25.880 --> 00:17:30.640
not to brag about it but to empower somebody else to say, oh, that s cool; I want to try that or I
00:17:30.640 --> 00:17:37.400
want to build upon this or maybe I can use this piece of that on something else. Once I learned
00:17:37.400 --> 00:17:44.080
that, everything changed [Music] because it was all about empowering this community to grow,
00:17:44.080 --> 00:17:47.920
and I would learn from other people and you'd learn from they would learn from somebody else and
00:17:47.920 --> 00:17:54.960
share that with you. So, it was this very communal sort of knowledge growth, I guess you could say,
00:17:54.960 --> 00:18:00.400
and that s the main thing I learned from the L0pht, and that for sure is of everything that
00:18:00.400 --> 00:18:07.480
I ve learned, that has stuck with me the most. JACK: L0pht was legendary. It was kinda
00:18:07.480 --> 00:18:12.720
like a research group. They found a lot of vulnerabilities in computers, and they released
00:18:12.720 --> 00:18:18.200
such tools like L0phtCrack, which can sometimes crack Windows passwords. They d publish new ideas
00:18:18.200 --> 00:18:23.400
of how to break systems or hack things. In fact, they were so legendary that they ended up going to
00:18:23.400 --> 00:18:29.080
Washington D.C. to testify before the Senate. JOE: I remember they called us up to the stand.
00:18:29.080 --> 00:18:34.240
We sit there, and there s all this so, we see the senators in front of us, but right
00:18:34.240 --> 00:18:40.160
below them facing us was this row of media. We sat down; it was just like, camera flash,
00:18:40.160 --> 00:18:45.520
camera flash. It was like the paparazzi, because it had never happened before. You
00:18:45.520 --> 00:18:49.760
never had hackers talking to the government. SENATE: We re joined today by the seven members
00:18:49.760 --> 00:18:57.080
of the L0pht hacker thinktank in Cambridge, Massachusetts. Due to the sensitivity of the
00:18:57.080 --> 00:19:09.160
work done at the L0pht, they ll be using their hacker names of Mudge, Weld, Brian Oblivion,
00:19:09.160 --> 00:19:17.160
Kingpin, Space Rogue, Tan, and Stefan. JACK: Joe s hacker name is Kingpin,
00:19:17.160 --> 00:19:21.640
and this was back in 1998. JOE: Morning. My name is Kingpin. I
00:19:21.640 --> 00:19:27.040
am the youngest member of the L0pht and one of the electrical engineers and hardware hackers.
00:19:27.040 --> 00:19:31.600
While some of the L0pht members concentrate on software programming, I work with hardward design
00:19:31.600 --> 00:19:37.440
and implementation of electronic circuits. My interests include embedded system design,
00:19:37.440 --> 00:19:42.280
surveillance and counter-surveillance tools, and wireless data transmissions. My current
00:19:42.280 --> 00:19:46.600
research project involves experimentation with the monitoring and eavesdropping of stray
00:19:46.600 --> 00:19:52.680
electromagnetic fields from computer terminals, otherwise known as TEMPEST monitoring.
00:19:52.680 --> 00:19:57.960
Using low-cost electronic equipment, one can capture the contents of computer screens from more
00:19:57.960 --> 00:20:04.080
than two hundred meters away, possibly gaining passwords and other sensitive information. The
00:20:04.080 --> 00:20:08.400
phenomenon of TEMPEST monitoring has been known to the industry for decades, but there is not
00:20:08.400 --> 00:20:13.920
much unclassified information available on how to both capture the emissions and also protect
00:20:13.920 --> 00:20:18.400
oneself from becoming an eavesdropping victim. My research will not only help me learn about
00:20:18.400 --> 00:20:22.960
the monitoring technology; it will enable me to educate others to help them protect their
00:20:22.960 --> 00:20:26.520
computer systems from prying eyes. JACK: Their message was simple;
00:20:26.520 --> 00:20:32.960
the internet is not as secure as you think, and we should embrace and welcome hackers
00:20:32.960 --> 00:20:38.720
to show us where the vulnerabilities are. SENATE: It s probably appropriate that gentlemen
00:20:38.720 --> 00:20:44.440
such as yourself were the ones who come forward and demonstrate that the emperor has no clothes,
00:20:44.440 --> 00:20:48.200
so we appreciate your coming here, especially in light of the fact that the Washington Post
00:20:48.200 --> 00:20:55.280
describe you as rockstars of the computer hacking elite. I am informed that you think
00:20:55.280 --> 00:20:59.800
that within thirty minutes, the seven of you could make the internet unusable for
00:20:59.800 --> 00:21:03.040
the entire nation. Is that correct? L0PHT: That s correct. Actually,
00:21:03.040 --> 00:21:07.800
one of us with just a few packets. JACK: How punk is that, to be this
00:21:07.800 --> 00:21:11.300
group of hackers coming up to the government saying, we could take down the internet?
00:21:11.300 --> 00:21:20.080
SENATE: Somebody had referred to you as rockstars of the new computer age. It s probably not what
00:21:20.080 --> 00:21:25.560
you came to hear, but actually, I think you're performing an act of very good citizenship,
00:21:25.560 --> 00:21:30.760
and I appreciate it. I d compare you I hope you don t mind that I m not gonna call you
00:21:30.760 --> 00:21:35.280
rockstars. I d compare you more to Rachel Carson, who sounded some early warnings
00:21:35.280 --> 00:21:39.960
about what environmental pollution was doing to the environment. [Music] In the defense context,
00:21:39.960 --> 00:21:46.210
you may be modern-day Paul Reveres, except in this case, it s not the British coming. We don
00:21:46.210 --> 00:21:51.920
t know who s coming; that s the problem. JOE: By that time in 98, a lot of the software
00:21:51.920 --> 00:21:56.560
guys had found vulnerabilities in Microsoft and they had actually had meetings with Microsoft at
00:21:56.560 --> 00:22:00.680
dinners where Microsoft s like, ah, we don t think that s gonna be a problem. Nobody s gonna exploit
00:22:00.680 --> 00:22:07.040
that. So, we would release exploit code. We were very early, if not the first, to have this sort of
00:22:07.040 --> 00:22:13.520
discussion of full disclosure or what would now be called coordinated disclosure or, in quotes,
00:22:13.520 --> 00:22:17.720
responsible disclosure . You know, how much time do you give the vendor to fix the problem?
00:22:17.720 --> 00:22:22.120
Do you trust that the vendor s gonna fix it? JACK: One of the things L0pht became known for is
00:22:22.120 --> 00:22:27.080
pioneering responsible disclosure. The problem was that hackers were looked at as criminals,
00:22:27.080 --> 00:22:32.120
hoodlums, untrustworthy, and L0pht thought of themselves as hackers, but didn t see
00:22:32.120 --> 00:22:36.760
themselves as hoodlums. They're just trying to warn the world of the problems they found,
00:22:36.760 --> 00:22:41.920
and they wanted people to fix it. They were here to help. But as they told companies about the bugs
00:22:41.920 --> 00:22:46.080
they found, the companies often misunderstood and thought these guys were there to cause trouble.
00:22:46.080 --> 00:22:50.400
So, L0pht was like, look, what do we have to do so you ll understand that we're here to help,
00:22:50.400 --> 00:22:56.080
not hurt you? That s where responsible disclosure came about. Companies learned that hackers can be
00:22:56.080 --> 00:23:01.040
very helpful at identifying vulnerabilities, and it s way better to work with them than to think of
00:23:01.040 --> 00:23:09.480
them as adversaries. So, I picture the old, old, old hacker spaces to not have many screens, and
00:23:09.480 --> 00:23:17.040
mostly just circuit boards you're looking at and maybe some visual aspect. I imagine you falling
00:23:17.040 --> 00:23:22.240
in love with this electronics aspect of it; the hardware components, how these things work.
00:23:22.240 --> 00:23:26.960
You can send signals here and make it do that, and all this kinda cool stuff. There s chips
00:23:26.960 --> 00:23:35.240
that have all this really cool CMOS in it. Then computers went in a direction of screens and
00:23:35.240 --> 00:23:42.440
programming languages and all this software. Did you go in that direction or did you say, no, no,
00:23:42.440 --> 00:23:46.680
no, I think you all need this hardware. I m gonna stay with the hardware. Or,
00:23:46.680 --> 00:23:51.200
how did you know that you were going to take a different route and not go
00:23:51.200 --> 00:23:54.680
with the software side of it, but instead you stayed on the hardware? Was that in
00:23:54.680 --> 00:24:00.160
L0pht that you kinda made that diversion? JOE: No. I had been as soon as I got attracted
00:24:00.160 --> 00:24:08.440
to computers, I was also getting attracted to electronics. I have an older brother,
00:24:08.440 --> 00:24:15.160
and he was more of an audiophile kind of person. He had radio receivers and things, but he had a
00:24:15.160 --> 00:24:18.960
lot of electronics that he would take apart and he would fix and put different capacitors in
00:24:18.960 --> 00:24:26.360
and everything, and he had this junk bin full of circuit boards. I just loved that tangible side of
00:24:26.360 --> 00:24:31.840
things, which to me makes sense of like, okay, I m using a computer, and the computer really is a
00:24:31.840 --> 00:24:41.360
very simple type of embedded system or electronic system like these other circuit boards, but I just
00:24:41.360 --> 00:24:46.360
loved the physical thing. I would start building projects out of magazines. There was a lot of
00:24:46.360 --> 00:24:51.440
hobbyist electronics magazines at the time. There were a couple people a couple text files
00:24:51.440 --> 00:24:58.560
you could read about of people making some interesting even this was pre-red box stuff,
00:24:58.560 --> 00:25:05.480
but different types of tone-dialers, blue boxes, and other telephone-related electronics. So,
00:25:05.480 --> 00:25:14.040
I started building things and I started building my own things. I knew from an early age you
00:25:14.040 --> 00:25:18.600
couldn't have a career as a hacker. When everybody would always say, what do you want to be when
00:25:18.600 --> 00:25:24.640
you grow up? and I always knew I m gonna be an engineer. I m gonna build electronics. So, that
00:25:24.640 --> 00:25:30.560
was something where it was a parallel path to the hacking, was building things, and the electronics
00:25:30.560 --> 00:25:38.000
that I was building were things like stun guns and some laser-listening systems to spy on rooms and
00:25:38.000 --> 00:25:43.240
kind of mischievous hardware, but things that I could use for the telephone system and subversive
00:25:43.240 --> 00:25:48.000
technology, like anything I thought was cool. JACK: Joe s specialty is hardware hacking. As I
00:25:48.000 --> 00:25:51.640
sit and look around his workshop, it s abundantly clear, too. [Music] He s got
00:25:51.640 --> 00:25:55.680
drawers full of parts. On the table in front of me is something like sixty circuit boards,
00:25:55.680 --> 00:25:59.200
and he says he s building all these for a class. There s a fault injector over there
00:25:59.200 --> 00:26:04.080
and soldering irons and an oscilloscope. There s something beautiful about the low-level aspect of
00:26:04.080 --> 00:26:11.880
electronics. There are no English words that you can use to program a circuit. Like, you can't say
00:26:11.880 --> 00:26:17.920
if this, then do that or write out a for-loop . No; here, at the circuitry level, you're dealing
00:26:17.920 --> 00:26:22.480
with electrons going through some metal, and you have to understand the physics of how to
00:26:22.480 --> 00:26:26.773
manipulate and move these electrons in order to make it do the things you want to do. It
00:26:26.773 --> 00:26:31.600
s amazing to watch the advancements in the electronic world. It feels like every now
00:26:31.600 --> 00:26:36.280
and then we reach a limit of how fast a CPU can operate, and it s like, well, that s it,
00:26:36.280 --> 00:26:39.920
everyone. This is the max speed. There s no way that we're gonna go beyond this. You just can't
00:26:39.920 --> 00:26:45.040
put more transistors on a chip. But then some scientists discover parallel processing, where
00:26:45.040 --> 00:26:49.880
they can make it go faster by breaking a CPU up into two or three smaller CPUs. Because there are
00:26:49.880 --> 00:26:55.040
now two or three things getting processed at once, it s faster than processing one at a time.
00:26:55.040 --> 00:27:00.520
So, this allows us to have faster computers. Then when that limit is hit and we hit a max there,
00:27:00.520 --> 00:27:06.360
someone else discovers FinFET transistors, where they can build transistors upwards in a 3D sort
00:27:06.360 --> 00:27:11.560
of way, like little fins. This invention improves processing speed again, and we reach higher and
00:27:11.560 --> 00:27:15.920
higher of what technology can do. Just the other day I heard about CPUs that are starting to be
00:27:15.920 --> 00:27:20.760
made out of glass. There s no doubt that the last thirty years we ve seen some incredible
00:27:20.760 --> 00:27:26.080
explosions in electronics and their capabilities and our understanding of physics. It s just a
00:27:26.080 --> 00:27:32.160
really great space to put focus into as the world is constantly evolving, and it s exciting.
00:27:32.160 --> 00:27:37.840
JOE: In the second L0pht space, we had a hardware room and a software room. The hardware room was
00:27:37.840 --> 00:27:45.120
me, Brian Oblivion, and Space Rogue. We were into scanner radios. POCSAG was the data transmission
00:27:45.120 --> 00:27:51.680
of pagers, and it turned out it s still being used to some extent today in certain environments. We
00:27:51.680 --> 00:27:56.880
basically loved and I loved being able to listen in on anything that I could. So, in college it
00:27:56.880 --> 00:28:01.920
was cordless phones. At the L0pht at the time it was POCSAG, listening in to transmissions so you
00:28:01.920 --> 00:28:05.840
can kinda see what s going on in the world around you, and the scanner radio listening to the cops
00:28:05.840 --> 00:28:11.380
and air traffic and all of these things. It was just getting insight into what s happening.
00:28:11.380 --> 00:28:15.520
JACK: Joe built a little device that lets you snag pager text messages out of the
00:28:15.520 --> 00:28:19.720
air and see what they say. The messages weren't intended for him. He was just seeing them fly by,
00:28:19.720 --> 00:28:24.440
and his antenna would capture it and decode it. This was something that the L0pht was actually
00:28:24.440 --> 00:28:27.300
selling to try to make enough money just to pay the rent for the place.
00:28:27.300 --> 00:28:30.800
JOE: Back in the day, you'd see all sorts of stuff, 'cause that s how people communicated,
00:28:30.800 --> 00:28:37.240
is with pagers. There d be stuff about buy groceries for me, or we saw some relationship
00:28:37.240 --> 00:28:45.560
sexting kinda one-way; kind of like, I can't wait for you to get home . You d see hospital
00:28:45.560 --> 00:28:55.040
a lot of hospital traffic, a lot of EMS traffic and emergency medical things. Yeah,
00:28:55.040 --> 00:28:58.160
it was just really fun to do, and that made a little bit of money. That was actually my first
00:28:58.160 --> 00:29:04.320
circuit board that I had mass produced. Then we d get our orders; they d all be mail order. We
00:29:04.320 --> 00:29:10.987
get our mail every week. I d build the circuitry or Space Rogue would build some circuitry, and we
00:29:10.987 --> 00:29:15.840
d package it up. If they wanted a kit, we d just give them the components. It was just a way to do
00:29:15.840 --> 00:29:24.080
something, but that really that was a contribution that I could help make to the L0pht to bring some
00:29:24.080 --> 00:29:29.480
money in. Then that kinda proved the concept of like, oh, we could make a little bit of money on
00:29:29.480 --> 00:29:34.240
this. What if we could do it full-time? JACK: [Music] I might have to do a whole
00:29:34.240 --> 00:29:38.520
episode on the L0pht someday. It was quite a remarkable chapter in hacker
00:29:38.520 --> 00:29:42.180
history. I bet we could sit here for hours to just talk about what happened there.
00:29:42.180 --> 00:29:48.080
JOE: It became a company. For me, as this kid who s still even though I was starting to grow up,
00:29:48.080 --> 00:29:55.120
I m still like I said at the beginning, I still have this punk aspect to me where that wasn t an
00:29:55.120 --> 00:30:01.080
environment I wanted to be in, and I realized, okay, the specialness of it. That group is gone.
00:30:01.080 --> 00:30:05.640
I don't want to work for somebody else. I can't stand if somebody s telling me what to do. In
00:30:05.640 --> 00:30:12.440
2003 I split and have been independent ever since. There s good and bad that has come with that.
00:30:12.440 --> 00:30:16.580
JACK: After that, Joe ended up hosting a cable TV show.
00:30:16.580 --> 00:30:20.120
JOE: It was a show called Prototype This! and it was on Discovery Channel,
00:30:20.120 --> 00:30:25.920
and it was made by the same production company as Mythbusters. The idea was that this would be the
00:30:25.920 --> 00:30:31.040
next show after Mythbusters sort of sunsets and goes away, which of course we know they didn t,
00:30:31.040 --> 00:30:36.640
and it lasted another ten years, and spin-offs are still happening. But the concept of the show
00:30:36.640 --> 00:30:42.000
was having four engineers building ridiculous prototypes. I got an e-mail and it was from a
00:30:42.000 --> 00:30:46.080
casting company, and they're like, yeah, we're looking for engineers. That was actually they
00:30:46.080 --> 00:30:49.640
had talked to Make Magazine, which was that had just come out and that s a maker
00:30:49.640 --> 00:30:55.280
magazine talking about electronics and hobby electronics. I was on the technical advisory
00:30:55.280 --> 00:30:59.960
board for them when they first started. This company had contacted Make Magazine saying,
00:30:59.960 --> 00:31:07.000
hey, do you know any engineers that might want to be on TV? They already had selected a mechanical
00:31:07.000 --> 00:31:12.360
engineer, a machinist, and a software engineer. So, to complete this circle,
00:31:12.360 --> 00:31:17.720
they needed a hardware person. So, they said, oh, you should talk to Joe. So, they reached
00:31:17.720 --> 00:31:21.720
out to me and I got this e-mail, and I remember showing it to my wife. I read it; I was like,
00:31:21.720 --> 00:31:25.520
I don't know. I was like, I don't know if I want to be on TV. I showed it to her and she was like,
00:31:25.520 --> 00:31:32.080
are you crazy? This is you can do what you love to do on TV. So, I didn t really just like with
00:31:32.080 --> 00:31:39.440
the Senate, I didn t know the impact or the implications of what it would become. I didn
00:31:39.440 --> 00:31:45.080
t know how special that was. I was like, alright, fine, I ll do a little interview with them.
00:31:45.080 --> 00:31:50.440
So, I showed all the stuff, didn t really think anything of it, said bye . I was riding my bike
00:31:50.440 --> 00:31:55.720
back from San Francisco to San Diego, which is where we lived at the time, just as a solo
00:31:55.720 --> 00:32:01.120
bike trip for fun. It was my first experience of like, I want to try to figure out what the
00:32:01.120 --> 00:32:07.360
hell I m doing, a little bit of self-love. I m gonna do some a little meditation kinda thing
00:32:07.360 --> 00:32:13.400
before that was even a known thing. It was just some I just needed to escape, and which
00:32:13.400 --> 00:32:19.360
is funny because we had just gotten married and talking to my wife about this recently, I m like,
00:32:19.360 --> 00:32:24.160
I can't believe that I did that, that we got married and then I went to San Francisco for
00:32:24.160 --> 00:32:28.280
a conference and then I rode my I didn t see you for ten days or whatever 'cause I just was doing a
00:32:28.280 --> 00:32:33.960
little bit at a time. She s like, well, you needed it. Like, very supportive, which was amazing.
00:32:33.960 --> 00:32:37.920
So, did this bike ride. I didn t have a phone or anything. This was like,
00:32:37.920 --> 00:32:44.240
Nokia-phone era. I didn t even bring a phone 'cause I really wanted to isolate myself.
00:32:44.240 --> 00:32:50.680
Come back from the trip, turn on my computer, and there was five e-mails of like, we want
00:32:50.680 --> 00:32:55.200
you on the show. Can you call us back? Call us back. So, it s amazing that they even waited,
00:32:55.200 --> 00:32:59.240
because they could have easily been like, alright, he s not answering. Let s go to somebody else. We
00:32:59.240 --> 00:33:04.640
spent the next year and a half in a warehouse on Treasure Island in the Bay Area in San Francisco
00:33:04.640 --> 00:33:09.440
building ridiculous, giant prototypes. JACK: [Music] Prototype This! was pretty
00:33:09.440 --> 00:33:14.120
darn cool. My favorite episode is where they came up with an idea to make a never-ending
00:33:14.120 --> 00:33:18.200
water slide. Can you imagine riding a water slide for as long as you wanted?
00:33:18.200 --> 00:33:22.680
JOE: Everybody needs an endless water slide. It was we called it the Backyard Water Slide.
00:33:22.680 --> 00:33:26.680
The concept the show really was like, in the future, you could have one of these,
00:33:26.680 --> 00:33:29.840
even though we were just prototyping. JACK: What they did was they connected
00:33:29.840 --> 00:33:35.600
curved water slide parts into a donut-looking shape, like a big circle, and they stood
00:33:35.600 --> 00:33:40.400
that up so it looked like a big wheel, and then they put water in it and spun it. So,
00:33:40.400 --> 00:33:45.080
if you're inside, you're always sliding down the side as long as it keeps spinning.
00:33:45.080 --> 00:33:51.360
JOE: We did a firefighter episode where we built a high-tech firefighter pack, and we had a drone
00:33:51.360 --> 00:33:56.960
that would go and help rescue somebody lost at sea. We did a pizza-delivering robot, which
00:33:56.960 --> 00:34:01.320
now there are food-delivering robots. Maybe they ripped it off the show; I don't know. Or like
00:34:01.320 --> 00:34:07.400
JACK: You had one where you tried to ride on a bug robot, right?
00:34:07.400 --> 00:34:09.600
JOE: Oh, yeah. JACK: A giant bug-looking thing,
00:34:09.600 --> 00:34:11.114
and then you would ride on it. JOE: Yeah, yeah.
00:34:11.114 --> 00:34:12.914
JACK: That s not even out yet. JOE: No.
00:34:12.914 --> 00:34:14.560
JACK: Fast-forward twenty years, right? What is it?
00:34:14.560 --> 00:34:17.720
JOE: Cause that was a really hard problem. JACK: Or fifteen years ago, and they
00:34:17.720 --> 00:34:20.074
still don t have rideable robots. JOE: Yeah. I know. What s up with that?
00:34:20.074 --> 00:34:23.280
JACK: You were building them then.
00:00:00.000 --> 00:00:00.541
Episode 155 [START OF RECORDING]
00:00:00.541 --> 00:00:03.680
JACK: Sometimes the people I want to talk to on this show are so cool that I want to
00:00:03.680 --> 00:00:05.200
be friends with them. JOE: Check, check.
00:00:05.200 --> 00:00:06.874
JACK: Hey, I m recording. JOE: Cool. Alright, let me get this
00:00:06.874 --> 00:00:10.280
JACK: Where are we going? JOE: Let s go to the lair,
00:00:10.280 --> 00:00:13.520
where the magic happens. JACK: Joe Grand is someone who because
00:00:13.520 --> 00:00:17.840
we have so much in common, I wanted to visit him in person to try to make that extra connection.
00:00:17.840 --> 00:00:22.040
JOE: Alright, here we go. JACK: Whoa, my. Quite the
00:00:22.040 --> 00:00:23.514
place. JOE: Yeah.
00:00:23.514 --> 00:00:26.880
JACK: Display case here, and then you ve got a table here
00:00:26.880 --> 00:00:31.520
with a ton of projects you're working on. JOE: Yeah. So, this is kinda the main table
00:00:31.520 --> 00:00:36.880
that people probably see in videos. I have my computer, my oscilloscope that is my one
00:00:36.880 --> 00:00:42.520
piece of test equipment that I m always using power supply, and a couple different projects;
00:00:42.520 --> 00:00:47.480
some fault injections set up here. All these circuit boards are for a class I m teaching in a
00:00:47.480 --> 00:00:51.560
couple weeks. I have to get those prepared. JACK: He showed me around his office,
00:00:51.560 --> 00:00:56.080
and I think a better description for his office would be a workshop. It s really a place that
00:00:56.080 --> 00:01:00.360
sparks creativity wherever you look. It s full of gadgets and tools that just beckon you to
00:01:00.360 --> 00:01:07.200
pick something up and start building something. JOE: work bench with various pieces of circuitry
00:01:07.200 --> 00:01:10.200
and, yeah, a lot of display stuff also. JACK: [Music] You got your
00:01:10.200 --> 00:01:13.941
YouTube plaque on the wall. JOE: Got the YouTube plaque on the wall, yeah.
00:01:13.941 --> 00:01:17.720
JACK: That s cool. We found some comfy spots to plop down on and have a chat for a while,
00:01:17.720 --> 00:01:22.960
because I wanted to hear all the stories that Joe had. How many books have you written?
00:01:22.960 --> 00:01:29.240
JOE: That s a good question. (INTRO): [Intro music] These are
00:01:29.240 --> 00:01:47.100
true stories from the dark side of the internet. I m Jack Rhysider. This is Darknet Diaries.
00:01:47.100 --> 00:01:57.040
JACK: Hi. JOE: Hey. Hey again.
00:01:57.040 --> 00:01:59.520
JACK: Why don t we start with your name, and what do you do?
00:01:59.520 --> 00:02:04.200
JOE: My name is Joe Grand, and I m a hacker. JACK: [Music] After hanging out with Joe a few
00:02:04.200 --> 00:02:09.080
hours, I think, yeah, he absolutely is a hacker, and I think it s becoming increasingly rare to
00:02:09.080 --> 00:02:14.640
find a hacker in their forties. I think we all rebel as teenagers. We have a lot of that youthful
00:02:14.640 --> 00:02:18.840
energy and are waking up to the world for the first time, and we start ignoring the advice of
00:02:18.840 --> 00:02:23.440
our parents and listen to music which talks about the problems of the world, and we resonate with
00:02:23.440 --> 00:02:29.200
it, and we come of age listening to that stuff, and we either want change or to fight the system.
00:02:29.200 --> 00:02:34.560
For me and for Joe, our teenage rebelliousness began as skateboarders. Back then, there was a
00:02:34.560 --> 00:02:39.600
sense that skaters were counter-culture, not abiding by the rules or the norms of society.
00:02:39.600 --> 00:02:43.440
I remember the first time I fell in love with skaters. It was in middle school, and I saw them
00:02:43.440 --> 00:02:48.080
all outside laying in the grass during lunch. It was fall out, so there were a lot of leaves
00:02:48.080 --> 00:02:51.880
everywhere, and a few of them were throwing leaves at each other and they were rolling around in it.
00:02:51.880 --> 00:02:57.880
Then the bell rang and we all had to go to class. They all looked at each other and silently agreed
00:02:57.880 --> 00:03:02.880
not to brush themselves off and instead come to class as messy as possible, with leaves
00:03:02.880 --> 00:03:07.800
all through their hair and clothes and grass everywhere. One sat in front of me in my class,
00:03:07.800 --> 00:03:14.120
totally a mess, and he paid absolutely no mind to it. He acted as if nothing was going on different,
00:03:14.120 --> 00:03:18.560
and I loved that attitude. It enticed me. It drew me in to not care about how you look or
00:03:18.560 --> 00:03:23.120
any norms or expectations that people have on you, to just be your wild and goofy self.
00:03:23.120 --> 00:03:27.320
There s a sense of freedom in that, and that s when I started hanging out with the skaters,
00:03:27.320 --> 00:03:31.400
and I felt completely at home there. I remained a skater all through middle school
00:03:31.400 --> 00:03:36.080
and high school. Joe and I both got into computers around the same time, too, and for both of us,
00:03:36.080 --> 00:03:40.920
we had just great fun in seeing all that it could do, building things, breaking things, trying just
00:03:40.920 --> 00:03:47.520
about every possible thing that we heard about; bulletin boards, floppy discs, DOS, AOL, IRC, FTP,
00:03:47.520 --> 00:03:54.160
Unix, Windows, programming, electronics, circuits. It was simply great fun to sit down Saturday night
00:03:54.160 --> 00:03:59.120
at a computer and just try to do something new with it, like to try out a new operating system or
00:03:59.120 --> 00:04:04.680
compile a kernel from scratch. We would absolutely try what other people tried before us, things that
00:04:04.680 --> 00:04:11.080
have tutorials for them, but then we d soon find ourselves in areas where no tutorials exist for
00:04:11.080 --> 00:04:16.560
this. No manuals explain what to do here. We were off the map, explorers of the digital
00:04:16.560 --> 00:04:21.440
world, and it felt like we were trying to get computers to do things they weren't intended to
00:04:21.440 --> 00:04:27.240
do, which in my opinion is the definition of a hacker, to push beyond the roadblocks that
00:04:27.240 --> 00:04:33.680
stop you from doing something and to try to get it done anyway. Living in that space is hard, though.
00:04:33.680 --> 00:04:38.040
It s like you're walking in the dark and you're constantly bumping into things. You feel stupid
00:04:38.040 --> 00:04:42.960
for not knowing what to do and just failing again and again, and it s frustrating when it doesn't
00:04:42.960 --> 00:04:49.320
work, and you give up. As a youth, you don t quite know that what you're doing is different than how
00:04:49.320 --> 00:04:53.920
other people are using these tools, so it just feels normal to stumble and struggle with whatever
00:04:53.920 --> 00:04:58.840
technology you have. You get used to that. [Music] But as you learn more about the world
00:04:58.840 --> 00:05:04.800
and grow up, you find your place in it and you try to be good in your domain of expertise. You want
00:05:04.800 --> 00:05:11.440
to find a place where you feel comfortable and confident. It s uncomfortable and hard to learn
00:05:11.440 --> 00:05:16.760
things without instruction manuals or YouTube videos to teach you. So, you wait for others
00:05:16.760 --> 00:05:22.000
to learn the things before you so that they could teach you, which means you lose your edge. You're
00:05:22.000 --> 00:05:26.680
not on the frontier of knowledge anymore. You're not pushing the systems beyond their intended
00:05:26.680 --> 00:05:33.400
purpose. As we get older, we lose that drive and instead just become better at following the rules,
00:05:33.400 --> 00:05:38.880
and as you grow older, you stop rebelling, too, maybe because you're just tired or because you
00:05:38.880 --> 00:05:44.080
just accept that life is going to be unfair. You realize that you have responsibilities, too,
00:05:44.080 --> 00:05:50.800
so you can't afford to get in trouble anymore. You lose that punk side of yourself. But Joe never
00:05:50.800 --> 00:05:57.840
lost that. Joe never turned his curiosity down or off. Joe learned how to feel comfortable walking
00:05:57.840 --> 00:06:04.000
in the dark, bumping into things, failing again and again. In fact, he likes that place. He loves
00:06:04.000 --> 00:06:08.480
that chase of finding the answer somewhere in the muck that nobody else has ever found before,
00:06:08.480 --> 00:06:13.440
that place of pushing things beyond their intended use. He ignores people telling him
00:06:13.440 --> 00:06:18.280
that s impossible . He pushes through roadblocks and just acts like they don t exist. While
00:06:18.280 --> 00:06:24.360
most of us have grown tired of inventing or finding creative ways to solve novel problems,
00:06:24.360 --> 00:06:30.080
Joe has more energy than ever to dance and play in that space, and it s amazing to watch him work.
00:06:30.080 --> 00:06:38.000
JOE: I still have this idealistic view of my little bubble of what a hacker is, and to me,
00:06:38.000 --> 00:06:43.720
it basically is kind of somebody who s questioning the system and curious about
00:06:43.720 --> 00:06:49.280
technology and wanting to learn things and bypassing security. Really, I grew up even
00:06:49.280 --> 00:06:54.360
before I knew what a hacker was, I was pushing people s buttons. I was causing trouble. I had
00:06:54.360 --> 00:06:58.920
this mischievous side, and a hacker JACK: That s what I was gonna ask you.
00:06:58.920 --> 00:07:03.760
As a hacker, have you ever been arrested? JOE: I have been arrested, and it was a great
00:07:03.760 --> 00:07:11.440
lesson and a great experience. It did change some of my behavior, but the hacker mindset
00:07:11.440 --> 00:07:18.480
and that ethos is still with me, and it s been the same since I was a kid. I feel the same way
00:07:18.480 --> 00:07:26.240
that I felt then as a hacker and how I fit into the world and into the society that I do now,
00:07:26.240 --> 00:07:32.080
right? So, even though I got arrested and that changed my perspective a little bit,
00:07:32.080 --> 00:07:39.400
changed my behavior so I wouldn't get arrested again, my mindset is the same, and I don't know
00:07:39.400 --> 00:07:44.280
but I have a sense of like that that s changing with a lot of people, where somebody of my age,
00:07:44.280 --> 00:07:48.720
of my generation who grew up with computers, has maybe a different mindset than people who got into
00:07:48.720 --> 00:07:58.880
it later. I don't really know. I just know how I feel, and I m very kind of rigid in my beliefs as
00:07:58.880 --> 00:08:04.640
a hacker and my responsibilities as a hacker. JACK: In 1982, he got some Atari equipment when he
00:08:04.640 --> 00:08:08.920
was like, eight, nine, ten. He was just mesmerized by the world of electronics. This eventually led
00:08:08.920 --> 00:08:12.880
him to computers, and he got a modem. He could dial out to bulletin board systems and reach
00:08:12.880 --> 00:08:17.360
other computers somewhere else in the world. JOE: Which ultimately led me to hook up with
00:08:17.360 --> 00:08:22.560
some guys that I had met on some bulletin board sytems and was part of a group called
00:08:22.560 --> 00:08:29.800
Renegade Legion. [Music] We wrote some early text files on some phone phreaking, credit card fraud,
00:08:29.800 --> 00:08:34.760
how to break into the CBI credit bureau and pull credit records and then get actual credit cards,
00:08:34.760 --> 00:08:43.440
and things that as a kid didn t seem bad. It was a cool thing. I mean, even now, I don't yes,
00:08:43.440 --> 00:08:50.080
it s a crime. Do I feel bad about it? No. Has it happened to me? Dozens of times my credit
00:08:50.080 --> 00:08:55.800
card has been stolen. It s a fact of life now. JACK: Back then, to hack a system would sometimes
00:08:55.800 --> 00:09:00.640
simply be telling your computer to dial a phone number and it might let you into that system
00:09:00.640 --> 00:09:05.080
without a password, or maybe you could just mash the keyboard and it would let you in. Hacking
00:09:05.080 --> 00:09:09.840
was a lot simpler then, but there really weren't instructions on how to do it. You were kind of on
00:09:09.840 --> 00:09:13.560
your own to discover what was out there. JOE: But yeah, there so, getting into those
00:09:13.560 --> 00:09:19.280
systems, the process basically was like and this was when I was fourteen, fifteen at this point of
00:09:19.280 --> 00:09:24.280
like, alright, let s look through the White Pages, which was the book of everybody in your area.
00:09:24.280 --> 00:09:30.880
Let s find the doctor, let s find the dentist, look up their name in the credit bureau system,
00:09:30.880 --> 00:09:34.520
see what their credit was 'cause you could see their name, their social security number,
00:09:34.520 --> 00:09:39.640
credit rating, what credit cards they had pick the one that had a high credit,
00:09:39.640 --> 00:09:42.680
get all that information, call the credit card company, give them what they needed, and say,
00:09:42.680 --> 00:09:46.440
hey, I m doctor whatever. I m on vacation. Can you I lost my card. Can you send me another
00:09:46.440 --> 00:09:50.840
card? They d send you a new physical card and you d go use it. But that was later on.
00:09:50.840 --> 00:09:55.640
The earlier days, there was a lot of this curious exploration because we would war dial. We would
00:09:55.640 --> 00:10:00.920
take a prefix and say, okay just like in WarGames when David Lightman was trying to find out his
00:10:00.920 --> 00:10:06.000
school computer, I figured if our school computer was connected, it would be within that range. So,
00:10:06.000 --> 00:10:11.600
doing those war-dialing sessions overnight, of course, so my parents wouldn't pick up the
00:10:11.600 --> 00:10:15.640
phone and hear everything, because at that point you still had a automatic you could do automatic
00:10:15.640 --> 00:10:20.840
dialing, but it was still everybody was sharing a single phone line in the house. Then you d wake
00:10:20.840 --> 00:10:25.240
up to a list of phone numbers, and you're trying those and you'd never know what it was. It was
00:10:25.240 --> 00:10:31.600
like this kind of treasure hunt. JACK: [Music]
00:10:31.600 --> 00:10:37.160
Joe grew up in Boston, Massachusetts. JOE: So, as part of joining Renegade Legion so,
00:10:37.160 --> 00:10:41.880
a bunch of teenagers doing stuff online and whatever we thought it would be cool
00:10:41.880 --> 00:10:47.520
for everybody to meet up in person during all of our winter break. Most of us were in high school.
00:10:47.520 --> 00:10:53.400
Some of the guys were a little bit older. One of the guys, whose name was Dr. Death,
00:10:53.400 --> 00:10:58.480
was in Michigan, and that was kind of a central point where everybody else was coming from. So,
00:10:58.480 --> 00:11:02.680
on one of our alliance teleconferences where we re all talking on the phone big party lines and,
00:11:02.680 --> 00:11:06.440
of course, being billed to somebody else, someone s like, hey, we should all get together. So,
00:11:06.440 --> 00:11:11.120
we decided during our school break, everybody meet up at Dr. Death s house, and we d hang
00:11:11.120 --> 00:11:18.040
out. He had an arcade game and a pool table. My parents talked to his parents and they're like,
00:11:18.040 --> 00:11:23.120
okay, this seems like a stable household. So, they actually let me fly to Michigan on my own,
00:11:23.120 --> 00:11:27.960
meet up with all these other hackers. Remember that this was already eight years after I had
00:11:27.960 --> 00:11:33.760
been using the computer. My parents knew what I was up to, but they didn t really know. So, we
00:11:33.760 --> 00:11:37.920
all got together and hung out, and then somebody had an idea of like, hey, let s break into the
00:11:37.920 --> 00:11:43.800
telephone company so we can get some hardware and get some documentation. At the time, the internet
00:11:43.800 --> 00:11:50.520
was starting to kinda be a thing, but not really. This was 92. So, really, it was hackers against
00:11:50.520 --> 00:11:58.560
the phone system. Ma Bell, New England Telephone, 9X Michigan Bell, whatever, Pacific Bell,
00:11:58.560 --> 00:12:05.840
all of those companies, that was the target of phone phreaking, exploring the phone network.
00:12:05.840 --> 00:12:12.120
That was for us, that was kind of the Holy Grail. We went to the hardware store and bought some big
00:12:12.120 --> 00:12:17.560
bolt cutters and some rubber gloves it was like a really bad movie and bought all the equipment
00:12:17.560 --> 00:12:22.720
to break into this place; some automatic center punches to break the windows. So, we basically
00:12:22.720 --> 00:12:27.360
went to the Michigan Bell telephone facility which was down the street from this guy s house,
00:12:27.360 --> 00:12:33.240
and went in and cut through the fence, pulled the fence back. I had this jacket at the time
00:12:33.240 --> 00:12:38.000
that I would wear every single day, and it tore a little hole in the shoulder on my way in. So,
00:12:38.000 --> 00:12:43.360
that was sort of this mark of pride after that. So, we didn t break into the building itself,
00:12:43.360 --> 00:12:48.480
but we smashed the windows of the vans that had all of the in-field equipment.
00:12:48.480 --> 00:12:53.560
JACK: What were you looking for? JOE: Documentation, manuals, hardware,
00:12:53.560 --> 00:12:58.080
telephone test equipment, things that other phone phreakers, other hackers didn t have,
00:12:58.080 --> 00:13:04.320
and took as much stuff as we possibly could. I think there were six of us. One of the guys
00:13:04.320 --> 00:13:10.360
was a larger fellow, so he was our lookout, and he was listening to the scanner radio to see when the
00:13:10.360 --> 00:13:16.920
police were called. Which, it turns out that if you use a scanner radio during committing a crime,
00:13:16.920 --> 00:13:18.920
that s an additional crime. JACK: Really?
00:13:18.920 --> 00:13:22.440
JOE: Yeah, at least at the time. I didn t know that. Especially a scanner radio there was no
00:13:22.440 --> 00:13:27.120
serial number on it 'cause it was scraped off because it was stolen. So, yeah, he ended up
00:13:27.120 --> 00:13:34.160
getting caught. The rest of us got away, but what happened is as we pulled up, next to the telephone
00:13:34.160 --> 00:13:38.360
facility was a park, and there was a nosy neighbor that was like, hey, there was a bunch of rowdy
00:13:38.360 --> 00:13:45.240
kids hanging out in the park. So, they called the police just because they thought kids were hanging
00:13:45.240 --> 00:13:51.000
out after curfew or something. By the time the cops showed up, they had the one guy there. He
00:13:51.000 --> 00:13:55.800
got caught in the car with the scanner radio. The police report when this guy called in said there
00:13:55.800 --> 00:14:00.440
were multiple kids. So, they're basically like, where are your friends? He flipped and was like,
00:14:00.440 --> 00:14:04.720
yeah, there was six of us or however many. We had all gotten home by that time or back to Dr.
00:14:04.720 --> 00:14:10.640
Death s house, and we're like, oh my god, where s this other guy? It turns out he got arrested. Then
00:14:10.640 --> 00:14:15.200
the next day, we all had to turn ourselves in. JACK: This was a pretty awful experience for Joe s
00:14:15.200 --> 00:14:19.840
parents, who had to fly to another state to rescue their son from juvenile detention. I could only
00:14:19.840 --> 00:14:23.280
imagine it s something like the movie Home Alone, where the mom was trying desperately to get home
00:14:23.280 --> 00:14:28.080
to her son. Luckily for him, because he was the youngest of the bunch, they let him off without a
00:14:28.080 --> 00:14:33.860
charge, but the others weren't so lucky. A bunch of them got felonies. Some served jail time.
00:14:33.860 --> 00:14:41.120
JOE: One of our other guys was already under I don't know if it was indictment or investigation
00:14:41.120 --> 00:14:46.240
or something by the Secret Service for some other phone phreaking stuff that we had done as a group,
00:14:46.240 --> 00:14:54.640
as Renegade Legion, and he ended up dying by suicide. That was a real eye-opener of like,
00:14:54.640 --> 00:14:59.040
holy shit, a law-breaker just killed himself over getting arrested?
00:14:59.040 --> 00:15:03.680
JACK: His parents were pretty mad and told him, look, you either need to get a job or take up
00:15:03.680 --> 00:15:08.720
a sport. He didn t want to get a job, so he joined the track team at school and started
00:15:08.720 --> 00:15:15.440
doing a lot of running. This gave him a group of normal friends, not rebels, not skaters,
00:15:15.440 --> 00:15:22.160
not hackers, just normal people. After this scare with the police and running track,
00:15:22.160 --> 00:15:27.880
he did straighten up a bit, which is how he got to join the L0pht. He had to actually tone down his
00:15:27.880 --> 00:15:33.600
rebelliousness to join this hacker space. JOE: So, L0pht or L0pht Heavy Industries was
00:15:33.600 --> 00:15:39.800
really just a safe space, possibly the first hacker space in the US as an organized space,
00:15:39.800 --> 00:15:46.480
and it really was just a clubhouse for seven Boston-area hackers to hang out and explore and
00:15:46.480 --> 00:15:52.120
have a place to play with technology. JACK: What did the space look like?
00:15:52.120 --> 00:15:57.640
JOE: It was very so, if you imagine a cyberpunk movie maybe Hackers;
00:15:57.640 --> 00:16:05.600
maybe the Hackers movie is probably the closest to sort of what it looked like, but it was in it
00:16:05.600 --> 00:16:15.720
was an artist loft space. So, it was a one one big room with old wood floors. There were PCs; Apple,
00:16:15.720 --> 00:16:24.560
Apple IIs, Macs. We had a VAX 11/780, I think. JACK: The L0pht was a magical place with about
00:16:24.560 --> 00:16:29.360
eight members. It was magical because computers weren't that popular yet.
00:16:29.360 --> 00:16:34.360
So, for there to be a space with electronics and computers, it was really ahead of its time. They
00:16:34.360 --> 00:16:39.640
were the weirdo nerds into that geeky stuff. Little did they know, the whole world would
00:16:39.640 --> 00:16:44.360
become weirdo nerds along with them, because we were all destined to buy computers and
00:16:44.360 --> 00:16:48.640
electronics in the coming decades. JOE: I remember seeing Count Zero give
00:16:48.640 --> 00:16:53.680
talks about stuff that we found from the trash or other things that he had been researching,
00:16:53.680 --> 00:16:59.640
and seeing his passion of sharing information in that way, of like, you don t need to hoard
00:16:59.640 --> 00:17:03.608
everything and as kids, we would hoard stuff but then we would trade bits and pieces, 'cause that
00:17:03.608 --> 00:17:09.760
s what would give you this power. But to see him just open up the kimono of like, here s everything
00:17:09.760 --> 00:17:14.360
I learned and maybe somebody can take a piece of that and do something else with it, I thought
00:17:14.360 --> 00:17:20.600
that was such a learning moment for me, and that when I started giving talks as well, it was like,
00:17:20.600 --> 00:17:25.880
alright, if I m gonna talk about something, I want to share as much as I possibly can,
00:17:25.880 --> 00:17:30.640
not to brag about it but to empower somebody else to say, oh, that s cool; I want to try that or I
00:17:30.640 --> 00:17:37.400
want to build upon this or maybe I can use this piece of that on something else. Once I learned
00:17:37.400 --> 00:17:44.080
that, everything changed [Music] because it was all about empowering this community to grow,
00:17:44.080 --> 00:17:47.920
and I would learn from other people and you'd learn from they would learn from somebody else and
00:17:47.920 --> 00:17:54.960
share that with you. So, it was this very communal sort of knowledge growth, I guess you could say,
00:17:54.960 --> 00:18:00.400
and that s the main thing I learned from the L0pht, and that for sure is of everything that
00:18:00.400 --> 00:18:07.480
I ve learned, that has stuck with me the most. JACK: L0pht was legendary. It was kinda
00:18:07.480 --> 00:18:12.720
like a research group. They found a lot of vulnerabilities in computers, and they released
00:18:12.720 --> 00:18:18.200
such tools like L0phtCrack, which can sometimes crack Windows passwords. They d publish new ideas
00:18:18.200 --> 00:18:23.400
of how to break systems or hack things. In fact, they were so legendary that they ended up going to
00:18:23.400 --> 00:18:29.080
Washington D.C. to testify before the Senate. JOE: I remember they called us up to the stand.
00:18:29.080 --> 00:18:34.240
We sit there, and there s all this so, we see the senators in front of us, but right
00:18:34.240 --> 00:18:40.160
below them facing us was this row of media. We sat down; it was just like, camera flash,
00:18:40.160 --> 00:18:45.520
camera flash. It was like the paparazzi, because it had never happened before. You
00:18:45.520 --> 00:18:49.760
never had hackers talking to the government. SENATE: We re joined today by the seven members
00:18:49.760 --> 00:18:57.080
of the L0pht hacker thinktank in Cambridge, Massachusetts. Due to the sensitivity of the
00:18:57.080 --> 00:19:09.160
work done at the L0pht, they ll be using their hacker names of Mudge, Weld, Brian Oblivion,
00:19:09.160 --> 00:19:17.160
Kingpin, Space Rogue, Tan, and Stefan. JACK: Joe s hacker name is Kingpin,
00:19:17.160 --> 00:19:21.640
and this was back in 1998. JOE: Morning. My name is Kingpin. I
00:19:21.640 --> 00:19:27.040
am the youngest member of the L0pht and one of the electrical engineers and hardware hackers.
00:19:27.040 --> 00:19:31.600
While some of the L0pht members concentrate on software programming, I work with hardward design
00:19:31.600 --> 00:19:37.440
and implementation of electronic circuits. My interests include embedded system design,
00:19:37.440 --> 00:19:42.280
surveillance and counter-surveillance tools, and wireless data transmissions. My current
00:19:42.280 --> 00:19:46.600
research project involves experimentation with the monitoring and eavesdropping of stray
00:19:46.600 --> 00:19:52.680
electromagnetic fields from computer terminals, otherwise known as TEMPEST monitoring.
00:19:52.680 --> 00:19:57.960
Using low-cost electronic equipment, one can capture the contents of computer screens from more
00:19:57.960 --> 00:20:04.080
than two hundred meters away, possibly gaining passwords and other sensitive information. The
00:20:04.080 --> 00:20:08.400
phenomenon of TEMPEST monitoring has been known to the industry for decades, but there is not
00:20:08.400 --> 00:20:13.920
much unclassified information available on how to both capture the emissions and also protect
00:20:13.920 --> 00:20:18.400
oneself from becoming an eavesdropping victim. My research will not only help me learn about
00:20:18.400 --> 00:20:22.960
the monitoring technology; it will enable me to educate others to help them protect their
00:20:22.960 --> 00:20:26.520
computer systems from prying eyes. JACK: Their message was simple;
00:20:26.520 --> 00:20:32.960
the internet is not as secure as you think, and we should embrace and welcome hackers
00:20:32.960 --> 00:20:38.720
to show us where the vulnerabilities are. SENATE: It s probably appropriate that gentlemen
00:20:38.720 --> 00:20:44.440
such as yourself were the ones who come forward and demonstrate that the emperor has no clothes,
00:20:44.440 --> 00:20:48.200
so we appreciate your coming here, especially in light of the fact that the Washington Post
00:20:48.200 --> 00:20:55.280
describe you as rockstars of the computer hacking elite. I am informed that you think
00:20:55.280 --> 00:20:59.800
that within thirty minutes, the seven of you could make the internet unusable for
00:20:59.800 --> 00:21:03.040
the entire nation. Is that correct? L0PHT: That s correct. Actually,
00:21:03.040 --> 00:21:07.800
one of us with just a few packets. JACK: How punk is that, to be this
00:21:07.800 --> 00:21:11.300
group of hackers coming up to the government saying, we could take down the internet?
00:21:11.300 --> 00:21:20.080
SENATE: Somebody had referred to you as rockstars of the new computer age. It s probably not what
00:21:20.080 --> 00:21:25.560
you came to hear, but actually, I think you're performing an act of very good citizenship,
00:21:25.560 --> 00:21:30.760
and I appreciate it. I d compare you I hope you don t mind that I m not gonna call you
00:21:30.760 --> 00:21:35.280
rockstars. I d compare you more to Rachel Carson, who sounded some early warnings
00:21:35.280 --> 00:21:39.960
about what environmental pollution was doing to the environment. [Music] In the defense context,
00:21:39.960 --> 00:21:46.210
you may be modern-day Paul Reveres, except in this case, it s not the British coming. We don
00:21:46.210 --> 00:21:51.920
t know who s coming; that s the problem. JOE: By that time in 98, a lot of the software
00:21:51.920 --> 00:21:56.560
guys had found vulnerabilities in Microsoft and they had actually had meetings with Microsoft at
00:21:56.560 --> 00:22:00.680
dinners where Microsoft s like, ah, we don t think that s gonna be a problem. Nobody s gonna exploit
00:22:00.680 --> 00:22:07.040
that. So, we would release exploit code. We were very early, if not the first, to have this sort of
00:22:07.040 --> 00:22:13.520
discussion of full disclosure or what would now be called coordinated disclosure or, in quotes,
00:22:13.520 --> 00:22:17.720
responsible disclosure . You know, how much time do you give the vendor to fix the problem?
00:22:17.720 --> 00:22:22.120
Do you trust that the vendor s gonna fix it? JACK: One of the things L0pht became known for is
00:22:22.120 --> 00:22:27.080
pioneering responsible disclosure. The problem was that hackers were looked at as criminals,
00:22:27.080 --> 00:22:32.120
hoodlums, untrustworthy, and L0pht thought of themselves as hackers, but didn t see
00:22:32.120 --> 00:22:36.760
themselves as hoodlums. They're just trying to warn the world of the problems they found,
00:22:36.760 --> 00:22:41.920
and they wanted people to fix it. They were here to help. But as they told companies about the bugs
00:22:41.920 --> 00:22:46.080
they found, the companies often misunderstood and thought these guys were there to cause trouble.
00:22:46.080 --> 00:22:50.400
So, L0pht was like, look, what do we have to do so you ll understand that we're here to help,
00:22:50.400 --> 00:22:56.080
not hurt you? That s where responsible disclosure came about. Companies learned that hackers can be
00:22:56.080 --> 00:23:01.040
very helpful at identifying vulnerabilities, and it s way better to work with them than to think of
00:23:01.040 --> 00:23:09.480
them as adversaries. So, I picture the old, old, old hacker spaces to not have many screens, and
00:23:09.480 --> 00:23:17.040
mostly just circuit boards you're looking at and maybe some visual aspect. I imagine you falling
00:23:17.040 --> 00:23:22.240
in love with this electronics aspect of it; the hardware components, how these things work.
00:23:22.240 --> 00:23:26.960
You can send signals here and make it do that, and all this kinda cool stuff. There s chips
00:23:26.960 --> 00:23:35.240
that have all this really cool CMOS in it. Then computers went in a direction of screens and
00:23:35.240 --> 00:23:42.440
programming languages and all this software. Did you go in that direction or did you say, no, no,
00:23:42.440 --> 00:23:46.680
no, I think you all need this hardware. I m gonna stay with the hardware. Or,
00:23:46.680 --> 00:23:51.200
how did you know that you were going to take a different route and not go
00:23:51.200 --> 00:23:54.680
with the software side of it, but instead you stayed on the hardware? Was that in
00:23:54.680 --> 00:24:00.160
L0pht that you kinda made that diversion? JOE: No. I had been as soon as I got attracted
00:24:00.160 --> 00:24:08.440
to computers, I was also getting attracted to electronics. I have an older brother,
00:24:08.440 --> 00:24:15.160
and he was more of an audiophile kind of person. He had radio receivers and things, but he had a
00:24:15.160 --> 00:24:18.960
lot of electronics that he would take apart and he would fix and put different capacitors in
00:24:18.960 --> 00:24:26.360
and everything, and he had this junk bin full of circuit boards. I just loved that tangible side of
00:24:26.360 --> 00:24:31.840
things, which to me makes sense of like, okay, I m using a computer, and the computer really is a
00:24:31.840 --> 00:24:41.360
very simple type of embedded system or electronic system like these other circuit boards, but I just
00:24:41.360 --> 00:24:46.360
loved the physical thing. I would start building projects out of magazines. There was a lot of
00:24:46.360 --> 00:24:51.440
hobbyist electronics magazines at the time. There were a couple people a couple text files
00:24:51.440 --> 00:24:58.560
you could read about of people making some interesting even this was pre-red box stuff,
00:24:58.560 --> 00:25:05.480
but different types of tone-dialers, blue boxes, and other telephone-related electronics. So,
00:25:05.480 --> 00:25:14.040
I started building things and I started building my own things. I knew from an early age you
00:25:14.040 --> 00:25:18.600
couldn't have a career as a hacker. When everybody would always say, what do you want to be when
00:25:18.600 --> 00:25:24.640
you grow up? and I always knew I m gonna be an engineer. I m gonna build electronics. So, that
00:25:24.640 --> 00:25:30.560
was something where it was a parallel path to the hacking, was building things, and the electronics
00:25:30.560 --> 00:25:38.000
that I was building were things like stun guns and some laser-listening systems to spy on rooms and
00:25:38.000 --> 00:25:43.240
kind of mischievous hardware, but things that I could use for the telephone system and subversive
00:25:43.240 --> 00:25:48.000
technology, like anything I thought was cool. JACK: Joe s specialty is hardware hacking. As I
00:25:48.000 --> 00:25:51.640
sit and look around his workshop, it s abundantly clear, too. [Music] He s got
00:25:51.640 --> 00:25:55.680
drawers full of parts. On the table in front of me is something like sixty circuit boards,
00:25:55.680 --> 00:25:59.200
and he says he s building all these for a class. There s a fault injector over there
00:25:59.200 --> 00:26:04.080
and soldering irons and an oscilloscope. There s something beautiful about the low-level aspect of
00:26:04.080 --> 00:26:11.880
electronics. There are no English words that you can use to program a circuit. Like, you can't say
00:26:11.880 --> 00:26:17.920
if this, then do that or write out a for-loop . No; here, at the circuitry level, you're dealing
00:26:17.920 --> 00:26:22.480
with electrons going through some metal, and you have to understand the physics of how to
00:26:22.480 --> 00:26:26.773
manipulate and move these electrons in order to make it do the things you want to do. It
00:26:26.773 --> 00:26:31.600
s amazing to watch the advancements in the electronic world. It feels like every now
00:26:31.600 --> 00:26:36.280
and then we reach a limit of how fast a CPU can operate, and it s like, well, that s it,
00:26:36.280 --> 00:26:39.920
everyone. This is the max speed. There s no way that we're gonna go beyond this. You just can't
00:26:39.920 --> 00:26:45.040
put more transistors on a chip. But then some scientists discover parallel processing, where
00:26:45.040 --> 00:26:49.880
they can make it go faster by breaking a CPU up into two or three smaller CPUs. Because there are
00:26:49.880 --> 00:26:55.040
now two or three things getting processed at once, it s faster than processing one at a time.
00:26:55.040 --> 00:27:00.520
So, this allows us to have faster computers. Then when that limit is hit and we hit a max there,
00:27:00.520 --> 00:27:06.360
someone else discovers FinFET transistors, where they can build transistors upwards in a 3D sort
00:27:06.360 --> 00:27:11.560
of way, like little fins. This invention improves processing speed again, and we reach higher and
00:27:11.560 --> 00:27:15.920
higher of what technology can do. Just the other day I heard about CPUs that are starting to be
00:27:15.920 --> 00:27:20.760
made out of glass. There s no doubt that the last thirty years we ve seen some incredible
00:27:20.760 --> 00:27:26.080
explosions in electronics and their capabilities and our understanding of physics. It s just a
00:27:26.080 --> 00:27:32.160
really great space to put focus into as the world is constantly evolving, and it s exciting.
00:27:32.160 --> 00:27:37.840
JOE: In the second L0pht space, we had a hardware room and a software room. The hardware room was
00:27:37.840 --> 00:27:45.120
me, Brian Oblivion, and Space Rogue. We were into scanner radios. POCSAG was the data transmission
00:27:45.120 --> 00:27:51.680
of pagers, and it turned out it s still being used to some extent today in certain environments. We
00:27:51.680 --> 00:27:56.880
basically loved and I loved being able to listen in on anything that I could. So, in college it
00:27:56.880 --> 00:28:01.920
was cordless phones. At the L0pht at the time it was POCSAG, listening in to transmissions so you
00:28:01.920 --> 00:28:05.840
can kinda see what s going on in the world around you, and the scanner radio listening to the cops
00:28:05.840 --> 00:28:11.380
and air traffic and all of these things. It was just getting insight into what s happening.
00:28:11.380 --> 00:28:15.520
JACK: Joe built a little device that lets you snag pager text messages out of the
00:28:15.520 --> 00:28:19.720
air and see what they say. The messages weren't intended for him. He was just seeing them fly by,
00:28:19.720 --> 00:28:24.440
and his antenna would capture it and decode it. This was something that the L0pht was actually
00:28:24.440 --> 00:28:27.300
selling to try to make enough money just to pay the rent for the place.
00:28:27.300 --> 00:28:30.800
JOE: Back in the day, you'd see all sorts of stuff, 'cause that s how people communicated,
00:28:30.800 --> 00:28:37.240
is with pagers. There d be stuff about buy groceries for me, or we saw some relationship
00:28:37.240 --> 00:28:45.560
sexting kinda one-way; kind of like, I can't wait for you to get home . You d see hospital
00:28:45.560 --> 00:28:55.040
a lot of hospital traffic, a lot of EMS traffic and emergency medical things. Yeah,
00:28:55.040 --> 00:28:58.160
it was just really fun to do, and that made a little bit of money. That was actually my first
00:28:58.160 --> 00:29:04.320
circuit board that I had mass produced. Then we d get our orders; they d all be mail order. We
00:29:04.320 --> 00:29:10.987
get our mail every week. I d build the circuitry or Space Rogue would build some circuitry, and we
00:29:10.987 --> 00:29:15.840
d package it up. If they wanted a kit, we d just give them the components. It was just a way to do
00:29:15.840 --> 00:29:24.080
something, but that really that was a contribution that I could help make to the L0pht to bring some
00:29:24.080 --> 00:29:29.480
money in. Then that kinda proved the concept of like, oh, we could make a little bit of money on
00:29:29.480 --> 00:29:34.240
this. What if we could do it full-time? JACK: [Music] I might have to do a whole
00:29:34.240 --> 00:29:38.520
episode on the L0pht someday. It was quite a remarkable chapter in hacker
00:29:38.520 --> 00:29:42.180
history. I bet we could sit here for hours to just talk about what happened there.
00:29:42.180 --> 00:29:48.080
JOE: It became a company. For me, as this kid who s still even though I was starting to grow up,
00:29:48.080 --> 00:29:55.120
I m still like I said at the beginning, I still have this punk aspect to me where that wasn t an
00:29:55.120 --> 00:30:01.080
environment I wanted to be in, and I realized, okay, the specialness of it. That group is gone.
00:30:01.080 --> 00:30:05.640
I don't want to work for somebody else. I can't stand if somebody s telling me what to do. In
00:30:05.640 --> 00:30:12.440
2003 I split and have been independent ever since. There s good and bad that has come with that.
00:30:12.440 --> 00:30:16.580
JACK: After that, Joe ended up hosting a cable TV show.
00:30:16.580 --> 00:30:20.120
JOE: It was a show called Prototype This! and it was on Discovery Channel,
00:30:20.120 --> 00:30:25.920
and it was made by the same production company as Mythbusters. The idea was that this would be the
00:30:25.920 --> 00:30:31.040
next show after Mythbusters sort of sunsets and goes away, which of course we know they didn t,
00:30:31.040 --> 00:30:36.640
and it lasted another ten years, and spin-offs are still happening. But the concept of the show
00:30:36.640 --> 00:30:42.000
was having four engineers building ridiculous prototypes. I got an e-mail and it was from a
00:30:42.000 --> 00:30:46.080
casting company, and they're like, yeah, we're looking for engineers. That was actually they
00:30:46.080 --> 00:30:49.640
had talked to Make Magazine, which was that had just come out and that s a maker
00:30:49.640 --> 00:30:55.280
magazine talking about electronics and hobby electronics. I was on the technical advisory
00:30:55.280 --> 00:30:59.960
board for them when they first started. This company had contacted Make Magazine saying,
00:30:59.960 --> 00:31:07.000
hey, do you know any engineers that might want to be on TV? They already had selected a mechanical
00:31:07.000 --> 00:31:12.360
engineer, a machinist, and a software engineer. So, to complete this circle,
00:31:12.360 --> 00:31:17.720
they needed a hardware person. So, they said, oh, you should talk to Joe. So, they reached
00:31:17.720 --> 00:31:21.720
out to me and I got this e-mail, and I remember showing it to my wife. I read it; I was like,
00:31:21.720 --> 00:31:25.520
I don't know. I was like, I don't know if I want to be on TV. I showed it to her and she was like,
00:31:25.520 --> 00:31:32.080
are you crazy? This is you can do what you love to do on TV. So, I didn t really just like with
00:31:32.080 --> 00:31:39.440
the Senate, I didn t know the impact or the implications of what it would become. I didn
00:31:39.440 --> 00:31:45.080
t know how special that was. I was like, alright, fine, I ll do a little interview with them.
00:31:45.080 --> 00:31:50.440
So, I showed all the stuff, didn t really think anything of it, said bye . I was riding my bike
00:31:50.440 --> 00:31:55.720
back from San Francisco to San Diego, which is where we lived at the time, just as a solo
00:31:55.720 --> 00:32:01.120
bike trip for fun. It was my first experience of like, I want to try to figure out what the
00:32:01.120 --> 00:32:07.360
hell I m doing, a little bit of self-love. I m gonna do some a little meditation kinda thing
00:32:07.360 --> 00:32:13.400
before that was even a known thing. It was just some I just needed to escape, and which
00:32:13.400 --> 00:32:19.360
is funny because we had just gotten married and talking to my wife about this recently, I m like,
00:32:19.360 --> 00:32:24.160
I can't believe that I did that, that we got married and then I went to San Francisco for
00:32:24.160 --> 00:32:28.280
a conference and then I rode my I didn t see you for ten days or whatever 'cause I just was doing a
00:32:28.280 --> 00:32:33.960
little bit at a time. She s like, well, you needed it. Like, very supportive, which was amazing.
00:32:33.960 --> 00:32:37.920
So, did this bike ride. I didn t have a phone or anything. This was like,
00:32:37.920 --> 00:32:44.240
Nokia-phone era. I didn t even bring a phone 'cause I really wanted to isolate myself.
00:32:44.240 --> 00:32:50.680
Come back from the trip, turn on my computer, and there was five e-mails of like, we want
00:32:50.680 --> 00:32:55.200
you on the show. Can you call us back? Call us back. So, it s amazing that they even waited,
00:32:55.200 --> 00:32:59.240
because they could have easily been like, alright, he s not answering. Let s go to somebody else. We
00:32:59.240 --> 00:33:04.640
spent the next year and a half in a warehouse on Treasure Island in the Bay Area in San Francisco
00:33:04.640 --> 00:33:09.440
building ridiculous, giant prototypes. JACK: [Music] Prototype This! was pretty
00:33:09.440 --> 00:33:14.120
darn cool. My favorite episode is where they came up with an idea to make a never-ending
00:33:14.120 --> 00:33:18.200
water slide. Can you imagine riding a water slide for as long as you wanted?
00:33:18.200 --> 00:33:22.680
JOE: Everybody needs an endless water slide. It was we called it the Backyard Water Slide.
00:33:22.680 --> 00:33:26.680
The concept the show really was like, in the future, you could have one of these,
00:33:26.680 --> 00:33:29.840
even though we were just prototyping. JACK: What they did was they connected
00:33:29.840 --> 00:33:35.600
curved water slide parts into a donut-looking shape, like a big circle, and they stood
00:33:35.600 --> 00:33:40.400
that up so it looked like a big wheel, and then they put water in it and spun it. So,
00:33:40.400 --> 00:33:45.080
if you're inside, you're always sliding down the side as long as it keeps spinning.
00:33:45.080 --> 00:33:51.360
JOE: We did a firefighter episode where we built a high-tech firefighter pack, and we had a drone
00:33:51.360 --> 00:33:56.960
that would go and help rescue somebody lost at sea. We did a pizza-delivering robot, which
00:33:56.960 --> 00:34:01.320
now there are food-delivering robots. Maybe they ripped it off the show; I don't know. Or like
00:34:01.320 --> 00:34:07.400
JACK: You had one where you tried to ride on a bug robot, right?
00:34:07.400 --> 00:34:09.600
JOE: Oh, yeah. JACK: A giant bug-looking thing,
00:34:09.600 --> 00:34:11.114
and then you would ride on it. JOE: Yeah, yeah.
00:34:11.114 --> 00:34:12.914
JACK: That s not even out yet. JOE: No.
00:34:12.914 --> 00:34:14.560
JACK: Fast-forward twenty years, right? What is it?
00:34:14.560 --> 00:34:17.720
JOE: Cause that was a really hard problem. JACK: Or fifteen years ago, and they
00:34:17.720 --> 00:34:20.074
still don t have rideable robots. JOE: Yeah. I know. What s up with that?
00:34:20.074 --> 00:34:23.280
JACK: You were building them then.
