After stealing source code, identities, thousands of dollars, and launching some of the most destructive computer viruses, a black hat might find themselves behind bars — or behind a desk in a swanky office.
Black hats are the “bad hackers,” the people who poke holes and write worms and take what does not belong to them. White hats are the good guys. They’re the security experts who try to protect the Internet from those black hats.
But sometimes after a black hat gets caught, they find themselves suddenly on the white hat side with the opportunity to help government agencies or start a security company. Here are five examples of people who did just that.
Kevin Mitnick aka Condor
Mitnick grew up with an interest in ham radios and a curiosity about technology. His specialty was social engineering, or tricking people into giving him exactly what he wanted. Without too much “hacking,” he got access to many companies’ systems through social engineering alone. From there, he copied source code owned by Digital Equipment Corporation (DEC) and Nokia and got inside Sun Microsystems’ and Pacific Bell’s networks. While on the run, Mitnick cloned cellphones to throw the police off his trail. After running all the way from the West Coast, he was eventually arrested in North Carolina.
After serving five years in jail, including some in solitary confinement, Mitnick founded his own security company called Mitnick Security Consulting, LLC, which runs penetration tests for its clients. He is also the “chief hacking officer” at security company KnowBe4.
Mitnick has written a few books on his experiences. Art of Deception and Art of Intrusion both help people get inside the mind of a hacker. He also releasedGhost in the Wires, which details his life as a fugitive.
Kevin Poulsen aka Dark Dante
Poulsen is another California native who is best known for his ability to control phone lines, which landed him a Porsche 944 S2 Cabriolet. He hacked into the computers that controlled a number of telephone systems, including those owned by a number of L.A. radio stations. He rigged the stations’ on-air contests and won the car and $20,000.
Of course, the FBI got wind of Poulsen, who ducked for cover for 18 months. When the FBI finally found him, he pleaded guilty, served his time, and was released. Poulsen soon rehabbed his image into that of an investigative journalist. He currently works for Wired.
In 2006, Poulsen used his coding talents to help Wired in an investigation of sex offenders on Myspace. He wrote 1,000 lines of code using the Perl programming language to spider over 100 million Myspace users at the time. The script compared those Myspace users to people listed on the public sex offender registry. Through this investigation, he found one man, Andrew Lubrano, who was later arrested for “attempted child endangerment” — actively searching out little boys on the social network.
Poulsen has also written a book called Kingpin, detailing his experiences as a hacker.
Robert Tappan Morris
Morris is known as that guy behind the first computer virus, appropriately known as the Morris Worm. This worm didn’t steal information as many do today; it caused computers to crash — accidentally. Morris didn’t actually intend for the virus to be malicious. Instead, he was using it to measure the size of the Internet itself, to see just how far the virus could reach. Morris released the virus from MIT so as to not associate it with his graduate studies at Cornell.
However, once the worm was on a computer, it started taking up space and memory. It wasn’t smart enough to determine if a computer was previously infected, so it would reinstall itself everywhere. Eventually, this caused systems to crash from heavy processing demands, causing financial damage for the owner.
Morris was arrested and was the first to be tried under the Computer Fraud and Abuse Act (CFAA). He received a $10,000 fine and 400 hours of community service.
Today, the CFAA is a controversial law that many say has led to overly harsh punishments for “computer crimes.” The recent death of Aaron Swartz, a civil rights activist who siphoned off five million JSTOR articles using MIT’s computer network, spurred this conversation. Swartz is believed to have committed suicide while facing dozens of years in jail and a $1 million fine for his actions.
Morris currently works for MIT in the electrical engineering and computer science department. He also helped found the well-known Silicon Valley tech incubator Y Combinator.
Adrian Lamo aka Homeless Hacker
Of all the people on this list, classifying Lamo as a “white hat” is likely the most controversial. Lamo is known as the “Homeless Hacker,” who illegally accessed the systems of a number of major brands such as the New York Times, Microsoft, Yahoo, and LexisNexis. He was convicted and served house arrest, probation, and paid a fine for the crimes.
But Lamo really got his fame for turning in Bradley Manning (now Chelsea Manning) to authorities for releasing top secret U.S. diplomatic cables to whistleblower site Wikileaks. Manning confided in Lamo, chatting with him online, unaware that Lamo had become an informant for law enforcement.
At Wired, Poulsen broke the story on Manning’s arrest. Lamo further provided Poulsen with the chat logs from his conversations with Manning, which Poulsen also published. Many in the privacy community were angry with Lamo for “being a snitch,” and Glenn Greenwald, known today for releasing U.S. surveillance leaks from former-NSA contractor Edward Snowden, even denounced Poulsen for publishing the logs.
Lamo currently works as a computer security consultant.
Mark Abene aka Phiber Optik
Abene learned computer programming languages after discovering that he could access DEC minicomputers through guest accounts posted to a BBS (bulletin board system — an early form of the chat room) he was involved in. The DEC computers were more powerful than his own, so he took to the library to learn. Soon after, he found the Legion of Doom, a group of individuals who were equally as curious, which later turned into a smaller hacking group called the Masters of Doom.
The FBI pursued Abene and a number of MOD members, but the reasons why are a little murkier than Abene’s hacking contemporaries. He has explained in past interviews that his arrest was due to hacking “gray areas” — accessing systems to poke around the Internet, not for malicious reasons. Indeed, the first laws on what it means to trespass on the Internet were being drawn up as he was accessing these systems.
He was eventually arrested and served one year in jail, three years of probation, and 600 hours of community service.
After his ordeal, Abene went on to create a security company called Crossbar Security with another Legion of Doom member. The company eventually failed in the dotcom bust. He now serves as a security consultant.