00:00:00
Phoebe Judge: How easy would it be for you
to hack into my stuff right now? Mike Calce: If I really wanted to and I was
at a computer, it'd probably take me about
00:00:09
half an hour. Phoebe Judge: And you could find out everything? Mike Calce: I'd find out everything, your
bank account information, your Twitter password,
00:00:16
all your passwords to all your accounts. Phoebe Judge: Half an hour. Mike Calce: Give or take.
00:00:22
Phoebe Judge: This is Mike Calce. Like so many of us, he first accessed the
internet in the early '90s, when AOL started
00:00:29
sending their floppy disks, and later CDs,
through the mail. At one point, half of the CDs in the world
were being produced for AOL's direct mail
00:00:38
campaign. Every six seconds, someone new signed up. AOL Message: Welcome. Phoebe Judge: Calce was 9 or 10 years old,
living with his parents in Montreal.
00:00:45
Mike Calce: AOL was actually what made me
want to be a hacker, or kind of forced me
00:00:50
to be a hacker. Because that 30-day process where they allow
you internet for free 30 days, I wasn't sure
00:00:59
if my father was going to give me his credit
card number to reinstate the service.
00:01:03
So what I had to do was, I found an application
that allowed you to log onto AOL and appear
00:01:10
to other people as if you were an administrator
of AOL. And I was messaging other users saying, "Excuse
me, due to a power outage at one of our facilities,
00:01:20
we need to verify your password." And sure enough, the first four out of four
gave me their passwords, and I was using other
00:01:28
people's AOL account information to stay online. That's—
Phoebe Judge: Wait a second, you're 10 years
00:01:34
old. Are you thinking the whole time, "Oh my God,
this is working. I can't believe this is working, this trick"?
00:01:40
Mike Calce: I was, I guess, surprised in the
sense that it was this easy. I would've figured it would have taken a few
attempts.
00:01:46
I knew I would have got somebody at some point,
but to go four for four on the first attempts,
00:01:51
I was like, okay, this is no problem. I have internet permanently, now. Phoebe Judge: Of course, most kids feel like
they can get away with anything.
00:02:00
But if by fifth grade, you're already smarter
than most of the adults around you, maybe
00:02:05
you actually can. I'm Phoebe Judge. And this is Criminal. [Music.] In many ways, Calce's early experience with
the internet wasn't so different from a lot
00:02:24
of people's. It started with AOL, but then he found out
you could download stuff — movies, music,
00:02:30
games — all free, albeit illegal, if you
knew where to look. Mike Calce: But the thing was, there was a
queue list where you had to wait in line,
00:02:38
because other people wanted the software as
well. So I kind of wanted to find a way to skip
the system and be able to just download whatever
00:02:46
I want. Phoebe Judge: Access to this free stuff was
run by hackers, and Calce realized he could
00:02:50
skip the line if he found a way to work with
them. So he sent a message to someone he thought
was in charge.
00:02:56
Mike Calce: And he said, "Oh, sorry, look,
we're only looking for experienced hackers
00:03:00
already. We're not interested in n00bs," which is basically
someone who has no idea what they're doing
00:03:05
and is new to the industry. I said, "Look, give me two weeks. Give me a trial period.
00:03:10
I'm a very fast learner. And I promise I won't disappoint you." Phoebe Judge: The guy gave Calce a series
of tests, and he passed.
00:03:18
He was good, really good. He was breaking into university networks. Mike Calce: Yale, UCLA, Harvard.
00:03:24
Phoebe Judge: So you're 11 or 12 now, and
you're trying to break into UCLA and Harvard?
00:03:29
Mike Calce: Exactly. So I had to pretend to go to sleep, then wake
up, and then go back on the computer.
00:03:34
And typically like I would sleep through the
first two classes of school every morning,
00:03:39
because I spent most of my hacking activities
at night. Phoebe Judge: By high school, Calce had hooked
up with what he describes as basically a group
00:03:46
of elite Russian hackers. He considered them as friends, but there was
a lot of paranoia.
00:03:51
You couldn't really be sure of who you were
talking to, or what they were capable of.
00:03:56
And it wasn't just online. They also talked on the phone. As Calce explains it, someone would steal
a credit card number and use it to buy a conference
00:04:04
call line. Mike Calce: It was kind of like a Friday night
thing. And someone would post a phone number and
post a pin, and a bunch of hackers would go
00:04:12
on this conference call line. Phoebe Judge: And what would you do once you
got there?
00:04:16
Mike Calce: Every instance was a bit different,
but a lot of it is mumbo-jumbo because there's
00:04:22
30 hackers, basically talking trash to each
other. But in one instance, there was an American
hacker on one end and there was a Russian
00:04:31
hacker on the other end. And they were basically calling each other
out. Phoebe Judge: The American was threatening
to divulge the Russian's personal information.
00:04:38
The term is 'doxxing.' And in this hyper-anonymous world, it basically
shows your own skill while embarrassing the
00:04:44
other guy. Mike Calce: A few other of the hackers were
egging them on and saying like, "All right,
00:04:48
let's see what you guys got. Let's go, let's go." And so they started going at it, and throughout
the process of the phone call, the American
00:04:57
hacker was taunting the Russian like, "Oh
yeah, I'm getting your information right now
00:05:01
as we speak." American Hacker: But I will find it. Mike Calce: He's like, "Don't worry."
00:05:04
And the Russian was really silent, not really
saying anything. At some point, like 20 minutes down this conversation,
the American's like, "All right, I'm getting
00:05:13
pretty close. I'm accessing some of your information." And the Russian finally speaks up, and he's
like, "Well, you don't have to do that."
00:05:22
And the American's like, "What are you talking
about?" And then the Russian starts going off, listing
off his parents' name, his home address, and
00:05:30
social security number... The American started admitting defeat. He's started pleading.
00:05:35
He's like, "Please, no, no, wait, I give..." And the Russian's like, "No, I'm not done
with you.
00:05:41
You were talking a big game. Now let's see what's going on." And the American started screaming on the
phone, and he's like, "What the hell did you
00:05:50
just do? What the hell did you just do?" And the Russian's like, "Bye-bye, kiss mommy
goodnight for me."
00:05:57
And I mean, I don't know if I want to say
this too explicitly, but the American was
00:06:01
like, "Holy shit, you cut the fucking power
from my house." Phoebe Judge: So he's sitting there in the
dark.
00:06:06
Mike Calce: He's sitting there in the dark,
and he's on the phone line. He was just freaking out, losing it.
00:06:11
And then people started exploding on the chat. I was very impressed and in awe with what
he was capable of doing.
00:06:17
Phoebe Judge: Just for context, that was 1999,
the same year that people were freaking out
00:06:22
about Y2K, and Al Gore claimed to have created
the internet. [Music.] So much of these chat room pranks were about
one-upmanship, about making other hackers
00:06:36
afraid of you. And Calce had yet to try. So the following year, in February of 2000,
he made his move.
00:06:43
Mike Calce: And I basically shut down eBay,
CNN, E-Trade, Dell, and Amazon.com. Phoebe Judge: [Laughs.]
00:06:51
How did you do that? Mike Calce: Basically, what I did is I hacked
into almost every major university college
00:06:57
in America, and I combined them all together. I made a massive network by combining all
the universities and colleges that I had compromised
00:07:06
together. And I basically set them up as slaves, and
I set one master network that was like the
00:07:12
boss, let's say. And when I would tell that master computer
to shoot all your bandwidth, all your internet
00:07:20
speed that you have available, to this one
designated site, all the other universities
00:07:26
and colleges that I had compromised would
respond at exactly the same time, so it would
00:07:30
launch a coordinated attack. And so I would say, all right — I'd go to
the master computer and say, all right, here's
00:07:37
eBay's IP address. Let's target eBay. Phoebe Judge: At this point in time, in 2000,
on the scale of large business hacks, where
00:07:48
did this rank? Mike Calce: At the time, it was definitely
the biggest hack. Phoebe Judge: Over the course of a week, Calce
basically broke the websites of E-Trade, Yahoo,
00:07:57
Buy.com, eBay, Dell, CNN, and Amazon. By most estimates, the attack caused $1.7
billion in lost revenue, even though the sites
00:08:07
were only down for a few hours. We asked a couple of other hackers what they
thought about it, and they said Calce demonstrated
00:08:15
what many in the community already knew was
possible. He basically proved just how powerful the
technology could be.
00:08:22
[Music.] So where were you when you get arrested? Mike Calce: I was at a friend's house, actually,
ironically watching a Goodfellas movie.
00:08:36
It was three in the morning, give or take. And I received a phone call from my father
saying, "They're here."
00:08:42
And I'm like, "Pardon me? Who's there?" But I could tell by the tone of his voice
that the
00:08:47
show was over, basically. And that the RCMP, which is the Canadian version
of the FBI, and the FBI, as well, were in
00:08:57
a joint task force, and they had raided my
house. Phoebe Judge: I mean, your parents know nothing
of what's going on when the police and the
00:09:06
FBI show up at the door? Mike Calce: My dad knew at this point, because
I had told him, prior to getting raided, that
00:09:14
I was the person responsible for these attacks. Phoebe Judge: What was his response?
00:09:18
Mike Calce: You know, I was pretty smart about
it. Basically, I had to pick the right time to
tell him, and I picked a Sunday, when he was
00:09:27
eating a nice panini and—
Phoebe Judge: [Laughing.] Wait, your dad's like — [laughing].
00:09:33
He's got the panini, so he doesn't care about
the New York Stock Exchange. It's okay, he's got the sandwich.
00:09:38
Mike Calce: Right. He's got the sandwich, you know, so I figured
the best time to deliver this kind of news
00:09:41
is when you're in the process of eating some
good food. I figured it would alleviate some of the stress
involved with what I'm about to tell him.
00:09:50
And my dad's a cool, calm, collected kind
of guy, so he took it rather well. He was kind of shocked, but he was very professional
about it and said, "Listen, we need to go
00:10:01
see a lawyer. We need to get prepared." And that's exactly what we did. Before they even raided me, I had already
seen a lawyer on three, four, several different
00:10:11
occasions. Phoebe Judge: But they couldn't protect you
from jail? Mike Calce: Nobody could, at this point.
00:10:17
Quite thankfully, I guess, I was 15 years
old at this point, because if I was 18, I
00:10:23
don't think we'd be talking over the radio
right now. Phoebe Judge: Because Calce was a minor, the
police couldn't release his name.
00:10:29
Media outlets referred to him only as his
alias: MafiaBoy. Janet Reno, the attorney general, referred
to him only as MafiaBoy.
00:10:36
Janet Reno: [At a news conference.] The suspect who goes by the online name MafiaBoy
has been charged in connection with the cyberattack
00:10:43
on the CNN network website. I believe this recent breakthrough demonstrates
our capacity to track down those who would
00:10:52
abuse this remarkable new technology. [Fades out.] Phoebe Judge: He pleaded guilty to 57 counts
of "mischief to data" in the Montreal Youth
00:10:59
Court, and was sentenced to eight months in
a youth detention center and a year of probation
00:11:04
after that. He could go to school, but he couldn't use
a computer. WIRED Magazine reported it as "the cyber-strike
that put the internet security issues on a
00:11:14
national stage, and inaugurated an era where
any pissed-off script-kiddie could take down
00:11:19
part of the web at will." Mike Calce: I was very content that I was
able to accomplish this goal.
00:11:24
I felt, like, a sense of accomplishment when
I was hacking and able to infiltrate such
00:11:30
high-profile targets. Phoebe Judge: If you hadn't gotten caught,
would you still be hacking?
00:11:36
Mike Calce: Absolutely not. Because to be quite honest with you, if I
wanted to hack, I still could hack.
00:11:42
They caught me for those attacks because I
was boasting about them in public chats.
00:11:47
And that's when they started to single me
out and really divert their attention towards
00:11:52
me. They never found me through technical means. It's not like I left digital footprints anywhere.
00:11:59
I knew what I
was doing. The point is that it's wrong. Phoebe Judge: When Calce got caught, a reporter
pointed out to Janet Reno that Calce was a
00:12:07
minor and asked how the justice system was
equipped to handle kids that cause so much
00:12:11
damage. She didn't say we'd be able to stay one step
ahead of them. She said she thought we needed to teach them
better manners.
00:12:17
Janet Reno: [At a news conference.] ... That they are not going to be able to
get away with something like this because
00:12:19
of age. There has got to be a remedy, there's got
to be a penalty, but more importantly, we
00:12:28
have got to renew our efforts to teach young
people — children, young people — cyber-ethics,
00:12:34
so that we ensure that this tool is used by
all concerned to expand our opportunity for
00:12:43
learning, for communication, for commerce. Phoebe Judge: It's like a game of cat and
mouse, where the cat is asking the mouse to
00:12:48
slow down and play nice. [Music.] Calce is 31 now. He makes a living trying to help companies
find weak spots in their networks.
00:13:04
A lot of people in the cybersecurity industry
are like him. Kids who started out breaking things, all
grown up and now in high demand.
00:13:18
[Music.] Criminal is produced by Lauren Spohrer, who
debuted on AOL as TheBookPrincess; Eric Mennel,
00:13:29
aka RedSox1302; and me, PhoebeJ44 — that's
unchanged for 20 years. Julienne Alexander does our episode art.
00:13:38
You can find all of our episodes on iTunes,
where you can subscribe to the show.
00:13:43
Our website is thisiscriminal.com. We're on Facebook and Twitter, @CriminalShow.
00:13:48
And thanks to all who donated to the Radiotopia
Kickstarter. We made the goal, and we're looking forward
to bringing you more new shows next year.
00:13:56
As part of Radiotopia, we'll be working with
shows like Benjamen Walker's Theory of Everything.
00:14:00
His newest episode features Ethan Zuckerman,
the guy who invented the pop-up ad.
00:14:05
Turns out, he thinks internet advertising
has gotten out of hand. Ethan Zuckerman: To try to convince investors
that ads are somehow going to be worth money
00:14:14
— because it's very clear that no one likes
them, no one wants to encounter them — we've
00:14:18
had to make them more and more intrusive. And we functionally had to put people under
surveillance.
00:14:23
Phoebe Judge: That's Benjamen Walker's Theory
of Everything. I'm Phoebe Judge. This is Criminal.
00:14:29
AOL Message: Goodbye. [Music fades out.] Phoebe Judge: What scares you? Mike Calce: What scares me is that, if this
gets to the level of terrorism one day, where
00:14:48
water sanitation sites and stuff — like,
the water being pumped into your home is pretty
00:14:52
much all automated these days. They put fluoride in our water, they put different
chemicals, and it's mainly all balanced to
00:14:59
be safe. But what if a hacker obtains access to one
of these water facilities and changes the
00:15:04
fluoride levels so that it's actually poisonous
and harmful to human beings? These are types of things that scare me.
00:15:11
Shutting off power in hospital facilities,
making automated defense missile systems launch
00:15:17
against their own nation... These are things that really scare me.