The magician’s transformation
While the FBI was hunting down notorious hacker Kevin Mitnick in the early 1990s, a newcomer named Erik Weisz showed up in Denver, moved into an apartment on 16th Street and got an IT job at a local law firm.
Walking with a slight limp, Weisz shared similar traits to Mitnick, such as his height and brown hair. But Weisz was much thinner and more fit than the pudgy- faced Mitnick pictured in law enforcement most- wanted posters. He kept to himself and loved his systems administrator gig helping with computer security for Holme Roberts & Owen, housed in the city’s iconic “Cash Register” building. He even suggested the firm switch to secure tokens — what today is called two- factor authentication — because having employees dial into the corporate network was insecure.
“They were calling me their resident hacker. But they had no idea who I was,” said Mitnick, whose alias was an homage to Harry Houdini’s birth name.
The FBI finally caught up with Mitnick in February 1995 after he hacked
into the computer of Tsutomo Shimomura, a research scientist. Shimomura traced the hack to a modem connected to a cell tower near Raleigh, N. C. Mitnick, then, 31, who had been breaking into communications company networks and scamming free phone calls since he was a teenager in the 1980s, spent five years in prison, including a year in solitary confinement.
Now 54, Mitnick seems far from the youth he once was. Unlike the shy loner he was often described as, the charismatic and cheerful guy runs a respected cybersecurity firm. On Tuesday, an audience in Denver watched in awe and horror as Mitnick showed how he uses hardware, phishing and social engineering to worm his way into “100 percent” of clients’ systems, partly by charming employees into handing over credentials. Invited by BBVA Compass bank, Mitnick is no longer the hacker feared by governments, telephone companies and the American public. In fact, the way Mitnick tells it, he never meant any harm.
“I never, in doing this, wanted to harm anybody. I was just having fun. I was being the magician by breaking the systems and getting the code,” said Mitnick, who was charged for wire fraud and possession of files from Motorola and others. “That’s why I was going after cellphones, that’s why I was going after operating systems — to become better at hacking them.”
Not everyone agrees with Mitnick’s memory, including John Markoff, who covered Mitnick’s escapades for The New York Times and co- authored with Shimomura “Takedown: The Pursuit and Capture of Kevin Mitnick.”
Said Markoff in an email: “What he did as an outlaw was to exploit the best quality in people — their desire to help. … Remember, he spent five years in prison for stealing software from a range of companies. He was sharing the software with an Israeli citizen. The cost to the companies was enormous. He also did lasting damage to individuals who lost their jobs as a result of his activities — something he has never acknowledged responsibility for.”
Mitnick told The Denver Post he does have regrets, especially after learning people lost their jobs at the Denver law firm, which is now part of Bryan Cave Leighton Paisner.
Growing up in Los Angeles, Mitnick wanted to become a magician. When he learned you could make free phone calls with a little blue box, he felt it was doable magic. He became curious about how phone systems work and ultimately hacked phone companies’ systems to learn more. Hacking into corporate networks and stealing data landed the teenager in jail. Yet, he kept at it through his 20s and became a fugitive in 1992.
He picked Denver because of the Rocky Mountains, and it was “as far away as I’ve ever been in my life,” Mitnick said.
“I just started creating résumés and looking at newspapers. I’d tailor my background to match 90 percent of what they were looking for,” he said. “I’d give my own references. It wasn’t hard. I created my own past.”
In Denver, he was an intentional loner. He didn’t date and was careful not to make any friends “because if I was ever on TV, they’d be able to identify me.” He had favorite bars and restaurants but kept conversation impersonal, never revealing his name or work. He changed his looks by working out at the YMCA and losing weight. He ditched his glasses. And he put pebbles in one shoe, which made it hurt to walk and changed his gait, “the No. 1 way you can be recognized,” said Mitnick, who spent evenings hacking.
“I just took it day by day. Looking over your shoulder was no way to live. I treated it like I wasn’t even on the run. And when I treated it like that, I didn’t have that stress. Cops would drive by and I’d be like ‘ Hi.’ I didn’t care. It wasn’t like my picture was all over the news or on America’s Most Wanted,” he said. “Once I got on the front page of The New York Times ( in 1994), I became a very high priority. They used a bad photo that made me look evil and grimacing. So I go, ‘ That’s great! I look totally different.’ ”
After prison, Mitnick started using his hacking skills for good as a consultant at Mitnick Security and public speaker. In 2012, he joined cybersecurity firm KnowBe4 as its Chief Hacking Officer. Despite his criminal background, Mitnick has won fans in the security, government and financial communities. The Tuesday event capped a 13- city tour with BBVA bank.
“Kevin is such an engaging public speaker, and his depth of knowledge of the digital world and its dangers is phenomenal,” said Andy Wykstra, BBVA Compass Colorado CEO. “Those two qualities made for an informative and special event for our clients here in Colorado.”
Even Markoff, the now retired New York Times reporter, felt Mitnick has turned his life around.
“He is performing a useful public service. It only took him five arrests to realize this,” Markoff said.
Returning to Denver this week brought back memories for Mitnick, who back then was tempted to make Denver his “forever identity.” But he knew he had to keep moving. He left for Seattle in 1994 and became Brian Merrill.
After living in Denver for more than a year, Mitnick was fired from the law firm. Ironically, it was his cellphone that did him in.
“I ended up getting fired because during breaks and lunch, I’d be on my cellphone. And back then, it was a buck a minute and I was getting paid $ 30,000 a year. But that wasn’t the only problem. My colleague in the IT department had his own consulting business on the side and was consulting on company time,” Mitnick recalled. “They assumed I was consulting just like this guy so when they fired him, they fired me. But they got it wrong, I was just a fugitive.”