Adrian Lamo; Hacks by Day Squats by Night

“ I have always said that actions have consequences, and this is something that I was always aware might happen. ” Lamo has been charged in New York under Title 18 U.S.C. 1030 and 1029, according to deputy federal public defender Mary French, who says she's spoken with one of the FBI agents that were searching for Lamo. The federal laws prohibit unauthorized access to a protected computer, and illegal possession of stolen "access devices" -- a term that encompasses passwords, credit card numbers, and the like. French did not know what the specific allegations were, because the charging document is sealed. Two agents visited the home of Lamo's parents, Mario and Mary Lamo, near Sacramento, California, Thursday afternoon, Mary Lamo said Thursday. "They wouldn't tell us anything but that they had an arrest warrant and they wanted to come in," she adds. When she demurred, the agents vowed to return with a search warrant, then began overtly watching the house from parked cars, she said. "They followed me when I went out, so they're not hiding it." Friday morning, a spokesperson for the U.S. Attorney's office in New York confirmed that the office had an open case file on Lamo, but otherwise declined to comment. Lamo frequently stays at his parents' home, but he was not there at the time of the FBI's visit, and has not returned since. His mother contacted the Federal Public Defender's office in Sacramento, which has agreed to handle his surrender. "If he's arrested or turns himself in in this district, we will represent him for the initial proceedings," French said Friday morning. "I haven't had any direct contact with him yet." In a telephone interview Thursday, Lamo said he was in California, but did not plan to turn himself in until after conferring with the attorney. The hacker was quick-witted and seemingly in good humor, with only a trace of nervousness in his voice. He quipped about the proper etiquette of being arrested by the FBI, and suggested jokingly that SecurityFocus should purchase the publication rights to a favorite photo. He said he was in the company of a camera crew producing a television documentary on hackers. "I have always said that actions have consequences, and this is something that I was always aware might happen," said Lamo. "I don't intend to deny anything that I have done, but I do intend to defend myself vigorously." The 22-year-old Lamo has become famous for publicly exposing gaping security holes at large corporations, then voluntarily helping the companies fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process. Until now, his cooperation and transparency have kept him from being prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser. Some companies have even professed gratitude for his efforts: In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others. Lamo believes the arrest warrant is for his most high-profile hack. Early last year he penetrated the New York Times, after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser. Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services. He also accessed a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter. In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter. But this time, no one was grateful, and by May federal prosecutors in New York had begun an investigation. "I think this is unsporting of the New York Times," Lamo said Thursday. Lamo's mother said she has no opinion on her son's exploits. She's just worried about him. "I don't really know much of anything about computers," says Mary Lamo. "He's my son. Right now, all I can worry about is how I can help him." "I hope there will be a time when Adrian can do positive things that everyone agrees are positive," she adds.

NEW YORK -- Last January, Adrian Lamo awoke in the abandoned building near Philadelphia's Ben Franklin Bridge where he'd been squatting, went to a public computer with an Internet connection, and found a leak in the Excite@Home's supposedly airtight company network. Just another day in the life of a young man who may be the world's most famous homeless hacker. More than a year later, Lamo is becoming widely known in hacker circles for tiptoeing into the networks of companies like Yahoo and WorldCom -- and then telling the corporate guys how he got there. Administrators at several of the companies he's hacked have called Lamo brilliant and "helpful" for helping fix these gaps in network defenses.

Critics blast Lamo as a charlatan who preens for the spotlight.

"(Is) anyone impressed with Lamo's skills(?) He is not doing anything particularly amazing. He has not found some new security concept. He is just looking for basic holes,"

wrote one poster to the SecurityFocus website. To such barbs, Oxblood Ruffian, a veteran of the hacker group Cult of the Dead Cow, replied, "It's like dancing. Anyone can dance. But not many people can dance like Michael Jackson." Lamo's latest move: using a back door in The New York Times' intranet to snag the home phone numbers of over 3,000 Op-Ed contributors, including Vint Cerf, Warren Beatty and Rush Limbaugh. Although Lamo (pronounced LAHM-oh) did nothing more mischievous with the information than include himself in its roster of experts, the Times is considering pressing charges, according to spokeswoman Christine Mohan. Hacking is a federal crime, currently punishable by five years in jail. Prison would be an ironic twist for Lamo -- it'd be the first time in years he would have a steady place to stay. Living out of a backpack, getting online from university libraries and Kinko's laptop stations, the slightly built, boyish Lamo wanders the country's coasts by Amtrak and Greyhound bus.

"I have a laptop in Pittsburgh, a change of clothes in D.C. It kind of redefines the term multi-jurisdictional," Lamo said with a mild stutter. "It'll be hard to get warrants for it all."

He spends most of his nights on friends' couches. But when hospitality wears thin, he takes shelter in city skeletons -- like the crumbling Philadelphia restaurant supply shop, or the old officers' quarters at the Presidio in San Francisco. Lamo said he found his way into the colonial-era military complex by randomly trying doorknobs until he found one that rattled. It's a pretty good metaphor, he adds, for how he hacks. Company networks use proxy software to let internal employees out to the public Internet. It's a one-way door, essentially. But if proxy servers aren't configured correctly, these doors can swing both ways, allowing outsiders in through the corporate firewall, said Chris Wyspoal, an executive with security firm @Stake. Lamo peeks around for these swinging doors and lets himself in with widely used hacker tools. It's not technically complex at all. Lamo found an open proxy on The New York Times' network in less than two minutes. So it's understandable that many who consider themselves black belts in the computer arts regard Lamo's notoriety with more than a bit of skepticism. A poster to SecurityFocus' site complains, "The only thing 'hacked' here is the media." "The only way to get a publicly traded company to recognize that they're acting retarded is to kick 'em in the nuts. And you do that through the media," wrote Ira Wing, 29, who's been one of Lamo's closest confidants since the mid-1990s when the two met at PlanetOut, the gay and lesbian media firm where Wing worked and Lamo volunteered. Lamo had long tried to point out security flaws to corporate network administrators, Wing said. But even after his first well-publicized intrusion -- a late-2000 pilfering of AOL instant messenger accounts -- the suits weren't about to pay attention to some hacker kid who didn't even have a high school diploma. Despite his good intentions, Lamo may still go to jail for what he's doing.