NORTHERN ILLINOIS UNIVERSITY








                THE SOCIAL ORGANIZATION OF THE COMPUTER UNDERGROUND








                     A THESIS SUBMITTED TO THE GRADUATE SCHOOL

                    IN PARTIAL FULFILLMENT OF THE REQUIREMENTS

                                  FOR THE DEGREE

                                  MASTER OF ARTS








                              DEPARTMENT OF SOCIOLOGY







                                        BY

                                  GORDON R. MEYER

                                  %CompuServe: 72307,1502%
                                  %GEnie: GRMEYER%


                                 DEKALB, ILLINOIS

                                    AUGUST 1989

^





                                     ABSTRACT







            Name: Gordon R. Meyer            Department: Sociology









            Title: The Social Organization of the Computer Underground









            Major: Criminology               Degree: M.A.











            Approved by:                     Date:



            __________________________       ________________________
            Thesis Director





                         NORTHERN ILLINOIS UNIVERSITY

^









                                     ABSTRACT



              This paper examines the social organization of the

              "computer underground" (CU).  The CU is composed of

              actors in three roles, "computer hackers," "phone

              phreaks," and "software pirates."  These roles have

              frequently been ignored or confused in media and other

              accounts of CU activity. By utilizing a data set culled

              from CU channels of communication this paper provides

              an ethnographic account of computer underground

              organization. It is concluded that despite the

              widespread social network of the computer underground,

              it is organized primarily on the level of colleagues,

              with only small groups approaching peer relationships.


^

























              Certification: In accordance with departmental and

                             Graduate School policies, this thesis

                             is accepted in partial fulfillment

                             of degree requirements.



                             _____________________________________
                             Thesis Director

                             _____________________________________
                             Date


^









                                  ACKNOWLEDGMENTS



                        FOR CRITIQUE, ADVICE, AND COMMENTS:

                                DR. JAMES L. MASSEY

                                  DR. JIM THOMAS

                              DR. DAVID F. LUCKENBILL



                          FOR SUPPORT AND ENCOURAGEMENT:

                                   GALE GREINKE



                                SPECIAL THANKS TO:

                           D.C., T.M., T.K., K.L., D.P.,

                                  M.H., AND G.Z.



                            THIS WORK IS DEDICATED TO:

                                  GEORGE HAYDUKE

                                        AND

                                    BARRY FREED






^














                                 TABLE OF CONTENTS

              Introduction . . . . . . . . . . . . . . . . . . .    1

              Methodology  . . . . . . . . . . . . . . . . . . .    6

              What is the Computer Underground?  . . . . . . . .   11

              Topography of the Computer Underground . . . . . .   20
                   Hacking     . . . . . . . . . . . . . . . . .   20
                   Phreaking . . . . . . . . . . . . . . . . . .   21
                   Pirating    . . . . . . . . . . . . . . . . .   24

              Social Organization and Deviant Associations . . .   28

              Mutual Association . . . . . . . . . . . . . . . .   31

              The Structure of the Computer Underground  . . . .   33
                   Bulletin Board Systems    . . . . . . . . . .   33
                        Towards a BBS Culture  . . . . . . . . .   37
                   Bridges, Loops, and Voice Mail Boxes    . . .   53
                   Summary   . . . . . . . . . . . . . . . . . .   57

              Mutual Participation . . . . . . . . . . . . . . .   59
                   Pirate Groups   . . . . . . . . . . . . . . .   63
                   Phreak/hack groups    . . . . . . . . . . . .   64
                   Summary   . . . . . . . . . . . . . . . . . .   67

              Conclusion . . . . . . . . . . . . . . . . . . . .   69

              REFERENCES . . . . . . . . . . . . . . . . . . . .   75

              APPENDIX A. COMPUTER UNDERGROUND PSEUDONYMS  . . .   76

              APPENDIX B.
                NEW USER QUESTIONNAIRE FROM A PHREAK/HACK BBS  .   77

^









                                   Introduction

                   The proliferation of home computers has been

              accompanied by a corresponding social problem involving

              the activities of so-called "computer hackers."

              "Hackers" are computer aficionados who "break in" to

              corporate and government computer systems using their

              home computer and a telephone modem.  The prevalence of

              the problem has been dramatized by the media and

              enforcement agents, and evidenced by the rise of

              specialized private security firms to confront the

              "hackers."  But despite this flurry of attention,

              little research has examined the social world of the

              "computer hacker." Our current knowledge in this regard

              derives from hackers who have been caught, from

              enforcement agents, and from computer security

              specialists.  The everyday world and activities of the

              "computer hacker" remain largely unknown.

                   This study examines the way actors in the

              "computer underground" (CU) organize to perform their

              acts. The computer underground, as it is called by

              those who participate in it, is composed of actors

              adhering to one of three roles: "hackers," "phreakers,"

              or "pirates." To further understanding this growing

              "social problem," this project will isolate and clarify
^



                                                                    8

              these roles, and examine how each contributes to the

              culture as a whole. By doing so the sociological

              question of how the "underground" is organized will be

              answered, rather than the technical question of how CU

              participants perform their acts.

                   Best and Luckenbill (1982) describe three basic

              approaches to the study of "deviant" groups.  The first

              approach is from a social psychological level, where

              analysis focuses on the needs, motives, and individual

              characteristics of the actors involved.  Secondly,

              deviant groups can be studied at a socio-structural

              level.  Here the emphasis is on the distribution and

              consequences of deviance within the society as a whole.

              The third approach, the one adopted by this work, forms

              a middle ground between the former two by addressing

              the social organization of deviant groups.   Focusing

              upon neither the individual nor societal structures

              entirely, social organization refers to the network of

              social relations between individuals involved in a

              common activity (pp. 13-14).  Assessing the degree and

              manner in which the underground is organized provides

              the opportunity to also examine the culture, roles, and

              channels of communication used by the computer

              underground. The focus here is on the day to day

              experience of persons whose activities have been
^



                                                                    9

              criminalized over the past several years.

                   Hackers, and the "danger" that they present in our

              computer dependent society, have often received

              attention from the legal community and the media. Since

              1980, every state and the federal government has

              criminalized  "theft by browsing" of computerized

              information (Hollinger and Lanza-Kaduce, 1988, pp.101-

              102). In the media, hackers have been portrayed as

              maladjusted losers, forming "high-tech street gangs"

              (Chicago Tribune, 1989) that are dangerous to society.

              My research will show that the computer underground

              consists of a more sophisticated level of social

              organization than has been generally recognized. The

              very fact that CU participants are to some extent

              "networked" has implications for social control

              policies that may have been implemented based on an in-

              complete understanding of the activity. This project

              not only offers sociological insight into the organ-

              ization of deviant associations, but may be helpful to

              policy makers as well.

                   I begin with a discussion of the definitional

              problems that inhibit the sociological analysis of the

              computer underground. The emergence of the computer

              underground is a recent phenomenon, and the lack of

              empirical research on the topic has created an area
^



                                                                   10

              where few "standard" definitions and categories exist.

              This work will show that terms such as "hacker,"

              "phreaker," and "pirate" have different meanings for

              those who have written about the computer underground

              and those who participate in it. This work bridges

              these inconsistencies by providing definitions that

              focus on the intentions and goals of the participants,

              rather than the legality or morality of their actions.

                   Following the definition of CU activities is a

              discussion of the structure of the underground.

              Utilizing a typology for understanding the social

              organization of deviant associations, developed by Best

              and Luckenbill (1982), the organization of the

              computer underground is examined in depth.

                   The analysis begins by examining the structure of

              mutual association. This provides insight into how CU

              activity is organized, the ways in which information is

              obtained and disseminated, and explores the subcultural

              facets of the computer underground.  More importantly,

              it clearly illustrates that the computer underground is

              primarily a social network of individuals that perform

              their acts separately, yet support each other by

              sharing information and other resources.

                   After describing mutual association within the

              underground community, evidence of mutual participation
^



                                                                   11

              is presented. Although the CU is a social network, the

              ties developed at the social level encourage the

              formation of small "work groups." At this level, some

              members of the CU work in cooperation to perform their

              acts. The organization and purposes of these groups are

              examined, as well as their relationship to the CU as a

              whole. However, because only limited numbers of

              individuals join these short-lived associations, it is

              concluded that the CU is organized as colleagues. Those

              who do join "work groups" display the characteristics

              of peers, but most CU activity takes place at a fairly

              low level of sophistication.
^



                                                                   12





                                   Methodology

                   Adopting an ethnographic approach, data have been

              gathered by participating in, monitoring, and cata-

              loging channels of communication used by active members

              of the computer underground. These channels, which will

              be examined in detail later,  include electronic

              bulletin board systems (BBS), voice mail boxes,

              bridges, loops, e-mail, and telephone conversations.

              These sources provide a window through which to observe

              interactions, language, and cultural meanings without

              intruding upon the situation or violating the privacy

              of the participants.  Because these communication

              centers are the "back stage" area of the computer

              underground, they provided insight into organizational

              (and other) issues that CU participants face, and the

              methods they use to resolve them.

                   As with any ethnographic research, steps have been

              taken to protect the identity of informants.  The

              culture of the computer underground aids the researcher

              in this task since phreakers, hackers, and pirates

              regularly adopt pseudonyms to mask their identity.

              However to further ensure confidentiality, all of the

              pseudonyms cited in this research have been changed by

              the author. Additionally, any information that is
^



                                                                   13

              potentially incriminating has been removed or altered.

                   The data set used for this study consists

              primarily of messages, or "logs," which are the primary

              form of communication between users.  These logs were

              "captured" (recorded using the computer to save the

              messages) from several hundred computer bulletin

              boards1 located across the United States.  The bulk of

              the data were gathered over a seventeen month period

              (12/87 to 4/89) and will reflect the characteristics of

              the computer underground during that time span.

              However, some data, provided to the researcher by

              cooperative subjects, dates as far back as 1984.

                   The logged data were supplemented by referring to

              several CU "publications."  The members of the computer

              underground produce and distribute several technical

              and tutorial newsletters and "journals."  Since these

              "publications" are not widely available outside of CU

              circles I have given a brief description of each below.

                   Legion of Doom/Hackers Technical Journal.  This

              ____________________

                   1 Computer Bulletin Boards (BBS) are personal
              computers that have been equipped with a telephone
              modem and special software. Users can connect with a
              BBS by dialing, with their own computer and modem, the
              phone number to which the BBS is connected. After
              "logging in" by supplying a valid user name and pass-
              word, the user can leave messages to other users of the
              system.  These messages are not private and anyone
              calling the BBS can freely read and respond to them.

^



                                                                   14

              publication is written and distributed by a group known

              as "The Legion of Doom/Legion of Hackers" (LoD/H).  It

              is available in electronic format (a computer text

              file) and contains highly technical information on

              computer operating systems. As of this writing, three

              issues have been published.

                   PHRACK Inc.:  Phrack Inc is a newsletter that

              contains various articles, written by different

              authors, and "published" under one banner.  Phrack

              Inc's first issue was released in 1985, making it the

              oldest of the electronically distributed underground

              publications.  CU participants are invited to submit

              articles to the editors, who release a new issue when a

              sufficient number (about nine) of acceptable pieces

              have been gathered. Phrack also features a lengthy

              "World News" with stories about hackers who have been

              apprehended and interviews with various members of the

              underground. As of this writing twenty-seven issues of

              Phrack, have been published.

                   Phreakers/Hackers Underground Network (P/Hun):

              Like Phrack, P/Hun collects articles from various

              authors and releases them as one issue.  Three issues

              have been published to date.

                   Activist Times, Incorporated (ATI): Unlike the

              other electronically distributed publications, ATI does
^



                                                                   15

              not limit itself to strictly computer/telephone news.

              Articles normally include commentary on world and

              government events, and other "general interest" topics.

              ATI issues are generally small and consist of articles

              written by a core group of four to seven people.

              Unlike the publications discussed thus far, ATI is

              available in printed "hard copy" form by sending

              postage reimbursement to the editor.  ATI is currently

              on their 38th issue.

                   2600 Magazine:  Published in a traditional

              (printed) magazine format, 2600 (named for the

              frequency tone used to make free long distance phone

              calls) is arguably an "underground" publication as it

              is available on some newsstands and at some libraries.

              Begun in 1987 as a monthly magazine, it is now

              published quarterly. Subscription rates are $25.00 a

              year with a complete back-issue selection available.

              The magazine specializes in publishing technical

              information on telephone switching systems, satellite

              descrambling codes, and news about the computer

              underground.

                   TAP/YIPL: First established in 1972 as YIPL (Youth

              International Party Line), this publication soon

              changed its name to TAP (Technical Assistance Party).

              Co-founded by Abbie Hoffman, it is generally recognized
^



                                                                   16

              as the grandfather of computer underground

              publications.  Publication of the 2-4 page newsletter

              has been very sporadic over the years, and currently

              two different versions of TAP, each published in

              different areas of the country, are in circulation.

                   Utilizing a data set that consists of current

              message logs, old messages logs, and various CU

              publications yields a reasonably rich collection from

              which to draw the analysis.  Examination of the older

              logs and publications shows that while the actors have

              changed over the years, cultural norms and

              characteristics have remained consistent over time.
^



                                                                   17





                         What is the Computer Underground?

                   Defining the "computer underground" can be

              difficult. The sociologist soon finds that there are

              several competing definitions of computer underground

              activity.  Those who have written on the subject, the

              media, criminologists, computer programmers, social

              control agents, and CU participants themselves, have

              adopted definitions consistent with their own social

              positions and perspectives. Not surprisingly, these

              definitions rarely correspond. Therefore, before

              discussing the organization of the computer

              underground, it is necessary to discuss and compare the

              various definitions.  This will illustrate the range of

              beliefs about CU activity, and provide a springboard

              for the discussion of types of roles and activities

              found in the underground.

                   We begin with a discussion of the media image of

              computer hackers. The media's concept of "hackers" is

              important because the criminalization of the activity

              has largely occurred as the result of media drama-

              tization of the "problem" (Hollinger and Lanza-Kaduce,

              1988). In fact, it was a collection of newspaper and

              film clips that was presented to the United States

              Congress during legislative debates as evidence of the
^



                                                                   18

              computer hacking problem (Hollinger and Lanza-Kaduce,

              1988, p.107).  Unfortunately, the media assessment of

              the computer underground displays a naive understanding

              of CU activity.

                   The media generally makes little distinction

              between different types of CU activity. Most any

              computer-related crime activity can be attributed to

              "hackers."  Everything from embezzlement to computer

              viruses have, at one time or another, been attributed

              to them. Additionally, hackers are often described as

              being sociopathic or malicious, creating a media image

              of the computer underground that may exaggerate their

              propensity for doing damage.

                   The labeling of hackers as being "evil" is well

              illustrated by two recent media examples. The first is

              from Eddie Schwartz, a WGN-Radio talk show host. Here

              Schwartz is addressing "Anna," a self-identified hacker

              that has phoned into the show:

                   You know what Anna, you know what disturbs
                   me? You don't sound like a stupid person but
                   you represent a . . . a . . . a . . . lack of
                   morality that disturbs me greatly. You really
                   do. I think you represent a certain way of
                   thinking that is morally bankrupt. And I'm
                   not trying to offend you, but I . . . I'm
                   offended by you! (WGN Radio, 1988)

                   Just two months later, NBC-TV's "Hour Magazine"

              featured a segment on "computer crime."  In this

              example, Jay Bloombecker, director of the National
^



                                                                   19

              Center for Computer Crime Data, discusses the "hacker

              problem" with the host of the show, Gary Collins.

                   Collins: . . . are they %hackers% malicious
                   in intent, or are they simply out to prove,
                   ah, a certain machismo amongst their peers?

                   Bloombecker: I think so. I've talked about
                   "modem macho" as one explanation for what's
                   being done. And a lot of the cases seem to
                   involve %proving% %sic% that he . . . can do
                   something really spiffy with computers. But,
                   some of the cases are so evil, like causing
                   so many computers to break, they can't look
                   at that as just trying to prove that you're
                   better than other people.

                   GC: So that's just some of it, some kind of
                   "bet" against the computer industry, or
                   against the company.

                   JB: No, I think it's more than just
                   rottenness. And like someone who uses
                   graffiti doesn't care too much whose building
                   it is, they just want to be destructive.

                   GC: You're talking about a sociopath in
                   control of a computer!

                   JB: Ah, lots of computers, because there's
                   thousands, or tens of thousands %of hackers%
                   (NBC-TV, 1988).


                   The media image of computer hackers, and thus all

              members of the computer underground, is burdened with

              value-laden assumptions about their psychological

              makeup, and focuses almost entirely upon the morality

              of their actions.  Additionally, since media stories

              are taken from the accounts of police blotters,

              security personnel, and hackers who have been caught,

              each of whom have different perspectives and
^



                                                                   20

              definitions of their own, the media definition, if not

              inherently biased, is at best inconsistent.

                   Criminologists, by way of contrast, have done

              little to define the computer underground from a

              sociological perspective.  Those criminological

              definitions that do exist are less judgmental than the

              media image, but no more precise. Labels of

              "electronic trespassers" (Parker, 1983), and

              "electronic vandals" (Bequai, 1987) have both been

              applied to hackers.  Both terms, while acknowledging

              that "hacking" is deviant, shy away from labeling it as

              "criminal" or sociopathic behavior.  Yet despite this

              seemingly non-judgmental approach to the computer

              underground, both Parker and Bequai have testified

              before Congress, on behalf of the computer security in-

              dustry, on the "danger" of computer hackers.

              Unfortunately, their "expert" testimony was largely

              based on information culled from newspaper stories, the

              objectiveness of which has been seriously questioned

              (Hollinger and Lanza-Kaduce 1988 p.105).

                   Computer security specialists, on the other hand,

              are often quick to identify CU participants as part of

              the criminal element. Correspondingly, some reject the

              notion that there are different roles and motivations

              among computer underground participants and thereby
^



                                                                   21

              refuse to define just what it is that a "hacker" or

              "phreaker" does.  John Maxfield, a "hacker expert,"

              suggests that differentiating between "hackers" and

              "phone phreaks" is a moot point, preferring instead

              that they all just be called "criminals" (WGN-Radio.

              Sept 28, 1988).

                   The reluctance or inability to differentiate

              between roles and activities in the computer

              underground, as exhibited in the media and computer

              security firms, creates an ambiguous definition of

              "hacker" that possesses  two extremes: the modern-day

              bank robber at one end, the trespassing teenager at the

              other.  Thus, most any criminal or mischievous act that

              involves computers can be attributed to "hackers,"2

              regardless of the nature of the crime.

                   Further compounding the inconsistent use of

              "hacker" is the evolution of meaning that the word has

              undergone.   "Hacker" was first  applied to computer

              related activities when it was used by programmers in

              the late 1950's.  At that time it referred to the

              pioneering researchers, such as those at M.I.T., who
              ____________________

                   2 During the WGN-Radio show on computer crime one
              caller, who was experiencing a malfunctioning phone
              that would "chirp" occasionally while hung up, believed
              that "computer hackers" were responsible for the
              problem.  The panel assured her that it was unrelated
              to CU activity.

^



                                                                   22

              were constantly adjusting and experimenting with the

              new technology (Levy, 1984. p.7).  A "hacker" in this

              context refers to an unorthodox, yet talented,

              professional programmer. This use of the term still

              exits today, though it is largely limited to

              professional computing circles.

                   Another definition of "hacker" refers to one who

              obtains unauthorized, if not illegal, access to

              computer systems and networks.  This definition was

              popularized by the movie War Games and, generally

              speaking, is the one used by the media.3 It is also the

              definition favored by the computer underground.

                   Both the members of the computer underground and

              computer programmers claim ownership of "hacker," and

              each defend the "proper" use of term.  The computer

              professionals maintain that using "hackers" (or

              "hacking") to refer to any illegal or illicit activity

              is a corruption of the "true" meaning of the word.  Bob

              Bickford, a professional programmer who has organized

              several programmer conferences, explains:
              ____________________

                   3 This is not always true of course.  The AP
              Stylebook has yet to specify how "hacker" should be
              used.  A recent  Associated Press story featured a
              computer professional explaining that a "real hacker"
              would never do anything illegal.  Yet just a few weeks
              later Associated Press distributed stories proclaiming
              that West German "hackers" had broken into US Defense
              Department computer systems.

^



                                                                   23

                   At the most recent conference %called
                   "Hackers 4.0"% we had 200 of the most
                   brilliant computer professionals in the world
                   together for one weekend; this crowd included
                   several PhD's, several presidents of
                   companies (including large companies, such as
                   Pixar), and various artists, writers,
                   engineers, and programmers.  These people all
                   consider themselves Hackers: all derive great
                   joy from their work, from finding ways around
                   problems and limits, from creating rather
                   than destroying.  It would be a great
                   disservice to these people, and the thousands
                   of professionals like them, to let some
                   pathetic teenaged criminals destroy the one
                   word which captures their style of
                   interaction with the universe: Hackers
                   (Bickford, 1988).

                   Participants in the computer underground also

              object to the "misuse" of the term. Their objection

              centers around the indiscriminate use of the word to

              refer to computer related crime in general and not,

              specifically, the activities of the computer

              underground:

                   Whenever the slightest little thing happens
                   involving computer security, or the breach
                   thereof, the media goes fucking bat shit and
                   points all their fingers at us 'nasty
                   hackers.' They're so damned ignorant it's
                   sick (EN, message log, 1988).

                   . . . whenever the media happens upon
                   anything that involves malicious computer use
                   it's the "HACKERS."  The word is a catch
                   phrase it makes mom drop the dishes and watch
                   the TV.  They use the word because not only
                   they don't really know the meaning but they
                   have lack of a word to describe the
                   perpetrator.  That's why hacker has such a
                   bad name, its always associated with evil
                   things and such (PA, message log, 1988).

                   I never seen a phreaker called a phreaker
^



                                                                   24

                   when caught and he's printed in the
                   newspaper. You always see them "Hacker caught
                   in telephone fraud."  "Hacker defrauds old
                   man with phone calling card." What someone
                   should do is tell the fucken (sic) media to
                   get it straight (TP2, message log, 1988).


                   Obviously the CU and computer professional

              definitions of "hacker" refer to different social

              groups.  As Best and Luckenbill (1982, p. 39) observe:

              "Every social group modifies the basic language to fit

              its own circumstance, creating new words or using

              ordinary words in special ways."  Which definition, if

              either, will come into widespread use remains to be

              seen.  However, since computer break-ins are likely to

              receive more media attention than clever feats of

              programming, the CU definition is likely to dominate

              simply by being used more often.4  But as long as the

              two definitions do exist there will be confusion unless

              writers and researchers adequately specify the group

              under discussion.  For this reason, I suggest that

              sociologists, and criminologists in particular, adopt

              the "underground" definition for consistency and
              ____________________

                   4 Another factor may be the adoption  of a close
              proximity to the underground definition being included
              in the 1986 edition of Webster's New World dictionary:
                   hack.er n. 1. a person who hacks 2. an unskilled
              golfer, tennis player, etc. 3. a talented amateur user
              of computers, specif. one who attempts to gain
              unauthorized access to files.

^



                                                                   25

              accuracy when speaking of the actions of CU

              participants.

                   While it is recognized that computer hacking is a

              relatively new phenomenon, the indiscriminant use of

              the term to refer to many different forms of unorthodox

              computer use has been counterproductive to

              understanding the extent of the activity. To avoid this

              a "computer hacker" should be defined as an individual,

              associated with the computer underground, who

              specializes in obtaining unauthorized access to

              computer systems.  A "phone phreak" in an individual,

              associated with the computer underground, who

              specializes in obtaining unauthorized information about

              the phone system.  A "software pirate" is an

              individual, associated with the computer underground,

              who distributes or collects copyrighted computer

              software. These definitions have been derived from the

              data, instead of relying upon those who defend the

              "integrity" of the original meanings, or those who are

              unfamiliar with the culture.
^



                                                                   26





                      Topography of the Computer Underground

                   Having defined the three main roles in the

              computer underground, it is necessary to examine each

              activity separately in order to provide a general

              typology of the computer underground.  In doing so, the

              ways in which each contributes to the culture as a

              whole will be illustrated, and the divisions between

              them that affect the overall organization will be

              developed. Analysis of these roles and divisions is

              crucial to understanding identity, access, and mobility

              within the culture.



              Hacking

                   In the vernacular of the computer underground,

              "hacking" refers to gaining access and exploring

              computer systems and networks. "Hacking" encompasses

              both the act and the methods used to obtain valid user

              accounts on computer systems.

                     "Hacking" also refers to the activity that

              occurs once access to another computer has been

              obtained. Since the system is being used without

              authorization, the hacker does not, generally speaking,

              have access to the usual operating manuals and other

              resources that are available to legitimate users.
^



                                                                   27

              Therefore, the hacker must experiment with commands and

              explore various files in order to understand and

              effectively use the system.  The goal here is to

              explore and experiment with the system that has been

              entered. By examining files and, perhaps, by a little

              clever programming, the hacker may be able to obtain

              protected information or more powerful access

              privileges.5



              Phreaking

                   Another role in the computer underground is that

              of the "phone phreak."  Phone phreaking, usually called

              just "phreaking," was widely publicized when the

              exploits of John "Cap'n Crunch" Draper, the "father of

              phreaking," were publicized in a 1971 Esquire magazine

              article.

                   The term "phreaking" encompasses several different

              means of circumventing  the billing mechanisms of

              telephone companies.  By using these methods, long-
              ____________________

                   5 Contrary to the image sometimes perpetuated by
              computer security consultants, the data indicate that
              hackers refrain from deliberately destroying data or
              otherwise damaging the system.  Doing so would conflict
              with their instrumental goal of blending in with the
              average user so as not to attract undue attention to
              their presence and cause the account to be deleted.
              After spending what may be a substantial amount of time
              obtaining a high access  account, the hacker places a
              high priority on not being discovered using it.

^



                                                                   28

              distance phone calls can be placed without cost. In

              many cases the methods also prevent, or at least

              inhibit, the possibility of calls being traced to their

              source thereby helping the phreaker to avoid being

              caught.

                   Early phreaking methods involved electro-

              mechanical devices that generated key tones, or altered

              line voltages in certain ways as to trick the

              mechanical switches of the phone company into

              connecting calls without charging.  However the advent

              of computerized telephone-switching systems largely

              made these devices obsolete.  In order to continue

              their practice the phreaks have had to learn hacking

              skills:6

                   Phreaking and hacking have just recently
                   merged, because now, the telephone companies
                   are using computers to operate their network.
                   So, in order to learn more about these
                   computers in relation to the network, phreaks
                   have learned hacking skills, and can now
                   program, and get around inside the machines
                   (AF, message log, 1988).

                   For most members of the computer underground,

              phreaking is simply a tool that allows them to call

              long distance without amassing enormous phone bills.
              ____________________

                   6 Because the two activities are so closely
              related, with phreakers learning hacking skills and
              hackers breaking into "telco" computers, reference is
              usually made to phreak/hacking or "p/hackers."  This
              paper follows this convention.

^



                                                                   29

              Those who have a deeper and more technically oriented

              interest in the "telco" (telephone company) are known

              as phreakers. They, like the hackers discussed earlier,

              desire to master and explore a system that few

              outsiders really understand:

                   The phone system is the most interesting,
                   fascinating thing that I know of. There is so
                   much to know. Even phreaks have their own
                   areas of knowledge.  There is so much to know
                   that  one phreak could know something fairly
                   important and the next  phreak not.  The next
                   phreak might know ten things that the  first
                   phreak doesn't though. It all depends upon
                   where and  how they get their info.  I myself
                   %sic% would like to work for the telco, doing
                   something interesting, like programming a
                   switch. Something that isn't slave labor
                   bullshit. Something that you enjoy, but have
                   to take risks in order to participate unless
                   you are lucky enough to work for the telco.
                   To have access to telco things, manuals, etc
                   would be great (DP, message log, 1988).

                   Phreaking involves having the dedication to
                   commit yourself to learning as much about the
                   phone system/network as possible. Since most
                   of this information is not made public,
                   phreaks have to resort to legally
                   questionable means to obtain the knowledge
                   they want (TP2, message log, 1988).



                   Most members of the underground do not approach

              the telephone system with such passion. Many hackers

              are interested in the phone system solely to the extent

              that they can exploit its weaknesses and pursue other

              goals.  In this case, phreaking becomes a means and not

              a pursuit unto itself. Another individual, one who
^



                                                                   30

              identifies himself as a hacker, explains:

                   I know very little about phones . . . I just
                   hack. See, I can't exactly call these numbers
                   direct.  A lot of people are in the same
                   boat.  In my case, phreaking is a tool, an
                   often used one, but nonetheless a tool (TU,
                   message log, 1988).


                   In the world of the computer underground, the

              ability to "phreak a call" is taken for granted.  The

              invention of the telephone credit card has opened the

              door to wide-scale phreaking.  With these cards, no

              special knowledge or equipment is required to phreak a

              call, only valid credit card numbers, known as "codez,"

              are needed to call any location in the world.  This

              easy access to free long-distance service is

              instrumental for maintaining contact with CU

              participants scattered across the nation.



              Pirating

                   The third major role in the computer underground

              is that of the software pirate.  Software piracy refers

              to the unauthorized copying and distribution of copy-

              righted software.  This activity centers around

              computer bulletin board systems that specialize in

              "warez."7   There pirates can contribute and share
              ____________________

                   7 "Warez" is a common underground term that refers
              to pirated software.

^



                                                                   31

              copies of commercial software. Having access to these

              systems (usually obtained by contributing a copyrighted

              program via a telephone modem) allows the pirate to

              copy, or "download," between two to six programs that

              others have contributed.

                   Software piracy is a growing concern among

              software publishing companies. Some contend that the

              illegal copying of software programs costs the industry

              billions of dollars in lost revenues. Pirates challenge

              this, and claim that in many ways pirating is a hobby,

              much like collecting stamps or baseball cards, and

              their participation actually induces them to spend more

              on software than they would otherwise, even to the

              point of buying software they don't truly need:

                   There's a certain sense of, ahh, satisfaction
                   in having the latest program, or being the
                   first to upload a program on the "want list."
                   I just like to play around with them, see
                   what they can do. If I like something, I'll
                   buy it, or try out several programs like it,
                   then buy one. In fact, if I wasn't pirating,
                   I wouldn't buy any warez, because some of
                   these I buy I do for uploading or just for
                   the fun of it. So I figure the software
                   companies are making money off me, and this
                   is pretty much the same for all the really
                   elite boards, the ones that have the best and
                   most programs. . . . I just bought a $117.
                   program, an accounting program, and I have
                   absolutely no use for it. It's for small
                   businesses.  I thought maybe it would auto-
                   write checks, but it's really a bit too high
                   powered for me. I thought it would be fun to
                   trade to some other boards, but I learned a
                   lot from just looking at it (JX, field notes,
                   1989).
^



                                                                   32


                   Pirates and phreak/hackers do not necessarily

              support the activities of each other, and there is

              distrust and misunderstanding between the two groups.

              At least part of this distrust lies in the

              phreak/hacker perception that piracy is an unskilled

              activity.8  While p/hackers probably don't disapprove

              of piracy as an activity, they nevertheless tend to

              avoid pirate bulletin board systems --partly because

              there is little pertinent phreak/hack information

              contained on them, and partly because of the belief

              that pirates indiscriminately abuse the telephone

              network in pursuit of the latest computer game.  One

              hacker illustrates this belief by theorizing that

              pirates are responsible for a large part of telephone

              credit card fraud.

                   The media claims that it is solely hackers
                   who are responsible for losses pertaining to
                   large telecommunication companies and long
                   distance services.  This is not the case.  We
                   are %hackers% but a small portion of these
                   losses.  The rest are caused by pirates and
                   thieves who sell these codes to people on the
                   street (AF, message log, 1988).

                   Other hackers complained that uploading large
              ____________________

                   8 A possible exception to this are those pirates
              that have the programming skills needed to remove copy
              protection from software.  By removing the program code
              that inhibits duplicate copies from being made these
              individuals, known as "crackers," contribute greatly to
              the easy distribution of "warez."

^



                                                                   33

              programs frequently takes several hours to complete,

              and it is pirate calls, not the ones placed by "tele-

              communications enthusiasts" (a popular euphemism for

              phreakers and hackers) that cost the telephone industry

              large sums of money. However, the data do not support

              the assertation that all pirates phreak their calls.

              Phreaking is considered "very tacky" among elite

              pirates, and system operators (Sysops) of pirate

              bulletin boards discourage phreaked calls because it

              draws attention to the system when the call is

              discovered by the telephone company.

                   Regardless of whether it is the lack of phreak/

              hack skills, the reputation for abusing the network, or

              some other reason, there is indeed a certain amount of

              division between the world of phreakers and hackers and

              that of pirates. The two communities co-exist and share

              resources and methods, but function separately.


^



                                                                   34





                   Social Organization and Deviant Associations

                   Having outlined and defined the activities of the

              computer underground, the question of social

              organization can be addressed.  Joel Best and David

              Luckenbill (1982) have developed a typology for

              identifying the social organization of deviant

              associations.  Essentially they state that deviant

              organizations, regardless of their actual type of

              deviance, will vary in the complexity of their division

              of labor, coordination among organization roles, and

              the purposiveness with which they attempt to achieve

              their goals.  Those organizations which display high

              levels in each of these categories are more

              sophisticated than those with lower levels.

                   Deviants relations with one another can be
                   arrayed along the dimension of organizational
                   sophistication. Beginning with the least
                   sophisticated form, %we% discuss five forms
                   of the social organization of deviants:
                   loners, colleagues, peers, mobs, and formal
                   organizations.  These organization forms are
                   defined in terms of four variables: whether
                   the deviants associate with one another;
                   whether they participate in deviance
                   together; whether their deviance requires an
                   elaborate division of labor; and whether
                   their organization's activities extend over
                   time and space (Best and Luckenbill, 1982,
                   p.24).

              These four variables, also known as mutual association,

              mutual participation, elaborate division of labor, and
^



                                                                   35

              extended organization, are indicators of the social

              organization of deviant groups. The following, taken

              from Best and Luckenbill, illustrates:

              FORM OF       MUTUAL    MUTUAL      DIVISION  EXTENDED
              ORGAN-        ASSOCIA-  PARTICIPA-  OF        ORGAN-
              IZATION       TION      TION        LABOR     IZATION
              -----------------------------------------------------
              Loners         no        no          no        no
              Colleagues     yes       no          no        no
              Peers          yes       yes         no        no
              Mobs           yes       yes         yes       no
              Formal
              Organizations  yes       yes         yes       yes
              _____________________________________________________
                                                      (1982, p.25)


                   Loners do not associate with other deviants,
                   participate in shared deviance, have a
                   division of labor, or maintain their deviance
                   over extended time and space.  Colleagues
                   differ from loners because they associate
                   with fellow deviants. Peers not only
                   associate with one another, but also
                   participate in deviance together.  In mobs,
                   this shared participation requires an
                   elaborate division of labor.  Finally, formal
                   organizations involve mutual association,
                   mutual participation, an elaborate division
                   of labor, and deviant activities extended
                   over time and space (Best and Luckenbill,
                   1982, pp.24-25).

                   The five forms of organizations are presented as

              ideal types, and "organizational sophistication" should

              be regarded as forming a continuum with groups located

              at various points along the range (Best and Luckenbill,

              1982, p.25).  With these two caveats in mind, we begin

              to examine the computer underground in terms of each of
^



                                                                   36

              the four organizational variables. The first level,

              mutual association, is addressed in the following

              section.


^



                                                                   37





                                Mutual Association

                   Mutual association is an indicator of

              organizational sophistication in deviant associations.

              Its presence in the computer underground indicates that

              on a social organization level phreak/hackers act as

              "colleagues."  Best and Luckenbill discuss the

              advantages of mutual association for unconventional

              groups:

                   The more sophisticated the form of
                   organization, the more likely the deviants
                   can help one another with their problems.
                   Deviants help one another in many ways: by
                   teaching each other deviant skills and a
                   deviant ideology; by working together to
                   carry out complicated tasks; by giving each
                   other sociable contacts and moral support; by
                   supplying one another with deviant equipment;
                   by protecting each other from the
                   authorities; and so forth.  Just as  %others%
                   rely on one another in the course of everyday
                   life, deviants find it easier to cope with
                   practical problems when they have the help of
                   deviant associates (1982,pp.27-28).


                   Hackers, phreakers, and pirates face practical

              problems. For example, in order to pursue their

              activities they require  equipment9 and knowledge.  The
              ____________________

                   9 The basic equipment consists of a modem, phone
              line, and a computer -- all items that are available
              through legitimate channels.  It is the way the
              equipment is used, and the associated knowledge that is
              required, that distinguishes hackers from other
              computer users.

^



                                                                   38

              problem of acquiring the latter must be solved and,

              additionally, they must devise ways to prevent

              discovery , apprehension and sanctioning by social

              control agents.10

                   One method of solving these problems is to turn to

              other CU members for help and support.  Various means

              of communication have been established that allow

              individuals to interact regardless of their location.

              As might be expected, the communication channels used

              by the CU reflect their interest and ability in high-

              technology, but the technical aspects of these methods

              should not overshadow the mutual association that they

              support.  This section examines the structure  of

              mutual association within the computer underground.














              ____________________



                   10 Telephone company security personnel, local law
              enforcement, FBI, and Secret Service agents have all
              been involved in apprehending hackers.

^



                                                                   39





                     The Structure of the Computer Underground

                   Both computer underground communities, the

              p/hackers and the pirates, depend on communications

              technology to provide meeting places for social and

              "occupational" exchanges.  However, phreakers, hackers,

              and pirates are widely dispersed across the country

              and, in many cases, the globe.  In order for the

              communication to be organized and available to

              participants in many time zones and "working" under

              different schedules, centralized points of information

              distribution are required.  Several existing

              technologies --computer bulletin boards, voice mail

              boxes, "chat" lines, and telephone bridges/loops --

              have been adopted by the CU for use as communication

              points. Each of these technologies will be addressed in

              turn, giving cultural insight into CU activities, and

              illustrating mutual association among CU participants.



              Bulletin Board Systems

                   Communication in the computer underground takes

              place largely at night, and primarily through Bulletin

              Board Systems (BBS).  By calling these systems and

              "logging on" with an account and password individuals

              can leave messages to each other, download files and
^



                                                                   40

              programs, and, depending on the number of phone lines

              into the system, type messages to other users that may

              be logged on at the same time.

                   Computer Bulletin Board Systems, or "boards,"  are

              quite common in this computerized age.  Nearly every

              medium-sized city or town has at least one. But not all

              BBS are part of the computer underground culture.  In

              fact, many systems prohibit users from discussing CU

              related activity.  However, since all bulletin boards

              systems essentially function alike it is only the

              content, users, and CU culture that distinguish an

              "underground" from a "legitimate" bulletin board.

                   Computer Underground BBS are generally owned and

              operated by a single person (known as the "system

              operator" or "sysop"). Typically setup in a spare

              bedroom, the costs of running the system are paid by

              the sysop, though some boards solicit donations from

              users. The sysop maintains the board and allocates

              accounts to people who call the system.

                   It is difficult to assess the number of

              underground bulletin boards in operation at any one

              time. BBS in general are transitory in nature, and CU

              boards are no exception to this. Since they are

              operated by private individuals, they are often set up

              and closed down at the whim of the operator. A week
^



                                                                   41

              that sees two new boards come online may also see

              another close down.  A "lifetime" of anywhere from 1

              month to 1-1/2 years is common for pirate and

              phreak/hack boards.11   One BBS, claimed to be the

              "busiest phreak/hack board in the country" at the

              time,12 operated for less than one year and was

              suddenly closed when the operator was laid off work.

                   Further compounding the difficulty of estimating

              the number of CU boards is their "underground" status.

              CU systems do not typically publicize their existence.

              However, once access to one has been achieved, it is

              easy to learn of other systems by asking users for the

              phone numbers.  Additionally, most BBS maintain lists

              of other boards that users can download or read. So it

              is possible, despite the difficulties, to get a feel

              for the number of CU boards in operation.    Pirate

              boards are the most common of "underground" BBS.  While

              there is no national "directory" of pirate boards,

              there are several listings of numbers for specific
              ____________________

                   11 While some non-CU BBS' have been operating
              since 1981, the longest operating phreak/hack board has
              only been in operation since 1984.


                   12 At it's peak this p/h board was receiving 1000
              calls a month and supported a community of 167 users
              (TP BBS, message log, 1989).

^



                                                                   42

              computer brands.13  One list of Apple pirate boards has

              700 entries. Another, for IBM boards, lists just over

              500.  While there is no way of determining if these

              lists are comprehensive, they provide a minimum

              estimate. Pirate boards for systems other than IBM or

              Apple seem to exhibit similar numbers. David Small, a

              software developer that has taken an aggressive stance

              in closing down pirate boards, estimates that there are

              two thousand in existence at any one time (1988).

              Based on the boards discovered in the course of this

              research, and working from an assumption that each of

              the four major brands of microcomputers have equal

              numbers of pirate boards, two thousand is a reasonable

              estimate.

                   The phreak/hack BBS community is not divided by

              differing brands of micro-computers.  The applicability

              of phreak/hack information to a wide range of systems

              does not require the specialization that pirate boards

              exhibit.  This makes it easier to estimate the number

              of systems in this category.

                   John Maxfield, a computer security consultant, has

              asserted that there are "thousands" of phreak/hack
              ____________________

                   13 Pirate boards are normally "system specific" in
              that they only support one brand or model of
              microcomputer.

^



                                                                   43

              boards in existence (WGN-Radio, November 1988).  The

              data, however, do not confirm this.  A list of

              phreak/hack boards compiled by asking active p/hackers

              and downloading BBS lists from known phreak/hack

              boards, indicates that there are probably no more than

              one hundred.  Experienced phreak/hackers say that the

              quality of these boards varies greatly, and of those

              that are in operation today only a few (less than ten)

              attract the active and knowledgeable user.

                   Right after "War Games" came out there must
                   have been hundreds of hacker bulletin boards
                   spring up. But 99% of those were lame. Just a
                   bunch of dumb kids that saw the movie and
                   spent all there %sic% time asking "anyone got
                   any k00l numberz?" instead of actually
                   hacking on anything. But for a while there
                   was %sic% maybe ten systems worth calling . .
                   . where you could actually learn something
                   and talk to people who knew what was going
                   Nowadays %sic% there are maybe three that I
                   consider good . . . and about four or five
                   others that are okay.  The problem is that
                   anybody can set up a board with a k-rad name
                   and call it a hacker board and the media/feds
                   will consider it one if it gets busted. But
                   it never really was worth a shit from the
                   beginning.(TP2, field notes, 1989)


                   Towards a BBS Culture.  Defining and identifying

              CU boards can be problematic.  The lack of an ideal

              type undoubtedly contributes to the varying estimates

              of the number of CU bulletin board systems. While

              developing such a typology is not the intent of this

              work, it is appropriate to examine the activities and
^



                                                                   44

              characteristics exhibited by BBS supporting the pirate

              and phreak/hack communities.  While much of the culture

              of pirate and phreak/hack worlds overlap, there are

              some differences in terms of how the BBS medium is used

              to serve their interests. We begin with a short

              discussion of the differences between the two

              communities, then discuss cultural characteristics

              common to all CU BBS systems.

                   All BBS feature a "files area" where programs and

              text files are available for downloading by users.

              Initially these programs/files are supplied by the

              system operator, but as the board grows they are

              contributed (called "uploading") by callers. The

              content and size of the files area differs according to

              whether the board supports the pirate or phreak/hack

              community.

                   The files area on a pirate board consists

              primarily of programs and program documentation.

              Normally these programs are for only one brand of

              micro-computer (usually the same as the system is being

              run on). Text files on general or non-computer topics

              are uncommon.  A "files area" menu from a pirate BBS

              illustrates the emphasis on software:

                   %1% Documentation        %2% Telecommunications
                   %3% Misc Applications    %4% Word Processing
                   %5% Graphics             %6% Utilities
                   %7% Games 1              %8% Games 2
^



                                                                   45

                   %9% XXX Rated            %10% Elite_1
                   %11% Elite_2             %12% Super_Elite
                                     (IN BBS, message log, 1988)

                   The "files area" on a phreak/hack BBS is

              noticeably smaller than it is on pirate systems.  It

              consists primarily of instructional files (known as "g-

              files" for "general files") and copies of phreak/hack

              newsletters and journals.  Pirated commercial software

              is very rare; any programs that are available are

              usually non-copyrighted specialized programs used to

              automate the more mundane aspects of phreaking or

              hacking. It is not uncommon to find them in forms

              usable by different brands of computers.  A "files

              area" list from a phreak/hack BBS is listed here

              (edited for size):

                     Misc Stuff
                   -------------
                   BRR2    .TXT: Bell Research Report Volume II
                   BRR1    .TXT: Bell Research Report Volume I
                   CONFIDE .ARC: Confide v1.0 DES
                                 EnCryption/DeCryption
                   CNA     .TXT: A bunch of CNA numbers
                   CLIPS   .ARC: newsclippings/articles on hackers
                                 and busts
                   ESS1    .TXT: FILE DESCRIBING THE ESS1 CHIP
                   TELEPHON.TXT: NY Times Article on hackers/phreaks
                   HP-3000 .TXT: This tells a little info about hp
                   VIRUS   .TXT: Digest of PC anti-viral programs.

                   Hack/Phreak Programs
                   -----------------------
                   THIEF   .ARC: Code Thief for IBM!
                   PC-LOK11.ARC: IBM Hard Disk Lock Utility- fairly
                                 good.
                   PHONELIS.COM: Do a PHONE DIR command on VAX from
                                 DCL.
                   XMO     .FOR: VAX Xmodem Package in FORTRAN
^



                                                                   46

                   PASSWORD.ARC: IBM Password on bootup.  Not too
                                 bad.

                   Archived Gfiles
                   ----------------------
                   PHRACK15.ARC: Phrack #15
                   PHRACK10.ARC: Phrack #10
                   PHRACK20.ARC: Phrack #20
                   ATI1_6.ARC  : ATI issues one thru six
                   PHRACK5.ARC : Phrack #5
                   PHRACK25.ARC: Phrack #25
                   PHUN1.ARC   : P/Hun first issue
                   TCSJ.ARC    : Telecom Security Journal
                   ATI31.ARC   : Activist Times Inc number 31
                   LODTECH3.ARC: LoD Tech Journal three
                                        (TPP BBS, message log, 1988)

                   The difference in files area size is consistent

              with the activities of pirates and phreak/hackers.  The

              main commodity of exchange between pirates is, as

              discussed earlier, copyrighted software thus accounting

              for the heavy use of that area of the board that

              permits exchange of programs.  The phreak/hackers, on

              the other hand, primarily exchange information about

              outside systems and techniques.  Their interests are

              better served by the "message bases" of BBS.

                   The "message bases" (areas where callers leave

              messages to other users) are heavily used on

              phreak/hack systems. The  messages are not specific to

              one brand of micro-computer due to the fact that not

              all users own the same equipment. Rather than focus on

              the equipment owned by the phreak/hacker, the messages

              deal with their "targets."  Everything from

              phreak/hacking techniques to CU gossip is discussed. On
^



                                                                   47

              some boards all the messages, regardless of topic, are

              strung together in one area.  But on others there are

              separate areas dealing with specific networks and

              mainframe computers:

                   Message Boards available:

                    1 : General
                    2 : Telecommunications
                    3 : Electronics
                    4 : Packet Switched Nets
                    5 : VAX/DEC
                    6 : Unix
                    7 : Primos
                    8 : HP-x000
                    9 : Engineering
                   10 : Programming & Theory
                   11 : Phrack Inc.
                   12 : Sociological Inquiries
                   13 : Security Personnel & Discussion
                   14 : Upper Deck
                   15 : Instructors
                                      (TPP BBS, message log, 1988)


                   The pirate community, on the other hand, makes

              little use of the "message bases." Most users prefer to

              spend their time (which may be limited by the system

              operator on a per day or per call basis) uploading

              and/or downloading files rather than leaving messages

              for others.  Those messages that do exist are usually

              specific to the pirating enterprise such as help with

              programs on the board, requests for specific programs

              ("want lists"), and notices about other pirate bulletin

              boards that users may want to call. Occasional

              discussion of phreaking may occur, but the emphasis is
^



                                                                   48

              on techniques used to make free calls, not technical

              network discussions as often occurs on phreak/hack

              systems.  A list of message areas from a large pirate

              BBS illustrates the emphasis on the pirating

              enterprise.  A message area for general discussions has

              been created, but those areas devoted to pirating

              display more use:

                   Area %1% General Discussion      15 messages
                   Area %2% Pirating Only!!         75 messages
                   Area %3% Warez Wants             31 messages
                   Area %4% **private messages**    10 messages
                                    (TL BBS, message log, 1988)


                   In addition to the differences between files and

              message use on pirate and phreak/hack boards, they

              differ in degree of community cohesiveness.  Every BBS

              has a group of "users" --the people who have accounts

              on the system. The group of users that call a specific

              BBS can be considered to be a "community" of loosely

              associated individuals by virtue of their "membership"

              in the BBS.

                   Additionally, the system itself, serving either

              pirates or phreak/hackers, exists within a loose

              network of other bulletin boards that serve these same

              interests. It is within this larger community where

              pirate and phreak/hack boards seem to differ.

                   Due to the brand-specific nature of pirate boards,

              there is not a strong network between pirate BBS that
^



                                                                   49

              operate on other systems.  This is understandable as a

              pirate that owned an Apple computer would have little

              use for the programs found on an IBM board.  However,

              this creates separate communities of active pirates,

              each loosely associated with other users of their

              computer type, but with little or no contact with

              pirate communities on other systems.

                   There is, however, a degree of cohesiveness among

              pirate boards that support the same micro-computers.

              While the users may be different on systems, the data

              shows that some pirate boards are "networked" with each

              other via special software that allows messages and

              files to be automatically shared between different

              boards.  Thus a message posted on a west coast pirate

              board will be automatically copied on an east coast BBS

              later that night. In a like manner, software programs

              can be sent between "networked" boards.  The extent of

              this network is unknown.

                   The pirate BBS community also exhibits

              cohesiveness in the form of "co-sysops."  As discussed

              earlier, sysops are the system operators and usually

              owners of BBS.  On some pirate boards, "co-sysop"

              distinction is given to an operator of another board,

              often located in another state. This forms a loose

              network of "sister boards" where the sysop of one has
^



                                                                   50

              co-sysop privileges on the other.   However, this

              cooperative effort appears to be limited mainly to the

              system operators as comparing user lists from sister

              boards shows little overlap between the regular

              callers. How co-sysop positions are utilized is

              unknown, and it is suspected that they are largely

              honorary.  But nonetheless it is indicative of mutual

              association between a small number of boards.

                    The phreak/hack board community does not exhibit

              the same brand-specific division as the pirate

              community.  Unlike the divided community of pirates,

              phreak/hackers appear to maintain contacts throughout

              the country.  Obtaining and comparing user lists from

              several phreak/hack BBS reveals largely the same group

              of people using several different boards across the

              country.14 While phreak/hack boards have yet to adopt

              the "networking" software used by pirate boards, an

              active group of phreak/hackers is known to use the

              sophisticated university mainframe computer network,

              called Bitnet, to exchange phreak/hack newsletters and

              gossip.

                   Despite the operational differences between pirate
              ____________________

                   14 In fact, users lists from phreak/hack BBSs
              located in Europe and Australia show that many U.S.
              p/hackers utilize these systems as well.

^



                                                                   51

              and phreak/hack boards, their cultures are remarkably

              similar. Any discussion of the computer underground

              must include both communities.  Additionally, a

              formulation of the culture of CU BBS must address the

              means in which access to the board, and thus deviant

              associates, is obtained.

                   For a caller to successfully enter the CU BBS

              community, he must display an awareness of CU culture

              and technical skill in the CU enterprise. If the caller

              fails to exhibit cultural knowledge, then access to the

              board is unlikely to be granted.  The ways in which

              this cultural knowledge is obtained and displayed

              illustrates the social nature of the CU and further

              displays some of the subcultural norms of behavior.

                   On most "licit" (non-underground) boards,

              obtaining permission to use the system is accomplished

              by logging on and providing a name and home phone

              number to the system operator (sysop).  Sysop's

              normally do not check the validity of the information,

              and once a caller has provided it he or she is granted

              full access to the system.  There is normally one level

              of access for all users, with only the sysop having

              more "powerful" access.

                   Obtaining access to underground bulletin boards is

              more complicated and requires more steps to complete.
^



                                                                   52

              In an attempt to prevent law enforcement agents

              ("feds") from obtaining accounts on systems where

              pirates or p/hackers are vulnerable, if not to actual

              arrest, then at least to exposing their latest act-

              ivities and methods, sysop's of illicit boards attempt

              to limit access to the system.

                   One method of doing this is to restrict

              publicizing the existence of the board.  Computer

              underground BBS are not normally included in BBS

              listings found in computer books and magazines, and

              there is a norm, particularly strong on p/hack systems,

              that the boards are not to be mentioned on non-CU

              systems.  There are, however, some "entry-level" CU BBS

              that are fairly well known.  These systems are known as

              "anarchist" boards.

                   "Anarchist" boards, while exhibiting many of the

              same characteristics as pirate and phreak/hack boards,

              are really a cross between the two and serve primarily

              as social outlets for both pirates and phreak/hackers.

              The message areas on "anarchist" boards are quite

              active, "chatty" messages are not discouraged. Indeed

              there are normally  several different message areas

              devoted to a wide range of topics including everything

              from "skipping school" to "punk rock." The files area

              contains both warez (but normally only the newest
^



                                                                   53

              games, and specific to the computer system that the

              board runs on) and phreak/hack text files.  Neither

              collection is as extensive as it would be on pirate-

              only or p/hack-only systems.

                   The data suggest that one function of "anarchist"

              boards is to introduce newcomers to the culture of the

              computer underground. By acting as "feeder boards,"

              they can provide preliminary socialization and

              instruction for CU behavior and techniques.

              Additionally, "anarchist" boards frequently provide

              areas where phone numbers to pirate and p/hack systems

              can be traded, thus providing systems where more in-

              depth information, and other contacts, can be found.  A

              phreak/hacker describes how an "anarchist" board was

              instrumental in introducing him to the computer

              underground:

                   I've been phreaking and hacking for about
                   four years now.  I discovered phreaking on my
                   own at this place I used to work.  We had
                   this small LD %long distance% provider that
                   used codez so I started hacking them out and
                   calling places myself . . . but I didn't know
                   no other phreaks at that time.  Then I
                   started using the codez to call boards from
                   home on my computer. Somebody gave me the
                   number to Jack Black's Whore House %an
                   "anarchy board"% and I started learning about
                   hacking and shit from the people and philes
                   they had there. Then one day this guy, King
                   Hammer, sent me some e-mail %a private
                   message% and told me to call his system.
                   That's where I really learned my way around
                   the nets and shit.  You could ask questions
                   and people would help you out and stuff. If I
^



                                                                   54

                   hadn't found out some of the tricks that I
                   did I probably would have got busted by now.
                   (TP2, field notes, 1989)

                   Once an individual has obtained the telephone

              number to a CU BBS, through whatever channels, callers

              follow essentially the same procedure as they do on

              licit systems . . . that of calling and logging on.

              However, since "underground" boards are not truly

              underground (that is, totally secret) first-time

              callers are not given access to the board itself. When

              a user is unable to provide an already valid

              username/password, the system will automatically begin

              its registration procedure.   First, the caller is

              asked to enter a "username" (the name used by the

              system to distinguish between callers) and "phone

              number."  These first system requests, normally seen

              only as "Enter Your Name and Phone Number," serve as

              partial screens to keep out non-underground callers

              that may have happened across the board.  The way that

              a user responds to these questions indicates if they

              have cultural knowledge of the CU. The  norm is to

              enter a pseudonym and a fake phone number.15 If a
              ____________________

                   15 A functional reason for this norm is that
              usernames and telephone numbers are stored on the
              computer as part of the BBS system files.  Should the
              BBS ever be seized in legal proceedings, this list of
              names and numbers (and on some systems addresses . . .
              which are also normally false) could be used to
              identify the users of the system.

^



                                                                   55

              caller enters his or her real name (or at least a name

              that does not appear to be a pseudonym) the system

              operator will be put on guard that the caller may not

              be aware of the type of board that he has called, for

              the pseudonym is the most visible of CU cultural

              traits.

                   All members of the underground adopt "handles" to

              protect their identity.  The pseudonyms become second

              identities and are used to log onto bulletin boards,

              and as  "signatures" on messages and instructional text

              files.16  They are not unlike those adopted by

              citizens-band radio users, and reflect both the humor

              and technical orientation of computer underground

              participants.  A review of handles used by phreakers,

              hackers, and pirates finds that they fall into three

              broad categories: figures from literature, films, and

              entertainment (often science fiction); names that play

              upon computers and related technologies; and

              nouns/descriptive names.  (See Appendix A for fictional

              examples of each.)

                   After providing a user name and entering a

              ____________________



                   16 The data suggest that, on the whole,
              individuals retain their handles over time.

^



                                                                   56

              password to be used for future calls, the caller is

              asked several more questions designed to screen users

              and determine initial access privileges.  Unlike licit

              boards, underground BBS may have several different

              levels of access with only the most trusted users being

              able to read messages and get files in "elite" or "high

              access" areas that are unknown and unavailable to other

              callers.  In many cases, pirate boards are able to

              operate "above ground"  and appear to be open-public

              access systems unless callers have the proper

              privileges to access the areas where the "good stuff"

              is located.  The answers given to access questionnaires

              determine whether a caller will receive access to some,

              all, or none of the higher levels.

                   These questionnaires frequently ask for "personal

              references" and a list of other boards the caller has

              "high access" on.  The question is vague, and random

              callers are unlikely to answer it correctly.  However,

              if the caller lists pseudonyms of other CU members that

              are known and trustworthy to the sysop, as well as some

              other boards that are known to have "good users" and

              "good security" access will usually be granted.17  If

              all the answers are relevant and indicative of CU
              ____________________

                   17 The data suggest that personal references are
              only checked if something seems unusual or suspicious.

^



                                                                   57

              knowledge, then initial access is normally granted.

                   Other methods of controlling access include

              presenting a "quiz" to determine if the technical

              knowledge of the user is up to par with the expertise

              expected on the boards.18  Some systems, instead of a

              quiz, ask the user to write a short statement (100

              words or less) about why they want access, where they

              got the phone number to the system, and what they can

              provide to other users. Some pirate boards come right

              out and ask the user to supply a list of the good

              "warez" that they can upload and what they are looking

              to download. If the caller fails to list recent

              copyrighted programs then it is evident that they are

              unaware of the nature of the BBS:

                   I had this one dude call up and he told me in
                   his message that he was looking for some
                   "good games."  So instead of giving him
                   access I just left him some e-mail %a private
                   message%.  I asked what kind of games he was
                   looking for. Next time he called he wrote
                   back and said "a public domain Asteroids
                   game."  I couldn't believe it. Not only is
                   Asteroids so damn old it's lame, but this guy
                   is looking for pd %public domain% shit.  No
                   way was he going to get access. He didn't
                   even know what this board is. I left him a
                   message telling him that I didn't have one.
                   He never called back after that (CH, sysop of
                   a pirate BBS, field notes, 1988).

              ____________________

                   18 One such quiz, from a p/h board, can be found
              in Appendix B.

^



                                                                   58

                   Ironically, the pseudo-elaborate security methods

              of underground boards, while they may be effective in

              keeping off random non-CU callers, are not effective in

              screening out "feds." Data and media accounts show that

              boards are regularly infiltrated by telephone security

              personnel and software companies. Also, the adoption of

              handles to protect identities is defeated by the

              consistent use of the same handle over time. But in

              order to obtain and maintain status and prestige in the

              CU one must keep the same pseudonym in order to

              (literally) "make a name for oneself." The fact that CU

              communication is not face-to-face requires a consistent

              means of identifying oneself to others.  The handle

              fulfills this purpose but at the same time becomes as

              attached to a single individual as a real name would.

              The access rituals of the computer underground, which

              are contingent on being a "known" pirate or

              phreak/hacker, make changing handles unproductive.

                   The life blood and center of the computer under-

              ground is the bulletin board network.  Acting as both

              the main trade center of performance related tools and

              innovations and as a means of socialization, the

              underground could not exist without the BBS network.

              They serve to "recruit" and educate newcomers and

              provide a way to traffic in information and software.
^



                                                                   59

              The pirating enterprise in particular is very dependent

              upon the BBS as they are the very means by which

              "warez" are traded.  For the phreak/hacker community,

              BBS provide a means of trading the resources of system

              numbers and passwords, as well as instructional texts

              on techniques.  The access process serves as evidence

              of mutual association amongst phreakers, hackers, and

              pirates as cultural knowledge is needed as well as

              personal references (evidence of acceptance and access

              to others).

                   The CU bulletin board systems are unique in that

              they provide a way to exchange information with a large

              number of others.  The other methods of CU commun-

              ication are based on conversations rather than written

              texts and thus are much less permanent.  These methods,

              discussed next, are telephone bridges/loops, voice mail

              boxes, and computer "chat" systems.



              Bridges, Loops, and Voice Mail Boxes

                   Of the additional means of communication used by

              the CU, telephone "bridges" and "loops" are most

              common.  Unlike BBS, which require data links provided

              by a computer and modem, bridges and loops are "old

              fashioned" voice connections.  Since they can not

              accommodate the transfer of programs or files they are

              used primarily by phreakers and hackers, and most often
^



                                                                   60

              as a social/recreational outlet.

                   A "bridge" is a technical name for what is

              commonly known as a "chat line" or "conference system."

              They are familiar to the  public as the pay-

              per-minute group conversation systems advertised on

              late night television.  Many bridge systems are owned

              by large corporations who maintain them for business

              use during the day.  While the numbers to these systems

              is not public knowledge, many of them have been

              discovered by phreaks who then utilize the systems

              during the night.

                   In addition to these pre-existing conference

              systems, phreakers have become skilled at  arranging

              for a temporary, private bridge to be created via

              AT&T's conference calling facilities.  This allows for

              conversations to be held among a self-selected group of

              phreak/hackers:19

                   Bridges can be %sic% extremely useful means
                   of distributing information as long as the
                   %phone% number is not known, and you don't
                   have a bunch of children online testing out
              ____________________

                   19 The data indicates that these private
              conference calls aren't "scheduled" in any real sense.
              One p/hacker will initiate the conference and call
              others at home to add them to the conference.  As more
              people join they suggest others to add. The initiator
              can temporarily jump out of the conference, call the
              new person and solicit their attendance. If they don't
              want to join or aren't home, the initiator simply
              returns to the conference without adding them in.

^



                                                                   61

                   their DTMF.20  The last great discussion I
                   participated with over a bridge occurred
                   about 2 months ago on an AT&T Quorum where
                   all we did was engineer 3/way %calls% and
                   restrict ourselves to purely technical infor-
                   mation. We could have convinced the Quorum
                   operators that we were AT&T technicians had
                   the need occurred. Don't let the kids ruin
                   all the fun and convenience of bridges.
                   Lameness is one thing, practicality is
                   another (DC, message log, 1988).


                   In addition to setting up "private" bridges,

              p/hackers can utilize "loop lines" in a further attempt

              to limit the number of eavesdroppers on their

              conversations. Unlike bridges, which connect a

              virtually unlimited number of callers at once, "loops"

              are limited to just two people at a time.

                   "Loop lines" are actually telephone company test

              lines installed for internal use.21  A loop consists of

              two separate telephone numbers that connect only to

              each other. Each end has a separate phone number, and

              when each person calls one end, they are connected to

              each other automatically.  This allows for individuals
              ____________________

                   20 "Dual Tone Multi Frequency" or in laymen terms,
              the touch tone sounds used to dial phone numbers.


                   21 These test lines are discovered by phreaks and
              hackers by programming their home computer to dial
              numbers at random and "listen" for the distinctive tone
              that an answering loop makes, by asking sympathetic
              telephone company employees, or through information
              contained on internal company computers.

^



                                                                   62

              to hold private conversations without divulging their

              location or identity by exchanging telephone numbers.

                   Finally, voice mail boxes ("VMB") are another

              means of communicating with individual actors. There

              are several commercial voice mail box systems located

              throughout the country.  They function similar to a

              telephone answering machine in that callers can call

              in, listen to a recorded message, and then leave a

              message for the box owner. Many of these systems are

              accessible via toll-free telephone numbers. The

              security of some VMB systems is notoriously poor. Many

              phreaks have expertise in "creating" boxes for

              themselves that are unknown (until discovered) by the

              owner of the system. However, these boxes are usually

              short lived since discovery by the system operator, and

              closure of the box, is only a matter of time. But as

              long as the box is functioning, it can serve as a means

              of communicating with others.  VMB numbers are

              frequently posted on bulletin boards with invitations

              to "call if you have any good stuff."  They are often

              used by pirates to exchange messages about new releases

              of software, and by phreak/hackers to trade account and

              access numbers.  Additionally, some of the underground

              newsletters and journals obtain boxes so users can call

              in news of arrests and other gossip.
^



                                                                   63

                   Like bulletin boards, VMBs are systems that allow

              information to be disseminated to a large number of

              associates, and unlike the live telephone conversations

              of bridges and loops, they are available at any time of

              the day.  Additionally, VMB's don't require use of a

              computer and modem, only a touch tone phone is needed

              to call the box.  Their usefulness is limited somewhat

              because they play only one "outgoing" message at a

              time, and their transitory nature limits their

              reliability.



              Summary

                   Phreakers, hackers and pirates do not act as

              loners.  They have adopted existing methods of

              communication, consistent with their skills in high

              technology, to form a social network that allows for

              the exchange of information, the socialization of new

              members, socializing with others, and in the case of

              pirates, performing the "deviant" act itself via these

              means.

                   These communication points create and foster

              groups of loosely associated individuals, with specific

              interests, coming together to exchange information

              and/or software. It is impossible to be a part of the

              social network of the computer underground and be a

              loner.   Based upon the Best and Luckenbill measure,
^



                                                                   64

              actors in the computer underground, by displaying

              mutual association, organize as colleagues.

                   The social network of the computer underground

              provides the opportunity for colleagues to form

              cooperative working relationships with others, thus

              moving the CU towards a more sophisticated form of

              social organization.  These "hacker groups" are

              addressed in the next section.
^



                                                                   65





                               Mutual Participation

                   In the previous chapter the ways in which the

              structure of the computer underground fosters mutual

              association  were discussed. Their social outlets and

              means for informational exchange bring the CU community

              together as deviant colleagues.  Their relationships

              fit quite well into the Best and Luckenbill (1982)

              typology of collegial associations:

                   The relationship between deviant colleagues
                   involves limited contact.  Like loners,
                   colleagues perform their deviant acts alone.
                   But unlike loners colleagues associate with
                   one another when they are not engaged in
                   deviance . . . In effect, there is a division
                   between two settings; onstage where
                   individual performs alone; and backstage,
                   where colleagues meet (cf Goffman).  In their
                   backstage meetings, colleagues discuss
                   matters of common interest, including
                   techniques for performing effectively, common
                   problems and how to deal with them, and ways
                   of coping with the outside world (1982 p.37).

                   However, despite the advantages of collegial

              association, ties between CU participants are weak.

              Loyalty between individuals seems rare, as the CU is

              replete with tales of phreak/hackers who, when

              apprehended, expose identities or "trade secrets" in

              order to avoid prosecution.  These weak collegial ties

              may be fostered by the anonymity of CU communication

              methods, and the fact that all CU actors are, to some
^



                                                                   66

              extent, in competition with each other. There are only

              so many systems with weak security and once such a

              system is found, sharing it with others will virtually

              ensure that the hole will be sealed when the increased

              activity is noticed.  Thus while p/hackers will share

              general knowledge with each other, specific information

              is not disseminated publicly.

                   As Best and Luckenbill have observed, in order to

              remain in a collegial relationship individuals must be

              able to successfully carry out operations alone (1982

              p.45). In order to sustain a career in p/hacking one

              must pursue and collect information independent of what

              is shared on the communication channels.  Despite the

              association with other phreakers and hackers, the

              actual performance of the phreak/hacking act is a

              solitary activity.22

                   That is not to say, however, that p/hackers never

              share specific information with others.  As discussed

              earlier, p/hack bulletin board systems frequently have

              differentiated levels of access where only highly

              regarded individuals are able to leave and read

              messages. These areas are frequently used to keep
              ____________________

                   22 This does not hold true for pirates. By
              definition they must trade programs with other
              individuals.

^



                                                                   67

              information from "unskilled" users at the lower levels.

              There are strong social norms that some information

              should not be shared too widely, as it may be either

              "abused" or fall into the hands of enforcement agents.

              For example, when one p/hacker announced that he was

              going to release a tutorial on how to infiltrate a new

              telephone company computer, he received the following

              messages in reply:

                   Not smart, DT. %That computer% is a system
                   which can be quite powerful if used to its
                   potential. I don't think that information on
                   programming the switches should be released
                   to anyone. Do you realize how destructive
                   %that computer% could really be if used by
                   someone who is irresponsible and intends on
                   destroying things? Don't even think about
                   releasing that file. If you do release that
                   file, it will disappear and will no longer
                   remain in circulation. Believe me. Not many
                   have the right to know about %that computer%,
                   or any other delicate telco computers for
                   that matter. Why do you think the fucking New
                   York Times published that big article on
                   hackers screwing around with telco machines?
                   Not only will you get into a lot of trouble
                   by releasing that file on %computer%, you
                   will be making telcos more aware of what is
                   actually happening, and soon no one will be
                   able to learn about their systems. Just think
                   twice (EP, message log, 1988).

                   Why would you want normal people to have such
                   knowledge? Any why would you post about it?
                   If you have knowledge that's fine but DON'T
                   spread that knowledge among others that may
                   abuse it. It's not impressive! I don't know
                   why anyone would want to disperse that
                   knowledge. Please don't release any "in
                   depth" files on such systems of great power.
                   Keep that to yourself it will just mess it up
                   for others (UU, message log, 1988).

^



                                                                   68


                   The desire to share information with selected

              colleagues often leads to the formation of cooperative

              "working groups." These partnerships are easily formed,

              as the structure of mutual association in the CU

              creates a means where "talent" can be judged on the

              basis of past interactions, longevity in the field, and

              mutual interests. When allegiances are formed, the CU

              actors begin "mutual participating" in their acts, thus

              becoming "peers" in terms of social organization.

                   Mutual participation, as defined in the Best and

              Luckenbill typology, is exhibited by actors sharing in

              the same deviant act, in the physical presence of one

              another (1982 p.45).  However, the measurement was

              "grounded" in studies of traditional deviant

              associations (eg:  street gangs, prostitutes, etc.)

              where "real-time" interaction is common. The technology

              used by the CU negates this requirement as actors can

              be located in different parts of the country.

              Additionally, "hacking" on a system, by a group of

              peers, does not require simultaneous participation by

              all members.  However Best and Luckenbill's typology is

              an ideal type, and the activities of peers in the

              computer underground do not fall outside of the spirit

              or intention of their concept of mutual participation.

              Their description of deviant peer associations is
^



                                                                   69

              presented here:

                   Deviant peers are distinguished from
                   colleagues by their shared participation in
                   deviance.  While colleagues carry out their
                   deviant operations alone, peers commit
                   deviant acts in one another's presence.
                   Peers cooperate in carrying out deviant
                   operations, but they have a minimal division
                   of labor, with each individual making roughly
                   comparable contribution.  Peer relationships
                   also tend to be egalitarian and informal;
                   some peers may be acknowledged leaders or
                   admired for their skill, but there is no set
                   division of authority.  Like colleagues,
                   peers share subcultural knowledge, but peer
                   groups typically provide their members with
                   more support.  In addition to cooperating in
                   deviant operations, peers may recruit and
                   socialize newcomers and supply one another
                   with deviant equipment and social support.
                   Thus, the bonds between peers are stronger
                   than those linking colleagues (1982, p.45).

                   Peer associations in the CU are largely limited to

              small groups23 working on a specified goal.  Both

              pirates and p/hackers organize themselves in this

              regard, though their characteristics differ.  We begin

              with a discussion of mutual participation among

              pirates.



              Pirate Groups

                   Pirate groups are composed of less than ten
              ____________________

                   23 In terms of the ideal type for deviant peers
              any two individuals working in cooperation exhibit
              mutual participation. The discussion here addresses
              groups that consist of three or more people that
              identify themselves as a sort of "club." Short-lived
              interaction between two people is not considered a
              "group" in the CU culture.

^



                                                                   70

              members.  Their primary purpose is to obtain the latest

              software, remove any copy-protection from it, and then

              distribute it to the pirate community.  Often the

              "warez" that they distribute will be adorned with the

              group name, so subsequent users will be aware of the

              source of the software.  Many pirate groups have "home"

              BBS systems that act as key distribution points, and as

              places where outsiders can communicate with members of

              the association. This researcher was unable to obtain

              data about the internal organization of pirate groups,

              but it appears that they are leaderless, with

              individual members working alone but giving credit to

              the group as a whole.



              Phreak/hack groups

              The existence of phreak/hacker groups is well

              documented in the data, and has been heavily reported

              in the media.  Two hacker groups in particular, The

              414's (named for the Wisconsin area code in which they

              lived), and The Inner Circle, received a large amount

              of press after being apprehended for various computer

              break-ins.  However, the "threat" that such groups

              represent has probably been overstated as the data

              indicate that "hacker gangs" vary greatly in

              organization and dedication to the CU enterprise.

                   Many hacker groups are short-lived associations of
^



                                                                   71

              convenience, much like the "no girls allowed!" clubs

              formed by young boys.  They often consist of four to

              nine beginning phreak/hackers who will assist each

              other in obtaining telephone credit-card numbers. By

              pooling their resources, a large number of illicit

              "codez" can be obtained and shared with others.

              Distribution of the account numbers is not limited to

              the group, they are often shared with the community at

              large, "courtesy of Codez Kidz Ltd." Groups of this

              type are looked at with disdain by "elite"

              phreak/hackers and are often criticized as being more

              interested in self-promotion then they are with

              actually phreaking or hacking.

                   Some hacker groups are very proficient and

              dedicated to their craft, however. These groups are

              characterized by smaller memberships, less visibility

              to non-members, and commitment to the CU enterprise.

              They are loosely organized, yet some have managed to

              exist six or more years despite members dropping out or

              being arrested. These "elite" groups are selective

              about membership, and cite trust and talent as the two

              leading requirements for joining:

                   The group exists mainly for information
                   trading. If you trust everyone else in the
                   group, it is very profitable to pool
                   information on systems . . . also it is nice
                   to know someone that you can call if you need
                   help on operating system X and to have people
^



                                                                   72

                   feel free to call you if they need help on
                   operating system Y (AN, message log, 1988).

                   Trust is a very important part of a group. I
                   think that's blatantly obvious. You have to
                   be able to trust the other members of the
                   group with the information you are providing
                   in order to be productive, and have a secure
                   situation (UU, message log, 1988).

                   . . . all groups serve the same purpose: to
                   make their members feel better about
                   themselves (like, wow, I'm in a group) and to
                   trade things, whether it's wares, codes, or
                   whatever. But the thing is that being in a
                   group is like saying "I trust you, so like,
                   what can we do together?" (NN, message log,
                   1988)

                   Indeed, hacker groups are formed primarily for the

              purpose of information exchange.  To this end, groups

              attempt to recruit members with a wide variety of

              "specializations" in order to have a better support

              network to turn to:

                   %Our group% has always been very selective
                   about members (took me six years to get in).
                   The only reason the group exists is to bring
                   together a diverse group of talents. There is
                   very little overlap in %the group% these
                   days.  Everyone has one thing that they are
                   the best in the country at, and are
                   conversant with just about any other form of
                   hacking.  As an example, I got into a Primos
                   computer this morning around 9 am. Once I got
                   in, I know enough about Primos to get around,
                   but that's it. So I call %PS% in New York,
                   give him the info, and when I get home
                   tonight, he has gotten in and decrypted the
                   entire username/password file and uploaded it
                   to me.  But two weeks ago he got into a VAX.
                   He got the account to me, I called it up and
                   set up three backdoors into the system that
                   we can get in if the account is detected or
                   deleted.  Simple matter of communism.  From
                   each according to his ability . . . etc. Also
^



                                                                   73

                   it helps that everyone in the group is
                   experienced enough that they don't fuck up
                   accounts you spend all day getting (TM, field
                   notes, 1989).

                   Consistent with the Best and Luckenbill ideal

              type, hacker groups do not exhibit a set division of

              authority or labor. Most groups are leaderless, and

              every member is free to pursue their own interests,

              involving other members of the group only when desired:

                   We just got our group together.  We've got a
                   guy that does VMB's and a Sprinter %obtains
                   "codez" from U.S. Sprint% and a couple of
                   hackers.  Everybody's free to pursue whatever
                   system they want but if they want or need
                   some help they can call on any of the other
                   members if they want to. Like if one guy is
                   scanning and finds a VAX he might call and
                   give me the dialup.  Then I might have to
                   call our Sprinter to get some codez so I can
                   start hacking on it.  Once I get through I'll
                   give the account to the other members.  But
                   if I found it myself I wouldn't have to give
                   it out but I probably would anyway 'cuz
                   keeping it would be bullshit (DC, field
                   notes, 1988).

                   There isn't a leader really.  The guy who
                   starts the group sort of acts like a contact
                   point but everyone else has everyones' phone
                   number and you can call whoever you want to
                   anytime.  Usually when you're putting a group
                   together you just get everyone you want and
                   you all decide on a name. (DC, field notes,
                   1988).



              Summary

                   By virtue of the extensive social network found in

              the CU, some participants form work groups.  The

              sophistication of these groups varies, but in all cases
^



                                                                   74

              it is evident that the groups exist to support what are

              primarily individually performed activities.  The

              groups exhibit many of the ideal-type characteristics

              of peer associations, and it is clear that in some

              cases the computer underground is socially organized as

              peers.


^



                                                                   75





                                    Conclusion

                   Phreakers, hackers, and pirates do not act as

              loners.  Loners do not associate with others, and are

              on their own in coping with the practical problems

              presented by their activities (Best and Luckenbill

              1982, p.28).  From the data presented here, it is

              evident that the computer underground has established

              an extensive social network for the exchange of

              resources and mutual support.  The characteristics of

              the CU varies according to the goals of the

              participants, but the presence of mutual association is

              consistent. Contact between individuals is limited,

              with the acts of phreaking or hacking being committed

              alone.  Computer underground participants do associate

              with one another in order to discuss matters of common

              interest, such as performance techniques, news, and

              problem solving.  To facilitate this informational

              exchange, they have established a technologically

              sophisticated network that utilizes computer bulletin

              boards, voice mail boxes, telephone bridges, and

              telephone loops.

                   The collegial organization of the computer

              underground is further evidenced by the establishment

              of a CU culture. The subcultural adaptation of
^



                                                                   76

              language, expectations of normative conduct, and status

              stratification based on mastery of cultural knowledge

              and skill, all indicate that the computer underground

              is, at the very least, a social organization of

              colleagues (see Best and Luckenbill, 1982, p.37).

                   The very structure that permits mutual association

              among CU participants also encourages some to form

              working relationships, thus acting as peers by mutually

              participating in CU activities. Peers organized in this

              manner share in their deviance, organizing informally

              with little division of labor or set division of

              authority (Best and Luckenbill, 1982, p.45).  These

              peer associations provide support to members, and can

              provide socialization and recruitment functions for

              newcomers. The establishment of work groups, through

              mutual participation, indicates that though the

              computer underground is largely organized as a network

              of colleagues, it is also, to some degree, a social

              organization of peers.

                   Best and Luckenbill (1982) describe two additional

              forms of deviant associations that are more

              organizationally sophisticated than peers: "mobs" and

              "formal organizations." The computer underground,

              however, does not display the requisite characteristics

              of these organizational types.  The primary
^



                                                                   77

              characteristic of "mobs" is an elaborate division of

              labor (Best and Luckenbill, 1982, p.25).  While some CU

              groups do exhibit a rudimentary division of labor based

              on individual members' specialization, it is not by any

              means "elaborate."  Any division of labor that does

              exist is voluntary and arises on the basis of

              specialized knowledge, not a specialized organizational

              role.

                   In much the same manner the lack of a designated

              leader or leadership hierarchy prevents CU groups from

              being categorized as "formal organizations" in the Best

              and Luckenbill typology.  Deviant organizations at this

              level are quite sophisticated and there is no empirical

              evidence that the computer underground is organized in

              this manner.

                   This study of the computer underground has been a

              test of the Best and Luckenbill typology of the social

              organization of deviants.  As a test of their

              organizational indicators, the CU has shown that the

              categories are well constructed, with the possible

              exception of limiting "mutual participation" to acts

              carried out in the presence of others.  However, if we

              modify this to include non-simultaneous, but

              cooperative, acts as found in phreak/hacker groups, the

              category is otherwise robust.  The flexibility of the
^



                                                                   78

              typology, which explicitly recognizes that not all

              deviant associations will display all of the character-

              istics (Best and Luckenbill, 1982, p.25), is a strength

              that allowed it to be easily used in terms of the

              computer underground.

                   By addressing the CU from a social organizational

              viewpoint we have seen that despite the high technology

              trappings of their craft, pirates, phreakers, and

              hackers display organizational characteristics found in

              other groups that have been criminalized.  This may

              suggest that the development of sophisticated tools to

              commit "crime" does not necessarily affect the ways in

              which individuals organize their activities.

                   The implications of peer and collegial

              organization for the members of the computer

              underground are vast.  The level of sophistication has

              a direct relationship to the types of resources on

              which individuals can draw (Best and Luckenbill, 1982,

              p.54).  Because CU members are mutually associated,

              they are able to turn to colleagues for advice and

              support with various problems.  However, at the

              collegial level they are left to enact the solutions

              independently.  Whether or not they are successful in

              doing so will determine if they choose to remain active

              in the computer underground.  The data show that
^



                                                                   79

              involvement in the CU is short in duration, unless

              success in early phreak/hack attempts is obtained.  As

              long as the CU remains organized as a collection of

              colleagues, this trend will continue.  Additionally, as

              the computer and telephone industries become more

              sophisticated in preventing the unauthorized use of

              their facilities, new phreak/hackers are unlikely to

              succeed in their initial attempts at the act, thus

              dropping away from the activity and never becoming

              acculturated to the point where peer relationships can

              be developed.

                   At the peer level, a dimension of sophistication

              that some members of the CU do display, the knowledge

              and resources to solve problems and obtain resources is

              greater.  However, even at this level the ties between

              peers remain weak at best.  Although their cooperative

              ties allow for more sophisticated operations, and

              somewhat reduce the CU's vulnerability to social

              control agents (Best and Luckenbill, 1982, p.53), it

              still does not completely eliminate the need for

              individual success in order to sustain a CU career.  As

              long as the CU remains at the current level of

              organizational sophistication, with weak ties and

              somewhat limited means of support and resource

              attainment, it will continue to be a transitory and
^



                                                                   80

              limited "criminal" enterprise.

                   This realization should be considered by policy

              makers who desire to further criminalize computer

              underground activities. Given the current organization

              of the CU, the future social costs of their actions are

              not likely to expand beyond the current level.  There

              is no evidence to support assertions that the CU is

              expanding, and the insight provided here shows that it

              is not likely to do so on a large scale.

                   For sociologists, the computer underground is a

              field rich for insight into several areas of concern.

              Future research into the career path of CU members, and

              the relationships between individuals, could prove

              helpful to those interested in applying theories of

              differential association and career deviance.

              Additionally, the computer underground provides a

              unique opportunity to study the process of

              criminalization, and its effect on those who are

              engaged in the behavior.






^







                                    REFERENCES

              Best, Joel and David F. Luckenbill. 1982. Organizing
              Deviance. Englewood Cliff, New Jersey: Prentice-Hall.

              Bequai, August. 1987. Technocrimes. Lexington,
              Mass.:Lexington Books.

              Bickford, Robert. 1988. Personal communication to
              Gordon Meyer.

              Chicago Tribune. 1989. "Computer hacker, 18, gets
              prison for fraud."  Feb. 15:2,1.

              Field Notes. Interviews with phreakers, hackers, and
              pirates. Conducted from 7/88 to 4/89 (confidential
              material in authors files).

              Hollinger, Richard C. and Lonn Lanza-Kaduce. 1988. "The
              Process of  Criminalization: The Case of Computer Crime
              Laws." Criminology 26:101-126.

              Levy, Steven. 1984. Hackers: Heroes of the Computer
              Revolution. New York: Dell Publishing.

              Message Logs from a variety of computer underground
              bulletin board systems, (confidential material), 1988-
              1989.

              NBC-TV. 1988. Hour Magazine. November 23, 1988.

              Parker, Donn B. 1983. Fighting Computer Crime. New
              York: Charles Scribner's Sons.

              Rosenbaum, Ron. 1971. "Secrets of the Little Blue Box."
              Esquire October, pp. 116-125.

              Small, David. 1988. Personal communication to Gordon
              Meyer.

              WGN-Radio. 1988. Ed Schwartz Show. September 27, 1988.



^



                                                                   82






                                    APPENDIX A
                          COMPUTER UNDERGROUND PSEUDONYMS

             _________________________________________________________
             |Literature, films,|Computers &        |Nouns, titles &  |
             |and Entertainment |related technology |Descriptive names|
             ---------------------------------------------------------
             | Pink Floyd       | Mrs. Teletype     | The Professor   |
             | Hatchet Molly    | Baudy Bastard     | Perfect Asshole |
             | Jedi Knight      | Doctor Phreak     | The Messiah     |
             | King Richard     | Lord FAX          | Right Wing Fool |
             | Captain Hoga     | CNA Office        | Bed Bug         |
             | Al Crowley       | Sir Mac           | Sleepy Head     |
             | Doc Holiday      | Busy Signal       | Mean  Underwear |
             | Mr. Big Dog      | Silicon Student   | Cockroach       |
             | Robin Williams   | Fiber Cables      | Primo Bomber    |
             | Big Bird         | Phone Crasher     | The Prisoner    |
             | Cross-eyed Mary  | Doc Cryptic       | Night Lighting  |
             | Capt. America    | Apple Maniac      | No Regrets      |
             | Uncle Sam        | Fuzzy Sector      | Grounded Zero   |
             | Thumpr           | Cntrl. Alt. Del.  | Spit Wad        |
             | Little John      | Byte Ripper       | Shadow Dove     |
             ----------------------------------------------------------


^



                                                                   83





                                    APPENDIX B
                   NEW USER QUESTIONNAIRE FROM A PHREAK/HACK BBS


                   Welcome to Analog Electronics Datum System.
              Please take this time to fill out a one-time
              questionnaire that will allow us to determine your
              level of access on Analog Electronics Datum System.

                   If any question is too difficult for you to
              answer, just answer with your best guess or a simple "I
              don't know."

                   We basically have two different divisions or types
              of users on this system:

                      (1) Apple (%%,Mac), and IBM software traders
                      (2) Telecommunication hobbyists - any/all
                          computers (networks, mainframes,
                          engineering)

                   Your answers will help us decide which category
              you belong to and what access you should get on our
              system.

              * What type of computer & modem are you using to call
              this system?

              * Where did you get the phone number to Analog
              Electronics Datum System?

              * We'll need your first name and real phone # where you
              can be reached for validation purposes only, this
              information is kept in a password encoded file, on
              another computer (critical for higher validation):

              First for the FILE TRANSFER AREA ACCESS questions:

              (1) How many bits are in a nibble? (Assume 6502 micro
                  processor)

              (2) Define WORM, RAM, ROM, VDT, CRT, BPS? (Pick any 3)

              (3) What does 2400 baud mean in terms of bit transfer
                  speed?

^



                                                                   84

              (4) What is PT,MT,AE,BIN2,Ymodem Batch,BLU? (Pick any
                  4)

              (5) How many Megahertz does a standard Apple %%+ run
                  at? (rounding OK)


              Now for the TeleCommunication Questions:

              (1) Describe the Voice Transmission Use of a Loop:

              (2) If I gave you my phone #, how would you find my
                  name and address?!

              (3) Can you name any networking software operating
                  systems or protocols?

              (4) What is the highest frequency a twisted two wire
                  pair can transmit at?

              (5) We believe Phones and Computers Belong Together,
                  what do you BELIEVE?


              Ok, thanks for that info.


                 A MESSAGE FROM AL CAPONE (LOCAL) AND THE TRADER (LD)
                                     SYSTEM VALIDATORS

              -----------------------------------------------------


                   Welcome  to  ALDS!  As a new  user you have  made
              a  change  for the better in choosing this system as
              one of your places of telecommunication exchange.   In
              my  opinion, this  is one, if  not  the  best, system
              in telecommunications today as most of the good  boards
              such as Shadowspawn, Metal  Shop  Private, etc. do not
              exist anymore.  Quality users exist on this system that
              have established a reputation for themselves so
              questions you ask will be answered thoroughly and
              precisely.  We are a sponsor board of the  LOD/H
              Technical  Journal,  and  accounts  have  been
              established representing  Phrack,  Inc.  and 2600
              Magazine.  (For our software trading people, we also
              have an excellent file transfer area . . . consistent
              with the rest of the nation . . . )

                   Due to the high quality of our system, we will
^



                                                                   85

              need some additional information about you.
              Maintenance  of a high  quality system requires high
              quality users, so the first step in  this  process is
              keeping the low quality users off of the system . . .
              so please cooperate with us . . . this is for your
              benefit as well as ours.   The information you give us
              will be cross referenced with other systems for
              accuracy, and if you leave false information, you may
              suffer low access or deletion.

                   All phone number information is stored outside of
              the housing of this system inside of an encrypted,
              password locked file for your security. So if you have
              left an invalid phone #, please leave one where you can
              be reached, or someone's name and number (if possible)
              that will vouch for you.  Keep in mind this validation
              can take up to 1 week to complete due to the high
              volume of new callers to our system.

              Note: Limited system access will be granted within 24
              Hrs if all of your  info seems correct.


              Thanks in advance . . .            Bugsy Malone
                                                 The Swapper
                                              SYSOP/SYSTEM VALIDATORS


              % Bugsy Malone needs the following info: %

              (1) Your references (sysops, other users on this
                  system, other BBS).
              (2) Your interests in having access to our system.
              (3) How do you feel you can contribute to our system?
              (4) How many years of telecommunication experience do
                  you have?
              (5) Do you have any special talents in programming, or
                  operating systems?
                  If yes, then name the language(s) or operating
                  system(s).



              Enter message now, answering these questions:



              %after entering the message the BBS hangs up and the
              caller will  call back in 24 hours to see if access has
              been granted.%
^


!