Hackers: Under the hood

Third profile: Adrian Lamo

Name: Adrian Lamo
Handle(s): None
Age: 23
Marital status: "Dating for over a year"
Current residence: Living in exile in Sacramento, Ca., USA
Job: Staff writer, American River Current and freelance journalist
First computer: Commodore 64
Best known for: Hacking into The New York Times network
Area(s) of expertise: "Seeing things differently"
Don't let his baby face fool you. Adrian Lamo started hacking even before he could legally drive.

Lamo's first thrill from a hack came when he figured out how to make both sides of a 5.25in floppy disk writable while playing around with his first computer -- a Commodore 64 he got when he was eight.

"It was quite the discovery for me," he said.

Unlike many so-called hackers, Lamo was never interested in impressing his peers.

"I became deeply interested in the hacker culture, reading everything I could about it before ever actually encountering it," he said. "Once I encountered it, I was turned off by it, so I chose to go solo. Exploration need not be competition," he told ZDNet Australia  in an interview last month.

At 18, his parents decided to move to Sacramento from San Francisco but Lamo decided to stay put.

He was the lead network administrator for a law firm at the time. "I stayed with friends, sometimes in abandoned buildings, sometimes in storage areas of office buildings I had access to. Sometimes, I'd just nod off at my desk," he recalled.

After a while, he dipped into his savings and hit the road, spending the next two years wandering around the United States.

"There's a lot to be said for just having your clothes, a backpack, and the ability to buy a bus ticket and not have anything to tie you down.

A young Adrian Lamo "I spent time in New York, Washington DC, Philadelphia, Pittsburgh, Ohio, parts of California, Virginia, and points in between -- usually because I knew people there, or wanted to see the city, or other circumstances," he said.

Lamo has travelled far and wide but ranks his time in Philadelphia as the best.

"I'd wake up early, go for a walk, check my e-mail wirelessly from a window ledge that had a clear shot to an unsecure 802.11 [wireless network], wander around with friends and hack from university libraries, Kinkos, coffee shops, read in the sun all day, or just explore the city physically. I loved it."

Over the years, Lamo has carved a reputation as someone who didn't care much for rules. He used his skills to gain access into high-profile networks owned by America Online, Microsoft, and many others.

But there was never any malicious intent. After penetrating these networks, Lamo would contact the network maintainers and tell them how he did it.

This modus operandi worked well for a while ... up until the time he hacked into The New York Times' network in 2002 and accessed its contributor database.

It's important to remember that the average contributor to The New York Times isn't Joe Bloggs from down-the-road. Lamo reportedly accessed the social security numbers of many high profile public figures, including former US president Jimmy Carter, Hollywood actors Robert Redford and Warren Beatty, and former United Nations weapons inspector Richard Butler. Some of the entries in the database included home phone numbers.

The Times, one of the world's most influential publications, was not impressed. US authorities issued a warrant for Lamo, who turned himself in and pleaded guilty to one charge of computer crime. Sentencing has been postponed until June.

"I'll either get prison, or house arrest," Lamo predicts, before becoming philosophical. "I hope for the best ... [and] will make the best possible experience out of any sentence that's handed down. No experience we ever have is wasted."

When he was arrested, he was dubbed the "homeless hacker" by media outlets due to the nature of his nomadic lifestyle. "I've never described myself as 'homeless'. It's something the media picked up," Lamo insisted.

Adrian Lamo accessing the Internet for the first time Lamo is currently living with his parents in Sacramento by order of the court. He draws parallels between his chosen lifestyle offline and his activities online. "I didn't, and don't, draw a clear distinction between the two kinds of exploration. I try to see things differently, no matter what venue I'm in. I'd be just as likely to spend the morning talking to a stranger who just got out of city jail, buy him breakfast, and learn about his life, as i would be to break into a company ... or just randomly explore the Net. It's all the same principle, the same desire to see things that other people gloss over in their daily lives."

It's this curious mind that has led Lamo to his new passion -- journalism. He's currently a staff writer for the American River Current, a bi-weekly Californian newspaper, and a freelance writer on the side.

"I'm interested in journalism because it's an extension of what i do: exploring, finding angles for things that others miss, sharing the uniqueness of the world. That's especially why i try to do my own photos when possible. It lets me capture moments in time in ways that words sometimes fail," he revealed.

A similar path was taken by the legendary hacker Kevin Poulsen, who is now the editor of online security portal SecurityFocus.com -- which was acquired by anti-virus maker Symantec in 2002. Poulsen was best known for hacking a telephone system in order to rig a radio contest. He won a Porsche 944 S2 before being caught and eventually spent some time in prison. He delved into journalism after his release.

Writing about security seems to hold less interest for Lamo. "I look to him [Poulsen] as a model of what I don't aspire to be: typecast, and locked into a one-trick career," Lamo said, while acknowledging his respect for Poulsen as a journalist.

Lamo doesn't want to work in the security industry either, believing that accepting payment for his talents would amount to "whoring himself".

"I don't believe it's an honest industry, which is why I've declined all security jobs offered to me. Journalism isn't an honest industry either, but at least I have some personal control over the degree of dishonesty levelled against my victims," he joked.

It's no surprise that Lamo is accustomed to the lifestyle of a nomad -- which began from a relatively young age. During the interview, he eluded to, at least, some degree of financial hardship -- riches-to-rags style. "We were well-off, we were poor, we had a house, then we had a tiny apartment," he recalled.

His parents have always been supportive, Lamo said, despite their concern over his chosen lifestyle.

"My parents are well-educated. My dad has a degree in anthropology and intercultural administration; my mom is a former English teacher. We moved around a lot, and they both tried to provide me a content-rich environment in which to grow up," he said.

Lamo with Kevin Mitnick and Poulsen If you think that using "content-rich environment" sounds like a peculiar way to describe up-bringing, just remember that Linux creator Linus Torvalds captioned a photograph of his daughter "Linus v2.0" on his Web-site. In fact, Lamo insists he's not a "dork".

"My curiosity isn't purely technological. Quite the opposite; I don't consider myself a tech person, I just see things differently and apply that to any environment I'm in. I spend a lot of time on my photography these days ... it acts as something of a surrogate to network intrusion," he said.

For now Lamo awaits his sentence but remains fatalistic.

"Actions have consequences. I never thought it was inevitable, but I always knew that something like that could happen." -- Patrick Gray

Advertisement

Talkback 9 comments

    I think it would be wise to re ...Anonymous -- 20/04/04

    I think it would be wise to research a claim like, "Alder was the first woman to deliver a technical presentation at the famed DefCon hacker conference in Las Vegas." Many women presenters come to mind long before defcon9; susan thunder, gail thackery, netta gilboa, the presenter from gray areas (whose speech got stolen at 4 while she was giving it), jennifer grannick, hell even carolyn mienel.

    This is either a false claim by raven or (more likely) bad journalism on zd net's part. A very simple search of http://defcon.org/html/links/past-defcons.html would have cleared this issue up easily. This is one of the problems with internet journalism, statements are made wildly and taken as fact by the masses.

    What bothers me with articles ...Anonymous -- 20/04/04

    What bothers me with articles such as these is the implication that only so-called blackhats really understand computer-related security issues. It smacks of cheap sensationalism, and b-grade "hacker" movie scripts. The vast majority of skilled and competent security researchers never crack any system that doesn't belong to them, and they are generally far more knowledgable and experienced than a bunch of overgrown skript-kiddies. And they don't believe that it's necessary to wear black clothing at all times to be taken seriously.

    Kudos to Raven for pointing ou ...Anonymous -- 20/04/04

    Kudos to Raven for pointing out what some of us have known all along....too often a security solution is just window dressing, something to make the CEO/CIO comfortable. Many time I have seen companies purchase appliances and comprehensive suites only to install them out of the box with no configuration or on-going support, thinking themselves protected. Wrong!

    If you aare going to do security, do it correctly.

    In response to the poster who ...Anonymous -- 21/04/04

    In response to the poster who started "What bothers me with articles such as these is the implication that only so-called blackhats..."-- exactly WHERE do you get the idea that the subject of the article, Raven Alder, is a blackhat?????

    It seems to me that she is a very accomplished security professional. Sorry that you don't like the attire she was photographed in, but I think it's a pretty far stretch to interpret the color of clothing in ONE photo to equal Ms. Alder believe it is "necessary to wear black clothing at all times to be taken seriously".

    I find your response to be sad, and I'm probably closer to your idea of a "security researcher". I'm employeed by a reputable firm, work in a computer lab, and rarely were black clothing. Ooops, I'm a male and have long hair-- does that risk me out of being a reputable security researcher?

    It's great to see some 'human ...Anonymous -- 23/04/04

    It's great to see some 'human interest' in the computer world for once! I thoroughly enjoyed this and took it for what I feel it's worth - humanising computers.

    I challenge Mudge at DefCon to ...Anonymous -- 24/04/04

    I challenge Mudge at DefCon to a No Holds Barred no-gi 3 round (2 minutes each) demo.

    gatton

    Some very few hackers may be u ...Anonymous -- 04/05/04

    Some very few hackers may be useful however the vast majority are at best unthinking children and at worst major criminals.
    Its not beyond the realms of possibility for some vital computer system to be taken down by hacking,so maybe one day its a bank who cares you say.
    Well next it could be air traffic control or a hospital computer system.
    I look forwards to the list of claim to fame reading Famous for getting 20 years in jail.
    Maybe I'm just getting radical in my views but causing untold misery is not fun.
    Mind you I have a special fate for Virus creators which make my views on Hackers almost paternal.

    It wouldn't be nice or fair by ...Anonymous -- 23/05/04

    It wouldn't be nice or fair by any means something bad befalls "Adrian Lamo" because he wasn't a bad guy after all. We all know that he was a white collared hacker and not the black or the evil kind.

    I don't really have much time, I would have been more willing to say exactly all what I feel for thie great guy.

    It wouldn't be nice or fair by ...Anonymous -- 23/05/04

    It wouldn't be nice or fair by any means something bad befalls "Adrian Lamo" because he wasn't a bad guy after all. We all know that he was a white collared hacker and not the black or the evil kind.

    I don't really have much time, I would have been more willing to say exactly all what I feel for thie great guy.

Add your opinion

Back to top

Featured