Kevin Mitnik FOIA Final(vault.fbi.gov) |
Kevin Mitnik FOIA Final(vault.fbi.gov) |
Reading Mitnicks book I sometimes get the impression that the he is making up half of it.
[1] Available DRM-free at Downpour (https://www.downpour.com/ghost-in-the-wires?sp=19991) and at Libro.fm (https://libro.fm/audiobooks/9781483067216-ghost-in-the-wires)
Big moments I remember from his book.
1. Gaining access to a telco C/O and social engineering his way out after being caught
2. Ultimately being caught by sloppy practices himself, logging into systems he was comfortable with and getting traced, and then forgetting some sort of identification in a ski jacket he hadn’t used in a long time, which was in his closet in a place he was living under a new identity.
It’s been awhile so I could be partly off on those details. But I’d say at least those pieces are very believable.
In many cases, a partial public document is better than no public document.
Plus, there's little way of knowing for the documents for which we haven't seen the uncensored version if they aren't just censoring arbitrary things.
It may be reality, but it's still pretty bad for any government that pretends to value transparency.
It's also extremely offensive to see the names of AUSA's (Assistant US Attourneys) and SA's (FBI Special Agents) redacted. They had personal involvement in this case so I genuinely don't understand why their names cannot or should not be a part of this document. They're public figures in a public role.
"Called -------- on July 1st, 1983 to get access to a router"
Is much better than
"----------------------------------------------------------"
The reason is GP doesn't understand the reason, so there is no reason, so it must be made public. /s
Anyway, each redaction has a usually-legible Exemption code next to it that tells you why it's redacted. You can find out what those are here:
https://foia.wiki/wiki/Exemptions
For example, you see 7c/b7c in the document a lot:
"could reasonably be expected to constitute an unwarranted invasion of personal privacy"
To: [recipient name]
From: [sender name]
Date: [date]
[Multiple paragraphs of redacted text]
...and that was basically it. It was funny, but frustrating (funstrating?).
That means records cannot be automatically declassified after N years because the effort to redact every document created N years ago would be extreme.
https://web.archive.org/web/20090317050834/http://www.themem...
Now I’m wondering how many other people in this thread don’t know he died (pancreatic cancer). 59 isn’t that old. And he was expecting a baby at the time, which suggests maybe they didnt think so either.
SSNs make terrible secrets and it's insane that you could harm a live person by knowing their SSN. I doubt that insanity stops just because you're dead.
The entire redacting seems just so superficial
I wonder if anyone did that back in the day. Not sure how much the telco would have appreciated it ...
Back in that time, I think a good rate was $0.01/minute for a local call on a consumer landline. Unlimited calling plans came later. Not attributing any intent to the telco, just saying, there would be no cost issue to motivate an investigation.
"The image quality contained within this site is subject to the condition of the original documents and original scanning efforts."
Hope that helps! :)
I can't remember charges for local exchanges (same area code), but I only remember as far back as the late 80s. It was something like 10 cents a minute. I remember all the adds about "friends and family" special rates/etc. Metering on voice calls persisted into the 2000s.
But the calls were very brief (if they did pick up) unless he got a "hit". So thousands of calls could have no charge
Or maybe he spliced into his neighbors line :-)
Pancreatic cancer is a fast and deadly one.
Cheap blood test detects pancreatic cancer before it spreads https://news.ycombinator.com/item?id=43035147 - Yesterday (233 comments)
The system still has to disambiguate and support the prospect of it happening though.
This also assumes that we can all agree on a definition for "innocent."
> what is there to protect?
Their privacy. Some people have strong opinions on 3 letter agencies and poor reading comprehension. Some people are just mean spirited. Best way to prevent dumb stuff from happening is to not create a situation where dumb stuff could happen.
I can't think of anything more public than airwaves.
Is the underlying assumption that everyone redacted in that report is a licensed HAM radio user deprived of their right to have a private name and address?
If you rented out a room (or even a hotel room) to Eric Weiss (mitnicks alias, one of many), do you really want everyone here to see your full name and address?
Or if someone hacked some database of users and used your name/surname to socially engineer someone else.
or worse!
maybe you were with your other family and this unwarranted disclosure revealed that to a scorned spouse and friend group that are always looking for holes in the story 40 years later
not criminal issues, not an FBI problem, and yet can alter your private life
Are we not at square one again?
And did Mitnick ever know Motnick? Am I experiencing the Mandala effect here?
It really does stop. What can you do with someone’s SSN? Get loans, open bank accounts, receive government benefits, set up utilities, etc. It harms someone because creditors falsely believe that the SSN’s holder owes the debt, or the government believes that the SSN’s holder received benefits, etc.
People who are falsely reported as dead have a difficult time doing anything… certainly a hard time getting loans. It’s certainly going to be hard to make a claim against an estate that’s been closed for a couple years, with a debt that is dated after that person’s death.
In general, identity verification is a joke in the US. At best its a racket.
Given the amount of erroneous information in credit files, I wouldn't be surprised if the above scenarios happen regularly.
75% of the book is spent social engineering over the phone and 20% doing stuff on phone switches and other equipment.
Freedom Downtime is a documentary that explains it.
It wouldn't be until much later (in the 90s at least, while he was in prison) that the advent of pure digital switching would enable the random reassignment of phone lines like he describes in the story about turning his friend's home phone into a payphone.
The lines were separated and had differences in sender frames just for payphones, plus typical phones weren't too happy when 130VDC was applied to them for very long.
The fact of the matter is that Mitnick went around and shook doorhandles until something opened and occasionally convinced someone to open a door for him her and there, and the fact that the emperor had no clothes was too politically inconvenient for the kinds of companies that Mitnick hit up.
I remember the day my busy signal changed from a buzz (350+440 Hz) to a tone (480+620 Hz).
In Mitnik's version, he RTFMs, learned the technical lingo, procedures, and even the names of telco employees.
The majority of corporate breaches are a combination of poor Least Privilege practices and phishing/smishing.
Even with well secured, alert personnel, you often see ISPs and Telcos socially engineered to gain access to an employee account.
