From Outlaw to Consultant

[InfoSec News <isn () C4I ORG>]

http://www.nytimes.com/2001/01/29/technology/29CAP.html

By JOHN MARKOFF
January 29, 2001

MENLO PARK, Calif.  There are many legendary figures here in Silicon
Valley. There are men like Steven Jobs and Stephen Wozniak, Bill
Hewlett and . There are stories of brilliance and innovation and
avarice.

But there may be no tale so poignant as that of John T. Draper, the
mythical "phone phreak" who became a national figure in 1971 after
being one of the first to discover that a toy whistle in the Cap'n
Crunch cereal box could trick the telephone network into giving free
telephone calls.

Widely known as Captain Crunch, Mr. Draper has had a remarkable career
since then. He was arrested and sent to prison for his telephone
exploits several times and graduated from phones to computers.

He did the early design from a jail cell for EasyWriter, the word
processing program that came with the first I.B.M. PC in 1981.

In the intervening decades he was for a while a millionaire who owned
a house in Hawaii. But he has also lost jobs and been homeless more
than once. He hacked into computer networks, using some of the same
skills he honed on the telephone system. His back was permanently
injured in a prison beating in Pennsylvania. He was robbed on a Texas
highway where he lost a notebook computer containing the only copy of
his autobiography. For years he wandered the world working where he
could as a high-tech hobo including the Goa coast in India, where in
1999 he spent six months coding Web sites for an Indian entrepreneur.

Throughout all of his travels and travails, however, Mr. Draper has
maintained an almost childlike sense of optimism, and now he is trying
to start over.

With a small group of partners and perhaps a little late to the game
Mr. Draper is seeking to take part in the Internet boom. In a venture
that will no doubt raise concerns for some, he and his confederates
have set up an Internet security software and consulting firm, aimed
at protecting the online property of corporations.

The company, which has been self- financed but is not soliciting
venture capital, is called ShopIP. Mr. Draper, 57, describes himself
as a "white-hat hacker" these days and sees his new venture as his way
of repaying society for his misadventures three decades ago.

Mr. Draper vows that his hacking days are behind him. In the last
year, he says, he has thrown himself into the study of computer
security techniques with the same passion with which he once studied
the intricacies of the nation's phone system.

"My eyes were opened, and this has been a real change in direction in
my life," he said in an interview at a coffee house here, just a mile
from the telephone booth where a government informer once cornered him
for his antics with a so-called blue box an electronic device that
could generate the tones necessary for commanding the phone network.
"It made me realize that I could pay back society for my deeds in the
past," he added.

After starting to develop a type of network-security software program
known as a fire wall in 1999, Mr. Draper met a young businessman,
Daniel Baggett, now 29, who had known the older man by reputation and
who now takes a sheltering stance toward him.

"Part of my mission is to protect Crunch; I respect him," Mr. Baggett
said. "He played a huge role in the early days of the personal
computer industry, and it's a crime he hasn't been able to reap the
rewards."

And yet, the issue of white-hat vs. black-hat hackers has long been a
thorny ethical debate in the computer security world, where some
people have argued that there is no room for outlaws reformed or
otherwise. Others respond that the people who can best protect network
computer systems are those with the most experience at testing their
weaknesses.

"Whether black hats can become white hats is not a black-and-white
question," said Peter Neumann, a computer security expert at SRI
International, a research firm here. "In general, there are quite a
few black hats who have gone straight and become very effective. But
the simplistic idea that hiring overtly black-hat folks will increase
your security is clearly a myth."

Mr. Draper's past was largely defined by a widely read article by Ron
Rosenbaum, "Secrets of the Little Blue Box," which appeared in the
October 1971 issue of Esquire.

The article described the activities of a small group of telephone
"hobbyists," including Mr. Draper, who had learned how to control and
misuse the nation's telephone network.

In an essay in The New York Observer this month, Mr. Rosenbaum wrote
that Captain Crunch became an American antihero and a cultural icon in
the intervening years.

Two young men who devoured the 1971 article were Steven Jobs and
Stephen Wozniak. At the time Mr. Wozniak was a student at the
University of California at Berkeley. He and Mr. Jobs spent several
weeks frantically searching for Mr. Draper, who then lived in the San
Jose area.

After they contacted him, Mr. Draper arrived at Mr. Wozniak's dorm
room. Mr. Jobs recalls an outlandish character with moustache and
horn- rim glasses who walked in and announced with a flourish, "It is
I."

Mr. Draper tutored Mr. Wozniak and Mr. Jobs in the art of programming
their own blue boxes, capable of gaining free and illegal access to
the phone network. The two novice entrepreneurs sold the blue boxes
door-to-door on the Berkeley campus, several years before they founded
Apple Computer.

Things turned out less favorably for Mr. Draper. After the Esquire
article he became a target of the F.B.I. and in 1972 was arrested and
spent a short while in jail before being sentenced to five years
probation.

Around this time he discovered Call Computer, a tiny company in
Mountain View, Calif., that provided computer time-sharing services.
Mr. Draper was still a student at a local community college, but the
owner of Call Computer discovered that Mr. Draper had a flair for
programming and offered him a job. Later, the programming tools Mr.
Draper had developed while working at Call Computer were widely used
by many of the first personal computer designers.

And while he did not entirely end his phone activities, he became a
regular at the potluck dinners at the People's Computer Company, a
counterculture educational organization in Menlo Park dedicated to
making computers widely available.

Mr. Draper's new passion was computing, but he was a phone- phreak
recidivist. In fact, it was at a pay phone across the street from the
People's Computer office near here where a government informer caught
him in the act of telephone fraud.

This time, Mr. Draper went to prison, spending October 1976 to
February 1977 at the federal prison in Lompoc, Calif. For the final
portion of his sentence he was in a work- release program back in the
San Francisco Bay Area, where he began developing his EasyWriter
program.

During the day, he recalled, he would write the code. Then, at night,
after returning to jail, he would study the paper list of programming
commands, looking for errors. "It was an ideal situation," he said.
"It forced me to get off the computer and think and debug my program."

Shortly after leaving prison, Mr. Draper was hired by Apple Computer,
at a time when the company had only 15 employees. He developed a
telephone-dialing card for the original Apple II computer. But Apple
never marketed it for fear that it could be used as a powerful
computer-controlled blue box.

In an online posting a number of years ago Mr. Draper described the
antics during Apple's early period, which may help explain the
company's hesitation to put his modem on the market. "I can remember
Woz programming it to repeatedly call Steve Jobs's parents' phone over
and over again (in those days, there were very few answering
machines). I got blamed for what Woz did."

He also was blamed, by federal authorities, for a parole violation
later that year for associating with known phone phreaks, and was sent
to a federal penitentiary in Pennsylvania. There, as Mr. Draper
recalls the episode, a fellow inmate asked for instructions on hacking
into the telephone network. Suspecting the man to be an informer, he
gave him bogus information. Unfortunately, when the inmate could not
get the free phone calls he was expecting, he beat up Mr. Draper, who
still has several damaged vertebrae from the run-in.

Despite his prison stints, Mr. Draper enjoyed an unaccustomed
affluence in the early 80's, after Easy- Writer hit it big on the
early I.B.M. PC's. But his life lacked the structure and discipline to
make his comfort last.

He drifted in and out of jobs, the most promising one with Ted Nelson,
a social scientist and software designer at Autodesk, in Sausalito,
Calif. Mr. Nelson was trying to perfect his hypertext software, a
forerunner of the World Wide Web.

But all too soon, Mr. Draper lost his job. He spent the mid-1990's
kicking about, winding up in San Diego in September 1996. There, he
lived in an artists' collective known as the Loft, which had a
high-speed Internet connection.

When the Loft fell apart, Mr. Draper was homeless. He spent time in
Tijuana, then decided to move to Florida, where he had heard of an
opportunity to work in Web-site development. It was on the road to
Florida, at a roadside rest area in Texas, that the manuscript for his
autobiography which he had worked on for four years was stolen from
his car as he slept.

But things started looking up in Florida, where he showed a natural
aptitude as a Web programmer and his work came to the attention of an
Indian businessman. That contact resulted in Mr. Draper's spending six
months on the Goa coast, designing Web pages for companies there that
were anxious to be on the Internet.

After returning from India in late 1999, Mr. Draper settled in
Fremont, across the San Francisco Bay from Palo Alto. Sharing a
cramped apartment with several friends, he began work on his software
company.

Today, Mr. Draper still lives a largely hand-to-mouth existence. Known
for his manic intensity and insistent curiosity, he has the
distinction of being one of the few people to lose his invitation to
the Hackers Conference, the annual gathering of the pioneers of the
personal computing industry, where social graces are not usually a
criterion for admission.

But there are those who have loyally stuck by Mr. Draper including Mr.
Wozniak, who gave him an Apple Macintosh PowerBook for Christmas.

For his part, Mr. Draper is enthusiastic about his new venture and
conveys a true believer's faith in the strength of his security
software, which ShopIP plans to release to a group of test customers
next month.

Yet he acknowledged the difficulties of living down the Captain Crunch
legend. "I'm not a bad guy," he said. "But I'm being treated like a
fox trying to guard the hen house."

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".