On his way out of the bathroom, Lamo nods his head at a nearby door, unmarked and anonymous. "Most of the telephone switches for the Embarcadero are in there," he says, a glint returning to his eye, the merest smile spreading across his cracked, thin lips. Then his cell phone peals, and it takes Lamo a few heartbeats to identify the number of the incoming call. "My attorney," he sighs, before answering his phone in the kind of crisp, authoritative monotone you'd expect from one of the most celebrated and controversial hackers in the world: "Lamo here."
If you type the address www.sfweekly.com/Examples/FileLibrary/Files/y0.txt into your Internet browser, you'll see the following message, in plain black text on a white background: "Confidential to Matt Palmquist: Sorry I never really got back to you when you emailed. Give me a ring! -- Adrian Lamo."
Reaching Adrian Lamo is not particularly difficult. His cell phone number is 505-HACK. ("Everyone assumes there was some wrongdoing involved," he says of obtaining the number, "but like with so many things, all you have to do is ask.") His e-mail address is firstname.lastname@example.org, which you can locate with ease on Lamo's very own Web site (http://adrian.adrian.org). He admits he's not much at Web design, and his home page, whose header says "Faith manages," is certainly stark: Other than a blurred, pixelated image of Lamo in the upper right-hand corner, the only thing to look at is a verse, pointed and trenchant, from the Bob Dylan song "Idiot Wind": "People see me all the time, they just can't remember how to act/ Their minds are filled with big ideas, images, and distorted facts/ Even you, yesterday, you had to ask me where it was at/ I couldn't believe, after all these years, you didn't know me any better than that."
In other words, though it's not hard to get in touch with Lamo (pronounced Lah-mo), it's considerably harder to get to know him -- and perhaps hardest still to actually meet him. "Who is this?" he asks when I call him one day in early 2003. "Oh, I thought you were a collection agency."
We'd been exchanging e-mails and phone messages for almost a year, ever since Lamo grabbed headlines around the world by hacking into the New York Times and pilfering, among other things, Social Security numbers, editing notes, and reimbursement figures for several of the Times' more high-profile op-ed contributors, among them William F. Buckley Jr., Robert Redford, and former President Jimmy Carter. Media reports about the incident were, on the whole, brief and bemused ("All the News That's Fit to Hack," chortled the New York Post) and absent all but the most basic details about the young man who could, if he so wished, ring up Warren Beatty or Rush Limbaugh at home. The basic details: In the past few years this so-called "homeless hacker," a drifter who rides Greyhound cross-country and crashes in abandoned buildings or on friends' couches, has trolled, undetected, through the innards of corporate giants like America Online, Yahoo! (where he edited himself into news stories), the now-defunct Excite@Home, the now-bankrupt WorldCom, and, most recently, the Times. And he did all this using Internet Explorer, usually from a computer at a Kinko's. His methods are refreshingly low-tech -- he often exploits open proxy servers, which, after configuring a Web browser properly, can act as doorways between the public Internet and a corporation's private computer network -- and he always tells companies how to close the holes he's found. Lamo's willingness to help the companies he hacks is part of his charm, and also part of the reason he has so far avoided prosecution. (Drifting around the country helps, too.)
"In the computer underground, he's very well-regarded," says Ed Skoudis, a vice president at the computer security company Predictive Systems and author of the anti-intrusion book Counter-Hack. "He's sincere, passionate, smart, with a good track record. Getting in and getting out without getting busted -- wow. And the thing that stands out about Adrian is that he's very open about the fact he's breaking the law. I don't want to get into his head, but he seems to think he's OK because he follows the spirit, if not the letter, of the law. And you know what?" Skoudis gives a small chuckle. "Maybe there is some validity in the way Adrian does his thing, because his targets don't seem to disagree."
That could change soon, however, and Lamo knows it. As it happens, one of the reasons I have such a hard time getting into Lamo's head, or even getting him on the phone, is because he's been preparing to announce, in a few days, weeks, or months -- whenever he decides the time is right -- his biggest hack yet. On the record, he defines his target as a "critical-infrastructure-related company"; off the record, he exhibits ample evidence of his repeated incursions into the corporation's internal system -- incursions that are almost bound to be extremely embarrassing to the firm. He admits giving considerable thought to the company's reputation for aggressively pursuing hackers, and has been lining up fallback plans -- asylum in a foreign country, hiding in the Deep South -- in case the company lives up to its reputation. "In terms of my personal sense of the intrusion and what it affects, I see this as more epic than anything I've worked on in the past," Lamo says, his clipped, halting words staggering out like text across a screen. "There's a sense of rightness about it. I believe it's broader in scope, but it also has more potential to go terribly south."
So why do it? That's what I'm dying to ask him, and because San Francisco is one of the few cities Lamo comes close to calling home (his parents live outside Sacramento), he generally spends some portion of his winter and spring in the Bay Area. But I'm not at all surprised to hear, when I call him up, that he's still on the road. In fact, as we chat, Lamo is walking 20 minutes to the nearest wireless Internet connection because, alas, the glue that binds his modem has melted from the heat of his laptop. "It's like I've always said, "If everyone had to walk 20 minutes to find an Internet connection, content on the Web would be so much better,'" Lamo jokes through the static of a fading cell-phone signal.
We agree to postpone our chat again, until he's a bit more settled. "Stay out of trouble," he says before signing off. "Don't do anything I wouldn't do."
Adrian Lamo doesn't know if the Pacific Bell Network Operations Center has moved out of a particular building on Second Street, but the last time he checked, the combination for the center's electronic door lock was still 55755.
After more than a year, I finally meet Lamo face to face on Presidents Day. He's staying outside Sacramento, and he agrees to hop on the bus and meet me at a coffee shop near the capital, if I'm willing to make the drive out from San Francisco. It's a hazy, chilled afternoon -- Lamo describes himself as "nocturnal," and you can't expect to catch him before 2 or 3 p.m. -- and the dusty, leaf-blown streets surrounding the Greyhound terminal downtown are largely deserted. Lamo shows up a half-hour late; he missed his scheduled bus, he explains, because he forgot his cell phone and had to retrieve it. He's wearing a black buttoned shirt, khaki pants, and sturdy brown boots, and his gaze is both intense and friendly, although he never, ever, asks questions and doesn't answer all that are posed to him. Within minutes, he's tapping away at a black laptop, signing on (somehow) to a wireless connection. "I couldn't find any immediate reference to Matt Palmquist in the San Francisco Bay Area outside of articles," Lamo says, "so ..." He turns his screen so I can take a peek at some of the, ahem, research he's turned up. "I'm happy to report," he says cheerfully, "that your account is in good standing."
Although he conducted much of the work behind his most famous hacks at different Kinko's copy shops throughout downtown San Francisco, Lamo now prefers a wireless connection, so he can go online outdoors, on the steps of buildings, whenever the mood strikes him. Some bums in Philadelphia, he says, know him as Hackin' Man. "There's nothing like having the guy who was bellowing about Jesus at the top of his lungs five minutes ago check his Hotmail account from your Palm Top," Lamo says with a grin, sipping from a cup of coffee. "I live for unusual situations, improbable things that wouldn't happen to anyone else."
He's lived through plenty of those: His parents, who work in video production and as English-Spanish translators, moved around a lot when Lamo was a kid. He was born in Boston, and he spent much of his early life in Massachusetts and the Washington, D.C., area. "I like to say I was raised by a band of wandering gypsies, but that just wouldn't be factual," says Lamo. "My upbringing was not transient in that sense. We had a roof over our heads -- I was always cared for well." The family spent a few years in Lamo's father's native Colombia, then returned to the United States when Lamo's younger brother was born prematurely and needed medical attention here. His parents settled in the Bay Area in time for Adrian to start high school; he never finished. Following three unsuccessful stints at San Francisco schools (where, to no one's great surprise, he had some problems with authority), Lamo opted to get a GED instead. By this time he was 17, his parents had moved to Sacramento, and he'd decided to remain behind on the streets of San Francisco.
Adrian's parents, Mary Atwood and Mario Lamo, have never been quoted in media reports about their son, but they agree to respond in writing to some of my questions. ("As long as they don't show you any baby pictures," Adrian grumbles.) I ask them several: What was he like as a kid? Are you proud of what he does? Do you ever just wish he'd get a "normal" job? What's the source of his unique outlook on life? Mario and Mary, whom Adrian refers to as former "young radical types," avoid answering most of the questions directly, but they do respond with a few warm paragraphs about their son.
"Since he was a baby, he had an outstanding intelligence and verbal ability," they write. "By the time he was three, he was already completely bilingual (English/Spanish). He easily learned to read at home and always loved books. As a child, he wasn't the type that tinkered with gadgets, although he did begin playing with Lego's at a very young age. ... When he was 6 years old, he received his first computer, a Commodore 64, from his grandmother, and soon mastered its use."
Indeed, it was this Commodore -- the first personal computer for so many American families in the 1980s -- that sparked Lamo's interest in virtual trespassing.
He was playing a text-based adventure game, in the ancient era before full-color graphics, and became "intensely frustrated" because he couldn't get past a certain point. "I neglected to pick up the pebble-of-something, so consequently I couldn't get through the so-and-so," Lamo recalls with a grimace. "After days of trying to get through, I said, 'Fuck this,' and I picked up the Commodore's manual and read about the list command, which shows the program code. I rewrote that particular part to let me through, and that was that." He shrugs. "Really, everything since then has been larger versions of that, being unwilling to accept reality as it's presented to me, the idea that this is denied to me, and there's no way around it."
He pauses. "There's always a way around it."
After his parents moved to Sacramento, Lamo began drifting around the city, working at a few nonprofits, doing some security work for Levi Strauss. He lived in a furnished apartment for a while, although when he moved back out, plastic sheets still covered most of the furniture. "I never made a conscious decision to start bouncing around," he says. "I just wasn't interested in finding an apartment in the Bay Area during the dot-comness."
He discovered he could live on about $50 a week, plus or minus the occasional check from his parents or gift card from a sympathetic friend, and got what little income he needed through an odd bit of freelance computer work. He has even been an assistant to a private investigator. His lifestyle, needless to say, made it difficult to apply for, much less hold, a regular job, and he wasn't willing to abandon his wayfaring ways. He had begun hacking in high school -- where he got thrown out of the only computer class he ever took (to this day, his computer skills remain entirely self-taught) -- and decided to devote himself to exploring both the real and virtual worlds. "I'm just as likely to be wandering around an abandoned building or crawling through a storm drain as I am to be poking around something online," Lamo says. "And I think both of them are equally valid. I think me getting stuck in a storm drain in New Jersey is every bit as important as breaking into the New York Times."
His parents, for their part, say they are pleased that Adrian has found an application for his unique talents; they don't discuss with me any concerns they might have about their son landing in prison. "We have always encouraged Adrian to be a critical thinker," they write, "and are proud of his intellect, and that he applies his skills to what he likes most, computer security."
Besides, they probably couldn't convince Lamo to change his line of work if they tried. "This is what I'm here to do," Lamo says, his long, slender fingers still gliding across his keyboard in the Sacramento coffee shop, now suffused in a late-afternoon glow that lends a bit more radiance to the hacker's near-translucent skin tone. "I think everything we do has ripples beyond what we see, even if the only thing that sees the ripples is the universe itself. I just have a real strong feeling that this is what I'm born for, and what I'm doing isn't wasted. I just feel compelled to explore."
A few minutes later, a guy with a crew cut and a thick build enters the coffee shop; Lamo stops talking, shuts his laptop, and follows the guy with his eyes. "There is an FBI office in that building over there," Lamo says, motioning out the window. "It's not in the building directory, but it's there, on the top floor."
With the kind of access Adrian Lamo stumbled across in 2001, almost by accident, any employee at WorldCom could have turned off the internal computer network for Bank of America.
He's eaten now; he feels better. Darkness has fallen outside the Embarcadero Center; it's a few weeks after we met in Sacramento. He's been out of touch again, "regrouping personally," as he puts it, and preparing for the hack he's about to announce. "I need to make sure I have cash on hand, places to go," Lamo says, and his tone hardens. "I want to make sure that, if things go south, they won't be able to say, "Lamo was hopelessly naive, that he was just sitting around in his bedroom at his parents' house.'"
After a sleepless night and a long day, Lamo is about to head downstairs to a meeting of 2600: The Hacker Quarterly. He has occasionally contributed to the magazine, named after the 2600-hertz signal that enabled hackers in the 1970s to access AT&T's long-distance switching system and make free calls, and considers it his duty, when in San Francisco, to drop by the meeting and hobnob with his fellow hackers. Most of the dozen or so attendees tonight are males with backpacks, although one is a woman with gray hair, and the best T-shirt says: "I see dumb people." Before Lamo sidles up to the group, clustered in the plaza, he mutters, "My God, I started going to meetings in 1996 -- I feel old."
Actually, Hacker Quarterly began publishing its tips, trade secrets, and commentaries way back in 1984, about the time computer espionage exploded into the national consciousness. The previous year had brought the popular film War Games, which starred Matthew Broderick as a computer wiz kid who mistakenly cracks into the military's nuclear-combat simulator computer and saves the world by programming the machine to play tick-tack-toe. The first high-profile arrests of real hackers occurred around the same time, when the FBI busted six teenagers from Milwaukee known as the 414 Gang (named after the local area code), who broke into more than 60 computers, including those at the Los Alamos National Laboratory and Sloan-Kettering Memorial Institute.
But the hacking tradition didn't start with criminality -- it started with graduate students at the Massachusetts Institute of Technology in the early 1960s. Tapping into the mainframe computer in the artificial intelligence lab, they pushed the boundaries of programs and earned the complimentary nickname "hacker." The Internet, of course, remained largely unexplored until the personal-computer boom of the 1980s, and it only became a staple of American life with the advent of e-commerce in the 1990s. As capital entered the flow of the information highway, hackers began finding more and more pathways closed to them, and the relationship between companies and intruders grew increasingly bitter.
"Malicious hackers like to illustrate the impact of what happens when they're ignored," says Douglas Thomas, an associate professor at the University of Southern California and the author of Hacker Culture, which explores the history and psychology of the movement. "The benevolent hacker says, 'Your fly's open, here's how to close it.' The thing I find interesting [about Adrian] is the idea of a hacker as a kind of consumer reporter on the world. He's doing a public service, finding these holes, and that seems to have a noble spirit to it."
But it's still a felony under several federal laws, most notably the Computer Fraud and Abuse Act, which was passed in 1984 and has been amended several times since. After the terrorist attacks of Sept. 11, 2001, Attorney General John Ashcroft strengthened that law, and others, through the Patriot Act, which expanded the government's powers to pursue alleged criminals online, listen to wiretaps, and monitor Internet usage. Although many in government and industry have downplayed the threat of cyberattacks from terrorist groups like al Qaeda, regular hackers do plenty of damage. According to the San Francisco-based Computer Security Institute's seventh annual Computer Crime and Security Survey -- which polls more than 500 U.S. corporations, government agencies, financial and medical institutions, and universities -- 90 percent of the respondents reported computer security breaches in 2002, and 80 percent said they suffered financial losses. The 223 respondents who were willing or able to quantify the damage done by hackers reported a grand total of $455 million in losses; the institute estimates that hackers did well more than $1 billion of damage in the United States last year.
"I'm not a jurist, but I recognize that what I'm doing is illegal, and I don't think the way I'm doing it makes it any righter than how anyone else would do it," Lamo says. "I'm sure someone somewhere has gotten fired because of what I do. These things happen. I've run networks myself and I've been intruded upon, so no one can say I don't know how it is. But as long as I'm doing it, I feel it's important to set a precedent so companies say, 'You know, everything didn't go to hell after we let him go.'"
Although Lamo seeks a cordial relationship with the companies he hacks -- some have even offered him a job, though he turns them down because he doesn't want people to think he's profiting from his exploits -- and takes pride in showing corporations his points of access, he's not naive enough to think his relative benevolence will get him off the hook. In fact, Lamo -- who says with absolute sincerity, "I never assume I'm not being surveilled" -- even posted an anonymous screed to an Internet discussion board in defense of the Patriot Act. "Many of you armchair attorneys general out there might not be so quick to fault the measures being taken now if you suddenly found yourself saddled with the responsibility of securing the lives of millions of your fellow citizens," he wrote. "As someone who does things that are illegal, I'd rather not have increased scrutiny. ... However, it's a no-win for a decision maker like Ashcroft. I don't know what I'd do if I were him. Neither do any of you. You *don't know* what you'd do in someone else's shoes until you actually have to face their decisions. Moralization is easy. Making decisions that may save or cost lives is hard."
There are many in the computer security industry who, while freely admitting they find some form of nobility in Lamo's peculiar brand of hacking, worry that those who follow his lead may do so not because they admire his spirit, but because they want to grab some headlines themselves.
"Benevolent hackers have been a piece of the computer underground for years," says Skoudis of Predictive Systems. "Adrian doesn't leave me ill at ease ... he's too smart. My fear is that it's not reproducible. Adrian does his thing, but Adrian is pretty decent about what he does; someone who doesn't have his skills, or his personality, could be like a bull in a china shop."
FBI officials, meanwhile, won't say whether the bureau has ever investigated any of Lamo's intrusions. "There's no way I'd be able to tell you that," a spokeswoman in the FBI's Washington, D.C., office says.
At one hotel in Washington, D.C., there's a vending machine that dispenses 20 cents in nickels every time it's hit with a Taser, an electric stun-gun meant for personal defense that is one of the more useful things Adrian Lamo has ever owned. "You never know what something's going to do when you Tase it," Lamo enthuses. "It's like the Swiss Army Knife of electronic devices."
It's a mild Sunday evening in late March, and Lamo has cashed in a gift card at Banana Republic for a new black jacket, which he wears over his usual dun-colored pants and boots. He's also sporting a new black shoulder bag -- complete with a sleeve on the strap for his cell phone -- that he bought, with another gift card, at the Gap. Protests against Operation Iraqi Freedom have roiled these streets in downtown San Francisco for much of the past two weeks, but Lamo has been away from the city, recuperating, again, from too many sleepless nights. Since turning 22, Lamo has noticed that his sleep schedule (or lack thereof) has been harder on him, and as we walk down the mostly empty streets, he stops to gaze in the window of a health food store. He's heard that some herbs and vitamins have anti-convulsive properties, which might help him stave off the spasms he suffers when he doesn't get enough rest. The convulsions are the result of a neurological disorder, which Lamo says stems from an amphetamine overdose he endured last year. As with most of the steady influences on Lamo's life, drug use is something he regards as a necessary element of his lifestyle -- which also includes mainlining caffeine-laced energy drinks like Red Bull, Jolt Cola, and Mountain Dew Code Red.
"I've resisted including this in news reports because I think it would make me intolerable to the government if I was advocating both intrusion and drug use, but substances that disassociate you from your senses have played a big part in my life," Lamo says. "The point, with substances, has always been to show myself where I can go without them. Drugs are not an indispensable part of my life. But there are times when I'd rather stay up until the next bus comes instead of curling up and finding my backpack gone when I wake. There are times I don't want to feel the pain."
He pauses, stops on a corner of the sidewalk in the Financial District, and waves his hand toward the nearest storefront. "This is my historic Kinko's," he says. "A great many of my compromises occurred here. I believe it's still 24-hours ..." Peering at the sign on the door, he steps back, aghast. "Goddamn it, it's not! How could they do this to me?" He shakes his head, then slips back into his role as tour guide. "It does not have a restroom but it has a vending machine, so I can keep the Code Red coming. So much miscellaneous stuff has happened from this Kinko's, from that far desk over there. Most of the exploration for the WorldCom intrusion happened here."
Before he penetrated the New York Times, Lamo's incursion into the troubled telecom giant WorldCom was perhaps his greatest coup. It was vintage Lamo: He was drifting around the company's site, with no preformed plans to hack it, when one thing led to another. Over a handful of all-day sprees -- "whenever I'd get bored and remember WorldCom," as he puts it -- Lamo got access to the company's internal system via open proxy servers, dedicated machines that act as a go-between for employees' computers and the Internet. This, too, is his trademark. Whereas most hackers obsess over known software vulnerabilities, endlessly scanning a company's security applications in the hopes of finding a random glitch, Lamo sneaks through these more nebulous, less intentionally geeky, holes. When brought online, proxy servers are often misconfigured, both accepting and forwarding connections from the outside as well as the inside, and Lamo can change his browser's preferences to match those of the proxy server.
Open proxy servers don't require a username or password, and once inside a company's system, Lamo hunts down passwords that enable him to view other pages on the company's own intranet. And this is one of Lamo's fundamental gripes: When you put a network, any network, online, you accept the responsibility for securing it, he says. And spending millions of dollars on front-door security software doesn't mean anything if the back door is wide open.
Lamo broke the news of his intrusion into WorldCom through the Web site SecurityFocus.com, and officials at the telecom company said they appreciated Lamo's help in drawing attention to the problems with their system. (It took a weekend of Lamo's assistance to close the holes.) "All these companies I've compromised, they've never had a clue until I told them," says Lamo, who has a computer screen-shot of WorldCom's stock falling the day he disclosed his hack. "To an extent, it's because of my approach. Classic intrusion software looks for an attack -- nothing I do looks like an attack. It's the same stuff a user would do, and you can't determine what the intent of a user is."
His nomadic lifestyle is another reason he's never been caught; Lamo always works alone, and he travels without companionship. Given his admitted contempt for returning phone calls promptly -- "Some people are rudely late," Lamo says, "I try to be absurdly late" -- it's hard for him to make personal relationships last. Although he's got a lot of friends across the country, he usually leaves before those friendships bloom into something more.
"In a way, I'm sort of fated to be a bright, fast-moving object in people's lives," Lamo tells me one night. "I tend to enter abruptly, make massive change in their life, and leave just as abruptly. I keep in touch with people, but I try not to let my words be taken with inappropriate weight by people around me. I've seen the effects of people's long-term association with me, and I just feel strange about changing people's lives so drastically. You know, people who were nice suburban boys two years ago, and now their mom wonders what happened to them."
A few evenings later, I meet a friend of Adrian in downtown San Francisco. His name is Nevin Williams, and he's a 32-year-old network administrator in a red sweat shirt that says "Canada." They met through a mutual friend in the computer world, and it's a credit to both Williams and Lamo that they still talk: Williams, as it happens, was lead engineer at Excite@Home when Lamo hacked the system and added his name as a security consultant to the company directory. Williams didn't hold it against him, and Lamo has since crashed many a night at Williams' house in the suburbs. Although he cautions Lamo about the risks, Williams doesn't try to change his friend's path. "With Adrian, it's a spiritual thing. This is his religion. It's something he believes in, and he's not two-faced. This is genuine. Many people don't understand it -- I don't claim to understand it, either."
Williams shrugs. "I just request he doesn't use my networks in the process of doing whatever he's doing," he says. "And I really hope I'm not with him when the FBI or the CIA swoops in."
For the past several years, there's been a bench warrant out for Adrian Lamo in Sacramento County. He got it several years ago for riding public transportation without a ticket. "There's irony in the fact that the whole time I was doing all these crimes, they had license to take me in," Lamo says. "I hope the universe enjoys absurdity as much as I do. I suspect it does."
On a windy afternoon in Yerba Buena Gardens, Lamo and I settle in a rare patch of sun on a round stone bench. He's talking into his cell phone to Williams. "I'm sure it's not messy by my standards," Lamo assures him. "I'm used to abandoned buildings." After he hangs up the phone, Lamo sighs, and says, "I hope I don't die of asbestos poisoning a few years down the road, but if I do, it will have been worth it."
His recent birthday, I think, has caused Lamo to question his mortality. He seems on edge, and when I ask him about his impending disclosure, he says he's not dissuaded by the target company's reputation for hunting down hackers -- "Intimidation is not a substitute for security," he insists -- but admits to weighing the ramifications. At one point, he stares into the sun, his brows locked, and considers a question about how he would fare in jail.
"I don't know; I could be happy indefinitely sitting here in the sun, and this could be a prison yard if you put walls around it," he says at last. "But prison would curtail what I do, and it would be unpleasant."
So why go through with it? He gives his standard line: "This is what I do, this is the role I was born to play." And he refers, as he often does, to a quote from Frank Herbert's 1965 science-fiction epic Dune, the story of a young man who becomes a messiah. At home that night, I look up the passage: "The person who experiences greatness must have a feeling for the myth he is in. ... And he must have a strong sense of the sardonic. This is what uncouples him from belief in his own pretensions. The sardonic is all that permits him to move within himself. Without this quality, even occasional greatness will destroy a man."
Only then do I understand: In his mind, Lamo's life is a new kind of story for the Information Age, the quasi-mythic saga of a traveler, perhaps not so different from Dune's, whose adventures are neither wholly corporal nor wholly virtual. If Lamo spends too much time considering his actions, he steps too boldly out of the character he's created. And more than anything, I think, Lamo wants to know how his story will end.
In that respect, at least, he's not so different from the rest of us.