15-Year-Old Admits Hacking NASA Computers

M I A M I, Sept. 22, 2000 -- A 15-year-old computer hacker caused a 21-dayshutdown of NASA computers that support the international spacestation, and invaded a Pentagon weapons computer system to intercept3,300 e-mails, steal passwords and cruise around like an employee.

The boy, known on the Internet as “c0mrade,” pleaded guilty today tojuvenile delinquency in a sealed federal case.

Six Months in Jail

He became the first young hacker to be incarcerated for computer crimes, theJustice Department in Washington said in a summary.

He will servesix months in a state detention facility.

“Breaking into someone else’s property, whether it’s a robberyor a computer intrusion, is a serious crime,” said AttorneyGeneral Janet Reno. The prosecution “shows that we take computerintrusion seriously and are working with our law enforcementagencies to aggressively fight this problem.”

Chris Rouland, who monitors computer attacks for InternetSecurity Systems Inc. in Atlanta, said the unusual part of the casewas that the boy was caught, not that he got where he did.

The boy’s identity was withheld because he’s a juvenile.

Stole Software, E-Mails

Now 16, he admitted accessing 13 computers at the Marshall Space FlightCenter in Huntsville, Ala., for two days in June 1999 anddownloading $1.7 million worth of NASA proprietary software thatsupports the space station’s environment, including temperature andhumidity.

NASA responded by shutting down the computers for 21 days todetermine the extent of the attack at a cost of $41,000 incontractor labor and replaced equipment.

In August and October 1999, c0mrade entered the computer networkrun by the Defense Threat Reduction Agency, whose mission is toreduce the threat from nuclear, biological, chemical, conventionaland special weapons to the United States.

By entering through a router in Dulles, Va., and installing aback door for access, he intercepted DTRA e-mail, 19 user names andpasswords of employees, including 10 on military computers.

The criminal case and plea bargain have been in the works forabout six months, said a source familiar with the case.

If prosecuted as an adult, he would have been charged withwiretapping and computer abuse violations.

As part of his sentence, the boy must write letters of apologyto the secretary of defense and the NASA administrator.

“The charges do not necessarily denote the actual threat tonational security,” said Russ Cooper of ICSA.net, a Reston,Va.-based network security provider. He believes the NASA computershutdown was time spent determining whether the intruder leftanything behind that could harm the system.

Gov’t Computer Scares Common?

But Cooper also believes that kind of shutdown is more commonthan federal agencies acknowledge.

“I would suspect that that type of delay is occurring very,very regularly,” he said. “It’s quite likely that companies andgovernment agencies, et cetera are scared into thinking that theymight have been compromised.”

The case reflects growing technical sophistication amonghackers, who found 10 new ways to break into computers in 1996 butnow invade at the rate of 100 a month, Rouland said. He ratesgovernment security at a D in terms of school grades.

“This is a great bellwether as to the state of security wherejuveniles can traipse across computer systems with little or nofear” of being caught, he said.