Hunting Down the Hackers : Vigilante Is On to Culprits’ Modem Operandi and Wants Them to Pay Up

Rebecca Bigley is on to Merlin’s game.

“Here, take a look at this,” says the security chief of Thrifty Tel Inc., a small long-distance telephone company. She presents a printout of a computer message, disseminated to the hacker community by a self-appointed magician who fancies himself as invulnerable. Should a telephone company catch you breaking into its system, “Merlin” advises his disciples, “deny it till your ass falls off.”

“Act real dumb if they call you--go, ‘Does that have something to do with my Atari 2600?’ or something equally as stupid,” Merlin continues. “They cannot prove you did it. Just (lie to) them and you will not be successfully busted.”

Ah, but Bigley begs to differ. They can prove you did it. And they will bust you.

In the past six months, Thrifty Tel’s vigilante has put six hackers in jail. And she has made 45 others atone for their sins with hard cash and hardware. The case that Bigley calls her biggest coup--involving a 16-year-old Buena Park boy whose alleged theft of computer data cost Thrifty Tel millions of dollars--is pending in Orange County Superior Court.

Thrifty Tel has become one of the most aggressive hacker fighters in California, according to Jim Smith, president of the California Assn. of Long Distance Telephone Companies (Caltel). “(Bigley) is tough,” he says. “I would not want to be a hacker on her network.”

So far, the company has collected more than $100,000 in penalties and reimbursements from hackers.

“We do not have a hacking problem anymore because we stood up and punched them in the face,” Bigley proclaims.

That pretty much sums up her feelings about hackers. They disgust her. She wants to lock them up and throw away the keyboard.

“These kids think that what they’re doing is no big deal--they’re not murdering anyone,” Bigley says. “They think we’re terrible for calling them on it. Their attitude is extremely arrogant.

“But these are not just kids having some fun. They are using their intellect to devise ways to steal. And these are not kids who need to steal. They come from white-collar families.”

For Thrifty Tel Inc., the battle of wits started a year ago.

The company was founded in 1981 and went public in 1988--four years after AT&T;’s deregulation, which spurred the creation of the 35 long-distance carriers currently operating in California.

Thrifty Tel Inc. competes against the big three long-distance companies--AT&T;, Sprint and MCI--by offering discount prices. It serves 7,000 Southern California customers, both residential and business.

Like every other telephone company, Thrifty has been plagued by occasional computer hackers. But last year, with the proliferation of technically advanced hacking software programs, what was once merely a nuisance became a catastrophe.

“Increasingly sophisticated programs have been developed in the past couple of years to attack telephone systems similar to ours,” Bigley says.

Hackers share the information with one another over clandestine computer bulletin boards, then use it to tap into telephone systems and crib paying customers’ access code numbers. The software programs, which boast such sinister-sounding names as “Thief,” randomly test numerical series until hitting upon operable access codes.

Thrifty’s private codes spread across computer bulletin boards like wildfire. Freeloaders were leeching off customers’ lines--interfering with service and running up huge phone bills from Thrifty’s local carriers, Pacific Bell and GTE.

“The first quarter of 1990 we came in with a half-million dollar net profit, and everything was going great,” Bigley says. “Then the next quarter, all of a sudden we were lopsided. We were getting bigger bills from our carriers than we were billing out to our customers.”

With a little investigation, the company realized the culprits: hackers who were eating up telephone time at as much as 10 hours a “conversation.” Because the hacker community exchanges information and solves secret codes via long-distance modem connections, circumventing expensive telephone charges has become its mainstay.

“I wanted to just turn the switch off and go into another business, literally,” says Bigley, who has been vice president of operations at Thrifty Tel for four years. “It was so frustrating to sit here and watch these hackers burn through our lines. I had technicians out changing customers’ codes that they’d just changed a few weeks before.”

But Bigley is not the sort of person to throw in the towel. By her constantly ringing telephone, by the haphazard stacks of files on her desk, by the secretaries periodically popping in to announce that so-and-so from the district attorney’s office is here for the meeting, by her impossibly overbooked schedule, by her feisty rhetoric, by her fingernails bitten to the quick, by her disheveled, no-time-to-brush-it hair inconsistent with her dressed-for-success business suit, you can tell:

This woman likes a challenge.

“We declared an all-out war against hackers,” she says. “For me, it’s all or nothing. I’ve always been very committed in everything I do. And if we didn’t stand up to the hacker community and make a statement, they would have ripped us apart.”

First, she devoted a couple of months to educating herself about the art of hacking. She monitored Thrifty Tel’s computers for unusual activity--telephone calls coming into the switching facility from non-customers.

“They believe that because they’re sitting in a room with a computer they’re safe,” Bigley said. “The problem is, they’re using their telephone--we can watch them in the act. It’s a lot easier to catch a hacker than a bank robber.”

Bigley started making a few calls of her own. If the infiltrator seemed major league, such as the Buena Park boy, she contacted the Garden Grove Police Department--whose fraud investigators went into homes with search warrants.

However, if the hacker seemed relatively small potatoes, Bigley took matters into her own hands--acting as arresting officer, judge and jury all in one. She telephoned the suspect and presented an ultimatum: Either come in and pay up, or face criminal charges.

A non-negotiable condition of Bigley’s out-of-court settlement provided that the guilty party relinquish his (or, infrequently, her) computer and modem. Thrifty Tel donates the confiscated weapons to law enforcement agencies.

Unusual punishment, yes--and, some would say, even cruel. But Bigley believes that physically prying the hacker from his beloved computer plays a crucial role in his rehabilitation. Sure, he can go out and buy another one, parents willing. Still, that initial separation “seems to have a bigger impact (on the hacker) than any fine we can charge.

“The computer is part of the kid’s body,” Bigley adds. “These kids spend hours and hours every night fooling around on their computers. That’s not normal--that’s obsession.”

Teen-age hackers tend to be “very intelligent and somewhat introverted,” says Garden Grove Police Detective Richard Harrison, a fraud investigator who has arrested many of Thrifty Tel’s suspects.

“We get the kids who are the last to be picked for sports teams,” Harrison notes. “They get on the bulletin boards and talk to people just like them. It would be great to harness their energy and divert it in a positive direction.”

Most of the parents he has dealt with were oblivious to their children’s secret lives, Harrison says: “They tell me, ‘Yeah, my kid likes to talk on the bulletin boards. We think it’s healthy that he’s so computer literate.’ They don’t understand how much harm a kid can do with a computer.”

Harrison suggests that parents educate themselves about their children’s computers. “If a kid is spending a whole bunch of time on his computer and it’s hooked up to a modem, he’s not just running his software. What is he doing on that computer? Does he really need a modem? Parents, after all, are liable for what their kids do with these machines.”

Not all hackers are young computer fanatics testing their limits.

“The hacking problem is twofold,” says Caltel president Smith, also president of the Sacramento-based long distance telephone company Execuline. “First, we have information-age fraud, which is an outgrowth of the proliferation of computers in households. We have all these kids who want to talk to each other on bulletin boards, and if mom and dad had to pay for all those phone calls the cost would be prohibitive.

“Then we have professional fraud--adults as well as kids who attempt to gain access to our codes for the purpose of selling the codes. They have made a big business out of hacking.”

Smith’s company has waged a more low-key defensive against hackers than Thrifty Tel.

“I wish I had the time to devote to hacker fraud that she (Bigley) has been able to devote,” Smith says.

Therein lies the reason that many telephone companies decline to file charges against hackers, says Roy Costello, a fraud investigator for GTE.

“Smaller carriers don’t have the time to allow their people to do the investigation and then carry it through the court system,” he says. “If they identify a hacker, they prefer to send that person threatening letters and try to receive restitution quickly, rather than prosecute and receive restitution in a year.”

However, Costello says, Thrifty Tel’s hard-line tactic has been the more effective.

“They’ve made a tremendous dent in the number of hackers wailing away at their system,” Costello says. “When someone finds out that a friend has been busted, he puts out a warning over the bulletin board: ‘Don’t mess with Thrifty.’ ”

The ever-helpful Merlin concludes his advice column of sorts with some reassuring counsel for the hacking audience:

“If a (telephone) company keeps calling you, tell them not to call any more or you will charge them with harassment. Now THAT one works.”

Clearly, Merlin has never crossed wires with Rebecca Bigley. She will not rest until she has “harassed” every hacker into submission.

When Bigley launched her crusade against hackers, she devoted “at a minimum” 60 hours a week to the mission--commuting from her San Fernando Valley home early every morning and returning late at night.

And, on top of the hacking crisis and the 150-mile commute, she and her husband had just had a baby. “My newborn daughter didn’t get to see too much of Mom back then,” Bigley, 33, admits.

She attributes her fervor to “a passion for drawing the line between what’s right and what’s wrong.”

“I have two children, and I live in this world like everyone else,” she says. “And when I see something that I think is immoral, I take a stand--I don’t just sit back and let someone beat me up.”

If she demurred from meeting obstacles head-on, she believes, she wouldn’t have gotten very far in corporate life.

“I have two strikes against me--I’m blond and I’m female, in a male-oriented world,” Bigley says. “Every single day I have to overcome the visual and say: ‘Look at me for who I am, look at my work product.’ ”

That unrequited need to prove herself helped propel Bigley through her war against hackers.

“I’ve been in the trenches with a BB gun fighting an entire army,” she proudly says. “And I won.”