Break The Internet | Criminal Podcast | Forensic Files

Phoebe Judge: How easy would it be for you to hack into my stuff right now? Mike Calce: If I really wanted to and I was at a computer, it'd probably take me about
half an hour. Phoebe Judge: And you could find out everything? Mike Calce: I'd find out everything, your bank account information, your Twitter password,
all your passwords to all your accounts. Phoebe Judge: Half an hour. Mike Calce: Give or take.
Phoebe Judge: This is Mike Calce. Like so many of us, he first accessed the internet in the early '90s, when AOL started
sending their floppy disks, and later CDs, through the mail. At one point, half of the CDs in the world were being produced for AOL's direct mail
campaign. Every six seconds, someone new signed up. AOL Message: Welcome. Phoebe Judge: Calce was 9 or 10 years old, living with his parents in Montreal.
Mike Calce: AOL was actually what made me want to be a hacker, or kind of forced me
to be a hacker. Because that 30-day process where they allow you internet for free 30 days, I wasn't sure
if my father was going to give me his credit card number to reinstate the service.
So what I had to do was, I found an application that allowed you to log onto AOL and appear
to other people as if you were an administrator of AOL. And I was messaging other users saying, "Excuse me, due to a power outage at one of our facilities,
we need to verify your password." And sure enough, the first four out of four gave me their passwords, and I was using other
people's AOL account information to stay online. That's— Phoebe Judge: Wait a second, you're 10 years
old. Are you thinking the whole time, "Oh my God, this is working. I can't believe this is working, this trick"?
Mike Calce: I was, I guess, surprised in the sense that it was this easy. I would've figured it would have taken a few attempts.
I knew I would have got somebody at some point, but to go four for four on the first attempts,
I was like, okay, this is no problem. I have internet permanently, now. Phoebe Judge: Of course, most kids feel like they can get away with anything.
But if by fifth grade, you're already smarter than most of the adults around you, maybe
you actually can. I'm Phoebe Judge. And this is Criminal. [Music.] In many ways, Calce's early experience with the internet wasn't so different from a lot
of people's. It started with AOL, but then he found out you could download stuff — movies, music,
games — all free, albeit illegal, if you knew where to look. Mike Calce: But the thing was, there was a queue list where you had to wait in line,
because other people wanted the software as well. So I kind of wanted to find a way to skip the system and be able to just download whatever
I want. Phoebe Judge: Access to this free stuff was run by hackers, and Calce realized he could
skip the line if he found a way to work with them. So he sent a message to someone he thought was in charge.
Mike Calce: And he said, "Oh, sorry, look, we're only looking for experienced hackers
already. We're not interested in n00bs," which is basically someone who has no idea what they're doing
and is new to the industry. I said, "Look, give me two weeks. Give me a trial period.
I'm a very fast learner. And I promise I won't disappoint you." Phoebe Judge: The guy gave Calce a series of tests, and he passed.
He was good, really good. He was breaking into university networks. Mike Calce: Yale, UCLA, Harvard.
Phoebe Judge: So you're 11 or 12 now, and you're trying to break into UCLA and Harvard?
Mike Calce: Exactly. So I had to pretend to go to sleep, then wake up, and then go back on the computer.
And typically like I would sleep through the first two classes of school every morning,
because I spent most of my hacking activities at night. Phoebe Judge: By high school, Calce had hooked up with what he describes as basically a group
of elite Russian hackers. He considered them as friends, but there was a lot of paranoia.
You couldn't really be sure of who you were talking to, or what they were capable of.
And it wasn't just online. They also talked on the phone. As Calce explains it, someone would steal a credit card number and use it to buy a conference
call line. Mike Calce: It was kind of like a Friday night thing. And someone would post a phone number and post a pin, and a bunch of hackers would go
on this conference call line. Phoebe Judge: And what would you do once you got there?
Mike Calce: Every instance was a bit different, but a lot of it is mumbo-jumbo because there's
30 hackers, basically talking trash to each other. But in one instance, there was an American hacker on one end and there was a Russian
hacker on the other end. And they were basically calling each other out. Phoebe Judge: The American was threatening to divulge the Russian's personal information.
The term is 'doxxing.' And in this hyper-anonymous world, it basically shows your own skill while embarrassing the
other guy. Mike Calce: A few other of the hackers were egging them on and saying like, "All right,
let's see what you guys got. Let's go, let's go." And so they started going at it, and throughout the process of the phone call, the American
hacker was taunting the Russian like, "Oh yeah, I'm getting your information right now
as we speak." American Hacker: But I will find it. Mike Calce: He's like, "Don't worry."
And the Russian was really silent, not really saying anything. At some point, like 20 minutes down this conversation, the American's like, "All right, I'm getting
pretty close. I'm accessing some of your information." And the Russian finally speaks up, and he's like, "Well, you don't have to do that."
And the American's like, "What are you talking about?" And then the Russian starts going off, listing off his parents' name, his home address, and
social security number... The American started admitting defeat. He's started pleading.
He's like, "Please, no, no, wait, I give..." And the Russian's like, "No, I'm not done with you.
You were talking a big game. Now let's see what's going on." And the American started screaming on the phone, and he's like, "What the hell did you
just do? What the hell did you just do?" And the Russian's like, "Bye-bye, kiss mommy goodnight for me."
And I mean, I don't know if I want to say this too explicitly, but the American was
like, "Holy shit, you cut the fucking power from my house." Phoebe Judge: So he's sitting there in the dark.
Mike Calce: He's sitting there in the dark, and he's on the phone line. He was just freaking out, losing it.
And then people started exploding on the chat. I was very impressed and in awe with what he was capable of doing.
Phoebe Judge: Just for context, that was 1999, the same year that people were freaking out
about Y2K, and Al Gore claimed to have created the internet. [Music.] So much of these chat room pranks were about one-upmanship, about making other hackers
afraid of you. And Calce had yet to try. So the following year, in February of 2000, he made his move.
Mike Calce: And I basically shut down eBay, CNN, E-Trade, Dell, and Amazon.com. Phoebe Judge: [Laughs.]
How did you do that? Mike Calce: Basically, what I did is I hacked into almost every major university college
in America, and I combined them all together. I made a massive network by combining all the universities and colleges that I had compromised
together. And I basically set them up as slaves, and I set one master network that was like the
boss, let's say. And when I would tell that master computer to shoot all your bandwidth, all your internet
speed that you have available, to this one designated site, all the other universities
and colleges that I had compromised would respond at exactly the same time, so it would
launch a coordinated attack. And so I would say, all right — I'd go to the master computer and say, all right, here's
eBay's IP address. Let's target eBay. Phoebe Judge: At this point in time, in 2000, on the scale of large business hacks, where
did this rank? Mike Calce: At the time, it was definitely the biggest hack. Phoebe Judge: Over the course of a week, Calce basically broke the websites of E-Trade, Yahoo,
Buy.com, eBay, Dell, CNN, and Amazon. By most estimates, the attack caused $1.7 billion in lost revenue, even though the sites
were only down for a few hours. We asked a couple of other hackers what they thought about it, and they said Calce demonstrated
what many in the community already knew was possible. He basically proved just how powerful the technology could be.
[Music.] So where were you when you get arrested? Mike Calce: I was at a friend's house, actually, ironically watching a Goodfellas movie.
It was three in the morning, give or take. And I received a phone call from my father saying, "They're here."
And I'm like, "Pardon me? Who's there?" But I could tell by the tone of his voice that the
show was over, basically. And that the RCMP, which is the Canadian version of the FBI, and the FBI, as well, were in
a joint task force, and they had raided my house. Phoebe Judge: I mean, your parents know nothing of what's going on when the police and the
FBI show up at the door? Mike Calce: My dad knew at this point, because I had told him, prior to getting raided, that
I was the person responsible for these attacks. Phoebe Judge: What was his response?
Mike Calce: You know, I was pretty smart about it. Basically, I had to pick the right time to tell him, and I picked a Sunday, when he was
eating a nice panini and— Phoebe Judge: [Laughing.] Wait, your dad's like — [laughing].
He's got the panini, so he doesn't care about the New York Stock Exchange. It's okay, he's got the sandwich.
Mike Calce: Right. He's got the sandwich, you know, so I figured the best time to deliver this kind of news
is when you're in the process of eating some good food. I figured it would alleviate some of the stress involved with what I'm about to tell him.
And my dad's a cool, calm, collected kind of guy, so he took it rather well. He was kind of shocked, but he was very professional about it and said, "Listen, we need to go
see a lawyer. We need to get prepared." And that's exactly what we did. Before they even raided me, I had already seen a lawyer on three, four, several different
occasions. Phoebe Judge: But they couldn't protect you from jail? Mike Calce: Nobody could, at this point.
Quite thankfully, I guess, I was 15 years old at this point, because if I was 18, I
don't think we'd be talking over the radio right now. Phoebe Judge: Because Calce was a minor, the police couldn't release his name.
Media outlets referred to him only as his alias: MafiaBoy. Janet Reno, the attorney general, referred to him only as MafiaBoy.
Janet Reno: [At a news conference.] The suspect who goes by the online name MafiaBoy has been charged in connection with the cyberattack
on the CNN network website. I believe this recent breakthrough demonstrates our capacity to track down those who would
abuse this remarkable new technology. [Fades out.] Phoebe Judge: He pleaded guilty to 57 counts of "mischief to data" in the Montreal Youth
Court, and was sentenced to eight months in a youth detention center and a year of probation
after that. He could go to school, but he couldn't use a computer. WIRED Magazine reported it as "the cyber-strike that put the internet security issues on a
national stage, and inaugurated an era where any pissed-off script-kiddie could take down
part of the web at will." Mike Calce: I was very content that I was able to accomplish this goal.
I felt, like, a sense of accomplishment when I was hacking and able to infiltrate such
high-profile targets. Phoebe Judge: If you hadn't gotten caught, would you still be hacking?
Mike Calce: Absolutely not. Because to be quite honest with you, if I wanted to hack, I still could hack.
They caught me for those attacks because I was boasting about them in public chats.
And that's when they started to single me out and really divert their attention towards
me. They never found me through technical means. It's not like I left digital footprints anywhere.
I knew what I was doing. The point is that it's wrong. Phoebe Judge: When Calce got caught, a reporter pointed out to Janet Reno that Calce was a
minor and asked how the justice system was equipped to handle kids that cause so much
damage. She didn't say we'd be able to stay one step ahead of them. She said she thought we needed to teach them better manners.
Janet Reno: [At a news conference.] ... That they are not going to be able to get away with something like this because
of age. There has got to be a remedy, there's got to be a penalty, but more importantly, we
have got to renew our efforts to teach young people — children, young people — cyber-ethics,
so that we ensure that this tool is used by all concerned to expand our opportunity for
learning, for communication, for commerce. Phoebe Judge: It's like a game of cat and mouse, where the cat is asking the mouse to
slow down and play nice. [Music.] Calce is 31 now. He makes a living trying to help companies find weak spots in their networks.
A lot of people in the cybersecurity industry are like him. Kids who started out breaking things, all grown up and now in high demand.
[Music.] Criminal is produced by Lauren Spohrer, who debuted on AOL as TheBookPrincess; Eric Mennel,
aka RedSox1302; and me, PhoebeJ44 — that's unchanged for 20 years. Julienne Alexander does our episode art.
You can find all of our episodes on iTunes, where you can subscribe to the show.
Our website is thisiscriminal.com. We're on Facebook and Twitter, @CriminalShow.
And thanks to all who donated to the Radiotopia Kickstarter. We made the goal, and we're looking forward to bringing you more new shows next year.
As part of Radiotopia, we'll be working with shows like Benjamen Walker's Theory of Everything.
His newest episode features Ethan Zuckerman, the guy who invented the pop-up ad.
Turns out, he thinks internet advertising has gotten out of hand. Ethan Zuckerman: To try to convince investors that ads are somehow going to be worth money
— because it's very clear that no one likes them, no one wants to encounter them — we've
had to make them more and more intrusive. And we functionally had to put people under surveillance.
Phoebe Judge: That's Benjamen Walker's Theory of Everything. I'm Phoebe Judge. This is Criminal.
AOL Message: Goodbye. [Music fades out.] Phoebe Judge: What scares you? Mike Calce: What scares me is that, if this gets to the level of terrorism one day, where
water sanitation sites and stuff — like, the water being pumped into your home is pretty
much all automated these days. They put fluoride in our water, they put different chemicals, and it's mainly all balanced to
be safe. But what if a hacker obtains access to one of these water facilities and changes the
fluoride levels so that it's actually poisonous and harmful to human beings? These are types of things that scare me.
Shutting off power in hospital facilities, making automated defense missile systems launch
against their own nation... These are things that really scare me.

Long before Game Stop and Crypto Bros, there was a hacker named "MafiaBoy". In 1999, most of America’s tech hysteria centered around Y2K. But at that same time, a teenager in Canada named Mike Calce was messing around in chat rooms, meeting hackers, and learning tricks. At 15, he decided to put his knowledge to the test. To push up against the Internet’s limits, and in some places, break them. We talk to “MafiaBoy” about how he managed to pull off something no one had ever seen before.

Criminal is a show about people who’ve done wrong, been wronged, or gotten caught somewhere in the middle. Hosted by Phoebe Judge. Part of the Vox Media Podcast Network.

Follow the show on Apple Podcasts, Spotify, or wherever you get your podcasts. https://link.chtbl.com/n33u0HsA

Say hello on Twitter (@CriminalShow), Instagram (@criminal_podcast), and Facebook https://www.facebook.com/ThisIsCriminal/.

Sign up for our occasional newsletter, The Accomplice https://bit.ly/accomplicenewsletter.

We also make This is Love and Phoebe Reads a Mystery.

Artwork by Julienne Alexander http://www.yssrs.com/.

Check out our online shop https://store.dftba.com/collections/criminal.

Episode transcripts are posted on our website https://thisiscriminal.com/

Episode 12 originally published 11/26/14 https://thisiscriminal.com/episode-twelve-break-the-internet-11-25-2014

Brief Summary

Mike Calce, known as MafiaBoy, discusses his early hacking exploits and the consequences of his infamous cyberattacks.

Key points

The Young Hacker. At just 10 years old, Mike Calce discovers the ease of hacking into AOL accounts.
The Biggest Hack. In 2000, Calce orchestrates a massive cyberattack, taking down major websites.
Caught by the Authorities. Calce's hacking spree ends when law enforcement raids his home.

Episode highlights

Episode quotes

I was, I guess, surprised in the sense that it was this easy.

Mike Calce reflects on his early hacking attempts.

1:40WatchOct 27, 2022

Tension

75/ 100High tension

More from Criminal | A Podcast About Crime

Solve the Crime

Read a real case one clue at a time, then see how your call held up against the investigators.