episode 026 — How a 15 Year Old Became the US’ Most Notorious Hacker

 

In 1999, an innocent 15 year old boy from Florida named Jonathan James unknowingly set on a path that would ruin his life. A computer genius, Jonathan had always been obsessed with computer programing and how different operating systems worked. He would often tinker around with his own computer at home, specifically reprograming things to his liking and eventually would even try hacking into different local networks and servers just out of sheer curiosity and for fun.

But although Jonathan never had any bad intentions as a hacker, he soon accidentally messed around in an area where he absolutely shouldn't have. All of a sudden, this 15 year old boy's name was making headlines all across the country. Before long, he had become the first miner ever to be incarcerated for cyber crime. And this is his tragic story.

Welcome back, guys. My name is Andy Jang and this is The Hidden Stories.

On December 12th, 1983, Jonathan James was born into the world. Now, at the time, computers were still in their infancy, and to just own one was considered to be a sort of luxury. For reference, well, up to 94% of American households are reported to own at least one computer of some sort. Today, in 2023, in the early 1980s, that number was only a mere 8%.

However, despite this, since Jonathan's dad worked as a computer programmer, growing up, Jonathan had constant access to computers, and even from a young age, he quickly became obsessed with them, starting from around age six. Jonathan would spend hours upon hours every single day in front of the screen playing different video games, since these gaming sessions would often go late into the night, interfering with not only his social life, but his sleep as well.

His parents soon began to really worry about him. Unlike today, back then, kids spending hours by themselves on a computer really wasn't normal or common at all. And Jonathan's parents were becoming increasingly afraid that their son's addiction would negatively impact his health and his studies. As a result, they soon decided to begin imposing parental controls, restricting Jonathan's computer time and access.

They figured that this would force him to start playing outside and hanging out with friends, more like the rest of the kids his age. However, little could Jonathan's parents ever have expected that their controls would only further strengthen their son's obsession and interest in computers. In Jonathan's mind, the restrictions that have been set in place by his parents were only mere challenges obstacles that he needed to bypass.

So despite his young age, he began diligently learning more about computers and their operating systems, intent on finding clever ways around these obstacles. Although at the time, it was much, much harder to really understand computers and how they worked since there was such a lack of resources about them. And also because computers back then were just that much more complicated, the computers today, Jonathan, somehow managed to figure everything out on his own, even just as a teenager.

He soon became very skilled, encoding and programing languages and also operating systems. He became very familiar with the ins and outs of computers and how every piece worked together in the ways that they did. And before long, he was already performing incredibly impressive technical fields, like replacing his computer's Windows operating system with Linux completely on his own. Given just how young he was, Jonathan's extensive knowledge of computers was really nothing short of remarkable, especially during that time.

His passion for computers was extraordinary as well. At a certain point, he could do so deep into the world of computers that he was no longer interested in just bypassing his parents restrictions to play video games. He was now much more intrigued by the sheer power of computers in general and just what he could do with that power.

Jonathan's intrigue and curiosity was only further heightened by the introduction of the World Wide Web in the early 1990. For the first time ever, people anywhere could navigate the Internet to find, share and communicate information. And it absolutely fascinated Jonathan. However, in 1996, when Jonathan was 13, his parents finally decided that his computer addiction had gone too far and that they needed to take drastic action.

So they confiscated his computer. When they refused to return it, Jonathan ran away from home, making it clear that he wouldn't come back until he had his computer back. When he actually kept that promise and didn't return, his worried parents called the cops, who were eventually able to track Jonathan down at a local bookstore. When Jonathan was brought back home, he once again fought with his parents to let him keep his computer.

He argued that his addiction wasn't quite as bad as his parents had made it out to be since his grades in school were still very good. Since this was actually true, Jonathan's parents eventually gave in and returned his computer to him. However, what they didn't know and what no one knew at the time was that Jonathan had actually managed to hack into his county school system earlier that year, allowing him to change his grades to whatever he wanted them to be.

Even more impressively, at around the same time, Jonathan had also secretly hacked into BellSouth Telecommunications, one of the largest telecommunication companies in the United States at the time. Despite the fact that this was extremely illegal and considered to be a major crime, the company's expert cybersecurity team had never even realized that Jonathan had been in their systems. Extremely lucky for them.

However, Jonathan never destroyed damage or shared any of their data or secrets. He had apparently never intended to, and I just wanted to hack into the company either because he had been curious about something or he had just wanted to prove that he could. In fact, no one would have even known that Jonathan had ever hacked into BellSouth Telecommunications if he hadn't confessed to it himself a few years later.

But although Jonathan had managed to get away with all of his hacking endeavors so far, unfortunately, his luck was very soon about to run out. In June of 1999, Jonathan 15 at the time was looking for some new vulnerable servers to tap into when he suddenly found one in Huntsville, Alabama, as he had already done several times in the past, he planted some malware that basically allowed him to take control of the companies in the server systems.

Unfortunately, however, what Jonathan presumably didn't know at the time was that this time he was unintentionally hacking into the National Aeronautics and Space Administration or nersa. And since Nassau obviously has some pretty critical national secrets and technology that they needed to protect, they were monitoring for any potential breaches far more carefully than BellSouth, Telecommunity nations had been. Even despite this, though, Jonathan was still able to hack into the Marshall Space Flight Center and steal what was estimated to be around $1.7 million worth of data.

The information stolen cover the source code of a software that was used to control the temperature and humidity of the International Space Station, as well as specifics on developing and testing new rocket engines and sets. A lot of this data was highly confidential and could lead to potentially catastrophic consequences if it landed in the wrong hands. When NASA's finally noticed the breach, they shut down their systems for 21 days to investigate directly, resulting in more than $41,000 worth of damages.

But while this investigation was ongoing and the FBI was getting closer and closer to pinpointing Jonathan as the hacker responsible for the massive breach, Jonathan himself was fairly oblivious to the sheer gravity of the crime that he had just committed. He had already moved on to his next target, a vulnerable server in Dulles, Virginia. This time he installed a back door onto the server, which allowed him to remotely connect to it.

Once he had gained access, he sold a computer program known as a sniffer which captured the network traffic, picking up information such as log and financials and other sensitive data. The only problem was the server he had picked. This time belonged to a unit of the U.S. Department of Defense, the Defense Threat Reduction Agency in particular, which was responsible for monitoring and responding to any threats that the country faced.

And after Jonathan had downloaded thousands of messages belonging to Pentagon employees and also scraped a couple of military usernames and passwords, since it was the very first time that a subsidiary of the Pentagon had ever been hacked, his breach was immediately noticed and a massive investigation was launched. A couple of weeks later, on January 26th, 2000, at around 6 a.m. in the morning, Jonathan was jolted awake by numerous agents from the Department of Defense armed with guns and bulletproof vests, raiding his home.

They arrested Jonathan and then seized any device he had that could access the Internet, which included four PCs, a laptop and a pocket computer. In court, Jonathan pled guilty to two counts of juvenile delinquency, one for hacking and stealing data from the Department of Defense, and the second for doing the same thing to nothing. If he had been an adult, he would have likely had to serve up to ten years in prison.

However, since Jonathan was only 16 at the time of his arrest and no minor had ever been convicted of a cyber crime before, much less a cyber crime this severe. The judge struggled with coming up with a fair punishment. At first, Jonathan was given six months in prison and probation until he turned 18. But later, the judge then decided to be more lenient and instead gave him just six months of house arrest and a total ban on computers for any reason other than studying.

In addition, he had to write a letter of apology to both the Department of Defense, NASA, as well as work with them to show them exactly how he had managed to gain access into their servers. Although Jonathan did go on to write these letters and did end up working with the two organizations to show them what he had done.

A couple of months later, he was found breaking his house arrest and re-arrested. This time, since his blood sample saw traces of drugs, he was sent to a juvenile detention center for six months in place of his house arrest. For the first time in U.S. history, a minor had been incarcerated for a cyber crime, and Jonathan's story served as an example to other aspiring young hackers all across the country to think twice before breaking the law.

Jonathan himself was incredibly solid and traumatized from this entire experience after he had served his sentence and was finally allowed to return back home. He left the computers that he had previously been so obsessed with, completely untouched and unplugged in his bedroom. He became very depressed and also developed anxiety, worrying that he was now causing only under government surveillance, in his own words, never again.

It's not worth it because all of it was for fun and games and to put him in jail for it. I don't want that to happen again. I could find other stuff for fun over the next few years. Jonathan kept a very low profile, seemingly want to just live nothing more than a normal life. Although he seemed to have left his career as a hacker in the past for good.

He never fully recovered from his depression and his anxiety since his mom passed away from breast cancer soon after his brush with the law when he was just 18. Jonathan had even more reason to feel sad and completely out of control of his life. But although he was probably very much looking forward to calmer and happier times to come, tragedy soon struck for him once again.

In January of 2007, when Jonathan was 23, the massive department store chain TJX was suddenly hacked, with the culprit managing to get away with the personal and credit card information of millions of people. When the FBI launched an investigation, they discovered that there were several people involved in the breach Alberto Gonzalez, Christopher Scott Damon, Patrick Tui and Maximillian Stransky, as well as two other people who hadn't yet been identified and were only known by their initials.

JJ and J.W.. When the FBI dug deeper into these two unknown people, they discovered that the man known as JJ had worked closely with Christopher Scott on a separate office. Max hack back in 2004. As a result, they soon became highly suspicious of Jonathan James, who not only had the initials JJ and had a past of cybercrime, but also just so happened to be friends with Christopher Scott.

The investigators figured that it simply couldn't be a coincidence. So they soon raided Jonathan's house, as well as the homes of his siblings, despite the fact that they didn't find anything incriminating or related at all to the TJX hack. They were still convinced that Jonathan had to have been involved with the hack, and we're determined to bring them to justice.

What the investigators did find Jonathan's home, however, was a legally owned firearm, as was a suicide note that he had written at some point. But although common sense would have dictated that the investigators confiscate the gun and get Jonathan the help that he needed, for some reason, they just decided to leave it in his possession. Less than two weeks later, Jonathan James would be found dead in his home, having taken his life with that very gut.

A new suicide note that was placed next to his body read talk about entrapment. The feds, of course, would see me as a much more appealing target than Chris. If they could tie me to this case, I'd be like Mitnick. Tums turned to them. Now, I honestly, honestly had nothing to do with TJX. Unfortunately, I don't picture the feds carrying all too much.

The feds play dirty. Chris called me the other day. He was in jail and they let him out. That can only mean that he too is trying to pin this on me. So despite the fact that he and Albert are the most destructive, dangerous hackers that the feds have ever caught, they let them off easy because I'm a juicy target that would please the public more than two random apps.

I have no faith in the justice system. Perhaps my actions today and this letter will send a strong message to the public. Either way, I have lost control over the situation and this is my only way to regain control. Remember, it's not whether you win or lose. It's whether I win or lose. So sitting in jail for 2010 or even five years for a crime I didn't commit is not me winning.

I die free incident. You can probably see the screenshots. They took an old suicide note of mine from five or six years ago, but left me with my gun. I have the Beatles for On the Hill in my head. I kept a journal in a safe place, read it with a grain of salt. I usually only wrote when I was depressed and I tried not to incriminate anyone more than for salvation.

My soul is dead, so I will look after the flesh. I am the master of his computer. For me, the gates will open. At first, Johnathan James's dad, Robert James, really believed that JJ was actually his son. However, the name JJ would later be connected to Jim Jones, an alias used by a different cybercriminal named Steven Watt, who is also linked to the rest of the TJX hackers.

Even today, it's still unknown for certain whether Jonathan was really involved in the TJX hacking or not. What is known, though, is that Jonathan was a bright kid with a bright future. What his life tragically ripped away from him by a series of choices and events that simply escalated far beyond his control. May he rest in peace. Take care, guys, and I'll see you all next week.