# 96-11


     "Takedown" Reviewed


     I must confess that I eagerly awaited the publication of
"Takedown:  The Pursuit and Capture of Kevin Mitnick, America's
Most Wanted Computer Outlaw--By the Man Who Did It".  So what if
the title was too long and gave the impression of pretentiousness.
Tsutomu Shimomura and John Markoff had tantalized me with their
book tour promotions.  I had become a Shimomura follower wandering
from one radio station to another in hopes of hearing yet another
mindless interview by an uninformed host.  When Shimomura and
Markoff moved to the television media, the expectation became more
acute, even if the interviewers seemed more inept than their radio
counterparts.

     When Pony Express finally delivered a copy to my favorite
desert bookstore, I threw down my MasterCard with unconcealed
bravado, and boldly informed the Walden employee that she need not
put the book in a bag.  For I was not afraid to let everyone know
that I was a believer in the takedown hysteria.

     Reality arrived as I began to read the work.  Let me announce
with no apology that I am a frustrated English major.  My love was
literature as an undergraduate.  I reached an opinion within a few
chapters that "Takedown ..." is a book in search of an editor.  It
cries out for an editor.  But apparently none was available, or
more likely none dared edit a single word from Shimomura and
Markoff.  I told myself that I was just picky, and needed to
concern myself with the substance of the book.  After all "The New
York Times" had raved about the work, called it "fascinating".  One
of the most popular computer security magazines had commented that
the book was a "who's who" of the computer security field.
"Rolling Stone" had in effect previewed what was to be in the book
in its May 4, 1995 article "The Samurai and the Cyberthief".  So
read on I told myself.

     Page 19 appeared and Shimomura discusses a "$500,000 per year
research grant from the National Security Agency".  NSA has
"dragged" its feet and Shimomura is tired of "being jerked around".
He comments:  "They're (NSA) amazingly inept, just like any
government bureaucracy . . . Everything I'd seen indicated they
were a largely incompetent organization tied up in endless
regulations that could do little good or evil... I don't want to
deal with them..."

     I think to myself this is strong stuff.  Here is man of strong
convictions.  But at page 109, after a brief discussion as to what
funding NSA has given him in the past, Shimomura receives a message
from Becky Bace, "a computer scientist" at the NSA.  Becky, whom
Shimomura writes "sometimes refers to herself as the 'mother of
computer security'", offers to pay his conference expenses and
"throw in an honorarium" if he will speak at the Computer Misuse
and Anomaly Detection (CMAD) Conference at the Sonoma Mission Inn
Spa and Resort.  Shimomura accepts the offer because here is a
"chance to talk about something . . . interesting".  I tell myself
conviction may be overrated.  After all, Shimomura is the Samurai.
But then what type of Samurai is he really?

     On page 41 Shimomura discusses his concern over the loss of
files downloaded from his system by an intruder.  The intruder had
apparently compressed several files into one and named it
"oki.tar.Z".  He explains his concern:

     "Several years earlier I had helped out Mark Lottor by reverse
engineering the software that is built into Oki cellular
telephones.  Normally the programs that control a cellular phone
are hidden in a ROM chip inside the phone . . . We examined the
software carefullly and worked backward from the 1's and 0's
embedded in the chip to the original commands intended by the
software designers.  Reverse engineering software is still
controversial, but recent court rulings have generally held that
such work is a legitimate activity."

     "Reverse engineering" software is probably more than just
"controversial".  Prohibitions on it appear in almost every
software license agreement that most of us take the time to read.
But maybe software vendors don't really mean what they say.

     At another point Shimomura discusses with Bill Cheswick and
Marcus Ranum, two well-known security specialists, the problem of
IP address spoofing.  Later he approaches Tom Longstaff, then a
member of the Computer Emergency Response Team (CERT), and asks:
"What would you do if we released a forged CERT advisory, detailing
the problem and warning about it?" (page 116).  Why does Shimomura
even consider a "forgery"?  Why not just release the information to
the Internet community, as CERT eventually did?

     Shimomura does on many occasions stakeout the moral high
ground.  He rejects as "ridiculous claims" the rationalizations
that breaking into computers systems is defensible if you just
"look" but do not "tamper"; or that cracking can help to "make
systems more secure by revealing vulnerabilities to system
operators".  The "takedown" of Mitnick, though devoid of much
suspense, does reveal an individual totally dedicated to one
pursuit:  the capture of an intruder.

     Fascinating as the pursuit may be, the reader is still left
with many unanswered questions, some significant and some
candidates for trivial pursuit.  Who is the mysterious user "jsz",
allegedly located in Israel? (page 209).  Evidence confirms he
assisted Mitnick, and indeed shared many of the essential "tools"
to facilitate break-ins.  Why does Shimomura feel it necessary on
several occasions to make disparaging comments about his graduate
student, Andrew Gross?  Is the Secret Service and FBI as grossly
inept as the book portrays?  Even if they are, what purpose does it
serve to advance the central focus of the book?  Who is Becky Bace
and why does she think she is the "mother of computer security"?

     Professor David Gelernter, in his "New York Times" review of
the book, draws this conclusion:  "Mr. Shimomura brags constantly
but with a winning cocker-spaniel innocence, and you wind up liking
him despite yourself.  He is an unselfconsciously kooky, brilliant,
fascinating fanatic."  The last sentence ironically may also
describe Kevin Mitnick.

     While "Takedown ..." is not in the same class as Cliff Stoll's
"The Cuckoo's Egg", it is still worth the read.  "Fanatics" can
also checkout two additional books with differing agendas on the
Mitnick case:  (a)  "The Fugitive Game" by Johathan Littman; and
(b)  "The Cyberthief and the Samurai" by Jeff Goodell.  The "New
York Times" review appeared in the Living Arts section, Tuesday,
February 27, 1996.


[Disclaimer:  Information Systems Security Updates represent the
opinions and views of the author (mcdonalc@wsmr.army.mil), not his
employer.  Recipients are free to quote all/parts of the ISSU with
credit/blame to the author.]