Computers: The Great Satellite Caper

The odd mix was not unique to the suspect bulletin boards. Explains Donn Parker, a computer-crime expert at SRI International in Menlo Park, Calif.: "Hacking is a meritocracy. You rise in the culture depending on the information you can supply to other hackers. It's like trading bubble gum cards."

Some of the information posted by the New Jersey hackers may have been gleaned by cracking supposedly secure systems. Other data, like the access numbers of remote computers, were probably gathered automatically by so-called demon dialers, programs that search the phone system for on-line computers by dialing, in sequence, every phone number within an area code. "In some cases penetrating computer systems is extremely difficult and takes a great deal of skill and knowledge," says Parker. "In others it's as simple as dialing into a bulletin board and finding the passwords that other kids have left." And sometimes it is even simpler than that. Two of the New Jersey youths admitted that at least one of the credit card numbers they used had come not from a computer but from a slip of carbon paper retrieved from a trash can.

No matter how mundane, the actions of the New Jersey hackers have again focused national attention on a real and growing problem: how to safeguard the information that is stored inside computers. Americans now carry more than 600 million credit and charge cards, many of them allowing at least partial access to a computerized banking system that moves more than $400 billion every day. Corporate data banks hold consumer records and business plans worth untold billions more.

Alerted to the threat by earlier break-ins, corporations and government agencies have been moving to shore up their systems. Many have issued multiple layers of password protection, imposing strict discipline on the secrecy of passwords and requiring users to change theirs frequently. Others have installed scrambling devices that encode sensitive data before they are sent over the wires. Audit trails make crime detection easier by keeping a permanent record of who did what within a system. Dial-back services help keep out unauthorized users by recording each caller's ID number, disconnecting the call and then redialing only that telephone number authorized by the holder of the ID.

All told, U.S. business spent $600 million last year on security equipment and software. By 1993, according to Datapro Research, security expenditures could exceed $2 billion annually. In addition to the cost, these measures tend to make the systems harder to use, or less "friendly," in the jargon of the trade. But computer operators who like to keep their systems casual may be courting trouble. Says SRI's Parker: "These are such reasonable, cost-effective steps that managers who don't use them pretty much deserve what they get." --By Philip Elmer-DeWitt. Reported by Marcia Gauger/New York and Stephen Koepp/Los Angeles