IRA WINKLER▊
- ALIAS
- "Modern Day James Bond" — a reputation he reports being given, in his own interview SELF-PUBLISHED
- OPERATION
- President, Information Security Advisors Group · author, Corporate Espionage and Through the Eyes of the Enemy · chief security strategist, Hewlett-Packard (2003) FACT
- HABITAT
- The keynote circuit — Black Hat '99, RSA panels, trade-press quote columns, a ZDTV "Spy Files" byline
- RECORD
- No conviction. No adjudication. No fraud allegation from any named critic. Every charge below is a dispute over self-promotion, not a finding of fraud. FACT
- STATUS
- STILL KEYNOTING — the books sell, the stages book, the attrition file stays open
- DISPOSITION
- Filed on attrition.org's Charlatan List (~1999) — attrition's characterization, contested by a long and paying client list ATTRIBUTED
The specimen, observed since the mid-1990s across ballrooms and quote columns, performs a display so loud that the field has spent twenty-five years arguing about the volume — and only the volume.
Approach this drawer with the labels in order. This is not a forged credential, a guilty plea, or a vanished client. The penetration test at the center of the file happened — commissioned, paid for, written up by the specimen himself in a conference paper the archive still holds. What the field contests is what the specimen built on top of it: the superlatives, the billion-dollar arithmetic, the James Bond plumage, and a press corps that kept printing all of it.
A dispute over volume is the easiest thing to overstate. That is why the archive exists. Every event below carries its receipt. Both sides get the microphone.
the drama timeline
ACT I — THE CRAFT (EARLY 1990s–1997)
Every display begins with a genuine feather or two. Watch this act carefully; the defense will carry it into everything that follows.
-
EARLY 1990s
The government credits, as billed
His conference billing runs: "former advisor to the U.S. Joint Chiefs of Staff, the National Security Agency and National Computer Security Association." The NCSA affiliation is on the byline of his own published paper; the rest is his career as the circuit bills it.
-
MID-1990s
The canonical pen test — in his own words
A large high-technology firm commissions a simulated industrial-espionage attack; Winkler writes it up for a security conference. His paper's result line: "Within one day of the on-site activities, over $1,000,000,000 of information was 'stolen.'" The quotation marks around "stolen" are his. So are the zeros. He would later say people called the paper "the seminal work on social engineering" — his account of others' praise.
Mark the specimen's honesty of method: open-source research, a temp job inside the target, physical access, insider hacking. The test is real, the write-up is real, the client asked for it. Everything the field will fight about is downstream of the zeros.
-
1997–1999
The books ship
Corporate Espionage (ISBN 0-7615-0840-6) makes him the industry's quotable authority on the subject; Through the Eyes of the Enemy follows, billed as a best seller in his 1999 keynote promotion. He writes the "Spy Files" column for ZDTV.
ACT II — THE BILLION-DOLLAR SEASON (1998–2000)
Here the display reaches full span. The specimen does not claim to be good. It claims to be the only one.
-
MAR 1998
"I can steal a billion dollars from any corporation"
To InternetWeek: "I know about 95 percent of [the vulnerabilities] I am going to find at a company before I even get there… I can steal a billion dollars from any [corporation] within a couple of hours." Attrition's marginal note calls the repeated claim "laughable" and argues the attitude "makes for a bad pen-tester."
-
FEB 1999
The PCCIP asterisk
Trident Data Systems promotes his keynote with the advisory-board line; Aleph One checks the PCCIP's own published advisory-committee list and finds no Winkler; Trident updates the release after criticism. The original text survives only because attrition preserved it.
Whether the specimen wrote its own placard or merely stood in front of it, the record does not say. The archive notes only that the placard changed when someone read it closely.
-
~1999
Attrition opens the file
The Charlatan List entry goes up: a career "over an overhyped and mundane penetration test," a "talking-head" who "let those around him do the actual work, bathing in the attention of the media." Attrition's words, sustained for the next decade of updates.
-
MAY 2000
Dream job: the James Bond interview
USA Today's career column runs the full plumage, in his own words: "I got the reputation of being a 'Modern Day James Bond'… I am the only person who has consistently demonstrated the ability to steal billions of dollars within several hours, using advanced human and technical espionage techniques." Also his, in the same interview: "I lucked into my first penetration test and was able to take over a very large bank by just calling them up and asking questions."
Observe the candor inside the boast. "Lucked into," "just calling them up" — the specimen narrates its own trick honestly, then prices it at a billion dollars. The field objects to the price tag, never the phone call.
ACT III — THE HP YEARS (2003)
The specimen takes a corporate perch. Two encounters follow: one on a stage, with a named challenger; one in print, with no name in it at all. Keep the two separate. The record does.
-
APR 2003
Mitnick, to his face
On RSA's "Foxes in the Hen House" panel, Winkler — by then chief security strategist at Hewlett-Packard — warns against hiring ex-hackers. Kevin Mitnick counters from the same stage that Winkler once hired ex-hackers at his own consulting company: "I know them personally. I had traded [break-in secrets] with them." Mitnick's claim, contested territory, adjudicated by no one.
-
MAY 2003
The espionage drama — and the contention
The Register reports that HP's printer labs are under a social-engineering siege from an unnamed competitor — fake HP staffers phoning engineers at work and home for details of a printer code-named Nozomi. The article names no individual and no culprit. Attrition files its contention anyway: given the timing, the background, the media affinity, and Winkler's HP post, it contends he was "directly involved in this article or affair." Attrition's own page opens by conceding the article never names him. No follow-up ever did. No legal action of any kind resulted.
This node is in the file because the file would be dishonest without it — and it is fenced because the fence is the whole point. A contention built on circumstance is the weakest exhibit in any drawer, and the archive labels its exhibits.
-
EPILOGUE
Still keynoting
The books remain in print, the speaking career continues, his site still bills the career (Wayback holds the current copy). The attrition file's last dated entry is 2003; the list itself stopped updating years ago. The archive keeps the tape running.
both sides, on the record
The critics' pattern claim (theirs, not ours): a career built on one commissioned test, retold for decades at escalating volume — "overhyped and mundane," a "talking-head" who "let those around him do the actual work" [1].
The self-published superlatives: "I can steal a billion dollars from any [corporation] within a couple of hours"; "I am the only person who has consistently demonstrated" it. His words, preserved verbatim [3] [4].
The asterisks: a PCCIP advisory credit that his promoter withdrew after a researcher checked it; a hire-no-hackers position that Kevin Mitnick contradicted to his face on an RSA stage [5] [6].
The test happened. Commissioned by the client, at the client's request, written up in a conference paper anyone can still read. Even attrition — his harshest archivist — states he performed it; the dispute is over the hype, not the event [1] [2].
The career is real. Real books — Corporate Espionage, Through the Eyes of the Enemy — a government-advisory billing, a chief-security-strategist post at Hewlett-Packard, and a paper he reports others calling "the seminal work on social engineering" [4] [5] [6] [9]. The billion-dollar line began life as his client-commissioned test's own valuation, in a peer-conference paper, before it became a stage line [2].
Scope of the record: no court, no regulator, and no named critic has alleged fraud, a fabricated engagement, or a crime. The PCCIP line ran in a promoter's press release — authorship never established — and was corrected [5]. The HP espionage article names no individual; the contention that follows is attrition's, built on circumstance by attrition's own admission, and it produced no follow-up, no filing, nothing [7] [8]. The harshest documented charge is self-promotion at industrial volume — which the keynote industry has never once made disqualifying.
YOU DECIDE
Scoped to the claims, never the man. Two specific claims carry asterisks on the public record: "only person who has consistently demonstrated" — a self-superlative no one has verified and no one could — and the PCCIP advisory credit, which his promoter withdrew when a researcher checked the commission's own list. The HP contention remains exactly what its author called it: a contention, resting on circumstance, naming him in no primary source. Nothing here is adjudicated. Nothing here is fraud. The record shows a self-promotional, divisive expert whose one commissioned test was real — and whose account of it grew a zero every time the microphone did.
Weigh the costly signals: he published his method in a conference paper where any critic could grade it, and told an interviewer he "lucked into" his first test. Attrition spent a decade of column inches on him and never once alleged a crime.
The archive does not judge. The archive merely keeps the tape running.
evidence locker
PRIMARY RECORD
Attrition.org — Ira Winkler charlatan dossier (index) ATTRIBUTED — the listing exists (fact); its characterizations are attrition's, including its concession that the test was performed.
attrition.org/errata/charlatan/ira_winkler/
PRESS & CRITICS — AS PRESERVED IN ATTRITION'S FILE
SUBJECT'S OWN CHANNELS — THE SPECIMEN, UNEDITED
The standard. Everything above is sourced to the attrition.org archive, the subject's own published paper and interviews as preserved there, and a Wayback-archived news article. Facts are stated as facts; characterizations are stated as characterizations and wear their author — "overhyped and mundane" belongs to attrition, the hiring counter-claim to Mitnick, the billion-dollar arithmetic to Winkler himself. Every charge on this page is a self-promotion dispute; none is a fraud finding, and the page says so. The one contention built on circumstance is labeled a contention, with its limits in the same breath. The defense is presented at full strength, including what the record does not show. No motive is asserted, no private character diagnosed. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.