MITNICK vs SHIMOMURA▊
On Christmas Day 1994 someone spoofed their way into the home computers of a Caltech-trained physicist who happened to be one of the best security researchers alive — and copied his files. The physicist took it personally, teamed up with a New York Times reporter, and spent two months chasing the intruder across the phone network with a cellular-frequency antenna until the FBI knocked on an apartment door in Raleigh. The hacker was Kevin Mitnick, already the most-hunted name in the country. The physicist was Tsutomu Shimomura, who then co-wrote the book, sold it to Hollywood, and titled it, without blinking, — By the Man Who Did It. Mitnick spent the rest of his life insisting the supervillain in that book was a character the press and the prosecutors invented.
The Pursuit and Capture of Kevin Mitnick, America's Most Wanted Computer Outlaw — By the Man Who Did It.
Tsutomu Shimomura & John Markoff, the subtitle of Takedown (Hyperion, 1996) — the credit and the menace claimed in a single breath, on the cover
… largely fictitious … without reason, justification, or proof.
Kevin Mitnick, sworn written testimony to the U.S. Senate (Mar 2, 2000), on the front-page reporting that made him "the world's most wanted" — the myth he spent the rest of his life disputing (see Kevin Mitnick)
- WHO
- Kevin Mitnick ("Condor"), fugitive hacker and social engineer, versus Tsutomu Shimomura, Caltech-trained computational physicist and senior fellow at the San Diego Supercomputer Center whose home systems were breached FACT
- THE DRAMA
- An insulted victim turns manhunter; a reporter rides shotgun and files the front pages; a fugitive is tracked by radio to an apartment — then a book, a movie, and a decades-long fight over how much of the "menace" was ever real
- RECORD
- Dec 25, 1994: an IP-spoofing / TCP-sequence-prediction attack — the first real-world use of a technique theorized in 1989 — opens Shimomura's server. Feb 15, 1995: Mitnick arrested in Raleigh, NC. 1999: pleads guilty to wire and computer fraud FACT
- STATUS
- DISPUTED — the intrusion, the hunt, and the arrest are matters of record; the "how dangerous was he, and who inflated it" fight never ended. Mitnick died July 16, 2023
This file is not a verdict on who was the better hacker — a question the scene has argued for thirty years and will argue for thirty more. It is a record of the moment the underground's oldest folk tale (the outlaw versus the lawman) got a real cast: a genuinely gifted trespasser, a genuinely brilliant victim who refused to stay a victim, and a reporter who turned the chase into a bestseller. The through-line is the gap between the myth — the digital supervillain who could crash anything — and the paperwork: an IP-spoofing recipe out of a 1989 research paper, a stack of cloned phone codes, and a conspiracy plea. Both men are quoted here at full strength.
the drama timeline
ACT I — THE FUGITIVE AND THE PHYSICIST (1992–1994)
One man is running from a supervised-release violation and a growing legend. The other is quietly one of the best security people on the planet, and has no idea he is about to become famous.
-
1992–94
Mitnick goes to ground
After a 1988 conviction and, later, a violation of the terms of his supervised release, Kevin Mitnick becomes a fugitive, living under assumed names and financing himself with cloned cellular phones. By July 1994 he is on the front page of the New York Times as "Cyberspace's Most Wanted" — a story he would later call, under oath, "largely fictitious." The manhunt is already a myth in search of an ending.
-
to 1994
Shimomura, the man they picked the wrong fight with
Tsutomu Shimomura — a computational physicist who had studied under Nobel laureate Richard Feynman at Caltech, worked at Los Alamos, and by 1989 was a senior fellow at the San Diego Supercomputer Center — is a serious security researcher who has testified to Congress on cellular-phone insecurity. Of all the machines on the Internet to break into on Christmas, an intruder chose his.
ACT II — CHRISTMAS DAY (DEC 25, 1994)
A textbook attack out of a five-year-old research paper, run for real for the first time, against exactly the wrong target.
-
DEC 25, 1994
The spoof
An intruder breaks into Shimomura's home computers in the San Diego area using source-address (IP) spoofing combined with TCP sequence-number prediction — impersonating a trusted machine to gain root, then copying tens of thousands of files, including security tools. The technique had been described by Steve Bellovin in a 1989 Bell Labs paper but never seen in the wild; this is widely cited as its first real-world use. The attack is attributed to Mitnick, who would later plead guilty to the broader fraud case built partly on it.
-
DEC 27, 1994
The taunts — and who did NOT leave them
Taunting messages — "my technique is the best," "my kung fu is superior" — land on Shimomura's voice mail, and, by the accounts, harden his resolve to run the investigation himself rather than leave it to the feds. One detail the movie posters skip: those voicemails were later reported to have been left by an unrelated third party, not Mitnick, and some arrived after the arrest. The insult that supposedly launched the manhunt may not have come from the man it caught.
ACT III — THE HUNT (JAN–FEB 1995)
The victim becomes the hunter. A reporter becomes the chronicler. And a stolen phone signal becomes a dotted line pointing straight at an apartment door.
-
JAN 1995
Shimomura enlists — and so does the Times
Shimomura joins the pursuit and works alongside the FBI. New York Times reporter John Markoff — who had already made Mitnick a household name — covers the chase and would co-author the book that came out of it, a dual role that critics would later hammer. The hunt has, from the start, a narrator with a stake in the story.
-
FEB 1995
Following the signal to Raleigh
The trail runs through the phone system: suspicious Netcom dial-ins traced through a GTE switching office to a Sprint cellular switch in Raleigh, North Carolina, then narrowed to the Players Court apartments near the Raleigh-Durham airport. The final step is pure radio work — a cellular-frequency direction-finding antenna, with Shimomura on hand, walked toward the strongest signal until it pointed at a single apartment.
-
FEB 15, 1995
The knock
The FBI arrests Kevin Mitnick at his Raleigh apartment. Agents recover cloned cellular phones, more than 100 cloned cellular phone codes, and multiple pieces of false identification. The most-wanted manhunt in the history of the medium ends, as they usually do, with a man opening a door.
ACT IV — TAKEDOWN, THE FRANCHISE (1996–2000)
The winner writes the book. The book becomes a movie. And almost nobody involved will vouch for the version before their own.
-
1996
"Takedown" — by the man who did it
Shimomura and Markoff publish Takedown (Hyperion), the pursuit told from the hunter's chair, subtitled "… By the Man Who Did It." It is a bestseller and a Hollywood option. It is also the moment the rivalry stops being a case and becomes a franchise — with one side holding the pen.
-
1996
The rival account
Journalist Jonathan Littman publishes The Fugitive Game, a competing account, and accuses Markoff of "journalistic impropriety and of over-hyping Mitnick's actual crimes." Critics maintain the coverage "exaggerated or even invented Mitnick's activities and successes." Markoff stood by his reporting. The scene now has two books and no agreed-upon facts.
-
2000
The movie its own source disowned
The film adaptation ships (Takedown, released in the U.S. as Track Down), direct-to-video. Markoff himself, to the San Francisco Chronicle: "I thought it was a fundamentally dishonest movie." Mitnick sues and settles with distributor Miramax for an undisclosed sum. The myth is now on its third medium, and no one will vouch for the last one.
ACT V — THE REBUTTAL (1999–2023)
The hacker gets out, gets a microphone, and spends the rest of his life editing the character someone else wrote for him.
-
MAR 1999
The plea — and the damages fight
Mitnick pleads guilty to wire fraud, computer fraud, and intercepting communications. The government had floated damages in the hundreds of millions; Mitnick's side notes that the allegedly victimized companies never reported losses on that scale to their shareholders, as securities law would require, and that he never sold what he took. The gap between the charged menace and the demonstrable loss becomes the defense's whole case.
-
2000
Under oath, against the legend
Six weeks out of prison, Mitnick testifies to the Senate that the front-page reporting was "largely fictitious" and had branded him the world's most wanted "without reason, justification, or proof." He was, on his own account, a social engineer and phone phreak — a talker and a trespasser — not the digital supervillain who could, as one accepted courtroom claim had it, start a war by whistling into a phone.
-
2011
Ghost in the Wires — his turn with the pen
Mitnick publishes Ghost in the Wires, the pursuit and the capture told at last from the fugitive's chair — the direct answer to Takedown. He does not deny the skill or the trespass; he denies the scale, the sensationalism, and the idea that he was a threat to national security. Fifteen years after Shimomura's subtitle, the other man in the story finally got to caption the picture.
-
JUL 16, 2023
The story outlives its subject
Kevin Mitnick dies of pancreatic cancer in Las Vegas at 59, a working security consultant and "the World's Most Famous Hacker" by his own company's branding. The obituaries lead, inevitably, with the manhunt and with Shimomura. The legend Mitnick spent two decades correcting is the one that ran in his death notices. Shimomura, characteristically, said nothing.
both sides, on the record
The intrusion was real and it was his case: someone ran a live IP-spoofing / TCP-sequence-prediction attack against Shimomura's machines on Christmas Day 1994, copied his files, and the fraud case built on it ended in a guilty plea. Shimomura did not invent the break-in; he was the one whose computer got opened [3] [1].
The hunter did the work: the trace through Netcom, GTE, and the Sprint cellular switch to a Raleigh apartment, finished with a direction-finding antenna, is documented and it worked. "By the man who did it" is a boast, but it is not a false one — Shimomura's contribution to the capture is on the record [4] [1].
The menace was inflated: Mitnick swore the reporting was "largely fictitious," Littman charged Markoff with "over-hyping Mitnick's actual crimes," and the hundreds-of-millions damages figure was never matched by any loss the victim companies reported to their shareholders. He was a social engineer and phreak, not the world-ending hacker of the posters [5] [2] [1].
The narrator had a book deal: the reporter who made Mitnick famous, John Markoff, then co-wrote the bestselling account of his capture with the victim — and later called the movie it spawned "a fundamentally dishonest movie." A chase covered by someone selling the chase is not a neutral record [2] [6].
Even the insult may be fiction: the taunting voicemails that supposedly made it "personal" were later reported to have been left by an unrelated third party, with some arriving after the arrest. The spark of the legend was, quite possibly, not Mitnick at all [7].
YOU DECIDE
The break-in happened, the hunt happened, and the man they caught pleaded guilty — strip all the myth away and Shimomura still traced a real intruder to a real door. But the "digital supervillain" who justified a national manhunt, a bestseller, and a movie was, by the sworn word of the man it was built on and the reporting of at least one rival journalist, considerably larger than the trespasser the court actually sentenced. Two brilliant men, one real intrusion, and a story that everyone downstream had a reason to make bigger than it was.
The archive does not pick a hunter or a ghost. It keeps the packet trace — and the sworn testimony that says the monster was mostly ink.
evidence locker
PRIMARY / COURT & SWORN RECORD
Wikipedia — Kevin Mitnick FACT — sourced biography: the fugitive years, the Feb 15, 1995 Raleigh arrest and the cloned-phone/false-ID recovery, the cellular direction-finding, the 1999 plea, the disputed damages, and his 2023 death.
en.wikipedia.org/wiki/Kevin_Mitnick
THE ATTACK, TECHNICAL
THE HUNT, THE BOOK, THE MOVIE
crime-research.org — "Shimomura vs. Mitnick: The Computer Crime of the Year?" ATTRIBUTED — contemporaneous account of the intrusion, the Netcom/GTE/Sprint trace, the cellular direction-finding to the Players Court apartment, and the arrest.
crime-research.org/library/cybercrime2.html Wikipedia — Takedown (Shimomura & Markoff, 1996) ATTRIBUTED — the book, its subtitle, the film, Littman's "journalistic impropriety / over-hyping" charge, Markoff's defense, "fundamentally dishonest movie," and the Miramax settlement.
en.wikipedia.org/wiki/Takedown:_The_Pursuit_and_Capture… Wikipedia — Track Down (the 2000 film) / John Markoff ATTRIBUTED — the film adaptation and Markoff's dual role as reporter and co-author.
en.wikipedia.org/wiki/Track_Down
CONTEXT & CORRECTION
Wikipedia — Tsutomu Shimomura FACT — Shimomura's background (Feynman, Los Alamos, San Diego Supercomputer Center), his role in the pursuit, and the Takedown authorship.
en.wikipedia.org/wiki/Tsutomu_Shimomura
The standard. Both principals are public figures; the intrusion, the trace, the arrest, and the 1999 plea are matters of public record and stated as fact. The attack is attributed to Mitnick as the government's case and his own plea support; the technique is documented in the security literature. Two beats are held to strict attribution: the taunting voicemails are given only as their sourcing supports — reported to have been left by an unrelated third party, never by Mitnick — and the "who exaggerated what" dispute is presented at full strength on both sides, with Markoff's reporting stated as his (he defended it) and Mitnick's and Littman's rebuttals stated as theirs. No motive is assigned to any named person; nothing beyond the record is asserted. If a line here couldn't survive scrutiny, it wouldn't be on the page.