An invitation-only bulletin board in suburban Melbourne, a homemade network scanner, and three teenagers who talked their way into NASA, a nuclear-weapons lab, and the source code of a telecom giant — then phoned a New York Times reporter to brag about it. What they didn't know was that the Australian Federal Police were sitting in a Canberra office 650km away, running the world's first remote datatap on a hacker, transcribing every keystroke. When the doors came in on 2 April 1990, it became Australia's first major computer-crime prosecution, the first conviction anywhere built on tapped data — and, courtesy of a researcher then hacking under the handle Mendax, the spine of the book that defined the whole scene.
It used to be the security guys chase the hackers. Now it's the hackers chase the security people.
"Phoenix" (Nahshon Even-Chaim), phoning New York Times reporter John Markoff to taunt the security establishment — published March 21, 1990, two weeks before the AFP came through his door
WHO
The Realm — a Melbourne BBS crew founded by the hacker known as Force; its convicted members were Phoenix (Nahshon Even-Chaim), Electron (Richard Jones), and Nom (David John Woodcock) FACT
SCENE
X.25 packet networks, VMS and Prime minicomputers, and a private Melbourne board, c. 1987–1990 (see the scene timeline and Crew Rivalries)
THE ROAM
The Zardoz security mailing list, the coveted Deszip password cracker, NorTel's network and source code, plus NASA, Lawrence Livermore, UC Berkeley, Purdue, and Australia's CSIRO
RECORD
Operation Dabble (AFP, from 1988): the first prosecution under Australia's June 1989 federal computer-crime law, and the first conviction anywhere obtained from a remote datatap. Arrests 2 April 1990; guilty pleas and suspended sentences 1993 FACT
STATUS
CONVICTED · IMMORTALISED — the saga became Underground (1997), researched by Julian Assange, and the 2003 documentary In the Realm of the Hackers
This file is not an argument that the roam was harmless — the intrusions were real, the crew pleaded to them, and a judge went out of his way to call the whole thing arrogant. It is a record of a specific first: the moment a national police force stopped chasing hackers through logs after the fact and started listening to them live, keystroke by keystroke, from another city. The through-line is the gap between the myth the boys built on the phone — untouchable, transnational, laughing at the security guys — and the paperwork, which shows three young men in a Melbourne courtroom, a datatap warrant, and a book deal for the one who got away.
the drama timeline
ACT I — THE BOARD AND THE SCANNER (c. 1987–1988)
A private Melbourne bulletin board, a hoarded network-mapping tool, and a rule that made the crew powerful: you can't have it unless you're one of us.
c. 1987
Force builds The Realm
The hacker known as Force founds The Realm, an invitation-only Melbourne board, and tries "to assemble a diverse group of Australia's best hackers, each with a different area of expertise." Its prized asset is DEFCON, Force's own scanner for mapping X.25 packet networks, written for Prime computers — and he refuses to hand it to anyone outside the crew, "which is one thing that made it such a powerful group." Force also publishes Globetrotter, "Australia's first underground hacking journal."
The roster that would end up in court forms around the board: Phoenix (Nahshon Even-Chaim, b. May 1971), "one of the most highly skilled members of The Realm"; Electron (Richard Jones, b. June 1969), who "visited The Realm regularly for a few months in 1988"; and Nom (David John Woodcock). Information in the underground was hoarded — by manufacturers, universities, sysadmins — and a crew was how a teenager with a 300-baud modem got past that wall.
Two trophies above all others — a mailing list and a password cracker — and a roam that ran from a Melbourne bedroom into a nuclear-weapons lab.
1988–89
Zardoz and Deszip — the crown jewels
Two prizes "glittered side by side as the most coveted" in the underground. Zardoz was a restricted, invitation-only security mailing list — formally the Security Digest, "everyone in the underground simply called it Zardoz, after the computer from which the mailouts originated" — because it detailed the very holes admins hadn't yet patched. Deszip was a password-cracking program that "could crack encrypted passwords up to 25 times faster." Both were heavily guarded; getting them was the whole game.
The ambition scaled up. NorTel — the telecom equipment maker with "sales of $8 billion" — ran a worldwide corporate network, and the thought of reaching "NorTel's original source code" was irresistible: "A hacker with access could insert his" own code across "the worldwide NorTel network." This is the roam graduating from trophy-hunting to the kind of access that made prosecutors' blood run cold.
Phoenix phoned New York Times reporter John Markoff to boast — "to break in to the computer security experts' systems as a challenge." Among the targets: Clifford Stoll (author of The Cuckoo's Egg) and Purdue's Eugene Spafford. An intruder altered a welcome message on a machine Stoll managed to read: "Have Cliff read his mail. The cuckoo has egg on his face." Stoll's verdict: "It's sad that people have these gunslinger ethics." Spafford's: "He got access for about 30 seconds and then we pulled the plug."
While the crew laughed on the phone, the AFP built something no police force had built before: a live tap on a hacker, run from another city.
1988–89
The AFP opens a file
The AFP's Southern Region Computer Crimes Unit, under Detective Sergeant Ken Day, worked the crew through informants and undercover contact from late 1988. The timing mattered: Australia's federal computer-crime provisions — the Crimes Legislation Amendment Act — came into force in June 1989, finally giving the Commonwealth a statute to charge under. Day would later publish his own account of the case in the AFP journal Platypus, under the title "Hackers tap in to justice."
A telephone-intercept warrant on Phoenix's lines commenced in late January 1990; days later, "the first time the AFP had done a datatap," officers began recording his data transmissions from the Telecommunications Intelligence Branch in Canberra — 650km from Melbourne — in shifts, "twenty-four hours a day, seven days a week," playing the captured traffic back through their own modem to build a court-ready text file. Phoenix, warned by his Texas friend Erik Bloodaxe that his phone was surely tapped, just laughed: "What are they going to do? Come and get me?"
In simultaneous Melbourne raids, the AFP arrested all three: Phoenix at his Caulfield North home, Electron, and Nom. It was the first prosecution of hackers under Australia's federal computer-crime legislation, and "the first time in the world police had gained a conviction using evidence obtained by the remote tapping of a computer." Phoenix was initially charged with 48 offences; Electron faced charges over intrusions into US defense and government systems and the theft of Zardoz.
Three years later, in the Victorian County Court, a judge weighed deterrence against three young lives and blinked — but not before the harshest words landed on the loudest of them.
JUN 3, 1993
Electron — suspended
Electron pleaded guilty to 14 offences. Judge Anthony Smith found "a custodial sentence is appropriate" on the three most serious counts — the "knowingly concerned" charges with Phoenix, involving NASA, Lawrence Livermore, and CSIRO — then suspended it: six months, released on a $500 recognisance, plus 300 hours of community service and psychiatric treatment. Smith described Electron as addicted to his computer "in much the same way as an alcoholic becomes addicted to the bottle." Electron later "worked off his 300 hours… by painting walls."
Phoenix pleaded guilty to 15 charges; he and Nom were sentenced side by side. The court heard a tape of Phoenix phoning CERT's Edward DeHart to brag — walking him step by step through a security bug that, ironically, Electron had discovered. Judge Smith saved his harshest words for Phoenix: "There is nothing… to admire about your conduct… a display of arrogance… open defiance, and an intention to… beat the system." Then he too suspended it: 500 hours community service and a $1000 bond for Phoenix; 200 hours and a $500 bond for Nom.
As Phoenix left the dock, a skinny stranger with long hair loped up the aisle. "I'm Mendax," he said. "I'm about to go through what you did, but worse." He would go on to write the book with the woman who made the crew immortal.
1997
The book that defined the scene
Suelette Dreyfus published Underground: Tales of Hacking, Madness and Obsession on the Electronic Frontier, researched by Julian Assange — the same "Mendax" who introduced himself to Phoenix in the courthouse. The Realm's saga — Zardoz, the datatap, the sentences — is its spine. In 2001 Dreyfus released the full electronic edition free; demand crashed the server, and it drew 400,000 downloads within two years.
Kevin Anderson's documentary In the Realm of the Hackers (Film Australia) told the Phoenix-and-Electron story on screen, drawing directly on Dreyfus's book — the point at which a private Melbourne board became national folklore.
In the Realm of the Hackers (dir. Kevin Anderson; Film Australia, 2003) — the full documentary on Phoenix, Electron, and The Realm, cut with the participants' own accounts. Archival upload; oEmbed-verified.
The intrusions were real: The Realm's members broke into systems they had no right to touch — NASA, Lawrence Livermore, universities, CSIRO, corporate networks — and stole guarded security tools. All three convicted members pleaded guilty; Phoenix to 15 charges, Electron to 14. A court accepted the pleas, and the sentencing judge found the conduct serious enough to warrant custodial terms before suspending them. The romance of the scene does not un-break the systems.
The arrogance is on tape: Phoenix phoned a Times reporter to boast mid-roam and walked a CERT engineer through a live security bug to show off. The judge's characterisation — "arrogance… open defiance, and an intention to… beat the system" — was not invented; it was drawn from the crew's own recorded words.
The damage was slight, the point was ego: the sysadmins whose systems were entered reported wasted time, not destruction — Spafford "pulled the plug" in 30 seconds. This was trophy-hunting and one-upmanship, not sabotage, and the sentences reflected it: not one member spent a day in prison. Community service and good-behaviour bonds, for a case the DPP had wanted to make an example of.
They were kids, and the law was brand new: the defendants were young men, hacking a subculture built on hoarded information they couldn't get any other way, charged under a statute barely a year old. Electron was described in court as addicted "in much the same way as an alcoholic becomes addicted to the bottle," and the judge weighed that seriously enough to suspend the jail term.
The real "first" was the state's: the landmark here is not the crime but the surveillance — the first remote datatap on a hacker, run 650km away, later held up as a template. The Realm's lasting legacy is a police capability and a book, not a body count [1].
YOU DECIDE
The roam was real and they pleaded to it — NASA, a weapons lab, a telecom's source code, all reached from a Melbourne bedroom on a 300-baud modem. But strip away the "cyber menace" framing and you are left with three gifted young men chasing trophies for status, a judge who decided prison would serve no one, and a police force that had just proved it could listen to a hacker in real time from the other side of the country. The Realm's crime made headlines for a season. The datatap that caught them, and the book that eulogised them, outlived the sentence by decades.
The archive does not deify the crew. It keeps the warrant — and the courthouse handshake where the next legend introduced himself as Mendax.
evidence locker
PRIMARY / COURT & SCENE RECORD
Suelette Dreyfus, Underground (1997), researched by Julian Assange — full textFACT — the crew's founding, DEFCON and Globetrotter, Zardoz and Deszip, the NorTel roam, the first AFP datatap ("come and get me"), and the verbatim 1993 sentencing remarks of Judge Anthony Smith. Dreyfus released the electronic edition free in 2001.
gutenberg.org/cache/epub/4686/pg4686.txt
Det. Sgt. Ken Day, "Hackers tap in to justice" — AFP Platypus Journal (1994)FACT — the case officer's own published account of Operation Dabble, the intercepts, and the arrests. (Live host bot-blocks automated fetches; archived copy is available via the Wayback Machine.)
classic.austlii.edu.au/au/journals/AUFPPlatypus/1994/48.pdf
John Markoff, "Caller Says He Broke Computers' Barriers to Taunt the Experts" — New York Times, Mar 21, 1990ATTRIBUTED — Phoenix's pre-arrest boasts, the Stoll/Spafford intrusions, and the "cuckoo has egg on his face" taunt. Verified against the archived full text.
nytimes.com — Markoff (Mar 21 1990, via Wayback)
REFERENCE & CONTEXT
Wikipedia — Nahshon Even-Chaim (Phoenix)ATTRIBUTED — dated record: the June 1989 legislation, the Jan–Feb 1990 intercepts, the 2 April 1990 arrest, 48 charges reduced to a 15-charge plea, and the 6 October 1993 sentence (500 hours, suspended term).
en.wikipedia.org/wiki/Nahshon_Even-Chaim
Wikipedia — Electron (Richard Jones)ATTRIBUTED — the 14-charge plea, the June 1993 suspended six-month sentence and 300 hours, and the friendship with Julian Assange.
en.wikipedia.org/wiki/Electron_(computer_hacker)
Wikipedia — Underground (Dreyfus book) & In the Realm of the HackersATTRIBUTED — the 1997 book, Assange's research role, the 2001 free release and download figures, and the 2003 documentary.
en.wikipedia.org/wiki/Underground_(Dreyfus_book)
troll.fan — LOD vs MOD / Crew Rivalries / TimelineCROSS-LINK — The Realm in the wider crew-era context: the American feuds, the scene's rivalries, and the crackdown chronology.
troll.fan/dossiers/lod-vs-mod.html
The standard. The Realm's three convicted members — Nahshon Even-Chaim, Richard Jones, and David John Woodcock — were named defendants in open court, in contemporaneous press, in the case officer's own published account, and in a book whose subjects cooperated; their real names, charges, pleas, and sentences are matters of public record and stated as fact. The taunts and boasts are quoted from the archived New York Times and from Underground, attributed to their speakers. The founder is given by handle only. No motive or private character is asserted beyond the record, and the exculpatory facts — slight damage, youth, a brand-new statute, and no custodial time served — are given at full strength. If a line here couldn't survive scrutiny, it wouldn't be on the page.