Forty years of the scene eating its own. The tools change — blue boxes, root shells, zero-days, transparency reports — and the grievance never does: the industry sells what the underground did for free, and cooperating with the law is death. This is the through-line every case file on this site is one slice of. Each entry links to its dossier.
John Draper — "Captain Crunch" — finds a toy whistle from a cereal box blows the exact tone that seizes AT&T's long-distance trunks. Free calls for anyone with a whistle and a grudge. The scene is born hostile to the phone company; it never stops being hostile to the incumbent.
A teenage Kevin Poulsen starts working Southern California's phone switches — the apprenticeship that ends, nine years later, with him rigging a radio station's lines to win a Porsche.
A movie about a kid nearly starting World War III by modem, and a Milwaukee crew (the 414s) breaking into Los Alamos, arrive the same year. Congress panics; the moral panic that shadows every event below is now switched on.
Legion of Doom (LOD) forms as the elite of the American BBS underground; the same year, in a Lubbock slaughterhouse, the Cult of the Dead Cow is founded. One becomes the scene's aristocracy, the other its longest-running media stunt.
Hours after his arrest, LOD's The Mentor (Loyd Blankenship) publishes "The Conscience of a Hacker" in Phrack — "This is our world now... the world of the electron and the switch." It becomes the most-quoted text in the culture — and the reason the Secret Service will later treat his GURPS Cyberpunk sourcebook as "a manual for computer crime."
A Cornell grad student's self-replicating program crashes a chunk of the early internet by accident — and becomes the first felony conviction under the Computer Fraud and Abuse Act. The law's opening move against a hacker, and the reason CERT exists.
West German hackers in the Chaos Computer Club orbit break into US military and research systems and sell the access to the Soviet KGB — traced by Clifford Stoll's "Cuckoo's Egg." One of them, Karl Koch, is found burned to death in 1989. The scene's darkest chapter.
After a falling-out with LOD, New York's Phiber Optik (Mark Abene) is pushed out and starts Masters of Deception. The name is the insult — "M" is one letter up from "L." The rivalry that gets mythologized as a "war" begins.
AT&T's long-distance network collapses — from its own flawed software update. The Secret Service raids Phiber Optik anyway and accuses him of causing it. The dragnet is codified as Operation Sundevil.
Phrack's Knight Lightning (Craig Neidorf) publishes a leaked BellSouth 911 document; the government prosecutes him for it. The case collapses when the "proprietary" doc turns out to be sold publicly for $13. The scene's founding free-press fight.
The Secret Service's nationwide dragnet — and the separate raid on Steve Jackson Games, a tabletop-game company, over The Mentor's cyberpunk sourcebook. The overreach is so total it founds the Electronic Frontier Foundation (Kapor, Barlow, Gilmore): "they have provided us with a devil." SJG later wins in court.
The same crackdown reflex reaches Melbourne: Operation Dabble takes down The Realm — Phoenix, Electron, Nom — in Australia's first big hacking prosecution, later immortalized in Dreyfus and Assange's "Underground." The panic that swept the US had gone global.
Phalcon/Skism launch 40Hex, the virus-writing scene's zine, and feud with rival crew NuKE — then turn on the kids using their own code generators. The first "everyone who isn't us is lame" purity panic, a decade before anyone said "script kiddie."
Five MOD members are indicted in the first U.S. hacker prosecution built on court-authorized wiretaps. Phiber Optik pleads guilty and does a year — the scene's first celebrity prison term.
Kevin Poulsen is convicted on 19 counts (a then-record hacker sentence). The same year the Mitnick manhunt goes into its media-mythologized final act. Two of the scene's biggest names, made into monsters by the same press cycle.
A prank-call zine turns "cross a PLA member and get buried" into an art form — pizza-bombing, fake classified ads, the works. Proof the scene's oldest weapon was never the exploit; it was a telephone and a sense of humor.
An 18-year-old Jeff Moss throws a going-away party for a friend's BBS network. It becomes the largest hacker convention in the world — and, three decades on, an institution with a code of conduct and a ban list.
On Christmas Day 1994 an IP-spoof attack copies the files of security researcher Tsutomu Shimomura, who takes it personally, teams up with a New York Times reporter, and traces the intruder — Kevin Mitnick — to a Raleigh apartment in two months. The book and the movie follow. So does a decade-long fight over who exaggerated what: Mitnick tells the Senate the reporting was "largely fictitious." The scene's first true-crime franchise.
Phiber Optik walks out of federal prison to a party in his honor at Irving Plaza and a Time magazine byline calling him "the Robin Hood of cyberspace." The scapegoat is now a legend; the template — hacker, defendant, prisoner, celebrity — is set.
The Cult of the Dead Cow releases a Windows remote-admin tool built to humiliate Microsoft's security, as a full stage show. The scene's fights are now public performances — the model ZF0 and the con's own ban list will inherit.
The L0pht — Mudge (Peiter Zatko) among them — testifies to Congress that they could take down the internet in 30 minutes. The underground goes to Washington; the pipeline from crew to contractor opens.
A teenage crew called milw0rm breaks into India's Bhabha Atomic Research Centre days after the Pokhran-II tests, plants a mushroom cloud and a message — "If a nuclear war does start, you will be the first to scream." Hacktivism with the stakes turned up to the apocalyptic; a sibling to the overreach the scene will disown in Legions of the Underground months later.
Legions of the Underground declares "cyberwar" on Iraq and China — and the rest of the underground turns on it. cDc, the Chaos Computer Club, 2600, Phrack, and the L0pht co-sign a joint statement opposing "any attempt to use the power of hacking to threaten or destroy the information infrastructure of any country, for any reason." LoU backs down within days. The scene polices its own overreach.
Global Hell (gH) defaces whitehouse.gov and the U.S. Army — "Global Hell is alive. Global Hell will not die." The government answers with raids and makes federal examples of MostHateD and Mindphasr for a few thousand dollars of actual damage. The template for every crackdown-on-a-defacement-crew that follows — straight through to LulzSec twelve years later.
Mitnick emerges from prison and testifies to the Senate while still barred from a computer. The L0pht is absorbed into @Stake. The antisec bloc will spend the next decade calling this exact move — underground talent taking federal and corporate paychecks — the original sin.
Russian programmer Dmitry Sklyarov shows Adobe's eBook crypto is trivially broken, and the FBI arrests him under the DMCA as he tries to fly home — the first criminal prosecution of the Act's anti-circumvention clause. Security research is now a crime you can be jailed for at a con.
The antisecurity movement goes to war on the security industry: zines that root famous whitehats and publish the logs, a "sellout = Fed enabler" thesis aimed at @Stake/L0pht, and a raid that hijacks the #phrack channel and forges a Phrack issue. "NO MERCY FOR WHITEHATS."
Michael Lynn quits ISS to give a Black Hat talk on a Cisco IOS remote-code-execution flaw. Cisco's and ISS's lawyers have the printed pages physically ripped out of the conference proceedings, win a restraining order, and bring in the FBI. The clearest snapshot of the disclosure debate: lawyers deciding what a researcher is allowed to say.
A Dateline NBC producer enters DEF CON with a hidden camera to catch attendees confessing to crimes. Staff flip "Spot the Fed" into "Spot the Undercover Reporter," name her from the stage, and she flees the building with a crowd behind her. There is video.
A parody-corporate trolling "association" runs media pranks as a product line — the CNN and MacRumors hoaxes, the Sandy Loot Crew, and weev's home crew before Goatse Security. Provocation engineered to be un-reportable; the direct ancestor of raid culture.
The satirical wiki launches and becomes the troll canon — the memes, the raids, the lexicon, all documented and weaponized. The institutional memory of /b/ and the raid era, later fought over in the "Oh Internet" revolt.
Zero for 0wned dumps the servers of the industry's biggest names — Mitnick popped on his own box, Kaminsky's whole life published, roughly 75,000 passwords — timed to land while the elite gather in Las Vegas. The antisec thesis, proven with root.
WikiLeaks is the most feared publisher on earth — and it cracks from both ends. Adrian Lamo reports Chelsea Manning to the FBI after she confides she leaked to WikiLeaks; the scene brands him the definitive snitch. The same year Assange's number two, Daniel Domscheit-Berg, walks out and takes the submission platform with him. The transparency era eats itself.
weev's crew increments a public AT&T web address to pull ~114,000 iPad-owner emails and hands the list to Gawker. weev is convicted under the CFAA; the Third Circuit vacates it in 2014. The decade's sharpest disclosure question, in a courtroom: is reading a page on the open web "unauthorized access"?
After PayPal, Visa and Mastercard cut off WikiLeaks donations, Anonymous DDoSes them with the LOIC "opt-in botnet." The FBI answers with the PayPal 14. The mass-participation Anonymous moment that turns a message board into a movement — and sets up LulzSec the next year.
The antisecurity spirit goes viral: LulzSec's 50-day spree, Operation AntiSec, and TeaMp0isoN feuding with both — "Lulzsec ARE Script Kiddies." The old grievance, now with a Twitter account and a much shorter fuse.
After the Snowden disclosures, DEF CON's founder asks federal agents to sit out the con for the first time in its history — a year after the NSA director had keynoted it. The scene's oldest ambivalence, stated out loud.
The FBI seizes the Tor/Bitcoin darknet market and grabs Ross Ulbricht ("Dread Pirate Roberts") mid-login in a San Francisco library. He draws two life terms without parole; two of the agents who investigated him go to prison for stealing bitcoin during the case; in 2025 he's pardoned. Charged with murder-for-hire — never tried.
The scene turns on the man covering it. Fraud-forum admin Fly (Sergei Vovnenko) crowdfunds a plot to mail heroin to Brian Krebs's house and have police called on him; the same year, UGNazi's Mir Islam doxes the First Lady and the FBI director on exposed.su and swats his way through at least nineteen homes — Krebs's among them. Doxing and swatting graduate from prank to weapon, aimed at the press. Both later go to prison; Vovnenko later apologizes.
Lizard Squad knocks PlayStation Network and Xbox Live off the internet on Christmas Day — months after grounding a plane with a bomb-threat tweet — and shrugs: "Because we can." It is LulzSec's for-the-lulz spirit stripped of even a cause, pointed at gamers. The clout-crew era begins.
Attack-for-hire goes industrial and then breaks the internet. vDOS — the biggest booter on the planet, run by two Israeli teenagers — is itself hacked, and Krebs names them; days later a record flood takes his own site down. The weapon is Mirai, a botnet of hijacked cameras and routers written by Rutgers student Paras Jha to muscle Minecraft-server rivals. Its authors release the source to hide in the noise; in October it takes out Dyn and half the DNS on the eastern seaboard with it.
The L0DE Radio Hour turns IRC-scene trolling into a live call-in broadcast — deliberately provocative, hosted by a pseudonymous ringmaster — and runs so long it outlasts most of the platforms it started on. Proof the scene's shock-and-performance instinct never needed a text file; it just needed a microphone.
Marcus Hutchins, who months earlier stopped the WannaCry pandemic, is arrested by the FBI as he leaves DEF CON 25 over a banking trojan he wrote as a teenager. The con's arrest tradition, still running thirty years on.
An anonymous hacktivist dumps ~400GB from Hacking Team (after breaching Gamma International in 2014), exposing the "lawful intercept" vendor's repressive-government client list and source code, and publishes the account. The disclosure wars turned on the surveillance industry itself. Never caught.
The scene's #MeToo year. DEF CON's first transparency-report bans name three of its own boldface figures "based on multiple public reports": Tor's Jacob Appelbaum (who denies it all), phreaking pioneer John Draper, and spyware-hunter Morgan Marquis-Boire, whose assault allegations The Verge reports that November. Allegations, denials, and the absence of any criminal charge — kept side by side.
DEF CON opens real U.S. voting machines to the floor; every unit is breached, one by an 11-year-old in under ten minutes. The manufacturers call the conditions "unrealistic." The con's other export: proof the infrastructure doesn't work.
The con that ran for decades on "don't be a jerk" publicly bans social-engineering figure Chris Hadnagy via its transparency report. The anti-establishment party is now an establishment with a disciplinary process.
A new teenage scene grows up around stolen phone numbers and the OGusers market for short "OG" social handles. Boston valedictorian Joel Ortiz becomes the first person convicted of SIM-swapping — $5M+ in crypto, three brazen thefts at a blockchain conference, and the ultimate flex, the single-character "0" Twitter handle. The clout-crew instinct, now pointed at other people's two-factor codes.
Reuters reveals that a U.S. presidential candidate — Beto O'Rourke — had been a teenage member of Cult of the Dead Cow under the handle "Psychedelic Warlord," t-files and all. He confirms it: "stuff I was a part of as a teenager that I'm not proud of." The oldest group in hacking turns out to have had a future presidential candidate writing for its zine. The scene goes mainstream the hard way.
On July 15, 2020 a 17-year-old from Tampa — Graham Ivan Clark, handle "Kirk," out of the same OGusers/SIM-swap scene — social-engineers Twitter's internal admin tools and takes over the accounts of Obama, Biden, Musk, Bezos and Apple to run a Bitcoin-doubling scam, netting ~$117k in hours. The biggest social-media takeover in history, pulled by a kid for coin and clout. Caught in weeks; pleaded as a youthful offender. The direct bridge from the SIM-swap kids to Lapsus$.
A crew of teenagers breaches Nvidia, Samsung, Microsoft, Okta and Rockstar — leaking GTA VI — with SIM-swaps, bribed insiders, and Telegram taunts. Low-tech, high-audacity, pure chaos-for-clout: the LulzSec lineage's newest and youngest generation, and a study in how a company's breach response (see Okta) becomes its own story.
DEF CON bans Eric Michaud in its own words for "enabling" Marquis-Boire — a characterization it credits to the Washington Post, and he is charged with nothing. And Israeli cyber-official Tom Alexandrovich is arrested in a Las Vegas sting during Hacker Summer Camp; he posts bond, flies home, and says he will fight the charge. A charge, not a conviction.
After the DOJ releases millions of Epstein files, DEF CON bans three men named in them — Pablos Holman, Vincenzo Iozzo (who calls the ban "performative"), and Joi Ito. Being named is not a charge; the ban list reaches the scene's own boldface names.
The exploits change. The grievance doesn't.