I wrote this long version a year ago after I posted the short version of my review of \u201cCult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World\u201d by Joseph Menn and I received fair bit of criticism from some cDc members. I was called a troll, a self righteous prick, an asshole and other choice names. As a result I felt it was necessary to detail my many issues with the book. So, here is the long version.
\n<\/p>\n
Books can be funny things. Anyone can write one. The author can put into it whatever they want, and yet once it is written down into a book the information takes on an authoritative tone. People assume that once it is in a book it must be true, and discrediting something that has been published in a book can become extremely difficult and time consuming. Even with that effort, what was written may become commonly accepted as “fact” or lore. I wrote this long version a year ago after I posted the short version of my review of \u201cCult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World\u201d by Joseph Menn and I received fair … Continue reading
\nSome books deserve to be held aloft and pointed to as an example of factual correctness. These books are valuable resources. Other books take liberties with the facts, or present alternate truths. This is especially true of books that rely on people\u2019s memories with little corroborating evidence to back it up. Memories fade and events are remembered differently by different people. Worse, storytelling and a “collective memory” can change over time like the classic kid’s game “Telephone”.
\nIn Joseph Menn\u2019s book \u201cCult of the Dead Cow: How the Original Hacking Supergroup Might Just Save the World\u201d, I remember the events described a bit differently. I feel it is important that the differences between my own personal memory and Menn\u2019s depiction be documented somewhere. Letting the book stand as is without challenge would be a disservice to future researchers. My own memory is not infallible and it too may be inaccurate, but I feel it is important that alternate viewpoints be presented. I have already detailed some of my objections to Menn\u2019s book in a book review posted to my blog.<\/a> However, the inaccuracies go much deeper and the perceived authoritativeness of Menn\u2019s book seems to be increasing.
\nThe actual ground truth of course lies somewhere in the middle. Perhaps I can put my own recollections into a more authoritative book someday, but until then this document will have to suffice.
\nMenn\u2019s overall premise that Cult of the Dead Cow was a \u2018Hacking Supergroup\u2019 does not fit with the perception of cDc by non-members at the time. Menn actually mentions this several times in the book such as when he calls the cDc a \u2018performance art group\u2019 (page 2), the \u2018liberal arts section of the computer underground\u2019 (12), \u2018the arts wing of the hacking community\u2019 (21), \u2018successor to the Merry Pranksters\u2019 (23), \u2018more of a social space\u2019 (25), and \u2018they were an enormous inside joke for hackers\u2019 (47). These descriptions do not equal \u2018hacking supergroup\u2019 unless you have an extremely liberal definition of the word hacking. Hacker groups such as Legion of Doom (LoD), Masters of Deception (MoD), the 414s and many others who also existed in the same time frame would be a much better fit for the moniker of \u2018hacking supergroup\u2019.
\nOn page ‘xi’ just prior to Chapter 1, Menn lists out what he calls \u2018The Players\u2019 but conspicuously does not list several members of the cDc itself. While I understand that Menn seems to only want to list the people that he feels are important to his story, he does not make that clear, so the impression is that there were only 2 members of Legion of Doom, only two members of masters of Deception, and that a related group, the cDc Ninja Strike Force only had three members. Menn seems to cherry pick his facts throughout the book, only choosing to include those things that won\u2019t interrupt his narrative despite there being a significant number of other people and events that should be included to help shape and give background to the story he is trying to tell.
\nOne of the things I found extremely confusing throughout the book was Menn\u2019s interchanging of labels for the main characters. In some cases he refers to people by last name, in some by first name, and others only by their handle. In some places he does all three in the same sentence (45). This makes trying to keep track of who\u2019s who in the book more difficult than it should be.
\nOn page 2, Menn claims that cDc invented the word hactivism, something they have claimed for a long time, and completely ignores research into the origin of that word<\/a> and instead leaves that small mention as a footnote (215) in the back of the book where it is unlikely to be seen by the casual reader or the audiobook listener. When an author perpetuates a claim that has essentially been debunked, it forces the question about the authors objectivity.
\nThe hacker group L0pht Heavy Industries is described on page 3 as “Mudge\u2019s squad”, somehow inferring that he was the leader or that The L0pht belonged to Mudge. This inference is done is several places throughout the book. This confusion isn\u2019t limited to Menn either as it appears in other publications as well. Mudge may have seen himself as the leader but the rest of us, or at least I, did not. Perhaps I was being na\u00efve; I definitely considered Mudge our public face, or front man, but definitely not our leader. We had weekly meetings which where run by Brian Oblivion a founding member, and we voted on important topics as a group. The inference that Mudge somehow dictated what the group did and determined its course is inaccurate. This is a side of the story possibly being pushed by Mudge himself, as I am sure his memory of events differs from mine.
\nOn page 25, Menn clearly describes what many of us know as Operation SunDevil, the 1990 nationwide US Secret Service crackdown on “illegal computer hacking activities.” It involved raids in approximately fifteen different cities and resulted in at least three arrests, the confiscation of computers, and the shutdown of several BBSs. While Menn does mention this event he fails to name it, not even in a footnote, doing a disservice to the reader who may want to further research this event.<\/a> Menn also contradicts his own title here calling the cDc \u2018more of a social space, a refuge for hackers blowing off steam, than a place to plot actual hacks that ran afoul of the law\u2019 (25) which seems to indicate the cDc wasn\u2019t a \u2018Hacking Supergroup\u2019 as indicated in the books title by any definition.
\nOne of the cDc\u2019s preeminent text files,<\/a> #200 titled “The cDc #200 Higgledy-Piggledy-Big-Fat-Henacious-Mega-Mackadocious You-Can’t-Even-Come-Close-So-Jump-Back-K-B00MIDY-B00MIDY-B00M File”, is briefly mentioned on page 32 and yet no mention of DemonSeed Elite (mentioned 10 times in that file). This is a part of the cDc mythology that has seemingly escaped the cDc collective memory itself, and if the file is going to be mentioned at all, and that it included monster trucks… how can you then not also include the name of the monster truck? Especially when the name is as cool as DemonSeed Elite? A reference to an obscure 1977 horror film \u2018Demon Seed\u2019 about a self-aware psychotic computer that impregnates a woman with its demon seed.
\nYou really can\u2019t write about the cDc without also writing about the L0pht. Four cDc members have connections to the L0pht including two of its founders, Count Zero and White Knight. However, it is important to remember that the two groups were separate distinct entities. Menn does state that there “were important differences between cDc and the L0pht” (41) and then pretty much proceeds to blur the lines between the two organizations. Going so far as to call L0pht the cDc \u2018physical base\u2019 (59). Just like you might be a member of your local volunteer fire department but you also happen to work as a police officer does not mean that the fire house is also a police station.
\nThe appearance of Deth Veggie on NBC News Dateline (48) is treated as if it went exactly as the cDc planned. It did not. Myself and others at the L0pht told Deth Veggie and the rest in the hacker house they lived in called Messiah Village that appearing on Dateline like this was a bad idea. I personally tried to warn Deth Veggie that no matter what he would not come out looking like a hero or defender of free speech. He either didn\u2019t listen or decided the lure of the national broadcast TV was too strong. Menn describes this as Deth Veggie wanting to “have a broader debate” (49); I saw it as someone blinded by the TV camera lights instead. That Dateline episode is painful to watch, even today, as Deth Veggie just comes off as a punk kid acting irresponsible.
\nAt the bottom of page 49, Menn mentions New Hack City, the name of a house shared by a group of Boston hackers, mostly refugees if you will from two other hacker houses, one named Messiah Village and the other Hell House. But Menn fails to mention where the name New Hack City comes from, which was a play on the 1991 movie \u2018New Jack City\u2019, which was used as the title for a magazine article in Esquire. Unfortunately I can\u2019t find the source now, but I am sure while interviewing cDc members Menn must have asked where the name came from, especially seeing as how it was so close to \u2018New Jack City\u2019.
\nMenn mentions on page 50 that Window Snyder had \u2018took off\u2019 from New Hack City but fails to mention who it was she took off with. Menn alludes to this person in several other places in the book but fails to mention that it was GHeap aka Garbage Heap aka Dave Goldsmith. Possibly because Dave doesn\u2019t want to be identified but if that was the case Menn should have said so and not even mentioned his presence.
\n\u2018Mudge\u2019s list of aliases ran for ten pages\u2019 (54) this is obviously hyperbole but Menn just lets it sit there on the page with no challenge. He does mention that Mudge \u2018does at times exaggerate\u2019 but leaves that as a footnote way in the back of the book. A footnote that will be unread by most readers and not heard at all by audiobook listeners. This seems like an important note that should possibly be in the main text of the book and not relegated to the back pages. This is apparent later on page 57 where Menn mentions that Mudge \u2018let people think that he did more hands-on hacking than he did.\u2019
\nWhile this is not supposed to be a L0pht book there are a lot of the pages devoted to L0pht. Which is fine but if you are going to take the time to write about a separate organization and devote a considerable number of words to the topic I would think the author would flush out the major parts of the story and not compress significant events into a few words like \u2018moving to a bigger space\u2019(55) or \u2018newly incorporated\u2019 (56). Menn compresses the entire disclosure debate which has been raging inside infosec circles for decades into a few paragraphs on page 57 and 75.
\nOn page 57 Menn mentions a \u2018leading security figure\u2019 like it is some big secret, why not just say Marcus Ranum?
\nI also take exception to the fact that Menn calls the 1995 movie Hackers \u2018reasonably well researched\u2019 (60). That movie was a farce, a joke, a play on words, and was anything but realistic, calling it \u2018reasonably well researched\u2019 indicates that you have absolutely no idea what was actually going on at the time. Or that you were being successfully trolled, again, by your interview subjects who told you it was an accurate depiction.
\nMenn claims that cDc had \u2018taken mercy\u2019 (66) on Microsoft by setting the default port of Back Orifice to 31337 which in my memory had nothing to do with Microsoft. Back Orifice had to have an open port, it could have been anything, obviously they were going to choose the ‘elite’ port. 31337 is often used in \u2018leet speak\u2019 to reference the word elite. On page 68 Menn labels Back Orifice as a virus, which is far from accurate in the technical and literal sense. A virus has self replicating code, it can make copies of itself, BO can not. cDc referred to BO as a remote administration tool, they fought against its inclusion in Anti-Virus software. Menn calling it a virus, with all the negative connotations that brings seems, to fly directly in the face of Menn\u2019s underlying thesis and shows his lack of understanding of the subject matter he is writing about.
\nSomehow Menn comes up with a $500,000 figure (73) for the income of L0phtCrack, the L0pht\u2019s password auditing tool. It never made anywhere near that much. Unfortunately Menn never bothered to verify this figure with anyone and after speaking with the people Menn interviewed who might have given him this figure I was able to trace it to one uncorroborated source. The command line version of L0phtCrack was given away for free, if you wanted the GUI you had to pay, and the early version only cost $50 a seat. By version 2.4 that amount had increased to $150. $500K would have been quite a few copies of L0phtCrack. If we were making that kind of dough L0pht probably would not have needed to sell to @Stake later on.
\nI take exception to Menn\u2019s inference on page 77 that I and other members of the L0pht were unclean.
\nThe Hong Kong Blondes are finally revealed as the joke they are on page 88 but Menn just brushes by that revelation and continues writing the HKB story as if they are real and actually existed. Considering how much media attention the HKBs received at the time not calling out that the entire story was made up in stronger terms is a disservice to the reader and to history.
\nWhile the joint statement against the declaration of war by the Legions of Underground is mentioned, it is credited as being the brain child of cDc. Being the editor of the Hacker News Network I was directly involved in this event. I sat in on the LoU chat room and captured their logs. It was the Chaos Computer Club that drafted the statement and then sought other groups to sign on. L0pht was particularly reluctant to be a signatory and only after I wrote a passionate email to the rest of the L0pht did they agree. Considering how nicely this incident fits into Menn\u2019s overall narrative of morality and ethics I am surprised that it did not get more coverage in the book, perhaps because it shows cDc as only one group among many who all shared the same morals which would reduce the overall impact of cDc? I don\u2019t know.
\nThere is an entire chapter of @Stake, I won\u2019t go through and nitpick everything in this chapter because I honestly don\u2019t understand why it is even in the book. The connection between @Stake and cDc is even weaker than that of L0pht and cDc. Suffice it to say that this chapter in my copy of the book is filled with notes and highlights of inaccuracies. Someone will need to write the story of @Stake, I was only there for a short time so it won\u2019t be me, but it is a story that I hope gets told, accurately, some day. Menn\u2019s portrayal is not it.
\nAs for the chapter on Tor and Citizen Lab I see the connection between it and cDc also as very thin. I can not speak as to the accuracy of this chapter as I wasn\u2019t involved at all but based on the lack of accuracy in the rest of the book I can only assume that the same continues here. The same for Jabob Applebaum, or ioerror, yes he was a member of cDc but most of his actions happened outside of cDc. His public expulsion from the group is a necessary bit to include but I\u2019m not sure the rest of the chapter is worth mentioning.
\nWhile Menn chose to include things that are only questionably related to cDc he also chose to exclude things that the group was very closely involved with. Menn does not mention that cDc was directly responsible for the Good Times Virus hoax https:\/\/en.wikipedia.org\/wiki\/Goodtimes_virus,<\/a> he does not mention the time that the cDc, a \u2018hacking supergroup\u2019, was itself hacked by a group know as zF0 http:\/\/web.textfiles.com\/ezines\/ZF0\/zf03.txt.<\/a> Absent is the cDc\u2019s own declaration of war against the Church of Scientology https:\/\/www.cultdeadcow.com\/news\/scientology.txt<\/a> directly contradicting the groups signature on the condemnation of LoU for the same thing. The fact that cDc tried to purge some of its own writing in later years is missing. There is little to no mention of the groups very large physical migration from the East to West Coasts.
\nThere are entire chapters about Back Orifice and BO2K but no mention of the competing software titles available at the time such as Sub7 and Netbus which had the exact same capabilities as BO but not the flashy release on stage at Defcon. Which one was more widely used? Which one exerted more pressure on Microsoft? Menn writes that it was all because of Back Orifice and fails to mention the contributions of other remote access tools available at the time.
\nMenn doesn\u2019t even mention several cDc members or Ninja Strike Force members. In a book attempting to document the groups influence it would seem important to at least mention the groups membership, especially doing such a deep dive on so few of them.
\nMenn has painted an interesting story of morality and ethics during a tumultuous period and it makes for a great read. But it is just that, a story. There are too many inaccuracies and left out facts to call it anything else. Perhaps I am nitpicking, perhaps such varnishing of facts by an author is normal. My hope is that enough other people who were there and present for these events write down their experiences somewhere. It would be a shame if this was the only version of this history to survive.<\/p>\n","protected":false},"excerpt":{"rendered":"