MafiaBoy

Michael Calce (born 1986, also known as MafiaBoy ) was a high school student from West Island, Quebec, who launched a series of highly publicized denial-of-service attacks in February 2000 against large commercial websites, including Yahoo!, Fifa.com, Amazon.com, Dell, Inc., E*TRADE, eBay, and CNN.^[1] He also launched a series of failed simultaneous attacks against 9 of the 13 root name servers.^[2]

Early life

Calce was born in the West Island area of Montreal, Quebec. When he was five, his parents separated and he lived with his mother after she had won a lengthy battle for primary custody.^[3] Every second weekend he would stay at his father's condo in Montreal proper. He felt isolated from his friends back home and troubled by the separation of his parents, so his father purchased him his own computer at the age of six. It instantly had a hold on him: “I can remember sitting and listening to it beep, gurgle and churn as it processed commands. I remember how the screen lit up in front of my face. There was something intoxicating about the idea of dictating everything the computer did, down to the smallest of functions. The computer gave me, a six-year-old, a sense of control and command. Nothing else in my world operated that way."^[3]

Project Rivolta

On February 7, 2000, Calce targeted Yahoo! with a project he named Rivolta, meaning “riot” in Italian.^[3] Rivolta was a denial-of-service attack in which servers become overloaded with different types of communications to the point where they shut down completely.^[4] At the time, Yahoo! was a multibillion-dollar web company and the top search engine.^[5] Mafiaboy's Rivolta managed to shut down Yahoo! for almost an hour. Calce's goal was, according to him, to establish dominance for himself and TNT, his cybergroup, in the cyberworld.^[3] Buy.com was shut down in response. Calce responded to this in turn by bringing down eBay, CNN, Amazon and Dell.com via DDoS over the next week.

In a 2011 interview,^[6] Calce claimed that the attacks had been launched unwittingly, after inputting known addresses in a security tool he had downloaded from a repository on the now defunct file-sharing platform Hotline, developed by Hotline Communications. Calce would then have left for school, forgetting the application which continued the attacks during most of the day. Upon coming home Calce says that he found his computer crashed, and restarted it unaware of what had gone on during the day.^[7] Calce claimed when he overheard the news and recognized the companies mentioned being those he had inputted earlier in the day, that he had "started to understand what might have happened".^[6]

Aftermath

The U.S. Federal Bureau of Investigation and the Royal Canadian Mounted Police first noticed Calce when he started claiming in IRC chatrooms that he was responsible for the attacks. He became the chief suspect when he claimed to have brought down Dell's website, an attack that had not been publicized at that time. Information on the source of the attacks was initially discovered and reported to the press by Michael Lyle, chief technology officer of Recourse Technologies.^[8]

Calce initially denied responsibility but later pleaded guilty to most of the charges brought against him.^[9] His lawyer insisted the child had only run unsupervised tests to help design an improved firewall, whereas trial records indicated the youth showed no remorse and had expressed a desire to move to Italy for its lax computer crime laws.^[10] The Montreal Youth Court sentenced him on September 12, 2001 to eight months of "open custody," one year of probation, restricted use of the Internet, and a small fine.^[1][11]

Matthew Kovar, a senior analyst at the market research firm Yankee Group, generated some publicity when he told reporters the attacks caused US$1.2 billion in global economic damages.^[12] Media outlets would later attribute a then-1.45:1 conversion value of CAD $1.7 billion to the Royal Canadian Mounted Police. Computer security experts now often cite the larger figure^[13] (sometimes incorrectly declaring it in U.S. dollars),^[14][15] but a published report says the trial prosecutor gave the court a figure of roughly $7.5 million.^[10]

Significance

While testifying at a congressional hearing in Washington, D.C., computer expert Winn Schwartau said that “Government and commercial computer systems are so poorly protected today they can essentially be considered defenseless - an Electronic Pearl Harbor waiting to happen.”^[16] Whether it be banking, business or social networking, most people have various amounts of personal information online. Mafiaboy was the first to demonstrate how accessible this information is to the public and how easily it could be retrieved. The fact that the largest website in the world could be shut down by a 15-year-old created widespread panic. By this time, the internet had already become an integral part of the North American economy. Consumers lost confidence in online business and the American economy suffered a minor blow as a result.^[5] Former CIA agent Craig Guent credits Mafiaboy for the significant increase in online security that took place over the decade.^[4]

Later years

During the latter half of 2005, he wrote a column on computer security topics for Le Journal de Montréal.^[17]

In late 2008, with journalist Craig Silverman, Calce announced he was writing a book, Mafiaboy: How I Cracked the Internet and Why It's Still Broken.^[18][19]

On October 26, 2008, he appeared on the television program Tout le monde en parle to discuss his book.^[20] The entire interview (in French) can be seen at the Télévision de Radio-Canada website.^[21] An English-language interview is available at: Mafiaboy interview on The Hour. The book received generally positive reviews.

Michael appeared on a TV show, Last Call with Carson Daly, MafiaBoy talks to Carson about his days as a hacker, how President Clinton became involved, and how it ultimately landed him in jail all at age 15.

In 2014, Calce appeared on the twelfth episode of the Criminal podcast which can be listened to on the podcast's website.^[22]

References