Feds: 'Hacker Journal' Implicates Heckenkamp

Feds: 'Hacker Journal' Implicates Heckenkamp
Kevin Poulsen, SecurityFocus 2002-05-31

Meticulous notes recovered from his computer allegedly link the accused eBay hacker to intrusions at over one hundred universities and companies. Heckenkamp's family says he's the victim of a frame-up.

A detailed personal log of computer intrusions recovered from the deleted file space on Jerome Heckenkamp's Linux box will serve as Exhibit A in the federal government's case against the accused super-hacker, according to newly-filed documents in the case.

Federal agents found the allegedly incriminating files on Heckenkamp's computer following a 1999 search of his dorm room at the University of Wisconsin at Madison. The "hacker journal," as it's described by prosecutors, consists of separate files for each hacked organization, and allegedly links Heckenkamp to intrusions at 120 different universities and companies.

"Typically, the defendant used the name of the hacked company as the name of the file," prosecutors wrote. "Each file contains records of the method by which Heckenkamp succeeded in hacking into the system or computer. Each file also typically contains information about what Heckenkamp did while he was in the system, the type of back door he installed, the method by which he obtained root status, and other information relating to the intrusion."

Forensic analysis of the hard drive indicated that the files had been burned onto a CD before being deleted, according to the government. That CD was apparently never recovered.

The details emerged in a court filing by federal prosecutors in San Diego, where the 22-year-old former network engineer faces nine felony charges for allegedly hacking telecom equipment-maker Qualcomm while a gradate student in 1999. In a related case in San Jose, Calif., Heckenkamp is charged with penetrating computers belonging to Lycos, Exodus Communications, Juniper Networks and Cygnus Support Solutions, and defacing online auction site eBay under the hacker handle MagicFX. That case is on hold pending the conclusion of the San Diego case.

Heckenkamp has maintained his innocence on all the charges, insisting that unknown hackers penetrated his computer and used it to launch the intrusions, framing him in the process. Heckenkamp's father says the "hacker journal" changes nothing.

"All it is is some stuff in his computer somewhere... which was accessed by numerous computer hackers," says Thomas Heckenkamp. "They still have not one shred of substantial evidence against him."

Held Without Bail
The "hacker journal" came up in the government's lengthy point-by-point response to a 13-page handwritten notice filed by Heckenkamp last month, in which he challenged the legitimacy of the case against him, and, seemingly, of the U.S. government's legal authority to prosecute anyone.

In his filing Heckenkamp -- who fired his attorney in March -- argued that he did not understand the nature of the charges against him, and therefore could not be prosecuted. He also claimed to have expatriated from "the corporation known as United States" and "re-patrioted into the de-jure California republic." Heckenkamp went on to demand that the plaintiff in the case, the U.S. government, appear in court. "The absence, or complete lack, of a client is evidence of fraud, or mental incompetence, or both, of [assistant U.S. attorney] Barbara L. Major," Heckenkamp wrote.

Last week federal judge Napoleon Jones, Jr. rejected Heckenkamp's arguments, and assigned him a court-appointed attorney over his objections. In a telephone interview, San Diego lawyer Kristen Churchill confirmed that she'd been appointed to represent Heckenkamp, but declined to comment further on the case. The senior Heckenkamp says his son has refused to see Churchill in jail. "She's not his lawyer, they have no right to appoint a lawyer for him," says Thomas Heckenkamp. "This is completely against his constitutional rights."

Prosecutor Barbara Major says the judge appointed Churchill after Heckenkamp began shouting in the courtroom. "If the court finds, as he did in this case, that the defendant is engaging in obstructionist conduct and other tactics designed for delay, he can appoint an attorney to represent him," says Major.

Heckenkamp is in federal custody at the Metropolitan Correctional Center in downtown San Diego. He's been held without bail as a "flight risk" since a court appearance in March, when he angered the judge in his Northern California case by challenging the indictment against him on the grounds that it spelled his name in all capital letters.

Heckenkamp's legal theories seem to be drawn from unsuccessful tax protester tactics more than established case law, and legal observers don't expect them to prove effective. "I've seen defendants do this," says Omar Figuroa, a San Francisco defense attorney. "It works with misdemeanors sometimes, if it is a case where it's not worth the prosecutor's time to respond to all the paperwork."

Trial in the matter is currently set for September 17th, but may be subject to delay.