📸 Photo

KINGPIN

tion by describing the recent landmark prosecution of a Bay Area hacker named Carlos Salgado Jr., a thirty-six-year-old computer repairman who, more than any other hacker, represented the future of computer crime.

From his room in his parents' house in Daly City, a few miles south of San Francisco, Salgado had cracked a major technology company and stolen a database of eighty thousand credit card numbers, with names, ZIP codes, and expiration dates. Credit card numbers had been hacked before, but what Salgado did next assured him a place in the cybercrime history books. Using the handle “Smak,” he jumped into the #carding chat room on IRC and put the entire list up for sale.

It was like offering a 747 for sale at a flea market. At the time, the online credit card fraud underground was a depressing bog of kids and small timers who'd barely advanced beyond the previous generation of fraudsters fishing receipt carbons from the Dumpsters behind the mall. Their typical deals were in the single digits, and their advice to one another was tainted by myth and idiocy. Much of the conversation unfolded in an open channel where anyone in law enforcement could log in and watch—the carders' only security was the fact that nobody would bother.

Remarkably, Salgado found a prospective buyer in #carding—a San Diego computer science student who'd been putting himself through college by counterfeiting credit cards, getting the account numbers from billing statements pilfered from the U.S. mail. The student had mob contacts who, he believed, would buy Smak's entire stolen database for six figures.

The deal went south when Salgado, looking to perform a little due diligence, hacked his customer's ISP and poked through his files. When the student found out, he got mad and secretly began working with the FBI. On the morning of May 21, 1997, Salgado showed up at a meeting with his buyer at the smoking lounge at San Francisco International Airport, where he expected to trade a CD-ROM containing the database for a suitcase packed with $260,000 in cash. Instead, he was arrested by the San Francisco computer crime squad.