Gary McKinnon doesn't smoke dope anymore. It used to be a part of his life, a shortcut to calm on those long nights he spent perched at his computer, escaping his boredom and exploring the universe. But those nights brought him to where he is today, so he gave up weed without hesitation. "Wouldn't you?" he says, a sardonic smile creeping across his angular face. It's late morning on a winter day, and McKinnon sits at his table in the Bird in Hand, a pub in a far reach of North London, biding his time in legal limbo.
The man whom former U.S. attorney Paul McNulty has accused of having orchestrated "the biggest military hack of all time" isn't sure how long he'll remain out of prison. He's also not sure what harm he's done to the United States. (Nor, apparently, is the United States.) But McKinnon, unnoticed by the handful of serious drinkers bothering the barmaid, is alert and intelligent, and his voice quietly carries an unblinking certainty. Especially when he speaks about the great loves of his life: science fiction and UFOs.
It wasn't so long ago that the 40-year-old Scotsman was a teenage boy migrating to London with his family or, after that, a working stiff with dreams of becoming an actor. There's certainly a soulfulness behind his sharp, Bowie-esque features, but he's landed just one onscreen role, in a small British sci-fi film called Lunar Girl. In his twenties and thirties, he parlayed a childhood interest in computers into a career as a systems administrator. At night, he would get stoned and surf online, trying to satisfy his long-standing curiosity about UFOs. Eventually, his thirst for proof of other worlds would bring about his downfall.
Soon—no one knows exactly when—McKinnon's fate will be determined by the Court of Appeal. He's within one flick of extradition to the U.S., where he faces up to 60 years in prison, or perhaps indefinite detention in Guantanamo Bay, Cuba. Prosecutors call McKinnon a ruthless hacker who wreaked havoc on America's most vital defense systems. McKinnon's legal team and human-rights activists deny such claims and offer dark interpretations of the prosecution: They say that McKinnon's a harmless, self-described "bumbling computer nerd" who inadvertently shamed the U.S. by effortlessly penetrating its post-9/11 government networks—and that the embarrassed superpower is making an example of him for wayward hackers everywhere.
McKinnon was arrested for hacking in Britain in March 2002 and indicted by the U.S. that November. Under the U.K.'s Computer Misuse Act, he'd be looking at a few years in prison, says his lawyer, Karen Todner. But unfortunately for him, Britain and the U.S. enacted a treaty in January 2004 that permits the U.S. to push for his extradition without having to present a case against him. In fact, Britain's National Hi-Tech Crime Unit (NHTCU), which initially arrested him, says it was told to "de-arrest" him, clearing a path to a potential U.S. prison term that could last the rest of his life.
"He's a British citizen, he was arrested by British authorities, and the crimes were committed in Britain," Todner says. "But America say they want him, and under the new extradition treaty, they're very close to getting him."
In 2003, the computers of the U.S. Department of Defense logged 54,000 attempted intrusions. That number leaped to 79,000 in 2004, 1,300 of which were successful. The vast majority of those breaches were of "low-risk" computers, according to the Joint Task Force for Global Network Operations (JTF-GNO) under the U.S. Strategic Command. "The nature of the threat is large and diverse," a JTF-GNO spokesperson says. "It includes recreational hackers, self-styled cybervigilantes, various groups with nationalistic or ideological agendas, transnational actors, and nation-states."
In recent years, punishments by the U.S. have paled next to the 60 years McKinnon may face. Ikenna Iffih of Boston got two years' probation and a $5,000 fine in 2000 for hacking computers at NASA and the Department of Defense, intercepting log-in names and passwords and sabotaging communications. Kenneth Kwak of Chantilly, Virginia, was sentenced to five months in prison last May for using remote-control software to monitor his Department of Education supervisor's e-mail and other Web activity. Overseas hackers have received similar punishments. Ehud Tenenbaum was given an 18-month prison sentence in 2001 in his home country, Israel, for masterminding attacks on Pentagon networks (and two California teens working with him got probation). American officials never attempted to extradite Tenenbaum. But they want McKinnon.
The U.S. charges McKinnon with having penetrated 92 networks belonging to the U.S. Army, Navy, Air Force, Department of Defense, and NASA, and having paralyzed the computers used by these agencies, inflicting some $900,000 in damage. Christopher Christie, then Newark's U.S. attorney, called McKinnon "an incredibly sophisticated cybercriminal" who had shut down the network at the Naval Weapons Station Earle, in Sandy Hook Bay, New Jersey, shortly after September 11, 2001—"when we, as a nation, had to summon all of our defenses against further attack." His case was announced to the media by Paul McNulty, then the U.S. attorney for the Eastern District of Virginia, whose all-star cases include "20th hijacker" Zacarias Moussaoui and "American Taliban" John Walker Lindh.
McKinnon insists his motivations were benign: He says he wanted information about UFOs and suppressed technology. Once, he says, he found an Excel file deep within a network of the U.S. Navy: a list of officers marked "non-terrestrial," supporting (in his mind, anyway) a popular UFOlogy rumor: that the U.S. maintains weapons and military bases in outer space. "But I saw other stuff," he says. "The U.S. were hot on North Korea, and the jailer files in military bases in America astonished me. Worrying stuff. Murders, rapes, drugs, violence. This is just before these guys were about to be sent to Afghanistan."
His hacking name was SOLO—with good reason, he says. "I never told anyone other than a few friends what I found, never helped anyone else hack," he says. In 2000, trying to reinvigorate a faltering life—a troubled relationship, a career dependent on temporary contracts—he began his obsessive late-night, pot-fueled cybersearches. "It was a distraction from problems," he says. "I stopped looking for work, never thought about going on holiday."
He became adept at tapping networks without assigned administrator passwords and pushing open their unlocked doors. In 2001, looking for evidence that the U.S. was scrubbing images of UFOs from satellite photos, he claims to have accessed computers at NASA's Johnson Space Center and found folders marked "raw" and "processed." "I started downloading a 'raw' image through my dial-up connection," he says. "It was a hemisphere of the Earth and, in front of it, a cigar-shaped vessel that was totally smooth: no rivets, seams, or aerials. Not man-made—no way." He pauses. "As I was looking," he says, "I saw the mouse move on the screen, and someone cut the connection. Bang—I was out of NASA."
Next came the Pentagon. It took him months to disable the security, but once inside, he says, he found he was far from alone. "I looked up the IP addresses for the other connections to the system, and the majority weren't military," he says. "There were American colleges, and people from Holland, Germany, China, Turkey, all over the place. So I took it for granted there was a permanent tenancy of foreign hackers within the Pentagon's computers." Sometimes he set up his own passwords, which denied other hackers access, and left admonishing messages of "hacktivism" for system administrators. "U.S. foreign policy is akin to government-sponsored terrorism these days," he wrote. "I am SOLO. I will continue to disrupt at the highest levels."
His passion remained UFOs, whose potential to benefit mankind he still discusses with seemingly guileless enthusiasm. But the Pentagon documents he was amassing intrigued him. "Even those jailer files from the military bases would have been a shocking story," he admits, "let alone the rest."
He grins weakly. "Then there was the knock at the door."
In March 2002, British high-tech-crime investigators arrested McKinnon, questioned him, and released him on police bail. "They were pretty laid-back about things," McKinnon says—the officers even told him they were instructed to ask him if he belonged to Al Qaeda. But they took his hard drive to Washington, he says, where they met with the U.S. Navy. That June or July, British officers arrested him again, and the mood had soured.
Todner, McKinnon's lawyer, met that summer and autumn with American officials, who were keen on a deal. They offered 6 to 10 years, Todner says, with no guarantee that a longer sentence wouldn't be imposed and with no right of appeal. When McKinnon turned the offer down, he says, an attache to the U.S. embassy warned that McKinnon would be "prosecuted to the max." The U.S. indicted him in November 2002.
Despite its synchronized portrayal of McKinnon's master cunning, the U.S. didn't immediately seek extradition, and the case fell silent. For more than two and a half years, McKinnon was a free man. The information-technology industry blacklisted him, he says, so he took a job at a warehouse and tried to keep his name out of the papers. But with the extradition treaty established, the U.S. decided to get the ball rolling in June 2005.
The treaty permits the U.S. to extradite McKinnon without having to provide prima facie evidence (an arrangement that does not apply to Britain's extradition of American suspects). And indeed, in his hearings in July 2005, hard evidence of his alleged crimes was significantly absent. The British courts signed off on McKinnon's extradition last May, and the Home Office, Britain's analog to the U.S. State Department, backed up the decision and dismissed his first appeal.
"It was a simple case, with a few years in prison likely," Todner says. "And then the Americans said, 'We want him. Back off.' And the NHTCU did just that. I'd never seen anything like it." McKinnon now awaits a ruling from the Court of Appeal, which is delayed pending a decision on another high-profile extradition case. Nevertheless, Todner says, "it could happen very quickly. A phone call, and not long after, Gary could be on a plane."
The U.S. seems to be tiptoeing from the McKinnon case, which it once trumpeted as a breakthrough in its War on Terror. In 2002, Paul McNulty had called the arrest a warning: "If you hack us, we will find you, and we will prosecute you, and we will send you to prison." But when asked to define McKinnon's motivation, he had offered only, "I suppose he was hoping to gain access to classified information." McNulty, now U.S. deputy attorney general, did not respond to a request to discuss the case for this story—nor did most other officials and agencies contacted.
In a 2003 report, Lieutenant Colonel Carl Hunt, who is now a colonel and the director of technology and analysis at the JTF-GNO, said McKinnon's "simple but clever" hack was "hardly unique," and that it resulted in "loss of services at a time when it was not decisive to U.S. security." And one well-placed U.S. military insider says, "The government contends he did serious damage: the same government that contended Saddam was in cahoots with bin Laden and that Iraq had piles of nerve gas. Yes, I believe the hacker did serious damage—serious damage to the egos of the people in charge of the various websites."
Yet the case rumbles on, its threat of a 60-year sentence still horrifyingly intact, and naturally, McKinnon calls the prospect "absolutely terrifying." A couple of days after the conversation at the Bird in Hand, he's sitting in a pub in central London, watching the rain beat the streets and checking his watch so he'll be on time to meet his girlfriend of two years. (McKinnon's previous girlfriend was also hauled in for questioning.) He and his current girlfriend occasionally manage to joke about the case. "Sometimes I think she's nearly as petrified as I am," he says.
McKinnon has a quick, dismissive rebuttal for every accusation. On the breach of the Naval Weapons Station Earle: "Pure crap," he scoffs. "It may have happened, but it certainly wasn't me. All that just-after-9/11 stuff—I resented that." On leaving the Pentagon vulnerable to other hackers: "Very unlikely. A lot of the time, I'd be setting passwords. The Americans claim this is damage, but it actually made their systems safer." On his ominous hacktivism messages, claiming that he would "disrupt at the highest levels": "My 'disruption' was the hacktivism," he says. "Messages. Stupid, late at night, and under the influence—not a threat. Remember, that's the only evidence they've produced. It could be all they've got." But under the treaty, it could be all they need.
McKinnon knows that one way or another, extradited or not, he will have to go to prison. "It was against the law; I shouldn't have done it," he says. "I thought I was doing it for the right reasons, but it wasn't worth..." He trails off. For the moment, he's a free man, and he has the rest of the day to spend with his girlfriend: a film, some shopping, maybe a drink or two. He drains his pint and smiles: "But really, I'll just be waiting."