Security experts unimpressed by T-Mobile hacker

THE BALTIMORE SUN

SANTA ANA, Calif. - Many people who know Nicolas Jacobsen said last week that they were surprised the young man had been accused of hacking into a huge cell phone network that guards millions of private messages.

Former neighbors, including some who witnessed his arrest last fall after federal agents arrived at their aging Santa Ana apartment complex, said he was just too bright to do such a thing.

"He could talk about politics. He knows about the law," said Victor Gonzalez, 60, a retired construction worker. "I couldn't believe that he got arrested. I thought he was a smarter guy than that."

Computer security experts who said Jacobsen turned to them for help also expressed surprise, but for a different reason: They weren't so impressed with his technical skills.

On one occasion during an online conversation with security experts, Jacobsen asked for basic pointers on how to penetrate an IBM mainframe computer, noting that "anything would be helpful."

Although the case became public only last week, Jacobsen was arrested in October on suspicion of breaking into a national database maintained by T-Mobile USA Inc. He has been charged with two counts of computer intrusion and has been negotiating a plea bargain with Los Angeles federal prosecutors.

According to Secret Service investigators and T-Mobile, Jacobsen looked at information from 400 customer accounts and offered to give other hackers access to many more among the wireless carrier's 16 million users. Investigators said he could access voice messages and e-mail of any customer whose cell-phone number he knew.

Investigators said that some in Jacobsen's circle trafficked in credit cards and other personal information used for fraud, though Jacobsen had no access to T-Mobile credit card data.

The Secret Service said Jacobsen even read e-mails from one of its agents. He also reportedly looked at pictures snapped with multipurpose T-Mobile Sidekick communicators. Jacobsen was betrayed by an informant inside a major fraud ring shut down in October, court records say.

According to a resume posted on the Internet, Jacobsen grew up in Oregon, where he was home-schooled and attended Umpqua Community College. He launched a small business that, according to an old Web site, offered computer security services to companies.

By 2003, that company was apparently out of business. In June he moved into a $650-a-month studio apartment that he shared with a girlfriend in a large complex in a run-down area near the Santa Ana Freeway. He told managers there that he made $30,000 a year at a computing job with Pfastship Worldwide Logistics Inc., a small company selling software that helps companies ship packages.

Officials with Pfastship declined to discuss their former employee's history. Jacobsen declined to discuss the charges against him. But former neighbors readily recalled him.

"We were bummed when they took him away," said Marthen Lumingkewas, manager of Saddleback Lodge Apartments. "We were wondering why, why, why. It was the talk for months around here because he was a friendly, joking, brilliant guy."

After posting bail, Jacobsen's girlfriend and his mother helped him pack up and move back to Oregon, former neighbors said. He was released on bond shortly after his arrest.

Simply gaining access to the underground world of high-level hackers would require technical skills, experts said. But some of the veteran software workers with whom Jacobsen corresponded said they found it difficult to believe that he masterminded the mammoth hack at T-Mobile.

Computer security professional Harlan Carvey recalled that his online conversations suggested Jacobsen was "trying to speak from a position of authority," without the necessary know-how.

He could have carried off the intrusion, however, using published techniques to probe for vulnerabilities, or by getting a tip from a more sophisticated hacker.

"It could have been any number of things," Carvey said.

The Los Angeles Times is a Tribune Publishing newspaper.

Copyright © 2020, The Baltimore Sun, a Baltimore Sun Media Group publication | Place an Ad
50°