FBI reportedly hunting Adrian Lamo

Arrest warrant


FBI agents armed with a federal arrest warrant out of New York were searching for Adrian Lamo Thursday, according to the hacker and his mother.

Two agents visited the home of Lamo's parents, Mario and Mary Lamo, near Sacramento, California, Thursday afternoon, says Mary Lamo. "They wouldn't tell us anything but that they had an arrest warrant and they wanted to come in," she adds.

When she demurred, the agents vowed to return with a search warrant, and have been overtly watching the house from parked cars ever since, she says. "They followed me when I went out, so they're not hiding it."

Bureau spokespersons could not be reached after hours Thursday.

Lamo frequently stays at his parents' home, but he was not there at the time of the FBI's visit, and has not returned since. His mother contacted the Federal Public Defender's office in Sacramento, which has agreed to handle his surrender, she says.

In a telephone interview, Lamo said he was in California, but does not plan to turn himself in until after conferring with the attorney. The hacker was quick-witted and seemingly in good humor, with only a trace of nervousness in his voice. He quipped about the proper etiquette of being arrested by the FBI, and suggested jokingly that SecurityFocus should purchase the publication rights to a favorite photo. He said he was in the company of a camera crew producing a television documentary on hackers.

"I have always said that actions have consequences, and this is something that I was always aware might happen," said Lamo. "I don't intend to deny anything that I have done, but I do intend to defend myself vigorously."

The 22-year-old Lamo has become famous for publicly exposing gaping security holes at large corporations, then voluntarily helping the companies fix the vulnerabilities he exploited -- sometimes visiting their offices or signing non-disclosure agreements in the process.

Until now, his cooperation and transparency have kept him from being prosecuted. Lamo's hacked Excite@Home, Yahoo, Blogger, and other companies, usually using nothing more than an ordinary Web browser. Some companies have even professed gratitude for his efforts: In December, 2001, Lamo was praised by communications giant WorldCom after he discovered, then helped close, security holes in their intranet that threatened to expose the private networks of Bank of America, CitiCorp, JP Morgan, and others.

Lamo believes the arrest warrant is for his most high-profile hack. Early last year he penetrated the New York Times, after a two-minute scan turned up seven misconfigured proxy servers acting as doorways between the public Internet and the Times private intranet, making the latter accessible to anyone capable of properly configuring their Web browser.

Once inside, Lamo exploited weaknesses in the Times password policies to broaden his access, eventually browsing such disparate information as the names and Social Security numbers of the paper's employees, logs of home delivery customers' stop and start orders, instructions and computer dial-ups for stringers to file stories, lists of contacts used by the Metro and Business desks, and the "WireWatch" keywords particular reporters had selected for monitoring wire services.

He also accessed a database of 3,000 contributors to the Times op-ed page, containing such information as the social security numbers for former U.N. weapons inspector Richard Butler, Democratic operative James Carville, ex-NSA chief Bobby Inman, Nannygate veteran Zoe Baird, former secretary of state James Baker, Internet policy thinker Larry Lessig, and thespian activist Robert Redford. Entries with home telephone numbers include Lawrence Walsh, William F. Buckley Jr., Jeanne Kirkpatrick, Rush Limbaugh, Vint Cerf, Warren Beatty and former president Jimmy Carter.

In February, 2002, Lamo told the Times of their vulnerability through a SecurityFocus reporter. But this time, no one was grateful, and by May federal prosecutors in New York had begun an investigation.

"I think this is unsporting of the New York Times," Lamo said Thursday.

Lamo's mother said she has no opinion on her son's exploits. She's just worried about him.

"I don't really know much of anything about computers," says Mary Lamo. "He's my son. Right now, all I can worry about is how I can help him."

"I hope there will be a time when Adrian can do positive things that everyone agrees are positive," she adds.

Copyright © 2003,


Other stories you might like

  • Will Lenovo ever think beyond hardware?
    Then again, why develop your own software à la HPE GreenLake when you can use someone else's?

    Analysis Lenovo fancies its TruScale anything-as-a-service (XaaS) platform as a more flexible competitor to HPE GreenLake or Dell Apex. Unlike its rivals, Lenovo doesn't believe it needs to mimic all aspects of the cloud to be successful.

    While subscription services are nothing new for Lenovo, the company only recently consolidated its offerings into a unified XaaS service called TruScale.

    On the surface TruScale ticks most of the XaaS boxes — cloud-like consumption model, subscription pricing — and it works just like you'd expect. Sign up for a certain amount of compute capacity and a short time later a rack full of pre-plumbed compute, storage, and network boxes are delivered to your place of choosing, whether that's a private datacenter, colo, or edge location.

    Continue reading
  • Intel is running rings around AMD and Arm at the edge
    What will it take to loosen the x86 giant's edge stranglehold?

    Analysis Supermicro launched a wave of edge appliances using Intel's newly refreshed Xeon-D processors last week. The launch itself was nothing to write home about, but a thought occurred: with all the hype surrounding the outer reaches of computing that we call the edge, you'd think there would be more competition from chipmakers in this arena.

    So where are all the AMD and Arm-based edge appliances?

    A glance through the catalogs of the major OEMs – Dell, HPE, Lenovo, Inspur, Supermicro – returned plenty of results for AMD servers, but few, if any, validated for edge deployments. In fact, Supermicro was the only one of the five vendors that even offered an AMD-based edge appliance – which used an ageing Epyc processor. Hardly a great showing from AMD. Meanwhile, just one appliance from Inspur used an Arm-based chip from Nvidia.

    Continue reading
  • NASA's Psyche mission: 2022 launch is off after software arrives late
    Launch window slides into 2023 or 2024 for asteroid-probing project

    Sadly for NASA's mission to take samples from the asteroid Psyche, software problems mean the spacecraft is going to miss its 2022 launch window.

    The US space agency made the announcement on Friday: "Due to the late delivery of the spacecraft's flight software and testing equipment, NASA does not have sufficient time to complete the testing needed ahead of its remaining launch period this year, which ends on October 11."

    While it appears the software and testbeds are now working, there just isn't enough time to get everything done before a SpaceX Falcon Heavy sends the spacecraft to study a metallic-rich asteroid of the same name.

    Continue reading

Biting the hand that feeds IT © 1998–2022