|
Tinseltown couldn't have staged a more strained and
obvious crime scene. On March 13, 1995, at approximately 8
p.m., four black men driving a rental van with Florida plates
pulled into a 7-11 parking lot in the mostly Caucasian township
of Haverford, Penn., just west of Philadelphia. There, they
waited. A couple of hours later, a second vehicle arrived and a
white man, dressed in business attire, stepped out and walked
over to the parked van. The five individuals began to talk and
engage in what looked like an unlawful transaction.
Detective John Morris of the Haverford Township Police
remembers receiving a call that night, tipping him off that a
drug deal was going down at the 7-11. Squad cars were
immediately dispatched. "I was in an undercover car pulling up
and I could see that one guy was holding money and it looked like
an exchange was going on," Morris recounts. "Cars were off to
the side in a manner other than people who patronize the store
and it looked out of place, it looked like something was wrong."
As suspicious as things may have appeared that evening,
nothing, in fact, was terribly amiss. Ed Cummings, a computer
and telecommunications consultant, was selling electronics
parts to a Florida resident who was passing through the
Philadelphia area. Cummings, better known in the hacker
community by his handle Bernie S., had been advertising the
sale of 6.5MHz phone crystals in the hacker quarterly
magazine, 2600. When used in lieu of standard crystals found
in ordinary Radio Shack phone dialers, these 6.5MHz crystals
allow for the programming of special tones -- tones that can be
employed to trick public phones into thinking coins have been
deposited. The visitors from Florida, who had seen the ad in
2600, called Cummings and arranged to meet him at the 7-11.
Despite Cummings' objections that nothing illegal was
transpiring, Morris remained suspicious and confiscated the
box of crystals and dialers. Morris agreed to return the
materials the next day, so long as they "checked out."
Cummings and the men and women from Florida were allowed
to leave the scene.
Two days later, Cummings received
a call from a client (she requested anonymity for this story)
who needed help installing a new hard drive that had just
arrived in the mail. She remembers putting her children to
sleep while Cummings worked away at the installation upstairs.
It was an ordinary evening -- at least until the doorbell rang
around 9 p.m. She had visitors.
Unaware, Cummings busily worked upstairs. "I heard
someone coming up the stairs," he remembers. "Then,
suddenly, I heard a bunch of men yelling, 'Freeze, Police!
Police! Secret Service!' I turned to my right and there were six
armed men all pointing guns at me. They said, ëDon't move!' I
was pushing my chair back slowly and moved my hands,
because I speak with my hands. They got really upset that I
moved." A couple of officers pushed Cummings to the floor. He
recalls hearing from over his shoulder, the charge being read to
him: "You're under arrest for
possession of equipment for theft of telecommunications
services."
From this point on, depending on who you speak with, the
facts of the Ed Cummings case diverge into two very different
stories. The Secret Service would have you believe Ed
Cummings is a malicious and dangerously vindictive phone
phreaker. The hackers, phreakers and devotees of 2600
magazine, who hold monthly meetings at locations nationwide
would argue otherwise, saying that it's just that the Secret
Service (or Secret Police as some hackers call them) is out to
get Cummings. Side by side, the contentions hardly seem to
relate to the same case and the same guy. Only after speaking
with him myself, could I determine incontestably, that the Ed
Cummings both sides were referring to was in fact one and the
same person.
Who is Ed Cummings really, and why has he been
incarcerated? When asked this exact question, he cautions
that it's bad "etiquette" to question another prisoner for "what
he's in for." He pauses for a moment and then laughs and says
that he's "more than happy to speak about the case." In fact,
Cummings says that at this point, he considers his life an open
book, and he's just glad that someone is willing to listen to his
side of the story. Emmanuel Goldstein, editor of 2600, and
some other sympathizers have tried to exculpate Cummings of
the allegations made against him by the U.S. Attorney's office,
but mostly, he finds
that the local press has badly misreported his case. So I ask
him to tell me
his story from the very beginning. He starts his tale on March
13, 1995, the night local police officers confronted him
outside the 7-11.
Call it bad timing, bad luck or bad karma -- one of the phone
dialers Detective Morris seized from Cummings that night had
been tampered with; Cummings says that it was a phone dialer
he had sold to another hacker who later returned the device
because of a flaky push button. Morris, the day after his initial
encounter with Cummings, contacted First Bell Telephone, who
then directed him to Special Agent Tom Varney of the Secret
Service. Varney, who suspected that the device might be a
"red box," an illegally modified tone dialer, went to meet Morris
at the Haverford Police Department. "As soon as [Varney]
walked in, he knew exactly what it was," Morris says. "We went
over and used the red box on a pay phone, and it worked. We
were getting free phone calls." Based on this evidence,
Cummings was charged with a Pennsylvania misdemeanor two
for possession of devices for theft of telecommunications and
also with a felony for unauthorized access of a computer.
The day after Cummings was arrested, he was shackled and
led to the Haverford District Court for arraignment, where a bail
agent set his bail at an unusually high $100,000. As it turns
out, Cummings was supposed to be arraigned the previous
night; however, the judge who was on duty at the time, Judge
Gerald Liberace, knew Cummings personally (Ed was a friend of
the family). So that following day, Cummings instead went
before Judge David Lang, who arraigned him on the
misdemeanor. Lang refused, however, to arraign him on the
felony charge, stating that there was nothing in the affidavit
accompanying the arrest warrant that said anything about
"accessing a computer."
Thrown in an 8-by-5 foot holding cell at the Delaware County
Prison, Cummings spent the next four days pondering his
unexpected incarceration and making unwanted acquaintances
with a few dazed loiterers who were in town for
a Grateful Dead concert. Thereafter, he was transferred to "E
Block" where he remained incarcerated, penniless and
downcast, until his April 10 preliminary hearing. And that's
when he recounts an unusual visit with his landlord, Al
Wheatley. "I thought he
was going to be mad as hell," says Cummings, who figured
Wheatley had come to notify him of his eviction. To his
surprise, however, Wheatley, an aspiring cyberlawyer, hoped to
pick up the case, and agreed to waive any legal fees. For
Cummings, it was a rare stroke of good luck.
On April 10 Cummings appeared in court for his preliminary
hearing regarding his misdemeanor charge. And it was then
that his case took a major turn for the worse. Before any
charges were heard, Agent Varney and Detective Morris
appeared in the courtroom and approached the bench. After a
short discussion with the presiding judge, Judge Robert Burton,
Cummings was informed that the state was dropping all
charges against him -- but that the federal government was
issuing a warrant for his arrest. Cummings was led out of the
courtroom with three other prisoners and placed in a van that
would once again return him to Delaware County Prison. As it
pulled away from the courthouse, police and a number of
Secret Service vehicles followed behind in tow. The parade of
cars amazed and amused the other prisoners in the van. In a
rare moment of levity, someone began singing the theme song
to Secret Agent Man. Cummings joined in, but he couldn't help
but wonder what it meant now that the U.S. Attorney's office
would be handling his prosecution.
Before Cummings left for Fairton Federal Prison in New
Jersey, his lawyer, Wheatley, visited him at the county prison
and read him the federal charges. According to Wheatley, the
violations didn't seem to exist, and he confessed that he
couldn't find any trace of the federal statutes that Cummings
had been charged with: Title 18, United States Code, Section
1029 (a)(5) ("knowingly and with intent to defraud...possesses
a telecommunications instrument that has been modified or
altered to obtain unauthorized use of telecommunications
services") and Section 1029 (a)(5)(B) ("knowingly and with
intent to defraud...possesses hardware or software used for
altering or modifying telecommunications instruments to obtain
unauthorized access to telecommunications services").
These phantom laws, it so happened, had been added as
riders to the Digital Telephony Bill passed by Congress in late
1994, only weeks before Cummings had been charged by the
state, and weren't published in any law books yet. Cummings,
as was his luck, would be the first person to be tried under
these new federal statutes.
On April 26, Cummings was moved by Agent Varney from
Delaware County Prison to federal court. Cummings describes
the ride as uneventful but says that Varney was very curious
about four photographs that had been found in his file cabinets
at home -- all four were shots of Secret Service agents, one of
which captured an agent "picking his nose."
Cummings explained to Varney that he didn't take the shots
himself but had received the four photos from a friend (who
apparently sells electronics surveillance equipment to law
enforcement agencies). "The Secret Service received an
unfounded tip that one of his employees might have been
involved in telecommunications fraud and sent two undercover
agents to his place of business where they were captured on
videotape," Cummings says. Suspecting that he was being
investigated, Cummings' friend gave him the photos and asked
that he bring them to a 2600 hacker meeting in Philadelphia
to see if anyone could confirm his suspicions. Coincidentally, a
camera crew from the Philadelphia Fox-TV affiliate, WTXF, was
attending the meeting to film a short report on hacking. In an
unfortunate twist, the four photos were broadcast on the
evening news two nights later, causing an enormous
embarrassment for the Secret Service.
Cummings is convinced to this day that this incident, and the
subsequent discovery of the pictures in his home file cabinet,
prompted Varney to recommend that the U.S. Attorney's office
federally prosecute this case. Varney refutes the accusation
and insists, "Ed Cummings was no more an interest than any
other suspect or subject or mope or doer or perpetrator that I
have ever investigated. It's just that Ed Cummings has become
a martyr for the hacker community and the 2600 club, and so
they see this as a vindictiveness and an aggressive reaction by
the Secret Service."
At the federal arraignment later that April afternoon, the
government referred to books on explosives and a substance
resembling the explosive C4 that were found in Cummings'
home. Despite the fact that there was nothing illegal about the
possession of these bomb-making books, and regardless of the
fact that the "C4" found in Cummings' home was nothing more
than dental putty, the federal magistrate denied Cummings
bail. By happenstance, Cummings' arraignment took place two
hours after the entire federal building had to be evacuated
because of a bomb scare and one week after the Oklahoma
City bombing. The next afternoon, Cummings was denied bail
and sent to federal prison.
Over the next couple of months, Wheatley, filed several
appeals for bail, without success. Varney's testimony that two
witnesses had claimed Cummings would flee if released was
enough to convince any judge to deny bail. According to
Cummings, however, the only person who actually made the
claim that he would flee was a man named Charles Rappa,
who previously had been arrested on assault charges (against
Cummings). Frustrated by the evidence presented against him
and also by his landlord lawyer's deleterious lack of experience
with regard to the federal criminal justice system, Cummings
fired Wheatley and scraped up enough money to hire attorney
Ken Trujillo, a former federal prosecutor whom he discovered
through a friend of a friend.
Trujillo, who began work on Cummings' case on July 7,
immediately went after an inconsistency in a police report filed
by Morris and a statement made in Varney's affidavit. In both
documents, Morris and Varney wrote that the evidence taken
from Ed Cummings on March 13 in front of the 7-11 was
"confiscated." Trujillo's problem with the word "confiscated"
was that there was no consent or probable cause to justify
making the seizure of the phone dialers and phone crystals on
Cummings' person, particularly since Morris didn't know what
the parts were. In response to this inconsistency, Varney says,
"[Morris] saw the fact that [Cummings] had a book opened up
in regard to cloning cellular telephones, telecommunications
fraud and red boxes. And in this book they opened up, they
also cited Ed Cummings' business as the business that sold
the parts to red boxes. I would guess that a law enforcement
officer, with the type of experience that Detective Morris had,
would be able to explain to any person why he felt there was
criminal activity, that these items were involved in some sort of
crime and that he was going to take them for further review.
And I think he could persuade any judge to understand that."
On July 14, Trujillo filed a motion to suppress the evidence
seized by Morris. It wasn't until Sept. 7, at the suppression
hearing, that Judge Jay C. Waldman would hear and settle on
the motion.
In the meantime, Cummings recounts having spent many
days in federal prison researching his own case and talking to
and learning from other inmates about everything from stealing
cars to making chemicals. At one point during his stay at
Fairton, Cummings even tells of a run-in with Philadelphia
crime
boss, John Stanfa, who at the time was implicated in of the
largest racketeering indictments in U.S. history.
At the time of this "run-in," Cummings was sharing a cell with
a roommate who had a penchant for bananas and who would
smuggle them into their cell after meals. Irritated by the smell
of discarded peels and the fruit flies they would attract,
Cummings says he would pick them out of the trash each day
and dump them instead in the communal bin just outside of
the cell. One day during his ritual disposal of the peels,
Cummings recalls lifting the 7-pound lid from off the communal
can and balancing it precariously on a railing that ran the
length of the upper tier. In a moment of clumsiness, he
knocked the lid from off the railing and watched helplessly as it
plummeted to the tier below, landing squarely on the large,
bald head of Stanfa. Cummings immediately hurried to the tier
below, spilling apology after apology over Stanfa's furious
harangue of Sicilian curses. Thankfully one of Stanfa's
bodyguards, in prison on a similar indictment as his boss,
intervened and explained that Cummings, whom he had met a
day before, was an "okay guy." Despite the bodyguard's
intervention though, Cummings remained terrified at the
prospect of donning cement boots. Two days later Stanfa
confronted him again as he feared he might. But rather than
"get rough" with him, the crime boss presented Cummings with
an offer he couldn't refuse -- Stanfa's English wasn't terribly
strong, so he asked Cummings to clean up a 50-page
handwritten document outlining Stanfa's and his associates'
alibis. In return for this favor, Cummings says he obtained
prison protection and occasional favors.
"Just my strange luck, I
suppose," Cummings says. "Things turned out all right, but
imagine if I killed the guy by
accident. Who would have believed me then?"
Certainly not Judge Waldman, who, on Sept. 7, finally heard
and denied Trujillo's motion to suppress the evidence of the
phone dialers and crystals that were taken on March 13
(Morris claimed that Cummings voluntarily gave him the
evidence). With nowhere to go but down, Trujillo suggested to
Cummings that he agree to a conditional guilty plea called a
"Zudick plea." Since Ed was the first person to be tried under
federal statutes 1029(a)(5) and 1029(a)(5)(B), he could use
the Zudick plea to challenge the constitutionality of the law he
was accused of violating (and avoid the likely risk of being
found guilty by a jury which often results in a harsher
sentence). "It is unconstitutionally vague because given
technology as it stands, the federal government has the wide
ability to call virtually anything illegal under that law," Trujillo
says.
In a phone interview, a friend of Cummings (who wished to
remain anonymous) adds, "It looks like it's possible to be guilty
of this crime just by possessing a telephone because the
telephone is self-modifying when you type buttons, because
you can hit redial. So therefore, by owning a telephone, you're
guilty of this crime." His back to the wall, and weary after seven
months in jail, Cummings agreed to plead guilty.
The hacking community prayed, with Cummings, that the
U.S. Third Circuit Court of Appeals would find the statutes
under which
he was being prosecuted unconstitutional; if not for the sake of
their pal Bernie S. (he'd served his federal time anyway), then
at least for their own sakes. Dark Tangent, an acquaintance of
Cummings, who's known among hackers for his work organizing
the yearly hacker convention, Def Con, says the fear among
users with regard to this legislation is its vast potential to be
abused. "I have parts laying all over my office that I'm sure I
could cobble together and make all types of evil ëdeath
machines.' I'm sure if I got a team of dedicated federal
prosecutors in here, they could come up with a whole host of
things to do with this stuff."
Convinced, as is Ed, that the Secret Service was "out to do
Cummings," Dark Tangent warns, "You don't really question the
Secret Service, it's just not done."
Finally on Oct. 10, 1995, after several unexplained hearing
delays, Cummings received federal sentencing. It should be
noted that the delays in Cummings' sentence caused him to
serve an extra month in prison past the maximum federal
guideline for a fraud case involving no money loss and no
victims. This extra month served, says Cummings, was justified
away that October afternoon when the court agreed to
prosecuting attorney Anne Chain's request that his sentence be
enhanced "because his offense involved 'more than minimal
planning.'" This, even though, as Cummings insists, "all the
'planning' alleged, the purchasing of crystals and dialers,
occurred prior to the enactment of the statute I was charged
with violating!" The sentence received: seven months
imprisonment. Cummings, who had almost served the entire
sentence during the protracted trial period, was released from
federal custody three days later.
On Oct. 13, Cummings was finally released from prison. But,
in a false ending typical of most bad horror stories, Cummings'
short-lived freedom was only the calm before another
nightmarish storm. Aside from the fact that the state had sold
his impounded car, his federal conviction, as it turned out, was
a violation of a county probation for a past misdemeanor
charge, "tampering with evidence," that he pled "no contest"
to in 1994. That earlier misdemeanor charge was the result of
Cummings' 1993 encounter with Forks (Penn.) Township's
police officer James Rowden at a Northampton County
Summer HamFest (a kind of electronics show and flea market).
Cummings, accompanied by two friends, Alan and Ted, had
arrived at the HamFest at around 6 a.m., just before the gates
to the show were opened. They parked Cummings' newly
purchased Ford Thunderbird on the shoulder of a side road
near the show and spent the next six hours buying electronic
equipment at the festival. Upon returning to the car with
armloads of assorted gear, they noticed a police car parked
behind Cummings' vehicle. Rowden, a local policeman, had
found the car abandoned on the side of the road and
suspected that it had been stolen, particularly because one of
the vehicle's windows was broken out and because its
registration failed to match up. After making a procedural
search through the glove box of the car (Cummings claims the
search went "too far"), in an attempt to find some evidence of
who the vehicle belonged to, Rowden says he discovered
phone dialers and accompanying pamphlets that explained how
to use them as red boxes.
Rowden questioned Cummings about the car and explained
that he couldn't allow the vehicle to be driven without proof of
ownership and insurance. Unfortunately for Cummings, who
had just purchased the Thunderbird that past week, he had not
yet updated the registration plates for the vehicle and could
provide no such proof. So Rowden drove the three show
attendees to the police station where they could make phone
calls to arrange for some kind of transportation back to
Philadelphia. "I also explained to them about the phone dialers
and that I would be contacting Bell Telephone security, and
that they would be conducting an investigation," Rowden says.
"[Cummings] was told he could take his personal belongings."
Cummings, who admits that two of the six phone dialers that
had been taken were red boxes, says that Rowden permitted
them to leave with everything but the dialers. So one of his two
friends (Cummings wouldn't say who) grabbed the pamphlets
and stuffed them down his pants, and removed the batteries
from the phone dialers, effectively erasing the memory of
illegally programmed red box tones. "Rowden did say everything
but the phone dialers," Cummings explains.
About 20 to 30 minutes after leaving the police station, while
walking down a country road toward a bus station, Cummings
says Rowden reappeared in his police vehicle and pulled over
in front of them. Furious that the batteries had been removed
from the dialers, Officer Rowden stepped out of the vehicle and
told Cummings that someone would have to be held
accountable for the tampering of evidence. Alan apparently
was already on federal probation, says Cummings, "so I took
the heat."
Consequently, Cummings was placed on probation and
slapped with his first misdemeanor two (a Pennsylvania charge
that's equivalent in severity to scattering rubbish, insulting the
flag or making a public nuisance). On Jan. 12 of this year, that
seemingly minor charge would come back to haunt him in a big
way.
Cummings' lawyer, Trujillo, whose car had been plowed under
during that January morning's record blizzard, could not make it
to his client's probation violation hearing. Angered by Trujillo's
absence, Northampton County Judge Anthony Pinella forbid
Cummings to speak in defense of himself; silent, Cummings
listened intently as Agent Varney, Detective Morris and
Cummings' probation officer, Scott Hoke, presented convincing
evidence that hacker Bernie S. was a danger to the
community. Despite the fact that he had landed a full-time job
at Bell Atlantic as a technical assessor of computer problems
(for banks, corporations, government agencies and ironically,
the FBI), Judge Pinella returned Cummings to prison and set an
extraordinary $250,000 cash bail.
With only a stick of gum and a little pocket change on him,
Cummings certainly could not cover the enormous cash bail.
He was placed once again in the all-too-familiar shackles,
taken to Northampton County Prison and, thanks to the high
bail setting, placed in the maximum security cellblock with "the
23 most violent and dangerous inmates of the entire 520-man
prison." It wasn't until March 5, 1996, that Cummings was
finally sentenced by Judge Pinella for his probation violation: a
$3,000 fine and two years in prison with eligibility for parole
after six months. According to Trujillo, this was eight times the
maximum guideline sentence for this kind of offense.
Currently, Cummings is being held at the minimum security
wing of Bucks County Prison, the fifth prison he's had the
misfortune of seeing from the inside. All this, he acknowledges
with amazement, for the possession of a 486 laptop computer,
a commercial software diskette with cellular programming
utilities and two touch-tone dialers with 6.5MHz crystals
installed. "There was never any charge of any damage incurred,
because there wasn't any" he says in utter disbelief -- so the
prosecution filed a charge of intent to defraud.
Prosecuting attorney Chain sharply disagrees that the
Cummings case was merely about "intent." "There is a loss, it's
just that you don't know what that exact amount is," she says.
"Certainly, the potential for extensive losses is there...because
we weren't required to put proof into specific dollar loss doesn't
mean there wasn't loss, and that there wasn't harm."
But does that potential for loss equate to the loss of two
years of a man's life? "Ed would try to convince you that he's
as pure as the new driven snow, but unfortunately that is not
the case," says Varney, who believes that, from the trunkloads
of evidence found in Cummings' home, the punishment fits the
crime.
Cummings laughs at the words, "trunkloads of evidence,"
and says that the "damaging" items Agent Varney introduced
as evidence into court were guilefully exaggerated: lock-picking
devices (just slim jims used for unlocking his car), the explosive
C4 (in reality, dental putty), false identification documents (a
novelty press badge that comically says "pull" on the back
side). And the list goes on, as do the months in prison -- a year
and seven months to date.
Still awaiting an ending is where Cummings' story stands
today. On June 17, the U.S. Third District Court of Appeals
dismissed his federal appeal. For hacker Bernie S., all that's
left now is time to kill.

|