Kevin Mitnick, who at the dawn of widespread internet usage in the mid-1990s became the nation’s archetypal computer hacker — obsessive but clever, shy but mischievous and threatening to an uncertain degree — and who later used his skills to become “chief hacking officer” of a cybersecurity firm, died on Sunday in Pittsburgh. He was 59.
Kathy Wattman, a spokeswoman for the cybersecurity company he partly owned, KnowBe4, said the cause was pancreatic cancer.
Described by The New York Times in 1995 as “the nation’s most wanted computer outlaw,” Mr. Mitnick was a fugitive for more than two years.
He was sought for gaining illegal access to about 20,000 credit card numbers, including some belonging to Silicon Valley moguls; causing millions of dollars in damage to corporate computer operations; and stealing software used for maintaining the privacy of wireless calls and handling billing information.
Ultimately, he was caught and spent five years in prison. Yet no evidence emerged that Mr. Mitnick used the files he had stolen for financial gain. He would later defend his activities as a high stakes but, in the end, harmless form of play.
“Anyone who loves to play chess knows that it’s enough to defeat your opponent,” he wrote in a 2011 memoir, “Ghost in the Wires.” “You don’t have to loot his kingdom or seize his assets to make it worthwhile.”
At the time of Mr. Mitnick’s capture, in February 1995, the computer age was still young; Windows 95 had not yet been released. The Mitnick Affair drove a fretful international conversation not just about hacking, but also about the internet itself.
“As a media celebrity, the internet is now seriously overexposed,” the Times columnist Frank Rich complained in March 1995, blaming the hoopla surrounding Mr. Mitnick.
Mr. Mitnick’s most spectacular crimes were his attempts to evade capture by the authorities. In 1993, he gained control of phone systems in California that enabled him to wiretap the F.B.I. agents pursuing him and confuse their efforts to track him. At one point they raided what they thought was Mr. Mitnick’s home, only to find there a Middle Eastern immigrant watching TV.
On another occasion, using a radio scanner and software, Mr. Mitnick discovered that F.B.I. agents were closing in on him. He fled his apartment, and when the authorities arrived, they found a box of doughnuts waiting for them.
Mr. Mitnick ran into trouble on Christmas Day 1994, when he stole emails from a fellow hacker named Tsutomu Shimomura and taunted him. When he learned of the attack, Mr. Shimomura suspended a cross-country ski trip he was on and volunteered to help track down Mr. Mitnick.
What The Times called a “duel on the net” ensued. Mr. Mitnick was the amoral savant, praising the tech skills of his adversary, while Mr. Shimomura was the freelance gunslinger with a conscience, accusing Mr. Mitnick of violating the codes of the online community.
“This kind of behavior is unacceptable,” he told The Times.
Mr. Shimomura, using software he had designed that reconstructed a user’s computer sessions, along with cellphone scanning equipment, proceeded to locate Mr. Mitnick.
Mr. Mitnick was finally captured by the F.B.I. and charged with the illegal use of a telephone access device and computer fraud. “He allegedly had access to corporate trade secrets worth millions of dollars,” Kent Walker, an assistant U.S. attorney in San Francisco, said at the time. “He was a very big threat.”
In 1998, while Mr. Mitnick awaited sentencing, a group of supporters commandeered The Times’s website for several hours, forcing it to shut down. A Times technology reporter, John Markoff, also became part of the imbroglio, reporting soon after the arrest that Mr. Mitnick had gained access to Mr. Markoff’s email as revenge for Mr. Markoff’s reporting on his activities.
Mr. Mitnick reached plea agreements in 1996 and 1999, which included pleading guilty to computer and wire fraud. He was released from prison in 2000 on the condition that he refrain from using a computer or cellphone for three years without the permission of his probation officer.
After leaving prison, Mr. Mitnick read out a statement of self-defense. “My crimes were simple crimes of trespass,” he said. “My case is a case of curiosity.”
Kevin David Mitnick was born in the Van Nuys section of Los Angeles on Aug. 6, 1963, and grew up in that city. His parents, Alan Mitnick and Shelly Jaffee, divorced when he was 3 years old, and he was raised by his mother, a waitress.
Mr. Mitnick was a heavyset and lonely boy who, by the age of 12, had figured out how to freely ride the bus using a $15 punch card and blank tickets fished from a dumpster. In high school he developed an obsession with the inner workings of the switches and circuits of telephone companies. He pulled pranks at a high level, managing to program the home phone of someone he did not like so that each time the line was answered, a recording asked for a deposit of 25 cents.
He showed a willingness to violate the law flagrantly, breaking into a Pacific Bell office as a teenager and stealing technical manuals.
In the late 1980s, he was convicted twice of hacking into corporate computer systems, leading to time in prison and counseling for addiction to computers.
Yet Mr. Mitnick often took a surprisingly old-fashioned approach to high-tech thievery. He frequently impersonated authority figures over the phone and in email, persuading low-level company officials to hand over passwords that gave him access to secret information.
Mr. Mitnick’s first marriage, in his early 20s, ended quickly in divorce. In 2015, he met Kimberly Barry at a cybersecurity conference in Singapore, and the two soon began dating. They married last year, after he learned of his cancer diagnosis. She survives him and is pregnant with his first child.
The year Mr. Mitnick was released, The Times reported on an “unusual arrangement” in which he was hired by a California college he had “victimized” to consult on cybersecurity. Mr. Mitnick called it “hire the hacker.”
Now it is commonplace for hackers to find work by exposing the vulnerabilities of governments and corporations. KnowBe4, the company Mr. Mitnick partly owned, describes itself as “the provider of the world’s largest security awareness training.” The company says that a cybersecurity training curriculum that Mr. Mitnick designed is used by more than 60,000 organizations.
Writing in The New York Times Book Review about data privacy, the journalist and author Amy Webb in 2017 identified that once-hunted hacker with an epithet that would have baffled members of law enforcement and newspaper readers in the 1990s: “the internet security expert Kevin Mitnick.”
Livia Albeck-Ripka and Orlando Mayorquin contributed reporting.
