Hacker breaks into secretary of state’s site

Tuesday, Nov. 30, 1999 | 10:50 a.m.

CARSON CITY -- The state attorney general's office confirmed Monday it has started a criminal investigation into the hacking of the secretary of state's website.

Chief Deputy Attorney General Kevin Higgins, in charge of the high-tech crime prevention program, said it is the first case of its kind to come to his attention.

Secretary of State Dean Heller said the office's web page was shut down for five hours Nov. 22. He said the home page was defaced but there was no permanent damage.

Heller said the identity of the hacker may never be known. The illegal entry was discovered while the individual was still in the system. And in an exchange of e-mail, the only clue to the identity of the individual was the statement, "I love Las Vegas."

Since then, the office has been working to shut down any "back doors" that allow unauthorized people into the system.

Beau Pankiw, information technology coordinator in Heller's office, said the hacker "had to come in through the state firewall," which was developed by the state Department of Information Technology, a security system to keep people from outside the system making unauthorized entry.

But Marlene Lockard, director of information technology, said it is "highly unlikely" any outsider penetrated the state's firewall. She believes it was an "inside job" -- somebody in state government who was able to find a weakness in the secretary of state's own system.

To back her argument that the state is secure, Lockard cited the example of the state Department of Education, which hired an expert hacker to break into the state network developed by her agency. She said that person was unable to penetrate the system.

Pankiw said the state has joined some distinguished organizations as hacker victims.

"We have joined the ranks of some of the most popular websites in the world: CIA, White House, almost every state, etc., who have been hacked into and defaced.

"The good part is that we were able to catch it before it got too bad." Pankiw said.

Pankiw said he believes the website intruder was "a friendly hacker, not malicious." The "friendly" hacker, Pankiw said, wants to expose weaknesses in a system -- show that the manufacturer isn't as good as he thinks. Higgins said some of these hackers illegally enter the systems "just for bragging rights."