4:47 a.m. International Space Station. Commander William Shepard checks the environmental readings and freezes. Temperature controls offline. Humidity systems failing. Life support showing critical errors. 250 mi below. In a messy bedroom in Florida, 15-year-old Jonathan James hits enter and downloads $1.7 million worth of NASA's most classified software. The same software keeping three human beings alive in the vacuum of space. This isn't science fiction. This actually happened. One teenager, one computer, one night that proved the most powerful military in human history was completely defenseless against a curious kid with an internet connection. But here's the terrifying part. Jonathan James wasn't trying to hurt anyone. He was just bored. In 3 years, this boy would infiltrate NASA, hack the Pentagon, crack Defense Department systems, and expose security flaws that could have crippled America's national defense. All while doing homework and playing video games. The FBI called him the most dangerous juvenile cyber criminal in American history. His neighbors called him a quiet kid who loved Star Trek. His victims called him a security nightmare. Jonathan called it education. But when the largest credit card theft in history went down 8 years later, someone decided Jonathan James was the perfect scapegoat. Someone who had never met him, never spoken to him, never bothered to check if he was actually guilty, and that someone just sentenced a genius to death. This is how America lost one of its most brilliant cyber security minds to a justice system that preferred convenient convictions over inconvenient truths. Summer 1989, Pinerest, Florida. Population 18,000. The kind of suburb where kids still rode bikes without helmets and parents knew their neighbors names. Robert James was debugging code at the kitchen table when his six-year-old son wandered over. Programming was Robert's profession, but for little Jonathan, it looked like magic. Green text flowing across black screens. Commands that made machines obey. >> What does that do, Dad? >> It tells the computer what to think. >> Within months, Jonathan had claimed the family computer. While other first graders were learning to tie their shoes, he was learning to break digital locks his parents thought were secure. The first sign of trouble came quickly. Robert installed parental controls to limit Jonathan's computer time. Reasonable precaution for a kid showing obsessive behavior. Jonathan bypassed them in an afternoon. >> What? How did you do that? >> It wasn't that hard. >> By age 10, Jonathan was reading programming manuals like other kids read comic books. C programming language, Unix operating systems, network protocols, technical documentation that college students struggled with. [Music] His parents worried. Normal kids played outside. Normal kids had friends. Normal kids didn't install Linux on the family computer without permission. Wiping Windows completely. Jonathan, you can't just change everything without asking. >> Linux is better. Windows has too many vulnerabilities. >> He was 12. The arguments escalated. Jonathan would disappear into cyberspace until 3:00 a.m., emerging only for school and meals. His grades suffered not from lack of intelligence, but from boredom. Why memorize dates and formulas when you could explore networks spanning the globe? When his parents finally confiscated his computer, Jonathan did what any rational teenager would do. He ran away. I'm not coming home until you give it back. 3 days later, they gave it back. They thought they were dealing with typical teenage rebellion. They were actually raising a digital savant who was about to become the most wanted juvenile hacker in America. [Music] Summer 1999. Jonathan James, 15 years old, sitting in his bedroom with three monitors glowing in the dark. Outside, Florida humidity pressed against the windows. Inside, air conditioning hummed while Jonathan's fingers danced across keyboards. He wasn't breaking into systems for money. Money was boring. He wasn't stealing credit cards or personal information. That was petty theft. Jonathan was hunting for something more valuable than cash. Respect. In the underground hacker community, reputation came from one thing. Technical skill demonstrated against impossible targets. And what target was more impossible than the United States government? His online handle comrade had been building reputation for months. Small victories first. University networks, corporate databases. Each breach carefully documented. Each vulnerability reported to administrators afterward. Your system has security flaws. Here's how to fix them. But government systems were different. Government systems were fortress walls that weren't supposed to have cracks. >> Sir, our system has been hacked. >> Jonathan found the cracks anyway. The 23rd of August, 1999. 11:47 p.m. Jonathan's screens reflected pale blue light across his face as he navigated through servers he wasn't supposed to access. Bell South telecommunications, Miami Dade school systems, digital territories. He explored like a tourist, leaving no damage behind. for helping us find the vulnerability. >> But tourist visits were becoming routine. Jonathan needed bigger challenges. September brought the challenge that would change everything. Somewhere in cyerspace, Jonathan discovered a server that looked ordinary. Generic IP address, standard security measures, nothing special about the digital doorway he was preparing to walk through. He had no idea he was about to break into the Pentagon. [Music] The Defense Threat Reduction Agency server sat in Dallas, Virginia, 25 mi from Washington DC. Physical security was militaryra armed guards, biometric scanners, layers of protection that would stop any conventional intruder. But Jonathan wasn't conventional, and he wasn't physical. From his bedroom in Florida, Jonathan found what physical security couldn't protect against. lazy password policies and unpatched software vulnerabilities. The intrusion began like all his others. Patient reconnaissance, network mapping, vulnerability scanning. Jonathan didn't smash through digital walls like movie hackers. He found unlocked windows. When he finally gained access, Jonathan installed his digital signature, a backdoor program that would let him return whenever he wanted. Then he began exploring. The DTR server was a gold mine of sensitive information, defense contractors emails, military personnel databases, communications between Pentagon officials and field operatives. For 3 weeks, Jonathan wandered through classified networks like he owned them. He intercepted over 3,000 messages between DTR employees, downloaded usernames and passwords for 19 military computers, gained access to at least 10 systems containing official defense department information, and he did it all from a cluttered teenage bedroom surrounded by Star Trek memorabilia and empty pizza boxes. But Jonathan wasn't done. Pentagon Access was impressive, but it wasn't his endgame. He wanted NASA. The 15th of July, 1999. NASA mission control, Houston. Flight director Patricia Williams reviews International Space Station operations. Everything nominal. Life support systems functioning perfectly. 240 mi above Earth. Commander William Shepard adjusts environmental controls, trusting the software, keeping his crew alive. Neither of them knows that software is about to be stolen. But tonight isn't about exploration. Tonight, he's hunting for treasure. >> Temperature and humidity are normal. Code is compiling. >> To NASA, $1.7 million worth of classified software. To Jonathan, free programming education. Oh no. Oh no. No. >> Sir, security breach detected. >> How bad is it? >> Complete shutdown. 3 weeks minimum. We need to audit every line of code. Jonathan, dinner. >> 5 minutes. Mom, >> he bookmarks a section on atmospheric recycling algorithms and heads downstairs. At the dinner table, he passes the salt while NASA's best engineers work overtime trying to figure out how a teenager breached their most secure systems. Cost of his education, $41,000 in system downtime. But Jonathan's real education is about to begin because someone at NASA just called the FBI. >> We've detected a breach. The system has been compromised. January 26th, 2000. 7:23 a.m. Pinerest, Florida. Jonathan's mother shook him awake. >> Honey, there are men at the door. They say they're from the FBI. >> Through his bedroom window, Jonathan could see unmarked cars lining Weatherstone Drive. Agents in bulletproof vests positioning themselves around the house. Neighbors peering through curtains at the federal operation unfolding in their quiet suburb. The fantasy was over. Jonathan walked to the front door in his pajamas, still half asleep, and came face to face with the consequences of his digital wandering. Defense Department investigators, NASA security officials, FBI cyber crime specialists, local police backup. An entire federal task force had assembled to arrest one sleepy teenager. Jonathan James, you're under arrest for unauthorized access to federal computer systems. They seized five computers. His Palm Pilot, CDROMs, even his Star Trek technical manual, apparently mistaking science fiction for evidence. During interrogation, Jonathan did something that surprised everyone. He confessed immediately. Yes, I accessed those systems. Yes, I downloaded the NASA software. Yes, I installed back doors in the Pentagon servers. No lawyer, no denials, no attempts to minimize his actions. Jonathan treated the federal investigation like a technical debriefing, explaining his methods with the same enthusiasm he'd shown explaining Linux to his parents. Here's how I found the vulnerabilities. Here's what I accessed. Here's what you need to fix. The investigators expected a master criminal. Instead, they found a kid who genuinely believed he'd been conducting educational research. But education was about to become punishment. The 21st of September 2000, Federal Courthouse, Miami. Jonathan James, 16 years old, became the first juvenile in United States history to be sentenced for cyber crime. The prosecutors wanted to make an example. Attorney General Janet Reno herself issued statements about getting tough on juvenile cyber offenders. The message was clear. Hack government systems face adult consequences. But Jonathan was still legally a child. The judge sentenced him to 7 months house arrest and probation until age 18. He was banned from recreational computer use, required to write formal apology letters to NASA and the Department of Defense, ordered to undergo drug testing and counseling. For a kid whose entire identity revolved around computers, the punishment was devastating. No programming, no networking, no digital exploration. Jonathan was cut off from the only world where he felt truly competent. Then he made his situation worse. 6 months into probation, Jonathan tested positive for marijuana. Probation violation. Federal marshals arrived with handcuffs and transport orders. Next stop, federal juvenile detention facility in Alabama. Prison was everything Jonathan had feared. Violent inmates, gang hierarchies, survival by intimidation and alliance. The quiet kid who talked to computers better than people was thrown into an environment where physical strength and social manipulation determined status. Jonathan served 6 months behind bars, emerging changed in ways his family couldn't understand. The curious boy who'd once explained Linux installations with infectious enthusiasm became withdrawn and suspicious. Prison changed him. His father would later say it made him strangely idle. But Jonathan's ordeal with the justice system was far from over. Eight years later, his hacking past would return to destroy his life completely. 2008. Jonathan James, 24 years old, living quietly in the same Pinerest house where his hacking career began. No college degree, no steady employment, no romantic relationships. His mother had died of breast cancer 2 years earlier, leaving him and his brother rattling around in childhood memories. Jonathan's bedroom, the same room where he'd once commanded digital empires. Now it's just depression and dust. Gaming consoles replace hacking equipment. Energy drinks replaced by prescription bottles. Jonathan had kept his promise. No more hacking. No more unauthorized access. No more digital adventures. He traded his reputation as comrade for the anonymous existence of a depressed young adult. But his reputation had a longer memory than he realized. The 17th of January, 2008, TJX company's headquarters, Framingham, Massachusetts. Emergency board meeting. CEO Carol Myowitz faces the cameras with devastating news. We have experienced the largest data breach in corporate history. Over 45 million customer records compromised. FBI Cyber Crime Division, Washington DC agent Lisa Martinez pins photos to a case board. Albert Gonzalez, Christopher Scott, Steven Watt. Complex web of connections spanning 3 years of cyber heists. >> This isn't random. This is organized, professional. We're looking at the most sophisticated hacking conspiracy we've ever seen. >> Evidence room. seized hard drives and encrypted communications. Agents pour over digital forensics following money trails and coded messages. Then they find it buried in encrypted chat logs. References to someone called JJ. Agent Martinez highlighting passages. JJ handled the Office Max job. JJ opened the mailrop in Staten Island. JJ knows the old school methods. Who was JJ? Someone who had helped steal credit card numbers from major retailers. Someone who had opened mail drops for stolen merchandise. Someone connected to the most destructive hacking conspiracy in American history. Database search. FBI computers running name correlations. JJ plus hacking background plus geographic proximity equals match found. Jonathan Joseph James. The agents eyes widen. She pulls up Jonathan's file. First juvenile cyber criminal, NASA hack, Pentagon breach, known associate of underground hacking community. >> Holy comrade. Secure conference room. Senior agents review Jonathan's profile. >> Think about it. He hits NASA at 15. Goes dark after prison. Perfect time to go underground. Get smarter. Connect with bigger players. The timeline fits. TJX happens right when he'd be desperate. No job, no money, mother dying of cancer, and he'd have the skills, the reputation. These guys would trust him. Jonathan's house, same week. He's unaware he's being discussed in FBI conference rooms, playing video games, eating cereal for dinner. No idea that somewhere in Virginia, agents are building a case that could destroy his life. The evidence seems to fit perfectly. too perfectly. JJ Jonathan James. Underground reputation, check. Technical skills, check. Financial desperation, check. Geographic proximity to known associates, check. Agent Martinez presenting to her supervisor. >> It all lines up, sir. James has motive, means, and opportunity. He's connected to this crew. >> But there's one problem with perfect cases. Sometimes they're too perfect to be true. May 7th, 2008. 6:42 a.m. Pinerest, Florida. Secret Service agents surrounded Jonathan's house with the same precision the FBI had used 8 years earlier. Same neighborhood, same shocked neighbors, same federal task force assembling to arrest the same hacker. But this time was different. This time Jonathan knew he was innocent. And this time, his innocence wouldn't matter. The agents searched Jonathan's house for evidence connecting him to the TJX conspiracy, computer equipment, financial records, communications with known hackers, proof of participation in credit card fraud. They found a legally owned handgun, which they left behind. They found notes suggesting Jonathan had contemplated suicide, which apparently didn't concern them. They found depression and isolation and the remnants of a life that had never recovered from his first encounter with federal justice. What they didn't find was evidence. But lack of evidence wasn't stopping the investigation. The TJX case was massive. Public pressure was intense. Media attention was relentless. Federal prosecutors needed convictions. And Jonathan's history made him a perfect target. I honestly honestly had nothing to do with TJX, Jonathan would write in his final letter. Unfortunately, I don't picture the feds caring all too much. The investigation revealed disturbing details about the actual TJX conspirators. Albert Gonzalez had been working as a Secret Service informant while simultaneously conducting the largest data thefts in American history. Christopher Scott was his groundlevel operative, driving around parking lots to breach wireless networks. Steven Watt was the technical genius who wrote custom software for stealing millions of credit cards. The real JJ was likely Steven Watt himself, using the alias Jim Jones in hacker circles. But Jonathan's reputation made him a more attractive target than the truth. So despite the fact that Chris and Albert are the most destructive, dangerous hackers the feds have ever caught, Jonathan wrote, they'll let them off easy because I'm a juicier target. He understood the psychology perfectly. The media loved the narrative of the boy genius turned cyber criminal. The prosecutors loved the precedent of the first juvenile hacker facing adult consequences. The public loved the idea that brilliant teenagers couldn't hack their way out of justice. Nobody cared about actual guilt or innocence. Jonathan had read Agent Steele's guide to getting busted, a survival manual written by a hacker who'd been destroyed by federal prosecution. The guide explained how the criminal justice system worked in practice, not theory. The criminal justice system is a game to be played both by prosecution and defense. And if you have to be a player, you'd be wise to learn the rules of engagement. The rules were simple. Law enforcement would lie, cheat, and manufacture evidence to win cases. Plea bargains rewarded cooperation over honesty. Public pressure influenced prosecution decisions more than facts. Jonathan knew he was going to prison regardless of innocence. The system demanded a conviction, and his history made him the perfect sacrifice. But Jonathan James had spent his entire short life refusing to accept systems he couldn't control. May 18th, 2008, 11:34 p.m. Jonathan's bedroom, 25 ft from where this story began. Jonathan sat at his desk writing letters, to his family, to his friends, to the public that would read about his death in tomorrow's newspapers. He left passwords to his online accounts, instructions for his remaining possessions, explanations for his final decision. I have no faith in the justice system. Perhaps my actions today and this letter will send a stronger message to the public. Either way, I have lost control over this situation and this is my only way to regain control. The gun was a 38 caliber revolver legally purchased and registered. Jonathan had owned it for protection, never imagining it would become his escape route from a system that had already destroyed him once. Remember, it's not whether you win or lose, it's whether I win or lose. and sitting in jail for 20, 10, or even 5 years for a crime I didn't commit is not me winning. I die free. At 11:47 p.m., Jonathan James performed his final hack, not into computer systems or government networks, but into the basic assumption that justice would eventually prevail. He placed the gun against his right temple and pulled the trigger. The boy who had broken into the Pentagon at 15, who had accessed NASA's most sensitive systems from his bedroom, who had become America's first juvenile cyber criminal, was dead at 24. He had never been charged in the TJX case, never been tried, never been convicted. He died purely from the fear of being railroaded by a system that valued convictions more than truth. The 25th of March, 2010, Boston Federal Courthouse. Albert Gonzalez, the real mastermind behind the TJX conspiracy, was sentenced to 20 years in federal prison. Christopher Scott received 7 years. Steven Watt, the probable JJ from the evidence, got 2 years. The Secret Service had seized $1.2 million in cash from a barrel buried in Gonzalez's backyard. The investigation had uncovered a sophisticated international criminal network that stole data from over 180 million credit and debit cards. It was the largest identity theft case in American history conducted by criminals who were already under federal surveillance. Jonathan James had nothing to do with any of it. But by then it didn't matter. The boy genius who could have helped secure the systems he learned to penetrate was gone. The young hacker who tried to help administrators fix vulnerabilities he discovered was dead. The teenager who' represented both the promise and the danger of the digital age had become a casualty of the very system he'd accidentally learned to breach. The Jonathan James file is closed, but the archives hold hundreds of unsolved cases. Want access to the next dossier? Hit subscribe.