Searching for Susy Thunder

In partnership with Epic Magazine

She was known, back then, as Susan Thunder. For someone in the business of deception, she stood out: she was unusually tall, wide-hipped, with a mane of light blonde hair and a wardrobe of jackets embroidered with band logos, spoils from an adolescence spent as an infamous rock groupie. Her backstage conquests had given her a taste for quaaludes and pharmaceutical-grade cocaine; they’d also given her the ability to sneak in anywhere.

Susan found her way into the hacker underground through the phone network. In the late 1970s, Los Angeles was a hotbed of telephone culture: you could dial-a-joke, dial-a-horoscope, even dial-a-prayer. Susan spent most of her days hanging around on 24-hour conference lines, socializing with obsessives with code names like Dan Dual Phase and Regina Watts Towers. Some called themselves phone phreakers and studied the Bell network inside out; like Susan’s groupie friends, they knew how to find all the back doors.

When the phone system went electric, the LA phreakers studied its interlinked networks with equal interest, meeting occasionally at a Shakey’s Pizza parlor in Hollywood to share what they’d learned: ways to skim free long-distance calls, void bills, and spy on one another. Eventually, some of them began to think of themselves as computer phreakers, and then hackers, as they graduated from the tables at Shakey’s to dedicated bulletin board systems, or BBSes.

Susan followed suit. Her specialty was social engineering. She was a master at manipulating people, and she wasn’t above using seduction to gain access to unauthorized information. Over the phone, she could convince anyone of anything. Her voice honey-sweet, she’d pose as a telephone operator, a clerk, or an overworked secretary: I’m sorry, my boss needs to change his password, can you help me out?

In the early ’80s, Susan and her friends pulled increasingly elaborate phone scams until they nearly shut down phone service for the entire city. As two of her friends, Kevin Mitnick and Lewis DePayne, were being convicted for cybercrime, she made an appearance on 20/20, demonstrating their tradecraft to Geraldo Rivera. Riding her celebrity, she went briefly legit, testifying before the US Senate and making appearances at security conventions, spouting technobabble in cowboy boots and tie-dye. Then, without a trace, she left the world behind.

I went looking for the great lost female hacker of the 1980s. I should have known that she didn’t want to be found.

Few of Susan’s old friends have remained in touch with her; those who have are tight-lipped. “We have protocols,” one tells me. “No chance,” says another. That’s how she likes it. She’s kept herself well-scrubbed from the public record. No social media, no website. Fragments scattered across the web indicate a peripatetic career: proposition poker player at the Las Vegas Stardust, city clerk of California City, eBay dealer of ancient Roman coins. It takes me nearly a year to track her down. In the end, it’s an ex-boyfriend who leads me to her.

In 1981, Scott Ellentuch — known online as “Tuc” — was the teenage system operator of a BBS frequented by phreakers. One day, a message popped up on his screen from a user named Susan Thunder. She was asking about his system. Trying to impress her, Scott told Susan his BBS was highly secure, locked in a vault 10 feet underground, and served by a single phone line. “Scott, you know that’s not true,” she responded. “Let’s get off here and talk on the phone.” In the other room, he heard the phone ring, and then his mother’s voice, yelling — “Scott, phone for you!”

Susan took Scott under her wing. “She’d talk about systems she’d compromised, how to do it, how to trick people into thinking you’re someone else to get information,” he remembers. “She was a mix of smart, technical, connected, and able to absorb information like a sponge.” She seemed to know all the elite hackers of the day, and she introduced him around.

Now, it’s Scott who holds the keys to Susan. Before I can talk to her, he tells me, I have to prove myself worthy.

Susan Headley was just a kid when her father moved her family into a two-bedroom house in La Crescenta and walked out. After he left, she retreated into the phone; she’d sit curled up with the handset for hours, searching for a voice, any voice, at the other end of the line, even if it was only the voice of an operator, asking to whom she’d like to be connected. Sometimes she’d pick up the receiver just to hear the dial tone, to hear the “click, click, click” of the rotary dial.

To Susan, talking on the phone was a basic magic: how could she reach her cousin in Chicago all the way from California? She thought only God could hear people from so far away. She dialed numbers at random, placing accidental long-distance calls that turned up on the family phone bill. She had whispered conversations with late-night radio DJs. When her mom installed a lock on the rotary dial, Susan figured out that by tapping repeatedly on the handset’s button rest, she could speak the secret clicked language of the telephone itself.

She dreamt of becoming a telephone operator or, better yet, the recorded voice that plays when a call is disconnected: I’m sorry, please hang up and try your call again. That way, she could live inside the phone forever.

Then, when Susan was nine, her mom started dating a Navy officer. One day, while her mom was at work, the Navy officer tried to lure Susan into a detached bedroom in the back of the house. Eventually, he forced her. Susan attempted to explain what was happening to her mom but had no language for the parts of her body that he had touched. Her mother was strictly religious; shame made it impossible to communicate. When she tried to convey that the man had been doing “something dirty,” her mother did nothing.

Susan disappeared further into the phone, where she could be someone else. Prank calls made her feel powerful, and at first, they were innocent enough: Is your refrigerator running? Well, you better catch it. But when one of her exasperated targets called her a small-brained little twerp, Susan got mad. In retribution, she called the phone company and, posing as the woman, had her phone number changed. It was her first time misrepresenting herself. She was shocked to discover how easy it was.

When the Navy officer moved on to her younger sister, Susan decided she needed to take more drastic action. She told her mom that he was still doing the dirty thing — only now, she embellished the truth with more vivid details about how he had pulled her hair and punched her, too. Sex was taboo; violence was more legible. Still, it wasn’t until her brother caught the officer molesting their sister that the police were finally called.

Susan’s mom told the cops about the violence, both real and invented. But when the prosecutor demanded a polygraph test, Susan was suddenly terrified that the whole case would go away if they discovered she’d told some half-truths to get her mom’s attention. It wasn’t just her own future at stake, but her sister’s, too. I have to pass that polygraph, she thought.

By then, she was 11. She took the bus to the Central Library in downtown Los Angeles, an imposing Art Deco tower with cavernous tiled hallways. She made a beeline to the card file to look up polygraph testing and spent the day reading technical manuals, researching how the tests worked. She learned that the electrodes would measure her blood pressure and that they would be sensitive enough to detect sweat on her skin. She read about the baseline questions that officials would ask her before the test began in order to establish readings for her bodily responses. When the time came for the polygraph, she knew exactly what to do.

The important thing was to invalidate the baseline so that her readings couldn’t be meaningfully compared against one another. When she was asked to tell a lie, she would tell the truth. When she was asked to tell the truth, she would lie. She manipulated her breathing, balled her hands into fists against the chair, and pressed her feet hard against the floor, causing her hands to sweat and her blood pressure to spike. The polygraph test was inadmissible. The case was sent to trial, and she testified in open court against her abuser. He was charged with a felony and dishonorably discharged from the military. It wouldn’t be the last time a man hurt Susan, but it wouldn’t be the last time a man paid the price for it, either.

Scott Ellentuch and I correspond for nearly three months before he agrees to give me Susan’s email address. He wants to know my intentions. He wants to know what I already know. He warns me, repeatedly, that Susan is a flake. That she’s no feminist, if that’s what I’m looking for. That she isn’t interested in talking to the media. That she barely responds to him, let alone to strangers. Still, he says, he’ll pass on my messages.

During the early days of quarantine, the search for Susan had kept me occupied. But as the doldrums of that spring turned to a blistering wildfire summer in Southern California, it had begun to occupy me. Looking for the great, lost female hacker of the ’80s had become a noble distraction from the sadness and horror of that summer. I follow up with Scott, my only lead, relentlessly. Why, he asks, do I want to talk to her so badly?

I tell Scott that Susan practiced, even pioneered, techniques still widely used by hackers. That a woman who broke into systems over the phone subverts the popular imagination of a hacker as some hoodie-sporting guy at a keyboard. I tell him that history has ignored women for too long and that when we fixate on the people who build systems and forget those who maintain, moderate, and use — or, in this case, exploit — those systems, we’re missing the messy realities of how technology actually evolves. We’re missing, too, how profoundly the human is entangled in the machine.

Finally, Tuc gives me her email address. It’s a Gmail account; I feel like an idiot. Humbled, I write to Susan. “By now I think Tuc has probably told you about my project and my intentions,” I begin. I tell her that I’d spent the year researching hacker and phreaker culture, reading everything I could about her, and about the other — far more famous — hackers of her era. I tell her I think that her place in this history is just as important as theirs and that I would really love to get the story right, but that I can’t do that without her help.

Another month passes in silence.

When she was 14, Susan ran away from home, trading the suburbs for the glittery clubs and grimy boulevards of 1970s Hollywood. She was a junior-high dropout with dreams of becoming a teenage rock groupie — a “baby groupie,” as they were known in those days. All she had were street smarts and her body, six-odd feet in hot pants and platforms.

On one of her first nights in the city, she befriended some male sex workers who hung around a diner called the Gold Cup on Hollywood and Las Palmas. Two beat cops landed on their little group. “Oh, I see we have someone new around town,” said the first, affecting a fey accent. “Well, aren’t you a pretty thing?” said the second, shoving his baton into her shirt and yanking it down, hard, breaking the buttons and exposing her chest to the air.

It was the beginning of a new era. Stripped half-naked in the Hollywood neon, she was no longer a troubled little suburban kid named Susan Headley. To survive these streets, she needed to become somebody else. Somebody who could handle such casual brutality. Someone in control. Someone the cops — and anyone else who crossed her — would think twice about hassling. Soon after, she became Susan Thunder. The name was a benediction: her maternal grandmother, a spiritual woman who’d raised 10 kids through the Dust Bowl, had always told her she’d been “blessed by thunder.”

She’d rarely felt blessed. At 14, Susan had already been abused by two men: after the Navy officer, her mother married an architect who crept into her room at night. Rumors swirled around her junior high, making her a pariah. The other kids teased and bullied her — even booing her during school assemblies. She was kicked off the drill team, made understudy in the school play. She begged her mother to advocate for her to the principal. They think I’m such a piece of shit, she cried, that they can do whatever they want. Her mom slapped her — hard — for saying “shit.”

But that kind of thing wouldn’t happen to Susan Thunder. Susan Thunder could say and do whatever she wanted because Susan Thunder was a hero’s name, and she was done being a victim.

In October, without warning, it arrives: an email from Susan. I hesitate to open it. By then, the search had taken me on a meandering path through hacker forums, poker leaderboards, and numismatist newsletters; I’d talked to phreaks and historians, groupies and coin collectors, academics and hackers. I’d sent countless emails to nowhere. I’d come to embrace the fruitlessness, accepting that I would likely never find Susan, but carried on because there was nothing else to do. It was a kind of absolution.

But now, here she is in my inbox — like it’s nothing at all. I open the email with one eye closed.

“I’m sorry it has taken me so long to respond to you,” her email begins. She outlines her terms. She’ll speak to me but only over the phone. She’s worked hard to keep her likeness off the internet, and she doesn’t want to take the risk of messing that up now. She will talk to me between 3PM and 5PM Central Time. During these hours, she will tell me about her social engineering exploits, but she won’t speak freely about the things she did with other hackers, especially not Kevin Mitnick, who is probably the most famous hacker in the world. She and Kevin have, she explains, “a longstanding mutual NDA.”

Finally, she asks if I have a landline. She says it would be better that way because she’ll talk the battery dead on my iPhone. When I read that, I laugh, but then she nearly does.

Back when she was a groupie, Susan got business cards printed:

Susy Thunder

Specializes in Parties with Scottish, British, and Irish Rock Bands

She claims to be one of only three women to have slept with all four Beatles, securing the trickiest, Paul McCartney, through an elaborate pretext that involved having his wife Linda whisked away in a limo for a staged photoshoot. When she was still underage, she hitch-hiked to Vegas with Johnny Thunders (no relation) from the New York Dolls. In a 1979 tabloid tell-all, she’s pictured with Andy Gibb, Donny Osmond, and Ringo Starr. Once, tearing down the Pacific Coast Highway in a convertible Mercedes, “flying on coke” with Mick Ralphs, the guitarist for Bad Company, she decided she must be immortal — a theory she’d test with enough overdoses that she considers herself lucky to be alive today.

Weekdays, she worked the switchboard at an answering service, which gave her access to unlisted phone numbers and plugged her into the day-to-day whereabouts of musicians, record company executives, and managers (“A groupie’s goldmine,” she told the tabloid). Leafing through her records, she took note of the PR agencies and management companies that represented her favorite bands, which were usually listed on the sleeve. When those artists came to town, she’d call venues pretending to be, say, “Delilah from the P and Q Management agency,” requesting some last-minute additions to the guest list. On the day of the show, she’d slink down to the artist entrance and grab her backstage pass. When all else failed, she carried a clipboard. Clipboards, she discovered, could get you in anywhere.

As she sweet-talked security guards, triangulated rock stars’ whereabouts, and pulled phone scams for backstage passes, Susan was following an instinct she’d had since childhood. When she was just a little kid, she’d beaten a polygraph test. It didn’t matter that her stepfather was a Navy man. It didn’t matter that her own mother didn’t believe her. It didn’t even matter that the system was rigged against her, and other survivors of abuse, from the outset. Its bureaucracy was inflexible, inhuman, but that rigidity made it vulnerable, too. There were ways to use the rules to break the rules. The older she got, the more she saw the polygraph as a lesson, revealing, to her, the hidden truth of the world: that everything is a system, and every system can be cracked.

The desert becomes a flood. Susan and I talk weekly for three hours at a time. It’s been so long since I’ve had a relationship with anyone over the phone. I’m no longer accustomed to feeling so close and so far away at once. I listen carefully, scribbling notes. She takes her time; she seems to have plenty of it. She tells me long, meandering stories in sotto voce murmurs. It feels as though she has not spoken to anyone about these things in a long, long time. I give up on asking questions and settle into listening, my iPhone burning my cheek. Without even recognizing it, I’ve made the mistake that so many others have before me: I picked up the phone and entered her domain.

The man beneath her boot whimpered happily. Working as a dominatrix at a BDSM dungeon in the San Fernando Valley was better than streetwalking, and the money was stupendous. At the Leather Castle, she called herself Jeanine; newly sober and happy to be alive, she held the business end of the whip. She charged men hundreds of dollars for a half-hour session just to lick her feet, more than enough money to buy all the computer gear she wanted.

Her tiny apartment in Van Nuys was fully kitted out — she called it the hacker den. She set up her own four-way phone conference line, Instant Relay, and spent her free time posting to bulletin board systems about telephone loopholes and vulnerabilities. In her first posting to the phreaker forum 8BBS, she announced herself with gusto. “I am new in computer phreaking and don’t know that much about systems and access. I have, however, been a phone phreaker for quite a while and know a lot about the subject of telephones…by the way, I am a 6 foot 2 inch blonde female with hazel eyes, weight 140, and I enjoy traveling a lot.”

Needless to say, she raised eyebrows — there weren’t many leggy blondes in the phone-hacking scene. But she was far from being Los Angeles’ most visible phreaker. That title went to Lewis DePayne, a 20-year-old USC student known in the telephone underground as “Roscoe.” He’d recently been the subject of a cover story in LA Weekly, in which he’d boasted that he could use his mastery over the phone network’s electronic systems to void bills, score free airplane tickets and hotel reservations, and alter credit scores. Lewis was a savant and, like Susan, liked being in control. The LA Weekly reporter wrote that he dialed phones “like Bobby Fischer moves chess pieces.”

Lewis ran a conference line, too — HOBO UFO (462-6836) — out of a Hollywood apartment strewn with phone manuals, computer parts, and recording gear. Most of his callers were high school and college-aged kids who’d heard about HOBO UFO through the grapevine; Lewis listened to their ambient chatter in his apartment day and night. He was the Wizard of Oz, and Susan always made it her business to see behind the curtain. She called up HOBO UFO, and when she popped on the line, Lewis remembers, she played it cool. She acted as though she already knew Lewis and like he should know who she was, too.

When Lewis first saw Susan in person, he clocked her immediately. Her descriptions of herself were accurate: she was very tall, looking down through feathery blonde bangs on the six-foot DePayne. He asked her what she did for a living. With uncharacteristic reticence, she didn’t mention the Leather Castle. Instead, she told him she was a sex therapist. He perked up.

They started spending time together, swapping notes and sharing gear. One object of mutual fascination was the TI Silent-700, a portable terminal with an acoustic modem and two rubber cups you could sock a phone handset right into. Some nights, Lewis brought Susan to the USC computer center, and she watched him surf networks around the country. He introduced her to his close friend, Kevin Mitnick, a teenage phreaker and Ham radio operator who would later spend most of the ’90s on the run from the feds.

Lewis wasn’t the kind of guy Susan normally went for. He was straight-laced, almost puritanical, favoring coffee, donuts, and late nights browsing electronic databases over sex, drugs, and rock ‘n roll. He kept diligent records, filling notebooks with the names of local telephone operators and access codes that could grant him access to the computer systems of airlines, private corporations, Western Union, and the DMV. Gathering this information was its own form of power. Knowing how to use it made this pale, serious young man one of the most dangerous people in Los Angeles.

Susan fell in love.

She and her new friends cruised the city at night, searching for unsecured dumpsters outside of phone company offices. The manuals and interoffice memos they pilfered from the trash were maps to the parts of the phone network that were hidden from view. By leveraging the information they found dumpster diving — everything from internal jargon to access codes and employee names — they were able to pull more complex and ambitious scams.

It helped Kevin and Lewis to have a female collaborator; targets trusted her more easily over the phone, especially when she played a telephone operator, who were, in those days, all women. It was a role Susan played gladly. Misrepresentation and subterfuge came easily to her. As a social engineer, she always considered herself to be at least their equal. Lewis, who was always more interested in the technical than the human side of their craft, disagreed.

Hackers are folkloric figures. They’re tricksters, bathed in the blue light of glowing screens and green mists of binary code. For 30 years, they’ve been romanticized in films, mashing keyboards, pounding soda, racing progress bars, shouting, “I’m in!” In the cultural imagination, they’re often antisocial, malevolent figures — usually male — whose obsession with the technical minutiae of computer systems leaves them wholly under-equipped for human interaction.

But few major hacks are pulled off without some old-fashioned social skills. Passwords are hard to crack, but people are easy. In the summer of 2020, just as I was trying to convince Scott Ellentuch to grant me access to Susan Thunder, a group of teenage hackers was able to crack 130 of Twitter’s most closely guarded accounts by manipulating Twitter employees into granting them access to internal company tools.

As Susan explained in a keynote talk at the 1995 DEFCON hacker conference in Las Vegas, if more than one person has access to a system, they can be played against one another. And if only one person has access, they’re still vulnerable, simply by virtue of being human. People are, on average, trusting and predictable; they respect authority, are keen to appear helpful, and aren’t very good at spotting deception. They might fall for a phishing attempt or ignore someone rifling through company dumpsters. They might be tempted by a USB stick labeled “salary information” and install malware on their laptop. They can be bilked, bamboozled, and bribed. Nobody knows that better than a social engineer.

“Whether I… perform some kind of ruse to gain access, or whether I just go seduce the guy and blackmail him afterwards… if I want to get into that computer, I’m going to get into it,” Susan said at the conference, as her almost entirely male audience laughed nervously. “That’s one advantage women hackers have over you guys,” she added, “if you’re willing to use it.”

Not long after Susan and Lewis started hanging out, she discovered that he’d been lying to her. On nights he claimed to be on campus, he’d been with another woman, a law student at USC. When it blew apart, she says, they both dumped him.

Lewis remembers it differently. He claims they never dated and that they were merely acquaintances — associates, maybe, for a while. He stopped hanging out with Susan, he says, because something about her felt off. Things didn’t add up to him. She never talked about her job, her psychology practice. It gave him an odd feeling.

One night, Lewis says, he and Kevin decided to solve this mystery using an old-fashioned social engineering technique — tailing Susan’s car. They followed her into the Valley until she pulled up to a place in Van Nuys called the Leather Castle. Obviously, they got the phone number.

They dialed the Leather Castle and reached an answering machine. Thank you for calling, a woman’s voice began. Describing the answering machine message, 40 years later, Lewis still drops his voice an octave for effect. Thank you for calling the Leather Palace. The sultry bedroom voice in the recording was, unmistakably, Susan’s.

Kevin and Lewis were beside themselves. They were used to penetrating the city’s telephone system, but that was impersonal joyriding compared to this: the most notorious woman in the California hacker underground outed as a sex worker. The details, to them, were delicious. Lewis hung up and called back, suction-cupping a tape-recording device onto his telephone handset.

It wasn’t long before his tape was making the rounds. In March of 1981, Lewis made an announcement to 8BBS, the phreaker forum: he would “expose” Susan, broadcasting the tape to anyone who called him. Callers could also hear “various obscene messages” she had left on his machine and get instructions for ordering a Xerox copy of an interview Susan had given to a “Hollywood fairy magazine” during her groupie years, which revealed, among other things, that “SHE WAS UNSUCCESSFUL AT GETTING DONNY OSMOND TO LAY HER!!!”

For Susan, this was a greater betrayal than their romantic rift. Lewis wasn’t just emotionally unavailable — he was an asshole. Their breakup metastasized. Susan claims that Lewis tapped her phone; Lewis says Susan made harassing phone calls to his mother. Susan called up Lewis’ workplace and ratted him out for joyriding on company computers; Lewis pressed charges for telephone harassment. On the BBS, they accused one another of collaborating with law enforcement and traded so many insults that fellow phreakers begged them to stop. But the flame war couldn’t be doused. ​​In late March, Lewis posted a veritable jeremiad:

HIPPO-HIPS, YOU THINK YOU CAN DAMAGE ME? HA HA, PHONES ARE NOT MY ONLY LIFE, YOU’RE REALLY POWERLESS, AND THAT’S WHY YOU DO WHAT YOU DO. IF I GET ANGRY ENOUGH, I WILL HAVE TO INSERT MY FIST DOWN YOUR THROAT AND THAT WILL PUT AN END TO YOUR SHIT…KEEP IT UP AND YOU’LL BE EATING MOLARS AND INCISORS FOR LUNCH, YOUR OWN.

Over the course of our conversations, Susan softens. She tells me about her insecurities. She doesn’t really know how to relate to people on a normal human level, she says. Maybe it’s the childhood trauma, but she feels like she’s spent most of her life in a dissociated state. People just don’t like her, she says. She found a medication recently that has given her the capacity to understand herself a little more clearly. “I see myself now and my motives,” she says. “Let’s just say that I wouldn’t have wanted to be someone like me if I had a choice.”

The other hackers she ran with were keen on destruction. They wanted to cause chaos, sending the city’s 411 service into an endless loop or taking down the entire 213 area code. She wasn’t interested in that. All she wanted, at the end of the day, was a little control. She wanted to know that if anyone ever fucked with her again, she could do something about it. If an asshole cut her off on the freeway, or worse, she could tamper with his DMV records, or worse. She didn’t even have to go through with it — just knowing that she could, often, was enough.

“I’m not going to live my life being battered down with a mole hammer if I stick my head above ground, by some of these people that think, ‘Oh, you’re just a little person, I can bash you back down,’” she says. “Well, you know what? They’re going to find out that I was a dragon wearing a false head.”

One evening, the previous December, before Susan and Lewis went to war, he came over to her little hacker den. They spent hours posted up at the terminal, accessing a system remotely. This was an unremarkable enough date for a pair of phreaks, but Lewis was more charged up than usual. He was in the zone — deep in a system and practically cackling at the screen.

Lewis, Susan alleges, was accessing a database belonging to US Leasing, a San Francisco company that leased electronic equipment and computers. The US Leasing system ran on RSTS, an operating system so user-friendly it was begging to be hacked. Susan was eager to understand the finer points of RSTS hacking — she’d just spent a chunk of her dominatrix money on the full set of manuals — and snuggled next to Lewis, reading over his shoulder. She didn’t understand a lot of what she was seeing, but she did understand one word: Deleted. She asked Lewis what he was doing. Just getting a little revenge, he said.

At the end of the night, as Lewis was leaving, Susan asked if she could access the system on her own in order to teach herself how to navigate RSTS. He stood in the doorway of her apartment, deciding whether or not to trust her. Finally, she says, he tossed her his handwritten notes, which included the number for US Leasing and several internal company passwords. After he’d gone, Susan tried to log in, but the system was down. In fact, there was nothing left of it at all.

At the time, she’d been impressed. Now, in light of Lewis’ betrayal, that night took on new significance. She rifled around her apartment. The scrap of three-ring binder paper was still there, shuffled between miscellaneous notes in a folder under her bed. She’d always been a pack rat — for once, it had come in handy. She sent a Xeroxed copy of Lewis’ notes to the FBI.

She included a letter in which she told the feds she wanted immunity from prosecution. That she wasn’t involved with the US Leasing hack — not as an active participant, anyway — but that she had sat next to the person who’d done it. She told them they could call her at her mom’s house.

By then, the incident was a year old, but it was still of interest to the authorities. Lewis, Kevin, and another phreaker named Mark Ross were under active investigation by the Los Angeles District Attorney’s Office for physically burgling a Pacific Bell building downtown, making off with a manual for the phone company’s internal database, COSMOS. Susan knew about that break-in — and now she had physical evidence of an electronic break-in, possibly perpetrated by the same people. The DA gave her immunity in return for her testimony. In subsequent news stories about the case, she was identified only as a “female conspirator.”

It would become one of the first prosecutions for an electronic intrusion under California’s only two-year-old computer crime statute. Kevin, a juvenile, did a year’s probation, while Lewis served 150 days in jail. Susan hoped it might humble them, but the experience only bolstered their notoriety. They became instant legends; Kevin’s journey from teenage phreaker to shadowy infiltrator of corporate systems is central to modern hacker mythology. Today, he runs his own security firm and counts among his clients Microsoft, JP Morgan Chase, and the government of Japan. He declined to speak to me for this story.

Lewis, meanwhile, made a fortune managing software infrastructure for porn sites on the early web and became a major figure in the world of pick-up artistry, eventually writing a book about how to use Neuro-Linguistic Programming techniques to seduce women online. He told me I could call him anytime.

Over the phone, Susan tells me all kinds of things. That she used her social engineering skills to sneak past military checkpoints and into Area 51. That she went dumpster diving with a young Charlie Sheen. That she figured out how to set off US missiles from a phone booth—a feat Kevin Mitnick was once accused, famously, of being capable of pulling off. That she once sprang an accomplice from jail over the phone, posing as a clerk from a different precinct.

Susan has an aptitude for the plausibly outlandish: the more far-fetched something sounds, the more detail she’s able to provide. It’s not lost on me, as she tells these stories, that I’m on the phone with a phone phreaker or that I’m attempting to tell the true story of an expert deceiver. When she tells me about a social engineering exploit, she does so methodically, outlining each step of the scheme until its conclusion seems all but inevitable. Like every con artist who has ever worked a mark, she’s thought of all the angles.

Susan doesn’t like the term “social engineering.” She thinks it has the whiff of fascism to it; at DEFCON, she said social engineering is “what Hitler did to the Jews.” She prefers the term “psychological subversion,” her own neologism, which she shortens, in conversation, to “psych-sub.” Of course, at the end of the day, it’s all just lying.

After two months of talking on the phone, Susan tells me about her last big psych-sub.

It happened not long after Kevin and Lewis were sentenced. She’d gotten a straight job at a company that made novelty phones; at home, she passed the time dialing the nascent internet with a Snoopy handset. Even without her former co-conspirators, she was hooked on the power trip she’d experienced from hacking and phreaking. There was so much still out there, off-limits. She decided to pull one final job — by herself. She knew exactly what it would be.

Back then, everyone had a landline, but people in the public eye kept their phone numbers out of the Yellow Pages. Susan knew the phone company kept a hardcopy list of those private, unpublished numbers, which phreakers colloquially referred to as a “non-pub file.” For Susan, who had cut her teeth hunting rock stars on the Sunset Strip, a comprehensive index of the personal details of every celebrity in Los Angeles was the ultimate haul. “Just think, you could call any sexy celebrity you wanted to,” she says. It was also enormously valuable.

“Non-pub was the Holy Grail,” she says. “And so it seems that some enterprising female hacker decided to go and acquire [it].” After learning that it was stored on microfiche at a Pacific Bell office in East Los Angeles, she began to regularly case the building. Two or three nights a week, she haunted its dumpsters, digging for castoff microfiche. After four months of coming up empty-handed, Susan decided on a more daring strategy. She would walk right into the building.

First, she found some discarded microfiche at a library, rubber-banded it into one-inch stacks, and stuffed it into her purse. Then, one night, while the cleaning crew was at work, she strode through the office’s front doors and tried a little social engineering. “I said to the cleaning crew that I worked there, and I’m in just for a little while to get some records that I need to work from home,” she remembers. After poking around for 15 minutes, making photocopies of interesting manuals, she found a filing cabinet with small, index-card-sized drawers. Inside were tidy stacks of microfiche. She grabbed a small jeweler’s loupe from her purse and peered at a sheet. Bingo.

She swapped out a section from the back of the drawer with an equally sized stack of library microfiche, slipped it carefully back in place, and left the office as confidently as she had arrived. She never told a soul. She even kept mum on the hacker forums. For her, the non-pub file was proof that she didn’t need Kevin and Lewis’ help to pull off something big. “I just did it for myself,” she says. “I didn’t do things to brag to others. I did it to hold the power myself.”

It should have made her feel giddy, but it had the opposite effect.

The next morning, she looked at the purloined microfiche with dread. Call it a hacker hangover: what she’d done was a bonafide crime, like the one she’d just sent her friends away for committing. “I remember pulling myself up hard and crying, crying, crying about it,” she says. She didn’t recognize herself in the mirror anymore. Her attraction to phone and computer systems was like an addiction — a dangerous mystique that kept drawing her back. “You can’t do this, Susan,” she said to herself. “The calling is too strong. You’ve got to break away from it.”

So Susan went straight. But not before she sold the non-pub file to a local tabloid.

Kevin Mitnick publicly maintains that he had nothing to do with the destruction of the US Leasing files. In his autobiography, he characterizes Susan as a “wannabe hacker” who took revenge on him and Lewis using a backdoor into the US Leasing system that he had created.

“Perhaps she thought Lewis had broken up with her so he could spend more time with me, hacking,” he proposes. As retribution, he says, she destroyed the US Leasing system and left his and DePayne’s names as a red herring. How a “wannabe hacker” might have known how to do all this — and, more importantly, get away with it — is left unsaid.

Mitnick should know, perhaps better than anyone, that being a great hacker is about much more than fluency in the language of computer systems. It’s also about meeting those systems where they are: irrevocably, often messily, entangled in a world of people. People with blind spots. People with broken hearts. People with pasts. Susan understood that, intuitively, because of her own past — a traumatic history that made her hungry, too, for control, wherever she could find it.

We are all vulnerable to the kind of social manipulation Susan and Mitnick and DePayne honed in those early years at the convergence of telephone and computer history. No password can protect us from trusting the wrong person. Our past is no longer just a story we tell ourselves; it’s a rich store of data that can be mined, studied, and used against us. Even Susan Thunder, in the end, left enough of herself behind for me to track her down. We are all potential social engineers, and we are all potential targets. That’s her legacy, too.

As for the woman on the other end of the line, she seems concerned with statutes of limitation. She’s married now and lives a quiet life in a large Midwestern city, collecting coins. She’s not sure why someone like me would be interested in her now, after so long. One day she asks me, “You know why nobody knows who I am?”

No, I say, thinking back to a year previous — before the plague, before our phone calls, before I finally found Susan, when her name still meant nothing to me.

“Because I never got caught,” she says. “All the best hackers, all the best phreakers in the world, we don’t know who they are because they never got arrested. And they never went to prison. This is why you don’t know who the best ones in the world are. This is the truth. Think about it.”