Operation Sundevil

Background

By the late 1980s, electronic bulletin board systems (BBSes) had become a common venue for hobbyist hackers and phone "phreaks" to trade information, but also for criminals to exchange stolen long-distance calling card numbers, cloned credit card data, and pirated software. The United States Secret Service, which has jurisdiction over credit card and access-device fraud, opened an investigation lasting roughly eighteen months into networks of BBS users suspected of this activity. The inquiry was coordinated out of the Secret Service's Phoenix field office, located near Arizona State University's Sun Devil Stadium, which gave the operation its name.

The May 1990 Raids

On May 7–9, 1990, Secret Service agents, assisted by the FBI, local police departments, and organized-crime units such as the Arizona Organized Crime and Racketeering Bureau, executed a coordinated series of raids in more than a dozen cities, including Phoenix, Tucson, Los Angeles, San Diego, San Jose, San Francisco, Miami, Newark, Pittsburgh, Detroit, Cincinnati, and Richmond. Agents served approximately 27 search warrants, seizing around 42 computers, roughly 25 electronic bulletin boards, and an estimated 23,000 floppy disks believed to contain stolen credit card numbers, hacking and phreaking tools, and copyrighted software. The operation was publicly announced at a May 9, 1990 press conference in Phoenix. Only a small number of arrests were announced at the time, involving suspects known by online handles such as "Tony the Trashman," "Dr. Ripco," and "Electra," and the great majority of the seized equipment did not lead to prosecutions.

The Steve Jackson Games Raid

Operation Sundevil is frequently discussed alongside a separate but contemporaneous Secret Service action: the March 1, 1990 raid on Steve Jackson Games, a small tabletop role-playing game publisher in Austin, Texas. That raid stemmed from a different investigation into the unauthorized copying and distribution of a Bell South internal document describing the 911 emergency telephone system, which agents believed was linked to a former employee associated with hacker circles. Secret Service agents seized company computers and a BBS used to develop an upcoming game manual, deleting stored electronic mail in the process, even though Steve Jackson Games itself was never charged with any crime. Although this raid was not formally part of Operation Sundevil, the two actions occurred within months of each other and were widely conflated in press coverage of the era's crackdown on the computer underground.

Legal and Civil Liberties Fallout

The Steve Jackson Games raid led to the lawsuit Steve Jackson Games, Inc. v. United States Secret Service. In March 1993, a federal district court ruled that the Secret Service had violated the Privacy Protection Act and, in part, the Electronic Communications Privacy Act, awarding the company $50,000 in statutory damages and roughly $250,000 in attorneys' fees; the U.S. Court of Appeals for the Fifth Circuit affirmed the judgment in October 1994. The case, along with the broader Sundevil raids, drew criticism from civil liberties advocates and technologists who argued that law enforcement agents lacked the technical understanding to distinguish criminal hacking activity from legitimate business and hobbyist computer use.

Founding of the Electronic Frontier Foundation

The perceived overreach of Operation Sundevil and the Steve Jackson Games raid, combined with an unrelated FBI investigation that had drawn Lotus Development founder Mitchell Kapor into contact with agents unfamiliar with computer technology, prompted Kapor and lyricist-activist John Perry Barlow to found the Electronic Frontier Foundation in July 1990. EFF was established to advocate for civil liberties in the emerging digital realm and went on to support legal defense efforts connected to the raids, including providing assistance in the Steve Jackson Games case.

Legacy

Operation Sundevil is remembered less for successful prosecutions than for its scale and its role in galvanizing public debate over computer crime enforcement and digital rights. Writer Bruce Sterling's 1992 nonfiction book The Hacker Crackdown documented the operation and its aftermath in detail, cementing its place as one of the most widely cited episodes in the early history of hacker culture, law enforcement overreach, and the birth of organized digital civil liberties advocacy in the United States.

Timeline

• 1988-1989The Secret Service begins an approximately 18-month investigation into BBS-based credit card fraud and phone phreaking that will culminate in Operation Sundevil.
• 1990-02-28A search warrant is issued in a separate Secret Service investigation into the leaked Bell South 911 document, targeting Steve Jackson Games.
• 1990-03-01Secret Service agents raid Steve Jackson Games in Austin, Texas, seizing computers and a bulletin board system.
• 1990-05-07Operation Sundevil raids begin, with Secret Service and other agents executing search warrants in more than a dozen U.S. cities.
• 1990-05-09The Secret Service publicly announces Operation Sundevil at a press conference in Phoenix, Arizona.
• 1990-07Mitchell Kapor and John Perry Barlow found the Electronic Frontier Foundation, citing the Sundevil-era raids among their motivations.
• 1993-03-12A federal district court rules in favor of Steve Jackson Games in Steve Jackson Games, Inc. v. United States Secret Service, awarding damages and attorneys' fees.
• 1994-10The U.S. Court of Appeals for the Fifth Circuit affirms the judgment against the Secret Service.