January 11th, 2011. A federal courthouse in San Francisco. Five lawyers in expensive suits sit across from George Hot.
Hots, a 21-year-old teenager who codes out of his parents' bedroom in New Jersey. They represent one of the most valuable electronics companies on Earth. He has no lawyer and only $32 to his name.
The judge just signed an order almost no court has ever signed, a subpoena for every single IP address that clicked play on this kid's videos. Not just him, his entire audience. But here's what makes this case impossible.
Hot has already done two impossible things. At 17, he took an eyeglass screwdriver to a kitchen table and cracked open the most hyped phone in history, blocked by the most valuable company alive. Then he broke the one console the global hacking world had publicly given up on.
And weeks before those lawyers walked into court, he handed the keys to Sony's kingdom to every person with an internet connection. Within 90 days, the decision to crush him will cost Sony $171 million and the data of 77 million customers. How did one teenager humiliate the most powerful tech companies on Earth?
And how did trying to crush him become one of the worst disasters in tech history? To understand how a single bedroom in New Jersey ended up in a federal lawsuit, you must start with a kid who could not, physically could not stand the idea of something being sealed shut. He grows up in Glenn Rock, a quiet New Jersey suburb where nobody is supposed to make headlines.
By his early teens, he is in the Bergen CountyMies, the kind of magnet school that collects prodigies the way other schools collect detention slips. While most kids in his class are coding small games, George Ho is wiring together a homemade three-dimensional imaging rig and calling it I want a hollow deck. He carries it to the Intel International Science Fair.
He walks out with $20,000 in scholarship money and his face on national television. A string bean teenager explaining motion capture to a morning news anchor as if he is bored of his own genius. This is who he was before the world heard of him.
A polite, fast-talking kid with a tinkerer's brain who looks at a system the way other people look at a puzzle. Closed equals broken. Sealed equals temporary.
Then in the summer of 2007, a small device comes onto the market that the entire planet wants and almost nobody can fully own. The iPhone. You probably remember the launch.
Lines around the block. Late night television gags. A glass slab from the most valuable company in the world.
There is one rule baked into every unit. You can buy it for $600, but you cannot use it on any cellular network that is not AT&T in the United States. The phone is yours and not yours at the same time.
It is a leash dressed as a luxury product. Hots is 17. He looks at the leash and starts unscrewing it.
For 5 weeks between high school and a part-time job, he camps in his bedroom with the device, a stack of forums, an eyeglass screwdriver, and a guitar pick to pry the case. He maps the board. He identifies the one chip standing between him and Freedom.
a tiny processor inside the phone that enforces the carrier lock. He realizes that if he can briefly send a controlled jolt of voltage to a single pin on that chip, the lock will not check the carrier. The phone will simply forget who it is supposed to be obeyed.
He sold wires. He runs his code. He inserts a SIM card from a different network.
It works. In the early hours of a summer morning in a New Jersey bedroom, the first unlocked iPhone in the world boots up on a network it was never meant to know. He does what any 17-year-old does.
He films it. He uploads the video. Within hours, it exploded across the internet.
Within a week, the most valuable company on Earth has been beaten by a teenager working at a kitchen table. You should feel the size of that, the way the world felt it. Apple is not a small business.
Apple is by then a religion with a stock chart. And a kid with $20 of tools at home has just told everybody that the new sacred object can be opened with a screwdriver. The reaction is not what you would expect.
Lawyers do not show up at his door. A businessman shows up at his door. A man from a phone repair company drives down to New Jersey and offers Hots a sports car and three more iPhones in exchange for the unlocked unit.
Hott hands over the phone and drives away in a Nissan 350Z 17 years old with a license that is still warm. Then a few weeks later, a quiet email lands in his inbox. The sender is the co-founder of Apple, Steve Wniaak, the original tinkerer, the man who built the company in a garage by opening every machine he could find.
Wniaak does not threaten him. Wniaak congratulates him. Five weeks, one bedroom, a stack of forms, and a guitar pick.
That's how H Hots taught himself to do the impossible alone and the hard way. Most people never get past that part. They watch a kid like this and assume the talent is something you're born with.
But it isn't. It's trained. That's exactly why we built Black Files Academy.
And since June 1st, it's live. It's not a pile of disconnected labs. It's hours of structured recorded courses that take you from your first Linux command to real offensive security.
You follow each lesson and do the work yourself until it stops being theory and becomes instinct. Stop watching hackers and become one. Your first month is 25% off with the code black files at blackfilesacademy.
com. Now back to the kid who' just beaten a phone and the one machine the entire world swore could never be cracked. Hold on to that email.
It comes back to the end. But the phone, even with the carrier broken, is not enough for him. Phones are easy.
The phone has a few chips and a battery. He wants the one machine the entire hacking world has been trying and failing to crack for years. A black plastic box untouched since launch, owned by a company that has none of Apple's patience for clever kids.
What happens when a teenager who cannot leave a lock alone walks up to the only console nobody has ever cracked? And how do you pick up a fight with a company that has never in its history lost one? The machine is a PlayStation 3.
By 2009, it is the white whale of the hacking world. The Xbox has fallen. The Wii has fallen.
Every other console on the market has been peeled open and modded by somebody somewhere. The PS3 has been on shelves for 3 years and not a single person has touched its core. The reason is engineering.
Sony has wrapped the console in layers of encryption, hypervisors, signed code, and hardware fuses. To break it, you have to defeat not one defense, but a stack of them, all watching each other. The community has tried.
The community has lost. HTZ writes a blog post in December 2009 that says in effect, "Hold my drink. " He is going after it.
5 weeks later, he posts an update. He has a hardware exploit. He has, in his own words, a way to use a tiny physical hole to make a much larger software hole large enough to walk through.
He has read and write access to the systems memory. He has highlevel access to the processor. He has done what nobody on earth has done.
He is 20 years old. He publishes the exploit publicly, not for piracy. He has been clear about that for years.
He believes that a thing you bought is a thing you own, and a thing you own is a thing you should be allowed to open. He releases the work as a gift to the people who already paid Sony $400 for the box on their living room floor. Sony, unlike Apple, does not send congratulations.
Sony's answer arrives a few weeks later as a mandatory firmware update. The update does not just patch the hole. The update strips a feature called other OS out of every PlayStation 3 in the world.
Until that day, anyone who owned a PS3 could install Linux on it, turn it into a computer, run scientific code, do whatever they wanted with the hardware they had purchased. After that day, they could not. Sony has reached out through the internet and removed something millions of paying customers had legally bought.
You should sit with what just happened because it is the moment the war changes shape. To close a whole one kid opened, Sony has chosen to break the property of every honest customer it has. The kid is one.
The customers are millions and millions are watching. If a story like this, one curious mind against the entire weight of the system, is what brings you here, a subscribe makes sure the next one finds you. You are the audience for this exact kind of company spin in a courtroom trying to make disappear.
The backlash hits fast. Owners are furious. A class action lawsuit is filed against Sony itself.
Universities that had bought racks of PlayStations to run scientific simulations on the cheap watch their clusters die overnight. Air Force researchers who had stitched together a supercomput out of consumer consoles lose part of their hardware to a corporate decision they had no say in. Forums filled with screenshots of the update prompt and one question repeated in 20 languages.
Is the thing I paid for still mine? The company has just turned a lone bedroom hacker into a public cause. And hot is suddenly not a hobbyist.
He is the face of the people Sony has betrayed. And then in the middle of 2010, exhausted by the constant attention and the inbox and the requests and the pressure to do it again, George Hotz publicly walks away. He posts goodbye.
He says he is done with the PS3. He says he is moving on. He thanks the community.
He logs off. For the first time, the story looks over. The kid won.
The company punished its own customers. The kid retired with the trophy. The moment passed.
It is not over. It is barely begun. Because the door hots opened cannot be closed.
And somewhere in Germany, a small group of hackers nobody has heard of yet has been quietly studying Sony's code, looking for a mistake. They are about to find one. Not a small mistake.
A mistake so fundamental that the entire security of the PS3 will collapse like a rotten beam and hots who walked away will pick the keys up off the floor and throw them into the world. What does a hacker do when he has officially retired from a war and somebody else finds the kill shot? And what is the one thing you never give to a man who is angry at a corporation?
December 2010, the annual Chaos Communication Congress in Berlin. The hacker world's biggest stage. A group called Fail Zero Overflow steps up to the microphone.
And in front of a packed auditorium, they explain with the calm of people delivering math proof that Sony has made a mistake. Inside the PS3 signing system, Sony was supposed to generate a fresh random number every time the console verified a piece of code. The random number is the spine of the whole security model.
If it changes, the lock holds. If it ever repeats, the entire lock falls apart because the secret master key can be calculated from the public signatures using nothing more exotic than high school algebra. Sony reused the number not once, every time they wrote a single value into their code and called it randomly.
That single line of laziness means the master key to the PlayStation 3 can be derived by anybody with a notebook in time. The console is not just broken. It is permanently mathematically unpatchable.
Any fix has to be baked into the silicon and the silicon is already in living rooms around the world. George H. Hotz watches the talk and the retirement ends.
Days later on his personal website, he publishes the master key pages for it. A long scrolling string of hexadesimal characters that is in cryptographic terms the deed to Sony's kingdom. The internet downloads it.
Within hours, mirror copies have spread to thousands of sites in dozens of countries. Sony will never put this back in the box. And then Hotz does something that even by his own standards is a deliberate provocation.
He records a rap track. He posts it. The lyrics are aimed at Sony's lawyers, at the company's executives, at the whole posture of the corporation.
The kid is openly laughing at the giant on its own internet. The giant decides it has had enough. In January 2011, Sony Computer Entertainment America files suit.
The complaint is named George Hots. It pleads violations of the digital millennium copyright act, computer fraud, copyright infringement, breach of contract, and a string of state law claim that stacked together could ruin him forever. Five lawyers go up against one 21-year-old who can barely afford a hard drive.
That is the visible escalation. The invisible one is worse. Sony goes to a federal magistrate and asks for something that should never have been granted.
They ask for the server logs of his personal blog, every IP address that ever loaded the page where he posted the keys. They asked for the same from his YouTube account, every person who pressed play on the rap video. They ask for his PayPal records, his Twitter records, and his Google account.
They get all of it. The order goes through. Now, read the line carefully because this is the moment the case stops being a console.
Sony's lawyers are now in a position to compile a list of every member of his audience. Every person who watched a kid mock for a corporation has been reduced in a federal court order to an entry on a spreadsheet that Sony can demand explanations from. To make the picture even uglier, Sony also tells the court that Hot has fled the United States and is hiding in South America to evade jurisdiction.
He has done no such thing. He flew to a security conference, gave a talk, and came home. The accusation has quietly dropped later.
The damage by then has already been done. You are watching a corporation try to bully a child and his entire audience into silence at the same time. He has no money.
He has no real legal team. The hourly rate of one of Sony's lawyers is more than he has ever earned in his life. He is being asked in effect to fight a war of attrition against an opponent that can simply outlast him until his bank account empties.
There is one variable Sony has not accounted for. Pots is not alone anymore. 2 years of stripped Linux features and corporate overreach and bullying have produced something the company never modeled for.
An audience that is angry. And on the internet, an audience that is angry is a force with its own gravity. What happens when a corporation forgets it has customers and not just defendants?
And how do you fight a billion dollar legal department when your wallet has $32 in it? The internet breaks for him. Within days of the lawsuit becoming public, donation pages go up.
Strangers from around the world wire him money to hire actual lawyers. The amount is not large by Sony standards. It is enormous by his.
He suddenly has a defense. Forums, gaming sites, programming communities, and even mainstream tech press shift their language. A story that had opened as a hacker dispute is being told now as a question about property.
Whether the console on your shelf is yours, whether the 30-second clause in a user agreement nobody reads can quietly mean it is not. The names of Sony's lawyers begin appearing in news articles. next to the price tag of the order they obtained.
The audience the corporation tried to map has just remembered it is public. Then a much larger force notices. A loose collective of online activists that the world has been learning to spell calls itself anonymous.
They have a habit of picking fights with institutions they believe overreach. In early 2011, they publish a press release. The release uses the word Sony as a target.
They give the operation a name. They say plainly that Sony has victimized its own customers, that the company has tried to censor the truth about how its own products work, and that Anonymous is going to make that decision expensive. Then they start hitting Sony.
The attacks are denial of service. They drown Sony's websites in traffic until the sites fall over. Online stores blink offline.
Customer service pages stop loading. Corporate sites go dark. The pressure is constant, distributed, and very public.
Every news article about the suit now leads to the fact that the company is being publicly bombarded over it. You can almost hear the boardroom recalculating the cost of pursuing a 21-year-old. But the legal arithmetic for Hots personally is unforgiving.
The case can drag on for years. Each motion costs more than he can raise. Each new filing exposes more of his data and the data of his audience.
Drgging the war out does not just risk bankrupting him. It risks pulling thousands of people who only clicked a video into Sony's Discovery files. The Vice Tightens until there is only one move left that protects everybody else.
In April 2011, George Hot. Hot. Hot.
Hot. Hot. Hot.
Hot. Hot. Hot.
Hot. Hot signs a settlement. He agrees to a permanent injunction that bars him from ever touching a Sony product again.
He agrees to never publish work on Sony hardware again. He agrees in legal effect to lay his sword down. The papers go out under headlines that read like a corporate victory.
The kid blinked. The giant won. The system worked.
That is the shape of it from the outside. From inside the moment, you can see the trade he is actually making. He is giving up his right to fight in order to protect the people who fought with him.
He is being asked by a system he has no way to beat in court to silence himself. He does it on paper. The war is over.
Sony has its win. And then Sony finds out what its win actually costs. So what happens when a corporation declares victory in the middle of a fire it lit itself?
And what is the price of telling an angry internet that it is too small to matter? Less than a week after the settlement, the PlayStation Network goes dark. In the third week of April 2011, Sony engineers detect that someone has gotten inside the network that hosts 77 million customer accounts.
It is not a probe. It is a tear right through the perimeter. Personal data, names, addresses, dates of birth, email accounts, and the encrypted password hashes of millions of customers have been pulled out.
Sony does what any company does in a moment like that. They pull the plug. They take the entire PlayStation network offline worldwide for days, then a week, then 2 weeks, then 23 days.
Every single PlayStation owner on Earth cannot log in. They cannot play online. They cannot buy a game.
The store is dark. The chat is dark. The world's most expensive entertainment service has gone completely silent.
The bill, when it is finally tallied, will run to roughly $171 million in direct costs, on top of the public trust damage that no spreadsheet can really price. At the time, it is one of the largest consumer data breaches the industry has ever seen. Now, read the next sentence carefully because the angle of this story dies if it gets blurred.
The intrusion is never publicly attributed to George H. Hots. He had nothing to do with it.
He says so plainly and on the record. He condemns it. Even anonymous, the collective that had been openly bombarding Sony, denies stealing the data.
The actual perpetrators of the breach are never definitively identified to this day. What is documented is the climate the breach occurred in. Sony lit a firestorm by suing a kid.
The firestorm drew every grudge holder on the internet to a single target. Somewhere inside that firestorm, an intrusion succeeded that the company might otherwise have weathered or never invited at all. Sony won its case against one curious 21-year-old.
And then it lost a number that no court would ever have ordered him to pay. Now look at the opening image again. The five lawyers.
The judge orders the IP addresses. The kid is at his parents house. Reese see what was actually happening.
The giant in that picture was not crushing a child. The giant was detonating itself. The consequences deserve to be acknowledged honestly.
Sony's reputation takes years to recover. The Linux feature removed from millions of consoles never comes back. George Hotz can never legally speak about Sony hardware again.
The court order over his audience stands as a precedent that the internet will not forget. None of that was free. And the kid, the kid does not vanish.
The same establishment that watched him take to court walks up to him and offers him a chair at its own table. Google hires him onto an elite security team called Project Zero, the unit that hunts the kind of bugs he used to find for fun. He stays only as long as he wants.
Then he founds his own company, a self-driving car startup he runs out of a garage in San Francisco. Because driving is just another locked system to him, and he intends to open it. He builds the prototype in a month.
He sells modified kits over the internet so anyone can turn the car they already own into a semiautonomous machine. The same instinct scaled up. The thing you bought is yours, and yours includes the right to teach it new tricks.
He does television interviews. He gives keynote talks. He becomes, without ever asking for the title, a quiet legend.
Which brings us back to the email. Years before the lawsuit, before the breach, before any of it, the co-founder of Apple had written to a 17-year-old to say congratulations, the original tinkerer recognized the next one. Waznjak saw in the kid with the screwdriver the future of the same instinct he had built his entire life on the instinct that a thing you bought is something you may understand.
The instinct that locks are conversations, not endings. They could lock down every chip they ever shipped. They could not lock down a curious mind.
And the moment they tried, they proved it on a scale they will never live down. The thing you bought is yours. And somewhere out there is another teenager opening another lock.
The next time the giants discover what curiosity cost them, you already know who is going to be holding the screwdriver. There is another hacker whose private war with a different giant ended with a sealed coffin and a story nobody can quite agree on. He is one click away.
If you want to understand what happens when another lonely programmer sits down at another keyboard with the same talent and points it the other way, running a global criminal empire from a laptop, moving tons of cocaine, smuggling gold, ordering murders, building a $400 million painkiller machine that helped light the fuse on America's opioid crisis and then flipping to become the most dangerous informant the US government ever ran. That story is already up.
