Legion of Doom vs Masters of Deception: The Hacker Gang Rivalry

Two hacker groups dominate the folklore of the late 1980s and early 1990s: the Legion of Doom and the Masters of Deception. The popular version of their story is a dramatic gang war fought across phone lines. The documented version is less cinematic, but it is a fascinating picture of how a small underground community worked, how it fell apart and what happened when the authorities caught up with it.

The Legion of Doom

The Legion of Doom, usually shortened to LOD, was formed in 1984. Its name came from the group of villains in a Super Friends cartoon. Members used handles rather than real names, and the group became known for its depth of technical knowledge about telephone networks and the computers that ran them. Its members came from across the United States and were mostly teenagers and young adults.

The group's most lasting contribution was its writing. The LOD Technical Journals collected detailed tutorials on how telephone systems and operating systems worked, distributed on bulletin boards. They are an important record of what a curious person could learn about these networks at the time.

Masters of Deception

Masters of Deception, or MOD, formed in New York in the late 1980s. Its best-known member was Mark Abene, who used the handle Phiber Optik. MOD members explored telephone company systems and computer networks, and became known for their technical ability. Accounts of how the group began differ, including how it related to the Legion of Doom, and some of the details come only from the participants themselves.

The so-called war

A popular story says that LOD and MOD fought a "great hacker war" around 1990 and 1991, jamming each other's phone lines, tampering with credit reports and breaking into each other's accounts. The truth is murkier. There was certainly a rivalry, and there were real personal quarrels, but the scale and exact events of the war have been exaggerated in retellings and are disputed among the people involved. It is best treated as a story of a feud rather than as a documented conflict.

How the groups operated

Both groups were loosely organised. Membership meant being invited by existing members after demonstrating skill, and groups relied on private bulletin boards and conference calls to talk. Many members never met in person. The handles they chose were meant to give a layer of anonymity, but the community was small enough that reputations and real identities often became known anyway.

It is also worth remembering how young many participants were. Teenagers with a home computer and a modem could reach machines belonging to large institutions, because those institutions rarely expected an outsider to try. Much of the learning came from reading manuals, trial and error, and trading notes. Some members later said that the thrill was in understanding the system rather than in any gain.

The investigation

US authorities were already watching the hacker scene, particularly after the raids of 1990. Investigators began to look at MOD more closely. In the early 1990s they used telephone records and court-approved wiretaps on lines, a technique that had rarely been used for computer crime before. The case rested on the argument that the group had broken into telephone company and credit information systems, and had changed or copied data.

In July 1992 a federal grand jury in New York indicted five MOD members on charges that included computer tampering and conspiracy. The indictment was a significant moment: it showed that investigators could make a case against a group by following communications, not only by seizing machines.

Outcomes

The defendants eventually pleaded guilty. Mark Abene was sentenced in late 1993 to a year and a day in prison and served about ten months of it, in 1994. His sentence sparked debate about whether such a sentence was proportionate. Some commentators argued that it was a harsh example. Others pointed out that the group's activities had affected real systems and individuals.

After the convictions, MOD effectively ended as a group. Several former members of both groups later worked in computer security or related fields, where their knowledge of how systems fail was useful. That trajectory, from underground explorer to professional defender, became a common pattern in the industry.

What the groups had in common

• A strong culture of sharing technical knowledge, usually within the group.
• A habit of exploring systems without permission, which made the law a constant concern.
• Reputation as the main currency: status came from skill and from what you knew first.

The legal side

The MOD prosecution is also remembered as an early example of the justice system adapting. Investigators had to learn how to explain computer intrusions to a jury and how to use telephone records as evidence. In later years, the same approach, correlating logs and communications records, became standard in cybercrime cases. For a website owner, that means your own logs may one day be the evidence that matters.

The lesson for site owners today

The old underground communities are largely replaced by online forums and marketplaces, but the dynamics are similar. Knowledge about vulnerabilities spreads quickly in groups, and a flaw discovered by one person is soon known to many. Treat the period between a security fix being released and your site installing it as a window of risk, and keep that window short.

1. Subscribe to security announcements for the software you use.
2. Apply updates promptly, starting with anything exposed to the public.
3. Remove accounts, plugins and services you do not need.
4. Log activity so that you can see what happened if something goes wrong.

For a wider baseline of measures, see the security page.

How we can help

Plesk on every Zebra Hosting plan makes it straightforward to keep software up to date from one place. Our WordPress hosting is a good fit if your site runs on a CMS that needs frequent patching, and the security page explains more about how we approach it.