Operation Sundevil 1990: The Raids That Created the EFF

On 8 May 1990, agents of the United States Secret Service, working with state and local police, carried out raids in a number of American cities. They called it Operation Sundevil. It was the largest coordinated action against computer hackers up to that time, and in many ways it was a failure. But it changed the debate about civil liberties and computers, and it led directly to the creation of one of the most important digital rights groups in the world.

The background

By 1990, the American hacker scene had grown through bulletin board systems, where users dialled in by modem to share messages and files. Some boards were used to trade stolen calling card numbers and credit card details. Some carried technical files taken from telephone companies. The Secret Service, which has legal authority over credit card and computer fraud, wanted to show that it could act.

A related investigation in the months before had already unsettled the community. In January 1990 the AT&T telephone network suffered a major software-related outage that was not caused by hackers, but that increased official anxiety about threats to the phone system.

The raids

Sundevil was reported to have involved search warrants in around a dozen or more cities, with agents seizing computers, hard disks and many thousands of floppy disks. The operation targeted bulletin boards and individuals suspected of credit card and telephone fraud. Public statements at the time described it as a nationwide blow against computer crime.

In practice, relatively few prosecutions resulted. Many of the people raided were never charged. Critics argued that the seizure of equipment, which could keep a small business or a teenager's computer out of use for a long time, was itself a form of punishment without trial.

Steve Jackson Games

The most famous side story of the period happened a few months earlier, on 1 March 1990. The Secret Service raided Steve Jackson Games, an Austin, Texas publisher of role-playing games, and took computers, including the one that ran its bulletin board, along with drafts of a book. An employee had been suspected of involvement in a case that centred on a stolen document from a telephone company. The company itself was not accused of wrongdoing.

The raid nearly put the business out of operation. In 1993 a federal judge ruled that the Secret Service had violated the law in the way it seized and held the material, including the protections for publishers and for stored electronic communications. The company was awarded damages. The case became a leading example of how the legal system had not yet adapted to electronic publishing.

The E911 document

Another case from the same period involved Craig Neidorf, a college student who published a document taken from a BellSouth computer about the 911 emergency system in an online magazine called Phrack. Prosecutors described the document as extremely valuable. During the 1990 trial it emerged that similar information could be bought from the company for a small fee, and the case collapsed.

The birth of the EFF

These events caught the attention of people with experience in the technology world. Mitch Kapor, the founder of Lotus Development, and John Perry Barlow, a writer and lyricist for the Grateful Dead, had both been contacted by agents in related inquiries. Concerned about the way the law was being applied, they founded the Electronic Frontier Foundation in July 1990, together with John Gilmore. The EFF funded the defence in several of the cases and set out to establish that constitutional protections such as free speech and protection from unreasonable search applied to computer networks.

The author Bruce Sterling documented the period in his 1992 book The Hacker Crackdown, which he later made available online for free. It remains one of the clearest accounts of how law enforcement, telephone companies and hackers misunderstood one another. Sterling's central point was that both sides were operating without a shared language. Police treated unfamiliar technical activity as evidence of a crime, and hackers treated the law as irrelevant to a space they considered new.

Looking back, Sundevil is often described as a case of enforcement running ahead of understanding. The agents were responding to real fraud, and the credit card and calling card abuse they were chasing did exist. But the methods they used, such as taking whole computers instead of copying the relevant files, hit people who had nothing to do with any crime. Later guidance and court decisions pushed investigators toward more targeted seizures, and the idea that a bulletin board operator has some of the same protections as a publisher became better established.

What it left behind

• A clearer legal understanding that online publishing and private messages deserve legal protection.
• An organised civil liberties movement focused on technology.
• A lasting lesson that over-broad enforcement damages innocent parties.

The lesson for site owners today

Your own site stores information that belongs to other people, such as customer details, messages and uploaded files. If your server is ever seized, hacked or taken offline in an investigation of a different customer, your ability to continue depends on separation and on backups. Keep your own copies of your data and your content, in a place you control, and keep your domain and email under accounts that only you can access.

It is also worth understanding who holds your data. A provider that is clear about where responsibility lies, and that lets you export your data at any time, reduces your exposure to events outside your control.

The hosting plans overview shows the available options.

Next steps

You can move your site at any time and keep full copies of it. See our free migration service if you are moving in, and our hosting plans if you are choosing a new home for your site.