Within Whistleblowers
The Claim That Was Easier To Test
McKinnon's most testable public-interest point was not alien evidence, but the weak security he said he encountered.
On this page
- What weak access controls implied
- Why security exposure differs from UFO proof
- The risks of testing defence systems
Page outline Jump by section
Introduction
Among Gary McKinnon’s various claims, the one that proved easiest to evaluate was not his assertion that he had found evidence related to UFOs. It was his contention that he encountered remarkably weak security on sensitive US government networks. Unlike alleged sightings, spacecraft images or references to “non-terrestrial officers”, the question of whether important systems were protected by poor passwords and weak access controls could be investigated through technical evidence, court records and independent reporting. As a result, network security became the strongest public-interest dimension of the case, even for people who rejected McKinnon’s UFO conclusions. [WIRED+2The Guardian]wired.comUFO Hacker' Tells What He FoundWIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the… poor…
In the broader comparison between UFO hackers and whistleblowers, this distinction matters. McKinnon’s claims about hidden alien technology remained unverified and heavily disputed. His descriptions of weak security practices, however, were supported by multiple accounts that suggested he often gained access through basic administrative failures rather than through sophisticated intrusion techniques. [The Guardian+2The Guardian]theguardian.comThe GuardianGame over | Gary McKinnon9 Jul 2005 —… administrator user names that had no passwords. Basically, what… "Maybe I'd been…
The Claim That Was Easier To Test
The central reason McKinnon’s security argument attracted attention is that it dealt with observable conditions rather than extraordinary conclusions. A government network either had inadequate password protection or it did not. An administrator account either used a blank password or it did not.
McKinnon repeatedly argued that he entered systems because security was so poor. Reporting from the period described his use of scanning tools to locate Windows machines where administrator accounts lacked passwords or relied on extremely weak credentials. Accounts from both McKinnon and journalists who examined the case described networks that were vulnerable because basic security practices had not been followed. [The Guardian+2The Guardian]theguardian.comThe GuardianGame over | Gary McKinnon9 Jul 2005 —… administrator user names that had no passwords. Basically, what… "Maybe I'd been…
Even critics of McKinnon often acknowledged that the allegations revealed uncomfortable questions about network protection. Wired noted that the case unfolded partly as a story about exposed national-security systems, while later reporting described prosecutors and defenders arguing over the significance of those vulnerabilities. [WIRED]wired.comUFO Hacker' Tells What He FoundWIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the… poor…
The result was an unusual situation: people could disagree completely about UFO evidence while still accepting that the case exposed genuine weaknesses in access control and system administration.
What Weak Access Controls Implied
If McKinnon’s account was substantially correct, the implications extended beyond one individual hacker.
Poor access controls suggest failures at several levels:
- Password management: Systems may have retained default passwords, blank passwords or easily guessed credentials.
- Network oversight: Vulnerable machines apparently remained connected to sensitive networks for extended periods.
- Administrative discipline: Security policies may have existed on paper but were not consistently enforced.
- Monitoring and detection: Unauthorised access allegedly continued long enough for McKinnon to move through multiple systems before detection. [The Guardian+2The Guardian]theguardian.comThe GuardianGame over | Gary McKinnon9 Jul 2005 —… administrator user names that had no passwords. Basically, what… "Maybe I'd been…
The public-interest aspect of this argument did not depend on accepting McKinnon as a heroic figure. Citizens, policymakers and security professionals could reasonably ask whether military and government systems were being protected adequately, especially during the period immediately surrounding the September 2001 attacks. The question was concrete and testable in a way that UFO claims were not. [WIRED]wired.comUFO Hacker' Tells What He FoundWIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the… poor…
This is one reason the security dimension has remained relevant in cybersecurity discussions long after the UFO allegations faded from mainstream attention.
Why Security Exposure Differs From UFO Proof
The evidential standards for the two claims were fundamentally different.
McKinnon’s UFO assertions relied largely on his personal recollections of files, images and lists he said he observed while connected to remote systems. The alleged evidence was not preserved in a form that independent investigators could reliably examine years later. Supporters viewed his testimony as credible; sceptics argued that extraordinary claims required documentation that never emerged publicly. [WIRED]wired.comUFO Hacker' Tells What He FoundWIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the… poor…
The security claim worked differently. It was not dependent on a single screenshot or memory. Investigators could examine logs, account settings, network configurations, administrative procedures and forensic records. Journalists could interview participants. Courts could evaluate technical evidence. The underlying proposition—that important systems had weak security—was therefore much more susceptible to verification. [The Guardian+2The Guardian]theguardian.comThe GuardianGame over | Gary McKinnon9 Jul 2005 —… administrator user names that had no passwords. Basically, what… "Maybe I'd been…
This difference mirrors a broader distinction between whistleblower-style disclosures and speculative investigations. Claims gain credibility when independent parties can test them. Weak password practices are measurable. Hidden alien fleets are much harder to verify.
The Risks of Testing Defence Systems
The strongest public-interest argument in McKinnon’s favour does not eliminate the risks created by his actions.
Court records and government allegations stated that he obtained administrative privileges, installed remote-access software and altered or deleted files on numerous systems. Authorities alleged that some actions disrupted networks and required significant recovery efforts. Whether one accepts every aspect of the prosecution’s account, the case demonstrates why security researchers and unauthorised intruders are treated differently under the law. [Department of Justice+2UK Parliament]justice.govDepartment of JusticeLondon, England Hacker Indicted Under Computer Fraud…Gary McKinnon, of London, England, was indicted in Alexandri…
A vulnerability can be real while the method used to demonstrate it remains unlawful. Modern cybersecurity practice generally distinguishes between authorised testing, coordinated vulnerability disclosure and unauthorised access. McKinnon’s supporters often focused on the weaknesses he exposed; prosecutors focused on the fact that the exposure came through unauthorised entry into defence systems. [Department of Justice+2UK Parliament]justice.govDepartment of JusticeLondon, England Hacker Indicted Under Computer Fraud…Gary McKinnon, of London, England, was indicted in Alexandri…
That tension explains why the case continues to occupy a grey area in public debate. The security lesson and the legal lesson are not necessarily the same lesson.
Why This Became McKinnon’s Most Durable Public-Interest Point
More than two decades later, the UFO aspects of the story remain disputed and unresolved. The security aspect has proven more durable because it addresses a practical question that governments, organisations and citizens can evaluate directly: were critical systems protected adequately?
McKinnon’s most lasting contribution to public discussion may therefore be indirect. Rather than proving a UFO cover-up, the case highlighted how apparently mundane failures—weak passwords, poor account management and inadequate oversight—can create vulnerabilities in highly sensitive environments. Contemporary cybersecurity professionals frequently regard those basic failures as among the most dangerous because they are common, preventable and exploitable. [The Guardian+2The Guardian]theguardian.comThe GuardianGame over | Gary McKinnon9 Jul 2005 —… administrator user names that had no passwords. Basically, what… "Maybe I'd been…
In the comparison between UFO hackers and whistleblowers, this is the point where McKinnon came closest to making a verifiable public-interest claim. The evidence for weak security could be examined independently. The evidence for hidden extraterrestrial programmes could not. That difference largely explains why the security issue remains the most credible and enduring part of the public debate surrounding his case. [WIRED+2The Guardian]wired.comUFO Hacker' Tells What He FoundWIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the… poor…
Amazon book picks
Further Reading
Books and field guides related to The Claim That Was Easier To Test. Use these as the next step if you want deeper reading beyond the article.
This Is How They Tell Me the World Ends
Examines vulnerabilities in government and corporate systems.
Digital Evidence and Computer Crime
Provides context for investigating security claims.
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
Endnotes
-
Source: wired.com
Title: ‘UFO Hacker’ Tells What He Found
Link: https://www.wired.com/2006/06/ufo-hacker-tells-what-he-found/Source snippet
WIRED'UFO Hacker' Tells What He FoundJune 21, 2006 — 21 Jun 2006 — 'UFO Hacker' Tells What He Found. The search for proof of the... poor...
Published: June 21, 2006
-
Source: wired.com
Title: terrorist or ufo truth seeker
Link: https://www.wired.com/2006/04/terrorist-or-ufo-truth-seeker/Source snippet
?28 Apr 2006 — Terrorist or UFO Truth Seeker? U.S. authorities want to try a Briton who hacked into top military sites to see what he cou...
-
Source: publications.parliament.uk
Title: mckinn 1
Link: https://publications.parliament.uk/pa/ld200708/ldjudgmt/jd080730/mckinn-1.htmSource snippet
UK ParliamentMckinnon V Government of The United States of America...30 Jul 2008 — Having gained access to those accounts he installed u...
-
Source: justice.gov
Link: https://www.justice.gov/archive/criminal/cybercrime/press-releases/2002/mckinnonIndict.htmSource snippet
Department of JusticeLondon, England Hacker Indicted Under Computer Fraud...Gary McKinnon, of London, England, was indicted in Alexandri...
-
Source: justice.gov
Link: https://www.justice.gov/archive/usao/nj/Press/files/pdffiles/Older/edva_mckinnon_[indictmentSource snippet
n unemployed computer system.Read more...
-
Source: theguardian.com
Link: https://www.theguardian.com/theguardian/2005/jul/09/weekend7.weekend2Source snippet
The GuardianGame over | Gary McKinnon9 Jul 2005 —... administrator user names that had no passwords. Basically, what... "Maybe I'd been...
-
Source: theguardian.com
Link: https://www.theguardian.com/uk/2007/apr/03/politics.usaSource snippet
Hacker's progress: how McKinnon pierced Pentagon security3 Apr 2007 — With such glaring errors leaving the backdoor wide open to intruder...
-
Source: Wikipedia
Title: Gary [Mc Kinnon]({{ ‘mc-kinnon/’ | relative_url }})
Link: https://en.wikipedia.org/wiki/Gary_McKinnonSource snippet
Gary McKinnonThe US government accused McKinnon of hacking into 97 United States military and NASA computers over a 13-month period be...
Additional References
-
Source: facebook.com
Link: https://www.facebook.com/AmazingFacts051779/posts/the-largest-known-military-hack-in-history/1062577141316209/Source snippet
The Largest Known Military Hack in History!Gary McKinnon's UFO hacking case and cybersecurity implications. Deep... Bevan claimed they h...
-
Source: malicious.life
Link: https://malicious.life/episode/us_vs_gary_mckinnon/Source snippet
The US vs. Gary McKinnonGary McKinnon, a British hacker with Asperger's, broke into NASA & US Army networks - to find evidence of UFO cov...
-
Source: instagram.com
Title: Once inside, he deleted critical files, shut down
Link: https://www.instagram.com/p/DLU4vKlI1l4/Source snippet
In the early 2000s, a British man named Gary McKinnon...He took advantage of weak security systems, often accessing machines with no pas...
-
Source: pinsentmasons.com
Title: pentagon hacker mckinnon fights extradition
Link: https://www.pinsentmasons.com/out-law/news/pentagon-hacker-mckinnon-fights-extraditionSource snippet
'Pentagon hacker' McKinnon fights extradition28 Jul 2005 — McKinnon allegedly exploited poorly-secured Windows systems to attack networks...
-
Source: cbsnews.com
Title: brit hacker loses us extradition appeal
Link: https://www.cbsnews.com/news/brit-hacker-loses-us-extradition-appeal/Source snippet
Brit Hacker Loses U.S. Extradition Appeal30 Jul 2008 — McKinnon, 42, an unemployed computer administrator, allegedly broke into 97 comput...
-
Source: infosecurity-magazine.com
Link: https://www.infosecurity-magazine.com/news/ufo-hacker-gary-mckinnon-denied-appeal-route-to/Source snippet
She told the BBC: "To use my desperately vulnerable son in this way is despicable, immoral and devoid of humanity".Read more...
-
Source: cybereason.com
Title: Malicious Life Podcast: The U.S
Link: https://www.cybereason.com/blog/malicious-life-podcast-the-u.s-vs.-gary-mckinnonSource snippet
vs. Gary McKinnonGary McKinnon had managed to breach not just NASA, but nearly 100 computers from the U.S. Army, Air Force, and Departmen...
-
Source: en.wikisource.org
Title: US v Gary Mc Kinnon Indictment
Link: https://en.wikisource.org/wiki/US_v_Gary_McKinnon_IndictmentSource snippet
v Gary McKinnon Indictment27 Feb 2021 — Then, the defendant obtained administrator privileges on these computers and installed RemotelyAn...
-
Source: futureintelligence.co.uk
Title: Gary Mc Kinnon was unlucky
Link: https://www.futureintelligence.co.uk/2012/10/18/gary-mckinnon-was-unlucky-hes-not-even-a-good-hacker/Source snippet
He's not even a very good hacker18 Oct 2012 — “He was asking for passwords to US systems and ways to access them that were common knowled...
-
Source: verticalvertical.com
Title: hacking the pentagon in search of ufos
Link: https://verticalvertical.com/hacking-the-pentagon-in-search-of-ufosSource snippet
Hacking the Pentagon in search of UFO'sIn November 2002, Gary McKinnon was indicted by a federal grand jury in the Eastern District of Vi...
Published: November 2002
Topic Tree