John Draper, a prankster hero to an early generation of hackers, used his status at cybersecurity conferences to arrange private meetings with teenage fans and a reporter where he touched them inappropriately, multiple men have told BuzzFeed News.
The allegations are the latest in what has become in recent weeks an explosion of sexual misconduct reports that have roiled a seemingly endless list of industries, from Hollywood to the news media to the Alabama Senate race.
As in many of those other cases, Draper’s actions were well known to at least a core of people who had regular contact with him. Apple cofounder Steve Wozniak told BuzzFeed News that Steve Jobs once told him that Draper, an early associate, once asked Jobs to sit on Draper’s back in the 1970s, an offer Wozniak said Jobs declined as being “out of the ordinary.”
But in the hacking world, where unusual behavior is accepted and often celebrated, there were few official steps taken to prevent Draper’s overtures to unsuspecting fans.
Volunteers who worked the annual DEF CON hacking conventions in Las Vegas recalled that one of their responsibilities was to separate Draper from his teenage followers. Draper's behavior drew attention at other conventions as well, where he was a frequent presence. Brandon Creighton, a long-standing volunteer at hacker conferences who was familiar with rumors about Draper, recalled escorting him from a private party after ToorCon in San Diego in 2007, though exactly why was not clear.
A spokesperson for DEF CON said that organizers had never received a formal complaint about Draper. When presented with these allegations, the spokesperson said Draper would no longer be allowed to attend the gathering. A spokesperson for ToorCon also said that it would ban him from attending in the future.
“We applaud those individuals bravely stepping forward to tell their stories,” DEF CON organizers said in a statement provided to BuzzFeed News. “The behavior described in these allegations is appalling and has no place in our community. Per DEF CON’s Code of Conduct, this kind of behavior will result in a permanent ban from our events.”
In a series of interviews, six men with direct knowledge of Draper, now 74, described him as habitually meeting young, often teenage men at conferences between 1999 and 2007, touting “energy” exercises or stretches. These included him massaging men in public and urging them to come to his or their hotel room for private sessions. In multiple cases in which the men agreed, Draper would leap on their backs in ways the men described as unwanted sexual contact.
Ethan Smith, now the Los Angeles bureau chief for the Wall Street Journal, told BuzzFeed News that Draper once drew him to his hotel room with the promise of an interview, but then commenced an “exercise,” climbing on Smith’s back and rubbing his erect penis against him.
Another of the three men who joined Draper in his hotel room, James Erickson, said Draper courted him for months as a teenager to join in “energy exercises,” eventually bringing him to his hotel room when he was drunk and jumping on his back. The young man threw Draper off and fled the room, he said.
Through a spokesperson, Draper declined to comment on any of the claims, saying “At this time, we will not be making any statement nor answering any questions.”
Draper is a legendary “phone phreak,” a predecessor to modern hackers who figured out how the right sounds could allow users to exploit telephone systems. He’s best known by the nickname Cap'n Crunch, a reference to a toy whistle that was once packaged with the cereal whose sound was the perfect pitch to let a phreak make free international phone calls.
Draper invented the “Little Blue Box,” an electronic device to better imitate the signal. In 1971, Draper showed his design to two fans, Jobs and Wozniak, who, with Draper’s blessing, began selling an improved version. As Jobs said in 1994, the product was integral to the company. “I don’t think there would have ever been an Apple Computer had there not been blue boxing,” Jobs said.
Draper’s autobiography, Beyond The Little Blue Box, is currently in the preorder stage, and Wozniak has endorsed it.
When reached for comment for this story, Wozniak said that he had no firsthand experience with Draper behaving inappropriately, though he had heard rumors, and knew of one specific incident.
“Jobs was asked by Draper, in the ’70’s, to help Draper exercise by sitting on Draper's back,” Wozniak told BuzzFeed News. “Jobs took this as being out of the ordinary and not up his alley and he avoided it. I cannot presume what it was about, although you are always free to guess.”
“Those with power should never use their power to take advantage of those with less power, including those who are younger,” Wozniak added.
A string of arrests for phone tampering didn’t hamper Draper’s reputation to many in the hacking community, where innovative outsiders can easily run afoul of the law. For years, he was a mainstay at cybersecurity conferences, where he often touted “energy” exercises. Draper claimed in a 1995 interview that he had “an inner sensitivity to people's energy,” adding that “I'm having a heck of a time trying to teach other people to do this.”
Hacker conferences tend to be hectic, energetic events filled with innovative nerds from all around the world, and the hacker community generally tolerates and celebrates oddballs. But Draper’s habit of inviting young men to his hotel room caught the attention of multiple message boards that described Draper’s energy stretches as predatory.
In 2013, a team at DEF CON named itself “Too Old for Cap’n Crunch.”
Still, Draper wasn’t banned outright, though his actions often drew the attention of volunteers who make sure talks, interactive villages, and parties run smoothly. Known as “goons,” the volunteers often took it upon themselves to police Draper’s activities.
“There’s been rumors of things, but there’s never been anyone who has flat-out come out and said ‘he totally did this to me,’” said Neil Wyler, who’s volunteered at DEF CON gatherings since 2002 and as a “senior goon” runs a number of DEF CON events each year.
“There have been instances where I have seen John, where he is sitting down talking to a couple 15- or 16-year-olds, and you’re [concerned],” he told BuzzFeed News. “But it’s Cap'n Crunch, and it’s a hacker conference, and people get excited about meeting what you think of as one of their heroes.”
Sometimes, the goons treated that responsibility with an uneasy humor. About a decade ago, Wyler said, when he was in his mid-twenties, a fellow goon came up to him with a special request.
“They said, ‘Cap'n Crunch is talking to a couple of kids. You’re his type, you’ll distract him.’ I was like, ‘Are you fucking kidding me? You’re using me as bait?’
His fellow volunteers simply needed him to provide a distraction, they said, while they escorted the young men in Draper’s presence away.
“I have no idea what might have taken place or not, but we did walk around a corner in a hall and there he was, sitting on a bench with two kids who were probably 16, 17 years old, and getting their phone numbers.” Wyler approached Draper with a smile, and the plan went off without a hitch.
For other volunteers, policing Draper became a regular occurrence.
“He and I, we don’t get along,” said Matt Lewis, who organized special events for years at DEF CON and other hacking conferences. “What I've seen with my own eyes is him behaving inappropriately around teenagers in the hacker community, and having a harem of young hackers that kind of bubble around him because he plays up the hero card. This has never been a secret, it's flagrant public behavior, and as a result he's been something of a social outcast for many years, although that doesn't stop him from showing up at hacker conventions.”
“Over the past 20 years we’ve interacted maybe 20, 25 times,” Lewis told BuzzFeed News. “Whenever I've been in a position to do so, I’ve forced his removal from events or otherwise denied him entry to events specifically in response to his behavior toward younger hackers.”
Ethan Smith, the Los Angeles bureau chief for the Wall Street Journal, took a job in the spring of 2000 as a reporter at the Industry Standard, a weekly tech publication.
That summer, when he was 29, he covered the Hackers On Planet Earth conference, a biannual weekend gathering in New York City’s Hotel Pennsylvania. He didn’t have much of a plan for how to cover the event, but did at least hope to speak with the celebrity hackers there, including Draper.
In his story, which was syndicated by CNN at the the time and is still online, Smith spends two paragraphs on Draper, describing him as spending “a good deal of the conference enticing young attendees back to his hotel room, where he offers full-contact ‘stretching’ sessions.” He even quotes Draper making the offer to Smith himself, saying “You should try one of my body tune-ups.”
What Smith didn’t tell his editors at the time, and has until now kept private, is that he was subjected to one of Draper’s sessions.
“It was like this guy’s some bizarro Harvey Weinstein,” Smith told BuzzFeed News.
Noting that the hotel lobby was noisy, Draper suggested that Smith accompany him to his room, where it was quieter.
Once they were seated, Draper began describing his energy stretching and touching Smith. “He starts doing this weird thing where he’s kind of massaging my thighs up and down. It didn’t feel particularly sexual. It was just weird. This guy’s a known eccentric. I was just clueless about what was happening here.”
Then, Smith said, Draper moved to the next stage. “He climbs on my back, wants me to give him a piggy back ride, carrying him up and down in the room. I’m still not getting what’s happening. I could feel he had an erection, that he was grinding against my back.”
Smith was bewildered. Draper was a slight man, and Smith, at 6’4, towered over him. “There’s this male component of I’m much bigger than this guy. I could have physically stopped him, but I didn’t. It’s embarrassing.”
Draper never did give the interview.
“He then hops off my back in a good mood, like ok, let’s get out of here,” Smith said. “I didn’t even get an interview with this guy.”
James Erickson first met Draper in 1999, the summer after he graduated high school. He was into the Bay Area rave scene, and attended one at Homebase, a since-demolished party space in an abandoned warehouse near the Oakland Coliseum.
“[It was a] massive event,” he told BuzzFeed News. “The average age there was 19, 20.”
An aspiring hacker who had already attended DEF CON with high school classmates, Erickson wore a T-shirt with a hacker logo on it. An older gentleman approached him and introduced himself as Cap'n Crunch.
“Of course I knew who he was,” Erickson said. “I didn’t think anything of it. He saw my hacker shirt, whatever, that’s cool.”
They chatted for some time, then Erickson went back to dancing. As he left the building that morning, Draper was waiting outside. “He spots me and comes up to me, says, ‘Hey, you want to come back to my place? I do this really cool thing I call energy work,’” Erickson said. He declined, saying he was exhausted, but exchanged contact information.
In the ensuing weeks, Draper repeatedly tried to contact him, Erickson said. “He was always asking if I wanted to hang out and try this bullshit energy work thing. I just kinda kept putting him off. Stupid, I didn’t see any red flags.”
Erickson didn’t meet up with Draper in the ensuing weeks, but in either August of 1999 or 2000 — he can’t remember which — he attended DEF CON at the Alexis Park Hotel in Las Vegas. It wasn’t hard for an underage attendee to find alcohol. One night Draper approached him in the main conference area. “I must have been pretty drunk. I thought, Oh sure, I’ll try your meditation room.”
The meditation exercises involved lifting heavy objects, Draper said. “He had me pick up chairs and heavier things across the table, doing pushups, basically until my arms and legs were getting sore. I started getting sweaty: ‘Oh, just take off your shirt.’”
Draper had Erickson continue with the exercises. “He continues having me do all this stuff. It’s weird. I’m starting to feel really weak, out of breath and gasping for air, and he jumps on my back.”
“I realized something was very wrong and that I needed to get out of there,” Erickson said. He threw Draper off of his back and ran out of the room. Years later, he still has trouble processing what happened.
“It did seem pretty rapey,” Erickson said. “I would just consider it sexual assault. He may have been grabbing himself while I was doing the exercise … he was wearing sweatpants and I think he took off his shirt.”
Lewis told BuzzFeed News that Erickson described an uncomfortable experience with Draper in the hotel room in broad terms immediately after it happened, and more explicitly in the ensuing years.
Given the difficulty in policing behavior that seemed unethical but that wasn’t backed up by a police record — none of the three men who told BuzzFeed News about their experiences filed police reports at the time — Wyler said he believed the hacking community did what it could to protect people from Draper.
Wyler, the longtime DEF CON goon, thinks there's not much conference organizers or the tech world could have done to stop Draper's predation.
“The community’s pretty good about trying to take care of its own,” he said. “So whether it’s a goon or whether it’s a couple random people at a bar saying ‘yeah, this guy’s a creeper and he’s currently doing some creeping, we should go try to defuse the situation,’ I don’t think it would have mattered if it were DEF CON staff or just attendees. We look out for one another. It’s actually one of the nice things about our dysfunctional community.”
Smith said he had never gone public with his interaction with Draper before being contacted by BuzzFeed News, but felt it was appropriate to do so, given the current culture of outing sexual predators.
“Everybody you read about, by definition, the figures that anybody cares about, are kind of by definition powerful people. They’re the people whose names we know. They’re not drugstore managers, they’re Harvey Weinstein,” he said.
“In this context, he did have just enough power relative to me to get me to his hotel room, to feel me out. Every time, I didn’t say anything, so he kept going. To me, it just highlights the reality here. It isn’t like, ‘oh what’s wrong with all these powerful people in our culture.’ All it takes is a little bit of power over somebody else to be able to pull this shit.”
Kevin Collier is a cybersecurity correspondent for BuzzFeed News and is based in New York.
Contact Kevin Collier at email@example.com.
Got a confidential tip? Submit it here.