Unlike Arizona’s cops, anyone paying attention to the cybersecurity world that summer would have known the answer to the mystery of the hotel ghost thief. “It was like a ghost had slipped in and slipped out.” No forced entry,” recalls Tyler Watkins, a detective for the Tempe, Arizona, police department who tracked those first cases.
But what kind of maid steals flatscreen televisions from multiple rooms? Or entire suitcases full of guests’ possessions? At first the hotels suspected their own staff.
But there were none of the usual signs of forced entry, like broken windows or smashed doorjambs. Hotels around central Arizona were reporting robberies, one after another. (Cashatt himself would later hint to me that the number was actually well more than a hundred.)īut flash back to the late summer of 2012, when Cashatt’s hotel break-ins were just getting started, and the cops were mystified. According to one document shared among cops in June 2013, officials estimated that Cashatt was responsible for 78 hotel burglaries. And he’d amass, by some estimates, close to half a million dollars’ worth of stolen goods.Įventually, Cashatt’s lock-hacking spree triggered Operation Hotel Ca$h, a multi-agency police operation aimed at tracking him down. His intrusions would stretch from Arizona to Ohio to Tennessee as he worked to stay ahead of law enforcement.
He’d escalate from stealing TVs to targeting guests’ luggage and walking out with all the possessions he could find.
Over the next year, Cashatt exploited an obscure software bug in one ultra-common model of hotel keycard lock to break into hotel after hotel in what would become an unprecedented, all-he-could-eat buffet of serial digital thievery. That spontaneous laundry heist was, in fact, the modest beginning of an epic crime spree. Tucking them under his arm, he quickly walked out the door, down the stairwell, out a side exit to the red Mitsubishi Galant he’d parked outside, and drove away. So on an impulse, he grabbed a pile of towels and pillows. Then he sat upright and started thinking about what he could steal.īolted to the dresser was an expensive-looking TV, but he didn’t have the tools to remove it. Even in his meth-addled state, he was so taken aback by his success in hacking his way in that he laid down on the room’s king-size bed for perhaps a full minute, his heart racing. “It was like the heavens had opened,” he’d say of the moment years later.Ĭashatt pushed open the unlocked door, walked into the room, and closed the door behind him. Instantly, the lock whirred as its bolt retracted, and a green light flashed above the door handle.įor a moment, Cashatt stared in shock, almost disbelief. Then he held a frayed wire coming off the board to one end of the battery, completing an electric circuit. Instead, he reached underneath the lock on the door until his finger found a small, circular port and inserted the plug of his device. He looked at the keycard lock on the door in front of him, a metallic box that offered a vertical slot ready to accept a guest’s keycard like a piece of bread into a toaster.Ĭashatt didn’t have a keycard. On one end of that loosely assembled gadget was a cord attached to a plug.
He pulled out a sunglasses case from his pocket, flipped it open, and removed a small tangle of wires connected to a circuit board and a nine-volt battery. When he found a quiet stretch of hallway, Cashatt chose a door and knocked. Six feet tall with blond, close-cropped hair, he wore a black sports coat and baseball cap and kept his head down so the hat’s brim hid his face from surveillance cameras. On a warm Phoenix night five years ago, Aaron Cashatt walked down the red-carpeted hall of the second floor of a Marriott hotel, trying to move casually despite the adrenaline and methamphetamine surging through his bloodstream.