ALI FBI HEREIN IS yghg DATE 09 20 2312 BY EDEE UCEDaw sabfaa FEDERAL BUREAU OF INVESTIGATION Precedence ROUTINE Date 2 19 1998 To Director FBI Attn Acting Unit Chief From WFO b Contact SSAI I Approved By I VI Drafted By Lrar File Number s 288-HQ 124256013Pending Title SOLAR CITAC 00 HQ Synopsis Following is the status of WFO's involvement in this investigation as of 2 19 98 Reference EC dated 2 17 98 to Houston Division Details 1 IU S NAVY OO SAI Iis coordinating all investigative activity with Agents of the Naval Criminal Investigative Service NCIS based in both Washington D C and Jacksonville Florida Evidence obtained from subject s University of Northern Florida UNF account has disclosed continuing access to that account from an IBM NET connection The Trap Trace pen register order b3 forl Iis being submitted this evening to the magistrate Order b6 - I b7c Results are anticipated to support a subsequent 2703 order to forI I The subject s current whereabouts and employment are known Coordination with the NCIS Agents will continue The installation of the monitoring software atI Iwas initiatedl Ib WFO is contacting Georgetown University University of Virginia and MW J 4 @31 3 1 95 FEDERAL BUREAU OF INVESTIGATION To WMFO From WMFO Re 66 12 01 1995 Georgia State University and the original ISP victim complainant in Lawton OK SUNRISE CITAC MATTERS 00 Optical disks received from Houston Copies will be made ASAP for AF Navy DISA Cbntact has been made with IBM network management and IBM is trace routing Israeli network leg Should know soon of monitoring ability from within US of overseas leased nets Analysis performed for three compromised systems 1 Univ California Berkeley 2 Andrews AFB 3 US Naval Academy To date nothing significant has been identified in the most recent JID data collected for the past day or so Observed two suspicious sites netgate saes com and netdex com WFO has not confirmed the nexus on these sites Gospelcom net not contacted due to NCIC checks b6 revealing Thegospel com does b7C not answer phone nor do they call back when message left Will continue to try to contact Slip-stream net SYSOP did not see anything unusual They have been hacked before and do not consider this out of the norm133 Sealed pursuant to court order On 02 13 98 Court Order served onI I 91 rsr - '3 assa ' Second 2703 order provided to Second order will provide additional information FERMI Labs and Oakridge National Labs report no intrusions at their sites All traffic to from labs is legitimate and explainable No known connection to this case No further information from DISA OO SAI Iis addressing this matter with the assistance of theI I land WFO CART Subject s home was consensually searched for computer and computer media the evening of 2 17 98 Newark Division CART Copy will be provided b6 2 b7C b7E Referral Consult zrnv s-ermiz l 4 403 3'1 95 FEDERAL BUREAU OF INVESTIGATION To WMFO From WMFO RE 66- 12 01 1995 Referral Consult Subject provided detailed interview to both FBI and Agents Gave no indication he was part of ongoing investigation A review of his system is under way - - mama-3Tfmg -x' A bu 4 7 A a - mes- 3