DECLASSEFEED BY 01 25 1998 A an Precedence PRIORITY Date 12 02 1998 To National Security Attn NIP 1887 Boston Attn NIPC Supervisor Coordinator Charlotte Attn NIPC Supervisor Coordinator Columbia Attn NIPC Supervisor Coordinator Indianapolis Attn NIPC Supervisor Coordinator Los Angeles Attn NIPC Supervisor Coordinator Mobile Attn NIPC Supervisor Coordinator Philadelphia Attn NIPC Supervisor Coordinator Pittsburgh Attn NIPC Supervisor Coordinator San Antonio Attn NIPC Supervisor Coordinator Tampa Attn NIPC Supervisor Coordinator From Cincinnati Squad 4 Cont ct SP 'Nh 2 b6 Approved By b7c Drafted By Case ID #H wa Title tun- M MOONLIGHT MAZE Synopsis w h Mix Derl H3 I a Slf y n ea a our ocume Enclosures m Q Detailszmi gi For information of recipients captioned matter is a joint FBI United States Air Force Office of Special Investigations AFOSI computer intrusions investigation By way of brief background FBI Cincinnati is investigating unauthorized ogre p 22 ff -X - 91 h 9- 41 7-234 3371560111 -I To National Security From Cincinnati Re uwlsi 12 02 1998 intrusions into computer systems located at Wright Patterson Air Force Base WPAFB Dayton Ohio The intrusions appear to be originating from Russia hopping through the University of Cincinnati UC Cincinnati Ohio then terminating at WPAFB The unknown intruder s has transferred several sensitive though not classified files to Russia The transferred files generally are word processing and or power point presentations dealing with cockpit design and computer chip schema m gi Investigation has revealed that the unknown intruder s has made connections to various other educational sites not previouslv seen I b3 OTHER Sealed Court Documents mi xi Recipient Field Offices should ensure that the respective network systems administrators from the educational sites in their Division are informed that once the data from their compromised systems has been analyzed and compared to data from other compromised systems the FBI may reque assistance in furtherance of this investigation b3 pawl OTHER Sealed fiourt Document A Chain of Custody form saould be included with the original evidence Any and all original interviews conducted with network systems administrators should be forwarded to FBI Cincinnati and a copy to FBIHQHNIPC FBI Cincinnati will forward the original evidence to the District of Columbia Forensic Laboratory DCFL Bolling AFB Washington D C for analysis DCFL will return all original evidence to FBI Cincinnati for proper storage semi To National Security From Cincinnati Remix 12 02 1998 Set Lead 1 BOSTON AT CAMBRIDGE MA in MA Set Lead 2 CHARLOTTE AT DURHAM NC m Set Lead 3 COLUMBIA AT GREENVILLE SC 133 i136 OTHER Sealed Court Document cm I Set Lead 4 INDIANAPOLIS AT SOUTH BEND IN w To National Security From Cincinnati Re ux-7% 12 02 1998 Set Lead 5 LOS ANGELES AT PASADENA CA UL Set Lead 6 MOBILE AT AUBURN UNIVERSITY AL I I I Set Lead 7 ha 136 PHILADELPHIA b7C OTHER Sealed Court Documents AT BRYN MAWR PA A 9 WE i max l I I I 05c qu x 13 - Set Lead vg WLb I Nab QQA 3 I I wait AT HAVERFORD PA g g tm Lug 571- Sun 320 4 cm a We - 9 4 Set Lead 9 Law 5 s 4 2 Nu ab To National Security From Cincinnati 12 02 1998 PITTSBURGH AT PITTSBURGH PA 3 33 i306 2337C OTHER Sealed Court Documents w Set Lead 10 SAN ANTONIO AT AUSTIN TX mam M I Set Lead 11 TAMPA AT MELBOURNE FL UHE6I