01 26 1998 To From Precedence ALL CSHTAII-IED IS 135$ FEDERAL BUREAU OF INVESTIGATION 1999 PRIORITY All Field Offices National Security Newark Attn Attn Date 10 06 1999 SAC SSA Room 11719 Contact Approved By a ox Mru Drafted By 9 I gBending Ea Case ID Titlezl ET MELISSA IMPAIRMENT INFO AKA Synopsis To request all field offices to gather and report damages to victims infected by the Melissa Macro Virus Details For information of receiving offices the Newark Division is requesting the assistance of all field offices in identifying and reporting damages caused by the Melissa Macro Virus to corporations organizations and agencies including federal state respective territories investigative activities ongoing investigation of and local government in their The following is a summary of and developments pertaining to the the MMV On 3 26 99 the MMV was proliferated on an America Online network news server through a posting to the alt sex news rou a stolen AOL account belonging to the screen name posting contained a file document called list doc names of alleged cracked pornographic websites An attachment to the posting contained The newsgroup called list zip which contained a The list doc document contained the MMV The MMV infected those using Microsoft Windows and Microsoft Word Outlook and Outlook Express MMV was coded to users email address book send an infected document to the first 50 addresses in each The compounding effect of MMV i136 2337C proliferation caused many email servers throughout the U S and - J48 g 065% Leak eege m v ff' 14 67 To All Field fices From Newark Re 288AHNK-99660 10 06 1999 rest of the world to crash Systems administrators and Information Technology personnel scrambled to mitigate the effects of MMV on their systems - On 4 1 99 the Newark Division and the New Jerse Dn'l'imn TJH r rh 'T'n 'h'nnlogy Crime Unit arrested pursuant to a state of New Jersey arranr obtained Monmouth County Superior Court Judge was charged with second degree offenses of interruption of public communication conspiracy to commit the offense and attempt to commit the offense third degree theft of computer service and third degree damage or wrongful access to computer systems relating to the propagation of the computer macro virus kno n as WELISSAP Earlier that evening prior to the arrest of the Newark the NJSP exe New Jersey search warrant at residence The initial information leading to the arrest and execution of search warrants came from Am r' Online Inc Dulles icontacted the State of New Jersey Attorney Generars Office with lead information with respect to MELISSA The State Attorney Generars Office enlisted the NJSP High Technology Crime Unit who in turn enlisted the assistance of the Newark FBI NIPC squad warrants at 136 b7C I On 4 16 99 Newark anc the NJSP seized from 14 back up cartridges and other computer evidence fro The District of New Jersey U S Attorneys Office and the Attorney Generars Office for the state of New Jersey anticipate returning simultaneous indictments on or about October 31 1999 To aid the prosecution it has been requested that Newark obtain detailed victim information relating to damages caused by the Melissa Macro Virus This information is critical to the prosecution of captioned subject s Questions regardirg this communication should be b6 directed to SA Newark Divisinwg NTPC Squad at b7C Franklin Townsaip RA telephone To All Field Offices From Newark Re 10 06 1999 LEAD S Set Lead 1 ALL RECEIVING OFFICES Newark requests all field offices to identify victim corporations organizations and agencies including federal state and local government in their respective territories infected by the Melissa Macro Virus Newark recognizes that this is an inherently difficult task and asks field offices to utilize liaison contacts including those developed through the Key Asset and InfraGard Programs where applicable Field divisions are also asked-to identify and follow up on'any complaints previously received relating to MMV and report those instances to Newark If necessary Federal Grand Jury subpoenas will be made available when requested Victims should report in dollars their best calculation of the damages caused by MMV Victims may be asked to verify their reported damages in federal court Information requested should detail the nature and extent of damages caused by MMV including but not limited to the following areas email servers desktop computers and other computer hardware affected computer system downtime personnel time including overtime for corrective action lost productivity lost contracts and missed business opportunities diminished profits consulting expenses infrastructure costs lost customers and sensitive data leakage Set Lead NATIONAL SECURITY AT WASHINGTON DC Read and clear 06