On April 16, 1992, I was contacted by Kevin Marcus. Marcus learned that we
were investigating individuals who were illegally logging (hacking) into
various computer systems nationwide. Marcus runs a local computer bulletin
board system (BBS) called The Programmer's Paradise. Marcus was concerned
about the illegal activities had had seen on various local BBSs and contacted
me.
Marcus also said that he had received computer messages from a person who goes
by the name (handle) of Knight Lightning in New York who asked him if he heard
anything about our investigation. Knight Lightning told Marcus that on April
3rd a reporter from San Diego by the name of Bigelo had contacted and talked to
him about our ongoing investigation.
-- -- -- -- -- -- -- --
Enclosure 1:
Date: Fri, 10 Apr 1992 18:14:11 -500
To: knight@eff.org
From: Craig Neidorf <knight@eff.org>
Subject: Runaway Teen Hacker Picked Up?
I was just contacted by a reporter in San Diego about a hacker case.
Apparently there is a teenage hacker from Indiana who ran away from home to
California to see some girl there. The local police and the FBI supposedly
picked him up on April 3rd and he remains in their custody uncharged while he
is telling them all sorts of information on hacker rings across the nation.
Does anyone have any clues as to who this kid is or what's going on?
:Knight Lightning
-- -- -- -- -- -- -- --
Enclosure 2:
Date: Thu, 16 Apr 1992 22:25:17 -0400
From: Craig Neidorf <knight@eff.org>
To: tck@netlink.cts.com
Subject: Re: Hi.
Bruce Bigelo, Union Tribune. Left his number at the office. Nothing going on,
but I understand that you called him.
Craig
-- -- -- -- -- -- -- --
Marcus offered to assist us. I asked if he knew of a BBS called Scantronics.
He said that he did and that he had been a member of that BBS and view the
files on that board in the past to see what the board carried. Marcus is a
computer science major at a local college and is doing research in the anti-
virus field. Marcus stated that the board carried a lot of technical data, but
had nothing regarding his subject. Marcus also belongs to other local and out-
of-state BBSs where he talks with other individuals with his same interest.
Marcus stated that he was last on Scantronics BBS about a month ago and he had
seen numerous computer files that involved CBI and carding. Carding is a term
used by hackers who are involved in the illegal or fraudulent use of credit
cards and their numbers. These credit card numbers are obtained from credit
reporting companies such as CBI and TRW, by illegally accessing (hacking) their
way into those company computers and reading or copying private individuals
credit reports and information.
Most copies of credit reports from these companies will show a person's name,
current and previous addresses, social security number, employer, salary, and
all current credit history including all credit cards and their account
numbers. They <the hackers> then use these credit card numbers to obtain
goods.
If one of the hackers used an account number he found on a credit report that
he illegally pulled from the credit reporting company, the victim would most
likely not find out that their card had been illegally used until the next
billing cycle which could be as much as 45 days after the illegal transaction
took place. According to the credit card industry, this is one of the most
risk free and safest way to commit credit card fraud.
Marcus said that the person's name who ran this BBS was Jeremy. He did not
know his last name, but the handle he is known by is "KLUDGE." I asked if he
knew the phone number to this BBS and he gave me 423-4852. The BBS phone
number, the operator's first name, and <the operator's> handle matched the
information we had learned earlier.
Marcus also gave me two disks <that> contained some files which had been
downloaded (left on his BBS) by other persons on his system. He regularly
checks his board and removes or deletes files regarding questionable or illegal
activity such as carding.
I viewed both of these disks and they contained some very interesting files.
These files included various topics <such as> an auto theft manual, CBI manual,
TRW manual, American Express card info, and many other files which if
downloaded or copied by another person, that person could easily gain illegal
access to various credit reporting companies and commit various other illegal
types of activity.
I told Marcus if he came across any further information regarding this type of
activity or further information about the BBS called Scantronics to please
contact me.
On April 17, 1992, I met Marcus and he said that he had logged onto Scantronics
last night by using an access number a friend gave him. This same friend had
let him use his access number to gain access to this BBS on many prior
occasions. He did this on his own, without any direction whatsoever from me or
any other law enforcement official.
Marcus handed me a 5 1/4" computer disk and said that it contained some file
listings and a list of all validated users. Marcus also stated that the disk
contained a copy of the messages that were sent to him through his BBS by the
person in New York regarding our investigation [those messages displayed above
from Knight Lightning].
He asked me if I wanted him to log on and see for myself what was on "KLUDGE's"
BBS. I told him that I would have to consult with the D.A.'s office first.
However, I was unable to get a hold of our D.A. liaison. I told <Marcus> that
I'd get back with him later.
After talking to D.A. Mike Carlton, I advised Marcus not to go into Scantronics
BBS unless it was for his own information. However he said that if he came
across any further information during his normal course of running his own BBS,
he would notify me.
-- -- -- -- -- -- -- --
[The police report also contained 60 pages of printouts of postings and text
files found on Scantronics BBS. It is also made very clear that Kevin Marcus
(aka The Crypt Keeper) accessed Scantronics BBS by using the password and
account number of The Gatsby. Files include:
- "Credit Bureau Information" which sounds harmless enough to begin with and
turns out is actually a reprint of an article from the September 27, 1992
issue of Business Week Magazine
- "Advanced Carding" by The Disk Jockey, which dates back to 1987.
- "The Complete CBI Manual of Operations" by Video Vindicator and Kludge,
dated October 10, 1991.
Aftermath
~~~~~~~~~
On April 23, 1992, a search warrant was issued in the municipal court of the State of California in the county of San Diego which authorized the seizure of:
A. All telephone company subscriber information to include service start date,
copy of most current billing statement, current credit information, and
location of telephone service to the following telephone numbers;
(619)XXX-XXXX and (619)XXX-XXXX and any other telephone number information
in any chain of call forwarding, to or from the listed phone numbers.
B. All telephone company records which includes subscriber information,
service start date, copy of most current billing statement, current credit
information, and location of telephone service phone numbers to which calls
are being forwarded to or from, from the listed phone numbers.
CERTIFICATION TO DEFER NOTIFICATION TO SUBSCRIBER
The Court finds there is substantial probable cause to believe
notification to the subscriber whose activities are recorded in the
records described above would impede or destroy this investigation.
Accordingly, the court certifies the request of the San Diego Police
Department that notification to the subscriber be deferred pending
further order of this court.
On April 30, 1992, a search warrant was issued in the municipal court of the
State of California in the county of San Diego which authorized the search of
Kludge's residence and the seizure of:
All computer equipment and paraphernalia use in computer hacking, or apart
of the BBS known as Scantronics which includes, but is not limited to
monitor(s), keyboard(s), CPU(s), which may or may not contain hard disk
drive(s), floppy drive(s), tape drive(s), CD rom drive(s), modem(s),
fax/modem(s), all hard copies (paper copies) of any computer files which
have been stored or currently stored on/in a computer system, all
documents whether in hard or data form which show how to operate any
computer program or computer file, all memory storage devices which may
include hard disk drive(s), 5 1/4" and 3 1/2" computer memory storage
disks, all computer memory storage and computer back up tapes, and all
computer CD rom disks capable of computer data storage; and, documents and
effects which tend to show dominion and control over said premises and
computer system, including fingerprints, records, handwritings, documents
and effects which bear a form of identification such as a person's name,
photograph, social security number, or driver's license number and keys.
The warrant was used immediately and Scantronics BBS and much more was seized.
