Compu-Fix/Compu-Fix.iso/pubnews/cud216.txt

Text File | 1993-03-01 | 38KB | 801 lines

  ****************************************************************************
                  >C O M P U T E R   U N D E R G R O U N D<
                                >D I G E S T<
              ***  Volume 2, Issue #2.16 (December 10, 1990)   **
        *> SPECIAL ISSUE: "ATLANTA THREE" SENTENCING MEMORANDUM <*
  ****************************************************************************

MODERATORS:   Jim Thomas / Gordon Meyer  ([e-mail])
GENERALIST:   Brendan Kehoe ([e-mail])
ARCHIVISTS:   Bob Krause / Alex Smith

USENET readers can currently receive CuD as alt.society.cu-digest.

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may be reprinted as long as the source is
cited.  Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.
It is assumed that non-personal mail to the moderators may be reprinted
unless otherwise specified. Readers are encouraged to submit reasoned
articles relating to the Computer Underground.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent the
            views of the moderators. Contributors assume all responsibility
            for assuring that articles submitted do not violate copyright
            protections.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The following is the prosecution's sentencing memorandum submitted to the
judge. Although it specifies that the defendants were cooperative and
requests a "downward" departure from the sentencing guidelines, it
nonetheless requests prison time. In our view, the sentence was unduly
harsh, and the memorandum reflects a number of substantial inaccuracies,
distortions, and questionable arguments in making the claim that prison is
necessary. In the next issue of CuD (2.17), we will print two responses to
this memo, including that of the EFF.

The first issue of EFF NEWS, the official newsletter of the Electronic
Frontier Foundation, will be distributed this week.  More detailed
information on this, including how to obtain it, will be in the next issue.

The sentence was imposed Friday, November 16, 1990.  Robert Riggs received
a sentence of 21 months incarceration.  Franklin E. Darden, Jr., and Adam
E. Grant each received 14 months incarceration (seven months of it to be
served in a half-way house).  All were additionally required to pay
$233,000 each in restitution, but all are responsible for the full sum of
about $700,000 should any of the others default.  For a complete discussion
of the sentence, see John and Barbara McMullen's article in CuD 2.14.

   ********************************************************************

                    IN THE UNITED STATES DISTRICT COURT

                   FOR THE NORTHERN DISTRICT OF GEORGIA

                             ATLANTA DIVISION

UNITED STATES OF AMERICA             :
                                     :     CRIMINAL ACTION
         v.                          :
                                     :     NO. 1:90-CR-31
                                     :
ADAM E. GRANT, a/k/a The             :
Urvile, and a/k/a Necron 99,         :
FRANKLIN E. DARDEN, JR., a/k/a       :
The Leftist, and                     :
ROBERT J. RIGGS, a/k/a               :
The Prophet                          :

        GOVERNMENT'S SENTENCING MEMORANDUM AND S.G. SS 5K1.1 MOTION

     Now comes the United States of America, by and through counsel
Joe D. Whitley, United States Attorney for the Northern District
of Georgia, and Kent B. Alexander, Assistant United States Attorney
for the Northern District of Georgia, and shows the court the
following:

     From September 1987 through July 21, 1989, the defendants
regularly broke into proprietary telephone computer systems, stole
access information, distributed that information toothers
throughout the country, and, in the process, regularly used
unauthorized long distance/data network services. In all, they
stole approximately $233,880 worth of logins/passwords and connect
addresses (i.e., access information) from BellSouth. BellSouth
spend approximately $1.5 million in identifying the intruders into
their system and has since then spent roughly $3 million more to
further secure their network.

Although the government is going to recommend a downward
departure from the Sentencing Guidelines, the three defendants
are clearly criminals who have caused a significant amount of damage


                                   - 1 -

and should be punished accordingly. Moreover, the computer
"hacker"%1% world is watching this case very closely, and the Court
should send a message that illegal computer hacking activities will
not be tolerated.

In this sentencing memorandum the government will describe the
investigation in the case, summarize some of the evidence that
would have been presented at trial, and describe the defendants'
cooperation. Finally, the government will emphasize the role this
case has played and will continue to play in curbing abuses in the
hacker community.

I. _THE INVESTIGATION_

In June of 1989, a computer threat and a computer intrusion sparked
a massive federal investigation into the computer hacking
activities of a self-proclaimed elite group of roughly 20 hackers
called "Legion of Doom." The threat involved an anonymous all to
an Indiana Bell security representative from a computer hacker. The
hacker, who has since been identified as an associate of the
defendants, will e called "John Doe" for purposes of this
memorandum. John Doe said that five telephone switches (telephone
company computers that route calls) would be programmed to shut
down the telephone system throughout the country. AT&T
investigators conducted a nationwide search and discovered "logic"


________________________
%1%The government uses the term "hacker" to describe a person
who uses computers for criminal activity. The Court should note,
however, that the term "hacker" can also be used to describe
legitimate computer users. At one time all computer users were
known as "hackers," and some computer users still identify
themselves as "hackers."

                                   - 2 -

bombs" (time delayed programs) in AT&T computers located in
Colorado, Georgia, and New Jersey. The logic bombs were programmed
to shut down service in portions of those states.

Aside from the hacker logic bomb threat, a June 1989 intrusion into
the BellSouth network also prompted the federal investigation.
A computer hacker broke into the BellSouth network and rerouted
calls from a probation office in Delray Beach, Florida to a New
York Dial-A-Porn number. Although creative and comical at first
blush, the rerouting posed a serious threat to the security of the
telephone system. If a hacker could reroute all calls to the
probation office, he or she could do the same to calls placed to
this Court, a fire station, a police station or any other telephone
customer in the country. Again, none of the three defendants are
implicated in this dangerous prank, though an investigation of the
intrusion ultimately led investigators to the illegal activities
of the three defendants and other members of a self-proclaimed
elite group of hackers called the Legion of Doom. The Legion of
Doom is described in a hacker "magazine" article filed separately
as _Government Exhibit A_.

In mid-June 1989, BellSouth%2% assembled a major security task
force consisting of 42 full-time employees to investigate the
intrusions. It assigned the employees to work 12-hour round-the-
clock shifts for nearly a month. To BellSouth's credit, the
management decided to go public with the intrusions by alerting the

________________________

%2%For purposes of this memorandum, "BellSouth" also refers to
Southern bell Telephone and Telegraph Company and BellSouth
Advanced Network, subsidiaries of BellSouth.

                                   - 3 -

United States Secret Service%3%.

On June 21, 1990 %sic%, a confidential "hacker" informant admited
that "The Urvile" in Atlanta (defendant Adam Grant) had provided
him with the access information necessary to break into the
BellSouth computer network. Based on that evidence and further
investigation, this office and the Secret Service arranged for a
court-authorized dial number recorder ("DNR") (i.e., pen register)
to be placed on the telephone lines of defendants Adam E. Grant,
Franklin E. Darden, Jr., and Robert J. Riggs.

From July 11 through July 21, 1989, a pattern emerged showing
that all three defendants were making outgoing calls and "looping"
the calls around the country and into the BellSouth computer
network. "Looping" is a system hackers use to transfer their calls
through a number of telephone companies and data networks (e.g.,
Telenet) to gain free telephone service and to avoid detection by
the authorities. The defendants would often start their loops by
patching into the Georgia Tech computer system, courtesy of access
numbers provided by defendant Grant. After looping the calls,
defendants used unauthorized connect addresses and logins/passwords
to break into the BellSouth system. Connect addresses are the
computer equivalent of a street address and logins/passwords are
like keys to houses (computers) on the street. The DNR records

________________________

%3%All computer systems using modems (telephone computer links)
are susceptible to computer hacker break-ins, but most companies
do not "go public" when break-ins occur for fear of bad publicity.
Unfortunately, when companies pretend such problems do not exist,
other companies develop a false sense of security with regard to
hacker intrusions. Fortunately, BellSouth took the public route.

                                   - 4 -

also revealed that the defendants were speaking with one another
and with backs from all around the country. Once BellSouth pin-
pointed the break-ins and determined that the hackers were
downloading BellSouth information (i.e., stealing information and
copying it into their own system), the Secret Service had enough
information to obtain a search warrant.

On July 21, 1989, the Secret Service executed search warrants
on all of the defendants' residences. At the same time, the Secret
Service executed a search warrant in Indiana on the home of the
"John Doe" hacker mentioned above. That hacker has since been
charged and convicted on computer fraud charges.

During the searches, the Secret Service uncovered thousands
of pages of proprietary telephone industry information, hundreds
of diskettes, a half-dozen computers and reams of incriminating
notes. After BellSouth and the Secret Service analyzed all the
evidence and interviewed the defendants and other hackers, the
government was able to piece the case together and seek an
indictment from the grand jury.

II. _THE EVIDENCE_

     A. _What the Evidence Generally Shows_

If the case had gone to trial, the evidence would have shown
that defendants Grant, Darden and Riggs used a variety of methods
to break into the BellSouth telephone systems. To start, they and
other Legion of Doom ("LOD") members would go "trashing" or
"dumpster diving" (i.e., scavenging through dumpsters) behind
BellSouth offices, usually in the dead of night. They took memos,

                                   - 5 -

printouts, and other documents. Additionally, when back at their
personal computers, they created hacking programs to break into the
BellSouth systems and obtained access information from fellow
hackers. Using all of these tools, the defendants broke into over
a dozen BellSouth computer systems. Once in the systems, the
defendants would scan the files for information they wanted to
steal and get into other computer systems of other entities,
including Credit Bureaus, hospitals, banks%4% and other private
corporations.

Among other information, the defendants downloaded BellSouth
passwords and connect addresses which they could later use to
return into the particular system they were scanning or to get into
other systems. Defendants also downloaded subscriber information
on individual customers. By getting subscriber information, the
defendants could change customer services (e.g., call waiting) and
obtain access to Credit Bureau information. Defendants Grant and
Darden also figured out how to wire tap telephone calls using a
BellSouth computer system called LMOS. Darden admits monitoring
friends' calls, but claims to have only done it with the knowledge
of the friends. Evidence recovered from Grant's dorm room
indicates that he monitored calls as well. The government has no
direct evidence that defendant Riggs monitored calls, though the
Secret Service did recover LMOS access information in the search
of Riggs' residence.

________________________

%4%During a meeting with the Secret Service, defendant Grant
admitted breaking into a bank in the State of Texas and altering
deposit records.

                                   - 6 -

The defendants and other LOD members freely exchanged
information they stole from BellSouth. Although it does not appear
that defendants themselves used this information to transfer any
money to themselves, they clearly exploited the services of the
telephone companies and data networks when making and receiving
hundreds of hours of free long distance service.

During the course of the conspiracy, the defendants and other
LOD members illegally amassed enough knowledge about the
telecommunications computer systems to jeopardize the entire
telephone industry. During one interview, defendant Darden
nonchalantly revealed that the defendants could have easily shut
down telephone service throughout the country.

The defendants freely and recklessly disseminated access
information they had stolen. By doing so, they paved the way for
others to easily commit fraud. For instance, in early 1989, Adam
Grant introduced defendants Robert Riggs and Frank Darden to a 15-
year old hacker, already identified as "John Doe." Based largely
on the information from the defendants, John Doe managed to steal
approximately $10,000. Basically, Doe used the information from
the defendants to reroute calls, enter Credit Bureaus, and have
Western Union ire money from credit card accounts captured from
the Credit Bureau records.

Defendants claimed that they never personally profited from
their hacking activities, with the exception of getting
unauthorized long distance and data network service. At the very
least, however they should have foreseen the activity of people

                                   - 7 -

like John Doe, particularly in light of articles on computer
hacking, stealing and fraud which they collected and authored (some
of which are described in Section B below).

Defendants disseminated much of their knowledge and stolen
information posting the information on electronic bulletin board
services ("BBS's"). A BBS is a computerized posting service
allowing hackers to post messages to one another, usually 24 hours
a day. Most BBS's around the country are perfectly legal and allow
legitimate computer users to communicate with each other. The LOD
created a BBS named "Black Ice," however, primarily to foster
fraudulent computer activities. Excerpts from the Black Ice BBS
are filed separately hereto as _Government Exhibit B. A review of
the Black Ice printouts reveals that defendants all realized that
braking into the telephone computer systems was illegal and that
they took precautions not to get caught. Of great concern are the
frequent references to law enforcement and national security
computer systems.
     B. _Specific Examples of Items Recovered from Each Defendant_

A brief review of some of the evidence recovered from each of
the defendants' residences during the July 21, 1989, searches will
shed further light on the criminal nature of their conduct. Please
bear in mind, however, that what follows is a description of only
a very small portion of the immense amount of material recovered
from each defendant.
          1. _ADAM E. Grant_
             --Hundreds of telephone numbers, connect addresses,
               logins/passwords, and loops for various Bell

                                   - 8 -

               computer systems.

            -- Files on how to hack voice mail, how to hack Bell
               company passwords, war dialing programs, time bombs,
               Georgia Tech computer accounts.

            -- Articles and tutorials on a number of topics. The
               articles outline information about a topic, while
               tutorials outline how-to steps to accomplish
               specific objectives (e.g., stealing access codes).
               Grant had articles and tutorials on hacking into the
               telephone system, building blue boxes (i.e., devices
               that simulate computer tones and allow free
               telephone access), using "loops," using Telenet,
               getting "root" access to BellSouth systems, (i.e.,
               free run of the system), planting "trojan horses"
               into UNIX (a trojan horse is essentially a time lapsed
               computer program and UNIX is the computer system
               used by BellSouth). Some article/tutorials titles
               include "Building Blue Boxes," "How to Rip off Pay
               Stations," "Hacking Telco Outside Plant," "Hacking
               Satellite Transponders," Defeating the Total
               Network," "UNIX Security Issues," and "UNIX for the
               Educated" by Urvile.

            -- One article specifically addressed malicious damage
               to and slowing down of a UNIX system. This article
               is noteworthy because it includes details on how to
               bring a central office of the telephone system "to
               its knees" by inserting a program to continually
               make directories on a disk until the switch (i.e.,
               BellSouth office computer that routes phone calls)
               runs out of disk space.

            -- Three letters to Grant from Georgia Tech complaining
               about his abuse of the system. The letters,
               attached as _Exhibit C_, indicate that Georgia Tech
               was very concerned about Grant's abuses of their
               system.

            -- Credit Bureau report on Bruce Dalrymple. Grant
               tutored the former Georgia Tech basketball star and
               broke into the Credit Bureau to get Dalrymple's
               credit history. Grant and the other defendants
               essentially had the power to review millions of
               citizens' credit histories by breaking into Credit
               Bureaus.

            -- Numerous phone numbers of military installations.

            -- Detailed information on LMOS, the system through
               which Darden and Grant tapped into other parties'

                                   - 9 -


              computer systems.


            -- AT&T Mail access numbers.

            -- MCI credit card access numbers.

            -- Telenet system addresses.

            -- List of user accounts on the Georgia Tech computer
               system.

     2. _FRANKLIN E. DARDEN

            -- Hundreds of telephone numbers, connect addresses,
               logins/passwords, and loops for various Bell
               computer systems.

            -- Files on Secret Service interrogation methods,
               computer-related laws/arrests, methods to defraud
               long distance carriers, and social engineering
               (getting information by pretending to work for the
                phone company).

            -- Articles and tutorials on blue and silver boxing,
               hacking voice mail systems, tapping a neighbors'
               phone, blue boxing, "military boxing" installing
               small transmitters on neighbors' terminal boxes.
               Titles of some of the articles included "How to Make
               Flash Bombs," "Hacking Voice Mail Systems," Hacking
               the Hewlett-Packard 3000 Computer," and "Art of Blue
               Box Construction."

            -- Extensive information on LMOS, including tutorials
               and handwritten notes concerning illegally wire
               tapping telephone lines.

            -- Sprint codes and Telenet addresses and passwords.

            -- Unauthorized Credit Bureau reports on other
               individuals stolen from CBI.

            -- Information on credit card fraud using Western
               Union. Interestingly, the John Doe mentioned above
               spoke with Darden many times concerning computer
               information and ultimately devised a credit card
               fraud scheme using Western Union Wires.

            -- A listing of credit card fraud laws in Michigan.

                                  - 10 -

            -- UNIX tutorial by The Urvile.

          3.   _ROBERT RIGGS_

            -- Hundreds of telephone numbers, connect addresses,
               logins/passwords, and loops for various Bell
               computer systems.

            -- File on "netcatch.c" a program designed to
               eavesdrop on computer-to-computer communications.

            -- Articles and tutorials concerning hacking passwords,
               understanding telephone security systems, and
               understanding voicemail systems. The articles
               tutorial titles included "Hacking COSMOS Part 2,"
               "BellSouth's central System for Main Frame
               Operations," "MVS from the Ground Up" by Riggs, and
               "UNIX Use and Security from the Ground Up" by Riggs.

            -- The E911 file. This file which is the subject of
               the Chicago indictment, is noteworthy because it
               contains the program for the emergency 911 dialing
               system. As the court knows, any damage to that very
               sensitive system could result in a dangerous
               breakdown in police, fire, and ambulance services.
               The evidence indicates that Riggs stole the E911
               program from BellSouth's centralized automation
               system, AIMSX. Riggs also managed to get "root"
               privileges to the system (i.e., free run of the
               system). Bob Kibler of BellSouth Security estimates
               the value of the E911 file, based on R&D costs, is
               $24,639.05.

            -- Handwritten note listing Riggs' top three goals:
               "Learn LMOS" %the system connected to monitoring
               phone lines%; "Learn PREDICTOR" %the BellSouth
               mechanized system concerning maintenance of
               telephone systems outside of the main office%; and
               %Learn C Programming" %computer programming%.

            -- Sprint access information

            -- Password hacking programs.

            -- Urvile's COSNIX tutorial (a how-to lesson relating
               to breaking into a BellSouth system).

All three defendants obviously stored significant amounts of
information in their home relating to illegal activities. In

                                  - 11 -

fairness to defendant Riggs, however, the Court should know that
Rigs had less evidence of illegal activity than Grant and Darden.
Apparently, defendant Riggs temporarily ceased illegal computer
activities after his computer fraud conviction in North Carolina
and parted company with some of his records. Eventually, however,
he again started to break into the BellSouth computer systems. By
the time of the search on July 21, 1989, rant, Darden and Riggs
were breaking into bellSouth computer systems and other computer
systems at will and were routinely downloading information.

III. _DEFENDANTS' PRIOR CONDUCT_

All of the defendants have been "hacking" for several years.
Defendant Riggs, however, is the only one with a prior conviction.
That conviction is described in _Government Exhibit D_ (filed
separately).

IV. _DEFENDANT'S COOPERATION AND THE GOVERNMENT'S RECOMMENDATION
     OF A DOWNWARD DEPARTURE_

All three defendants have provided significant cooperation
that has fueled further investigation into the activities of a
number of computer hackers around the country. In light of the
substantial assistance each defendant has provided, as described
below, the government movees for this Court to make a downward
departure pursuant to S.G. 5K1 in the amount of three levels for
defendants Grant and Darden and two levels for defendant Riggs.

     A. _Cooperation of Adam E. Grant_

        1. July 21, 1989 - After the search of his residence,
Grant gave a statement to the United States Secret Service. He was

                                  - 12 -

not forthcoming and generally denied any wrongdoing. By the time
he pled guilty, however, Grant had realized the severity of the
crime and was very forthcoming with helpful information.

        2. July 16, 1990 - Grant spent approximately 2-3 hours
meeting with Assistant United States Attorneys from Chicago
regarding the Craig Neidorf Case. Grand provided valuable
information to assist in the prosecution of the case. Grant agreed
to testify, though when the prosecutors called him at the last
minute to fly to Chicago, he declined because of his school
schedule. Ultimately, the Chicago office did not need him to
testify.

        3. August 9, 1990 - Grant met with a number of Secret
Service agents and representatives of BellSouth to discuss all
aspects of the investigation in Atlanta and divulge information
about other members of the Legion of Doom. The meeting lasted more
than 8 hours and Grant provided a substantial amount of helpful
information. Special Agent William Gleason says that Grant was
very cooperative.

        4. October 8, 1990  through October 10, 1990 - Grant
traveled to Detroit, Michigan to meet with investigators and a
prosecutor there regarding the investigation of a fellow Legion of
Doom member. While there, he testified before the grand jury.
According to Assistant United States Attorney David Debold, Grant
was cooperative.

        5. October 12, 1990 - Grant met for approximately 4
hours with BellSouth security officers. He discussed a number of

                                  - 13 -

matters, including what he believed could be future hacking efforts
against BellSouth and measures BellSouth should take to protect
their system.

                                  - 14 -

     B.  _Cooperation of Franklin E. Darden, Jr._

         1. July 21, 1989 - After the search of his residence,
Darden provided a very detailed statement to the United States
Secret Service describing his activities and the activities of the
Legion of Doom. Based in part on that statement, the Secret
Service and BellSouth were able to further their investigation into
the identities and illegal acts of other members of the Legion of
Doom.

         2. July 24, and July 28 - Darden volunteered to
meet and did meet with the Secret Service and the undersigned
counsel and thoroughly answered all questions posed to him.
Particularly in the early stages of cooperation, Darden provided
more helpful information than any defendant.

         3. July 1990 - Darden traveled to Chicago and spent
three days waiting to testify and occasionally meeting with
Assistant United States Attorneys. The Chicago authorities called
him one morning during work, and Darden flew to Chicago by that
evening. Although Darden did not have to testify, he was ready and
willing to do so. Also, he had met with the Chicago prosecutors
a week or so earlier in Atlanta.

         4.  August 7, 1990 - Darden met in the Atlanta field
office of the Secret Service with Secret Service agents, BellSouth
representatives and other investigators. The meeting lasted most
of the day. According to Special Agent William Gleason,Darden was
very forthcoming and provided valuable leads for other cases.
         5. October 1990 - Darden traveled to Detroit Michigan

                                  - 15 -

to meet with investigators and the prosecutors there regarding the
investigation of a fellow Legion of Doom Member. He also testified
before the grand jury. According to Assistant United States
Attorney David Debold, Darden was very cooperative and offered
evidence that will be very useful in prosecuting the Detroit
hacker.

     C. _Cooperation of Robert J. Riggs_

        1. July 21, 1989 - After the search of his residence,
defendant Riggs provided a very detailed statement to the United
States Secret Service describing his activities and the activities
of the Legion of Doom.  Based in part on that statement, the Secret
Service and BellSouth were able to further their investigation into
the identities and illegal acts of other members of the Legion of
Doom.

        2. May 23, 1990 - Defendant Riggs met with Chicago
Assistant United States Attorneys and the undersigned counsel to
discuss the case generally and the activities of other Legion of
Doom members. Mr. Riggs provided helpful leads in pursuing other
hackers.


        3. July 17, 1990 - Riggs met again with two Assistant
United States Attorneys from Chicago who were in Atlanta and spent
several hours discussing the prosecution of Craig Neidorf and
related computer hacker matters. The prosecutors found Mr. Riggs'
statements very helpful.

        4. July 1990 - Riggs traveled to Chicago and was there
for several days before his testimony in that case. The testimony

                                  - 16 -

was somewhat helpful, though the prosecutors felt defendant Riggs
was holding back and not being as open as he had been in the
earlier meeting.

        5. August 8, 1990 - Riggs met in the Atlanta field
office of the Secret Service agents, BellSouth representatives, and
other investigators from around the country. The meeting lasted
roughly 5 hours. According to Special Agent William Gleason, Riggs
was less forthcoming than either Darden or Grant and seemed to have
more of a problem recalling details. He did, however, provide some
helpful information.


        6. October 13, 1990 - Riggs traveled to Detroit,
Michigan to meet with investigators and the prosecutor there
regarding the activities of a fellow member of the Legion of Doom.
He also testified before the grand jury. According to Assistant
United States Attorney David Debold, Riggs was helpful, but Mr.
Debold had a difficult time prying information from Riggs without
asking very specific questions. Mr. Debold said he did not know
whether Riggs was evasive or simply quiet.

Defendant Riggs strikes the undersigned counsel as an
unusually quiet and pensive person. Throughout the investigation,
he has been cooperative, but because of his nature, he sometimes
comes across as uninterested and evasive. The bottom line is that
he provided helpful information that furthered several
investigations around the country, though his assistance was not
as substantial as that of Grant and Darden; hence the
recommendation of only a two-level departure.

                                  - 17 -

V. _DEFENDANTS' MOTIVATION_

All three defendants belonged to the self-proclaimed elite
group of hackers called Legion of Doom. As described in _Exhibit_
_A_, 15 members of this group lived in cities throughout the country
and used personal computers and modems to break into a host of
other computer systems. Their main motivation: To obtain power
through information and intimidation. Basically, they wanted to
own "Ma Bell."

In their quest for power, the defendants and other LOD members
in the group fixated on the telephone industry for two reasons.
First, the telephone industry has one of the most complicated and
challenging computer systems in the world. Second, telephones link
all computers throughout the world to each other and a mastery of
the telephone system would allow the defendants to break into
computer systems virtually anywhere. The defendants and other LOD
members engaged in an arcane game of technological one-upmanship.
Whoever could break into the most systems and steal the most
information would be considered the superior hacker. For instance,
LOD members were designated at certain levels (e.g., The Urvile,
Level 8) to reflect their degree of expertise.

Once the defendants figured out how to master a computer
system, they would often assert their bragging rights by
documenting their methods of break-ins and sharing the information
with hackers around the country. Although each defendant claims
to have carefully restricted access to the information, there could
be no realistic safeguards. From the start, the information was

                                  - 18 -

stolen and, by definition, no longer safeguarded. Moreover, the
defendants commonly made the information available to all hackers
who happened to access the computer bulletin board service they
were using. A case in point is John Doe of Indiana who stole the
approximately $10,000 by using information provided by the
defendants.

In essence, stolen information equalled power, and by that
definition, all three defendants were becoming frighteningly
powerful.

VI. _THE GOVERNMENT'S RECOMMENDATION AND THE NEED TO SEND A MESSAGE_
    _TO THE COMMUNITY_

Computer hackers around the country are closely following the
outcome of this case in light of the probated sentence of the last
federally prosecuted adult criminal hacker, Rober Morris, Jr.
Any sentence that does not include incarceration would send the
wrong message to the hacking community; that is, that breaking into
computer systems and stealing information is not really a crime.

As the Court may recall, Mr. Morris created a computer virus
which began multiplying out of control and infected hundreds of
computers around the country. The case garnered national attention
because it was one of the first computer fraud prosecutions to
focus the public's eye on the very real dangers of computer
hacking.

Computer bulletin board services (BBS's) around the country
were buzzing about the _Morris_ case. For instance, two printout
pages of one BBS, filed separately as _Government Exhibit E_, will

                                  - 19 -

give the Court an idea of how closely hackers follow these matters.
A hacker named The Mentor noted that if Morris was sentenced to do
time, "it'll be a *very* bad precedent." Another hacker, Eric
Bloodaxe, responded "Hell, maybe it IS time to start doing all the
terrible things I always had the capabilities to do..." A hacker
named Ravage commented that he heard the prosecution had had a hard
time showing Morris' malicious intent and noted that if that was
true, "I doubt he will get any time. Probably a fine, community
service, or probated time." The Urvile (the hacker name used by
defendant Grant) aid, "The virus will hurt us (the hacking
community) a tremendous among in the future." He went on to say
that "even if the courts are lax on him (orris), which is the only
silver lining i can think of, then security on all systems is going
to increase. we don't need that. not one bit."

The government does not have ready access to any printouts
from BBS's following the Morris sentencing, thought hackers and
computer experts recall general hacker jubilation when the judge
imposed a probated sentence. Clearly, the sentence had little
effect on defendants Grant, Riggs, and Darden.

The undersigned counsel met with each of the three defendants,
and all three have been very cooperative and remorseful. The
defendants, however, have literally caused BellSouth millions of
dollars in expenses by their actions. Moreover, they knew
throughout their hacking activities that they were engaging in
illegal conduct as they broke into untold numbers of telephone and
non-telephone computer systems. Because of that conduct and the

                                  - 20 -

message that the hackers around the country need to hear, the
government strongly urges this Court to include incarceration as
part of the sentence. The government will make a more specific
recommendation at the time of sentencing.


                                   Respectfully submitted,

                                   JOE D. WHITLEY
                                   UNITED STATES ATTORNEY


                                   KENT B. ALEXANDER
                                   ASSISTANT UNITED STATES ATTORNEY
                                   1800 United States Courthouse
                                   75 Spring Street, S.W.
                                   Atlanta, Georgia 30335

                                   Georgia Bar No. 008893


                                    - 21 -

********************************************************************

------------------------------

                           **END OF CuD #2.16**
********************************************************************