The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / etc / hacklaw / ripcobbs.txt < prev next >

Wrap

Text File | 2003-06-11 | 73.5 KB | 1,578 lines

*** SEIZURE WARRANT DOCUMENTS FOR RIPCO BBS *** ******************************************************************** On May 8, 1990, RIPCO BBS was closed and the equipment seized as the result of a seizure warrant. FULL DISCLOSURE Magazine obtained publicly available copies of the various documents related to the warrant, which are reproduced below. The documents include (in order presented): 1. Government's petition for Assistance during Execution of Search Warrant 2. ORDER approving assistance 3. Order authorizing blocking out income telephone and data calls 4. Application for order to block out calls 5. Application and affidavit for seizure warrant (Barbara Golden, affiant) 6. Application and affidavit for seizure warrant (G. Kirt Lawson, affiant) Attached to the original documents (but not presented here) are an application (by Ira H. Raphaelson and William J. Cook, United States attorney and AUSA) to suppress the seizure warrant for 90 days, and a variety of photographs of Dr. Ripco's premises. ******************************************************************* **************************************** Government's Petition for Assistance **************************************** UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION UNITED STATES OF AMERICA ) ) v. ) No. 90-M-187 & 90-M-188 ) Magistrate James T. Balog ) xxxx NORTH CLYBOURN, CHICAGO ) ILLINOIS AND xxxx NORTH ) LAWNDALE, CHICAGO, ILLINOIS ) GOVERNMENT'S PETITION FOR ASSISTANCE DURING EXECUTION OF SEARCH WARRANT The United States of America, by its attorney, Ira H. Raphaelson, United States Attorney for the Northern District of Illinois, petitions this Court for an order directing representatives of AT&T's Corporate Security Division to accompany Special Agents of the Secret Service during the execution of the search warrant against the premises of xxxx North Clybourn, Chicago, Illinois, and xxxx North Lawndale, Chicago, Illinois. This petition is supported by the following: 1. The affidavit of Special Agent Barbara Golden of the Secret Service is incorporated herein by reference. 2. AT&T has offered the assistance of Jerry Dalton and John Hickey of AT&T Corporate Security/Information Protection to the government and this Court. Both men are very experienced in the operation of computers and especially in the analysis of UNIX systems. 3. We also request that Sergeant Abigail Abrahams of the Illinois State Police be authorized in the execution of the aforementioned warrants. Sergeant Abrahams has investigated the computer bulletin board (BBS) operation since approximately 1988 - 1 - and has extensive details with respect to the structure of the BBS and its contents. While these individuals will not be seizing evidence, their assistance is necessary to quickly read and identify the critical files in the computer being searched. Moreover, their presence during the search will insure that the records on the computer are not accidentally erased and remain intact. Respectfully submitted, IRA H. RAPHAELSON United States Attorney BY: (signature of) WILLIAM J. COOK Assistant United States Attorney - 3 - UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION UNITED STATES OF AMERICA ) ) v. ) No. 90-M-187 & 90-M-188 ) Magistrate James T. Balog ) xxxx NORTH CLYBOURN, CHICAGO ) ILLINOIS AND xxxx NORTH ) LAWNDALE, CHICAGO, ILLINOIS ) ORDER In view of the specialized nature of the evidence that is being sought in this warrant, _______________, as indicated in the government's petition and the affidavit for the search warrant, which is incorporated herein by reference; It is Hereby Ordered that representatives of AT&T's Corporate Security Division and Sergeant Abigail Abrahams of the Illinois State Police accompany Special Agents of the United States Secret Service during the execution of the search warrant to assist those agents in the recovery and identification of the evidence sought in the warrant. (signature) James T. Balog 5-7-90 UNITED STATES MAGISTRATE - 3 - UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION IN THE MATTER OF THE ) APPLICATION OF THE UNITED STATES ) OF AMERICAN FOR AN ORDER FOR THE ) No. 90-M-187 & 90-M-188 BLOCKING OF INCOMING TELEPHONE ) Magistrate James T. Balog AND DATA CALLS AT (312 )528-5020 ) (312 )xxx-xxxx AND (312)xxx-xxxx ) ORDER AUTHORIZING BLOCKING OUT INCOME TELEPHONE DATA CALLS An application having been made before me by Colleen D. Coughlin, an Assistant United States Attorney for the Northern District of Illinois, pursuant to Title 28, United States Code, Section 1651, for an Order to "block out" incoming telephone and data calls by the Illinois Bell Telephone company, and there is reason to believe that requested actions are relevant to a legitimate law enforcement investigation; IT IS ORDERED THAT: 1. Illinois Bell Telephone company servicing said telephone lines shall "Block out" of incoming telephone and data calls on (312) 528-5020, (312) xxx-xxxx and (312) xxx-xxxx, which telephone and data lines are on premises which are the subject of federal search warrants to be executed the 8th day of May, 1990 at approximately 0630 hours. Such "blocking out" of incoming telephone and data calls shall commence at 0500 hours on May 8, 1990 and continue up to and incoming 1700 hours on May 8, 1990, or until the completion of the search warrants, whichever is the earlier. 2. The "blocking out" of incoming telephone and data calls will likely assist in the execution of search warrants seeking - 4 - evidence of violations of Title 18, United States Code, Sections 1343, 1030, 1962, 1963, and 371. (signature of) JAMES T. BALOG Magistrate 5-7-89 (sic) - 5 - UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION IN THE MATTER OF THE ) APPLICATION OF THE UNITED STATES ) OF AMERICAN FOR AN ORDER FOR THE ) No. 90-M-187 & 90-M-188 BLOCKING OF INCOMING TELEPHONE ) Magistrate James T. Balog AND DATA CALLS AT (312 )528-5020 ) (312 )xxx-xxxx AND (312)xxx-xxxx ) A P P L I C A T I O N Now comes the UNITED STATES OF AMERICA, by IRA H. RAPHAELSON, United States Attorney and Colleen D. Coughlin, Assistant United States Attorney, and makes application pursuant to Title 28, United States Code, Section 1651, the All Writs Act, for an Order to stop or "block out" incoming telephone calls to particular telephone and/or data lines, as described below, by the Illinois Bell Telephone Company. In support of this Application the undersigned states as follows: 1. This Application seeks an order requiring the Illinois Bell Telephone Company to "block out" incoming telephone and data calls from 0500 hours until 1700 on May 8, 1990 regarding the following numbers (312) 528-5020, (312) xxx-xxxx and (312) xxx- xxxx. 2. The United States Secret Service has been conducting a two year investigation into the activities of computer hackers which will result in thirty-two search warrants being executed across the United States on May 8, 1990 beginning at 0630 hours. 3. Because the United States Secret Service needs to ensure the integrity of the evidence at each of these locations from remote access tampering, alteration, or destruction, this "blocking out" order is required. 4. This action by Illinois Bell Telephone will only "block out" incoming calls and the telephones will at all times be capable of making "outgoing" calls. Thus, the telephone lines will at all times be available for emergency outgoing calls. 5. It is reasonably believed by the United States Secret Service, based on experience and their investigation in this case, that the requested action will be of substantial assistance in forwarding this criminal investigation. 6. The All Writs Act, 28 U.S.C. 1651, provides as follows: The Supreme Court and all courts established by the Act of Congress may issue all writs necessary and appropriate in aid of their respective jurisdictions and agreeable to the uses and principles of law. 7. A Federal Court has power to issue "such commands under the All Writs Act as may be necessary or appropriate to effectuate and prevent the frustration of orders it has previously issued in the exercise of its jurisdiction...." UNITED STATES v. NEW YORK TELEPHONE CO., 434 U.S. 159, 172 (1977). WHEREFORE, on the basis of the allegations contained in this Application, applicant requests this Court to enter an order for "blocking out" of income telephone and/or data calls at the above described telephone numbers. It is further requested that Illinois Bell Telephone Company may be ordered to make no disclosure of the existence of this Application and Order until further order of this Court since - 2 - disclosure of this request to the individual or individuals whose telephone lines are affected would threaten or impede this computer investigation. Respectfully submitted, IRA H. RAPHAELSON United States Attorney By: (signed) COLLEEN D. COUGHLIN Assistant United States Attorney - 3 - **************************************************** {transcriber's note:} Following is the APPLICATION AND AFFADAVIT FOR SEIZURE WARRANT, Case number 90-M-187, dated May 7, 1990. Affiant: Barbara Golden, Special Agent, U.S. Secret Service Location: United State District Court, Northern District of Illinois Judicial Officer: Magistrate James T. Balog The warrant alleges violations under Title 18, USC, Sections 1343, 1030, 1029, 1962, 1963, and 371. ******************************************* --------------(Begin Barbara Golden's Affidavit)----------------- State of Illinois ) ) SS County of Cook ) AFFIDAVIT 1. I, Barbara Golden, am a Special Agent of the United States Secret Service and have been so employed for the past fourteen years; the past three years as a Special Agent. I am present assigned to the Computer Fraud Section of the United States Secret Service in Chicago. I am submitting this affidavit in support of the search warrants for the residence of Bruce Xxxxxxxxxxx xxxx North Lawndale, Chicago, Illinois (including the detached garage behind the house) and his business address at xxxx North Clybourn, Chicago, Illinois. 2. This affidavit is based upon my investigation and information provided to me by Special Agent G. Kirt Lawson of the United States Secret Service in Phoenix, Arizona and by other agents of the United States Secret Service. I have also received information from Sergeant Abigail Abrahams of the Illinois State Police. 3. Additionally, I have received technical information and investigative assistance from Roland Kwasny of Illinois Bell Telephone Corporate Security. VIOLATIONS INVOLVED 4. This warrant is requested to recover unauthorized and illegally used access codes posted on the RIPCO BBS by computer hackers and to develop evidence of their illegal use of those codes in violation of federal criminal laws, including: - 1 - a. 18 USC 2314 which provides federal criminal sanctions against individuals who knowingly and intentionally transport stolen property or property contained by fraud, valued at $5,000.00 or more, in interstate commerce. b. 18 USC 1030(a)(6) provides federal criminal sanctions against individuals who, knowingly and with intent to defraud, traffic in interstate commerce any information through which a computer may be accessed without authorization in interstate commerce. c. Other federal violations involved in this case may include Wire Fraud (18 U.S.C. 1343), Access Device Fraud (U.S.C. 1029) and other violations listed and described on page 15, 16, and 17 of the attached affidavit of Special Agent Lawson. LAWSON AFFIDAVIT 5. The attached affidavit of Special Agent Kirt Lawson is incorporated herein in its entirety and is attached as Attachment 1. Lawson's affidavit is based upon a two year undercover investigation of the United States Secret Service involving an undercover bulletin board located in Phoenix, Arizona. Essentially, Lawson's affidavit and my investigation establish probably cause to believe: a. Bruce Xxxxxxxxxxx, using the computer hacker handle "Dr. Ripco", has been operating the RIPCO BBS in Chicago since approximately December 10, 1983. - 2 - b. During the time period named in the Lawson affidavit unauthorized access codes were posted on the RIPCO BBS by various computer hackers. c. The access codes posted on the RIPCO BBS have been determined by Special Agent Lawson to be valid access codes which are being used without authorization of the true authorized user of the access codes. Moreover, in many cases the access codes have been reported stolen by the true authorized user(s). d. Special Agent Lawson's investigation has further determined that the access codes posted on the RIPCO BBS are not concealed from the system administrator of the BBS and could be seen by the system administrator during an examination of the BBS. 6. I have personally worked with S.A. Lawson on computer crime investigations and known him to be a reliable agent of the Secret Service and an expert in the field of telecommunication investigations. 7. I personally received the attached affidavit on May 1, 1990 and have verified with S.A. Lawson that it is in fact his affidavit and have verified with S.A. Lawson that it is in fact his affidavit and that it accurately reflects his investigation. I have verified information with respect to his investigation with Special Agent Lawson as recently as May 7, 1990. - 3 - UPDATED PROBABLE CAUSE 8. On May 1, 1990, I personally observed that the surveillance cameras described on pages 32 and 33 of Lawson's affidavit still appear to be in operation. (The antennas and surveillance cameras located at the Clybourn address are reflected in the photographs attached as Attachment 2.) 9. On May 4, 19900, I personally updated the status of the telephone lines at the Clybourn address with Roland Kwasny of Illinois Bell Telephone. Kwasny advised me that those telephones continue to be in active service at this time. ITEMS TO BE SEIZED 10. On pages 36 to 39 of his affidavit S.A. Lawson describes the items to be seized at the search locations. Locations to be Searched 11. The complete description of the business location to be searched on Clybourn Street is contained on page 30 of S.A. Lawson's affidavit. (Photographs of that location are in Attachment 2.) I have personally observed the resident to be searched on Lawndale on May 1, 1990. The photographs attached to this affidavit as Attachment 3 truly and accurately show the residence known as xxxx North Lawndale, Chicago, Illinois, as of May 1, 1990. - 4 - EXAMINATION OF COMPUTER RECORDS 13. Request is made herein to search and seize the above described computer and computer data and to read the information contained in and on the computer and computer data. 14. The following attachments are incorporated herein by reference: Attachment 1 - Affidavit of S.A. Lawson (39 pages): Attachment 2 - Photographs of the Clybourn address (2 pages); Attachment 3 - Photographs of the Lawndale address (1 page). (signature) Special Agent Barbara Golden United States Secret Service Sworn and Subscribed to before me this 7th day of May, 1990. (signature) James T. Balog UNITED STATES MAGISTRATE - 5 - ** (End Barbara Golden's Affidavit) ** ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ** (Begin G. Kirt Lawson's affidavit) ** ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ State of Arizona ) ) SS County of Maricopa ) AFFIDAVIT 1. Your affiant G. Kirt Lawson has been a Special Agent of the U.S. Secret service for eighteen years and in the course of his employment has investigated over 100 cases involving credit card fraud, theft, computer- related crime, and other offenses. I have training from the Secret Service in the investigation of computer fraud, have attended six or more seminars on investigative procedures from AT&T and the Secret Service, and have lectured on computer crime for the IEEE (an international professional group of electrical engineers) and Bellcore (the research / security organization owned by the regional Bell operating companies.) Within the last year, I have assisted the Arizona Attorney General's office with the execution of three computer-crime search warrants, and the Austin, Texas field office of the Secret Service with the execution of another computer-related search warrant. Over the last two years, I have assisted numerous state, local, and federal law enforcement agents in half a dozen U.S. cities by providing information and technical assistance which has led to the execution of over a dozen search warrants in computer crime cases nationwide. - 1 - SOURCES OF INFORMATION 2. Your affiant has also received technical information and investigative assistance from the following experts in the field of telecommunication fraud and computer crime: a. R.E. "Sandy" Sandquist,, Regional Security Manager, U.S. Sprint Communications Company, who has been so employed since 1987, and was previously employed by General Telephone (GTE) as a special agent, technical investigations since 1983. He has investigated cases of communications fraud involving computer hackers, computer bulletin board systems (see Definitions section below), and the abuse of voice mail message computers, involving over 100 systems. He has assisted law enforcement search teams in the execution of search warrants, and has trained many state, local and federal agents in the investigation of computer and communications crime. b. Stephen R. Purdy, Special Agent, U.S. Secret Service, currently the Assistant to the Special Agent In Charge of Fraud Division of the Computer Diagnostic Lab in Washington, D.C. He is a member of the Federal Computer Investigations Committee, and is currently its Co-Chair. He has helped to design training programs in computer crime and telecommunications fraud investigations for the Federal Law Enforcement Training Center in Glynco, Georgia. He also developed and instructs in the Secret Service's training program in computer fraud investigations. - 2 - c. George Mehnert has been a Special Agent with the Arizona Attorney General's office for more than twelve years; for the last three years, he has been responsible for special projects including the investigation of computer crime. He has taken courses relating to computer hardware and software programs from various industry sources and a local college, and has worked with computer hardware and software, including communications equipment and analysis tools, in investigative matters for more than six years. Mehnert has instructed numerous state and local law enforcement agencies in the methodology of executing search warrants involving computers, and in the investigation of computer crimes. He recently published of article on this subject in a law enforcement periodical. In the past two years, Mehnert has been involved in thirty warrant searches relating to the seizure of computer of communications-related evidence. d. In addition to the above, affiant has also received technical assistance and information from the following communication industry sources: Steve Matthews, Telenet; Leila Stewart, MCI; Sue Welch, MCI; Toni Ames, U.S. West; Connie Bullock, ComSystems (a long-distance carrier); Karen Torres, MidAmerican Communications Company; Richard Petiollo and Richard Kopacz, AT&T; Hank Kluepfel and David Bauer, Bellcore (a research/security company owned by the Bell Regional Operating Companies); Marty Locker, International Telephone and Telegraph (ITT), and credit industry sources: Valerie Larrison, American Express; MaryAnn Birkinshaw, TRW: Michelle Mason, CBI (TRW and CBI are national card bureaus). - 3 - DEFINITIONS AND EXPLANATIONS 3. Computer hackers: individuals involved in the unauthorized intrusion into computer systems by various means. They commonly identify themselves by aliases of "hacker handles" when communicating by voice or electronically with other hackers. Because they normally communicate through electronic bulletin board systems in several states, and because they often conduct their hacking activities against victims at many locations outside their local calling area, computer hackers typically use long-distance carrier customer authorization codes without the permission of the individuals or corporations to which they are assigned, in order to achieve "free" long distance telecommunications (over standard voice lines, or over data-communications services). Search warrants executed in hacker cases routinely produce evidence of theft of communications services, and often product of possession, use, and/or distribution of credit cards as well. 4. Electronic Bulletin Board System (BBS): an electronic bulletin board is a computer operated as a medium of electronic communications between computer users at different locations. Users access the BBS by telephone from distant locations (often their residences), using their own computers and communication devices (modems). Typical functions of a BBS include (1) providing storage for a software library; (2) allowing users to "download" (copy to their own computers) various files or software programs; (3) allowing users to - 4 - exchange and store messages by "electronic mail"; and (4) publishing of text files and tutorials, which contain information or instructions on various subjects of interest to the users. Although many BBS's are operated as commercial services to the public (large services such as Compuserve and The Source may offer many more functions than those listed above), thousands of BBS's are privately operated by individuals who run them from their residences, or by special-interest clubs. It is common for a BBS to have several sections or "conferences" on the system, to which a particular level of access is required: many users might have access to lower-level sections, while only some users would be permitted to access the highest-level sections (many sysops --defined below-- "voice validate" a prospective user, using a telephone call to screen users and determine whether they are law enforcement, adults, or other undesirables). This is particularly true of BBS's whose members are involved in some form of criminal activity. Many "underground" or criminal bulletin boards contain subsections through which the users regularly exchange stolen customer authorization codes, credit card numbers, and information on techniques or methods for the commission of such crimes as computer fraud and abuse, access device fraud and wire fraud. 5. System operator/system administrator (sysop): the person(s) charged with the responsibility for operating a particular computer bulletin board system (usually the owner of - 5 - the computer who lives in the residence where the BBS is operating). In order to perform their necessary supervisory and maintenance functions, sysops who run or own the BBS give themselves the highest level of access, or privileges, available on a system. In the case of a bulletin board sysop, these functions typically include deciding whether or not to to give access or type of privileges to allow to different users, and the ability to read the entire content stored on the BBS (including "private mail" -- see electronic mail, below.) Sysops control the BBS, can remove contents, add and delete users, change the programming, alter the communications parameters, and perform a number of administrative and maintenance tasks associated with operation of the BBS. 6. Electronic mail (E-mail): electronic mail is a means of communication among computer users, and is one of the features normally found on a BBS. Each user on a criminal BBS has a distinct identifier, with a computer hacker's "username" or "login" often identical to his hacker handle (handles tend toward the theatrical, I.e. Prophet of Doom, DungeonMaster, Ax Murderer, etc.) and a unique confidential password; each user may also be assigned a user number by the system. Users may send "public" mail by leaving a message in a section of the system where all who call in may read the message and respond. They may also send "private mail" by sending a message limited to a particular individual or group. - 6 - In this instance, other users would not be able to read the private message. (Except, of course for the sysop, as explained above.) 7. Chat: unlike electronic mail, which consists of messages and responses entered and stored for later review, the "chat" communication on a BBS consists of simultaneous interactive communication between the sysop and a user, or between two or more users -- the computer equivalent of a conference call. A more sophisticated BBS may have more than one telephone line connected to the system, so that two or more users can "talk" to each other though the BBS from their own computer systems at one time. 8. Voice Mail System (VMS): a voice mail system is an electronic messaging computer which acts as an answering service. These systems are generally either (1) operated for hire to the public by commercial communications companies, often in combination with cellular telephone or paging services, or (2) by corporations for the convenience of employees and customers. In either case, the subscriber or employee is assigned an individual "mailbox" on the system which is capable of performing several functions. Among these functions are receiving and storing messages from callers, sending messages to other boxes on the system, and sending messages to a pre-selected group of boxes. These functions are performed by pushing the appropriate numerical commands on a telephone keypad for the desired function. - 7 - 9. While voice mail systems vary among manufacturers, in general, a caller dials either a local area code and number, or an "800" number to access the system. Generally, the caller hears a corporate greeting identifying the system and listing instructions for leaving a message and other options. To leave a message, the caller enters a "mailbox number," a series of digits (often identical to the assigned owner's telephone extension), on his own telephone keypad. The caller then hears whatever greeting the mailbox owner has chosen to leave. Again, the caller can usually exercise several options, one of which is to dictate an oral message after a tone. 10. In this respect, the voice mail system operates much like a telephone answering machine. Rather than being recorded on audio tape, however, the message is stored in digitized form by the computer system. When the message is retrieved, the computer plays it back as sound understandable by the human ear. The entire VMS is actually a computer system accessible through telephone lines; the messages are stored on large-capacity computer disks. 11. A caller needs to known only the extension or mailbox number in order to leave a message for the employee or subscriber. In order to retrieve the messages or delete them from the system, however, the person to whom the box is assigned must have both the box number and a confidential password: the password ensures privacy of the communications, by acting as a "key" to "unlock" the box and reveal its contents. Anyone - 8 - calling the telephone number of the mailbox hears the owner's greeting -- only the content of messages left for the owner is protected by the password or security code. The person to whom the box is assigned may also have the ability to change his password, thereby preventing access to the box contents by anyone who may have learned his password. 12. Private Branch Exchange (PBX): a private branch exchange is a device which operates as a telephone switching system to provide internal communications between telephone facilities located on the owner's premises as well as communications between the company and other private or public networks. By dialing the specific telephone number of a PBX equipped with a remote access feature and entering a numeric password or code on a telephone keypad or by means of a computer modem, the caller can obtain a dial tone, enabling the caller to place long distance calls at the expense of the company operating the PBX. 13. Phone phreak: phone phreaks, like computer hackers, are persons involved in the theft of long-distance services and other forms of abuse of communications technology, but they often do not have computer systems. Rather than communicating with each other through BBS's, they communicate with each other and, exchange stolen carrier customer authorization codes and credit cards, either directly or by means of stolen or "hacked" corporate voice mailboxes. Phone phreaks may also set up fraudulent conference calls for the - 9 - exchange of information. A phone phreak may operate a "codeline" (a method of disseminating unauthorized access devices) on a fraudulently obtained voice mailbox, receiving messages containing stolen credit card numbers from his co-conspirators, and in turn "broadcasting" them to those he shares this information with during the greeting (box owner's message to callers), which can be heard by anyone dialing the mailbox number. Phone phreaks and computer hackers sometimes share information by means of the conference calls and codelines. Like computer hackers, phone phreaks also identify themselves by "handles" or aliases. BACKGROUND OF THE INVESTIGATION 14. Over the past several years, the U.S. Secret Service has received and increasing number of complaints from long distance carriers, credit card companies, credit reporting bureaus, and other victims of crimes committed by computer hackers, phone phreaks, and computer bulletin board users and operators (see Definitions section), which have resulted in substantial financial losses and business disruption to the victims. Because the persons committing these crimes use aliases or "handles", mail drops under false names, and other means to disguise themselves, they have been extremely difficult to catch. They also conspire with many others to exchange information such as stolen long distance carrier authorization codes, credit card numbers, and technical information relating to the unauthorized invasion of computer systems and voice mail - 10 - messaging computers, often across state or national borders, making the investigation of a typical conspiracy extremely complex. Many of these persons are juveniles or young adults, associate electronically only with others they trust or who have "proven" themselves by committing crimes in order to gain the trust of the group, and use characteristic "hacker jargon." By storing and trading information through a network of BBS's, the hackers increase the number of individuals attacking or defrauding a particular victim, and therefore increase the financial loss suffered by the victim. 15. For all of the above reasons, the U.S. Secret Service established a computer crime investigation project in the Phoenix field office, utilizing an undercover computer bulletin board. The purpose of the undercover BBS was to provide a medium of communication for persons engaged in criminal offenses to exchange information with each other and with the sysop (CI 404-235) about their criminal activities. The bulletin board began operating on September 1, 1988 at 11:11 p.p., Mountain Standard Time, was located at 11459 No. 28th Drive, Apt. 2131, Phoenix, Arizona, and was accessed through telephone number (602) 789-9269. It was originally installed on a Commodore personal computer, but on January 13, 1989 was reconfigured to operate on an Amiga 2000 personal computer. 16. The system was operated by CI 404-235, a volunteer paid confidential informant to the U.S. Secret Service. CI 404-235 was facing no criminal charges. Over the past eighteen - 11 - months, information by CI 404-235 (see paragraph 16) has consistently proved to be accurate and reliable. The Arizona Attorney General's office executed six search warrants related to affiant's investigation in 1989 and 1990 (affiant participated in three of these). Evidence obtained in those searches corroborated information previously given to affiant or to George Mehnert, Special Agent of the Arizona Attorney General's office by CI 404-235. In over a dozen instances, CI 404-235's information was verified through other independent sources, or in interviews with suspects, or by means of a dialed number recorder (pen register). One arrest in New York has been made as a result of CI 404-235's warning of planned burglary which did occur at a NYNEX (New York regional Bell operating company) office. Throughout this investigation, CI 404-235 has documented the information provided to the affiant by means of computer printouts obtained from the undercover BBS and from suspect systems, and consensual tape recordings of voice conversations or voice-mail messages. 17. Because many of the criminal bulletin board systems require that a new person seeking access to the telephone code or credit card sections contribute stolen card information to demonstrate "good faith," when asked to do so, CI 404-235 has "posted," (left on the system in a message) Sprint, MidAmerican or ComSystems authorization codes given to affiant by investigators at these companies for that purpose. - 12 - EVIDENCE IN HACKER CASES 18. Computer hackers and persons operating or using computer bulletin board systems commonly keep records of their criminal activities on paper, in handwritten or printout form, and magnetically stored, on computer hard drives, diskettes, or backup tapes. They also commonly tape record communications such as voice mail messages containing telephone authorization codes and credit cards. On several occasions, affiant has interviewed George Mehnert, Special Agent, Arizona Attorney General's office and R.E. "Sandy" Sandquist, Security Manager, U.S. Sprint, about the types of evidence normally found in connection with computer/ communications crimes. Both have assisted more than 20 search teams in the execution of search warrants in such cases. Both Mehnert and Sandquist stated that because of the sheer volume of credit card numbers, telephone numbers and authorization codes, and computer passwords, and other information necessary to conduct this type of criminal activity, in almost every case, they have found a large volume of paper records and magnetically-stored evidence at scenes being searched. Because of the ease of storing large amounts of information on computer storage media such as diskettes, in a very small space, computer hackers and bulletin board users or operators keep the information they have collected for years, rather than discarding it. Mehnert stated that in virtually every communications/computer crime case he has investigated, the suspect was found to have records in his possession dating - 13 - back for years -- Mehnert stated that it is common in such cases to find records dating from 1985 and sometimes, even earlier. 19. Sandquist confirmed Mehnert's experience, stating that hackers and phone phreaks typically also keep a notebook listing the location of information especially important to them, for easy access. Mehnert has seized several of these "hacker notebooks" in computer/communications crime cases; they were usually found quite close to the computer system, or in the hacker's possession. Both Mehnert and Sandquist stated that it is common for a person involved in the theft of communications services (long distance voice or data calls, voice mail boxes, etc.) also to be involved in the distribution or use of stolen credit cards and/or numbers; hackers and phone phreaks often trade codes for credit cards, or the reverse. Both Mehnert and Sandquist stated that it is common to find credit card carbons at locations being searched for stolen telephone authorization codes. 20. Both Mehnert and Sandquist also stated other evidence commonly found in connection with these cases includes telephone lineman tools and handsets (used for invading telephone company pedestal or cross-boxes and networks, or for illegal interception of others' communications), tone generators (for placing fraudulent calls by electronically "fooling" the telephone network into interpreting the tones and legitimate electronic switching signals), computer systems (including central processing unit, monitor or screen, keyboard, modem for - 14 - computer communications, and printer), software programs and instruction manuals. Sysops of bulletin boards also commonly keep historical backup copies of the bulletin board contents or message traffic, in order to be able to restore the system in the event of a system crash, a power interruption or other accident. An important piece of evidence typically found in connection with a criminal bulletin board is the "user list" -- sysops normally keep such a list on the BBS, containing the real names and telephone numbers of users who communicate with each other only by "handles." The user list is a very substantial piece of evidence linking the co-conspirators to the distribution of telephone codes and credit cards through the BBS messages or electronic mail. 21. Mehnert and Sandquist stated that it is also common to find lists of voice mailboxes used by the suspect or his co-conspirators, along with telephone numbers and passwords to the voice mailboxes. Many suspects also carry pagers to alert them to incoming messages. CRIMINAL VIOLATIONS 22. Criminal violations may include, but are not limited to, the following crimes: 23. Wire fraud: 18 U.S.C. ~ 1343 prohibits the use of interstate wire communications as part of a scheme to defraud, which includes obtaining money or property (tangible or intangible) by a criminal or the loss of something of value by the victim. Investigation by your affiant has determined that - 15 - the actions of the computer hackers, phone phreaks and bulletin board operators detected in this investigation defrauded telephone companies whose customer authorization codes were exchanged through the BBS's) gained valuable property because their fraud scheme provided them with telephone customer authorization codes and other access devices which in turn could be used by them to obtain telephone services and property which would be charged to the victim companies. Their scheme also provided them with access to private branch exchange (PBX) numbers and codes which could be used to obtain telephone service which was charged to the victim companies. 24. Computer fraud and abuse: 18 U.S.C. ~ 1030 prohibits unauthorized access to a federal interest computer with intent to defraud. Intent to defraud has the same meaning as in the wire fraud statute above. A federal interest computer is defined as "one of two or more computers used in committing the offense, not all of which are located in the same state," as well as computers exclusively for the use of a financial institution or the United States Government, among others defined in the statute. This section also prohibits unauthorized access to financial records and information contained in consumer reporting agency files. 25. Access device fraud: 18 U.S.C. ~ 1029 prohibits the unauthorized possession of 15 or more unauthorized or counterfeit "access devices" with intent to defraud, and - 16 - trafficking in authorized access devices with an intent to defraud and an accompanying $1,000 profit to the violator or loss to the victim. These prohibitions also apply to members of a conspiracy to commit these offenses. Intent to defraud has the same meaning as in the wire fraud statute above. "Access devices" includes credit cards, long distance telephone authorization codes and calling card numbers, voice mail or computer passwords, and PINS (personal identification numbers). An "unauthorized access device" is any access device obtained with the intent to defraud, or is lost, stolen, expired, revoked, or cancelled. 26. Other offenses: other federal statutes violated in this case may include 18 U.S.C. ~ 1962 and 1963 which prohibit the commission of two or more acts of racketeering (including two or more acts in violation of 18 U.S.C. ~ 1343 and/or 1029), and permits forfeiture of the instrumentalities used or obtained in the execution of a crime; and 18 U.S.C. ~ 371, the federal conspiracy statute. PROBABLE CAUSE BULLETIN BOARD SYSTEM 312-528-5020 27. CI 404-235 has accessed a public electronic bulletin board at 312-528-5020 over three dozen times between 4/7/89 and 12/31/90. The most recent access was on 4/28/90. In the "Phone Phun" subsection of the BBS, CI 404-235 has regularly seen messages posted by users of the BBS, which contain long distance carrier customer - 17 - authorization codes, references to hacking, and to credit cards and credit bureaus. This affidavit is in support of a search warrant for two premises where evidence of the operation of the BBS is expected to be found. CI 404-235 provided to affiant copies of messages posted to the BBS, including the following: Numb 12 (54r4q9kl-12) Sub miscellaneous... From DON THOMPSON (#689) To all Date 03/17/89 03:55:00 PM o.k.: 1999: 322300 342059 366562 344129 549259 549296 492191 496362 422000 549659 28. In the above message, "1999" refers to the last four digits of the local access number assigned to Starnet, a long distance network owned by ITT Metromedia Communications. To use such codes, a caller dials the local access number, the customer authorization code, and the area code and number to be called. Marty Locker, ITT Security, verified that the local access number 950-1999 is Starnet's (Starnet's authorization codes and six digits long). Loss figures on the above are unknown. 29. On 3/20/89, user #452 "Blue Adept" replies to a previous message, as follows: - 18 - Numb 25 (54r4q9kl-25) Sub Reply to: Reply to: Legal expenses >From BLUE DEPT (#452) To all Date 03/20/89 08:42:00 AM 1999 is starnet. they've busted several people I know. they live to bust people. mainly with extraordinarily large fines. I've heard of them taking it to court though. first person they busted was the Diskmaster/Hansel. really cool guy. hacked em 300 times with the applecat and they busted him. he didn't "Hacked em 300 times" refers to the number of timers that "Diskmaster/Hansel" is supposed to have attempted to hack out a Starnet customer authorization code. "Applecat" is the name of a modem (computer communications device) and related software program which automates the code-hacking process. Numb 69 (54r4q9kl-69) Sub loop >From JOE FRIDAY (#120) To all Date 03/25/89 07:10:00 PM IF ANYONE HAS A LOOP FOR THE 404 AREACODE I WOULD APPR. IT VERY MUCH!! IF THERE ARE ANY REAL PHREAKS THAT STILL DO HACK ALOT LEAVE I THINCK YOU MIGHT BENEIFIT FROM IT. 18002370407-8010464006ACN- 8205109251- IF ANYONE STILL GETS INTO LMOSE LEAVE ME A MESSAGE.. 30. On 4/17/90 Mark Poms, Director of Security, Long Distance Service of Washington D.C., verified the following: 1) 1-800-237-0407 is his company's assigned 1-800-line number. Authorization code 8010464006 has suffered $6, 287.22 in fraud - 19 - losses, and 8205109251 has suffered $970.34 in fraud losses. 31. In the above message, "LOOP" refers to a telephone company "loop around test line". Hackers commonly exchange information on loops, in order to be able to communicate with each other without divulging their home telephone numbers. If two hackers agree to call a loop number at a certain time, they loop allows them to speak with each other -- neither hacker needs to know or to dial the other's telephone number. "LMOSE" refers to a type of computer system (LMOS) operated by Bell regional operating companies (local telephone companies). This computer system contains data such as subscriber records, and the LMOS system is solely for the use of telephone company employees for the purpose of maintaining telephone service. (Explanations provided by Bellcore computer security technical staff member David Bauer.) Numb 136 (56r5q9kl-136) Sub Suicide? >From THE RENEGADE CHEMIST (#340) To All Date 04/18/89 05:33:00 PM 9501001 074008 187438 057919 068671 056855 054168 071679 - 20 - 32. On 3/20/90 Karen Torres, MidAmerican Communications, a long distance carrier which a local access number of 950-1001 as valid MidAmerican customer authorization codes. She advised that all but the invalid code were terminated "due to hacking". 950-1001 074008 Valid code, no loss 187438 Valid code, no loss 057919 Invalid 068671 Valid code, no loss 056855 Valid code, no loss 054168 Valid code, no loss 071697 Valid code, no loss Numb 109 (53r3q0k2-109) Sub Reply to: Reply to: Reply to: Reply to: Reply to: John Anderson >From BRI PAPE (#22) To ALL... Date 06/28/89 05:31:00 AM ANOTHER valid code.. AND A DIVERTER... 215-471-0083..(REMAIN QUIET) 33. 950-0488 is the local access number for ITT Metromedia Communications, according to Marty Locker, ITT Security. Fraud, losses, if any, on this customer authorization code are unknown. 34. On 4/16/90, Kathy Mirandy, Director of Communications, Geriatrics and Medical Center Incorporated, - 21 - United Health Care Services, in Philadelphia, PA, verified that 1-215-471-0083 is her company's telephone number. She stated that between 12/28/88 nand 5/15/89, her company suffered a fraud loss of $81,912.26 on that number. In the above message, "diverter" refers to a common hacker/phone phreak term for a means of placing telephone calls through a telephone facility which belongs to someone else. The hacker "diverts" his call through the other facility, and if the outgoing "diverted" call is a long distance call, the owner of the facility is billed for the call as though it originated from the victim telephone facility. 35. On 7/3/89, CI 404-235 accessed the BBS and observed the following message, a copy of which was provided to the affiant: Numb 137 (56r3q0k2-137) Sub dib. >From POWER ASSIST (#524) To * Date 07/02/89 12:01:00 AM Divertors: 1800 543 7300 543 3300 I'm not sure if this is a 800 to 800 : 800 777 2233 36. On 4/18/90 Delores L. Early, Associate General Counsel of the Arbitron Company, Laurel, Maryland, verified that 1-800-543-7300 is listed to her company. She advised that her company suffered a direct fraud loss by October, 989 of $8,100 on that line, as well as additional expenses in for form of the installation of "an elaborate security procedure to prevent this - 22 - type of fraudulent use," and lost employee time in identifying and correcting the problem. "800 to 800" refers to whether the "divertor" posted in the above message can be used to call out to another 800 number. Numb 113 (53r6q0k2-113) Sub Codes >From BLUE STREAK (#178) To ALL Date 07/26/89 05:05:00 AM Here is a code: 1800-476-3636 388409+acn 950-0266 487005 8656321 6575775 oops first one is 4847 not 487 Blue Streak. Blee blee blee thats all pholks. 37. On 4/2/90. Dana Berry. Senior Investigator, Teleconnect (a division of Tele*Com USA, a long distance carrier), verified that 1-800- 476-3636 code 388409 is her company's authorization code and it has suffered a fraud loss of x176.21 {transcrib. note: portion of dollar figure (first digit) is illegible on copy of affidavit} 38. On 4/20/90, Christy Mulligan, ComSystems Security, whose company is assigned the local access number 950-0266, verified the following: - 23 - 1) 4847005 $2,548.75 loss due to fraud 2) 8656321 $2,000.00 loss due to fraud 3) 6575775 $ 753.61 loss due to fraud Numb 122 (57r3qlk2-122) Sub TRW >From NEMESIS TKK (#311) To Garth Date 09/30/89 04:01:00 AM I have no ideas about accessing TRW through any type of network, but,m you cal dial TRW directly (although you will probably want to code out..Even if format has changed or anything in the past 5 years.. its still db idpw first, ast, etc...So anyway, if you do know how to use it,you can get at it from that number. 39. In the above, "Nemesis" gives a telephone number in area code 602 (Arizona) for TRW. "Code out" refers to using a stolen customer authorization code ("if only to save yourself the fone bill") to call the TRW number. The format for getting in to the TRW computer that he gives Marianne Birkinshaw, TRW investigator advised that the telephone number posted in the message is "a legitimate telephone number into TRW's database". Numb 138 (57r4q2k2-138) Sub 5 >From Chris X (#134) To PEOPLE WHO HAVE OR HACK CODEZ Date 01/22/90 05:54:00 PM - 24 - Dear Anyone, I am in desperate need of a code. SOMEONE PLEASE Post a code with a dialup and the format the code must be entered. I will be ever so greatful. PLEASE HELP!!! Max Man - Chris X 40. In the above, user #134 asks for a code (customer authorization code), "dialup" (the local access or 800 number through which the code may be used), and the format (the order in which code, area code and number must be dialed in order to place a call on the particular network). Numb 146 Sub Here's your code beggar >From POWER ASSIST (#524) To beggars Date 01/23/90 12:40:00 AM 950-0266 6552513 1564844 probably die before you use it. -PA 41. On 4/19/90, John Elerick, ComSstems Security, verified that the codes posted with his company's local access number (950-0266) in the above message are valid; 6552513 has suffered $185.31 in fraud loss, and it" refers to the code -- customer authorization codes "die" when they are deactivated or cancelled by the carrier. - 25 - 42. On 1/26/90, CI 404-235 again accessed the BBS and observed the following message, a copy of which was provided to the affiant: Numb 147 (50r5q2k2-147) Sub ALL >From THE SILENCER (#269) To ALL Date 01/25/90 08:26:00 PM YO...UMM...WHO ASKED FOR CARDS? hahahahah that is pretty pathetic..god. If you want Credit Cards get your own. One step closer to safe carding....getting cc's off bbs's is the most disgusting thing I've ever heard...use TRW..use CBI...trash...steal...pickpocket....but dont get em off a bbs...jeez.. 0266 working:1593527 lets hope that this dies real fast so the REAL phreaks will be left alone by the leacherz...heheheh - Silencer 43. In the above message, "carding" is a common hacker/phone phreak term which refers to the fraudulent use of credit cards or credit card numbers to obtain merchandise which will be billed to the cardholder. "The Silencer" advises "all" users on the BBS to use TRW, or CBI (both national credit bureaus) or to "trash" (the practice of obtaining credit card numbers and related information from receipts or carbons discarded in trash -- sometimes also referred to as "dumpster diving"), steal or pickpocket, but not to get them (credit cards) from a bulletin board system. He then gives the a ComSystems code identified by the the last four digits (0266) of the ComSystems local access number. "Leacher" is a common hacker insult for those BBS - 26 - users who copy codes, credit cards, or software from a BBS but do not contribute their share. 44. On 4/13/90, John Elrick, ComSystems Security, verified that 1593527 is a valid customer authorization code which has suffered $27, 353.34 in fraud loss. 45. It should be noted that in message #138 above, dated 1/22/90, Chris X asked for codes. On 1/26/90 the following followup message was noted by CI 404-235: Numb 149 (50rq2k2-149) Sub Credit Card's for Codez >From Chris X (#134) To ALL Date 02/26/90 07:43:00 AM Okay, Tell ya what. I will exchange any amount of credit cards for a code or two. You name the credit limit you want on the credit card and I will get it for you. I do this cause i go to ganitorial work at night INSIDE the bank when no one is there..... heheheheheh 46. On 1/30/90, Zimmerman left a message on the BBS for CI 404-235, stating that he "will be ready to exchange your codez for cards. I have got 2 right now. 1 witch contains a $1500 credit limit and the other containing a $2200 credit limit. I will 'steal' some more when I go to the bank this weekend. Talk to ya tomorrow..." On 1/31/90 CI 404-235 gave Chris X Sprint Customer authorization code 25259681433275, provided to affiant by U.S. Sprint Regional Security Manager R.E. Sandquist for this purpose. On 3/18/90 in a computer-to-computer - 27 - conversation (not on the BBS), Chris X gave CI 404-235 a list of ten (10) credit card numbers with names, addresses, credit limits, and expiration dates. All of the credit cards appear to be issued in Illinois. Zimmerman told CI 404-235 that all of the cards "belong" to Consumers Co Op Credit Union. 47. On 4/28/90, CI 404-235 again accessed the BBS and provided printouts of messages which he observed on the BBS. In one, dated 3/27/90, "Scott Sxxxxx", user #160, offered to trade "virgin" credit cards (newly acquired and not yet used for fraudulent purposes) for AT&T cards (calling card numbers), PBX's (see Definition section above) or numbers that will call overseas. In a message dated 4/17/90, "SLI FOLKS", user #572, stated that he was calling from Edmonton, Canada, "using a stolen account on Datapac for this call" (Datapac is a data communications carrier). He tells "all" users that he has access to phone rooms for two apartment buildings "which gives me access to several hundred phone lines. new bpox that lets me get free LD on someone elses line frommy house. So I hope you guys can teach me some stuff." On 4/24/90, Chris X left another message to "anyone" offering to trade credit cards and codes for information on how to get "information on a non-published person. It can be found if you have a persons phone number and want a name and address or vice-versa." (He is referring to obtaining non-published subscriber information maintained by the telephone companies.) - 28 - 48. In attempting to located the BBS which operates on telephone number 312-528-5020, affiant has discovered several significant facts which appear to indicated that an attempt has been made to disguise the actual location of the BBS. These facts, and the sources for them, are detailed below. In summary, the BBS telephone line is listed to an address as one of its facilities, the BBS telephone line ends at an Illinois Bell junction box where an non-Illinois Bell (unauthorized) line leads from the BBS line to an apparent retail/office structure at another address. The BBS telephone bills are sent to a post office box opened in the corporate name, but the applicant, who is not listed as an officer of the corporation, described himself in a police report as "self-employed". A second, unlisted, telephone line, billed to the post office box applicant's home address, is installed at the retail/office structure where the non-Illinois bell (BBS) line also leads. 49. Illinois Bell telephone records show that the BBS telephone number 312-528-5020 is subscribed to by Mxxx Xxxxxx, Inc., xxxx West Belmont, xxxx xxx, Chicago, Illinois. The bills for this service are sent in the name of Mxxx Xxxxxx, Inc., at P.O. Box xxxx, Chicago, Illinois, 60618-0169. The BBS line was installed on December 1, 1982. 50. In April of 1989, Sgt. Abigail Abraham, Illinois State Police, conducted an investigation of the bulletin board - 29 - system at telephone number 312-528-5020. She checked directory assistance, and both white and yellow-page telephone directories: although she found several telephone numbers and address for Micro Repair, Inc., 312-528-5020 and xxxx West Belmont were not among them. She investigated the purported BBS site, and determined that xxxx West Belmont, xxxx xxx, Chicago, Illinois, does not exist. She reported that at xxxx W. Belmont, there is a structure which would incorporate the address of xxxx W. Belmont. Sgt. Abraham had a telephone company repairman check the physical junction pole: they discovered that the 312-528-5020 line ran from the phone via a non-Illinois Bell (unauthorized) connection to a building at xxxx N. Clybourn, Chicago, Illinois. This building appears to be a retail/office structure, at which, according to SA Conway, Secret Service Chicago field office, as of 4/16/90 "there is nothing to indicate that there are any businesses operating out of xxxx N. Clybourn, Chicago, Illinois." It is a one story section of a larger one-and-two story building which is "V" shaped, fronting on both Clybourn and Belmont Avenues. The third leg of the larger building (southeast side) fronts on a parking lot, with a fenced courtyard section off the parking lot. The xxxx address is approximately the last thirty feet at the south end of the Clybourn side of the building. - 30 - 51. Illinois Bell records show that a non-published telephone line is installed at xxxx N. Clybourn, which is 312-xxx-xxxx. Per Sgt. Abraham, the subscriber is Bruce Xxxxxxxxxxx, xxxx N. Lawndale, Chicago, Illinois and the bills are mailed to Fred Xxxxxxxxxxx at the same address. Telephone service for 312-xxx-xxxx was installed at xxxx N. Clybourn on January 1, 1982. 52. On April 26, 1989, Sgt. Abraham wrote down all of the vehicle license plates parked in the parking lot next to xxxx N. Clybourn and those parked immediately in front of it. PTxxxx, which was a 1987, four- door Ford, was registered to Bruce Xxxxxxxxxxx, xxxx N. Lawndale, Chicago, Illinois. 53. On 4/5/90, the Secret Service office in Chicago was notified by the Illinois Department of Revenue that there are not business licenses for xxxx N. Clybourn, Chicago, Illinois, nor are there any licenses issued to Bruce Xxxxxxxxxxx. 54. On 4/2/90 the Illinois Secretary of State, Corporation Division, advised that Martin and Wendy Gilmore are the only officers for Micro Repair listed on its Illinois Articles of Incorporation. 55. On 4/3/90, the Chicago Postal Inspector's Office informed the Secret Service office in Chicago that the billing address for telephone number 312-528-5020 (the BBS) is Post Office Box xxxx and is open in the name of Mxxx Xxxxxx. The name of the person who made the application for the post office box is Bruce Xxxxxxxxxxx, xxxx N. Lawndale, Chicago, Illinois, - 31 - telephone number 312-xxx-xxxx. Identification used to open the box was Illinois Driver's License exxx-xxxx-xxxx (per the Illinois Secretary of State this license is that of Bruce Xxxxxxxxxxx), and according to Sgt. Abraham, his license address is also xxxx N. Lawndale. 56. To the rear of the property where xxxx N. Clybourn is located, there is an antenna and a satellite dish. SA William P. Conway of the Chicago field office contacted the Coast Guard for assistance in determining the latitude and longitude of the satellite antenna. On 4/3/90, the Coast Guard Air Operations Duty Officer at the Glenview Naval Air Station, Chicago, Illinois, advised that the Belmont/Western/Clybourn intersection, Chicago, Illinois, has a latitude of 41 degrees, 56 minutes, 9 seconds north, and a longitude of 87 degrees, 41 minutes, 5 seconds west. With that information, SA Conway was able to obtain assistance from the Federal Communications Commission in determining the owner of the satellite antenna. Will Gray, of the Chicago FCC office, advised that the FCC license for the antenna (which is mounted on a tower located in the fenced courtyard section of the larger building of which xxxx N. Clybourn is a part) is registered to the American United Cab Company at xxxx N. Belmont. The satellite dish is affixed to the rear of xxxx N. Clybourn. Mounted on the tower are two closed circuit cameras. The first camera is located approximately 20 feet above the ground, the second camera is approximately 45 feet above the ground. - 32 - 57. Chicago Police Department General Offense Report #Mxxxxxx, dated 3/13/89, lists Bruce Xxxxxxxxxxx as the victim, with the address of occurrence listed as xxxx N. Clybourn, Chicago, Illinois. Xxxxxxxxxxx reported that his car window was broken by two subjects. Per this police report, Xxxxxxxxxxx states that he watched on a closed circuit security camera as the two subjects entered the parking lot adjacent to xxxx N. Clybourn, and broke his automobile window. Xxxxxxxxxxx told the officers that the cameras are used for parking lot security, due to "breakins". This incident took place at 2:30 PM. The report lists Xxxxxxxxxxx's residence address as xxxx N. Lawndale, Chicago, Illinois, his home phone number as 312-xxx-xxxx (that telephone number is listed to Fred Xxxxxxxxxxx at the xxxx N. Lawndale address, according to Sgt. Abraham), and his work phone number as 312-xxx-xxxx (the unlisted line billed to his residence). He stated that he is self-employed. 58. On 4/5/90, the Chicago Office of the Secret Service requested Rolonie Kwasny, Security Supervisor, Illinois Bell Telephone to verify that there are no other authorized or unauthorized telephone lines into xxxx N. Clybourn other than 312-528-5020 and 312-xxx-xxxx. 59. On 4/6/90, Kwansy notified the Chicago Office that early on that date the xxxx N. Clybourn address was checked. The larger building of which xxxx N. Clybourn is part, is serviced by 13 working phone lines through the box attached to the Belmont Side of the building, which also services the xxxx address. - 33 - 60. The only authorized phone line to the xxxx address is 312-xxx-xxxx (the number Bruce Xxxxxxxxxxx gave as his business number in the police report). The only other phone line (unauthorized) into the xxxx address is bulletin board number 312-528-5020, the line which leads from the junction box to the building. Kwasny advised that this type of hookup required no special knowledge. 61. Affiant has interviewed Sandquist, Mehnert, and CI 404-235, all of whom have operated electronic bulletin boards themselves. All three advised affiant that the sysop of a BBS must continuously perform a great many maintenance or "housekeeping" chores necessary to operation of the BBS. A sysop's maintenance functions include constantly making changes on the BBS, such as adding or removing users, raising or lowering users' level of access, removing files or programs uploaded to the BBS (added to the system by a user). If a user places a virus or logic bomb which could disrupt the functioning of the BBS, for example, on the sysop's computer, the sysop can remove it. 62. Since many BBS's (including this one) operate 24 hours a day, for the convenience of sysops, BBS software allows many of these functions to be performed from what is called "remote" locations, I.e., by the sysop using another computer, over the telephone line to the BBS. If the BBS is operating at a - 34 - business address, for example, the sysop can perform his maintenance functions at night or any other time from his residence or from any other location where he has a computer, modem, and telephone communication to the BBS. BBS users commonly communicate directly with the sysop on the BBS, either in "chat" mode or by leaving him electronic mail (see Definitions section, above). A BBS sysop is essentially "on call" during the entire time the BBS is in operation, to solve equipment/software problems or interruptions to the operation of the BBS, for the supervision of users, and to communicate with them. Operating a BBS is extremely time-consuming, according to Mehnert, Sandquist, and CI 404-235. 63. CI 404-235 advised affiant that, when he logs on to the BBS, he sees a screen in which the first two lines advised that connection has been made to the BBS, the third line lists the baud rates, or speeds, at which a user may communicate with the BBS, and the fourth line states "On line since 12/10/83". This indicates that approximately one year after the 312-528-5020 number was subscribed to by Bruce Xxxxxxxxxxx, the BBS began operating. As of 4/29/90, all attempts to locate any residence for Bruce Xxxxxxxxxxx other than that listed on his driver's license, auto registration, post office box application, and subscriber records for telephone number 312-xxx-xxxx, have been negative. Therefore, it appears that his residence address is xxxx N. Lawndale, Chicago, Illinois. - 35 - 64. The telephone bills for the unlisted line (312-xxx-xxxx) which is installed in the xxxx N. Clybourn building where the unauthorized BBS line (312-528-5020) leads, are mailed to the same address, xxxx N. Lawndale, Chicago, Illinois, to Fred Xxxxxxxxxxx. 65. If the sysop is accessing the BBS from his residence, it is likely that evidence of the sysop's identity and evidence relating to the operating of the BBS will be found on a computer system at the residence, or on diskettes, printouts, and other records at the residence. The telephone bills for unlisted number are also likely to be found at the residence, along with financial records such as cancelled checks or receipts, which will assist in identifying the individual who paid them. 66. At the xxxx N. Clybourn address, evidence of the connection of the BBS equipment to the 312-528-5020 telephone line, and evidence relating to the operation of the BBS, are expected to be found. Entry into the premises at this location, and physical inspection, are necessary in order to determine whether the 312-xxx-xxxx line is also connected to the BBS. 67. Based upon all of the foregoing, affiant believes that evidence of violations of 18 U.S.C. ~~ 1343, 1030, 1029, 1962, 1963, and 371, will be found at xxxx N. Lawndale, Chicago, Illinois, and at xxxx N. Clybourn, Illinois, such evidence consisting of: - 36 - 68. Electronic data processing and storage devices, computers and computer systems including central processing units; internal and peripheral storage devices such as fixed disks, floppy disk drives and diskettes, tape drives and tapes, optical storage devices or other memory storage devices; peripheral input/output devices such as keyboards, printers, video display monitors, optical readers, and related communications devices such as modems; together with system documentation, operating logs and documentation, software and instruction manuals. 69. Telephone equipment such as lineman's handsets, memory telephones, automatic dialers, programmable telephone dialing or signalling devices, electronic tone generating devices. 70. Records pertaining to ComSystems, ITT and other long distance companies' access numbers and customer authorization codes; credit card numbers; telephone numbers for computer bulletin boards, voice mail systems, and corporate computer systems; PBX codes and related telephone numbers; records and information related to the unauthorized access into computer systems or to the sale, sharing, or other distribution of long distance companies' access numbers and customer authorization codes, credit card numbers, including financial records, receipt of payments, worksheets, correspondence, memoranda, computer bulletin board downloads or messages, and other documentation. 71. Records pertaining to Mxxx Xxxxxx Inc., to Post - 37 - Office box number xxxx, telephone bills for 312-528-5020 and to 312-xxx-xxxx from 1982 to the present date, bank account records including statements and cancelled checks for Bruce Xxxxxxxxxxx from 1982 to the present date, business records relating to the occupancy of the xxxx N. Clybourn premises, including rent/mortgage payment receipts, rental or mortgage contracts, utility bills and proof of payment, and records pertaining to the purchase, ownership, and maintenance of the BBS computer system and software. 72. All of the above records, whether stored or on paper, on magnetic media such as tape, cassette, disk, diskette, or on memory storage devices such as optical disks, programmable instruments such as telephones, "electronic address books", programmable wristwatches, calculators, or any other storage media, together with the indicia of use, ownership, possession or control of all of the above property or records, including bills, letters, identification, personal effects, memoranda, and other documentation. 73. Since much of the above-described evidence is likely to be found in electronic form or machine-readable media which cannot be read or analyzed by affiant in its present form, - 38 - affiant requests authorization to seize, listen to, read, review, and maintain the above described property and records and to convert the above records to human-readable form as necessary. (Signature/G. Kirt Lawson) Affiant Subscribed and Sworn before me this 30th day of APRIL, 1990. (signature) Cynthaia M. Penumire {??illegible) Notary Public My Commission Expires (illegible) 9865e/ - 39 - ---end of documents-----