Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 6/24/83; site mit-eddie.UUCP
Path: utzoo!linus!decvax!genrad!mit-eddie!bcn
From: bcn@mit-eddie.UUCP (Clifford Neuman)
Newsgroups: net.legal
Subject: Intruder roundup
Message-ID: <972@mit-eddie.UUCP>
Date: Mon, 28-Nov-83 23:52:33 EST
Article-I.D.: mit-eddi.972
Posted: Mon Nov 28 23:52:33 1983
Date-Received: Wed, 30-Nov-83 02:15:33 EST
Organization: MIT, Cambridge, MA
Lines: 34

Date:  26 Oct 1983 16:19:38 PDT
From: guy @ UCLA-LOCUS
Subject:  potential 'witnesses' needed for district attorney's case
Text: 
Hello,

	Most of you are already aware of the arpanet-hackers problem that was
occuring during August and September of this year, in which UCLA was used as
the 'home' site for much of the activity.  (If this is the first you've heard
of it, my apologies.  Only recently have we conducted an exhaustive(ing)
analysis of the data we've been collecting.)

	Our district attorney's office is in the final stages of filing charges
against two individuals.  (search warrants were served Sep. 22, and equipment
and materials confiscated)  In order to proceed, they need the name of a person
from each victimized site who can testify that their site was penetrated at
specified times, on specified accounts.  Basically what we need is supporting
evidence that in some way would indicate to a court that we haven't 'faked up'
our log files.  'Last login' information will suffice; if you happen to have
more extensive information, that would be welcome.  (Incoming/outgoing FTP and
TELNET logging info would be very useful as well.)

	The name(s) you each supply will appear on court documents when the
charges are filed (hopefully this week).  They will be listed as 'potential
witnesses' to support the charges.  This means that the names will probably be
public information, available to the press, but does NOT mean that the persons
listed will actually have to come and testify.  If this thing does in fact go
to trial, some subset of the names will be selected.  The DA was unsure whether
simple affidavits would suffice, in place of personal appearances.

	In short, the DA needs (yesterday, of course) one name from each site
that he can list as a potential witness to corroborate what our log files say,
at least in regards to when connections were made.  He would like to file the
charges Friday, Oct. 28.  So far, the original search warrants have been sealed
away from the press, but from Friday on, everything will