JOHN C. SMITH, SENIOR INVESTIGATOR

HI TECH / COMPUTER CRIME UNIT

SANTA CLARA COUNTY DISTRICT ATTORNEY'S OFFICE

70 WEST HEDDING STREET

SAN JOSE, CALIFORNIA 95110

408/299-8411 email jsmith@netcom.com

The Santa Clara County District Attorney's Office Hi Tech /

Computer Crime Team has had years of experience investigating and

prosecuting trade secret thefts, network intrusions, chip thefts, and

other types of high technology thefts in Silicon Valley. The Unit is

composed of two Deputy District Attorneys and one Investigator.

Some of the cases we have handled include:

Theft of Source code to manufacture computer chips.

Theft of manufacturing processes to make computer chips.

Theft of password files from computers (hacking).

Sending harassing e-mail over networks (Internet).

Theft of software by rewriting into another computer language.

Shutting down computers via telephone access.

Theft of Source Code to develop competing software program.

Intrusion into computer systems using random number dialers.

Theft of Source code via modems and cellular phone.

Intrusion into systems via the Internet using bugs such as rdist.

Illegal intrusion into networks to destroy data.

Theft of hardware and computer chips.

THIS PRESENTATION WILL COVER

Network intrusions.

Theft of proprietary material

How to conduct your investigation and gather evidence.

How to gather and safeguard the evidence necessary for prosecution.

How to get the appropriate law enforcement support.

How to work with law enforcement so they understand the problem.

What is required for a search warrant.

How a Search Warrant Raid is conducted (You may be asked to go.).

What is required for a telephone trap.

What is required for an arrest.

What to expect from the court process.

How to prepare to testify in court if necessary.

How to recover damages civilly or from probation.

Impact of the Electronic Communications Privacy Act.

Examples of Search Warrants and Telephone Traps are attached.

Actual cases will be discussed and used as examples. The search warrant

affidavits and telephone traps attached to this outline are exactly as

I took them to court with the exception of the name changes. By

thoroughly reading the affidavits, the reader will have the opportunity

to see what probable cause to obtain a search warrant.

HAS A CRIME BEEN COMMITTED

Under most circumstances, For Federal or local law enforcement to assist

you there has to be a violation of the law.

United States Code, Title 18, Section 1030, "Fraud and related

Activity in Connection with Computers", is the section relied upon

by the FBI. (A COPY OF THIS SECTION IS ATTACHED.) The FBI will

also attempt to use sections dealing with theft by wire and

interstate theft.

Each State has their own laws. These laws vary widely and most

states have not yet enacted appropriate laws for dealing with

computer or network intrusion.

California Penal Code Section 502, "Unauthorized Access to

Computers, Computer Systems, and Computer Data." (A COPY IS

ATTACHED.) Some of the subsections are felonies. A person

who is convicted of this section is subject to having their

computer forfeited under Penal Code Section 502.01.

California Penal Code Section 499c, "Trade Secrets" covers the

theft of trade secrets. This has to be scientific or

technical information, computer programs, or information

stored in a computer.

If local law enforcement decides that they do not have

sufficient information to file a crime report, conduct a

search warrant, or issue and arrest warrant, they may be able

to phone or contact your suspect and warn them to stop. This

does sometimes work.

WHEN A CRIME HAS BEEN COMMITTED

DO NOT CONFRONT OR TALK WITH THE SUSPECT.

This gives them the opportunity to hide or destroy evidence.

Law enforcement probably will not help you if this occurs because

of the slim chance of making a case.

If necessary call law enforcement and ask what the law is.

Many times executive of victims companies are hesitant to file a

crime report until they know and understand what law enforcement

will do. Can you discuss what your options are with the

appropriate law enforcement agency without having to make an

official report?

You should be able to discuss your options without having to file

an official crime report. Under most circumstances our office will

not file a criminal case for theft of data or proprietary

information (Industrial Espionage) unless the company/victim wants

to file a criminal charge. These cases are complex and require the

willing cooperation of the victim. We make sure they understand

what will be required of them before we will start an

investigation.

Many times both the FBI and local law enforcement will have jurisdiction

over a network intrusion or theft. You may want to talk to both about

how long their investigation will take and what they expect from you.

Will their reports be available for your review and use in civil

actions?

Law Enforcement does not like a company "shopping" for the best

deal so be careful how you deal with agencies. Remember the

agencies talk and work with each other.

Local law enforcement may have trouble conducting the investigation

outside of their jurisdiction. Police Departments and Sheriff's

Offices will work with their local prosecutors.

Will the FBI conduct an investigation? They have to work with

the U. S. Attorney's Office to obtain a search warrant or

investigate a case.

SHOULD YOU REQUEST LAW ENFORCEMENT ASSISTANCE

This can be DAMAGE CONTROL, the only way you may ever know the extent of

your loss or network penetration is from the evidence collected from a

search warrant.

DO NOT WAIT TOO LONG TO CALL. It is best to notify law enforcement

right way. In one case we worked, the backup tapes from a system an

intruder was using were kept only a short time and then reused.

In a civil action, you will demand discovery to obtain evidence and

learn what document or data the defendant may have, but it is up to the

person being sued to turn over the documents you are accusing them of

stealing or using to penetrate your network.

Working with law enforcement is a time consuming and demanding task.

For us to assist you with an investigation we require your assistance

and cooperation. We need:

A commitment of your time and resources. You will have to work

with law enforcement at almost every step of the process.

Interviews to prepare crime reports and the affidavit for a

search warrant.

Engineers or computer operators to accompany law enforcement on the

search warrant to assist with operation of computer system and

identification of data or property.

Assistance the victim company to identify and describe documents,

source code, and other evidence found.

A company expert may need to be available for explanations and

assistance during a trial.

Documents may need to be provided to the defendant's attorneys for

discovery. They may ask for more than you want to provide. Your

attorney will have to argue against broad ranging discovery.

Defendant's are entitled to seek evidence they need for their

defense.

You and other company employees will be subpoenaed to testify.

This is time-consuming in that witnesses may have to wait their

turn in court

Very few cases actually go to trial! Approximately 5 % go to trial in

Superior Court in Santa Clara County, California.

There will generally be plea bargaining and negotiations so that an

agreed upon sentence can be reached. Both prosecutors and defense

attorneys know what sentences can be expected from certain cases.

White collar crimes are not usually prison crimes.

You should be able to access law enforcement's reports. This will help

you understand your situation. You can then use those reports for civil

proceedings.

If you are going to initiate civil litigation, it is a good idea to wait

until you decide whether you are going to make a report to law

enforcement. You do not want to alert the suspect to criminal action in

the event a search warrant is issued.

Law enforcement does not (or should not) care if civil actions are

filed. In most of our cases there have been parallel civil actions

and they have not affected our cases.

In some cases the victim's attorneys have used our Search Warrant

Affidavit to apply to the court for a TRO (temporary restraining

order) to prohibit a suspect from using materials or data they have

taken.

HOW TO GET LAW ENFORCEMENT'S ASSISTANCE

CORPORATE SECURITY - If your company has corporate security or a

corporate investigator, talk with them. They may know the capability of

law enforcement in your area. They may have contacts with law

enforcement. They may know the best way to get assistance.

The High Technology Crime Investigation Association (HTCIA) is a group

of local and federal law enforcement officers, corporate investigators

and private investigators who have an interest in or work in the area of

computer or high technology crime. HTCIA provides training to its

members. I can put you in touch with someone from each chapter.

HTCIA has chapters in:

Silicon Valley (San Jose), California

Southern California

Northern (Sacramento), California

Austin Texas

Portland Oregon

Chicago, Illinois

New York, NY

New Mexico

Chapters have begun forming in Netherlands and in Arizona.

(I try to keep up with current contacts and phone Numbers.)

If you call local law enforcement, I recommend calling the

investigations or detective bureau directly.

If you call 911 or a regular police department reporting number,

they will send a uniformed officer, and log the call on a public

log. It is the uniformed officers job to write a report which will

go through a review process, be logged in by records, and then sent

to investigations for assignment to the appropriate investigator.

This can some times take a week.

Try to get the direct assistance of an investigator. You will

usually get a more experienced officer and faster assistance.

Call your local prosecutors office. Most District Attorney's Office

have investigators. Ask if there is a computer or hi tech unit. Ask if

they know who would be best to assist you.

Training for law enforcement is becoming better and easier to get.

Don't be surprised if there is a highly trained law enforcement officer

in your local area. You just have to find them and cultivate their

friendship. Interested law enforcement officers would probably be

interested in talking with you or touring your facilities.

If your company will allow (many will not), consider volunteering

to provide advice and assistance to local law enforcement. I have

started a volunteer program of computer knowledgeable individuals

who help me on search warrants and help retrieve data from

computers. If you work for someone you should get permission

first. Many corporations see this type of volunteer work as being

a conflict of interest. If this is the case, see if they will let

you provide advice or training to law enforcement. This will pay

dividends because it gives you direct access to law enforcement for

advice if and when you need it.

The FBI has a highly trained computer crime team stationed in Washington

D.C. They can be reached at (202)324-9168.

WORKING WITH LAW ENFORCEMENT

Remember there is a very good chance the law enforcement officer is not

going understand the technical aspects what you are talking about. Most

cannot work PC's much less understand a network problem.

You should have been making notes of your activities as you track an

intruder. Put this is some type of a report or memo format. This

report can be given to the officer. It can also be used as part of the

report or as an attachment for a search warrant. You can then use this

report to help you recall what you did if the case goes to trial many

months later.

As you write your report remember WHO, WHAT, WHEN, WHERE, WHY, and

HOW. If you and law enforcement can show this you can make a case.

Diagrams are very helpful in understanding systems. A diagram can be

attached to the report to help others who have to read and understand

the report. Diagrams are frequently used in court.

EVIDENCE

In these types of cases evidence may consist of such things as back up

tapes, printouts of computer programs, suspect's accounts and the

contents, computer disks.

In one case we used an article found online that had been written

by our suspect regarding activities he had been involved in. We

attached this to our affidavit requesting a search warrant.

In a intrusion case, you will be looking for evidence that will show who

commit the violation and that can be used to obtain a search warrant to

seize the suspect's personal computers at his home or business.

A suspect would have a good defense if you only found evidence in

an online account. The defense will claim that someone else put

the evidence there. We would not charge a person with a crime on

the basis of evidence found in an online account.

We investigated and obtained a conviction on a suspect that

used someone else's account (after they broke the password) to

shut down a computer. I later found the broken password in

the original suspects home computer. (I CAN EMAIL YOU THE

JUDGE'S RULING FROM THE APPEAL WHERE HE DISCUSSES THIS.)

You would use the evidence in the online account to seize the

suspect computers. Law enforcement will then search the suspect's

personal computers for evidence. You often find printed material

at suspect's home that can be used as evidence.

Evidence must be gathered by law enforcement officers in accordance

court guideline governing search and seizure or it will be excluded.

This is referred to as the Exclusionary Rule. It does not apply to

ordinary citizens such as you. You do have to remember that if you do

something illegally you could be sued.

If you gather evidence at the request or suggestion of a law

enforcement officer and the gathering does not meet the legal

requirement, that evidence will be excluded.

Remember the provisions of the Electronic Communications Privacy Act,

Chapters 2500 & 2700 of Title 18 of the United States Code.

CHAIN OF POSSESSION - This means that for evidence to be admitted in

court, the prosecution has to be able to show who obtained it, who

secured it, anyone who has had control. It will probably be necessary

to have anyone in this category testify. This applies to anything you

may secure such as a disk or backup tape.

Evidence should be properly marked by placing your initials on items

like tapes, printouts, documents, or equipment. Items can be sealed in

envelopes or bags which should be signed, dated, and sealed.

Evidence should be stored and locked, so that you can testify that no

one other than yourself or those people that you can name have had

access to it.

The defense may maintain that an item has been tampered with or

changed.

Read the attached Search Warrant Affidavits for ideas on what can be

evidence. These are actual warrants I have written and served, but with

name changes.

The affidavit on page 27 is a good illustration of what can be evidence.

OBTAINING AND SERVING SEARCH WARRANTS

The search warrant should be done as quickly as possible before the

intruder can do further damage. It has been my experience that this

type of person does not destroy data unless they are threatened.

It is important that you keep information about the investigation

limited to as few people as possible. This limits the possibility

of the investigation being leaked.

When I go to a victim company to conduct my investigation, I

usually do not identify myself as law enforcement to company

receptionists and others not involved in an investigation.

You should ask law enforcement to merely request to speak with

you when they come to your office to start the investigation.

Probable cause is the criteria required for the issuance of a Search

Warrant. You have to establish that a crime has been committed and show

why there is cause to enter someone's home or business. The law

enforcement officer, probably a local prosecutor, and a judge all have

to believe that there is probable cause. For a conviction you have to

prove that someone is guilty beyond a reasonable doubt, much stronger

that probable cause.

If you have property or data stolen and probable cause can be

established, a search warrant can be issued for both building and

computer systems. Comparisons of data recovered can be made with data

allegedly stolen.

You may be asked to accompany law enforcement on the search warrant as

a technical assistant or to identify property.

If it is necessary for you carry documents in on a search warrant,

consider copying them onto colored paper. This will prevent the

defense from inferring that what might have been found was left by

you.

Once law enforcement has served the search warrant and examined the

seized computers and disks, you will start to be aware of the extent of

your problem. You will probably be asked to help evaluate and identify

programs found on computers.

This will probably lead to other victims.

Any evidence gathered during the search warrant, even though maintained

by law enforcement, is legally under the control of the court. Even

though a seized item may have your name on a document, it will not be

returned to you unless the suspect signs a release or after a hearing by

the court.

Many victims just want to get their property back after a search

warrant has been completed. They may not want to go to trial for

fear of disclosing information and think that if they drop charges

they will get their property returned to them.

TELEPHONE TRAPS

(SEE ATTACHED EXAMPLES)

This requires the equivalent of a search warrant. You will have to file

a crime report with law enforcement. The prosecutor or U.S. Attorney's

office will have to approve the request before it is taken to a judge

for signature.

The form will be different from State to State, but it usually

always take probable cause.

Once you have information regarding where calls are coming from, this

will be the probable cause needed to obtain a search warrant for that

location.

Modifying and illegally using cellular phones has become big business.

It is impossible to track and locate if a suspect has used someone

else's id or cellular phone number. In one case the suspect social

engineered a modem access number and then used a cellular phone to

illegally access a companies network.

If you belong to any type of an association, invite a local telephone

company representative to meet and talk with your group.

Most of the telephone companies are charging for these types of

services. You will be required to pay the costs.

DISCOVERY AND PROTECTIVE ORDERS

Discovery is where the prosecution (not the defense) provides all

reports, information on evidence, list of potential witnesses, any

criminal history of witnesses, and any information except how the

prosecution is going to present the case in court.

Any property or data recovered by law enforcement and will be subject to

discovery if a person is charged with a crime. However a protective

order can limit who has access, who can copy, and the disposition of the

documents.

A protective order allows you to protect proprietary or trade secret

documents related to the case.

California Evidence Code Sections 1061, 1062, & 1063, deal with

protecting proprietary information, how to obtain protective orders, and

how to close courtrooms during discussion of propriety information. It

also limits who the defense can hire to use as an expert witness.

If your State does not have such a law, you and members of your

association should work to have one passed.

(AN ARTICLE ON THIS SECTION IS ATTACHED)

CRIMINAL TRIALS AND TESTIFYING IN COURT

Once a person is arrested they will be arraigned, during which time the

court will make sure the suspect has an attorney. For a felony a grand

jury hearing or preliminary hearing will be scheduled. States do differ

somewhat in this process.

In a grand jury hearing the defendant nor their attorney can be

present. A grand jury hearing is considerably faster.

In a preliminary hearing the prosecution must show that a crime has

been committed and there is probable cause to believe that the

defendant committed the crime.

If the defendant is held to answer in a preliminary hearing or the grand

jury returns an indictment, a trial will be scheduled.

If the case goes to trial, interviews with witnesses will be necessary.

You may have to assign someone to work with law enforcement as a

liaison. Key employees will have to spend time away from work at the

court as the prosecution is required to have another witness ready as

soon as the current witness is excused.

If you are called as a witness, you should be given instructions prior

to trial by the prosecutor about the type of questions to expect and how

you will be allowed to answer questions. Remember the prosecutor does

not know what the defense attorney will ask. The prosecution is

required to furnish the defense with copies of all reports, evidence,

and witnesses names prior to the trial.

Listen to the question carefully to get the fully meaning and the

determine that is not a multiple part question or contradictory. Most

defense attorney are going to want you to answer only yes or no.

However if you can not answer with a yes or no, let the court know that

it is necessary to answer with an explanation.

Do not answer immediately and make sure you understand the

question. This pause will give the prosecutor time to object to

defense questions that are inappropriate, confusing, or vague.

If you do not totally understand the question, ask for an

explanation or start your answer by stating: "I understand your

question to be... (give an explanation) and thus my answer would be

this....."

You can not give hearsay answers, only information that you have seen or

done. This means that you can generally not testify as to what someone

has told you.

Engineers are generally poor witnesses. They tend to see things in

absolutes. Often times it is necessary to explain or request

clarification so that a witness is not always answering no.

In one case we called a woman engineer as a witness. On the first

day she answered no so often everyone thought she was committing

perjury. That evening I explain that she should begin explaining

rather than just saying no. This worked for her.

EXPERT WITNESS - Based on your education, training, and experience, you

may qualify to testify as an expert witness. This will allow you to

give explanations about how computer systems or networks function. In

order to give an opinion you have to be qualified as an expert witness.

I have testified as an expert on fingerprints, drugs, alcohol, and

prostitutes. It has taken up to an hour to go through this process

as the defense can also challenge your expertise.

RECOVERY OF DAMAGES

To recover the cost of damages, such as reconstructing data,

re-installing an uncontaminated system, or repairing a system, you can

file a civil lawsuit against a person.

You can hire an attorney or you could consider filing a claim in

small claims court. In California, neither you or the person you

are suing can take an attorney into court. Small claims is heard

only by a Judge. In California the maximum that you can sue for in

Small Claims is $5,000.00. Check with your local court to learn

the small claim maximum

THINGS TO REMEMBER DURING AN INVESTIGATION

To remember this think of Smith's Splendid / Silly / Superfluous System

SPEED

STEALTH

SYSTEM SECURITY

SECURE EVIDENCE

SUSPICIOUS / SCREWY EMPLOYEES

SHOW & EXPLAIN - REPORTING

SEARCH WARRANT - PREPARE AND SERVE

SPEED

Obtain a copy of any unauthorized program or data quickly before it is

moved or erased. This copy could be valuable evidence. Notify law

enforcement and try to get a search warrant to find any additional data

or seize any personal computers associated with the crime. There is

likely to be additional information in the computers that may tell you

about other intrusion into your systems as well as other companies.

In one case I found 10 etc/passwd files, most with cracked

passwords. In recent cases I have found a backdoor login program

and a trojan horse. I was able to show these programs to the

systems operator so they could more effectively check their

systems.

If you have a theft of a trade secret, you should talk with your law

enforcement representative to find out what they can and will do to

help. Can the secret be stopped before it is removed from the United

States and what can be done if it is removed. We are presently

prosecuting a company based in Taiwan.

STEALTH

Don't alert intruder that law enforcement is involved. In several cases

it has taken several weeks to complete the investigation and obtain a

search warrant. Very few people in the victim company knew who I was,

they merely viewed me as another consultant. As a result we recovered

computers and other data from the victims.

SYSTEM SECURITY

This will most likely be your major concern, but law enforcement's role

is to catch the bad guys. Explain to law enforcement what the intruder

can do with any data they may have taken or from just gaining access.

Remember the law enforcement officer may not understand the potential

damage to your system or the over ramifications to "merely having an

unauthorized person connecting to your system."

Explain what an intruder can do if they can get root access and

what it will take for you to correct the problem.

Even under the ECPA you can take steps to protect your system, if you do

tell law enforcement what you found without a proper search warrant.

If you think you need to examine someone's account to protect your

system, you should document the reasons that you took the action.

SECURE EVIDENCE

Remember the Chain of Evidence. This is critical as we can not

introduce evidence in court unless we can prove the chain of possession.

Make or obtain tapes of data when possible.

Try to determine the motive of the intruder. This will help with the

prosecution

In cases of theft, a showing of probable cause will have to be made that

the product being sought in the search warrant is the same as the victim

companies. I have made comparison of the victims printed manual with

the manual or manual pages from a suspect's software program. A victim

company engineers statement that the functionality is the same is not

sufficient, this statement must be corroborated with evidence like the

manual pages.

SUSPICIOUS EMPLOYEES

If an employee with system knowledge leaves your company, consider

changing passwords. We investigated a case where a manufacturing

database was erased twice. The first time was with use of a current

employees password that the suspect learned while employed with the

victim.

Most of Santa Clara County District Attorney's office cases of trade

secret theft have involved employee embezzlement. Several examples

include:

WBS - a disgruntled engineer who carried out thousands of pages of

proprietary information and tried to use them to get another job after

he was terminated.

M Goldberg - a young man from France who was sent to the United States

to work in American software companies rather than serve his French

military draft obligations. When his 2 year obligation expired he was

stopped from getting on an airplane with enough proprietary information

to duplicate the software program he had been working on. He said he

want to get a job when he returned to France.

CVD - The manager of a computer support group that had his employees

rewrite his company's major database program from an IBM mainframe

language to a C for Sun workstations. He then sold it for several

million dollars. He was also trying to do business with other

countries. A Sun Employee was also convicted for commercial bribery

for helping CVD sell the stolen software to Sun. He was also trying to

sell computer programs in other countries.

Raj - an Indian engineer who went to work as a security guard at a

computer company's R&D building while at the same time he was working

for other companies doing the same type of development.

Foreign companies - One tactic is to hire one employee from a company so

that person can help determine who else to hire.

SHOW & EXPLAIN FOR LAW ENFORCEMENT

When you think you have a problem you should ask your local law

enforcement whether they are required to take a report if you talk to

them about a problem. If you decide you are going to file a report

designate someone to work with law enforcement.

Remember a report and diagrams are helpful.

On a case of software theft, I worked with a customer support software

engineer who was very good at explaining the company product.

Law enforcement will have to talk directly with development engineers,

financial officers, and other company officials. You can not just have

your attorney relate the information. We require a commitment from a

high ranking company official that they will support a criminal trial

before we will start a search warrant.

SEARCH WARRANT

A search warrant to check a suspect's home and computers is the only way

to know the extent of an intrusion into your computer system or to learn

if any programs were modified or programs left in you your system.

A search warrant is also often the only way to recover stolen

proprietary information.

A phone trap also requires a search warrant.

FEDERAL AGENCIES

FBI has a computer crime team in Washington DC and some trained agents

in various field offices

Secret Service, has experts in areas around the USA.

Customs tracks money exchanges.

U. S. Commerce Department - can keep companies who have stolen products

from doing business in the USA such as in the case of the Taiwanese

company charged with theft of trade secrets.

IRS sometimes even if you can not prove a crime the IRS can tax people

who have stolen products, made money, and not paid taxes.

ECPA - TITLE 18 U S CODE 2500/2700

Electronic Communications Privacy Act Title 18 US Code Chapters 2500 &

2700 as it relates to keystroke monitoring or system administrators

looking in other people accounts. If you do not have a banner or the

account holder has not been properly notified, the system administrator

can be guilty of a crime and liable for civil penalties from a law suit

for key stroke monitoring or looking in someone's account.

ATTACHMENTS

SEARCH WARRANT EXAMPLES:

Page 16 - For a Commerial E-Mail account

Page 20 - Illegally accessing a company network and destroying data

Page 27 - Broken University account

Page 38 - Number Search & Trap and Trace for long distance connections

Page 45 - Trap & Trace for attempted contact to system

Page 50 - Example of new language for describing computer data and

computer equipment to be seized with a search warrant.

Page 52 - Section 1030 Title 18 U.S. Code

Page 55 - Section 499c California Penal Code

Page 56 - Section 502 California Penal Code

Page 61 - Article on 1061 California Evidence Code

The following three (3) Search Warrant Affidavits on file with the

Superior Court were used to obtain a conviction in a case where the

defendant was charged with the theft of passwords and for shutting down

a computer.:

Page 65 - For account information from commerial provider, conforms to

ECPA.

Page 81 - For computers and other records to show network intrusion.

Page 89 - For computers after a computer was shut down.

This affidavit deals with obtaining a copy of a suspect electronic mail

account at a commerial account provider for the Internet

SUPERIOR COURT OF CALIFORNIA

SANTA CLARA COUNTY JUDICIAL DISTRICT

STATE OF CALIFORNIA - COUNTY OF SANTA CLARA

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT

JOHN C. SMITH being sworn, says that on the basis of the

information contained within this Affidavit and any attachments thereto,

he has probable cause to believe and does believe that the property

described below is lawfully seizable pursuant to Penal Code Section

1524, as indicated below, in that it:

( ) was stolen or embezzled;

(X) was used as the means of committing a felony;

( ) is possessed by a person with the intent to use same as a means of

committing a public offense, or in the possession of another to

whom he/she may have delivered same for the purpose of concealing

or preventing its discovery;

(X) constitutes evidence tending to show that a felony has been

committed or that a particular person has committed a felony;

and that he has probable cause to believe and does believe that the

described property is now located at, and will be found at, the

location(s) set forth below and thus requests a warrant to search

THE FOLLOWING LOCATION(S):

The premises at Blvd, Suite City of Town, County of Santa Clara,

State of California, further described as Commercial Communications a

commercial on-line computer service communication company that provides

access to the Internet for subscribers. The Internet is a world wide

network coordinated by National Science Foundation.

The premises to be searched also include any and all electronic

mailboxes, directories, or accounts on Commercial Communications's

computer system, registered to or containing data placed in that

directory by Brendan Gomez.

DESCRIPTION OF PROPERTY TO BE SEIZED

1.2. Any and all documents and records, whether on paper or stored on

magnetic media (including information stored within a computer),

within the account of Brendan Gomez, which show the unauthorized

entry or attempted entry or connection to other computer systems

that connect to the Internet or were done

2. Any and all programs or computer instructions that reside in the

account of Brendan Gomez at Commercial Communications that would be

used for the unauthorized connections to other accounts on the

Internet and would be used for the automatic transfer of

information or programs in any other account or systems on the

Internet (hacking).

3. Documents and/or magnetic media showing the identity of users,

owners, or lessees of the computer account managed by Commercial

Communications and registered Brendan Gomez.

STATEMENT OF PROBABLE CAUSE

Your affiant declares that the facts in support of issuance of this

search warrant are as follows:

Your affiant, John C. Smith, is a Senior Criminal Investigator

(Peace Officer) employed by the Santa Clara County District Attorney's

Office in Santa Clara County, California. Your affiant has been

assigned to the High Technology / Computer Crime Unit of that office

since December 1989. He has been a California Peace Officer since June

1965. He is a member and past President of the High Technology Crime

Investigators Association (HTCIA), and the Santa Clara Valley Industrial

Security Managers Association. He has been a Macintosh computer user

since about 1986 and an IBM PC user since 1990 and owns both types of

computers. He is a regular user of the Internet and has had classes on

the Unix/Workstation operating environment. He has over 274 hours of

training in the High Technology field. He has worked at least eight (8)

prior network/intrusion type cases and given several talks to computer

professionals on investigating intrusions. He has conversed with experts

in federal law enforcement corporate network security who have

specialized in these cases, and who have considerable experience in

investigating and interacting with persons who have illegally accessed

computers.

Your affiant was contacted by President of Commercial

Communications Company, Blvd., Suite 200 , Town, California, on Friday,

June 17, 1994. President told affiant that Commercial had received a

communication from the Computer Emergency Response Team (CERT) that

detailed a break-in of a computer system at OutOfState University from

an account at Commercial. (CERT is the federally funded agency

responsible for monitoring security issues on the Internet). This

communication is attached as Exhibit A. (NOTE FOR SUN USER GROUP - This

attachment listed the dates, times, and computer systems that were

illegally accessed. I attached it as part of the affidavit so I would

not have to type the same information.)

Your affiant started his investigation by interviewing John Little,

President of Commercial Communications and opening Santa Clara County

District Attorney's Office Case #94-O-0889. Little gave your affiant

the following information: He started Commercial Communication,

(hereafter referred to as Commerical) in 1986. Commercial is an on line

communications services, setup to provide customers with access to the

Internet. Commercial has two T-1 leased lines, one to BARRNET and the

other to CIX, Commercial Internet Exchange, in Santa Clara.

President explained that the message from CERT detailed a break-in

to an account and a computer system at OutOfState University on June 9,

1994. In this intrusion the intruder achieved root access and then broke

into five (5) OutOfState computers. (Root or superuser status is the

privileged or upper level used by the systems administer. At the root

level a user is allowed to do anything on the system such as to look,

use or change any regular account and to create in files under other

names that may run programs not normally allowed on a system.) President

said that Commercial did not know which customer account was being used

to reach OutOfState and Commercial was concerned that Commercial's

computer systems may have been or be compromised. Commercial employees

Brain Brown and Rich Black began checking the Commercial system to make

sure Commercial's system had not compromised. They traced the activity

from OutOfState back to Brenden Gomez's account. They open the account

to see if Commercial's system was being compromised and saw tools for

breaking into computer systems.

Your affiant interviewed BRIAN T. Brown, Commercial Technical

Support staff member. Brown gave affiant the following information: He

has worked at Commercial for 3 years and has been working with UNIX for

about 6 years. Brown explained that after Commercial received the

message from CERT, Exhibit A, he and Black matched IP (Internet)

addresses from OutOfState with outgoing logs generated automatically by

Commercial's computers. Commercial has a logging program that captures

outgoing ftp (file transfer process) and telnet connections, i.e.,

connections to computers at other locations. At about the same time

the connections were made to the computer accessed at OutOfState, Brown

saw three connections to OutOfState from a Commercial account labeled

"brendan". Brown said there were no other connections made to

OutOfState during this time period. Brown and Black opened this account

to ensure that Commercial's system was not being compromised and in the

account they observed a Sniffer program. The "sniffer" program was not

operating at that time. A "sniffer" is a program that captures the data

sent from a user to other users as the data is transmitted over a

network. Login and password information can be pulled from the data and

used to illegally access other accounts.

Brown believes Brendan is 21 yrs old and a 1991 graduate of High

School in Santa Clara. Brown has met Gomez through a friend and has

talked with Gomez on network chat lines.

Gomez has only paid $40.00 towards the monthly costs of his

"brendan" account while he should have paid $240. Gomez opened the

account in 1993. Gomez's account was automatically suspended, probably

in Aug 93, because of non payment. Gomez somehow got around the

suspension closure and into his account. On Friday 6-17-94, Brown

closed the security hole for billing suspensions.

Your affiant would note that neither Black or Brown actually

intercepted communications made by the person using he "brendan" account

and that the copy of the "brendan" directory made by Brown consisted

of data that was not stored temporarily as an incident of an electronic

transmission. Your affiant specifically does not seek authority to

intercept wire communications made by "brendan" in the future.

Affiant contacted Robin Huxley, an employee of OutOfState

University. Huxley is responsible for security on the computer system

that was compromised from Commercial Communications. Huxley verified

the information in the report he sent to CERT and copied to Commercial

Communications, attached as Exhibit A.

Based on these facts, you affiant is of the opinion that it is

probable that Brendan Gomez has committed violations of Penal Code

Sections 484 and 502c(2), which violations are punishable by terms of

imprisonment of longer than one year, and that evidence thereof exists

on the data tape of the Brendan Gomez directory made by Commercial

communications.

WHEREFORE your affiant prays that a search warrant be issued with

respect to the above locations for the seizure of said property at any

time of the day and that the same be held under Penal Code section 1536

and disposed of according to law.

___________________________

JOHN C. SMITH, Investigator

District Attorney's Office

Santa Clara County

Subscribed and sworn to before me

this 28 day of June 1994.

___________________________

Judge of the Superior Court

EXHIBITS:

A - Three page electronic Message From: huxley-

robin@CS.OutOfState.EDU, Date: 17 Jun 1994, TO: cert@cert.org.

B - Three page report prepared by Brian Brown dated 94/06/22 containing

portions of outgoing message logs from Commercial Communications.

This search warrant was used to search the residence and computers of a

former employee suspected of illegally accessing and the erasing a

company's database.

SUPERIOR COURT OF CALIFORNIA

SANTA CLARA COUNTY JUDICIAL DISTRICT

STATE OF CALIFORNIA - COUNTY OF SANTA CLARA

AFFIDAVIT IN SUPPORT OF SEARCH WARRANT

JOHN C. SMITH being sworn, says that on the basis of the

information contained within this Affidavit and any attachments thereto,

he has probable cause to believe and does believe that the property

described below is lawfully seizable pursuant to Penal Code Section

1524, as indicated below, in that it:

( ) was stolen or embezzled;

(X) was used as the means of committing a felony;

( ) is possessed by a person with the intent to use same as a means of

committing a public offense, or in the possession of another to

whom he/she may have delivered same for the purpose of concealing

or preventing its discovery;

(X) constitutes evidence tending to show that a felony has been

committed or that a particular person has committed a felony;

and that he has probable cause to believe and does believe that the

described property is now located at, and will be found at, the

location(s) set forth below and thus requests a warrant to search

THE FOLLOWING LOCATION(S):

The residence of Joe Suspect described as the premises at 18

Street, City of , County of Santa Clara, State of California, further

described as being a two (2) story structure, a tan color with gray

trim, with the numbers 18 on a lone mailbox across the street from the

residence; including any and all yards, outbuildings, storage areas,

garages, carports, sheds, or mailboxes assigned to the described

premises, including but not limited to those listed above.

FOR THE FOLLOWING PROPERTY:

1. Any and all documents and records, whether on paper or stored on

magnetic media (including information stored within a computer),

which show the unauthorized entry or attempted entry or connection

to the computer systems at MfgCompany Inc, including but not

limited to passwords, password files, security holes, backdoor

logins, telephone numbers for modem connections, and Software that

creates ZY Computer terminal emulation in a personal computer.

2. Any and all programs or computer instructions that would be used

for the unauthorized connections to the computer system at

MfgCompany Inc and would be used for the unauthorized transfer of

information or programs.

3. Any and all documents and records, whether on paper or stored on

magnetic media, that contain any portion of files from the computer

systems of MfgCompany Navigtation

4. Computer hardware, software, and data including, but not limited to

central processing units (CPUs), hard disks, hard disk drives,

floppy disk drives, tape drives, CD-ROM drives, display screens,

keyboards, printers, modems, magnetic tapes, cassette tapes, and

floppy disks, found together or separately from one another.

5. Written documentation, whether typed or handwritten, including, but

not limited to, computer manuals and instructions for the use of

any computers and their accessories found at the premises.

6. Evidence of occupancy and control of said premises and work areas,

including but not limited to, utility company bills, cancelled mail

envelopes, and personal papers.

STATEMENT OF PROBABLE CAUSE

I declare that the facts in support of issuance of this search

warrant are as follows:

I, John C. Smith, am a Senior Criminal Investigator (Peace Officer)

employed by the Santa Clara County District Attorney's Office in Santa

Clara County, California. I have been assigned to the High Technology

/ Computer Crime Unit of that office since December 1989. I have been

a California Peace officer since June 1965. I am a member and past

President of the High Technology Crime Investigators Association

(HTCIA), and the Santa Clara Valley Industrial Security Managers

Association. I have been a Macintosh computer user since about 1986

and an IBM PC user since 1990 and owns both types of computers. I am a

regular user of the Internet and has had classes on the Unix/Workstation

operating environment. I have over 274 hours of training in the High

Technology field. I have worked at least nine (9) prior

network/intrusion type cases and given several talks to computer

professionals on investigating intrusions. I have conversed with

experts in federal law enforcement and corporate network security who

have specialized in these cases, and who have considerable experience in

investigating and interacting with persons who have illegally accessed

computers. I am a member the Santa Clara County Network Security

Working Group responsible for developing and overseeing the security of

the County's wide area network.

I began case #94-0-1102 on Monday, July 18,1994, by interviewing

Alan Albert, Director of Information Systems, MfgCompany Inc, Community,

California, and, Jonathon A., a private investigator hired by

MfgCompany. I again met with Albert and A. on August 5, 1994 and with

Albert on August 8, 1994. Albert told me that someone illegally gained

access to MfgCompany's corporate computer network on June 12, 1994 and

again on July 26, 1994. On these occasions the intruder erased the

files from MfgCompany's manufacturing database, modified key files that

allow data to be moved between computers for company use and caused the

password file on an ZY Computer 4 computer (named Pacific) to become

void so that the 400 to 500 users of that system could not log on.

Albert stated that these intrusions have cost MfgCompany over

$100,000 to repair the damage and hundreds of hours in lost time

repairing the system so that the manufacturing database will function

properly. MfgCompany has had to hire a full time consultant to check

the integrity of the system and ascertain if there are back door login

programs or other programs hidden in the system that would allow an

intruder to access MfgCompany's system without MfgCompany's knowledge.

Albert explained that MfgCompany has offices around the world and

uses its electronic network to connect operations and offices.

MfgCompany has employees in 30 countries. MfgCompany's information

systems and core business systems are headquartered in Bldg x, Ave.,

Community, California. MfgCompany has its manufacturing database set up

on three ZY Computer 4 Mini Computers, named Atlantic, Pacific, &

Baltic, on MfgCompany's ethernet (network connection). There are

approximately 500 computers, both Unix and personal computers, on

MfgCompany's network. MfgCompany's manufacturing database is an

inventory system called "MIP" for Manufacturing & Inventory Planning.

The ZY Computer 4 operating system is in a language called MPE and the

database application/program is called "Enhanced Software", produced by

SoftwareCo Computer Systems of Santa Clara County.

Albert believes that the unauthorized intrusion and damage to the

system was done by a former MfgCompany employee, Ray Suspect, who was

the Manager of the Operations Group in the Information Systems

Department. Albert said that Suspect was only one of two people who had

all of the information and skills necessary to locate and change the

files that were changed. Albert explained that MfgCompany has not cross

trained Information Systems employees so that in some cases only one

person will know a job or function. In most cases there will only be

two people who may have the same skills. Suspect was released by

MfgCompany.

Albert told me the following: Suspect was hired because he had

worked for (ZY Computer) and was very knowledge able about the ZY

Computer 4 Computer. Suspect set up the "Enhanced Software"

communications software that allows communication and file exchange

between the ZY Computer 4 computers, Pacific & Baltic, at MfgCompany.

Ray connected to MfgCompany's computer network system from his home as

part of his job on a daily or regular basis via a modem into the ZY

Computer 4 and into a modem bank on an X.25 network (worldwide network)

that is connected to the ethernet (local). He was also aware of the

modem connections for Unix computers and personal computers on the

ethernet based network.

An internal investigation preceded Suspect's termination, so that

he was working at the company while the termination was discussed. He

has the knowledge to place hidden programs (backdoor logins) on the

system that would allow him access to the system.

On June 12, 1994, MfgCompany experienced an unauthorized 3 minute

logon to one of the ZY Computer 4 Mini Computers, called Pacific.

Pacific contains MfgCompany's manufacturing database. During this

unauthorized intrusion the intruder performed four (4) actions that have

caused MfgCompany to have to spend many hours and extra cost to repair

their computer system.

In the first action the intruder erased MfgCompany's data files in

the manufacturing database but not the executable database program.

In the second action, two Configuration files were removed from

Pacific's Enhanced Software application which tell Enhanced Software how

to use how to obtain data from the other 2 ZY Computer 4s on the system.

Enhanced Software resided on both Baltic and Pacific, but with

different sets of data. The data is divided between Pacific and Baltic

based on demand and location. For MfgCompany to achieve maximum

utilization of the Enhanced Software database and its computers, all

three ZY Computer 4's have to be able to communicate and pass data. The

2 configurations files which were removed are separate from the Enhanced

Software executable code and do not reside in the same group

(directory). The intruder had to have expert knowledge of the ZY

Computer 4 system and the SoftwareCo Enhanced Software application to

know which files from approx 20,000 files in the application and

manufacturing database files would stop the computers from

communicating. Once MfgCompany had purchased and installed Enhanced

Software, it added a feature called Enhanced Software" to the main

program. The two deleted configuration files that were deleted were

part of this added feature. Albert stated less than (Small) percent of

SoftwareCo's customers use this feature. He learned this from dealing

with SoftwareCo.

In the third action, the intruder moved to the "ftp" (file transfer

protocol) file in the ZY Computer 4 Operating System of the computer

Pacific. In this "ftp" file the intruder changed a small "i" to a

capital "I" in a directory name in a path in the script which caused the

path to become invalid and not function properly. This change of case on

the "i" in "mis" was made globally in this script and thus modified

approximately 30 paths. This in turn affected 30 files which prohibited

data from being send to Unix computers on the network. MfgCompany had

purchased this "ftp" feature separately and Ray Suspect had installed

it. The "ftp" feature is used by the ZY Computer 4's to automatically

transfer certain files that are listed in a script, to Unix computers on

MfgCompany's ethernet network. This transfer is completed by the

computer referring to a path (the hierarchy of files/directories that

lead to a given file) in the script of directions and then copying the

specified file to the location designated in the path. Since Unix

computers are sensitive to capital and lower case letters, every letter

in the path has to be of the same case as it listed in root (main)

directory of the Unix computer where it is located. If any one letter

is of a different case the computer will not make the transfer of the

copy. MfgCompany employees then use the data on the Unix computers for

business. This failure signaled the corporation that there has been a

failure in the Information Systems. Ray Suspect created this ftp script

for MfgCompany when it was set up and them maintained it.

In the fourth action, the intruder voided passwords on the ZY

Computer 4 computer named Pacific by causing the password expiration

program to expire several hours later on Monday May 13, 1994, at 0001

hours. Thus when MfgCompany employees tried to logon on Monday morning

they could not use the computer system as all of the passwords had

became invalid.

The intrusion was made through the account of Employee4. Network

system log's indicated that Employee4's password was used to make the

connection. The passwords for the network were not changed after

Suspect left MfgCompany. While at MfgCompany, Suspect had authorization

to review and copy the password file as he was one of three system

administrators with "root" privileges.

Only two people in the company, Employee2 and JoeSuspect, had the

total level of knowledge to complete the above actions. Employee2 is

the senior applications engineer in Information Systems. Albert said

that Employee2 and Suspect did not work together and were only speaking

acquaintances. Employee2 was on a canoeing trip on June 12, 1994, and

it was Albert's belief that this trip was out of State.

On July 26, 1994, MfgCompany discovered that its computer network

had again been illegal accessed and files erased. This came to

MfgCompany's attention because production schedules stopped working on

the ZY Computer 4 as a result of database files having been erased. No

other modifications. This intrusion took 8 minutes. On this occasion

both Pacific and Baltic ZY Computer 4s had files erased. This

intrusion was possible as security for whole system went down on July

26, 1994, as a result of a hardware upgrade.

On Friday, 8-12-94, I spoke with Jonathon A. and Robert Burns,

Private Investigators. Burns told me that he works for A. and was

checking the trash of Suspect. Burns said that on 8-12-94, at about

12:30 a.m., he checked the trash of JoeSuspect, 1111 Rd., The trash

was located in a trash can next to the street for collection. There are

no sidewalks or curbs in this area. In the trash he found piece of

yellow lined paper approximate 3 X 5 inches. The paper had the

following numbers written on it:

123-1111

1112

1113

1114

444-5555

During a conference call between Alan Albert, A., and myself, as A.

read the numbers, Albert told us the 123 numbers connect to a modem pool

in the computer room of the Information Service's office in Community

where the ZY Computer 4 computers are maintained. This modem pool

allows a connection to MfgCompany's ethernet/local network in Community.

Information services uses this modem pool as a connection to

MfgCompany's network when they need to check the system. Albert went on

to say that the 444-5555 telephone number is a San Jose telephone number

that serves as a connection point to MfgCompany's world wide X.25

network. A. faxed me a copy of the paper with numbers.

Your affiant seeks permission to bring MfgCompany employee Alan

Albert and Jonathon A., private investigator under contract to

MfgCompany, along on the search to assist with the identification of the

files. Albert will be under the direct supervision and control of your

affiant or another peace officer assisting your affiant in the service

of this warrant.

Your affiant is aware that such a procedure was approved in People

v. Superior Court (Moore) (1980) 104 Cal. App. 3d 1001. Albert will be

closely supervised by members of the District Attorney's office staff or

other law enforcement officers.

Computers:

Your affiant requests permission to search and seize any computer

systems and magnetic media found at the scene.

Your affiant knows from his training and experience that computer

systems commonly consist of central processing units (CPUs), hard disks,

hard disk drives, floppy disk drives, tape drives, display screens,

keyboards, printers, modems (used to communicate with other computers),

electronic cables, cassette tapes, floppy disks, and other forms of

magnetic media containing computer information.

Your affiant knows from his training and experience that computer

users will commonly keep computer hardware and software in their homes,

garages, carports, outbuildings, storage areas and sheds assigned to

their premises.

Your affiant requests permission to seize computer systems and

magnetic media found at the scene without first conducting an

examination of each and every hard and floppy disk to determine if such

systems and media contain the items requested by this affidavit.

Computer users frequently collect a great deal of software on disks or

other magnetic media. Searching that media within a reasonable amount

of time to determine which material is relevant to this investigation

would be difficult and could risk destruction of the evidence.

Your affiant may also need to examine at another location any

computer(s) found at the scene because most hard disks contain so much

data that an on-site inspection is impractical. The examination

required to determine whether the hard disk contains the items requested

by this affidavit could take days or weeks. Furthermore there may be

too many tapes and or disks to allow a thorough search of such disks

within a reasonable period.

Finally, the computer and magnetic media is the best evidence

available. Magnetic media is easily erased or destroyed. Leaving

magnetic media behind may result in the loss of that magnetic media as

evidence. Your affiant believes that it is better to seize the original

evidence than to rely solely on copies which have not been authenticated

in the presence of counsel for persons who could face criminal charges

based on material found pursuant to this warrant.

Your affiant also seeks to seize documentation associated with the

computer(s) found at the scene. Your affiant may need that

documentation to search the computer. Moreover, that documentation may

well contain information identifying the owner and/or user of that

computer.

Occupancy:

Based on your affiant's training and experience, your affiant knows

that occupants of dwellings usually receive correspondence addressed to

the occupants at that particular dwelling. Such correspondence usually

includes, but is not limited to, phone bills, utility bills, rental

agreements, rent receipts, identification papers, canceled mail

envelopes, and personal letters. Additionally, your affiant knows that

other evidence of ownership and control of said dwellings can usually be

found on the occupants of said dwellings and may include, but is not

limited to, keys, rent receipts and photographic identification

documents, with names and addresses on them. Your affiant seeks

permission to seize those items.

Based on these facts, you affiant is of the opinion that it is

probable that Suspect has committed violations of Penal Code Section

502c(2), the violation of which is punishable by terms of imprisonment

of longer than one year.

WHEREFORE your affiant prays that a search warrant be issued with

respect to the above locations for the seizure of said property at any

time of the day and that the same be held under Penal Code section 1536

and disposed of according to law.

___________________________

JOHN C. SMITH, Investigator

District Attorney's Office

Santa Clara County

Subscribed and sworn to before me

this 16th day of August 1994.

___________________________

Judge of the Superior Court

This affidavit was used to get into the residence

and personal computers

of a part time university employee who broke an other employees account

and used that account.

SUPERIOR COURT OF CALIFORNIA

SANTA CLARA COUNTY JUDICIAL DISTRICT

STATE OF CALIFORNIA AFFIDAVIT IN SUPPORT

COUNTY OF SANTA CLARA OF SEARCH WARRANT

JOHN C. SMITH, Sr. Criminal Investigator, Santa Clara County

District Attorney's Office being sworn, says that on the basis of the

information contained within this Affidavit and any attachments thereto,

he has probable cause to believe and does believe that the property

described below is lawfully seizable pursuant to Penal Code Section

1524, as indicated below, in that it:

( ) was stolen or embezzled;

(X) was used as the means of committing a felony;

( ) is possessed by a person with the intent to use same as a means of

committing a public offense, or in the possession of another to

whom he/she may have delivered same for the purpose of concealing

or preventing its discovery;

(X) constitutes evidence tending to show that a felony has been

committed or that a particular person has committed a felony;

and that he has probable cause to believe and does believe that the

described property is now located at, and will be found at, the

location(s) set forth below and thus requests a warrant to search

THE FOLLOWING FOUR (4) LOCATION(S):

LOCATION A:

1. The three (3) electronic mail accounts, including the information

from these accounts on the system backup tapes, belonging to Joe

Suspect: #1 suspect@rome.univ.ede (Unix System);

#2 suspect@univvm1.univuniv.edu (IBM system); and

#3 guard@univvm1.univ.edu (IBM system). These accounts are on

computers maintained and housed in the Information Systems and

Communications Department, University, Information Systems and

Communications("ISC") Department, California.

AND

2. The desk and work space of Joe Suspect at the Computer Information

Center, Information Systems & Computing Department,

FOR THE FOLLOWING PROPERTY:

1. Any and all documents and records, whether on paper or stored on

magnetic media (including information stored within a computer)

that contain any of the network electronic mail addresses,

hertz@Rome.Univ.Edu, jeanc@college-ca.edu (Jean Clinton), or

carol@college-ca.edu.

2. Any and all documents and records, whether on paper or stored on

magnetic media which contain the code or computer instructions that

are used for the automatic transfer of information or email from

one account to another and directing the transfer of email to or

from supect2nd@rome, hertz@rome, jeanc@college-ca, or

carol@college-ca

3. Any and all programs or computer instructions that would be used

for the cracking, matching, or discovering encrypted passwords for

computer accounts.

4. Any and all documents and records, whether on paper or stored on

magnetic media which contain the code or computer instructions that

create or operate a computer program commonly known as a "TROJAN

HORSE", a shell or program that purports to have a valid purpose,

but contains hidden in its code instructions that start another job

such as automatically capturing a user's log-on identification and

password and sends it to another location.

LOCATION B:

SUSPECT'S Apartment B, Drive, in the City of _________. This

residence is a duplex type residence, that is painted gray and has a

detached open carport. The residence is on the south side of Drive

between Streets. There are two street address number plaques attached

to the front of the house. The plaque with 732B is nearest the corner

of the west side, where there is a door that appears to be the front

door for Apartment B. The premises to be searched also include any and

all yards, outbuildings, storage areas, garages, carports, sheds, or

mailboxes assigned to the described premises, including but not limited

to those listed above.

LOCATION C:

The person of Joe Suspect and any personal affects such as but not

limited to books, binders, backpacks, or briefcases where papers or

computer disks may be carried.

LOCATION D:

A gray, Ford, bearing California license ________ registered to Joe

Suspect City of __________, wherever it maybe located in the County of

Santa Clara.

STATEMENT OF PROBABLE CAUSE

Your affiant declares that the facts in support of issuance of this

search warrant and court order are as follows:

Your affiant, John C. Smith, is a Senior Criminal Investigator

(Peace Officer) employed by the Santa Clara County District Attorney's

Office in Santa Clara County, California. Your affiant has been

assigned to the High Technology Unit of that office since December 1989.

He has been a California Peace Officer since June 1965. He is a member

and past President of the High Technology Crime Prevention Association

(HTCIA), and a member of the Santa Clara Valley Industrial Security

Managers Association. He has been a Macintosh computer user since

about 1986 and an IBM PC user since 1990 and owns both types of

computers. He is a regular user of the Internet and has had classes on

the Unix/Workstation operating environment. He has over 274 hours of

training in the High Technology field. He has been involved in at least

five (5) prior intrusion type cases and given several talks to computer

professionals on investigating intrusions. He has conversed and worked

with experts in federal law enforcement who have specialized in these

cases, and who have considerable experience in investigating and

interacting with persons who have illegally accessed computers.

Your affiant is currently investigating violations of Penal Code

Sections 502 (Unlawful Access to Computer Systems).

Your affiant knows from training and experience that individuals

who "hack" or access computers without authorization often do so from

their own computer systems and maintain cracking or password matching

programs which may include dictionary or word lists.

Your affiant knows that persons who hack computers services by

fraudulent means maintain notes and ledgers which document the accesses

that are valid, passwords which have been used or tried, and their

written notes on how to bypass systems security measures installed.

They also make notes of what systems are accessed, what files were down

loaded or uploaded and who else they have been in contact with regarding

the access codes being used.

Your affiant knows from training and experience that persons who

have passwords on their computer system usually maintain a record of

that password on a piece of paper, card, book, etc. so that it may be

retrieved in case the persons fails to recall a password. Your affiant

knows the above information may be in the form of hard copy printouts,

paper notes, notes in a ledger, or files maintained on a computer system

itself in the form of electronic media.

Your affiant knows from training and experience that a computer

system used to communicate with other systems via modem and the

telephone lines will be attached to a modem and a phone line that is

installed in the residence.

On May 10, 1994, your affiant was contacted by Detective

_______, University Police Department, and provided with police reports

for case number 94- alleging a violation of California Penal Code

Section 502, Computer Crime. Affiant opened SSCCDA case #94-0-0661.

Your affiant interviewed Dept Head, Associate Vice President, in charge

of the Information Systems and Computing (ISC) Department at AnyCity

State University (Univ); Bill Sysop, Staff Systems Software Specialist,

ISC, ; and Timothy J. Sysadmin, Network Systems Programmer, ISC. To the

best of your affiant's knowledge, these three individuals are reliable

and trustworthy citizens without involvement in criminal activity.

The following chronology of events prepared by your affiant after

reading the police reports and interviewing the three individuals named

above, was prepared for convenient review:

CHRONOLOGY OF EVENTS:

3-21-94 to 4-1-94 - Joe Suspect and Jason Student workers are suspended

from the jobs at the Computer Information Center (CIC), ISC, Univ and

are told not to use their network accounts for two weeks for verbally

fighting and arguing via their electronic mail accounts on Univ's system

and on America Online, a commercial system.

3-21-94 - A message is sent from "Patricia Hertz" to ten people, "From:

Suspect!", stating that he had been suspended and to send any email to

hertz@.univ.edu.

4-12-94 - The email message to "Hello John", attached as Exhibit #1,

accusing systems operators Sam Sysadmin and another employee of

maintaining pornographic GIFs (graphic or photographic computer files)

on the university system was sent to the mailing list on another system

maintained by Univ

4-14-94 - Univ President Ferris receives an email message from

jeanc@college-ca.edu (St Mary's College) regarding Univ computer

administrators holding pornographic pictures on the Univ system,

attached as Exhibit #2.

4-15-94 - Dept Head assigns Bill Sysop to investigate this matter.

4-15-94 - Bill Sysop learns that there is no issued account to "Patricia

Hertz", but he knows a Professor Hertz and contacts him. Professor

Hertz states he was issued the account but does not use it.

- Bill Sysop checks logs on the IBM computer network and finds that

(a) the message, Exhibit #2, sent to Univ President Evens was received

from jeanc@college-ca.edu on 4/14/94, at 17:49:14 hrs and that (b)

suspect@univvm1.univ.edu sent a message to jeanc@college-ca.edu at

4/14/94 17:39:02 hrs, Exhibit #9.

4-27-94 - Univ Police report 94-117-0705 was taken by Officer Laws. The

suspect named was Joe Suspect.

- Sysadmin examines data in the broken "hertz account" obtained

from the backup tapes of April 11, 1994, and observes a ".forward" file

used by the Unix mail system to forward mail to another computer. The

forwarding address listed was supect2nd@.univ.edu, Exhibit #11.

5-4-94 Front page article appears in Univ newspaper written by

regarding pornography on the Univ computer system.

*

On 5-11-94 your affiant began his investigation by talking with

Dept Head at his office at Univ. Dept Head related the following

information:

In March 1994, Suspect and another student, Jason Student , were

verbally fighting and arguing. This disagreement spilled into

electronic mail. American OnLine sent a message to Supervisor and Bill

in the Computing Information Center, the supervisor of Suspect and

Student , asking if something could be done to stop the bickering.

Suspect and Student were then suspended from their jobs for two weeks

by the Director of Information Services (a division of the ISC) after he

investigated and concluded that they have behaved inappropriately.

Supervisor also told Suspect and Student not to use their computer

network accounts during their suspension.

The suspension was from March 21, 1994 to April 1, 1994.

Sometime during this two weeks, Dept Head suspects that Joe Suspect

hacked into the "hertz account". The "hertz account" belongs to Univ

Professor Hertz who was assigned the account 2 yrs ago and has never

used it. The Identifier that is printed when electronic mail is sent

from the hertz account was changed from Professor to Patricia.

On 5-11-94 and 5-12-94, your affiant interviewed Bill Sysop, Staff

Systems Software Specialist, Technical Services, Information System &

Computing Department, Univ, at the ISC. Sysop provide affiant with the

following information:

The Information Systems and Computing Department (ISC) is assigned

the task of providing general academic and computing services and

Administrative services to the University. Administrative services

include student scheduling, records, grades, and other student

information as well as purchasing, and assorted administrative

functions. The campus has an IP (Internet Protocol) type network that

has both Unix and IBM computers attached to it.The Unix system was

installed three years ago. ISC has an Internet connection.

Sysop was assigned to investigate this matter by Dept Head after

Ferris, the President of Univ, received an email message from a Jean

Clinton, St Mary's College, dated 14 Apr 94, 17:49:13 PDT, stating in

relevant part, "your university computer administrators are using the

system as a holding area for pornographic pictures." A copy of the

messages is attached as Exhibit #2.

Sysop began his investigation by trying to find "Patricia Hertz".

He asked the CIC (Computer Information Center) and learned there was no

record of "Patricia Hertz". Sysop had worked with Professor Hertz,

Univ, on prior occasions. Thinking it might be Patrick rather than

Professor, Sysop phoned Professor Hertz, on April 15, 1994. Professor

Hertz told Sysop that he did have a Unix account but, that he did not

use it. Professor Hertz told Sysop that he recalled being told that he

needed a UNIX account to receive email and so about 2 years ago he

signed up with Univ and was given a Unix account that was named hertz.

He did not use the Unix account because he found he could use email

facilities directly through the Unix Workstation he has on his desk.

On Friday April 15, 1994, Bill Sysop examined the SMTP (Mail

Transfer) log for April 14, 94, on the Univ IBM computer system,

attached as Exhibit #9. He did this because Ferris's email account is

on the IBM system. Sysop checked the log for the time that Ferris had

received Exhibit #2 Jean Clinton. Sysop then looked through the log and

found that on 4/14/94, 17:39:02 hours, ten minutes before Exhibit #2 was

sent, Suspect had been connected to jeanc@college-ca.edu. Your affiant

has obtained a list of log-ins to the jeanc@college-ca account and

verified this information. One of the log-ins was from 17:55 to 18:06

hours. The message to President Ferris from jeanc@college-ca was

received at Univ at 18:05 hours.

Sysop knows Joe Suspect to be a paid Student Assistant at CIC,

Computing Information Center, a division of ISC. CIC is assigned the

task of providing with computer support to the academic computing

community at Univ and to provide assistance to administrative computer

users. Suspects' supervisor is -------- who reports to __Director of

CIC. Sysop believes Suspect has worked there for about 2 years.

On May 12, 1994, your affiant interviewed Bill J. Sysadmin, Network

Systems Programmer, ISC, at the computer center. Sysadmin maintains the

Unix network. Sysadmin related the following information to your

affiant:

The hertz account resides on a computer server called "" which is

the primary Unix server at Univ. Sysadmin made the printout labeled

"Apr 17 23:27 1994 hertz.last Page 1.", attached as Exhibit #10. This

printout, Exhibit #10, is a list of connections to the hertz account and

shows that someone was connecting to the hertz account on from a

terminal server that houses the public modem pool. The entry, "isc-

ts1.Univ.EDU", on the log indicates that the connection to hertz was

most likely made through a dial-in telephone modem hooked to the

terminal server.

The original message "Hello John" was sent to 1.BITNET, which

distributed the message to a number of systems users. This message is

attached as Exhibit #1. At that time there were 30 faculty members and

students from the Univ campus on the mailing list to receive messages

sent to the UnivSER account on UnivSER on the IBM system. This account

serves as a general computer information source for asking questions and

disseminating information regarding the computer system.

After seeing the message to President Ferris (Exhibit #2),

Sysadmin opined that the hertz account had been broken into. His

opinion was based on a number of factors. He recognized that the hertz

account had a low user id number (meaning that it was an older account)

and the wording of the message in Exhibit #1 caused him to infer the

sender was a new user also, the sender described him or herself as a

student. Finally, faculty and staff are in one file system and students

in another. The hertz account was a faculty account.

Sysadmin made a "last" print out that shows where the user logged

in from and the date & time. A "last log" shows the account where the

connection was made, the name of the computer or device where the

connection came from, the date, the time, and the duration of the

connection. On this "last log" printout Exhibit # 10, the log shows log-

ins from College and a log-in from the Univ CIC, which is in the

form of a network numerical address, IP address 130.65.55.26. This

number shows up on the log since the computer at that location has not

been given a name.

Sysadmin went to the backup tapes from April 11, 1994, for the

server on the Unix system and recovered the home directory from the

hertz account onto his (Sysadmin's) workstation. Sysadmin printed the

stored mail messages recovered from the backup tape in the hertz account

and gave your affiant the 56 pages that he printed. What appears to be

the first message from the hertz account is attached as Exhibit #3.

That message reads as follows:

Date: Mon, 21 Mar 1994 15:11:36

From: Patricia Hertz <hertz@.Univ.EDU>

Subject: From Suspect!

To: people <bart@>, (list of his friend'e email addresses)

"Hello everybody,

I'm sure you're wondering why I'm not using my account to mail this

to all of you, well the reason is I got suspended for two weeks

from work. Actually it was me and Jason "May I sniff your

buttcheeks?" Student that got suspended. It's a very long story,

but suffice to say I got screwed royally on this one and as such,

it is only right that I screw back. Student is toast.

I'm not too sure how much mail is going to pile up on my system in

14 days, but let's do the simple math: I get about 45 pieces of

mail a day on EACH of my accounts, and I have three, count 'em

three, accounts. Let's see 45 times 14 times 3. Shit. 1890

pieces of mail. I think I'll forward all of it to Jason "I'm, the

Weenie Genie" Student . Anyway, if for any reason you need to get

a hold of me via e-mail, please use hertz@.univ.edu.

I'll send you all the gory details later.

-Suspect"

Another message that Sysadmin found in the hertz account deals with

Trojan Horses, attached as Exhibit #4. This message is addressed as

follows:

Date: Tue, 22 Mar 1994 15:29:44 PST

From: fly <cartert@.com>

To: hertz@.univ.edu

Subject: The Trojan Horse (For Suspect)

In this message, a "Trojan Horse Program" is discussed. Dfly

states, "Here's what the code *might*(sic) look like", and describes

what the code would be. Also in this message is a description of a

Trojan Horse, which is a fake shell. That paragraph is as follows:

When a user attempts to login on the Trojan Horse their login name

and password are mailed to a specific user (defined in the code).

The process then terminates and the user is left with the *REAL*

login prompt. You now have a password and login for a specific

user, in other words you have full access to their account.

How this happens is defined here:

When Sysadmin looked at the data in the broken hertz account, which

obtained from the backup tapes of April 11, 1994, he observed a

".forward" filed used by the Unix mail system to forward mail to another

computer. The forwarding address listed was supect2nd@.univ.edu. The

file listing shows that the .forward file was last modified on April 6.

On May 19, 1994, Sysadmin printed a copy of the .forward file from the

hertz April 11 backup and gave it to your affiant. As indicated this

printout is attached as Exhibit #11.

Sysadmin told your affiant that he called the network system

administrator at College, College Sysadmin, and advised College

Sysadmin that someone seemed to have broken into (the name of the

primary Unix server for the .univ.edu system) from College's Network.

Subsequently, College Sysadmin told Sysadmin that the "jeanc" and

"carol" accounts had been broken into. College Sysadmin sent Sysadmin

a list of log-ins to the computer "galileo" at St Mary's where the jeanc

and carol accounts are located, (Exhibit #6). Roy College Sysadmin in

his message of April 26, 1994, (Exhibit #6) states:

The owner of the carol, account found that someone has tampered

with her account. The user hertz@.univ.edu re-routed her e-mail

using a .forward file. This has gone on about 2 weeks. She is

understandably very upset and has lost some very important

messages."

On May 15, 1994, your affiant attempted to contact College Sysadmin

and learned that he is out of town for several days. Affiant spoke on

the telephone with College's 2nd Sysop, Ph.D., Computer Science,

College, California, who also serves as a systems administrator with

College Sysadmin. Dr. College's 2nd Sysop said he was familiar with the

situation with Univ. Dr. College's 2nd Sysop told affiant that Carol is

a teacher at College. Mrs. Carol was using her child's name as a

password; the password thus would have been on a standard word list or

dictionary used by a cracker or password matching program.

Sysadmin made printouts from the "last" log for both accounts

"hertz" and "suspect" from the Unix workstation named "homerun", which

uses as a server. The printout for the supect2nd account is attached

as Exhibit #7 and the printout for hertz account is attached as Exhibit

#8. Sysadmin found log entries on March 17 between 16:34 hours and

18:15 hours which appear to indicate that someone logged out of the

supect2nd account and immediately into the hertz account. The following

are entries of log-in and log out time from the "last" logs if the two

accounts:

supect2nd Mar 17 16:43 - 16:40

hertz Mar 17 16:40 - 16:52

supect2nd Mar 17 16:52 - 18:07

supect2nd Mar 17 18:07 - 18:09

hertz Mar 17 18:09 - 18:15

On May 19, 1994, your affiant talked with Bill Sysop and Sam

Sysadmin at their office. They both informed affiant that it would be

highly unusual for Joe Suspect to have his supect2nd account broken into

without Suspect not being ware of it and for cortes not to make a

report. Suspect' "vigil" account was set up to subscribe to various

mailing lists dealing specifically with network security. Suspect is

supposed to review any material that is received and distribute any

relevant material to CIC employees. Sysadmin has never received any

complaints from Suspect about problems with the cortes account being

compromised. Sysop told affiant that when he interviewed Suspect, he

asked Suspect if he was having any problems with his (Suspect) IBM

accounts. Suspect said he was not having any problems with his

accounts.

On April 19, 1994, Sysadmin said he copied the contents of the

supect2nd@ account from the backup tapes into his (Sysadmin's),

workstation. Sysadmin also said that he had not looked at or examined

the contents of that account until the legality of such examination can

be determined.

Your affiant seeks permission to bring Bill Sysop and Sam Sysadmin

along on the search to the four locations to assist with identifying the

computer programs described in this affidavit that are to be searched

and seized, and to them operate the Univ computer system to search for

the items listed in the Search Warrant. Sysop and Sysadmin will be

acting under the direct supervision and control of your affiant or

another peace officer assisting your affiant in the service of this

warrant. Your affiant is aware that such a procedure was approved in

People v. Superior Court (Moore) (1980) 104 Cal. App. 3d 1001.

Residence Information:

Joe Suspect told Officer Laws of the AnyCity State University

Police Department that his home address is 732 E. Taylor Street,

AnyCity, California. Dept Head checked Payroll records and found that

Suspect' address is listed as 732. E. Taylor Street, Apartment 2,

AnyCity, California. Dept Head has also seen a business card for a

business maintained by Joe Suspect that listed an address of _______.

Your affiant checked the California Department of Motor Vehicle

records for the drivers license information on Joe Suspect based on the

date of birth, 11-18-66, and drivers license number, C1111111, on the

police report and found that Joe Suspect Jr has a valid California

Drivers License that expires on his birthday in 1987. This record

states that his residence address is ______

California DMV records checked by affiant also show that Joe

Suspect Jr., ___ the registered owner of a Ford, license number Affiant

drove by the residence and saw a gray Ford California license number

XXXin the carport of ___

Computers:

Your affiant requests permission to search and seize any computer

systems and magnetic media found at the scene.

Your affiant knows from his training and experience that computer

systems commonly consist of central processing units (CPUs), hard disks,

hard disk drives, floppy disk drives, tape drives, display screens,

keyboards, printers, modems (used to communicate with other computers),

electronic cables, cassette tapes, floppy disks, and other forms of

magnetic media containing computer information.

Your affiant knows from his training and experience that such

computers and magnetic media are used to store information. Your

affiant believes that, based on the information related above, that

computers and magnetic media located at the place to be searched contain

telephone numbers, access codes and the software necessary to access

such computer codes.

Your affiant knows from his training and experience that computer

users will commonly keep computer hardware and software in their homes,

garages, cars, carports, outbuildings, storage areas and sheds assigned

to their premises.

Your affiant requests permission to seize computer systems and

magnetic media found at the scene without first conducting a detailed

examination of each and every hard and floppy disk to determine if such

systems and media contain the items requested by this affidavit.

Computer users frequently collect a great deal of software on disks or

other magnetic media. Searching that media within a reasonable amount

of time to determine which material is relevant to this investigation

would be difficult and could risk destruction of the evidence.

Your affiant may also need to examine at another location any

computer(s) found at the scene because most hard disks contain so much

data that an on-site inspection is impractical. The examination

required to determine whether the hard disk contains the items requested

by this affidavit could take days or weeks. Furthermore there may be

too many tapes and or disks to allow a thorough search of s uch disks

within a reasonable time.

Finally, the computer and magnetic media is the best evidence

available. Magnetic media is easily erased or destroyed. Leaving

magnetic media behind may result in the loss of that magnetic media as

evidence. Your affiant believes that it is better to seize the original

evidence than to rely solely on copies which have not been authenticated

in the presence of counsel for persons who could face criminal charges

based on material found pursuant to this warrant.

Your affiant also seeks to seize documentation associated with the

computer(s) found at the scene. Your affiant may need that

documentation to search the computer. Moreover, that documentation may

well contain information identifying the owner and/or user of that

computer.

Occupancy:

Based on your affiant's training and experience, your affiant knows

that occupants of dwellings usually receive correspondence addressed to

the occupants at that particular dwelling. Such correspondence usually

includes, but is not limited to, phone bills, utility bills, rental

agreements, rent receipts, identification papers, canceled mail

envelopes, and personal letters. Additionally, your affiant knows that

other evidence of ownership and control of said dwellings can usually be

found on the occupants of said dwellings and may include, but is not

limited to, keys, rent receipts and photographic identification

documents, with names and addresses on them. Your affiant seeks

permission to seize those items.

Your affiant will not intercept electronic mail or examine

electronic mail that has not been read and stored. To the best

knowledge of your affiant, this Affidavit and Search Warrant complies

with the requirements of Section 2703, of Title 18 United States Code

dealing with the disclosure of by a provider of electronic

communications services of the contents of an electronic communication

that is in electronic storage.

On the basis of the foregoing, your affiant believes that evidence

of the commission of felony violations of California Penal Code section

502 will be found upon the premises and in the records heretofore

described.

That based upon the above facts, your affiant prays that a search

warrant be issued with respect to the above location for the seizure of

said property, and that the same be held under Penal Code section 1536

and disposed of according to law.

___________________________

AFFIANT John C. Smith

Criminal Investigator

Subscribed and sworn to before me

this 23rd day of January 1994.

___________________________

JUDGE OF THE SUPERIOR COURT

Exhibits:

1 Message "Hello John", from Patricia Hertz, April 14, 94.

2. Message to ferris@univ from jeanc@college-ca, April 14, 94.

3. Message from Patricia Hertz, Subj: From Suspect, March 21, 94, with

Suspect explaining why he is using this account.

4. Message from fly <carter@.com>, to hertz@univ, Subj: THE TROJAN

HORSE (for Suspect). March 22, 94.

5. Dept Head's report/chronology of this event. April 20, 94.

6. Message from Systemop@college-ca.edu, To: Sysadmin@isc.univ, Subj:

last list. April 20, 94.

7. "last" log from supect2nd (Unix) account showing activity on 3-17-

94.

8. "last" log from hertz (Unix) account showing activity on 3-17-94.

9. SMTP, mail log, from IBM network showing message to jeanc@college-

ca on April 14. 94.

10. hertz@.univ "last" log showing connections and dates, this includes

modem connections.

11. Copy of the ".forward" file from the hertz@ account on the April

11 backup tape.

This is a request for tracing a long distance call

GEORGE W. KENNEDY

DISTRICT ATTORNEY

FRANK D. BERRY JR.

DEPUTY DISTRICT ATTORNEY

70 West Hedding Street

San Jose, California 95110

Attorneys for PEOPLE of the State of California

SUPERIOR COURT OF CALIFORNIA, COUNTY OF SANTA CLARA

In re Order authorizing

"trap and trace" device.

)

)

)

)

)

)

)

)

NO.

APPLICATION FOR ORDER

AUTHORIZING "TRAP AND TRACE"

DEVICE AND NUMBER SEARCH [18

USC _3123]Personally appeared before me this 20th day of January 1994,

Investigator John C. Smith who requests an order authorizing the

installation of a "trap and trace" device and number search and on oath,

deposes and says that there is just, probable, and reasonable cause to

believe, and that he does believe, that the telephone number(s) from

which incoming calls are to be trapped/number searched and identified

are being used in connection with criminal activity and that the

information likely to be obtained by such installation and use is

relevant to an ongoing criminal investigation.

Your affiant is requesting that this Court authorize a "trap and

trace" device by Pacific Bell, the American Telegraph and Telephone

Company, and any other provider of electronic or wire communication

service for the following telephone numbers: (408) 999-1111 and (408)

999-1112.

Affiant is seeking to determine the origin of all telephone calls

made to the aforesaid telephone numbers as well as records showing the

date, time, and length of call, together with the area code, telephone

number, subscriber identification information (including name and

address), and location of the calling telephone device.

STATEMENT OF PROBABLE CAUSE

Your affiant declares that the facts in support of issuance of this

court order are as follows:

Your affiant, John C. Smith, is a Criminal Investigator (Peace

Officer) employed by the Santa Clara County District Attorney's Office

in Santa Clara County, California. Your affiant has been assigned to

the High Technology Unit of that office since December 1989. He has

been a California Peace Officer since June 1965. He is a member and past

President of the High Technology Crime Prevention Association (HTCIA),

and the Santa Clara Valley Industrial Security Managers Association. He

has been a Macintosh computer user since about 1986 and an IBM PC user

since 1990 and owns both types of computers. He is a regular user of

the Internet and has had classes on the Unix/Workstation operating

environment. He has over 274 hours of training in the High Technology

field. He has worked at least five (5) prior intrusion type cases and

given several talks to computer professionals on investigating

intrusions. He has conversed with experts in federal law enforcement who

have specialized in these cases, and who have considerable experience in

investigating and interacting with persons who have illegally accessed

computers.

Your affiant was contacted by Frank L. Edwards, Brand

Incorportated, Security Services Department, Street, FarState. on

January 19, 1994. Your affiant knows Brand Systems to be a company which

creates and sells software which enables users to create and maintain

Mr. Edwards told affiant that the Brand corporate network had been

penetrated by an unauthorized intruder who had then gained superuser

status on numerous Brand computer systems, reviewed proprietary data and

transferred copies of proprietary data to a computer outside the Brand

network. Your affiant started his investigation case #94-0-0109, on

January 19, 1994 by interviewing Brand employees Frank Edwards; Davis

Investigator; Employee2, Investigative Technician; and Employee3,

Network Security Manager for Security Services. These interviews were

conducted by telephone.

Employee 3 has a Degree in Electrical from College. He has worked

in the computer industry since 1979. Employee3 has been working in

security at Brand for about 15 months. Employee2 started with Brand

about 1986. He became a Brand Engineer about 1989, and has held several

jobs of a technical nature. The last four years he has worked as an

Investigative Technician for Brand Security. Frank L. Edwards spent 7

years with the FBI, 2 1/2 years with FarState xxxx Department and four

years with Brand as Manager of Investigations.

The information in this affidavit was furnished to affiant by these

Brand investigators and Michael Houser, a Brand Manager. Your Affiant

has worked with Brand Security on previous occasions, and knows the

personnel to be experienced and reliable. A report in Memo form from

Scott Employee3 is attached as Exhibit A. To the best of your affiant's

knowledge, these Brand employees are reliable and trustworthy citizens

without involvement in criminal activity.

Brand's internal corporate network is designed to link Brand

facilities with electronic mail, transfers of data and source code, and

phone system messaging. Brand Security personnel describe it as one of

the largest in the world. The network links facilities such as the major

products research & development sites at Texas; FarState; San Jose, Ca.;

Ca.; sites in the United Kingdom, smaller development sites, (which do

not do major product development), and Brand sales offices. There are

over 40 connections on the network worldwide.

Your affiant was informed by these Brand Security investigators

that the problem with the network intruder first came to Brand's

attention, on December 20, 1993, when an unkown individual called a

Brand employee posing as a Novel engineer named John Cash. The person

posing as Cash asked the Brand employee for his password to a Brand

computer file server, a 486 Personal Computer named "Money", located at

the Engineering Department in FarState. The computer file server named

Money contains source for Brand Software, has ever developed. The

engineer provided the person his password. This password enabled the

intruder to log into the file server, Money.

Employee 4 one of the administrators for the file server named

Money, checked the internal logs of Money, and found that someone had

tried to log in as John Cash through the Brand network computer located

at the Brand facility at View, FarState. Further investigation indicated

that the intruder had teleneted into View, FarState from an unknown

location. (Your affiant knows teleneting to be the method where a user

connects to a remote computer via his own computer and directs the

remote computer to perform various functions.) Once the intrusion had

been verified, Brand started searching intrusion logs on the Money file

server to ascertain who had attempted to log onto the computer.

Security and administrators then called the employees whose names and

accounts had been used by the intruder in attempt to gain access to the

file server.

Some employees on that list contacted the administrators and

informed them that they had been contacted by a telephone caller who

attempted to persuade them to divulge their passwords. Security

contacted some of the employees who said that the caller identified

himself as `Doug Smith' from Brand. `Smith' told them he was working

the on Money file server and needed their password to make corrections.

Affiant knows this to be a method used by network intruders to

fraudulently obtain passwords. Security then warned employees not to

give out passwords on the telephone, but employee interviews revealed

that intruder was still able to obtain more passwords.

Employee3, working with Michael Houser, Brand Development Systems

Manager and Employee6 Brand Sr. Service Engineer also found several

"Trojan Horses" on the entire Brand network. A Trojan Horse refers to

program covertly placed in a computer system to perform a function not

authorized by the system administrator or owner. This Trojan Horse

system was designed to capture passwords and then allow retrieval by the

intruder. Numerous passwords were captured but only 2 could be used

without having to contact their owner. The owners of these two

passwords were using the same passwords on the Brand Unix system as well

as the Brand System, which runs on DOS systems. Money is on the system

and these two passwords allowed the intruder access to Money. Logs of

activity on Money, which were provided by one of three system

administrators, Jason Johnson, are attached as Exhibit B.

Using the passwords gained through contacting the employees and

from the trojan horses, the intruder was connecting to various computers

on the Brand corporate network, teleneting from machine to machine.

On or about December 28, 1993, a male individual telephoned

Employee 8the Program Manager in the Brand Software Engineering

Department, FarState, for Brand utility source code. The man identified

himself as a Brand employee named Richard Hoover and requested employee8

place a copy of Brand Source Code on the file server "Flower" into an

account called "Richard" with the password being "Richard1". employee8

complied with the request.

On January 4, 1994, at 6:18 pm a male phoned Brand Information

Services Desk, San Jose, California, and left a message on voice mail,

for employee9, the system administrator, directing him to set up a modem

access account for Richard Hoover with the password "goose". This

caller had also previously talked to employee9. This account was

established on January 5, 1994. The modem access accounts from this

facility connect to the Brand Corporate Network, allowing a user to

connect to computers where the user has a password and user name.

On January 5, 1994, employee8, the program manager for utility

source code, received a telephone call from a person identifying

himselves as Richard Hoover. This person asked employee8 to put all of

the Brand Version X Source Code on a file server called Flower.

employee8 tried to load the software; however, it would not fit on this

file server. employee8 phoned Brand employee Richard Hoover, at the

Brand facility in View, FarState and told Hoover that the enire set or

source code would not fit. The majority of the source code files were

however transferred to the computer before it became full.

Richard Hoover is a Brand Engineering Manager in the Unix Systems

Group at View, FarState, who has authorized access to this utility

source code. Richard Hoover informed employee8 that he did not know

what employee8 was talking about and denied he had made such a request.

employee8 then asked Hoover if he had been the person who had requested

that version Y be placed on the file server "Flower"the week previously.

Hoover denied that he had ever made such a request. Richard Hoover

subsequently told Employee3 that he had never requested a modem access

account through Brand's San Jose Office. employee8 said that an unknown

person had removed Version X Source Code from the computer. Brand

security suspects that was done to make room for version Y.

About January 5, 1994 Michael Houser installed a product called

LANalyzer, to trouble shoot network problems, on the network at the

Brand View, FarState facility. The LANalyzer was placed in that portion

of the Brand network where file server "Flower"resides so that it could

watch the traffic in and out of Flower. The LANalyzer captures network

data packets which contain destination and origin data. Houser reviewed

the data, which showed the intruder retrieving passwords from the Trojan

Horse and the transfer of Brand Ver X source code for LogAB and LogCD to

the Colorado Supernet account "Ben".

The captured data from LANalyzer shows commands being executed by

the intruder to put Brand source code into a computer account on the

Colorado Supernet in the name of `Ben'.

ame2 is the source code for

the Name 2 file that resides on the operating system in an installed

Brand networking system on a computer and allows a person to log into a

Brand system. The estimated value of Name2.exe is worth in excess of

$1.00.

Richard Hoover e-mailed a message regarding the transfer of the

data to the systems operator, Trent Hein, at the Colorado Supernet.

Colorado Supernet is a commercial service provider of accounts on the

Internet to members of the public. Hein told Hoover that the account

named "Ben" where the Brand data was being deposited had been

compromised and the intruder was not authorized to use it. The logging

system at Colorado Supernet showed FTP (File Transfer Protocol)

connections being made from 17 different Brand computer systems on the

Brand Network to the `Ben' account. The FTP command is used to copy

files to and from computer systems, although it can be used to look at

a computer directory. Logs from the Colorado Supernet system, for the

account Ben, from December 24, 1993, to January 7, 1994, were sent to

Brand and are attached to this affidavit as Exhibit C. From December

24, 1993 to January 7, 1994 connections from Brand were made with

Colorado supernet approximately 4 times per day. On January 7, 1994, 10

connections from 4 different Brand computer systems were made to the

Colorado Supernet.

Employee 11 a Brand Lead Engineer, in the Software Engineering

Division, FarState, for a new unpublished Brand project, has a computer

running the HP Unix operating system. On January 18, 1994, He installed

a "wrapper" on this computer and changed all of the users passwords.

Michael Houser explained that a wrapper is a program that keeps anyone

out of a computer who is not an authorized user trying to connect from

a computer that has been specifically designated as having permission to

connect. Employee11 then checked his computer's logs and found an

intruder trying to access this computer from a computer on the Brand

network at the Brand facility, San Jose, California. The computer at

the facility in San Jose is a 3Com computer terminal server connecting

the inbound modem for telephone numbers (408) 999-1111 & (408)999-1112.

This 3Com terminal server (computer) is designed to allow remote

connection to Brand's internal corporate network via modem by calling

these telephone numbers. The Modem connects the caller to the network

via the 3Com terminal server. Brand Security has determined that there

have been in excess of 140 logins through this telephone number using

the fraudulent account of Richard Hoover that had been established in

San Jose. The intruder used this account and telephone number

approximately 4 -5 times on January 19, 1994 and left a message that

read as follows:

"I know you idiots are watching, goodbye asshole."

On one of these occasions on January 19, 1994, the intruder using

(408)999-1111 as a connecting point e-mailed all of Brands's technical

publications to a user on the Colorado Supernet.

Employee3 said the intruder had gained root access at the beginning

of the intrusions. Root access gives the intruder system administrator

status which would allow the intruder to change passwords and to create

methods to gain entry back into the system at some later time even after

the intrusion has been stopped. Michael Houser said that the intruder

has obtained root access at least 50 times. The intruder has put a

hacked program on the root directory on at least 6 commputers on the

Brand network. Five (5) of these computers are at the Drive facility in

San Jose, California. The hacked program is a modified version of a

legitimate Sun program called Newgrp. This program at the root level

allows the intruder to move into other computers and make changes.

Based on training and experience, it is your affiant's opinion that

is series of intrusions throughout the Brand Network have all been

perpetrated by the same individual or individuals, based on similarity

of methods used, times, interest in Brand source code and the use of

Brand employee names.

Your affiant is informed and believes based on the

representations of Jim Capili, an Investigator for Pacific Bell, that

the items requested in this application are the type of records

obtained, kept, and maintained by Pacific Bell when they perform a "trap

and trace". On January 19, 1994 your affiant notified Jim Capili that

he would be making this application to the Court.

Affiant is requesting a further Order authorizing Pacific Bell,

AT&T and any other provider of electronic or wire communication service

to the numbers (408) 999-1111 and 1112 install an appropriate "trap and

trace" device in switches connecting to the aforesaid numbers in order

that the origin of these calls can be established.

Therefore, your affiant further requests that such an order be

made.

Your affiant is informed and believes that telephone companies,

including Pacific Bell and AT&T, are required to advise subscribers of

telephone service who are identified pursuant to searches such as here

requested, unless the court ordering the installation of a "trap and

trace" device makes a specific order to the contrary. Your affiant

believes that any such disclosure might alert suspects as to the nature,

scope, and direction of this investigation before it is completed, and

could therefore impede the investigation and interfere with the

enforcement of the law. Therefore, your affiant would request that the

Court issue the following order as part of its Order:

Pacific Bell, AT&T and their agents and employees,

and any other provider of wire or electronic

communication service subject to this Order and its

agents and employees shall not disclose to the

subscriber(s) of the telephone service described

herein, or those subscribers identified as calling

the above mentioned number(s), the existence of

this Order or of this investigation, unless

otherwise ordered by this Court.

That based upon the above facts, your affiant prays that an order

be issued as requested above.

___________________________

JOHN C. SMITH

Subscribed and sworn to before me

this day of January, 1994.

___________________________

JUDGE OF THE SUPERIOR COURT

Exhibit A - Report by Employee3

Exhibit B - Delyle Johnson's Money activity logs

Exhibit C - Colorado Supernet activity logs

This affidavit was used to trap and trace telephone numbers calling into

a business. This affidavit would not authorize the telephone company to

release the subscriber information (name and address), this would

require another affidavit and order.

GEORGE W. KENNEDY, DISTRICT ATTORNEY

FRANK DUDLEY BERRY, JR., Deputy District Attorney

High Technology Unit

Attorneys for the People

SUPERIOR COURT OF THE STATE OF CALIFORNIA

IN AND FOR THE COUNTY OF SANTA CLARA

In re Order authorizing "trap and

trace" device and a "number/call

search".

)

)

)

)

)

)

)

)

NO.

APPLICATION FOR ORDER

AUTHORIZING "TRAP AND TRACE"

DEVICE, AND "NUMBER/CALL

SEARCH", [18 USC _3123];Personally appeared before me this 28 day of June 1994,

Investigator John C. Smith who requests an order authorizing the

installation of a "trap and trace" device, number/call search, and

release of subscriber information and on oath, deposes and says that

there is just, probable, and reasonable cause to believe, and that he

does believe, that the telephone number(s) from which incoming calls are

to be trapped/number searched and identified are being used in

connection with criminal activity and that the information likely to be

obtained by such installation and use is relevant to an ongoing criminal

investigation.

Your affiant is requesting that this Court authorize a "trap and

trace" by the American Telegraph and Telephone Company, Pacific Bell

Telephone Company, and any other provider of electronic or wire

communication service for the telephone number specified below.

Affiant is seeking to determine the origin of all telephone calls

made to Computer Co. nc. Computer Corporation telephone numbers (415)

222-0000 to and including 222-9999 and (415) 333-0000 to and including

333-9999, as well as records showing the date, time, and length of

call, together with the area code, telephone number, subscriber

identification information (including name and address), and location of

the calling telephone device.

STATEMENT OF PROBABLE CAUSE

Your affiant declares that the facts in support of issuance of this

court order are as follows:

Your affiant, John C. Smith, is a Senior Criminal Investigator

(Peace Officer) employed by the Santa Clara County District Attorney's

Office in Santa Clara County, California. Your affiant has been

assigned to the High Technology / Computer Crime Unit of that office

since December 1989. He has been a California Peace Officer since June

1965. He is a member and past President of the High Technology Crime

Investigators Association (HTCIA), and the Santa Clara Valley Industrial

Security Managers Association. He has been a Macintosh computer user

since about 1986 and an IBM PC user since 1990 and owns both types of

computers. He is a regular user of the Internet and has had classes on

the Unix/Workstation operating environment. He has over 274 hours of

training in the High Technology field. He has worked at least eight (8)

prior network/intrusion type cases and given several talks to computer

professionals on investigating intrusions. He has conversed with experts

in federal law enforcement corporate network security who have

specialized in these cases, and who have considerable experience in

investigating and interacting with persons who have illegally accessed

computers.

Your affiant was contacted by the Police Department on 6-16-94 and

asked to investigate this matter. Designated by the Police Department

as case # 92-7354.

Your affiant started his investigation case #94-0-0888, on 6-16-94

by interviewing Patrick Jones, Manager of Network Security, and Manager

of Information Resources Advanced Networking Group, Computer Co.

Computer Corporation. Computer Co.'s Network Security unit is

responsible for Computer Co. Network security, policy, workstation and

system security audits, and intrusions into Computer Co. computer

systems and networks.

Jones gave your affiant the following information: He has worked

for Computer Co. for 9 years. He has been the Manager of Security

(networks) for the last 9 months. He has worked in the communication

industry for 19 years with the last 15 years being in data and voice

type network systems. Working in this field required him to become

knowledgeable about security issues.

Jones advised that it is his opinion that an unknown person has

been attempting to penetrate Computer Co.'s corporate computer system by

gaining access through telephone analog lines. Computer Co. has 10,000

telephone numbers dedicated to their corporation. These numbers are

designated through two prefixes, (415) 222-0000 thru 222-9999 or (415)

333-0000 thru 333-9999. Jones said that an unauthorized intruder has

been using some type of an automatic dialer program that can check a

telephone line for a connection about every six (6) seconds. The

intruder has narrowed down the attempts to connect to only analog

telephone lines that have a tone which are use to connect to computers

and fax machines.

On 6-20-94, affiant was furnished with the report from Helen

Phillips, Computer Co. Network Support Specialist, dated 6-16-94, and

attached as Exhibit A. In this report Phillips explains that Computer

Co. has experienced an increase in telephone calls at the Town Computer

Co. facility from approximately average of 11,000 per day to the peak of

44,000 call per day on 6-3-94.

On 6-23-94, your affiant went to the Computer Co. facility in Other

Town and met with Computer Co. employees, Patrick Jones, Helen Phillips

and Roger Green, Network Security Consultant.

Helen A. Phillips, is a Network Support Specialist, in the Network

Administration Department. She has worked for Computer Co. for about 5

years. Prior to working for Computer Co., she was a telephone

communications technician for Pacific Bell and American Telephone for

about 9 years. She was trained by Pacific Bell. Phillips's job is

collecting and billing "Call Detail Recording". This data shows the

telephone usage by Computer Co. employees on the telephone PBX.

Phillips watches for unusual activity and follows up by notifying

management of that activity. Phillips gave affiant the following

information: Computer Co. leases their telephone system from

Commmunication Company. As detailed in her report of 6-16-94, she

observed an alarming jump in total number of call records at certain

locations. She watches five locations. She researched the calls

coming in and found that the majority of calls were going to numbers not

in service. (At the present time, only about 1,000 of the 5,000 numbers

are active.) Phillips observed that the duration of the calls were 6

seconds or less.

Phillips observed that when the calls started on 5-24-94, all of

Computer Co.'s telephone numbers were being called. Thereafter the

calls were focused on numbers with that have a tone signifying a

connection to either a fax machine or computer modem. As Phillips

examined the logs of the numbers called, she also observed repeated

calls to the same number. She believe that the intruder did not know

what telephone numbers to call in the beginning, but then learned which

telephone numbers were for analog lines to fax machine and computers.

Some telephone numbers have been hit as many as 300 times per day and

others 60 times per day. This is not a normal level of Computer Co.

business activity. She found that one line with a tone (telephone

number) was hit 27 times in one minute.

Roger Green is a Network Security Consultant in the Network

Security Department. Green gave affiant the following information: He

has worked at Computer Co. nc. for 3 years. Prior to joining Computer

Co., Green worked at Large company from 1986-1989. He has a Bachelor of

Science Degree from University. Green writes security policies, does

intrusion investigations, and evaluates software for enhancing Computer

Co. internal security.

Green explained how modems and computers attach to the Computer Co.

telephone system. He explained that someone can dial a telephone number

that is connected to a modem and workstation and, if that person has the

correct password or can determine the correct password, they have access

to Computer Co.'s corporate world wide computer network that connects

their facilities in many countries and Computer Co.'s 6,456 employees.

Computer Co. policy requirements calls for every computer with a

modem to have it configured with software that sets up a call back

procedure. Your affiant knows from training and experience that a

callback procedure requires someone calling a telephone number to obtain

a connection to a computer to give a password. The computer being

called has been programmed not to allow a connection, but to telephone

back to a preprogrammed telephone number. When the computer telephones

back to the prearranged number, the person requesting the connection has

to enter a second password. If there is no call back procedure in

place, an intruder with the right type of software can call a number and

once a tone is received, the computer/software generates a number

emulating a password. If the password is incorrect, the calling

computer hangs up and dials the number again, this time generating

another number attempting to match the password of the computer being

called. These password dialer programs are designed to be left running

indefinitely, recording any telephone numbers and correct passwords that

are successfully determined.

However, Green knows some people have not complied with this

policy. Green is concerned that the intruder will hit a modem number

that is not set up according to Computer Co. policy with a call back

number. Green also said there are a fair number of modems that have

been distributed to people thru the Computer Co. corporation and these

modems are not set up thru Computer Co. modem pools but hooked directly

to a desk top computer and individual telephone. He knows of about 50

modems in the corporate headquarters building in Palo Alto and estimates

that there may be as many as 200 modems through the Computer Co.

facilities in Santa Clara County. The Computer Co. modem pools are all

configured with call back software.

When affiant asked Green and Jones what they thought the motive

would be for an Intruder to gain access to the Computer Co. computer

network, they gave several reasons. They said that Computer Co.

operating system (OS) source code is valuable, costing in the range of

xxx per copy, and can be downloaded from the Computer Co. network.

Also, if an intruder can learn how to break into Computer Co., such

knowledge would help the intruder learn how to break into other sites.

Affiant examined the list of Computer Co. telephone numbers called

by the intruder and noticed that certain numbers were being called

multiple times. Affiant is aware of at least one other instance where

even after an intruder was successful in obtaining a password for

telephone number, the program continued to try other numbers to obtain

the password for each number. Intruders continue to look for other

passwords for specific telephone numbers in the event they are

discovered and closed out of a telephone number they have learned.

Your affiant is informed and believes based on the representations

of Darrell Santos, an Investigator for Pacific Bell, that the items

requested in this application are the type of records obtained, kept,

and maintained by Pacific Bell when they perform a "trap and trace" and

"number/call" search. On June 16, 1994, affiant notified Darrell Santos

that affiant would be making this application to the Court.

Affiant is requesting a further Order authorizing AT&T, Pacific

Bell, and any other provider of electronic or wire communication service

to install a "trap and trace" and "number/call search" device.

Therefore, your affiant further requests that such an order be

made.

Your affiant is informed and believes that telephone companies,

including AT&T and Pacific Bell, are required to advise subscribers of

telephone service who are identified pursuant to searches such as here

requested, unless the court ordering the installation of a "trap and

trace" device makes a specific order to the contrary. Your affiant

believes that any such disclosure might alert suspects as to the nature,

scope, and direction of this investigation before it is completed, and

could therefore impede the investigation and interfere with the

enforcement of the law. Therefore, your affiant would request that the

Court issue the following order as part of its Order:

AT&T, Pacific Bell, and its agents and employees,

and any other provider of wire or electronic

communication service subject to this Order and its

agents and employees shall not disclose to the

subscriber(s) of the telephone service described

herein, or those subscribers identified as calling

the above mentioned number(s), the existence of

this Order or of this investigation, unless

otherwise ordered by this Court.

That based upon the above facts, your affiant prays that an order

be issued as requested above.

___________________________

JOHN C. SMITH, Investigator

District Attorney's Office

Santa Clara County

Subscribed and sworn to before me

this 28 day of June, 1994.

___________________________

JUDGE OF THE SUPERIOR COURT

EXHIBIT A - Report of 6-16-94 by Helen Phillips.

This is new language for seizing computer equipment.

for the following property:

1. Any and all documents, including documents stored in computer

readable form, that contain the (NAME OF ITEM) or any portion

thereof.

2. Any and all documents, including documents stored in computer

readable form, that contain the words (NAME OF ITEM)

Confidential,

3. Any and all documents, including documents stored in computer

readable form and computer files, relating to (NAME OF ITEM)'s

4. Any and all computers, including any peripheral devices

connected thereto, as well as any and all hard disks, floppy

disks, computer tapes, CD-ROM's, and other computer storage

devices.

5. Any and all computer manuals and instructions for the use of

any computers and associated peripheral devices found at the

premises.

6. Any and all documents showing the identity of persons

occupying and/or in possession of the premises to be searched

including, but not limited to, utility company bills,

telephone bills, mail and personal papers.

Seizure of computer systems:

Your affiant knows from his training and experience that

computer systems commonly consist of a central processing unit

(CPU), connected to peripheral devices such as hard disk drives,

floppy disk drives, tape drives, CD-ROM's, display screens,

keyboards, printers, and modems (used to communicate with other

computers). In order to examine a computer system it is sometimes

necessary to have all original peripheral devices connected to the

CPU in order for the system to work properly.

Computer users also maintain floppy disks and other forms of

computer readable media which can store computer data and can be

moved from one computer system to another. Floppy disks typically

store up to 1.4 megabytes of data. (A megabyte is one million

bytes of data. One byte of storage is needed for each text

character stored.) The computer systems currently in use today

typically come configured with internal hard disk drives with a

storage capacity of 200 megabytes or more. Hard disk drives on the

market today can have storage capacities as high as one gigabyte,

which is one-thousand megabytes of storage. In searching computer

systems it is not unusual to find a large number floppy disks along

with the computer system. It would not be unusual to find hundreds

of floppy disks associated with a computer system.

Your affiant requests permission to seize all computer systems

and computer readable media found at the scene without first

conducting an examination of each and every hard and floppy disk to

determine if such systems and media contain the items requested in

this affidavit. Computer users frequently collect a great deal of

software on disks or other computer readable media. Searching that

media at the search scene within a reasonable amount of time to

determine which material is relevant to this investigation is not

usually possible. It can take up to one hour to search just one

(1) megabyte of computer storage. Given the storage capabilities

of modern computers and floppy disks it could easily take upwards

of 200 hours just to search one computer system and its associated

floppy disks.

Finally, the computer and magnetic media is the best

available. Magnetic media is easily erased or destroyed. Leaving

magnetic media behind may result in the loss of that magnetic media

as . Your affiant believes that it is better to seize the original

than to rely solely on copies which have not been authenticated in

the presence of counsel for persons who could face criminal charges

based on material found pursuant to this warrant.

Your affiant also seeks to seize documentation associated with

the computer(s) found at the scene. Your affiant may need that

documentation to search the computer. Moreover, that documentation

may well contain information identifying the owner and/or user of