ALL FBI HERE IN IS 12 31 1995 DATE 09-19-3013 603ESEUCJDSEIESSDERS Precedence PRIORITY Date 02 18 1998 To Boston Attn SSA Houston Attn SSA San Francisco Attn SSA WMFO Attn SSA From Contact SSA t5 ml ON Approved By Geide Ken Drafted By Case ID Title CITA MATTERS DOJHQ Synopsis This communication sets forth additional investigative leads to be addressed regarding captioned subject w W Reason Administrative Receiving field offices should reference Bureau EC to All Field Offices dated 2 9 98 Bureau EC to All Field Offices dated 2 12 98 Re xsl meult Details S Referenced matter continues to receive the highest level of attention and scrutiny from the Department of Defense and the National Security Council The Attorney General has ordered all necessary DOJ resources be afforded to this matter and all avenues of investigation be pursued FBIHQ will continue to provide overall coordination analytical support and liaison with DOD under umbrella case The following leads delineate specific areas of investigative responsibility for receiving field offices under which field office of origin OO cases may be opened Investigation and leads should be expeditiously addressed and telephonically provided to 3 4 l 1 114 a Lll J leh E mm g g - - Estes To Boston From Re 02 18 1998 SSAI or Acting Unit b5 I I These telephonic contacts should be n7c followed up with appropriate paper communications Sm To Boston From Re 288-NQH1242560 02 18 1998 LEAD S Set Lead 1 BOSTON AT BOSTON MA Referral Consult Set Lead 2 HOUSTON Referral Consult AT HOUSTON TX m Set Lead 3 SAN FRANCISCO AT SAN FRANCISCO CA gjwill Open an 00 case into intrusions in to department of defense domain name servers and b7E Em iB Will continue monitoring ofl I perform analysis of content and provide results to CITAC Will b3 obtainl End conduct appropriate analysis Ji Sm To Boston From Re 02 18 1998 initiate surveillance of subjects as deemed appropriate Hi iBjWill seek amended order or letter From b3 Ui b will consider use ofl Set Lead 4 WMFO AT WASHINGTONI DC m S Will contact and interviewl I I Ireqardinq trace of Internet session accessed b3 throughl I Obtain all relevant recordsi Referral Consult bf iuiiginll continue investigation intol land ba coordinate with NCIS E 3 33Will obtain and serve 2703 order on University of Maryland systems administrator to determine source of hacker tool files Conduct appropriate investigation to determine user account holding and accessing files date files were accessed and locations to which th and trace order for b3 Referral Consult CC 1 - Mr Geide 1 - b7C TO Re 00 Sm Boston From 288-NQ-1242560 02 18 1998 1 - Mr 338 Mr b b