BREEZE I3 HEELAEBIFIED DATE BY ALL FBI CDT-WAII-IEIE LI i February 25 1998 Director Freeh RE SOLAR CITA MATTER 00 HQ The captioned investigation involves intrusions into computers within-the United States which began around January 13 1998 and continuing to date The computers which have been compromised are computers belonging to the United States Air Force located at Andrews AFB Maryland Kirkland AFB New Mexico Columbus AFB Ohio Lackland AFB Texas Gunter AFB Alabama and Channel Island AN GS California computers belonging to the United States Navy located at the United States Naval Academy in Annapolis Maryland Pearl Harbor Hawaii and computers belonging to the United States Marine Corps Base Camp Butler Okinawa Japan Most of the compromised computers are Domain Name Servers DNS i e fbi gov DNS systems are responsible for translating domain names into their respective Internet Protocol IP addresses IP addresses are essential for Internet computer communications Intrusions into such computers have the potential to disrupt the mission of the US military throughout the world From logs obtained om various Internet service providers and universities investigators have determined that the intruder s originated from SONICNET an Internet service provider in Santa Clara California Court Orders served onI Irevealed thatI b3 I Sealed pursuant to court order On February 9 1998 the Massachusetts Institute of Technology I I ontacted SONICNET regarding a computer intrusion I I be I Iat MIT stated that someone had intruded their system from SONICNET and NC provided the Internet Protocol IP address The IP address is known to be associated withI I On February 16 1998 electronic surveillance was initiated by the FBI on the user accountI I The Order was signed onI I Oigg HM awe 52 b7C Sealed Pursuant to court order aesuwatlasuo 5x are subjects of this investigation and are associates Another site identi ed as a launching point for the intrusions is Marooncom a web hm publisher located at College Station exas land a search warrant has been served 011 A trap and trace Order was signed and executed onI I I A trap and trace Order is already in place forI I i On FBI SF initiated a Title Order onl IA Title Order is now 1133 being pursued f0 Additionally Iare also being obtain for each 3973 subject b3 To date 15 court orders have been served to include one Title and two consensual monitoring sites Two more orders are presently being obtained to include another Title __This matter is being coordinated with DOJ DOD and others as new developments arise Re femat Cons at 1 KM NOT FOR DISSEMINATION TO THE PUBLIC 1- l-Mr Geide 1- 1- be 1- 1 3 APMzapm 11 03 31 95 ALL FET IEFURHATIBN CUHTAIHEB EEREIE IS UNCLASSIFIED DATE BUREAU OF INVEST TION Precedence ROUTINE Date 2 24 1998 To Director FBI Attn Acting Unit Chief From WFO Contact SSAI I ha Approved Byz g I Drafted By I hrar File Number S Title SOLAR CITAC 00 HQ Synopsis Following is the status of involvement in this investigation as of 2 24 98 Reference EC dated 2 17 98 to Houston Division Details 1 IU S NAVY oo SAI Iis coordinating all investigative activity with Agents of the Naval Criminal Investigative Service b3 NCIS based in both Washington D C and Jacksonville Florida ib Trap Trace pen register installation-still problematic The b7C subject s current whereabouts and employment are known Coordination with the NCIS Agents will continue Remote monitoring Intrusions through IAP NET into MIT will be a ressed by NCIS only SUNRISE CITAC MATTERS 00 Copies of Icopied at FBIHQ CART were blank Original evidence in the hands ofl ISSA is following through to resolve Irelated to the account to be copied tomorrow by FBIHQ CART per CITAC 'Access to account originated from the University of Phoenix online uops fo uophx edu WFO will follow through b6 1 ibTC b7E Referral Consult