neidor~1.txt

黑客培训教程

was being sent from Riggs in Atlanta to Neidorf in Missouri.

          To carry the analogy a little further, the evidence is
going to show that Riggs used the bulletin board. He used it under
a false name which he used to disguise his real identity. He use it
under the name of Robert Johnson instead of Robert Riggs. He had
authorization to use the bulletin board section where you post
messages generally, and he also had a storage locker on the bulletin
board, on of those lockers along the wall in a high school, where he
thought he could safely store the text file, the E911 text file that
he had stolen. The evidence is going to be, though, that law
enforcement, Hank Kluepfel, found out about it. Mr. Kluepfel's
efforts to get into and to use Jolnet in that storage area will be
testified by Mr. Kluepfel. But the only thing we need to remember
here at this point is that the information was stored in Lockport,
Illinois. That is where the private high school is located. It was
stored in the locker of a private high school in Lockport.

          But because computer technology is the way it is, Riggs is
able to transfer the file by E-mail or a file transfer down to
Neidorf in the computers at the University of Missouri. Again, this
analogy is not quite the same as the bulletin board, but the
University of Missouri has a capability there at the university to

- 19 -

Cook -- opening statement

allow students to have essentially a locker on their computer system
where Neidorf generated PHRACK Magazine from.

          Just a final note of reassurance. As we go through the
evidence here, we are going to try to have the witnesses explain as
each step progresses what the technology is again. So hang in there
and listen with an open mind, as I know you will anyhow, listen to
the explanations of the technology.

           (Chart) The evidence in this case is going to show that
the text file that was stolen here described in vivid detail each of
the locations along the E911 path to an emergency call. It's going
to show and it did show the central location and the central
significance of two places. When an emergency call is made in the
BellSouth area, BellSouth region--it is really the area
geographically that southerners describe as "Ol' Dixie"--when an
emergency call is made there, it goes to a thing called a PSAP, public
safety access point. The public safety access point is the one that
is in direct communication on secure lines with the fire, police, and
ambulance.

          Under the old 911 system, the old emergency dialing
system, the call would come in, and they would have to trace it back
to the origin in many cases. You have a situation potentially where
someone would call, perhaps a child, and say, "My dad's hurt", and
before the operator could talk to the child, they hang up the phone.
The child, of course, figures, "Well, I called them. I told them y
dad was hurt. They'll e here". So it is, obviously, not that
easy. Under the old 911 system, a complicated tracing procedure had

- 20 -

Cook -- opening statement

to be established. They had to try to find out where the call had
come from, and it's all done in an emergency posture.

          Now comes Enhanced 911. You will hear the lady that is
operating that system, or operated it for the balance of time
involved in this case. You will also hear from the man, Richard
Helms, that brought all the pieces together for the bellSouth
region, and put them in one central location so that all the phone
companies supporting the 911 system, the Enhanced 911 system, would
all be on board and be working with the same game plan, never thinking
that that game plan was going to be over over to hackers.

          The Enhanced 911 gives you this capability within
three to five seconds of the time that the person picks up an
emergency call and that 911 is entered in, sometimes even before the
person at the public safety access point can pick up the phone. The
computers that drive the 911 system have done this: They have gone,
in this case, to the remote location in Sunrise, Florida, where the
back-up systems and the support systems for the control, the
maintenance and the operation of 911 are kept, and it has pulled up
all kinds of information about the person making the call.

          When the person picks up the phone, it's connected wit police,
fire and ambulance. They have a TV monitor in front of them or a
computer monitory, if you will, which has all kinds of information.
It has the name of the caller or the people that the are known to be at the
calling address. It will have location information with respect to
where the closest department is, fire department, police department,

- 21 -

Cook -- opening statement

to that person. It will also contain information in their computer
storage banks about special problems that may exist. If it's a
business, if it's a business involving chemicals, the fact that those
chemicals are explosive will be reflected on that screen. If it is a
private home, if there is a handicapped person there, it will be
reflected on that screen. And it's all done within a matter of three
to five seconds. They have it captured there. That is what
Enhanced 911 is about. That's the system that Robert Riggs stole:
how that all works together, and how the computers at BellSouth
support that kind of capability, consistent with the telephone
company's long history, going back to that first phone call,
"watson, I want you", their tradition of providing emergency services
as the first priority of the phone system.

     You will be hearing from essentially three groups of
witnesses. You will be hearing from people at bellSouth that will
tell you about the steps taken to protect the system. They will tell
you about the way the file was defined. They will also tell you that
at the same time that they were having these problems with 911 in
terms of the los of the file, at the same window, they recognized
that there was a larger problem throughout the network as a result
of hacker intrusions, that there were a series of bellSouth
computers along the network that had been attacked or were under
attack. Some of those computers included the ESS switches. They
recognized that the Enhanced 911 theft was a symptom of a disease.
The disease was the hackers into switches, and they took remedial

- 22 -

Cook -- opening statement

steps. They started out slowly to try to identify it, and then they
rapidly expanded, trying to solve the disease along with the problem
of E911. So you will hear from the BellSouth people.

          You are also going to be hearing from three members of the
Legion of Doom, three hackers. You're going to be hearing from
Robert Riggs, Frank Darden and Adam Grant. They have hacker
handles. These hacker handles sometimes seem to get to be a little
on the colorful side, a little bit like "CB" handles.

          You are going to be hearing the testimony of the hackers.
You're going to be hearing the testimony of Robert Riggs who will
testify that Mr. Neidorf had been after him to give him information
to put into PHRACK, this hacker newsletter. That when Riggs had
broken into the AIMS-X computer in BellSouth, he saw on that AIMX-X
computer at BellSouth the 911 text file. You're going to hear that
he contacted Neidorf in advance, that in that advance conversation or
communication, he advised Neidorf that he had the text file, he was
sending him the text file to put in PHRACK, that he had gotten it
>from an unauthorized account that he had on the BellSouth computer.
Essentially, what he told Neidorf is, "This is a stolen piece of
material you're getting".

          He indicated to Neidorf and Neidorf agreed...first, he
agreed to take the stolen property, and he agreed to disguise the
identity of the stolen property to some degree so that it wouldn't
run off on Riggs. Riggs' name wouldn't appear on the file when it was
published in PHRACK. He would try to disguise some of the

- 23 -

Cook -- opening testimony

indiations that it was stolen from the BellSouth area...Neidorf
would. You will hear evidence that that is exactly what Neidorf did
to some degree or another.

          You will hear evidence bout Neidorf seeing and noting the
proprietary warnings that made it clear that this was stolen
property belonging to BellSouth. He even made a joke of it. He put a
little, "Whoops"next to it when he sent it back to Riggs because he
didn't want BellSouth to know that he was inside their computers.

          You're also going to hear evidence that Riggs was never
satisfied with the final result that Neidorf had because it always
contained too much information even for Riggs. But the E911 system,
the text file and the road map, was published by Neidorf all the
same.

          You are going to be hearing from Agent Foley who will
testify that he talked to Neidorf about this at his fraternity house
at the University of Missouri. Neidorf said he has freedom of
expression. That was his response to Foley: Freedom of expression
to publish it in PHRACK.

     The First Amendment can't be used as a defense to theft.
When you steal something, you can't claim that coming up the back
door, the First Amendment protected you.

     You will be hearing from Agent Foley though that as part
of this discussion with Mr. Neidorf, Mr. Neidorf, in fact, admitted
that he knew the file was stolen, the text file was stolen, and he
published it in PHRACK.

- 24 -

Cook -- opening statement

          He also turns over to Foley a hacker tutorial, a hacker
lesson to other hackers on how to break into the ESS switches. He
turns that over.

          The evidence will also indicate that in addition to that
stolen information was information about a stolen AT&T source code
document. Here he goes again...source code! The source code program
had a Trojan horse in it. It made it clear right on the face
of it that it was a Trojan horse, a way of stealing passwords from a
computer.

          I am going to have to pause here for a second to make
sure that I reassure you again on the descriptions and the items
we'll talk about.

          The source code is a type of language. It is kind of a way
human beings write things down as a first step toward communicating
with computers. They write it down in source code, which is
directions. A rough analogy would be if I'm going to give you
directions on how to get to my house. The source code for that kind
of program might be something like:

"Go to the door.
          "Open the door.
          "Go through the door.
          "Go forward to the sidewalk.
          "Go the the sidewalk and stop.
          "Stop at the sidewalk. Turn left.
          "After you turn left, start walking.

- 25 -

Cook -- opening statement

Step by step by step progression along the way. That is kind of what
the source code is about. You will hear, fortunately, a much better
description of this from the witnesses on the stand.

          The source code program that was stolen here that
Mr. Neidorf received, again, basically was clear from the face of the
document that it was stolen. And, again, Mr. Neidorf transferred it
out to somebody else. Again, stolen property was received and
distributed in interstate commerce.

          The nature of this source code was that it would act a lot
like a false front door to a computer, where you walk up to the
false front door of the computer, you knock on the door, and somebody
inside the door or inside the house says, "Who is it?" The person
knocking on the door uses their secret word, or their name or an
identifier, or it's recognized by the person inside the house:
          "My name is Joe Jones."
          "My name is Bill Cook."
          "My name is Colleen Coughlin."
          "My name is Tim Foley."
Except with this door, it was a false door, and what it had the
capability to do is it would record the information. It would
record, "Bill Cook," "Joe Jones," "Colleen Coughlin," "Tim Foley".
Those are the passwords to get into the house that a legitimate user
of the house would use.

          But this Trojan horse, what it would do is it would store
those, and after it had stored all that information, it would

- 26 -

Cook -- opening statement

essentially disappear. And the person trying to get in the house would
all of a sudden get a communication from the other side that would
say, "I didn't hear you. Try it again".

          It would steal those passwords, and it would then put them
in a private place where the hacker would come back whenever he
wanted to, and just pick up the bucketful of passwords and log-ons,
and use them to break into the same computer systems again and
again, kind of an elaborate piced of scientific perversion but that
is what it is about. That was the document that Mr. Neidorf also
trafficked in as part of this fraud scheme.

          The final expert that you will probably hear from on the
government's side is going to be a man from inside the phone
company, a man who was with bell laboratories before he was with the
phone company. His name is Mr. Williamson. Mr. Williamson will talk
to you about the property, the property being the text file, and
the way in which and the reason that the phone company protects
this kind of property, this information.

          He will testify, we anticipate, to the obligations of the
phone company, to the significance of the text file, along with
other people, and the fact that the theft was the theft of critical
information for the operation of that system, and that the
proprietary markings made it clear to anyone who took it that that
was stolen and that they didn't have authorization for that document.

          No matter what other information floating around about 911
that might be out there, this document was proprietary and contained
the inside information about what this system was all about, and how
an emergency call is driven from the point of someone picking up
the receiver to the time when the help is actually generated from
the fire, police and ambulance stations.

          As I've said before, it's that text file that Mr. Neidorf
deliberately compromised into the hacker community. At the
conclusion of this case, we are going to be coming back here and
asing you to find a guilty verdict against Mr. Neidorf for the
interstate transportation of that stolen text file both from the time
he got it from Riggs, and it was sent from Rigs in Georgia to the
bulletin-board in Lockport down to Neidorf at the University of
Missouri, that's one interstate transportation of stolen property,
and the interstate transportation of stolen property, that same
stolen information back from Neidorf to Riggs in Lockport. In this
situation, it was reviewing the stolen property to make sure that
they could disguise themselves. And then the final interstate
transportation of that stolen property when Mr. Neidorf compromised
the text file into the hacker community.

          I appreciate your attention. That concludees my remarks.
I ask you to pay as much attention to Mr. Zenner as he makes his
remarks to you this morning.

          Thank you.

     THE COURT: Thank you, Mr. Cook. Mr. Zenner, are you prepared
to make your opening statement?

                  <End of Cook -- Opening Comments>