Fbi Foia Anti-sec Documents 5w1u5

<.!.Lo1~e.ry!.Lf'~--lOO::!..+.l..-Se;.1,,~er' . \i~~~....s.b7Y-tI

_j-------

t..

.;

. I

i I

I

J

/

i

-

-

----

-----~--,

-

I

.

• 1

.--'

!

t.

,I

.

~E"t ..~\Lcz.~~'"

~_.£

c....... "'~

• -:j)~~-t..._.,.,l\."f h......( \ c...",,~= ~

. 'i?

,l _(

~r'ifO~c1

tC. __ 'l ....... .J.

~%!

~d 7

a:tl~

y.,_~

..LM

+-

Q.e~~

~l:~

~k.~

..."k.~

.~~~e.."

J

~y.J..rwofAL.C..-'::.

. A.ec.o """ b. e

'I

• otite......

')1"J')Q,r....us. c_..

L\.a..",

1k~~

~ec:....s....

I....)

II

l~-br.,~I/ Gwt;A

'.-. S~

b6 b7C

,j :j

l(j~~

....

I1 -;)...

1

-.)1

II

I

0 (.... '"c.M u

o.t\

ph lMJZ.

·l4'~ye..J +e...'iOb:. .Q.~ .A 11 ,..~:'

...-b{ r(!."~ ~"-~

1·~,

. c..l'Y\.+.:'~

"~-hJJ~ ,

I

,• \Jh~tll rr.f~

II

t

II ,

II

"II.,..

oJ

4'(1

'-.I

-h ~.,..,.,,;{~hf)1\-t J

I

.9-~

t;~1

~~T ~

.J

a.i.c..A- -po-S;f-s

C1"_~~

-\-t'~f\"itw. '3:.\M.,,\c.kh.,.

~lI~~L~("

'\)

It

c-. F1\ ..c.~

\,_,lL-l 1.... .-

I\...~

t

c.,._lls

.....Jl

[4,m+ Q?I

c;l J

v

......

r-..u...,.:!:i/;i

a.cc.±

~t'ta

-..J

~

t:1tfl-;Lt U

I.dA

.... ~

--

- ---

-----~-----

.. .--

/

IW

~

. Dv-Jweck

c~~

'1'::.

r1r.>r'(c~

~c -II

I

b6 b7C I

i I

..0 v J e,..-J

I

.t...w... ~, +z.

i I

:

,

>

-I

,~

--

.>

~r;.M

«HC<.

(~n-Jc.-~\ ,

Statement regarding the hijacking of my personal s:

I

On Friday 11-18-2011, at approximately 0700 hours I was getting in my car and began receivina text ressages on my phone from my own Gooale telephone number of

I

This number is associated with my bccount of I , The messages stated that in essence, the senders had taken over my and hat they "owned" me. The messages were also directing me to a specific chat room (I already deleted the text) to them, otherwise they were going to post my email and personal information all over the Internet. I ignored them and they continued to harass me with incoming text messages. I checked via my smart Android based cell phone, and immediately noticed I no longer had access to my Google , my Facebook that was assotated with the same email address, and the yahoo that was linked to my I The perpetrators continued to prod me to go to the chat room with threats of releasing the information, but I continued to ignore them.

b6 b7C

When I arrived home at approximately 0730 hours, I went onto the Internet from what I believed to be a secure computer and via the specific providers websites followed their online protocols for recovering compromised s. It took approximately 1 hour, but I was successful in gaining access to all the compromised s and changed the s several times to prevent the intruders from following the same protocols. In the Google , they harassed many of the s contained in my phone book with a variety of text messages. They posted personal emails from the email s around the In erne and m d Id s atements about compromising a Department of Justic Some ofthe email in m sent folder included

b6 b7C

They logged into my Facebook and deleted most of my photos, changed configuration settings, posted numerous offensive comments and personal messages to various friends, as well as impersonated me in various chats. . I received a phone call from a Huffington Post reporter (didn't get his name but seemed legitimate, b at approximately 1400 hours the same day. He was excited when he initially called, like he was at the forefront of a big breaking story. He asked if I wanted to comment on the compromise that happened to me and told me he learned of it from people in a chat room. It appears he thought I was going to be some high ranking manager of a computer crimes unit and there were going to be damning things in the data they stole. I quickly deflated his enthusiasm as I told himl I ....._ __~and that whatever they got was personal, but not embarrassing and I was not going to give in to their threats and intimidation by ing them. I further told him that in the overall scheme of things, I was really nobody and it was insignificant to terrorize me for their cause.

I

b6 b7C

Following my recovery of the s, the perpetrators texted me and said it was not over yet. They made a comment about how tough economic times were and I should beware of my financial status. I made a check of my assorted banking and credit

~~~--

-----

that I deal with online and discovered a fraudulent charge made th~ RiIz camera for app~XimatelY $896.95. The purchase was made with my and was sc~eduled to ship to an old mailing address a

to b6 b7C

I [

I ed I and they are cancelling the transaction and the . There are no other know discrepancies at this time and have since place a credit block on my personal information.

They continued to harass me via text and said they were releasing my telephone number to 150,000 followers on twitter, and hoped I wasn't busy. I received a few calls, but did only answered a few just to see what the callers had to say. 'Most just made ignorant comments and hun u . I disabled the mail , to avoid a backlo of voicemail as m hone i I believe this tactic, along with not acknowledging them in the text or chat rooms frustrated them and kept them from calling or texting too much. There were a couple of texts from I khat appeared to be sympathetic to me, wishing me well and hoping the hackers would be brought to justice. I ignored them as well, suspicious that the perpetrators were just testing to see if I was receiving their other harassment texts. I received only a few additional phone calls from mysterious numbers and harassment texts over the weekend. I desire prosecution.

b6 b7C

FEDERAL FOI/PA DELETED FOI/PA# Total

Page Page Page Page Page Page Page Page Page Page Page

BUREAU

PAGE INFORMATION 1204913-0

Deleted

16 17 18 19 20 24 25 30 31 36 37

OF INVESTIGATION

-

b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ;

Page(s)

b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;

SHEET

11

b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX

J ..

,I'

••

(Rev. 01·31.2063)

FEDERAL BUREAU OF INVESTIGATION

ROUtlNE

~recedence:To:-

Date:-

Cyber Division

ATTN:-

SSA

I

.10/ 08/2009

Computer Intrusion'

From:- San Fr-ancisc-o

Squ-ad CY-2/Sa',U-~~~I.LSA

Unit #2

I

__

:-

b6 b7C

Approved ;By:: Drafted.By}

~ __

~__ ~~~~

Case -lD #:- 288A-SF-i!t~f~ending)

/t

288A-SF-NtW-G'J (Pending) .....' ANT-I-SEC; UNSU-B (S), et al; -IMAGESHAC-K :-:--VICT'IM; COMPUTER I:NTROS'ION

Title:-

S_y:nopsis:- To Open , Case and s

f_i_les.

I

I

on October 8, 20 9, Special Agent A) met w"ith employee_s of IMAG at 23 rtfi Sant-a Cru-z Avenue, Los Gatos, California, 95030, to Lscuss two rec _ c-omputer i,ntrusions of IMAGESHACK sezvexs , -IMAGES'HACK is a company which provldes i,oternet "image host,i_ng.

-Details:-

IMAGE_SHACK advis-ed s'AI I t.hat the f_i,r-st comput e r intr"tlsion occur-red on July 10, 2009 at approxima_te_ly 7 pm Paci_fic St'andard 'rime (PST)._ A group by the n_ameof ANtI-SEC gai_ned

.

access to one of the companydatabase server s ,

hack-er (s) access-ed contafned I

l

able

to I

The server the

I

The hacker 1s1 w-ere als o 1

on th e t,he hacker (s) posted a mess-age I In addition, - intet:net which claims the ANTI-SEC .is a ,movement ded.lcated to the er-adic-at-ion of full disclosure. Their mess-age _further explained they plan to achiev-e tbis "t,hrough t,he fulJ and unrele,nting, unmerciful elimination of all ers of fulJ-disclosu-re and t,be security industr-y in its 'present form." b6 b7C

b6 b7C

d ~ b6 b7C b7E

To:· Re:·

San Francisc. From:· San Francisco 288A-SF-NEW, 10/08/2009

•

IMAGESHACK advised ·this computer intrusion affected approximately 50 million images and every that was on their site at the time viewing :images. IMAGESHACK .Ls steill ot su e ~ ...., got into t~eir database but believe.""=."......,,,,.,,,...,,. b6 b7C b7E

On August 2, 2009, :IMAGESHACK believes the same hacke_r(s) came back and gained access ·to their servers again. IMAGESHACK has -full and complete logs. 'It.is apparent the hackerls)1 I b6 b7C b7E

b6 b7C b7E

IMAGESHACK estimates their losses at approximately $26,000. :It is requested that t.he folJowlng subfiles be opened e SUS GJ

Grand Jury

It is .requested that the new casy and subf_i:lesbe opened and a.ssigned to SA ...1 __.J

b6 b7C

••

2

- --

_--

_cc--cc-_-=--_c_-"--=_c_

cc-==

-=--__:_:--:_:_:--c=_- -=--cc_-

_--,----~

-----

---

-

•

10/21/09 -12:08:07 'ritle ~tI Date

and chaxaceex

•

'FD-192

ICMt~ROl Page l

of case s

SEC Pr.operty

Acqui_red:-

Source from which IMAGE'SHACK, c/ol

26-3 N SAN'rA CRUZ AVE '#100 ~OS GArOS CA 9S030

10/08/2009

Anticipated

Property

Disp.osit-i.on:-

Acquired

By:·

Acgui_red:-

l

26-3 N. SANtA CRUZ ' ,"

Case ~gent:

I Desc_ript,i.on_ of Pr.operty:· .1B 1

Date

Entered

.srx (6 )

HAEDDRIVE'S:· '-THREE (3) WES-TEENDIGlTAL S/r::; WMAP4,123996-4, S/ij W~KI{12S207'1 AND SiN WMAKE-2_1S'3028 -TWO(2) }{tT~Cl{I: SiN CKC4U'9S'E, SIN C~t-5'H4ME -ONE(1) S'N{SQNGSiN S09QJ1'OL218644 ONE( 1) f!tTAcHt Bare'ode:·

E4189643

Case Number:· Owning Off.ic'e:·

10/09/2009

288A-SF-145486 SAN FAANCISCO

b6 b7C

,

08/1_9/10 19: 29: ss , T,itle

Date

-FD-_1_92

and Character

Property

of Case:-

Aequi_red::

•

Source f_rom wb,ich Property SV-~CJ"L

Ae_qui_red:-

Acquired

Case Agent:-

ICMI:IiROl Page 1

08/19/2010 -Anticipated

Disposition:

. Description

~I

BYi

b6 b7C

~

Date Enee_red

of Prope_rty:-

l_B 2

·ONE(1) CD LABELED5'0'-·09-016'2 (DE,R:IVAtIVEEVI:DENCEOF 181) Baz'code s E4189947

Case Number:Owning Office:-

_Loe-ation:- S_JECR

08/19/2010

'PRESS3

288~-SF-~4_5486S~ FRANCISCO

·mY~ k-'"

ot8~ t\ -

1~' -

Sf - '46

10. 2.

•

..

)

FD·302 (R~v.10-6-95)

•

.. • 1•


Date of tratlSCription

1Q L Q ~ L2 0 Q 9

--------------~I

On October 8, 2009,~1 was interviewed at his place of employment, ,IMAGESHbCK, located at '236 North San Cruz Avenue, Suite ,100, Los Gatos, California, 95030, telephone number 40S-836'-8579. Afte~ advised of the identity of the interviewing agent, L______j provided the fOl_lowing information:· On July 10, 2009 at approximately 7: 00 p.m., U1AGESHACK servers were hacked. The hacker(s) ,we:e able 'to qet into the ~~~~~~~~~~~~~~~~~~lnsl L.....__ ....-----------___.....,I I -indicated the This sever also contained b6 b7C b7E

L-----:,---:-I indicated 'IMAGESHACK does not ~~~~formation~~~~~~-~~~~~~~----~~~~~~ ave a that from that server, the Ultimatel

~~_~advised this affected every ~~~O~-,o:"Tl~:"""'TlIT'7C~-.,.;~'=""I:'7C, ~ and approximately 50 million images. He -indicated IMAGESHbCK images were replaced with this propaganda message for several hours. I I said this caused quite a stir on the internet as it affected many website backgrounds as well. I ladvised a group named ANTI-SEC c Latmed responsibil.ity for ,the hack of IMbGESHACK on the internet. 1 1 said the technical team at IMAGESHACK believed the hack was a result of an I I He ~~ifi~p~ that after 'the hack. the technical team at IMAGESHACK I

II

I

back.

On August 2, 2009,1 1indicated the hacker (s) came He advised ,the staff at IMAGESHACK believes it was the same

b6 b7C b7E

({'ss ))wb::;l;se theyh~yised L that at the time it appeared the I haaCckkeerr •

0

I

h

was able tol

I

lov~stigation fil~ by

*

I '

on

.

09/08/2009

28 8A-S F-14 5 4 86

The technical team 1

;;:r

?t

....;;;.L.;.o.::.s_G.;;..-:;;,a.;.to.;..::.s~, _C.;.a=l;;;;,i·;;;;,fo.;..::.rn;.;;,;;.ia;;_ _ Dat~ 4i«ate4

.;.,N..;;.;A;..._ _

SA

This doo.nn~nt contains f1cith« fe¢Omme~ions fIOI' con?tusions of th~ fBI. It is t~ ptop¢rty of the FBI a.n4 is ~e4 it w its CQfItentsar~ I\Ot to be dlstriblolte4 outMe your ~ency.

to your ~gen¢y:

b6 b7C

)

•

•

,

288}J.-SF-145486

ContinuationotfD·3'0201

:~L

---"---------'

On

Q9/0B 120 09

Z

.Page

b6 b7C b7E

During tb~ second ,attAyk, tb,e bac~went J tben I J 'and tben "'__---;::::::==::::::;---'

througb the :through tbere. b6 b7C b7E

$26',450. !--:-.......-- ........... I provided one compucer Di,sk (CD) -LabeLed IMAGESHAC~ 'ANtI SEC which he did not want .recurned that cont-ained copies of an ovezvd ew of the hac~';, 'Mitt-S'EC jpg. ,image posted to t,he

th;

server's, email ',froml'reg'ardi,ng tbe identity of tbe hacker t s), ana chat ' o9srqm : t1AGE:S'HACK st'aff dur.in_g t he bugust ,2009 at t'ack ,

2,

---....II'provided 'six, hard, drlv'es to S,~ I and signed 'an FD-941 Consent to Syarc,h Corciputer(s ) form for t,hese six hard drives. I J was al so 'provided and si9ned an FD597 On,ited St'ates Depart,Inent of Justice, Feder'al Bur-eau of , Investig'at:ion, Rece,ipt For Prope r ty Received. 'I'be, fd-941 and FD-' 597 and CD have been placed Ln a lA .enve'Iope and, sent 'to the ,file. L...-

b6 b7C

,

•

.

(Rev.OS"()1.ZOO8)

bl b3

FEDERAL BUREAU OF INVESTIGATION ~

Precedence: To:

Attn:

San Fr-ancisco

From:

San Francisco Oakl_and ~, : !

Approved By. Drafted (5)

Date:

ROUT-INE

...case tD

By:

S~A-l _ S

~~Y-2 ~ CY--3

1-2 -and CY- 3

I.

.

~========::::::;-~

b6 b7C

r

~==========~----------~ I

bl

#u:ml b3 ·~(~O~)~~2~88~J~-~S~F~-~1~4~1~8~90~----------~(~p-e-n-d~in-g~) (U) ...-288A-SF-145486_ _ --~

'ritle:- .~

J:s<

W)

1_1/03/2009

DEATHIS COMING.FROMTHE EAST; 'ONSOB (S) ; C.I/CT - TNtI WORLDDEE-'ACE&S,

UNSUB(S) ; CT - TNt!

OO:SF ~nti-Sec UNSUB(S); lMAGESHACK- VlcrIM (U)

Synopsis: 'Anti-Sec.

(5) (U)

Reference:

M.

Ide_nti_ficat-ion

of possible

f()Un~ing member of

~

~~~~~~~~~~~-r~--------------~ .~ 288A-SF-145486- Ser-ial -1

------ll

(5) ·············l.___

+S)

uummumuS~INOFOR~m'

mmul

bl b3

•

To: (5)

Re:1

S~/INOFORN~

San Francisco

From;

San Francisco ....J

L..

bl b3

(3)

/ \

(U) Open jource searches provide no information that Anti-Sec hacked. I b7E

San Francisco division

The hackers changed the server settings to redirect every image to a hacker logo. The hackers posted a message claiming that the Anti-Sec group is dedicated to the eradication of full disclosure by eliminating the cyber security industry. (288A-SF-145486-,Ser:ial : 1) (U)

Anti--Sec claimed that a r

1

I.

An identified

b6 b7C b7E

1

1

I

1

Ifurther

stated.tnat Ant 1. -sec IaOrl.Ca~e--cr the claim ofl.~~ ~ ~ ~ ~l White-Hat Hacker and Cyber Security Communities. Open source rese~rch r~yealed that several -large web hosting companies consl.deredl~. ~ ~ ~I (800A-HQ-C1591622-NO, Serial : 20010).

b7E

1 I

I

b7E

(800A-HQ-C1591622-NO, Serial 20010)

(S)

bl b3

-

(3)

. To:-

•

Francisco

S~IINOFOl!N~

FroID; San Francisco

Re: bl b3

Possible Identification of a founding member (5)

~/

/NOFORN~L....-----I

3

bl b3

•

•

•

(3)

Franei seQ

To:·~e:

~lINOFORN~ FrOm·-

San

bl b3

Francjsco

,LEAD (8) : Set, Le'ad 1:

(Info)

SAN FRANCISCO AT SAN JOSE

(U) R¢ad 'and Clear.

++

bl b3

l

•

•

••

•

,UNCLASSIFIED

FEDERAL BUREAU OF INVES,-IGATION

iPrecedence::

Rou'tINE

Date::

1_1/10/200Q

'To:, 'San EYanci_sco From:- San .-Francisco

S'quad C'i'2/ Sal1.....JO\l:..:olQ:.ws.:..:e_'.LlIMLA-' :· SA I

---.

~--~---------~ '0, I

Ap~rovea By: Drafted

----JI

By:' ~

Case 10- #:: 28aA-S-F-145486 ,

I

'Title:-'

b6 b7C

/

(pendingVt.t

ANtI-SEC;

(JNSOB(S); JMAGES,HACK _' 'VICTIM; COMPUtER'lNTRO$ION 'Synopsis:-

,to 'Report US ,Attprn~¥

Of
operii_ng .' On October ,9, 2009, Special }J.gent (SA) ~I=-:---:-_~_~ e~a,i:le,d Chief, A~'s,ist,-ant, _Un_i~ed St-~t'e,y Attorney ,(AOS'A);,fo,r,-t.,he Computer Int,rusl.on and ,ij,ackl.ng Un,l.t"L Ire,gardl.,ng concur renee ,for new capt.Lcned :investigation. ,rbe e-mail ccncafned a surn.rnarY'-oi'the case informat,ion., ~AI lwas ccntact ed t'elephonica11y and g,ran:ted ,~oncu'r_'rence regarding cC'aptioned i,nvestigation -and advised ,that !.AusA jt;tould be as'sLqned t,he -case ,

:Details::

I

..

I

to ,AUSA '

-Attached

I

and-made a,'part

of t_h,is document 'i,s the -email

-UNCLASSIFIED "

b6 b7C

•

fD·S42 (Rev.o3-i3-20(9)

UNCLASSIFIED


Date:To:-

11/13/2009

San f'r"anc_isco

From:-

San Francisco Squ-ad -C'i'2/s_a1Jose M :S~_

Approved Dr'afted

By.:- I B~:-

Case ID #:: Title:

Synopsis::

----!I

I

b6 b7C

___,f

'7

288_A-SF-1A:S486 (pendi_n~

~NTJ-SEC; UNS-UB (S), et ali .IH~GES.HAC}{ - VICT-I~; COM£iOTER INTJ~USION To Claim St·atist_ics.

I

On September -16', 2009, Special Ag-e~t (S]J.) te_lephonic-ally spoke to ,the vict_im company, Imag-esh..... a-c"""k-, -------, .re,g-arding c-aptioned rnat t er and set a date to meet in per~son. Detai_ls:-

On October 8, 2009, SAlimet wit.ol lof Image_shack and obta med the de~:i_nfoI:mation about the capt Lcned comput er i,nt:rusions. ,Possible s'ubj ect (s) have been :identified.

b6 b7C b7E

SAl

On Noyember 13, 2009,

UNCLASSIFIED

- ---

-~ -

-

-~-- ---

"

~---

-':__c--''---

--==:__::___::_____---=--=

UNCLASSIFIED

To: Re:-

e.

San Fr-ancisco From:- San Francisco 288A-SF-145486-, 11/13/2009

Accomplishment

Information:-

Number:- 2 -Type:- CI? 2703 (f) ORDER SERVED ITU:- crs -tTU:- :LIAISON WtTH OTHER AGENCY' Claimed ~y :-1 SSN.Name:Squad :-~C=Y=2O:-----___' Number e 2 Type:err SUBJECT IDENTI FlED ITU:· err ITU:- LJAISON WITH OTHER AGENCY Claimed By '1· SSN:· Name:- L...-...."..".".,..... ...... Squad:CY2

b6 b7C

Number:- 2 Type:C1P VIC'tIM CON'I'ACTE-D/INTERVIEWED ITU:- bGENT :INTERvtEW -ITU:- CIP °tTU:· INDIVIDUAL/NON-INFORMANT ITU:- .LIAISON WI'tH OTHER AGENCY Clairn_ed SSN:· Name e Squad :·L...-C~Y~2";------"'"

BY:·I

++

UNCLASSIFIED

2

·~'a

"~t

FEDERAL: BUREAU OF:INVES'rIGATION

I>~e, of trltlseriptiQo

a

On 'Dec~'~~~~~~~-w~~~~~~~ f'acsimile from

. 'aforement;:ipned ..lac'simi,le' tb,i,s. documerrt ,

InvestigatiQo File. #

by,_

\

,

Oft,

12/08/2009

,288A-~F~145486:'~

12L Q2_L 20

0 ;1 b6 b7C b7E

~~

~.

"

had been. 'attac.be:d 'and ~i,s':made:'a !;a~t; of

,~ ,_c.;..a.;..'m;..Jpli..b.;..e.;...;;.l,;;,l,:..' _c~' .;.,;a.;,;.l,;;;,i.;,;.f...;,o.;,;.r.;.,;n;.;,;i;.;,;'a;,..' Date,di¢tate4,

_

-NA

--------------------

~

'Thi$ ~t.m'lent oontains neither recomrnendatiol:ls flOf «>n~I\lsiOtl$of the FBI. 11i$ the property of the "it an~ its ¢ontcnU are t.IOC to be distribute4 ou'tsi~ yOUtage~y. . ;

:

fBI aM

is Ioatle~ to Yout ~gen¢y;

b6 b7C

•

f'D·)02 (Rev. 10>-6·95)

"

,.

•

. . 1·


Date of tr~s«iption

0 3/ 0 Z /2 0 1 0

b6 b7C b7E

The abov~ referenced letter had been attached and 1s made a part of thi~sdocument.

Investigation on File /I by

01/23/2010

288A-SF-145486 ~ SAl

This d«urnent cootains nej~r r~ndations II ~ its contents are not to be 4istri~ted

at

CamEbell, California

,?-

I

Date d ietated

b6 b7C

(via .facsimile) NA

Z2b~

ID~ tf }J/ f};,

not con¢lI,lSionsof the FBI. It is the property of the FBI an4 is lQaned to your .ge~y; OIortSideyour agelXy.

•

UNCLASSIFIED·

•

"FEDERAL;BUREAU ·OF INVESTIGATION

:Date~

01/14/2010

To:· .san Fr'ancJsco ;From:·

San Francis'co Squad. Ci'z/sa1 ':

Jose .RA'

,SA,

~----~------------------~

::::::~ B::: ....I---------------'---,..I~ Case ID #:. -Titie:·

(pendingvY

288A-S-F-145486:

AN'T~I:-SEC; 'ON'S'UB(S), et al;' .1MAGtSHACK - V'ICT~tM;, COM:PUTER :IN'tRUSION

'SynoI>sis:·

Details:·

b6 b7C

To Claim Stat:ist'ics. On Jantiar

12

b6 b7C b7E

2010,

'Or),October 8, 200.9, :Ima_geshac,kprovided sA !-ol_ 'hard drtves and consent; 'to search t,bose hard drives.

UNCLASSIFIED

___.I, w:it,b sh(

..-UNCLASSIFIED -To:- San tranc1sco .Re::

288A';'SF':';1~5486:"

From:- San Fr-anc1s-co

•

01/14/2010

Accomplishment_ Information:: NurrlbeI':-

1-

type:- CIP 27-03 (f) 'ORDE:R SERVED I1'U:- crs iTU:: LJAISON' WI_TH,otHE"R ,A~tNC'.( Claimed

BY',:

SSN:

Name:: .__--==--==----_

squads

Nuinbe_r-:-

C';'2

......

b6 b7C

'8

:-rype :. : CIP VICtIM -tD/ .l,N'I'ERVlEWE'O "ITU:: CONSENSUbL SEARCH Claime.d

'~¥:I

ssa.

Name:-

'Squad

'

::L...-,,....C'""x2.,....-----

.....

..

UNCLASStFIED 2

•

FD-302 (Rev, 10..6-95)

-

•

·1. -FEDERAL BUREAU OF INVEsTIGATION

Pate ohl'ao~iption

0:i

L 2 7 12 0 1.2

Agent I I returned six hard, d~ive.s tol at hi_s plac-e of empkoyment; .IMAGESAACK, 2_36 Sant:a Cruz Avenue, L9S G_atos, Ca~_ifornia, 95030. A c-opy of th~ signed :£0"0-597 Unit-ed -St-at-es Department of Justice Fed~r-al 'bure-au of Investigation Receipt :for t>_roperty Rec-eived/R~tu~ned/Released/Sei_zed had been placed in a l~ enveIop and sent to the f_ile.

On April

lnvestigatiotlce file by

*

4/27/2012

2 S SA - SF -1454 'S~

S6

27. 2012. speci1l

cl

at

b6 b7C

Los Gatos, California ~~~~~~~~~~~~---------------------------------------------Date ~ktite4

'_'.;;.N,;.;;.A~

I

nus «loWXIent CQfttlinS ncithet te«>mmen4atiol:l$ not eon~h.lSions 01 the fBI. It is the property it an\i its contents ate not to be distribl.lte4 Ol.l'tsi4eyow .g~y.

_ b6 b7C

'(>( the

FBI and is loaned to yow agency;

•

(Rev.OS..Ql·ZOO8)

UNCLASSIFIED


Precedence: To:

Date:

ROUTlNE

04/27/2012

San Francisco

From:

San _Franc-isco Squad Ct2/Sa~~~~ : S~

~

Approved By: Drafted

b6 b7C

By: (Closed)/'

Case 1D #: 288A-SF-14S486 Title:

Synopsis:

/~

ANT~-SEC; UNSUB(S), et ali IMAGESHACK - VICTIM COMPUTER INTRUSION To Close Captioned

Details: l\ssistant

I

Case.

I

~nit:d State~ 'l\ttorney (AUSA)

I

I and

Special Agent (SA) have discussed captioned investigat~ on -~nd l.S s atus on _numerous occasions. On March 16-, 2012, AU?Al I jn)IUir~d via emai_; -if captioned investig-ati
b6 b7C

I.retut:ned the hard drives -in capt_ioned case back to t_he

It is -recommended that capt_ioned c-ase be closed and that col_lected on c-aptioned case be destcroyed and/of -retut:ned

ct~>~o-': u e l\z~~J-.\\.

UNCLASSIFIED ~

~00ll2~

UNCLASSIFIED

To:- San Eo"rancisco -From:- San ":£i'i'anGlsc'o Re: 288A-S:£i'-~_{S486-, '04/27/2012

put~suant ,to' Eo"Bt policy., -';['he:te~ 'axe 'no pending leads inves tigat,ion: re9:uired:' on capt Ioned case ,

++

,UNCLASsIFIED

2,

01:',f"urthe1:'

,.

U.S. DeI>~rtm.f Justice f(Jnited States Attorney Northern District of California DD: (408) 5)5·5061 FAX:(408) J35·5066

150 Almaden Boulevard, Suite 900 .SanJose; California '95113

Aprfl'18', 2012'

Special Agent Federal Bureau of Investigation ;1919 S>Bascom Avenue, Sulte'400 'Campbell, CA 95008

b6 b7C "

RE': 'JmageShack'Intrusion,

'pear Special-Agent

CJ 1

This letteris to confirm that my office-has closedthe investigation intothe ImageShack .intrusion by agroup known as Anti-Sec, Based on our conversations, you have conducted an ,exhaustive investigation and have been unable to identify the individual responsible for the intrusion .. If'you find new,evidence, 'please re-submitthe casefor prosecution, I appreciate allof'your. work on tlie case. .Please do not hesitate to me if you have any questions. Lean be reached a~ I ,Very.truly ¥ours, ',MEcINDAJIAAG·

AssistantUnited States Attorney

.,

.. j ,

" "

.,

I

'

.'

FEDERAL FOI/PA DELETED FOI/PA#

BUREAU

OF INVESTIGATION


Total Deleted Page(s) Page 6 b6; b7C; b7E;

Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

7 8 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 43

-

-

SHEET

29

b6; b7C; b7E; b7E; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX

1A Envelope Case ID: 288A-SF-145486-1A -------------------------------------------------------------------------------

SF

1 ! !

SF

ORIGINAL NOTES RE INTERVIEW OF~I ~ FD-597 RECEIPT FOR PROPERTY; FD-941 CONSENT TO SEARCH COMPUTERS; ONE CD WITH PRINTED COPIES

2 ! SILICON VALLEY RCFL REPORT OF EXAMINATION DATED 11/17/2009; ! AND 08/09/2010 AND RETURN TO AGENCY RECEIPT DATED 08/19/2010 .! (NO REFERENCE SERIAL)

-----------------------------------------------------------------------------b6 !

SF

3 ! -ORIGINAL PACKAGE COPY FD192 (CHAINS OF CUSTODY) lA'D ! -ORIGINAL 1B2 ENCLOSED

b7C !

SF

4 ! -ORIGINAL PACKAGE COPY FD-192 OF 1B1 (EVIDENCE RETURNED) ! -COPY OF A SIGNED FD-597 ----------------------------------------~-------------------------------------! SF 5 ! FD-597 RECEIPT FOR PROPERTY RETURNED Tol ! IMAGESHACK ON 4/27/12 (REF SERIAL 14) ~. ----------~~ !

., ~

------------------------------------------------------

--------------------~---~'

----------~------------------------------7------~------------------------------

,,

,

,..:

,

.

f''''';'''''''''-'''''

Ml'tllitEl

'. 'J.

~!

I

'&

')

Q

it

"

';

:J' U$$

~ Uti w.."

: P,

f

, '

1

I

j

"

!

,,!f

1o

" ,! ,!

;-

t

; I

\:::;

o

o

, "

.

;.

~

<;

!

FD-340b(ReV. 4-11'()3)

Field Office Acquiring Evidence _~~:::;:',/;.._..

I'

I

_

",'

,

j

'1 1

Serial # of Originating Docnment

,.

f51,c

From ,i ~

.,

<

..

,

, .1

1\)1 of' 'M»)1

Date Received

~~J~ (N~

I I 1 1

r

£.g(t+~r-)t45tf~b.

Fale Number

'

j

"'

,

1

1

!1

k..JI'-a.e VA

ofContribuwrllnterYiewee)

I

,1

~

'

,

,

~

5·(:(1.

By

To Be Returned

,

," ; r

0

..e:( No

Yes

Receipt Given. 0 Yes ffNo Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure

\ s

I

I'

i:

o

Yes,

~o

Federal Taxpayer Information (FTI)

, 1

0 Title:

"

ld"" No

Yes '

Po-lll--5f"v; Ut(!~J 1: SV\ A"Q. fi-rlA"tt-

Reference:

v

!VJ7 Nt

D~~"~\.('~~

_

(Communice.1ion En.closillg Material)

Descriptioll:

6!f

Originalnotes Ie interview of

I

b6 b7C

oj t

,~I J

.. , c

.......

"','."'~""

, .. ".~

..

,

"'_~"¥~

..... "',"''''''''''''o-__.~.'~<.Q.i;.I~rt

..... _j

'.

•

•

•

•

·U.S. GPO:2004-307-714/90013

•

- --"

-

-

-

FD-597 (Rev 8-11-94)

•

-- ---

-

Page

~

•

--

-

-

of

UNITED STATES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property Received/Returned/Released/Seized File #

::z W (1-- 'B£- t-\ ~~

On (date)

---iE2~c_+~ooLJ\-n~c~. -l?.l-;-J

__.p~D~Ol_9-l-.

_

item(s) listed below were: ~Receivect From Returned To D Released To D Seized

o

(Name)~L----.---_-----,:-----;-_J-1

__

~---=-_~~-=--_

(Street Address),__,.j==~"'_P'""'~4~U~e~c~~!...!:,-,-~c=::;\~c..~" -cCl~:;~{.l.c::t""--P\\.o..L)...J.!~~""a."y:.r-."'-Idz4't==-G~C~Y'-4::2"--f./....L..I£b)t..c;..,---'*!..L.....L/~00~__ .::_<'

(City)

--=L=-=:-'?_(~~~;4€:l-....1fu~s:......,.., __;(?I..:.....!..::A-~_

_fj.,.;:,5:::>.-.J,;.O~a~D.t_--------------:..-_

I

Description of Item(s): ~

h.l.

r-d m....r- M(I'_J

_

b6 b7C b7E

~

-

.,.-

./

L Received

L

/"

/

->

-> .>

Received From:

-

->

->

.>

-

b6 b7C

•

FD-941 (2-26-01)

CONSENT TO SEARCH COMPUTER(S) I, ~L

___'I---------' have been asked by Special Agents of the

Federal Bureau ofInvestigation (FBI) to permit a complete search by the FBI or its designees of any and all computers, any electronic and/or optical data storage and/or retrieval system or medium, and any related computer peripherals, described below:

"HPr(2..'O~-Je

:

(

b6

~r~p~TljIS4~2~kie:b~4~Q~d£ejC8~rJ§~e~d~2rl~~I~,,~m~b~er~(~jfE?~1~'2~jl~9~bl~e~\:::::::::::::::::::::::::::::::I~~lr_--_-_-_-_-_-_-_ ~".'

"RrlrimJ

M,d;, CnmmJfe""ripbmJ,

c

control, and/or have access to, for any evidence ofa crime or other violation of the law. The required s, s, and/or specific directions for computer entry are as follows:

_

I have been advised of my right to refuse to consent to this search, and I give permission for this search, freely and voluntarily, and not as the result of threats or promises of any kind. I authorize those Agents to take any evidence discovered during this search, together with the medium in/on which

JU)

OR")

a..D\)~

Date

b6 b7C

Date

Location

July 10th Hack On July 10th, at approximately 7 pm PST, ImageShack's services were compromised by a hacking group named anti-sec. The first complaint came in at 6:59pm pst. Anti-sec gained access to one of our database servers. Server named:

iI

They posted this message after the attach on multiple security threads:

I

This message linked back to the antisec's website:

On Thu, 23 JuI 2009 we received an email froml'provided some information on his site which was also hacked by the same group.

I

email_from email from] attachment: '-------

.....

I Anti-Sec info The group we believe has at least two

I

I

some website ed underl

I

I ._______.

_..~ which he

b6 b7C b7E

,.

August 2 Hack On August 2 early in the morning about 12:50am pst we were compromised again. They were unable to effect s as we stop them in time. We have chat logs of our employee included.

b6 b7C b7E

Chat logs:

Estimated

company loses

\__\ I __\1 C---- I \1

_____ I I_I __ I I \ __ \ I

\ I

______ I I I \ I I I I

I__ I I __ I \1

II __ \_I \ \\ I\ \ _ >\ \1

>\ \1

> \1

Proudly presents ... I I__

C-) '_ , _\ I _' II _' II _\' I __ I

I

___I

'_\ I _' II __ I

II I

I I I I I I I C-I I C-I I __ I x., \ I I I C-I I C--I I_I_I I_I I_I\ __ ,_I\ __ , I\ I I I I_I I_I\ __ ,_I\

<

I_I

\_\ I

__ I I I

Anti-sec. We're a movement dedicated to the eradication of full-disclosure. We wanted to give everyone an image of what we're all about. Full-disclosure is the disclosure of exploits publicly - anywhere. The security industry uses full-disclosure to profit and develop scare-tactics to convince people into buying their firewalls, anti-virus software, and auditing services. Meanwhile, script kiddies copy and paste these exploits and compile them, ready to strike any and all vulnerable servers they can get a hold of. If whitehats were truly about security this stuff would not be published, not even exploits with silly edits to make them slightly unusable. As an added bonus, if publication wasn't enough, these exploits are mirrored and distributed widely across the Internet with a nice little ment embedded in them for the crew or website which first

••

,I

exposed the vulnerability to the public. It's about money. While the world is difficult to change, and money will certainly continue to be a very important in the eyes of many, our battle is that of the removal of full-disclosure for the purpose of making it harder for the security industry to exploit its consequences. It is our goal that, through mayhem and the destruction of all exploitive and detrimental communities, companies, and individuals, full-disclosure will be abandoned and the security industry will be forced to reform. How do we plan to achieve this? Through the full and unrelenting, unmerciful.elimination of all ers of full-disclosure and the security industry in its present form. If you own a security blog, an exploit publication website or you distribute any exploits ... "you are a target and you will be rm'd. Only a matter of time." This isn't like before. This time everyone and everything is getting owned.

Signed: The Anti-sec Movement "No images were harmed in the making of this ... image."

b7E

Replacing images ...

b7E

If you think that we oppose your website, our advise is to pack it up and shut it down, because we're coming for you. - anti-sec.

iProudty presents ... Anti-sec.

We're a movement dedicated

to the

eradiCation of -

isclosure. We wanted to give

everyone a~ jm8g~ of what wet'reall abo4t ·

i

I

FuH-disclosJre is the disclosure of exploi~ publicly - anywhere. e secu'rity industry uses fulldiSClosure:t? profit :and develop scare-tactics to convince into bUying their f rewalis. anti-virus software, and alldi~ing services. '

Meanwhi~e" knpt ~ddies copy and pasaeiihese expJoits and vulnerable Servers lthey can gat a hold ofl If whitehats were published. 'riot. • exploits with silly edits to make them I

. ~ :

'

I if publica.Uonwasn't lenough, these exploits I !"

a nice little ment embedded' inbility to the publ'b.,' '-. .:';, ~,-. . _-.

I~ th.J. ready to strike any and all about se;curitythis stuff would nof ut:'lusable. .-

'

mirrq.red and distributed for the crew or website ...'.... ',..,n. !

-

I"'AI~l.n;I\I

continue to be for the purpose

~Iimination:,6(all own a secvri~

:;iciu wmi~'

o

I,, f

I 'J\:) ~

~'f't=<:;='-:

File Number

I

/1+{pJ

FO-340 (Rev. 4-11-03)

Field Office Acquiring Evidence

_-";";::~=-_-'__

--' __

-'-

_

I. i

Serial # of Originating

'.1,

!

~)<j

Date Receive~

&J;

From

Document.

-:-

_

_"\.::..~_:;' ;._I::.-;D:::;.__

Sv,. Gu.,40-CkP

--'-_

,

ili~ :.f2e.=

I

I.

II

,

i

'(Address)

!

I'

I. •f

(Name ofContribu'ltTlfnitrviewee)

I.

I

!.

t

'By

! i

---S--4A-::::::;'

To Be Returned

j,

, , . 1

'.. 1 . I

I

LI

!

I

I----~~c

Receipt Given !J'1ifo Grand Jury Material - DisseminateOnly Pursuant to Rule 6 (e) Federal Rules of CriminalProcedure

1

I

•

'

T1. ~ .'No. ~

.

!,

DYes

I

V)

I I.

g,.NO

DYes FederalTaxpayer Information (fTI)

\

!,.

CJ...NO

0 Yes 0 Yes

CJ\

\

!

!l-

.;

i Reference:

"-..:....-_ .(Corillnunication Enclosing Material)

I i

I ).

I Description:

S;;'0:

;:

0 Originalnotes re interview of

VL

I~ ~

~7~-)-.R B,".,;-~;: i

-\--. ~ 4

E>Dzlo=

'-t

. fkea, '~;y

& c.,!4{

Ii

!.

R/ I f ,/:l-O{ I> ~\'

,, t

t

r

".i~.."'",,"..""...~""""~·!: ,

.

--~~---

-

_---

,

:

~,

.

'"

,~

.'

'

,t

'f: ' ('J.

.... \..../.J

:

18-1 (Re'~1-26-2007)

/' e-

' '--

$

4600 Bohannon Drive Suite 200 Menlo Park, CA 94025

Silicon Valley Regional Computer Forensic Laboratory

REPORT OF EXAMINATION To:

San Francisco SanJoseRA

SAlL-

Date:

____~

August 9, 2010

Case ID No.: 288A-SF-145486

Lab No.:

SV-09-0162

Reference:

Communication (Request for Service) dated October 20, 2009 Imaging Report dated November 17, 2009

Ref No.:

N/A

Title:

ANTISEC UNSUBS; (V) IMAGESHACK

Date specimen received:

b6 b7C

October 21, 2009

Specimens:

b6 b7C b7E Request:

l

On October 20,2009, Special Agent! Federal Bureau of Investigation, requested that the above noted specimens, property of ImageShack, be examined pursuant to a signed consent form. She requested that the following items be searched for, identified (if present), documented, and reported on by the SVRCFL: 1) Hacking rootkits and logs Summary of Examination:

Attached and made part of this report is Imaging Report dated November 17, 2009. While this report addresses the examination processes, the attached Imaging Report addresses the imaging of the submitted evidence. 0 Page 1 of3 Enclosures:

For Official Use Only

1 2

3

These files were exported to a digital report. The other hard drives provided did not contain anything that appeared to be relevant. Details of Examination:

SAl I provided thd I Legal authority for the examination was provided as a signed consent form that was reviewed by the examiner prior to starting the examination. ~ used the examination image for review. The following processes were performed: 1 2

Derivai ive Evi A.

Disposition of Evidence:

1) All original items.!

~obe returned to submitting aaencv.

2)

288A-SF-145486 SV-09-0162 Page 2 of3 For Official Use Only

b6 b7C b7E

3) ~~ __ ~~ __ ~ __ ~ __ ~~~ ~ until its released to the investigator with this report. 4) Special handling instructions include: a. All files contained on this DVD have the potential to contain viruses and other malicious code exported from the examined computer media. Therefore, this DVD should not be viewed on any networked computer OR any computer connected to the Internet. It is recommended this DVD only be viewed on a standalone workstation designed for the purpose of evidence review. Please consult your systems for assistance and guidance. b. In certain investigations, files and information containing contraband such as pornographic images and trade secrets may have been discovered and copied onto this DVD. This can also include pornographic and obscene images of children. Extraordinary care must be taken to safeguard this material and properly secure it when not being used for investigative or legal purposes. The SVRCFL recommends this DVD be secured in appropriate storage, such as an evidence facility, when not being reviewed by the investigator. c. File attributes such as time/date stamps are dependent on several factors such as computer date/time settings and time zones. Where possible and feasible, dateitime attributes have been preserved and details can be found in the electronic report contained herein. d. THIS DVD SHOULD NOT BE DUPLICATED or DISSEMINATED to parties outside of the requesting law enforcement agency or prosecutor's office without first consulting with Silicon Valley RCFL. e. This DVD is intended primarily for law enforcement and prosecution use. It is not recommended that this DVD work product be used for evidentiary hearings, trials, or other official proceedings. If any contents of this DVD are needed for a legal proceeding, the Silicon Valley RCFL should be ed so that the relevant items can be provided in a form suitable for these purposes.

b7E

b6 b7C Examiner:

Silicon Valley Regional Computer Forensic Lab Computer Analysis Response Team

288A -SF-145486 SV-09-0162 Page 3 of3 For Official Use Only

18-1 (Rev. 3-26.-2007)

"

'" 4600 Bohannon Drive Suite 200 Menlo Park, CA 94025

Silicon Valley Regional Computer Forensic Laboratory

REPORT OF EXAMINATION To:

San Francisco San Jose RA s.A...... 1

Date:

----'

November 17,2009

CaseIDNo.:288A-SF-145486

Lab No.:

b6 b7C

SV-09-0162

Reference: Communication (Request for Service) dated October 20, 2009

Ref.No.:

N/A

Title:

Image Shack

Datespecimensreceived:

October 21, 2009

Specimens:r------------------------------,

b6 b7C b7E Request:

Refer to the final Report of Examination for information on services requested. This report relates to the imaging processes only. Summaryof Examination:

Digital evidence media items were imaged to media to be retained as archives, and to staging media for future forensic examination by an assigned forensic examiner.

Enclosures:0

Page 1 of3 For Official Use Only

Details of Examination:

Prior to conducting any forensic process, I reviewed the legal authority, presented as a "Consent to Search" form. Upon submission to the SVRCL, each submitted item was inventoried. As part of the inventory process, each item was assigned a unique SVRCFL bar code, and was entered into the SVRCFL evidence system. Where appropriate, make, model, and serial number for each imaged item was recorded, and each item was digitally photographed. To preserve the original evidence and minimize any risk of damage to the original, an exact copy of the -accessible data located on the evidentiary items was created onto staging media. (The exact copy will hereafter be referred to as an image.) The images were created using approved and appropriate forensic imaging software to write to forensically clean staging media prepared for use in an examination. Unless otherwise noted, the original evidence was write-protected using a hardware-write protection device to prevent any unintentional or accidental destruction or modification of the original evidence. An archive copy was also made using approved and appropriate software. The staging media will be used in the examination phase to further satisfy the request, while the archive copy will be retained in the SVRCFL evidence control room in order to preserve the evidence should it be required in the future for authentication or court processes. b7E

L...-__

.....I1

All the original evidence was returned to the SVRCFL evidence control

room. The following processes were performed during imaging of the original evidence: Physical Examination of Evidentiary items Write Protect Media Hardware Geometry and System Information Create Image

b7E NlA

SV-09-0162 Page 2 of3 For Official Use Only

--------------------------------------------

Verification Items ima ed: 1.

2. 3. 4.

5. 6. Derivative Evidence (DE) generated during the course of this examination includes thefollro~~~·n~ _, 1.

b7E

2. 3.

4. 5. 6. Stagin media used durin the course of this examination includes the following: 1.

Disposition of Evidence:

All original evidence items returned to the SVRCFL evidence control room. All DE items will be retained in the SVRCFL evidence control room for a period of five years in order to preserve the evidence in the event additional forensic processes or legal proceedings require its use. After this time, the DE will be returned to the requestor's agency for disposition. This imaging of this case is complete. The staging media will be given to an examiner for additional forensic processing. b6 b7C

Silicon Valley Regional Compter Forensics Lab Computer Analysis Response Team

N/A

SV-09-0162 Page 3 of3 For Official Use Only

Return to Agency Evidence Receipt

Silicon Valley RCFL Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050

SV-09-0162 Evidence Details Total numberof evidenceitems processedon this receipt:9

Description: MediaContainer:AccordionFolder StorageLocation:[Undetermined] Make:

Model:

Serial Number:

Case 10 I Lab number: SV-09-0162

SVE028018

Agency Case Number: 288A-SF-145486

i.an Designation, lJeslgnatlon t:xpl.: Not Examined(NE), [No designation explanation)

Intake Container I Seal: None I None

ECF Container I Seal: PlasticBag I Heat Seal

Intake Damage: [No damagerecorded]

Tracking Number:

Description: Hard Drive:HOD StorageLocation:[Undetermined]

riliJh~·

Model:

I

I

I

I

I

I

SVE028019



Lab Designation / Designation Expl.: Ouestioned(0), [No designationexplanation]

Intake Packagmg: [Not recorded)

ECF Contamer I Seal I Packaging: [Not recorded)


Tracking Number:

Description: HardDrive: HDD StorageLocation:[Undetermined]

b7E

Make,

I

I

I

I

Mode'·

I

SVE028020

Case 10 I Lan numner: SV-09-0162


Lab Designation, Designation Expl.: Ouestioned(0), [No designationexplanalion]

Intake Packaging: [Not recorded]

ECF Container I Seal I Packaging: [Not recorded]

Intake Damage: [No damagerecorded)

Tracking Number:

Property I Evidence Receipt Date me Date/Time 08/1912010 12:30 PM

Released sy

I

tI

Received sy

't

r~VRCFL

(Phone:OOO'()O()'OOOO)'

I

NnmclQ aepCY

~FBI(Phone:

b6 b7C ·Indlcates

the WJtne:ss Ole

3

o


Silicon Valley RCFL

= Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050


Description: Hard Drive:HDD StorageLocation:[Undetermined] Make·

I

I

I

Serial Number:

J

I

Mode:

I

SVE028021

Case 10 I LaOnumoer: SV-09-0162

Agency case rmmDer: 288A-SF-145486

Lab DeSignation I Designation Expl.: Ouestioned(0), [No designationexplanation]

lntake Packaqing: [Not recorded]

ECF Contamer I Seal I Packaging: [Not recorded]


Tracking Number:

Description: Hard Drive:HDD StorageLocation:[Undetermined]

I

Model:

I

I

I

SVE028022

case IU I Lao number:

I

SV-09-01B2


Lab Designation I Designation Expl.: Ouestioned(0), [No designationexplanation]

lntake PacKagmg: [Not recorded]

ECF Contamer I Seal I PacKagmg: (No! recorded]


Tracking Number:

b7E

Description: Hard Drive:HDD StorageLocation:[Undetermined] Make-

I

Ser al Numoer:

I

I

I

SVE028023

Case 10 I Lao nurneer: SV-09-01B2

I


Lab Designation I Designation Expl.: Questioned(0), [No designationexplanation]

Intake Pacl
ECF Contamer I Seal I PacKagmg: (Not recorded]


Tracking Number:

Property I Evidence Receipt uate nne Date/Time 08/1912010 12:30 PM

KeleaseClsy

I

:

N9mc/AgGDG~ VRCFL (Phone:

RecelveClBy Name/OgeDe"

OOQ..O()().OOOO) •

IFBI (Phon.:

I

b6 b7C

Sig

'ndlCOltes the Witness acted as an

"""""

-ClY" ~ f 3 Document Generation Date: 08/19/2010


Silicon Valley RCFL Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050


Description: Hard Drive:HDD StorageLocation:[Undetermined]

I

I

I

b7E

II Case 10 LaoI number:

SVE028024

I

I

SV-09-0162


Lab Designation I Designation Expl.: Questioned(Q), [No designationexplanation]

lntake PacKaging: [Not recorded]

ECF Container I Seal I PacKaging: [Not recorded]


Tracking Number:

Description: MediaContainer:plasticbag StorageLocation:[Undetermined] Make:

Model:

sertat Numller:

Case 10 I Lao numner: SV-09-0162

SVE030246

Agency Case Number: [No AgencyCase Number]

Lab Designation I Designation Expl.: Not Examined(NE). [No designation explanation]

Intake Container I Seal: None I None

ECF Container I Seal: Paper Bag I Heat Seal


Tracking Number:

Description: DVD: digitalreport StorageLocation:[Undetermined] MaKe:

MOclel:

Serial Number:


SVE029747

Agency Case Number: [No AgencyCase Number]

Lab Designation I Designation Expl.: DerivativeEvidence(DE).[No designation explanation]

Intake PacKagmg: [Not recorded]

ECF Container I Seal I Packaging: [Not recorded]

Intakeuamage: [No damagerecorded]

Tracking Number:

Property I Evidence Receipt Date ime OatelTlme 0811912010 12:30 PM

Ke easeo tly NamclAgency Jann Hayes, SVRCFL (Phone: 000-000-0000) •

xece vea tly Name/Agency

MelanieAdams. F81(Phone: 408-99~633)

b6 b7C -Indicates the Witness Dele

f3 10

·"~f'·..., \'

,,

,

·1

Q FD-340 (Rev. 4-11-03)

File Number

_.

~f- t4'5~Ab

J: rel="nofollow">%2> A


~

--_.:::3"".ctF---'--------------

Serial # of Originating Document

_ ' _,... :;

-Date Received .

IfJ - ~

From

_

-,

L

4 \ ~'\ !~~( "' \ --r~~

\.

, r

.

(Name'of Contributor/Interviewee)

• ...;1:,

:.

_

(Address)

(City and State)

b6 b7C

~--_r---------------------------

BYL_ To Be Returned

0 0

0 0

Yes

No ,I

Receipt Given Yes No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) FederalRules ofCriminal·Procedtire No DYes .:

o

•

Federal Taxpayer Information (FTI)

0' Ti~e:

--If """'-p

~t\

ONo

Yes

,

.

: :,_.':".;:;:_.;...

0 ~ /'I

.~,

....

. :'

.,{: Rererence:

~-----------------------(Communication Enclpsing Material)

i,:.

,

'"

/'

;, I!i "

.

\

1, •

•

.~. I'

. '". ~

.;;.

,

... ~

08/19/10 19:29:55

ICMIPR01 Page 1

FD-192

Title and Character of Case: ANTI SEC Date Property Acquired:

Source from which Property Acquired: SV-RCFL

08/19/2010 Anticipated Disposition: Acquired By:

Case Agent:

I

b6 b7C

Date Entered

Description of Property: 1B 2 ONE (1) CD LABELED SV-09-0162 (DERIVATIVE EVIDENCE OF 1B1) Barcode: E4189947

Location: SJECR

r,,1 , t1

PRESS3

v-,

'

.....

Case Number: Owning Office:

288A-SF-145486 SAN FRANCISCO

..

08/19/2010

.....

I' .".,

•

.."I

'

....'

'_ .... ',.,.

.j.iC.' •

¥

FD-IOO4 Revised 9-16-2009


EVIDENCE CHAIN-OF-CUSTODY

Evidence Type:

o General

o Drug

)Zf CART

nValuable

o Firearm/Weapon o Firearm/Other

Special Handling Instructions

o o o o

Batteries HAZMAT Reg, Charging Other

o Biohazard o Latents o None

o o

FGJ Refrigerate

Signat

11)~)lu

Printe

Signature:

do

3.?y_

-

Printed Narr Reason:

~,~I Relinquished Custody

r

4/.11(12-

S\~

Reason:

/0 l-rt

Printea Namel Reason:

Signature:

Printed Name:

Printed Name:

Reason:

Reason:

Date and Time

Accepted Custody

Signature:

Signature:

Printed Name:

Printed Name:

Reason:

Reason:

Relinquished Custody

Accepted Custody

Date and Time

Signature:

Signature:

Printed Name:

Printed Name:

Reason:

Reason:

Firearms Certification: Printed Name: CaseID:

Signature:

~8~A - Sf - (4548'blB:__ .2...=-

\0

~~3er'

Date and Time

rJD-l3/

://4-,'01 Accepted Custody

Date and Time

~ \~l

l L/'27/1z

Sign t-

Signature:


y

Accepted Custody

Date and Time

Signature:

-

PrintedNam

2.../

. Relinquished Custody

Date and Time

Accepted Custody

Date and Time

~)1 /J;) 1~/'·.dt2.-v

)J.,SVf"""

Reason: Collected


Reason:--r.:;-

Date and Time

Initial Receipt

Date:

Date and Time

Date and Time

Date and Time

_

Barcode:_"""'E~4,-.;...>\R1....---,---I-?4-1-r_-q--

b6 b7C

.,

..

')1,1

;'"

'.

1~'

FD-340b (Rev. HI-03)

,

,

File Number

cfl.eJA·,- <; F· 145 4 g-:c


----1oS!..If------·---

~~..... "~" - ...... t '.;.._~

Serial # of or:ginating D.ocU~)nt

4 / 3D L .,£ () 1
Date Received'

.From

(Name of Contributorllntcrviewee)

t-~-~

(Address)

I-

~L:---------I~r -

b6

I. f

b7C

B~

'\:::i~:-:.' '.r .A~.~~>:.;~'~'-.._. _~ .

-c

.-,- -,'" ...'. mz:;~..:.'z..\'.).\:'tk;~ '" ~":';"_.~\ -c, •

1<.,'..•.,

d,,<:: " " .'.

To Be Returned DYes 0 NQ Receipt Given 0 'Yes 0 'Grand Jury Material" Disseminate Only Pursuant to Rule 6 (e) ....~ed~ral Rules of Criminal Procedure -, . , DYes No

No

.

q

Federal Taxpayer Informatlon.ff'Tf) .: DYes' ::-"".,

D

No

.flAJ \ T( ..TI

Title:

. '.:

Referencee .--

~~-':--:----_ (Communication Enclosing ¥.tcri~I)'

,

,/

P""'P.OOI

0

Original notes re intervlew of

-D:r~1tt!::19:!fr I' -~d ~ hitred -s'/p L tcl· Oy

.. ,.~~

I

f;O

,J_....8 g_A_-_g~f__14j~'54...;.,;;;.;;o.~b~' ....... l,!\oiiIiIW' :f ' #;'' 4~~,

I.

...

' ..

.--

• A'

"

'';-10/21/09 12:08:07

ICMIPR01 Page 1

FD-192

Title and Character of Case: ANTI SEC Date Property Acquired:

Source from WhiTh Property Acquired: IMAGESHACK, C/O_ 1263 N. SANTA CRUZ 263 N SANTA CRUZ AVE #100 LOS GATOS CA 95030

10/08/2009

Case Agent:

Anticipated Disposition: Acquired By:

I Date Enteredb6

Description of Property: 1B 1

Barcode: E4189643

Case Number: Owning Office:

Location: SJECR

b7C b7E

PRESS3

10/09/2009

288A-SF-145486 SAN FRANCISCO

(Ib/)

FD-IOO4 Revised 9-16-2009

FEDERALBUREAUOF INVESTIGATION

EVIDENCE CHAIN-OF-CUSTODY

o Drug o Valuable

Evidence Type: 0 General ~CART

o Firearm/Weapon o Firearm/Other

Special Handling Instructions

o o o o

Batteries

HAZMAT Req. Charging Other

o Biohazard o Latents o None

o o

r bJ'" "JJ2..r.r

I

Printed Name


_.......

Reason:

Reason:

Date and Time

I

(t"]i?/.),-

Reason:

'to

rn I

Signature:

,0

I

---=S~f---L!=14::::J=..-.=.5......:A~R:0L.=...· _

(tJCJ~ Date and Time'

I

J

IO·.~.£.o.....

['.K@

Sign t-Printed Name:

...) {)

e-: .r.:>_...J Date:

~=__

Date and Time'

'/)2))z.

-

Signature: 1B: __

II

Accep~edCustody

Reason:

v/I~I (0

printedNa~

I~K.p1'l'....Reason: ~tOJb-9\,e_-

4/~1(Itl I

Firearms Certification: Printed Name: . Case ID:

loft-l/rYj

Accepted Custody

Date and Time

I

1

l

g"/l<1)

711-iYL Date and Time

aAf.?OulJ'l J

Reason:


Printed Name:

Accepted Custody

Printed NarvJ

l

Signaturel

l )O/2A/b7

~

Reason: ·T~/'J._~i:::tLo •..;t--::k;_....&dZCJ!!l

----

"I/-IA -c ,.,.... \- -10

..

Date and: . Time

AccepVedCustody

Signature:

SignaJ Printed Name:

(OOnn •

~I[C:tQO

Date and' Tim~


7

Reason:

Printed Name

q~

I

SA- J

IO{'l/1J4

Printed Name

Io A-tv-.

lolz{/o~

Date and Time

Signature:

10)"/d7 Date and Time

signat~

Printed Name:

/ : ~Pr-... Accepted Custody

if.


Signature:

I

Date and Time

Printed Name]

Reason:~

Printed Name:

/0/Dft')IJ7

Reason: Collected

~

-r:

l-

Signat

FOI Refrigerate

Relinquished. Custody

Reason:

Date and Time

Initial Receipt

Barcode:

L

lD~~

_

--.l..::t:::.....£4-4-R1'f~Cj~r;:::....::4'=f--"'):...._

b6 b7C

.. EVIDENCE

CHAIN-OF-CUSTODY

Continuation Page Relinquished Custody

2=

Signa~ Printed Name:

I

QO.11

Reason:

r:.....j

Accepted Custody

Date and Time


b6 b7C

Signature:

~/~II~

Printed Name:

IJ-'cg;_

Reason:

Accepted Custody

Date and Time

Signature:

Signature:

Printed Name:

Printed Name:

Reason:

Reason:

, Relinquished Custody

...

Date and Time

Signature:

Printed Name:

Printed Name:

Reason: '

Reason: .

Signature:

Signature:

Printed Name:

Printed Name:

Reason: ;

Reason:


Printed Name:

Printed Name:

Reason: '

Reason:

"

Date and Time

Signature:

-

Reason: '

Case ID: _

Accepted Custody Signature:

Printed Name:

Printed Name: Reason:

. O.fLf

__.,2L=--,-+-~

r:

/4C"4 _,__J__

w-

-'-~-=-F-;___~

IB:

-1-

Date and Time

Date and Time

~

Signature:


,

Accepted Custody

Date and Time

Signature:

...

Date and Time

Accepted Custody

Date and Time

Date and Time

,

Accepted Custody

Signature:

, Relinquished Custody

Date and Time

Barcode:

Date and Time

•

"

EVIDENCE CHAIN-OF-CUSTODY Continuation Page Relinquished Custody ,

Accepted Custody

Date and Time

Signature:

Signature:

Printed Name:

Printed Name:

Reason:

Reason:


Accepted Custody

Date and Time

Signature:

Signature:

Printed Name:

Printed Name:

Reason: ,

, Relinquished

Custody

Date and Time

.

~,

Date and Time

,

Reason: .

Date and Time

Accepted Custody

Signature:

Signature:

Printed Name:

Printed Name:

Reason: :

Date and· Time

•

Reason: '"

, Relinquished

Custody

Date and Time

Accepted Custody

Date and Time

:

,

Signature:

Signature:

Printed Name:

Printed Name:

Reason: ;

Reason:

.

RelinquisoeaCiIstody

- -

- - Dai£an-dTime

--

-

..

---AccepfectCiistody

Time ~

Signature:

Signature:

Printed Name:

Printed Name:

"

Reason: .

Reason:

Relinquished

Custody

'""'" ,

Date and Time

Signature:

Reason: .

. _._~-~'---=.-__ - ..:.. __

-'--

IB:

Accepted Custody

Date and Time

Signature:

-.

Printed Name:

,.

Reason:

..

Printed Name:

Case ID: __

Datearrd+l

-'--

.!. ,.,

Barcode:

--,

- :

:

-597 (Rev 8-11-94)

I'"

Page

!

_-I-'r__

I

of

I

UNITED STATES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property Received/Returned/Released/Seized

On (date) --f'i/&.-L-ffin.~~'___'__1+-·I____.CJ-=-7~"7-( ___,d=-p"'-'I'-'<:::2.::::='

(Name)JL

_

item(s) listed Received OCReturned Released Seized

o o o

below were: From To To

-r-_j---:---/7n~--\--:----------'-~'

(Street Address)...,---"=- .......... "---'Z-"-f.L.::.-'-!.-=---"...<..;:o""""~_,_-"'-"..........:...._..:p-.;.__,.~~~~~4""--'--=-'..__

. _

b6 b7C b7E

Description of Item(s):

"

t ..

b6 b7C

Received By:

Received Fr

---------~------~--~==---

'(

o

o

18[£)

FO-340 (Rev. 4-11-03)

-=2=--~~-l-·tt.!_,.......::n:.....J6=~----!..t--lI.f:......5~-Vc':p~L...:.'1-,:s......,---

File Number __


Sc

-~~J---_-r-

if ,27 /)..Dn.

Date Received _

_

ILf

Serial # of Originating Docrment

From

_

Federal Bureau of Investigation 1919 .S. Bascom Avenue Suite # 400 Campbell, CA 95008 (City and State)

~I

By

To Be Returned 0 Yes -B-1'io Receipt Given 0 Yes ..g-,q:o Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules ofCrirninal Procedure DYes Federal TaxpayerInformation (FTJ) 0: Ye's

•

.Q-NO .....Q.No

Title: b6 b7C Re~r~ce:

/'

Description:

~-~~~~~--~~---------------

(Communication Enclosing Material)

0 Original notes re interviewof

ru-6-!]

&Jb::-;~

f2e.Mte-, Iff? __ /

.;:.

I~

I?

tA-CS)

, ..

FEDERAL FOI/PA DELETED FOI/PA# Total Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

BUREAU

OF INVESTIGATION


Deleted Page (s) 9 - b3; b6; b7C; 11 - b3; b6; b7C; 18 - b3; b6; b7C; 20 - b3; b6; b7C; 26 - b3; b6; b7C; 27 - b3; b6; b7C; 28 - b3; b6; b7C; 29 - b3; b6; b7C; 35 - b3; b6; b7C; 38 - b3; b6; b7C; 39 - b3; b6; b7C; 40 - b3; b6; b7C; 43 - b3; b6; b7C; 44 b3;

45 47 50 55 57

-

b3; b3; b3; b3; b3;

b6 ; b6 ; b6 ; b6 ; b6 ;

SHEET

19

b7C; b7C; b7C; b7C; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX

•

•

....(!<$"'~0\1.31-2003)


To:

Date:

ROUTINE

Precedence:

ATTN: Computer Intrusion Unit #2

Cyber Division

SSA From:

I

San Francisco Squad CY-2/Sarn~J~o~s~e~RA~ : SA~

Approved Drafted

I

~ ~ b6 b7C

By: By:

10/08/2009

I

I

/4Slfmt5

I

Case ID #: 288A-SF-~

(pending),-l~ 288A-SF-NEW-GJ (Pending)? l

Title:

ANTI-SEC; UNSUB(S), et ai; IMAGESHACK - VICTIM; COMPUTER INTRUSION

Synopsis:

To Open'Case and subfiles.

On October 8, 2009, Special Agent (SA)I with employees of IMAGESHACK located at 236 North Santa Cruz Avenue, Los Gatos, California, 95030, to discuss two recent computer intrusions of IMAGESHACK servers. IMAGESHACK is a company which provides internet image hosting. Details:

I met

IMAGESHACK advised SAl Ithat the first computer intrusion occurred on July 10, 2009 at approximately 7 pm Pacific Standard Time (PST). A group by the name of ANTI-SEC gained access to one of t~e company database servers. The server the hacker(s) accessed_ I for IMAGESHACK customers to include I I

b6 b7C b7E

~

~~I. In addition, the ac er s pos e a message on e internet which claims the ANTI-SEC is a movement dedicated to the eradication of full disclosure. Their message further explained they plan to achieve this "through the full and unrelenting, unmerciful elimination of all ers of full-disclosure and the security industry in its present form."

()41t {OIOOl

/fPt /)U

b6 b7C

I

-

~

• v

t... To:

Re:

San Francis~ From: San Francisco 288A-SF-NEW, 10/08/2009

•

IMAGESHACK advised this computer intrusion affected aRproximately 50 million images and every that was on their b6 b7C b7E

On August 2, 2009, IMAGESHACK believes the same hacker(s) came back and gained access to their servers again. IMAGESHACK has full and com lete 10 s. It is a arent the hacker s

b6 b7C b7E

Jui b6 b7C b7E

the August attack able

IMAGESHACK

believes the

to

~~~~I IMAGESHACK I $26,000.

estimates

It is requested

their losses at approximately

that the following

Grand Jury

subfiles be opened:

SUB GJ

It is requested that the new case and subfiles be opened and assigned to SAl I

••

2

b6 b7C

;

:J

,",

•

•

.~,

I

u.s. Department

of Justice

Federal Bureau of Investigation

In Reply, Please Refer to FileNo.

/

450 Golden Gate Ave. San Francisco, CA 94102 (415) 553-7400

288A-SF-145486-GJ~~

Nov.embe r 10, 2009 Honorable Joseph P. Russoniello United States Attorney Northern District of California 450 Golden Gate Avenue San Francisco, California 94102 Attention: Assistant United States Attorney

b6 b7C

ANTI-SEC; UNSUB(S), et ali IMAGESHACK - VICTIM; COMPUTER INTRUSION Dear Sir: Pursuant to the above captioned investigation, the Federal Bureau of Investigation (FBI) requests that the below listed individuals be placed on the Federal Grand Jury 6E list, in as much as they may require access to grand jury information during the course of the investigation: NAME

AGENCY FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI

POSITION Special Agent Special Agent Special Agent Special Agent Special Agent Special Agent Special Agent Supervisory Special Agent Intelligence Analyst SST Evidence Control Technician Evidence Control Technician

b6 b7C

•

Should you have any questions regarding this matter, please do not hesitate to r-=s""'A_,_,_I San Jose Resident Agency, telephone number ....I ___,

-...J1

b6 b7C

Sincerely, Stephanie Douglas Special Agent in Charge

By: Supervisory Special Agent

2

b6 b7C

'.

.

-

.

ED-302 (Rev, 10-6-95)

•

'

;

- 1FEDERAL BUREAU OF INVESTIGATION

Date of transcription

GRAND JURy MATERIAL

- DISSEMINATE

PURSUANT

12/14/2009

TO RULE 6(e)

~1

On December 14, 2009, Spectal Agent~(~S~A~,)_~I served a Grand Jurv subpoena via. facsimile tol I

attached

Investigation on File # by

I

The file copy of the Grand Jury Subpoena and is made a part of this document.

""?: I

[

b6 b7C

I

has been

(via facsimile)_

12/14/2009 at Campbell, California ----~----------

288A-SF-145486-GJ

SAl

The subooena I

r

b3 b6 b7C

Date dictated'

NA

.1

This document contains neither recommendations nor conclusions of-the FBI. It is the property of the FBI and is loaned to your agency; it and its contents, are not to be distributed outside your agency.

d(

I

.~-

:A0110 (Rev.12/89) Subpoena to Testify Be~

•

•

and Jury

Wniteb ~tates 11Bistrirt<1:ourt NORTHERN

.'.

CALIFORNIA

DISTRICTOF

TO:

r

SUBPOENA TO TESTIFY BEFOREGRAND JURY IBPOENA EOR'

b3

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States.District Court at the place, date and time specified below.

PLACE

COURTROOM

United States District Court 280 South First Street San Jose, CA 95113

As directed by the court

DATEANDTIME January 6, 2010 at 9:30 a.m.

YOU AREALSO COMMANDED to bring with you the following document(s) or object(s):*

Please see attachment. Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena and no appearance will be necessary.

IZI Pleaseseeadditional information on reverse. This subpoena shall remain in effect until you ar'~~~WJ~~JNlepart behalf of the court. ¢'Q' . (>0

R

by the court or by an officer acting on

(';.

~U~.S~.M~A~G~IS~TRA~TE~ruD~~G~E~O~R~C=L~E~RK~O~F~C~O~UR~T~~~~ ~~~~~---------------------------RICHARD W. WIEK!NG December 11, 2009

U.S. ATTORNEY

This subpoena is issued on application of the United States of America

JOSEPH P. RUSSONIELLO United States Attorne * If not

applicable, enter "none".

b6 b7C

'AOll0

(Rev. 12/89)

Subpoena

to Testify Bef.and

Jury

RETURN OF SERVICE (1) DATE

RECEIVED BY SERVER

PLACE

j d- ) ) 't J d-O''()

,

UAlt

SERVED

b3 b6 b7C

1"1

1'.).- ) \ \.f I ')_-L) o i

::.tKVtU UN lI"KINI NAlllt)

.

::.tKVtU tH ll"'KIN I NAMt}

p(L~J1

,S

~-

TRAVEL

~

STATEMENT OF SERVICE FEES

I

SERVICES

.i->

ITOTA~

DE'CLARATION OF SERVER (2)

I declare under penalty of perjury under the laws of the United States of America that the foregoing information contained in the Return of Service ~nd Statement of 1:', .,,; Fp.p.<: is trueand r.n rect Executed on

fY'a be-~M DATE

).Do, ,

"Ffj;-

,

) '7;
A_;, \'

1>P-J/6l)

/.~MA

, ADDRESS OF SERVER

!lif~'I2~

~

/7,,-:r

9({!)(_)..{Y'

-

ADDITIONAL INFORMATION

~Vttj

y/.{_

~)'~/~

fII

(1) (2) ,

As to who may serve a SUbpoenaand the manner of its service see Rule 17(d), Federal Rules of Criminal Procedure, or Rule 45(c), Federal Rulesof Civil Procedure. "Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rulesof Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs (28 USC1825, Rule 17(b) Federal Rules of Criminal Procedure)".

•

FD-448 (Rev. 6-2-97)

.,

•

'

FBI FACSIMILE COVER SHEET

PRECEDENCE

CLASSIFICATION

D

D Top Secret D Secret D Confidential D Sensitive

Immediate

D Priority [ZJ Routine

Time Transmitted: Sender's Initials: .,LI __ Number of Pages: _4=-(including cover sheet)

--L

_

_

[ZJ Unclassified Date:

To:

12/14 /2009

Name of Office

Attn: Room

From:

Telephone

b3 b6 b7C

FBI San Francisco - San Jose Office Name of Office

Subject:

Preservation Request

Originator's Name:

Special Agent 1

Originator's Facsimile Number:

L--

ITelephone: ....1 '--

.1__---

_

Approved: Brief Description of Communication Faxed:

_

WARNING Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information, disclosure, reproduction, distribution, or use of this information is prohibited (IS.USC, § 641). Please notify the originator or the local FBI Office immediately to arrange for proper disposition.

FD-302 (Rev. 10-6-95)

• - 1FEDERAL BUREAU OF INVESTIGATION


12/14/2009

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) b3 b6 b7C

On December 14, 2009, Special Agent~(s~A~)~I------------~l served a Grand Jury subpoena via facsimile tol

r

The file copy of the Grand Jury Subpoena has been attached and is made a part of this document.

~.

Investigation on File # by

12/14/2009

----------------

at

Campbell, California

(via facsimile)

4--~==========~--------~~-----~------------------~ S_A;I _rI-------------~~c 288A-SF-145486-GJ ......

Date dictated

NA

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. _____________

..J

t.A0110 (Rev. 12/89) Subpoena to Testify Befo.nd

•

Jury

mlniteb ~tate5 1!listrirt QCourt NORTHERN

DISTRICTOF

CALIFORNIA

TO: SUBPOENA TO TESTIFY BEFOREGRAND JURY SUBPOENAFOR:

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the-United States District Court at the place, date and time specified below.

COURTROOM

PLACE

United States District Court 280 South First Street San.Jose, CA 95113

As directed by the court

DATE AND TIME January 6,2010 at 9:30 a.m.

YOU ARE ALSO COMMANDED to bring with you the following

document(s) or object(s):*

Please see attachment. Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena and no appearance will be necessary.

IZ1 Pleaseseeadditional information on reverse. This subpoena shall remain in effect until you ar~~~fi/;i~ behalf of the court. .~'>' .

~ U.S. MAGISTRATE JUDGE OR CLERK OF COURT RICHARD W. WIEKING December 11, 2009

This subpoena is. issued on application of the United States of America

JOSEPH P. RUSSONIELLO United States Attorne * Ifnot applicable, enter "none".

b3 b6 b7C

.~~

•

,

, AOll0

(Rev. 12/89) Subpoena to Testify Bef

rand Jury

RETURN OF SERVICE II) DATE

PLA

RECEIVED BY SERVER

1~))LjJ'UnJ1 UAIt:

SERVED

PLALt:

/2) IV jZODj

!>I:KVI:U UN (pKINI NAIIlI:)

I SERVED BY (PKIN I

NAMt:)

IIILt:

Spe

..»

STATEMENT OF SERVICE FEES

TRAVEL

I

~-

b3 b6 b7C

-

tt--~+

I

SERVICES_______________

TOTAL

~

DECLARATION OF SERVER (2)

I declare under penalty of perjury under the laws of the United States of America that the foregoing information contained in the Return of Service and Statement of Service Fees is true ann correct Executed on

t'1.Ji Oe,~/!/L. ka1 )_OU! DATE

r0.J./ ~f-1

S" AhO,-Otv-.. Ih--P.

.

rfL~()

ADDRESS OF SERVER

.t~.~ p/,dL ADDITIONAL INFORMATION

fplrleA V/'A.

teo,.,

(lA-

96{)O(~

<~

~

(1) (2)

As to who may serve a subpoena and the manner ot its service see Rule 17(d), Federal Rulesot Criminal Procedure, or RUle45(c), Federal Rulesot Civil Procedure. "Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs (28 USC1825, Rule 17(b) Federal Rules of Criminal Procedure)".

>

•

Fb-448'-(Rev. 6-2-97) I

•

" .

FBI FACSIMILE COVER SHEET

PRECEDENCE

CLASSIFICATION

D Immediate D Priority

D D D D

Time Transmitted: Sender's Initials: L:J -===-----Number of Pages: ___;3'-(including cover sheet)

Top Secret Secret Confidential Sensitive [Z] Unclassified

[Z] Routine

Date:

To:

_

12/14/2009

Name of Office

:-jL J

Facsimile Num_b_er-:-:: Attn: Name

From:

FBI

San

--=:--:---:-

....a..--:::--

Room

Francisco _ San Name of Office

Jose

_

Telephone b3 b6 b7C

Office

Subject:

Originator's Name:

Special

Agent

Originator's Facsimile Number: L

I

ITelephone:

L-

....J------

J--------------------

Approved: Brief Description of Communication Faxed:

-,..

WARNING Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information, disclosure, reproduction, distribution, or use of this information is prohibited (IS.USC, § 641). Please notify the originator or the local FBI Office immediately to arrange for proper disposition.

•

FD-302 (Rev. 10-6-95)

•

j)

- 1-



12/29/2009

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) received

On December 23, 2009, Special Agent (sA)1 a response to a Federal Grand Jury Subpoena

(~r_Qm_1 ..._

T_h_e_r_e_S_p_Q_D_S_e __ i_D_C_l__.l]ded the following

1

~I

Vla facslmlie

....J

LI

b3 b6 b7C

The above referenced response provided byl has been attached and is made a part of this documen~t~.------------------~

Investigation on

12/23/2009

at

File #

288A-SF-145486/GJ

/2

~

SAl

I

Campbell,

California Date dictated

(via facsimile) ,.N_A

..................... ...,

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.

b6 b7C

~------------------------------~Cl~5~1 -7

18002234893

~ 12/23/2009 12:28 PM

14085581096

FBI CYBER

4085581.

12/14/2009 16:13

~

PAGE 01/04

FD·448 (Rev. 6-2-97)

FBI FACSIMILE

COVER SHEET

PRECEDENCE

CLASSIFICATION

o Immediate

o Top Secret

o Priority 00

Time Transmitted:

o Secret o Confidential o Sensitive

Routine

IZJ

Sender's Initials:

Number of Pages: ___:3:;..._ (including cover sheet)

_

Unclassified

Date: 12/14/2009

To:

FacsimileNumber: Attn:

I

Name of Office

. --~N~a-m-e-----------------L~R~o-o-m--~T=e'l-ep~h-o-n-e-----

b3

b6 b7C From:

FBI San Francisco - San Jose Office Name of Office

Su~e~:;_

~----------------------~-------

Special Handling Instructions:

Originator's Name:

Special Agent

_

I Telephone:

I

.__

oo::=o==!..

~

Originator's Facsimile Number:

Approved: Brief Description of CommunicationFaxed:

-------------~---------------------WARNING

Information attached 10 the COYersheet is U.S, Government Property. If yOU are not the intended recipient of this information. disclosure, reproduction, distribution, or usc of this informationis prohibited (IS.USC, § 641). Please notizy the originator or the loc!il FBI Office immediately to arrange fol' n.to...ru:s_disool;iliM _~ __ L-~~~=-~~~-

_-~

J ,., ' FD-302 (Rev. 10-6-95)

•

"

•

(1



GRAND JURy MATERIAL

- DISSEMINATE

PURSUANT

01/06/2010

TO RULE 6(e)

On January 6, 2010, Special Agent~I~~~ __~~ __~lreceived a response via facsimile to the abovementioned Grand Jury sUbfoena from I _

I

I The information, which was provided in paper format, included the following informa~ion: b3 b6 b7C

(jj ~

Investigation on

at 01/06/2010 ----------------

A~#

288A-SF-145486-GJ

by

SAl

/lp

Campbell, California Date dictated

N/A

I


b6 b7C

FD-302 (Rev. 10-6-95)

- 1-



GRAND JURy MATERIAL On a Grand Jur

- DISSEMINATE

PURSUANT

03/05/2010

TO RULE 6(e)

2010, Special A~~~~~ and Court Order

~~~ed

b3 b6 b7C

The file copy of the Grand Jury Subpoena and the Cour Order has been attached and is made a part of this document.

Investigation on

03/05/2010

at

Campbell, California

File #

288A-SF-145486-GJ .......-~

by

SAl

Date dictated

(via facsimile)

~=========---. NA


b6 b7C

OJ 09-1 2009R02026

.A0110 (Rev. 12/89) Subpoena to Testify Before Grand Jury

mlniteb ~tates ]!listrict <1:ourt NORTHERN

DISTRICT OF

CALIFORNIA

_TO~

SUBPOENA TO' TESTIFY BEFOREGRAND JURY SUBPOENA FOR:

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District. Court at the place, date and time specified below.

PLACE

COURTROOM


As directed by the court DATEAND TIME March 17, 2010 at 9:30 am

YOUAREALSOCOMMANDEDto bring with you the following document(s) or object(s):* -See Attachment-

Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this . subpoena and no appearance will be necessary.

[{]

Pleaseseeadditional information on reverse.

This subpoena shall remain in effect until you ar ~»!~~~~~epart behalf of the court. :~~.

by the court or by an officer acting on ('>0b .

U.S. MAGISTRATE JUDGE OR C;LERK OF COURT RICHARD W. WIEKING March 3, 2010

This subpoena is issued on application of the United States of America

JOSEPH P. RUSSONIELLO United States Attorne

* If not

applicable, enter "none".

b3 b6 b7C

A0110 (Rev. 12/89) Subpoena to Testify Before Grand Jury

RETURN OF SERVICE (1) DATE

RECEIVED BY SERVER

PLACE

b3

J/O/3fJlD UAII:

SERVED

b6 b7C

PLA~

3 is: )~D ;D'

·1

StKVtU UN (I"KININAMI:)

I :>tKVtUIH (I"KININAMI:)

TITll:

gpe:Dt~ ~tSTATEMENT OF SERVICE FEES TRAVEL

1SERVICES

.~--'

.:.1 TOTAL

-

.......

DECLARATION OF SERVER (2)

I declare under penalty of perjury under the laws of the TInited States of America that the foregoing rrect information contained in the Return of Service Executed on

S" mar-vA DATE

d:DID

r«-:]_ ~)

~

..(,

ADDRESS OF SERVER

SAP

('4 h\Jo1d1

hI".

t!IT

L .../L(£511

-

9SVt>cr'


~Jq_;)

(1)

(2)

VIA-

~C6',~lv

Asto who may servea subpoena and the manner of its serviceseeRule 17(d),FederalRulesof Criminal Procedure,or Rule4S(c),FederalRulesof Civil Procedure. "Feesand mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United Statesor an officer or agency thereof (Rule 45(c), Federal Rulesof Civil Procedure; Rule 17(d),Federal Rulesof Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs(28 USC1825,Rule 17(b)FederalRulesof Criminal Procedure)".

FD-302 (Rev. 10-6-95)

•

• - 1-



03/31/2010

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) On March 29, 2010, Special Agent I I received via u.S. Postal service a resnonse to a Grand Jurv subnoena from

b3 b6 b7c

~

V

Investigation on File #

03/29/2010 at Campbell, ----~--~-------

288A-SF-145486-GJ

~ SAl

g-:

California Date dictated

NA

b6

-r================~__~lb7C

I


••

FD-302 (Rev. 10-6-95)

• - 1-

FEDERAL BUREAU OF INVESTIGATiON


11/22/2010

GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) b3 b6 b7C

served

A copy of the abovementioned Grand Jury Subpoena has been attached and is made a part of this document.

Investigation on

11/22/2010 at ----~~--------

File #

288A-SF-145486-GJ

by

S_A~

cr

Campbell, California Date dictated

(via facsimile) NA ----------------------

~

This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. '----------------

-------------

_

b6 b7C

---- -----------

-------------~

y'

OJ 09·1 2009R02026

.AO110 (Rev.12/89) Subpoena to Testify Before Grand JulY

Wntteb 5>tates i1Bistrict ([ourt NORTHERN

DISTRICTOF

CALIFORNIA

TO:

SUBPOENA TO TESTIFY BEFOREGRAND JURY SUBPOENAFOR:

YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District Court at the place, date and time specified below.

PLACE

COURTROOM


As directed by the court DATE N TIME December 8, 2010 at 9:30 am

YOU ARE ALSO COMMANDED to bring with you the following

document(s) or object(s):*

-See Attachment-

Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena. No appearance will be necessary.

IZI Pleasesee additional information

on reverse.

U.S: MAGISTRATEJUDGE OR CLERK. OF COURT RICHARD W. WIEKING November 22, 2010

ONE NUMBER OF AS I TANT U.S.ATTORNEY This subpoena Is issued on application of the United States of

America MELINDA HAAG, United States Attorne • Ifnot applicable, enter "none".

sSist~a. 150 Almaden Blvd., Suite 9 0 San Jose, CA 95113 (408) 5 Special Agent Melanie Adam,

ttorney.

l-/

61 1(408) 369-8900

b3 b6 b7C

•

'j.

• A0110 (Rev.12/89) Subpoenato Testify BeforeGrand Jury

RETURNOF SERVICEIII DATE

RECEIVED BY SERVER

PLACE

/1)2-2-12-,;;>

/D

UAlt

t'LALt.

SERVED

b3 b6 b7C

I

I

J I ) 2- 2-- 12-;;> ) 0

::>tHVtU UN It'HIN I NAliIltJ

.,

,

. ~tKVtU tly WHIN I NAMt.J

IllLt

5pq TRAVEL

/

»->:

_-

Cc'-,\"

&

~"t -

STATEMENT OF SERVICEFEES I SERVICES ________

ITOTA~

DECLARATION OF SERVER(2)

I declare under penalty of perjury under the laws of the United States of America that the forel!o·ng information contained in the Return of Service a t Executed on

.;:;t ;)_ r...~

~)UJI!.J"/J~.r Q..oI (.) DATE

~tm~ttHVtK

/ 4j

I <::j

[:

f::l.,,,,,

P/.II
..4ve II---<.~

ADDRESSOF SERVER

c?~

:2....1_ ,

tA_,.._

q,ftJlYf-'


~JfJt{

(1) (2)

Jlit

~UI

"",~Iv

As to who may servea subpoena and the manner of its serviceseeHUle17101.I"ederalRulesof Criminal Procedure.or Rule 45(c). Federalxutes or Livil Procedure. "Feesand mileage need not be tendered to the witness upon serviceof a subpoena issuedon behalf of the United Statesor an officer or agency thereof (Rule45{c),Federal Rules.of Civil Procedure;Rule !7(d). Federal Rulesof Criminal Procedure)or on behalf of certain Indigent parties and criminal defendantswho are unable to pay such costs (28USC1825,RuleI 7(b) FederalRulesof Criminal Procedure}".

FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) Page 2 b3; b6; b7C; Page 3 b3; b6; b7C; Page 4 b3; b6; b7C; Page 5 b3; b6; b7C; Page 6 b3; b6; b7C; Page 7 b3; b6; b7C; Page 8 b3; b6; b7C; Page 9 b3; b6; b7C; Page 10 b3; b6 ; b7C; Page 11 b3; b6 ; b7C; Page 12 b3; b6 ; b7C; Page 13 b3; b6 ; b7C; Page 14 b3; b6 ; b7C; Page 15 b3; b6 ; b7C; Page 16 b3; b6 ; b7C; Page 17 b3; b6 ; b7C; Page 18 b3; b6 ; b7C; Page 19 b3; b6 ; b7C; Page 20 b3; b6 ; b7C; Page 21 b3; b6 ; b7C; Page 22 b3; b6 ; b7C; Page 23 b3; b6 ; b7C; Page 24 b3; b6 ; b7C; Page 25 b3; b6 ; b7C; Page 26 b3; b6 ; b7C; Page 27 b3; b6 ; b7C; Page 28 b3; b6 ; b7C; Page 29 b3; b6 ; b7C; Page 30 b3; b6 ; b7C; Page 31 b3; b6 ; b7C; Page 32 b3; b6 ; b7C; Page 33 b3; b6 ; b7C; Page 34 b3; b6 ; b7C; Page 35 b3; b6 ; b7C; Page 36 b3; b6 ; b7C; Page 37 b3; b6 ; b7C; Page 38 b3; b6 ; b7C; Page 39 b3; b6 ; b7C; Page 40 b3; b6 ; b7C; Page 41 b3; b6 ; b7C; Page 42 b3; b6 ; b7C; Page 43 b3; b6 ; b7C; Page 44 b3; b6 ; b7C; Page 45 b3; b6 ; b7C; Page 46 b3; b6 ; b7C; Page 47 b3; b6 ; b7C; Page 48 b3; b6 ; b7C; Page 49 b3; b6 ; b7C;

-

-

724

Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103

-

-

b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b3 ; b6; b7C; b3 ; b6; b7C; b3 ; b6; b7C; b3 ; b6; b7C;

b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3;


104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157

-

b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;

b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;

b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;


158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211

-





212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265

-




Page

266

Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319

-





320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373

-

b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3

; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;



Page

374


375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427

-





428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481

-





482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535

-





536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589

-


; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;




590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643

-


; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;



Page

644


645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697

-




Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725

-

b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;

b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;

b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX

FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) 151 Page 8 b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; Page 9 b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - PERSUANT TO SEALED COURT ORDER; Page 11 Page 13 - b6; b7C; b7D; Page 14 - b6; b7C; b7D; Page 15 - b6; b7C; b7D; Page 16 - b6; b7C; b7D; Page 17 - b6; b7C; b7D; Page 18 - b6; b7C; b7D; Page 24 - b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - PERSUANT TO SEALED ORDER; Page 25 Page 26 - b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - Sealed Order; Page 37 Page 38 - b6; b7C; OTHER - SEALED ORDER; Page 39 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 40 Page 41 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 42 OTHER - Sealed Order; Page 43 OTHER - Sealed Order; Page 44 OTHER - Sealed Order; Page 45 Page 46 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 47 Page 48 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 49 OTHER - Sealed Order; Page 50 OTHER - Sealed Order; Page 51 Page 52 - b7D; OTHER - SEALED ORDER; Page 53 - b7D; OTHER - SEALED ORDER; Page 54 - b6; b7C; OTHER - SEALED ORDER; Page 58 - b6; b7C; Page 59 - b6; b7C; Page 60 - b6; b7C; b7E; Page 61 - b6; b7C; b7E; Page 62 - b6; b7C; b7E; Page 68 - b6; b7C; OTHER - Persuant to Sealed Order; Page 71 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 72 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 73 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 74 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 75 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 76 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER;

-

-

-

Page 77 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 78 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 79 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 80 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 81 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 82 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 83 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 84 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 85 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 86 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 87 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 88 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 89 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 90 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 91 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 92 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 93 - b6; b7C; b7D; b7E; Page 94 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 95 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 96 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 97 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 98 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 99 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 100 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 101 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 102 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 103 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER;

Page 104 ORDER; Page 105 ORDER; Page 106 ORDER; Page 107 ORDER; Page 108 ORDER; Page 109 ORDER; Page 110 ORDER; Page 111 ORDER; Page 112 ORDER; Page 113 ORDER; Page 114 ORDER; Page 130 Page 131 Page 132 Page 133 Page 134 Page 135 Page 136 Page 137 Page 138 Page 142 Page 143 Page 144 Page 145 Page 146 Page 147 Page 148 Page 149 Page 150 Page 151 Page 152 Page 153 Page 154 Page 155 Page 156 Page 157 Page 158 Page 159 Page 160 Page 161 Page 162 Page 163 Page 164

- b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT -

b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;

b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;

b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D;

Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page

165 166 167 168 169 170 171 172 173 174 175 176 177 178 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204

-

b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;

b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;

b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX

•

·t (R:ev.05-01-2008)

•

UNCLASSIFIED


ROUTINE

Precedence: To:

Date:

Cyber

From:

Attn:

SSAI CCU-~2~------------~

Attn:

Victim-Witness Coordinator

San Antonio Cyber C-4 SA

Con tac t : Approved Drafted

By: By:

1/17/2012

____~

L...-

b6 b7C

~

I ~~TtK~L~~5~~~-~' ----~o~

Case ID #: 288A-SA~ Title:

(Pending) I"""" 1~-SA-58304-K (Pending)- 2)~ ~IDf_Pr "!>A"'(P3f.Uia ...~:r- , I I ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS

Synopsis:

To open case and GJ subfile.

On 11/08/2011 containinql

Details:

a CHS provided writer with a CD I b6 b7C b7D b7E

D

I

I

ACS and searches on the term I resulted in a hit on case 288A-AT-99,96. serial J~J-.~T~h~l~is--s-e-r~i~a~l~ b6 is an FD-302 of an 2006 interview ofJ lat his b7C residence inl lin which he I I I The information provided the following:

I

Name:~I

~

OPEN&ASSIG

UNCLASS IFI~ass/Alpha: __ Zti~,~II.....L::J....---,._J. Case Agent: ~~~=~-r'-f SRC Code:..Q!:L '_~-=---=~"'""M I Codes:;_~~~_:"::::i=-+Assess PI IDENTITYTH DATE:,__ .1.=-..l-l.---lo.!::::;"_ __

To: Re:

•

UNCLASSIFIED

Cyber From: San Antonio 288A-SA-NEW, 1/17/2012

Telephone: IL........ Associate ~~a~mwe~s~;~n~o~n~e~ Addresses: ! Businesses: none

• ~

b6 b7C

It is requested that the case and Grand Jury subfile be opened.

UNCLASSIFIED 2

,)

•

. To: Re:

UNCLASSIFIED

Cyber From: San'Antonio 288A-SA-NEW, 1/17/2012

LEAD (8) : Set Lead 1:

(Info)

CYBER AT CCU2, DC For information only. Set Lead 2:

(Info)

SAN ANTONIO AT SAN ANTONIO, TEXAS To advise Victim-Witness Coordinator of case initiation.

••

•

UNCLASSIFIED 3

Case ID: 288A-SA-63452

•

•

lA Envelope

OTHER SEALED ORDER

------------~------------------------------.-~--------------------~ SA 1 SEARCH WARRANT RESULTS FOR 1--------I

~-------~------j~~~I----------------------------------------------------------------------------------------------------------------------------~---

---------------------~---------------------------------------------------------

---------------~---------------------------------------------------------------

----------------------------------------------------------------------~-------! ! ---------------------------------------------------------~------------------------------------------------------------------~------------------------------------------------------~-

------------------------------------------------------

!.

!

.

I~

_)

MDI 23;._;:;_~A_-_:__);4-_'.. ~_~:...;_'S_'L t _,__;_~ I_;_:_~~__

FD-340 (Rev. 4-11-03)

File Number __


S'1'" .A.II Will ;D

Serial # of Originating Document Date Receiv~e::d-====;_--4-;-·

-,

_

=--====-

_-_~_;_'-_' _'2._t?_I_L

_

OTHER SEALED ORDER

From __ (NameofContributor/Interviewee)

(Address),

_---------=j(City

BY __

~~Jt~·LI

andState)

~I

~_~_c

__

To Be Returned 0 Yes ~ No Receipt Given 0 Yes [it'No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure DYes Federal Taxpayer Information (FTI)

o

Yes

[i;?' No

d'~o

Title:

Rererence:

~

_

(Communication Enclosing Material)

OTHER SEALED ORDER

e

S'

~.,. " ,,;-¥-_

1

'C,,,,

1

DocLab Note //

ITEMS(S) CANNOT BE .

SCANNED DESCRIPTION

.'

I

c)

u

FD·340(Rev. 4-11·03)

I_88_~A-_' 51+-,.f\_- (b_~_lJ-~_7-_-_.!.._1 A~~j-=-__

File Number __

Field Omce Ac:qulrln&Evfdence

.'

_+-~..::..>.;..'1..;._~.A:.....,..·."'~~_" __i_;:o=--",--

Serial # of Originating Doc:ul,ieJlf'

.

Date Received From

_.;_I

...,.-

o..;:·:;..·....ll"-· _-'-

_ _

101(O! 20 (2... ---~~~~~~------------~-~~

---------~---~------------------~--------------(Name of ContributorlInterviewee) 1

(AddrcsI)

i~

(City1s....)

5A-

·i

By

~

To Be Returned

0

-,

~

Yes

___ '"

g No

,I

i·

cf

Receipt Given 0 Yes No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure.tL Yes U No Federal Taxpayer Information (FfI) DYes c:l No

o

J /

"-;

Title:

b6 b7C

~

j

I

Reference: (Communication Encklsing Material)

I I

'1 ~

.1

Origin~lnotes re interview of

I .......

FBI SAN ANTON,IO CYBER SQUAD C-4

FAX TRANSMITTAL SHEET

2__-_~-_f_L __

Date: __

Y-

Number of Pages: (Includin.g

_

OTHER

Fax S::h=e=:et:!...) _--------,\

To: __

~I__ ------------~=-~-----------

Fax Number:

J _----====-l------L

From: Number:

L__===-J Fax: \L__

Office:

b6 ~ b7C

-___l--

Reference:

--~~---------------------

I

I \

I

I

\ I

I

I

I

!......-~~

-_._---

:~

FD-S42 (Rev. 03-23-2009)

UNCLASSIFIED


ROUTINE

Precedence:

To:

Date: 02/09/2012

San Antonio

From:

San Antonio Cyber/C-4 : SA

Approved By: Drafted By: Case ID #: Title:

b6 b7C

I

~==========~--~ ~I ~ 288A-SA-63452

(Pending)"'"

1

ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS

Synopsis:

To claim statistical accomplishment. b6 b7C b7E

UNCLASSIFIED

b6 b7C

I I ,

'(

'r.;

UNCLASSIFIED To: Re:

San Antonio From: San Antonio 288A-SA-63452, 02/09/2012

Accomplishment

Infor.mation:

Number: 1 Type: ClP 2703(f) ORDER SERVED lTU: ClP Claimed SSN: Name Squa: C-4

BI"

~~~~------------~

b6 b7C

••

UNCLASSIFIED 2

INFORMATION NEEDED F~M AGENT FOR COMPLETION (Complete one form for each defendant)

OF CRIMIIIl

OPENING

I.

NAME & AKA'S OF SUBJECT:

ADDRESS.~· __~

FORMS:

Antisec

~---------------

ID#: SEX:~M==~~D~O~B~:~I=-~ ~ ARREST DATE:~n~a~ SSN:L_ _J-------COUNTRY OF CITIZENSHIP: ~U~S~A~ IMMIGRANT STATUS: NON-RESIDENT / UNDOCUMENTED

__ ___ __

/

LEGAL

PERMANENT

RESIDENT

IS THIS A SINGLE AGENCY, SHARED AGENCY OR TASK FORCE CASE? AGENT/AGENCY:

~FwB~I~

__ AGENCY

Any other agency involved: AGENT/AGENCY: ANTICIPATED CHARGES:

__

/

VALID

VISA

LIST ALL:

CASE #: 2BBA-SA-63452

b6 b7C

AGENCY CASE #:

Title 18 USC 1030, Title 18 USC 2261 A(2) (A) (LIST LEAD CHARGE FIRST)

ESTIMATED DOLLAR LOSS: ~n~o~n~e~

__

IN WHAT COUNTY OR COUNTIES DID THE CRIME OCCUR?

DOES SUBJECT HAVE COUNSEL? ~U~n~k~n~o~w~n~ IF YES, CIRCLE ONE: FEDERAL DEFENDER / APPOINTED

_rl=c=o=u=n=ty~-------

L-

___ /

RETAINED

/

PRO SE

And LIST COUNSEL'S NAME AND ADDRESS:__~N~A~

__

IF THIS IS A BANK FRAUD CASE, IS THERE A PROGRAM AGENCY INVOLVED? (i.e., Comptroller of the Currency, FDIC, etc.) IF SO, LIST AGENCY AND THEIR FILE NUMBER' n/a

ARE THERE ANY VICTIMS IN THIS CASE? Yes IF SO, WHOM? Texas Commission on Jail Standards website at www.tcjs.tx.us IS THIS A SENSITIVE CASE?~N~

__

GIVE SHORT SYNOPSIS OF CASE: Subject of case is involved in computer hacking with the Anonymous group. Subject conducted unauthorized activity against www.tcjs.tx.us as part of a computer intrusion attack against the site.

.." (Rev. 65-01-2008)

UNCLASSIFIED


Precedence: 'To:

Date:

PRIORITY

San Antonio

From:

Attn:

SIA ...1

02/27/2012"

___~

San Antonio Cyber C-4 ; SA

Approved By: Drafted By:

L..--i

_p

~I! A

L--I

Case ID #: 28~-SA-63452

(Pending) ~

b6 b7C

~

I

Title:

~ ~ANTISEC; TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS Synopsis:

Request Sosi

lassistance on captioned case.

Details: Writer requests sosl lassistance due to the overwhelming amount of time-sensitive data bein r vided by a CHS. This data often contains b7D

Due to the amount, and frequency, of the data, it is not possible to provide timely updates to the affected FBI field . offices and law enforcement agencies while also addressing current CIP National Security and CIP Criminal case load. It is anticipated that sosl I assistance will consist of reading email, watching videos, and crnducting online research regarding CIP Criminal hacktivism. SOS_ assistance is requested to assist C-4 Cyber in mitigating hacktivism threats which are presently ongoing in FBI San Antonio's AOR and in other FBI Field Office AORs. CHS reporting is arriving daily, but becomes stale if not utilized immediately to assist in preventing or responding to CIP Criminal Hacktivism threats. The duration of the captioned case is unknown and will be commensurate with the operational life of the CHS.

J

I

Without SO~ assistance, there is a substantial risk of losing valuable information being provided by UNCLASSIFIED

b6 b7C



the CHS into CIP Criminal Hacktivism threats and the ability to mitigate these threats in a timely manner through prevention of attacks or mitigation of known or attempted intrusions.

UNCLASSIFIED

2

l-

UNCLASSIFIED

I

To: Re:


LEAD (s)

:

Set Lead 1:

(Action)

SAN ANTONIO AT SAN ANTONIO, TEXAS matter .

Please assign sos~I

~

••

•

UNCLASSIFIED 3

to captioned

b6 b7C

Ep-542 (Rev. 03-23-2009)

UNCLASSIFIED


Precedence: To:

ROUTINE

Date:

02/20/2012

San Antonio

From:


Approved By: b6 b7C

Drafted By: Case ID #: Title:

288A-SA-63452

1

(Pending)........


Synopsis:

To claim statistical accomplishment.

Details: To date, during the course of this investigation, writer has accomplished numerous achievements. The owners of www.lcso.org and www.pbso.org were notified of treser activity against their sites.

I

I

The sUbjecT~~o~£~t~b~e~'~'n~1wTe~s~t~i~a~a.t~j.o~n~I----------------'_I~"JS b6

identifiedthrQ~

UNCLASSIFIED

b7C b7D

To: Re:

•

UNCLASSIFIED


Accomplishment

Infor.mation:

Number: 2 Type: CIP VICTIM ED/INTERVIEWED ITU: CIP Claimed BY:I SSN: Name: Squad :L...-...,.c.,..-....,4.-----------. Number: 1 Type: CIP SUBJECT IDENTIFIED ITU: CIP Claimed By °1 SSN: Name: Squad:~-C=--4~------~ Number: 1 Type: CIP IN~ORMANT/ASSET DEVELOPED ITU: CIP Claimed By.~o---------~

~;:~:I

Squad'~:-~C~--4------~

Number: 1 Type: CIP CONSENSUAL MONITORING CONDUCTED ITU: CIP Claimed BYro-----------,

~~:~: I Squad

:!--.... C.... -....,4..---------~

••

UNCLASSIFIED

2

b6 b7C

•

(Rev. 05-0),,2008) t

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE


Precedence: To:

ROUTINE

San Francisco

Date: Attn:

04/11/2012

San Jose RA SA L-I

From:

----1


Approved By: Drafted By:

L...--

Case ID #: Title:

b6 b7C

288A-SA-63452

___..lll (Pending)/

,\


Synopsis:

Request location of subject of captioned case.

Enclosure's): Encrosed for San Jose are two recent photographs of ""__ __ ! -;:::::::::::::=._--,

I

Details:

On

b6 b7C b7D b7E

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE


San Francisco 288A-SA-63452,

From: San Antonio 04/11/2012

b6 b7C b7E

confirmation

of the location

of this ca tioned case.

of

I

r~------~Il~'s~b-e~l~l~'eved

to reside in

The subject's full name is I DOB: SSAN: [ I possible cellular telephone number I las~ known ad~ress: I ~----------------~ ~J This residence is~I ~ primary residence. Other possible residents at L.t-h-a-t--l-o-c-a-t....,i-o-n--m-a-y~be

r---------,l

I

b6 b7C

I

I appears to be currently

Pertinent subject ofLI

I

to this lead is the fact that I

Iwas the ~

L

See case 288A-AT-99196 for further informatiQn. Please be aware that I Imay bel

UNCLASSIFIED/fLAW ENFORCEMENT SENSITIVE 2

b6 b7C b7E

, ,

. .,)


San Francisco From: San Antonio 288A-SA-63452, 04/11/2012

LEAD (s)

:

Set Lead 1:

(Action)'

SAN FRANCISCO AT SAN JOSE, CALIFORNIA Please determine

the current

residen~c~e~o~f~I

r.

land determine whether he currently is~I 1 I Please include information on any electronic equipment that may be observed in subject's possession .

••

UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 3

~ __~

~

b6 b7C

FBI SAN ANTONIO CYBER SQUAD C-4

FAX TRANSMITTAL SHEET Date: __ Number of Pages: __

Y_-_r..&;;.,,_~-_12

It

Jr---.....;....._-------,

_

_

(InclucUD.g Fax Sheet)

To:

Fax Number:

_"L-I

--'-

From:

SA

Number:

omce: Fax:

Reference:

,

b6

b7C b7E

L--

__'

_

f~

•

~..

(Rev. 05-01-2008)

UNCLASSIFIED//FOR OFFICIAL USE ONLY


Precedence: To:

ROUTINE

Date:

04/20/2012

Cyber

Attn:

SSAL.CCU-~2~----------~ SSAI CCU-~l-----------~

San Antonio

Attn:

CI-l

From:

SSA~I---------------, CT-4


Approved By: L-Ir--_ -__ - _- _-_-_......I...JojI[a~

I


......

288A-SA-63452

__._.....,

.

I

*

b6 b7C

(Pending)" \


Synopsis:

(U//JOUO)L.-

__......

I Details:

~I

(UjjFOUO)

I

-----------------------


b6 b7C

__......I~~~ b7E

'"

. UNCLASSIFIED To: Re:

San Francisco From: San Antonio 288A-SA-63452, 04/11/2012

LEAD (s): Set Lead 1:

(Info)

CYBER AT CCU-1, WASHINGTON, DC No hard copy to follow. Set Lead 2:

For information only.

(Info)

CYBER AT CCU-2, WASHINGTON, DC No hard copy to follow. Set Lead 3:

For information only.

(Action)

SAN ANTONIO AT SAN ANTONIO, TEXAS For evaluation by CI-l for actionable value. Set Lead 4:

(Action)

SAN ANTONIO AT SAN ANTONIO, TEXAS For evaluation by CT-4 for actionable value .

••

UNCLASSIFIED//FOR OFFICIAL USE ONLY 46

•

•

(Rev, 05-01-2008)



Precedence: To:

ROUTINE

Date:

Sacramento

From:

04/20/2012

Attn: CY-1


Approved By: Drafted By: Case ID #:

288A-SA-63452

(Pend i nq L>

y:~;

b6 b7C

~~TISECi Title: ~ TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS ~S_yn __O_D_S_;_S_.

(T_T_/_/F_O_T_ID~r.L-

Enclosure(s): Enclosed for Sacramento is a CD-ROM containing a copy of the database table in MS Excel format.

UNCLASSIFIED//FOR OFFICIAL USE ONLY OTHER Persuant to Sealed Court Order b6 b7C b7D

~

, t

To: Re:

•

UNCLASSIFIED

Sacramento From: San Antonio 288A-SA-63452, 04/20/2012

• b7E



,

Sacramento From: San Antonio 288A-SA-63452t 04/20/2012

LEAD (s)

:

Set Lead 1:

(Action)

SACRAMENTO AT SACRAMENTO

I

(U//FOUO)I

b7E

••


UNCLAS$IFIED,

FEDERAL

~F INVESTIGATION

ROUTINE

Precedence: To:

BOFl~U

• Date:

05/01/2012

San Antonio

From:

San Antonio Cyber/C-4 Con tact:

Approved Drafted

By: By:

Case ID #: Title:

I

I

~========----~ I I 288A-SA-63452

b6 b7C

~l~

(Pending)

ANTISEC; TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS

Synopsis: Details:

~----------------------------~ SA

To claim stati$tical accomplishment. To date, writer has used a CRS on multiple occasions to b6 b7C b7D

I

)

OTHER Persuant to Sealed Court Order b6 b7C b7D

UNCLASSIFIED

:f

UNCLASSIFIED

To: Re:

San Antonio From: pan Antonio 288A-SA-63452, 02/0~/2014

Accomplishment

•

Infor.matiq~:

Number: 1 Type: CIP SUBJECT IDENT~fIED ITU: CIP Claimed By:I SSN: Name: Squad:~~C---4--------------~ Number: 1 Type: CIP SEARCH WARRANT OBTAINED AND EXECUTED ITU: CIP Claimed BY:I SSN: Name: Squad: C-4

~~~------------~

Number: 1 Type: CIP CONSENSUAL MONITORING CONDUCTED ITU: CIP Claimed By~· ~

~;~~:~I--~~------------~ Squad:

C-4

Number: 1 Type: CIP COMPROMISED SITE IDENTIFIED ITU: CIP Claimed By:~ ~ SSN: I Name: ~ ~ ....I Squad: C-4

••

UNCLASSIFIED,

2

b6 b7C

•

•

I..

(Rev. 05-01-2008)



Precedence: To:

Date:

ROUTINE

San Antonio

From:

San Antonio Squad CI-1 : SA

Approved By:

Attn:

SA -r=-~--____J Cyber!C-4 L..I

I

]

I

I

~

~L..-

_

Drafted By:' Case ID #: Title:

288A-SA-63452

05/03/2012

(Peridd.nq )

-

1

b6 b7C

ANTISEC TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) - VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS

Synopsis:

Coverage of lead.

Full Investigation Initiated:

01/17/2012

Details: San Antonio CI-1 received a SA-63452 serial #14 lead #3. Special ~~~~~~ __~ __~~ ~ and Staff Operations Specialist (SOS) conducted logical investigation of e-mail addresses. To date, FBI San Antonio CI-1 ha~ exhausted all investigative resources and no priority threats to national security warranting further investigation were identified. In the event additional derogatory information is discovered, FBI San Antonio CI-1 will consider opening an investigation. FBI San Antonio CI-1 considers this lead covered.


b6 b7C

UN~ASSIFIED//FOR OFFICIAL us!ltNLY To: Re:


LEAD (8)

:

Set Lead 1:

(Info)

SAN ANTONIO AT SAN ANTONIO, TX C-4 for information only. Read and clear .

••


(Rev. 05-01-2008)

UNCLASSIFIED

•


Precedence: To:

Date:

PRIORITY

OS/25/2012

San Antonio

From:

San Antonio Cyber C-4 :

SAl~----------------------------,

Approved By:

__.I \ q,

Drafted By: L...---

Case ID #: 288A-SA-63452 Title:

I

(Pending) ~

b6 b7C

I

aka I I ANTISECi TEXAS COMMISSION ON JAIL STANOARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS

Synopsis:

Case update and investigative plan. ·' Details: Writer currently has no CHS coverage of the subject of the captioned case and no more open-source leads. A lead was sent tol I RA, IDivision, to attempt to physically locate subJect at filS last known physical address. To date, I IRA has been unable to locate the subject.

r

~ ~IRA has a CHS that may be able to gain access to the subject online and writer has requested that this be attempted. Writer has also requested I I RA to «onti plle attempt to locate the subject. Writer will work withtto provide any needed information or Grand Jury subpoenas.

fO

Upon locating the subject, whether online or physically, writer will use all means available to observe the online activity, especially the IP addresses used, by the subject. It is anticipated that this will enable writer to link past known attacks to the subject beyond a reasonable doubt .

•• UNCLASSIFIED

b7D

•

•

FD-302 (Rev. 10-6-95)



rI

05/31/2012

~O~n~~M~a~y~3~1~, 2012, an employment request was faxed to the State ofl lEmplOymenf Development Department (EDD), via facsimile number I . The request asked for employment information from 01/01/2010 through present for the following individual:

b6 b7C b7D

Name: DOB: SSAN: Attached and made a part of this document is a copy of the request faxed to EDD_

Investigation on

05 / 31/2012

File #

288A-SA-63452 /l

by

S_A~

b7D atL-1

q

...J....-------Date dictated

a1

not dictated

~------------------~--~~--------------~~._-

This document contains neither recommendations nor conclusions of the FBI. It is the it and its contents are not to be distributed outside your agency.

~lle~!1

:nd

?our-:: le~

b6 b7C

•

•

U.S. Department of Justice Federal Bureau of Investigation

In Reply, Please Refer to

File No.

28 8A -SA -63452

May 31, 2012 Attention:

To Whom It May Concern

Re:

Employment

Dear State ofL..I

for L..I

~FmplOyment

...... Development

Please provide employment information through present for the following individual:

Department: from 01/01/2010

b6 b7C b7D

Name: DOB: SSAN:

Sincerely yours, b6 b7C

SpecJ.al Agent

./

,\

'\/

)Ov ,

\0

I

" .'

•

it1

. (Rev. 03-23-2009) FD-542

UNCLASSIFIED


Precedence: To:

ROUTINE

Date:

06/08/2012

San Antonio

From:


Approved By:

b6 b7C


288A-SA-63452

(Pending)./

d-D


Synopsis:

To claim statistical accomplishment.

Details: On 6/7/2012, an I~I~R~(~n~U~mb~~e~r~I ~ ~ was published based on CHslreporting. The subject of b7D the IIR was (U//FOUO) Identification of Internet Relay Chat (IRC) Channels Used by Anonymous , as ofl I

UNCLASSIFIED

To: Re:

•

UNCLASSIFIED


Accomplishment

•

Infor.mation;

Number: 1 Type: CIP POSITIVE INTELLIGENCE PRODUCT GENERATED (E.G. IIR) ITU: CIP Claimed By~· ~

~::~:~I------------------~ Squad: C-4

••

UNCLASSIFIED 2

b6 b7C

UNCLASSIFIED

FD-l023

FEDERAL BUREAU OF INVESTIGATION CHSREPORTING DOCUMENT

(07/24/2010)

HEADER

IDt

Source Date:""'0"""3~/~0-=2-=/-=2-=0-=-1=-2--___' b7D CaseAgenr Name_ Field!------OfficejDivisioSan Antonio

b6 b7C

.....

n: Squad: C Four Date of 02/22/2012 List all present includin g

yourseI1i---------,

b6 b7C

(Do not include the CHS.): Type of e-Mail Date of 03/02/2012 Report: Substantiv e CaseFile Number: 288A-SA-63452 DCheck if Grand Jury restrictions apply Source Reporting: CHSprovided the following through email:

b6 b7C •

,.

UNCLASSIFIED

-----------------------------------------------

UNCLASSIFIED

FD-l023

FEDERAL BUREAU OF INVESTIGATION CHS REPORTINGDOCUMENT

(07/24/2010)

HEADER

Source I Date: 12/06/2011 Case Agenq Name~~ Field Offlce/Dlvlslo San Antonio

~~~~~----~ ~

n: Squad: C Four Date of 11/08/2011 : List all present including,.-

b6 b7C ~

yourself]

(Donorla_.

~

include the CHS.): Type of In Person : •

Count~ UNITED STATES City: Lackland AFB Stat: Texas Date of 12/06/2011 Report: . Substantiv e Case File .....__ Number: 288~UB

A

2.. i~A" S4- , ~lfst b6 b7C b7D

-

--

- -------

--

--_

---------------------------------------------------------,

DCheck if GrandJury restrictions apply The report mentions a full report provided by1:hesource:

r-1-------------,lan4

~s being potential actors in the LulzSecgroup. Belowis the L..-

___'

b6 b7C

This is your guide to making senseof everything on this disc. All times in file names are Central.

[[DISCLAIMER]]

b6 b7C b7D

•

FD-l023

UNCLASSIFIED

•

FEDERAL BUREAU OF INVESTIGATION CHS REPORTINGDOCUMENT

(07/24/2010)

HEADER

IDtL

Source Date: 05/10/2012 Case Agent Name:1 Field Office/Division: Ls-a-n-A-n-t-o-n-io----'

___.

b7D

b6 b7C

Squad: C Four

Date of : 05/01/2012

I

List all present including vourself.L (Do not include the CHS.): Type of : e-Mail

___,J

Date of ReportLI

.....I

Substantive Case File Number: 288A-SA-63452 Source Reporting:

b7D

Page 1 of 26

b6 b7C b7D

Fbi Foia Anti-sec Documents 5w1u5

Overview 3z723u

More details 2i4a6q

Related Documents g842

Fbi Foia Anti-sec Documents 5w1u5

Fbi Anonymous Anti-sec Lcso.org Foia Documents 2l1h2v

Fbi 6e435i

Foia Release Of 9/11 Dancing Israelis Thru The Fbi 5o126e

Foia Documents From The Treasury Department On Hsbc Money Laundering 274o2h

Sample Foia Response Letters 6q233p

More Documents from "Smiley Hill" 16263i

Fbi Foia Anti-sec Documents 5w1u5

Fbi Anonymous Anti-sec Lcso.org Foia Documents 2l1h2v

Ff Gerri Hill Snow Falls Pdf 325r20

Makalah Trauma Kepala f7264

Atkins Graduate Brochure Best Version 4i2l5d

Deformation Of The Crust 473o5m