FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) = 15 Page 2 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 3 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 4 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 5 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 6 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 7 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 8 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 9 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 10 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 11 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 12 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 13 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 14 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 15 - OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; Page 16 - b6; b7C; OTHER - OBTAINED PERSUANT TO SEALED COURT ORDER; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) 32 Page 13 b6 ; b7C; b7E; Page 14 b7E; Page 15 b7E; Page 16 b6 ; b7C; b7E; Page 17 b6 ; b7C; b7E; Page 18 b7E; Page 19 b7E; Page 25 b6 ; b7C; b7E; Page 26 b6 ; b7C; b7E; Page 27 b6 ; b7C; b7E; Page 28 b6 ; b7C; b7E; Page 29 b6 ; b7C; b7E; Page 30 b6 ; b7C; b7E; Page 31 b6 ; b7C; b7E; Page 32 b6 ; b7C; b7E; Page 33 b6 ; b7C; b7E; Page 34 b6 ; b7C; b7E; Page 35 b6 ; b7C; b7E; Page 36 b6 ; b7C; b7E; Page 37 b6 ; b7C; b7E; Page 38 b6 ; b7C; b7E; Page 39 b6 ; b7C; b7E; Page 40 b6 ; b7C; b7E; Page 41 b6 ; b7C; b7E; Page 42 b6 ; b7C; b7E; Page 44 b6 ; b7C; Page 49 b3; b6 ; b7C; Page 50 b3; b6 ; b7C; Page 51 b3; b6 ; b7C; Page 52 b3; b6 ; b7C; Page 53 b3; b6 ; b7C; Page 54 b3; b6 ; b7C;
-
XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
b6 b7C (Rev. 05-01-2008)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
Date:
ROUTINE
12/01/2011
San Diego
From:
San Diego CY1 :
~ ~
9' /
:::: r~
SA
Approved By: Drafted By: b6 b7C
Case ID #: 288A-SD-NEW Title:
UNSUB (S); #ANTISEC;
ICOMPUTER Synopsis:
INTRUSI d-N
Request case
e opened on captioned investigation.
Details: On 11/18/2011, retired California Department of Justice Special Agent Supervisor I I advised that he received text messages from his own Google telephone number indicating that he had been "owned". On 11/18/2011, a YouTube video was posted with the title "#AntiSec Fuck FBI Friday V - Cybercrime Investigator com:m; ons" from the YouTube I __ ~ I. The video was 6:03 long and stated the following information, which was also posted as text below the video:
:ati
b6 b7C
"Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. As part of our ongoing effort to expose and humiliate our white hat enemies, we targeted a Special Agent Supervisor of the CA Department of Justice in charge of We are leaking over 38,000 private emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters (especially those who have been targeted by these scurvy dogs) while also making a mockery of "security professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we aim to destroy.
UNCLASSIFIED
b6 b7C
UNCLASSIFIED
To: Re:
San Diego From: San Diego 288A-SD-NEW, 12/01/2011
We hijacked two gmail s belonging tol ~ho has been a cop for[],ears, dumping h~ orival email correspondence as well as several dozen voicemails and SMS text message logs. While just yesterda was having a private BBQ with hisl high computer crime task force friends, we were reviewing their detailed internal operation plans and proc_~documents. We also couldn't overlook the boatloads of embarrassing personal information about our cop friendl IWe lulzed as we listened tol I
Mre turned on his !!oo!!leweb history and watched himlL...-
1
r
I
---I--.,...._...J
We also abused his google voice , making surd'1.r-_.....Lrfl;l;r.:.::ie::lon~d~s b6 L..a-n~d~f~am~il~yk-n-e-w-h~o-w.....,.h-a-rd.,...,..he-w-a-s-o-w-n-e...,d,... . ...Ipossibly the most interesting content in his emails are thd I b7C I 1 b7E I IThe information in these emails will prove essential to those who want to protect themselves from the techniques and procedures cyber crime investigators use to build cases. If you have ever been busted for computer crimes, you should check to see if your case is being discussed here. There are discussions aboud
These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement targets-- getting in and out of whichever high profile government and corporate system we please and despite all the active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere nearus. Even worse, they bust a few dozen people who are alleged!} part of an "anonymous computer hacking conspiracy" but who have only used kindergarten-level this isn't even hacking, but a form of electronic civil disobedience.
I
-
We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending out takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals like Thomas Ryan and Aaron Barr think they're doing something noble by "leaking" the public email discussion lists of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" Zatko who back in the day used to be old schoollOphtlcDc only now to sell out to DARPA going around to hacker conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal information all over teh internets. Hackers, us and rise up against our common oppressors - the white hats, the 1%'s 'private' police, the corrupt banks and corporations and make 2011 the year of leaks and revolutions! We are Anti-Security, We are the 99% We do not forgive. We do not forget. Expect Us!"
UNCLASSIFIED 2
b7E
,"
.UNCLASSIFIED To: Re:
San Diego From: San Diego 288A-SD-NEW, 12/01/2011
A link was also provided on the YouTube page to the documents that were taken from I recount. The n forma tj on Wi3 S J oca t ed at L...---I
I;
L...-
dditionallY, some of The information contained within ~_ was posted atl 1
f
On 11/30/2011, California Department of Justice pr?vided the with a CD-ROM disc containing the files located atl . These files are contained in a 1-A envelope to thjs fjle and are protected with the following :
FiI
1
I·
••
UNCLASSIFIED 3
b6 b7C b7E
•
(Rev. 05-01-2008)
UNCLASSIFIED
•
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
Date:
ROUTINE
12/05/2011
San Diego
From:
San Diego CY1 :
Approved
SA
By:
Drafted By:
b6 b7C
J J\ ~
Case ID #: 288A-SD-73148 Title:
UNSUB (S); #ANTISECj
I
COMPUTER Synopsis:
~I
~I
(Pending)
~ VICTIM;
INTRUSION
Document
collection
ofl
~------~-
IGmail files from
Details: On 12/01/2011, following a determination that the CDROM disc obtained from the California Department of Justice had become corru ted, SA visited the website
b6 b7C
and ed the torrent L.c-o-n""7t-a-l:"'"' n-g-':""t";""h-e-c-o-n-:t-e-n-t:-"s--o""f---=-tTh_je Gmail files exfiltrated from I s. The contents included one zipped file
=r
I-
I
The zipped file was placed on a CD-ROM disc and placed in the 1-A file .
•• ,,,-
...
--.,.~ ~~
UNCLASSIFIED
----- -' _
...
)
•
FD-302 (Rev. 10-6-95)
- 1FEDERAL BUREAU OF INVESTIGATION
12/07/2011
Date of transcription
date of birth I L social securi ty a.... c-c-o-u-n-t-n-u-mb-=-e-r"""T"1 ....L....., was in tervi ewed at the San Diego Division of the Federal Bureau of Investigation. Also attending the interview were ITCFEI land IA After being advised of the identity of the interviewing Agent and the nature of the interview, I Ivolunteered the following information:
I
I
b6 b7C
I
referred to the written statement he had previously submitted and advised that the information provided within was accurate. A copy of the written statement is contained in a 1-A envelope in the file.
I
I
On 11/18/2011, at approximately 7:00 am PST, began receiving text messages on his cellular telephone from the telephone number associated with his Google Voice , b6 I I The text messages were statements similar to "We'='"""I:h~a:"'::'v you" and "IoTe ox:m vpu". Additional text messages were received that b7C directed ~o enter an IRC chat rqom to disCllSS the matter with the indivlduals that had taken overt s. advised that he did not reply to these messages and does not recall the exact context of the messages or the name of the IRC chat room that they were directing him to. stated that he has deleted the text messages and has no record of them.
I
I
I
.
I
I
I
I
I
Shortly after receiving the text messages from the individuals claiming they had compromised his s, ....I __~ ~ began receiving telephone calls from friends and family who advised him that they were receiving suspicious messages ff~m him on Facebook. The individuals also advised that there were_ and other out of character posts on his Facebook feed.
I
I
I
s. telephone Pllmber
.__
By noonl had recovered and locked down all of his Text messages continued arriving on his cellular b6 that appeared to be from his Google Voice telephone b7C Fearing that his Google was still compromised, deleted the Google ..
........... I
I
Following the recovery of his s, received a text message that stated ·that it wasn't over and a text message that made a reference to the tough economic times and financial Investigation on
12/06/2011 ---~~--------
File #
288A-SD-73148
by
SAl
;...2
at
San Diego, CA Date dictated
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.
b6 b7C
-
•
- ~-, FD-302a (Rev. 10-6-95)
288A-SD-73148
Continuation of FD-302 of
_
........
.....L
,On
12/06/2011
,Page __
2;;;...._.._
b6 issues. I Ichecked his credit crrds and discovered that a fraudulent charge had been made on hisL Icard from R~i~t~z~ __ ~ b7C camera. The item was set t~to his old address. The I card that was used ended inL_____j ~---~
I
I
believed that the compromise could be related to his Android cellular telephone, which he had "rooted". One of the consequences of rooting the telephone was that other programs that normally would not have access to the files "Shared Preferences" and "s.db" could now access those files. The files contain information such as from the telephone. A few days prior to the individuals advising I 1 that he had been compromisedl Ihad ed and installed a program called "atorrent" from the Android store. This program allowed a ufer to dOjN;nlOad torrent files onto your cellular telephone. _ _stated that he used the program several times to test it, ing music and a movie.
b6 b7C
I
lalso stated that his laptop could have been a potential source of the compromise, but did not believe that it could have been his desktop computer. b6 b7C
AlthOllgh #AntiSec claimed to compromise two Gmail s, I believed that the second compromised may have been his Yahoo! ,! I since he had to ! Istated that he was unsure how the would have determined that he was the owner of the Yahoo! L.:-----,;----::---......,..-"........"......---r---------I was unaware 1f t e Gma i he had create~~~-~~~-~-~had been compromised. Additionally, did not the exact name of that or the for it.
I
ladvised that he has wiped the hard drives of both his laptop and desktop computers. He also stated that he has deleted his Google that was compromised and reset his
b6 b7C
•
FD-302a (Rev. 10-6-95)
288A-SD-73148
Continuation of FD-302 of
--L
__j---------
,On
12/06/2011
,Page
_J_
which removed Android cellular telephone ......."._.."....__ .....,...._.."....----' all of the text messages he had received.
b6 b7C
•
FD-302 (Rev. 10-6-95)
b6 b7C
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
01(05(2012
On 12(31(2011, an individual posted information regarding' the compromise of the California State Law Enforcement Association (www.cslea.com) on www.pastebin.com. The information provided an explanation for the attack, e-mail communications from CSLEA personnel discussing the security of their website, as well as name, address, , and credit card information for individuals related to CSLEA. Additionally, the message stated that the compromise of CSLEA was "how Special Agent I I at the California DOJI IUnit got humiliated last month".
b6 b7C
The referenced information has been printed out and attached to this document.
Investigation on
F~#
01(05(2012 ----~~--------
288A-SD-73148
at
, 5.~ .
San Diego, CA Date dictated
I by
b6 b7C
SAl ----~.~------------------~-------------------------------------------------
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is 10a~our it and its contents are not to be distributed outside your agency.
,;;z2394,-",SD _ Y] 31 V [3/ ~
agency;
~e!
v
1/5/12
Hello comrades and thanlr
PASTEBIN
~~
e
ing us for the final phase of our cross count - Pastebin.com
.'; "ASI' IOOl SINer' 21)0]
CREATF.NEW PAST!:
TOOLS
API
AR01IVf
search••.
Follow@pastebin
Untitled
'_OGIN MY SETT MY PASTES
,
BY: A GUEST I DEC 31ST, 2011 I SYNTAX:NONE I SIZE: 71.51 KB I HITS: 2,862 I EXPIRES:NEVER
PUBLIC PAS
COPY TO CLIPBOARD I I RAW I EMBED I REPORTABUSE
Lou Reee 9 secage Untitled 23 secal
Database 34 seca~ inserting 54 secal
1. 2. 3. 4. 5.
Hello comrades and thanks for ing us for the final phase of our cross country hacker crime spree, our contribution to prOj3kt m4yh3m. We're still preparing the torrents, mail spools, as well as our final txt zine release which will surely bring humiliation and embarrassment to many white hats and syss. But this New Years Eve, we bringing yall some party favors to keep 6. you raging all night. Did you a month ago when the mayors and piggies
Untitled 1 minag Untitled 1 min ag Untitled 2 minag
7. across the US conspired to attack protesters in public parks? We sure do, so we
Selecting 3 minag
8. have been planning a retaliatory raid of our own. Bring it, NOAA. Bring it,
9. SOPA. We are snipers with one hell of a scope! Takin out a cop or two, they 10. can't cope with us!
LAYOUT WI
11.
12. 13. 14.
15. 16.
west coast - east coast
,
/*******************************************************************************
CALIFORNIA LAW ENFORCEHENT ASSOCIATION - DEFACED AND DESTROYED BY ANTI SEC *******************************************************************************/
17. 18. Soundtrack to the Rev Track: The Coup - Five Million Ways to Kill a CEO 19. http://Wl-IW.youtube.comll~atch ?v=lJotps9V4as 20. 21. 22.
I'm from the land where the Panthers grew You know the city and the avenue
23. 24. 25. 26. 27. 28. 29. 30. 31. 32.
If you the boss we be smabbin through And we'll be grabbin' you To say "What's up with the revenue?" Most everybody already knows that we don't like police very much. Shit, just about everybody hates them, everybody except for the rich and powerful who depend on their protection. But which state got the most blood on their hands? Well we already owned pigs in Texas and Arizona, and many many others; guess its time to ride on the California police.
33. From the murder of Oscar Grant, the repression of the occupation movement, the 34. 35. 36. 37. 38. 39. 40. 41. 42. 43.
assassination of George Jackson in San Quinten prison, the prosecution of our anonymous comrades in San Jose, and the dehumanizing conditions in California jails and prisons today, California police have a notorious history of brutality and therefore have been on our hitlist for a good minute now. So we wenc ahead and owned the California State Law Enforcement Association (CSLEA.COM), defacing their website and giving out live backdoors. We dumped a few of their mail spools and forum databases, and we did get a few laughs out of reading years of their private email correspondence (sucrras CSLEA's Legislative and policel
44.1
pastebin.com/MSaBvt9R
I· But what
I
we wez e really after was their hip rosters, ~/hich
-,
b6 b7C
SHARE PAS'
1/25
Hello comrades and thanks for ing us for the final phase of our cross count - Pastebin.com
1/5/12
e
45. included the cleartext wor82500 of their ~mbers," guaranteeing the 46. ownage of many more California pigs to come. 47. 48. "But waitl Cops are people tool Part of the 99%1" orly? When these soulless 49. traitors voluntarily chose to cross the picket line and side with the bosses and 50. bureaucrats, they burned all bridges with working class. As the bootboys for 5l. capitalism they do not protect us, instead choosing to serve the interests and 52. assets of the rich ruling class, the 1%. Many Occupiers are learning what many 53. of us already know about the role of police in society when they violently 54. attacked protesters occupying public parks. Now it's time to turn the table and 55. start firing shots off in the right direction. Problem, officer? 56. 57. Interestingly, CSLEA have discussed some of our previous hacks against 58. police targets, raising concern for the security of their own systems. However 59. c::=Jdeliberately made some rather amusing lies as to their security. He 60. repeatedly denied having been hacked up until web hosts atl IShowed him 6l. some of the backdoors and other evidence of having dumped their databases. We 62. were reading their entire email exchange including when they realized that 63. credit card and information was stored in cleartext. This is about the 64. timec:::]changed his email , but not before receiving a copy of the 65. 'shopper' table which contained all the CCs. Too lateJ.~ ~ 66. 67. In all fairness, they did make an effort to secure their systems after discovery 68. of the breach. 1 69 70
b6 b7C b7E
72
79. 80. 8l. 82. 83. 84. 85. 86. 87. 88. 89. 90. 9l. 92. 93. 94. 95. 96. 97. 98. 99. 100. 10l. 102. 103.
b6 b7C
1
71
73 74. 75. 76. 77. 78.
4.8k
I
But we still had and were stealthily checking out the many other websites on the server, while also helping ourselves to thousands of police names and s (it's how Special Agent at the California DOJI ~nit got humiliated last month). For two months, we ed around their private list amongst our black hat comrades like it was a fat blunt of the dank shit, and now it's time to dump that shit for the world to use and abuse. Did you see that there were hundreds of @doj.ca.gov s? Happy new years I I
I
I
b6 b7D b7E
/*******************************************************************************
LIST OF SITES HOSTED BY CSLEA, NOW WIPED OFF THE NET III *******************************************************************************/
Association of Conservation Employees (ACE) Association of Criminalists-DOJ (AC-DOJ) Association of Deputy Commissioners (ADC) Association of Motor Carrier Operations Specialists (AMCOS) Association of Motor Vehicle Investigators of California (AMVIC) Association of Special Agents-DOJ (ASA-DOJ) california Association of criminal Investigators (CACI) California Association of Food and Drug Investigators (CAFDI) California Association of Fraud Investigators (CAFI) California Association of Regulatory Investigators and Inspectors (CARlI) California Association of State Investigators (CASI) California Organization of Licensing Registration Examiners (COLRE) California Association of Law Enforcement Employees (CALEE) California Highway Patrol Public Safety Dispatchers Association (CHP-PSDA) Fire Marshal and Emergency Services Association (FMESA) Hospital Police Association of California
pastebin.com/MSaBvt9R
"
(HPAC)
2/25
Hello comrades and thanks for ing us for the final phase of our crosscount- Pastebin.com
1/5/12 104. 105. 106. 107. 108. 109. 110. 11!. 112. 113. 114. 115. 116. 117. 118. 119. 120. 12!. 122. 123. 124. 125. 126. 127. 128. 129. 130. 13!. 132. 133. 134. 135. 136. 137. 138. 139. 140. 14!. 142. 143. 144. 145. 146. 147. 148. 149. 150. 15!. 152. 153. 154. 155. 156. 157. 158. 159. 160. 16!. 162.
Resource Protection Peace OffiJilt Association (~POA) state Employed Fire Fighters Association (SEFFA)
".
4IIt
/*******************************************************************************
OUR FAVORITE SECTION IN ANY GOOD HACKING ZINE - EXPOSING THE CLUELESSNESS OF WHITE HAT SYSS IN THEIR OWN WORDS. OUR STORY BEGINS IN AUGUST WHEN CSLEA TAKES NOTICES OF OUR PREVIOU~ ATTACKS ON POLICE SYSTEMS. IS ANYONE SAFE?I *******************************************************************************/
pastebin.com/MSaBvt9R
, b6 b7C
3/25
Hello comrades and than~r
1/5/12
ing us for the final phase of our cross count - ~bin.com
.225• .226 • .227 • .228 • .229 • .230 • .231.232• .233. .234. .235. .236• .237 • .238 • .239. .240• .241.242• .243. .244. /******************************************************************************* .245. LOLOLOL so MUCH FOR "ENCRYPTED MEMBER DATA". DAMDou DID HALF THE WORK .246. FOR us. AND DESPITE BEING AWARE OF THE BREACH, YOU STILL COULD NOT KEEP US OUT. .247. ON TO THE NEXT TARGET •••• NEW YORK POLICE CHIEFS, OWNED AND EXPOSED III .248• *******************************************************************************/ .249. .250. Soundtrack to the Rev #3: cop Killer by Ice-T .251http://www.youtube.com/watch?v=p5gRlud57jQ .252• .253. I got my black shirt on • .254. I got my black gloves on • .255. I got my ski mask on • .256. This shit's been too long • .257 • .258. I got my twelve gauge sawed off. .259. I got my headlights turned off. .260. I'm 'bout to bust some shots off. .261I'm 'bout to dust some cops off. .262. .263. I'm a cop killer, better you than me. .264. Cop killer, fuck police brutality I .265• Cop killer, I know your family's grieving, (fuck 'eml) .266. Cop killer, but tonight we get even, ha ha • .267. .268• For our next owning we bring you multiple law enforcement targets in the state .269. of New York, who has been on our crosshairs for some time due to their brutal .270. repression of Occupy Wall Street. We also want to bring attention to the 1971 .271- riots at Attica where in response to the murder of George Jackson, convicts took .272. over the priso, demanding humane living conditions. It is in this same spirit of .273 • cross-country solidarity that we attacked police targets in NY • .274 • .275. We're dropping the md5-hashed s and residential addresses for over 300 .276. Police Chiefs in the state of New York. We are also sharing several private mail .277. spools of a few NY police chiefs. While most of the contents of these emails .278. involve boring day to day office work and blonde joke chain emails, there were .279. also treasure troves of embarrassing personal information as well as several .280• "For Official Use Only" and "Law Enforcement Sensitive" documents discussing .281- police methods to combat protesters • .282. .283. Subject: Mid Hudson Chiefs Fwd: Demonstrators
b6 b7C b7E
,
b6 b7C
,
, pastebin.com/MSaBvt9R
22/25
•
.
e
Hello comrades and thanks for ing us for the final phase of our cross count - Pastebin.com
1/5/12 .343 • .344.
-----11
1....---
.
345. .346 • There were also many parolee/probationers
but the thought of betraying our comrades under the gun of the prison industrial complex never crossed our minds • .348. But how about sum moar private police documents?? We dropped these on Bradley .349 • Manning's birthday: •347.
.350.
b6 b7C b7E
.351. .352 • .353 • .354 • .355 • .356 • .357 • .358. 359. .360.
// THATS ALL FOR NOW KIDDIESI EXPECT A BADASS ZINE AND TORRENT COMING SOONl!I!I!
CREATENEW PASTE I CREATENEWVERSIONOFTHIS PASTE
RAW Paste Data
~----------------------------------------------------------,
b6 b7C
PASTEBIN.COM TOOLS
a APPLICATIONS
WINDOWS DESKTOP
pastebin.com/MSaBvt9R
FIREFOX
CHROME
IPHONE a IPAD
WEBOS
ANDROID
MAC
OPERA
cue
24/25 -,
Hello comrades and thanks for ing us for the final phase of our cross count - Pastebin.com
1/5/12 PASTEBIN.COM
CREATE NEW PASTE DOMAINS CENTER
I APIINOS
I S I FAQ I tOOLS I P~IVACY I I AD.SE
I PASTEBIN ON FACEBOOK I PASTEBIN ON TWinER
I PASTEBIN IN THE
I STATS I GO PRO ::!J
NEWS
~"t OUR SITES: HOSTLOGR I TINYSUBS I URLSPY I FILESHUT I MORE... TIME: 0.01265
,
pastebin.com/MSaBvt9R
25/25
b6 b7C FD-302 (Rev.10-6-95)
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
01/11/2012
__
The following is a summary of the results of the subpoena:
b3 b6 b7C
The results have been printed out and are attached to this document for the file.
Investigationon
01/11/2012
Fil,'
28 8A-SD-7 314 8 t
by
SA
ce
at
San Diego, CA _.:.:__:_.;:_::....::..:...:....::::....:.....:..___:_----D-a-te-d-ic-ta-te-d------------.
I
b6 b7C
r.
This documentcontainsneitherrecommendationsnor conclusionsof the FBI. It is the propertyof the FBI and is lo~nd to your agency; it and its contentsare not to be distributedoutsideyour agency.
:;<_,f!3f!3 F)-sO _ 7 3/l{
,
~
/
•
(Rev. 05-01-2008)
UNCLASSIFIED
•
b6 b7C
FEDERAL BUREAU OF INVESTIGATION
ROUTINE
Precedence: To:
Date:
01/26/2012
San Diego
From:
San Diego CYl :
Drafted
11....-
By:
Approved
By:
SA L...-
____J
____1
-J
L-I
Case ID #: 288A-SD-73148 Title:
..., (Pending)
b6 b7C
UNSUB{S); #ANTISEC; VICTIM; COMPUTER INTRUSION
Synopsis:
Close captioned investigation.
On November 18, 2011, ~etired California Department of Justice Special Agent Supervisor IL.....II advised that he received text messages from his own Google telephone number indicating that he had been "owned". Details:
b6 b7C
On November 18, 2011, a YouTube video was posted with the title "#AntiSec Fuck FBI Friday V - Cybercrime Investigator Cormnunications"from the YouTube The video was 6:03 long and stated the following information, which was also posted as text below the video: "Greetings Pirates, and welcome to another exciting #FuckFBIFriday release. As part of our ongoing effort to expose and humiliate our white hat enemies, we targeted a Special Agent Supervisor of the CA Department of Justice in charge od I We are leaking over 38,000 private emails which contain detailed computer forensics techniques, investigation protocols as well as highly embarrassing personal information. We are confident these gifts will bring smiles to the faces of our black hat brothers and sisters (especially those who have been targeted by these scurvy dogs) while also making a mockery of "security professionals" who whore their "skills" to law enforcement to protect tyrannical corporativism and the status quo we aim to destroy. \
UNCLASSIFIED
\\
b6 b7C
p
~\~
UNCLASSIFIED
To: Re:
San Diego From: San Diego 288A-SD-73148, 01/26/2012
We hijacked two gmail s belonging td Iwhohas been a cop fonyears, dumping hislprivar email correspondence as well as several dozen voicemails and SMS text message lo~~hile just yesterday was having a private BBQ with hisl Ifriends, we were reviewing their detailed internal operation plans and procedure documents. We also couldn't overlook the boatloads of embarrassing ersonal information about our co friend e lulzed as we listened to an r voicemails fro We turned on his 00 Ie web history and watched him look UpL,--,. _ ___,J L---IWe also abused his google voice , making sureL.r-_...&.l..l=, and family knew how hard he was owned. Possibl the most interestin content in his emails are the internal email list archives (2005-2011) which L...;-__ -:--:--_-:-_-:-_-:-_-:--:__ .JThe information in these emails will prove essential to those who want to protect themselves from the techniques and procedures cyber crime investigators use to build cases. If you have ever been busted for com uter crimes, ou should check to see if our case is being discussed here. There are discussions abou
These cybercrime investigators are supposed to be the cream of the crop, but we reveal the totality of their ignorance of all matters related to computer security. For months, we have owned several dozen white hat and law enforcement targets-- getting in and out of whichever high profile government and corporate system we please and despite all the active FBI investigations and several billion dollars of funding, they have not been able to stop us or get anywhere near us. Even worse, they bust a few dozen people whl are a!1egedly ~art of an "anonymous computer hacking conspiracy" but who have only used kindergarten-Ieve this isn't even hacking, but a form of electronic civil disobedience. We often hear these "professionals" preach about "full-disclosure," but we are sure these people are angrily sending out takedown notices and serving subpoenas as we speak. They call us criminals, script kiddies, and terrorists, but their entire livelihood depends on us, trying desperately to study our techniques and failing miserably at preventing future attacks. See we're cut from an entirely different kind of cloth. Corporate security professionals like Thomas Ryan and Aaron Barr think they're doing something noble by "leaking" the public email discussion lists of Occupy Wall Street and profiling the "leaders" of Anonymous. Wannabe player haters drop shitty dox and leak partial chat logs about other hackers, doing free work for law enforcement. Then you got people like Peiter "Mudge" Zatko who back in the day used to be old schoollOphtlcDc only now to sell out to DARPA going around to hacker conventions encouraging others to work for the feds. Let this be a warning to aspiring white hat "hacker" sellouts and police collaborators: stay out the game or get owned and exposed. You want to keep mass arresting and brutalizing the 99%? We'll have to keep owning your boxes and torrenting your mail spools, plastering your personal information all over teh internets. Hackers, us and rise up against our common oppressors - the white hats, the 1%'s 'private' police, the corrupt banks and corporations and make 2011 the year of leaks and revolutions! We are Anti-Security, We are the 99% We do not forgive. We do not forget. Expect Us!"
UNCLASSIFIED 2
b6 b7C b7E
b7E
To: Re:
•
UNCLASSIFIED
San Diego From: San Diego 288A-SD-73148, 01/26/2012
A link was also provided on the YouTube page to the documents that were taken from . The jnformatjon was located at
I
1....-
~dditionallY' some of ~he jnformation contained within was posted at I
r
...1.
I
l
b6 b7C b7E
On November 30, 2011, California Department of Justice pr1:i:~~ t:: ~BI with a CD-ROM disc containing the files located atr These files are contained in a 1-A envelope to thed are protected with the following :
c"h ...... nc,.,'"
;
On
I
CC'
ICr'l
Iresponded to a Grand Jury ;,.,
I
Y"c1"'~; r.T1 rr.1
b3 b6 b7C
Due to all victim information bein lack of ~~ __~ closed .
b3
~San Diego requests that captioned investigation be
••
UNCLASSIFIED
3
b6 b7C FD-302 (Rev. 10-6-95)
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
01/26/2012
e-mail address was ~ terviewed telephonicall~ter the identity of the interviewing Agent, L____j following information: b3 b6 b7C
ed the writer and advised
Investigation on File #
01/24/2012 at ----~--~---=~-
288A-SD-73148 I
by~S=A~I
r
(telephonically)
San Diego, CA Date dictated
~
_
i (J
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loan~ it and its contents are not to be distributed outside your agency.
~eBA --SaD
_I) '?J 14 6
your agency;
b6 b7C
lA Envelope Case ID: 288A-SD-73148
'II ,
!
1
~
-----------~------------------------------~---------------------~-------------------------------------------------------------------------------------~--------------~~~-----------~------------------------------------------------~------------------------------------------------------------------~-------------~--,! ----~-~-----------------~----------------------------~---------------------------------~--------------------------------------------------------------------~ -----------------------------------------------------------------------------~.-
Ii
~
i
-----------------------------------------~----~------~-------------------------
I "1
iI ,
i
1,_,__
-------------------------------------------------------------------------------------------------------------------------------------------------------------
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
-----~-------------------------------------------------------------------------------------------------------------------------------------------------------
-............--~~~
---------------------------------------
\
~
~
,
.
') FD-340 (Rev. 4-11-03)
__..2'"'-'L!88.L.!A"-!.-....-=~:....=1:::>=--~__.::7..S:~!....:1~t.l.!...l8'.J.._
File Number
Field Office Acquiring
Evidence
Serial # of Originating
Document
Date Received
I 2. I/OltJ
~
_-"-L.J-.l.
_
-::3==~"----------------
12.0\ l
,
From
(Name 01 COlillibUlOl/llilviewee)
(Address)
b6 b7C
(City and State)
s~1
By
To Be Returned
-
I· 0 0
IZ( No
Yes
Receipt Given Yes ~No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure ~No
DYes I
Fedenil Taxpayer Information (FTI) DYes Title: LJ N S U1> ( ~)' J
itA('l.TI S.Ec...'
1
' C.O.,\llu"Ta'Jt
Reference:
Description:
~~
1-.£, (..IL,c.1.~
1f\1~OS.loN
'f'D -.302 Jl).ted
~
l'2..tcn/2P Ll (Communication Enclosing Material) b6 b7C
Original notes re interview of
r---~~~-----
~16~\JCY..Yw;-L+..u.te
<.!.Lo1~e.ry!.Lf'~--lOO::!..+.l..-Se;.1,,~er' . \i~~~....s.b7Y-tI
_j-------
t..
.;
. I
i I
I
J
/
i
-
-
----
-----~--,
-
I
.
• 1
.--'
!
t.
,I
.
~E"t ..~\Lcz.~~'"
~_.£
c....... "'~
• -:j)~~-t..._.,.,l\."f h......( \ c...",,~= ~
. 'i?
,l _(
~r'ifO~c1
tC. __ 'l ....... .J.
~%!
~d 7
a:tl~
y.,_~
..LM
+-
Q.e~~
~l:~
~k.~
..."k.~
.~~~e.."
J
~y.J..rwofAL.C..-'::.
. A.ec.o """ b. e
'I
• otite......
')1"J')Q,r....us. c_..
L\.a..",
1k~~
~ec:....s....
I....)
II
l~-br.,~I/ Gwt;A
'.-. S~
b6 b7C
,j :j
l(j~~
....
I1 -;)...
1
-.)1
II
I
0 (.... '"c.M u
o.t\
ph lMJZ.
·l4'~ye..J +e...'iOb:. .Q.~ .A 11 ,..~:'
...-b{ r(!."~ ~"-~
1·~,
. c..l'Y\.+.:'~
"~-hJJ~ ,
I
,• \Jh~tll rr.f~
II
t
II ,
II
"II.,..
oJ
4'(1
'-.I
-h ~.,..,.,,;{~hf)1\-t J
I
.9-~
t;~1
~~T ~
.J
a.i.c..A- -po-S;f-s
C1"_~~
-\-t'~f\"itw. '3:.\M.,,\c.kh.,.
~lI~~L~("
'\)
It
c-. F1\ ..c.~
\,_,lL-l 1.... .-
I\...~
t
c.,._lls
.....Jl
[4,m+ Q?I
c;l J
v
......
r-..u...,.:!:i/;i
a.cc.±
~t'ta
-..J
~
t:1tfl-;Lt U
I.dA
.... ~
--
- ---
-----~-----
.. .--
/
IW
~
. Dv-Jweck
c~~
'1'::.
r1r.>r'(c~
~c -II
I
b6 b7C I
i I
..0 v J e,..-J
I
.t...w... ~, +z.
i I
:
,
>
-I
,~
--
.>
~r;.M
«HC<.
(~n-Jc.-~\ ,
Statement regarding the hijacking of my personal s:
I
On Friday 11-18-2011, at approximately 0700 hours I was getting in my car and began receivina text ressages on my phone from my own Gooale telephone number of
I
This number is associated with my bccount of I , The messages stated that in essence, the senders had taken over my and hat they "owned" me. The messages were also directing me to a specific chat room (I already deleted the text) to them, otherwise they were going to post my email and personal information all over the Internet. I ignored them and they continued to harass me with incoming text messages. I checked via my smart Android based cell phone, and immediately noticed I no longer had access to my Google , my Facebook that was assotated with the same email address, and the yahoo that was linked to my I The perpetrators continued to prod me to go to the chat room with threats of releasing the information, but I continued to ignore them.
b6 b7C
When I arrived home at approximately 0730 hours, I went onto the Internet from what I believed to be a secure computer and via the specific providers websites followed their online protocols for recovering compromised s. It took approximately 1 hour, but I was successful in gaining access to all the compromised s and changed the s several times to prevent the intruders from following the same protocols. In the Google , they harassed many of the s contained in my phone book with a variety of text messages. They posted personal emails from the email s around the In erne and m d Id s atements about compromising a Department of Justic Some ofthe email in m sent folder included
b6 b7C
They logged into my Facebook and deleted most of my photos, changed configuration settings, posted numerous offensive comments and personal messages to various friends, as well as impersonated me in various chats. . I received a phone call from a Huffington Post reporter (didn't get his name but seemed legitimate, b at approximately 1400 hours the same day. He was excited when he initially called, like he was at the forefront of a big breaking story. He asked if I wanted to comment on the compromise that happened to me and told me he learned of it from people in a chat room. It appears he thought I was going to be some high ranking manager of a computer crimes unit and there were going to be damning things in the data they stole. I quickly deflated his enthusiasm as I told himl I ....._ __~and that whatever they got was personal, but not embarrassing and I was not going to give in to their threats and intimidation by ing them. I further told him that in the overall scheme of things, I was really nobody and it was insignificant to terrorize me for their cause.
I
b6 b7C
Following my recovery of the s, the perpetrators texted me and said it was not over yet. They made a comment about how tough economic times were and I should beware of my financial status. I made a check of my assorted banking and credit
~~~--
-----
that I deal with online and discovered a fraudulent charge made th~ RiIz camera for app~XimatelY $896.95. The purchase was made with my and was sc~eduled to ship to an old mailing address a
to b6 b7C
I [
I ed I and they are cancelling the transaction and the . There are no other know discrepancies at this time and have since place a credit block on my personal information.
They continued to harass me via text and said they were releasing my telephone number to 150,000 followers on twitter, and hoped I wasn't busy. I received a few calls, but did only answered a few just to see what the callers had to say. 'Most just made ignorant comments and hun u . I disabled the mail , to avoid a backlo of voicemail as m hone i I believe this tactic, along with not acknowledging them in the text or chat rooms frustrated them and kept them from calling or texting too much. There were a couple of texts from I khat appeared to be sympathetic to me, wishing me well and hoping the hackers would be brought to justice. I ignored them as well, suspicious that the perpetrators were just testing to see if I was receiving their other harassment texts. I received only a few additional phone calls from mysterious numbers and harassment texts over the weekend. I desire prosecution.
b6 b7C
FEDERAL FOI/PA DELETED FOI/PA# Total
Page Page Page Page Page Page Page Page Page Page Page
BUREAU
PAGE INFORMATION 1204913-0
Deleted
16 17 18 19 20 24 25 30 31 36 37
OF INVESTIGATION
-
b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ; b6 ;
Page(s)
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
SHEET
11
b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; b7E; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
J ..
,I'
••
(Rev. 01·31.2063)
FEDERAL BUREAU OF INVESTIGATION
ROUtlNE
~recedence:To:-
Date:-
Cyber Division
ATTN:-
SSA
I
.10/ 08/2009
Computer Intrusion'
From:- San Fr-ancisc-o
Squ-ad CY-2/Sa',U-~~~I.LSA
Unit #2
I
__
:-
b6 b7C
Approved ;By:: Drafted.By}
~ __
~__ ~~~~
Case -lD #:- 288A-SF-i!t~f~ending)
/t
288A-SF-NtW-G'J (Pending) .....' ANT-I-SEC; UNSU-B (S), et al; -IMAGESHAC-K :-:--VICT'IM; COMPUTER I:NTROS'ION
Title:-
S_y:nopsis:- To Open , Case and s
f_i_les.
I
I
on October 8, 20 9, Special Agent A) met w"ith employee_s of IMAG at 23 rtfi Sant-a Cru-z Avenue, Los Gatos, California, 95030, to Lscuss two rec _ c-omputer i,ntrusions of IMAGESHACK sezvexs , -IMAGES'HACK is a company which provldes i,oternet "image host,i_ng.
-Details:-
IMAGE_SHACK advis-ed s'AI I t.hat the f_i,r-st comput e r intr"tlsion occur-red on July 10, 2009 at approxima_te_ly 7 pm Paci_fic St'andard 'rime (PST)._ A group by the n_ameof ANtI-SEC gai_ned
.
access to one of the companydatabase server s ,
hack-er (s) access-ed contafned I
l
able
to I
The server the
I
The hacker 1s1 w-ere als o 1
on th e t,he hacker (s) posted a mess-age I In addition, - intet:net which claims the ANTI-SEC .is a ,movement ded.lcated to the er-adic-at-ion of full disclosure. Their mess-age _further explained they plan to achiev-e tbis "t,hrough t,he fulJ and unrele,nting, unmerciful elimination of all ers of fulJ-disclosu-re and t,be security industr-y in its 'present form." b6 b7C
b6 b7C
d ~ b6 b7C b7E
To:· Re:·
San Francisc. From:· San Francisco 288A-SF-NEW, 10/08/2009
•
IMAGESHACK advised ·this computer intrusion affected approximately 50 million images and every that was on their site at the time viewing :images. IMAGESHACK .Ls steill ot su e ~ ...., got into t~eir database but believe.""=."......,,,,.,,,...,,. b6 b7C b7E
On August 2, 2009, :IMAGESHACK believes the same hacke_r(s) came back and gained access ·to their servers again. IMAGESHACK has -full and complete logs. 'It.is apparent the hackerls)1 I b6 b7C b7E
b6 b7C b7E
IMAGESHACK estimates their losses at approximately $26,000. :It is requested that t.he folJowlng subfiles be opened e SUS GJ
Grand Jury
It is .requested that the new casy and subf_i:lesbe opened and a.ssigned to SA ...1 __.J
b6 b7C
••
2
- --
_--
_cc--cc-_-=--_c_-"--=_c_
cc-==
-=--__:_:--:_:_:--c=_- -=--cc_-
_--,----~
-----
---
-
•
10/21/09 -12:08:07 'ritle ~tI Date
and chaxaceex
•
'FD-192
ICMt~ROl Page l
of case s
SEC Pr.operty
Acqui_red:-
Source from which IMAGE'SHACK, c/ol
26-3 N SAN'rA CRUZ AVE '#100 ~OS GArOS CA 9S030
10/08/2009
Anticipated
Property
Disp.osit-i.on:-
Acquired
By:·
Acgui_red:-
l
26-3 N. SANtA CRUZ ' ,"
Case ~gent:
I Desc_ript,i.on_ of Pr.operty:· .1B 1
Date
Entered
.srx (6 )
HAEDDRIVE'S:· '-THREE (3) WES-TEENDIGlTAL S/r::; WMAP4,123996-4, S/ij W~KI{12S207'1 AND SiN WMAKE-2_1S'3028 -TWO(2) }{tT~Cl{I: SiN CKC4U'9S'E, SIN C~t-5'H4ME -ONE(1) S'N{SQNGSiN S09QJ1'OL218644 ONE( 1) f!tTAcHt Bare'ode:·
E4189643
Case Number:· Owning Off.ic'e:·
10/09/2009
288A-SF-145486 SAN FAANCISCO
b6 b7C
,
08/1_9/10 19: 29: ss , T,itle
Date
-FD-_1_92
and Character
Property
of Case:-
Aequi_red::
•
Source f_rom wb,ich Property SV-~CJ"L
Ae_qui_red:-
Acquired
Case Agent:-
ICMI:IiROl Page 1
08/19/2010 -Anticipated
Disposition:
. Description
~I
BYi
b6 b7C
~
Date Enee_red
of Prope_rty:-
l_B 2
·ONE(1) CD LABELED5'0'-·09-016'2 (DE,R:IVAtIVEEVI:DENCEOF 181) Baz'code s E4189947
Case Number:Owning Office:-
_Loe-ation:- S_JECR
08/19/2010
'PRESS3
288~-SF-~4_5486S~ FRANCISCO
·mY~ k-'"
ot8~ t\ -
1~' -
Sf - '46
10. 2.
•
..
)
FD·302 (R~v.10-6-95)
•
.. • 1•
FEDERAL BUREAU OF INVESTIGATION
Date of tratlSCription
1Q L Q ~ L2 0 Q 9
--------------~I
On October 8, 2009,~1 was interviewed at his place of employment, ,IMAGESHbCK, located at '236 North San Cruz Avenue, Suite ,100, Los Gatos, California, 95030, telephone number 40S-836'-8579. Afte~ advised of the identity of the interviewing agent, L______j provided the fOl_lowing information:· On July 10, 2009 at approximately 7: 00 p.m., U1AGESHACK servers were hacked. The hacker(s) ,we:e able 'to qet into the ~~~~~~~~~~~~~~~~~~lnsl L.....__ ....-----------___.....,I I -indicated the This sever also contained b6 b7C b7E
L-----:,---:-I indicated 'IMAGESHACK does not ~~~~formation~~~~~~-~~~~~~~----~~~~~~ ave a that from that server, the Ultimatel
~~_~advised this affected every ~~~O~-,o:"Tl~:"""'TlIT'7C~-.,.;~'=""I:'7C, ~ and approximately 50 million images. He -indicated IMAGESHbCK images were replaced with this propaganda message for several hours. I I said this caused quite a stir on the internet as it affected many website backgrounds as well. I ladvised a group named ANTI-SEC c Latmed responsibil.ity for ,the hack of IMbGESHACK on the internet. 1 1 said the technical team at IMAGESHACK believed the hack was a result of an I I He ~~ifi~p~ that after 'the hack. the technical team at IMAGESHACK I
II
I
back.
On August 2, 2009,1 1indicated the hacker (s) came He advised ,the staff at IMAGESHACK believes it was the same
b6 b7C b7E
({'ss ))wb::;l;se theyh~yised L that at the time it appeared the I haaCckkeerr •
0
I
h
was able tol
I
lov~stigation fil~ by
*
I '
on
.
09/08/2009
28 8A-S F-14 5 4 86
The technical team 1
;;:r
?t
....;;;.L.;.o.::.s_G.;;..-:;;,a.;.to.;..::.s~, _C.;.a=l;;;;,i·;;;;,fo.;..::.rn;.;;,;;.ia;;_ _ Dat~ 4i«ate4
.;.,N..;;.;A;..._ _
SA
This doo.nn~nt contains f1cith« fe¢Omme~ions fIOI' con?tusions of th~ fBI. It is t~ ptop¢rty of the FBI a.n4 is ~e4 it w its CQfItentsar~ I\Ot to be dlstriblolte4 outMe your ~ency.
to your ~gen¢y:
b6 b7C
)
•
•
,
288}J.-SF-145486
ContinuationotfD·3'0201
:~L
---"---------'
On
Q9/0B 120 09
Z
.Page
b6 b7C b7E
During tb~ second ,attAyk, tb,e bac~went J tben I J 'and tben "'__---;::::::==::::::;---'
througb the :through tbere. b6 b7C b7E
$26',450. !--:-.......-- ........... I provided one compucer Di,sk (CD) -LabeLed IMAGESHAC~ 'ANtI SEC which he did not want .recurned that cont-ained copies of an ovezvd ew of the hac~';, 'Mitt-S'EC jpg. ,image posted to t,he
th;
server's, email ',froml'reg'ardi,ng tbe identity of tbe hacker t s), ana chat ' o9srqm : t1AGE:S'HACK st'aff dur.in_g t he bugust ,2009 at t'ack ,
2,
---....II'provided 'six, hard, drlv'es to S,~ I and signed 'an FD-941 Consent to Syarc,h Corciputer(s ) form for t,hese six hard drives. I J was al so 'provided and si9ned an FD597 On,ited St'ates Depart,Inent of Justice, Feder'al Bur-eau of , Investig'at:ion, Rece,ipt For Prope r ty Received. 'I'be, fd-941 and FD-' 597 and CD have been placed Ln a lA .enve'Iope and, sent 'to the ,file. L...-
b6 b7C
,
•
.
(Rev.OS"()1.ZOO8)
bl b3
FEDERAL BUREAU OF INVESTIGATION ~
Precedence: To:
Attn:
San Fr-ancisco
From:
San Francisco Oakl_and ~, : !
Approved By. Drafted (5)
Date:
ROUT-INE
...case tD
By:
S~A-l _ S
~~Y-2 ~ CY--3
1-2 -and CY- 3
I.
.
~========::::::;-~
b6 b7C
r
~==========~----------~ I
bl
#u:ml b3 ·~(~O~)~~2~88~J~-~S~F~-~1~4~1~8~90~----------~(~p-e-n-d~in-g~) (U) ...-288A-SF-145486_ _ --~
'ritle:- .~
J:s<
W)
1_1/03/2009
DEATHIS COMING.FROMTHE EAST; 'ONSOB (S) ; C.I/CT - TNtI WORLDDEE-'ACE&S,
UNSUB(S) ; CT - TNt!
OO:SF ~nti-Sec UNSUB(S); lMAGESHACK- VlcrIM (U)
Synopsis: 'Anti-Sec.
(5) (U)
Reference:
M.
Ide_nti_ficat-ion
of possible
f()Un~ing member of
~
~~~~~~~~~~~-r~--------------~ .~ 288A-SF-145486- Ser-ial -1
------ll
(5) ·············l.___
+S)
uummumuS~INOFOR~m'
mmul
bl b3
•
To: (5)
Re:1
S~/INOFORN~
San Francisco
From;
San Francisco ....J
L..
bl b3
(3)
/ \
(U) Open jource searches provide no information that Anti-Sec hacked. I b7E
San Francisco division
The hackers changed the server settings to redirect every image to a hacker logo. The hackers posted a message claiming that the Anti-Sec group is dedicated to the eradication of full disclosure by eliminating the cyber security industry. (288A-SF-145486-,Ser:ial : 1) (U)
Anti--Sec claimed that a r
1
I.
An identified
b6 b7C b7E
1
1
I
1
Ifurther
stated.tnat Ant 1. -sec IaOrl.Ca~e--cr the claim ofl.~~ ~ ~ ~ ~l White-Hat Hacker and Cyber Security Communities. Open source rese~rch r~yealed that several -large web hosting companies consl.deredl~. ~ ~ ~I (800A-HQ-C1591622-NO, Serial : 20010).
b7E
1 I
I
b7E
(800A-HQ-C1591622-NO, Serial 20010)
(S)
bl b3
-
(3)
. To:-
•
Francisco
S~IINOFOl!N~
FroID; San Francisco
Re: bl b3
Possible Identification of a founding member (5)
~/
/NOFORN~L....-----I
3
bl b3
•
•
•
(3)
Franei seQ
To:·~e:
~lINOFORN~ FrOm·-
San
bl b3
Francjsco
,LEAD (8) : Set, Le'ad 1:
(Info)
SAN FRANCISCO AT SAN JOSE
(U) R¢ad 'and Clear.
++
bl b3
l
•
•
••
•
,UNCLASSIFIED
FEDERAL BUREAU OF INVES,-IGATION
iPrecedence::
Rou'tINE
Date::
1_1/10/200Q
'To:, 'San EYanci_sco From:- San .-Francisco
S'quad C'i'2/ Sal1.....JO\l:..:olQ:.ws.:..:e_'.LlIMLA-' :· SA I
---.
~--~---------~ '0, I
Ap~rovea By: Drafted
----JI
By:' ~
Case 10- #:: 28aA-S-F-145486 ,
I
'Title:-'
b6 b7C
/
(pendingVt.t
ANtI-SEC;
(JNSOB(S); JMAGES,HACK _' 'VICTIM; COMPUtER'lNTRO$ION 'Synopsis:-
,to 'Report US ,Attprn~¥
Of
operii_ng .' On October ,9, 2009, Special }J.gent (SA) ~I=-:---:-_~_~ e~a,i:le,d Chief, A~'s,ist,-ant, _Un_i~ed St-~t'e,y Attorney ,(AOS'A);,fo,r,-t.,he Computer Int,rusl.on and ,ij,ackl.ng Un,l.t"L Ire,gardl.,ng concur renee ,for new capt.Lcned :investigation. ,rbe e-mail ccncafned a surn.rnarY'-oi'the case informat,ion., ~AI lwas ccntact ed t'elephonica11y and g,ran:ted ,~oncu'r_'rence regarding cC'aptioned i,nvestigation -and advised ,that !.AusA jt;tould be as'sLqned t,he -case ,
:Details::
I
..
I
to ,AUSA '
-Attached
I
and-made a,'part
of t_h,is document 'i,s the -email
-UNCLASSIFIED "
b6 b7C
•
fD·S42 (Rev.o3-i3-20(9)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Date:To:-
11/13/2009
San f'r"anc_isco
From:-
San Francisco Squ-ad -C'i'2/s_a1Jose M :S~_
Approved Dr'afted
By.:- I B~:-
Case ID #:: Title:
Synopsis::
----!I
I
b6 b7C
___,f
'7
288_A-SF-1A:S486 (pendi_n~
~NTJ-SEC; UNS-UB (S), et ali .IH~GES.HAC}{ - VICT-I~; COM£iOTER INTJ~USION To Claim St·atist_ics.
I
On September -16', 2009, Special Ag-e~t (S]J.) te_lephonic-ally spoke to ,the vict_im company, Imag-esh..... a-c"""k-, -------, .re,g-arding c-aptioned rnat t er and set a date to meet in per~son. Detai_ls:-
On October 8, 2009, SAlimet wit.ol lof Image_shack and obta med the de~:i_nfoI:mation about the capt Lcned comput er i,nt:rusions. ,Possible s'ubj ect (s) have been :identified.
b6 b7C b7E
SAl
On Noyember 13, 2009,
UNCLASSIFIED
- ---
-~ -
-
-~-- ---
"
~---
-':__c--''---
--==:__::___::_____---=--=
UNCLASSIFIED
To: Re:-
e.
San Fr-ancisco From:- San Francisco 288A-SF-145486-, 11/13/2009
Accomplishment
Information:-
Number:- 2 -Type:- CI? 2703 (f) ORDER SERVED ITU:- crs -tTU:- :LIAISON WtTH OTHER AGENCY' Claimed ~y :-1 SSN.Name:Squad :-~C=Y=2O:-----___' Number e 2 Type:err SUBJECT IDENTI FlED ITU:· err ITU:- LJAISON WITH OTHER AGENCY Claimed By '1· SSN:· Name:- L...-...."..".".,..... ...... Squad:CY2
b6 b7C
Number:- 2 Type:C1P VIC'tIM CON'I'ACTE-D/INTERVIEWED ITU:- bGENT :INTERvtEW -ITU:- CIP °tTU:· INDIVIDUAL/NON-INFORMANT ITU:- .LIAISON WI'tH OTHER AGENCY Clairn_ed SSN:· Name e Squad :·L...-C~Y~2";------"'"
BY:·I
++
UNCLASSIFIED
2
·~'a
"~t
FEDERAL: BUREAU OF:INVES'rIGATION
I>~e, of trltlseriptiQo
a
On 'Dec~'~~~~~~~-w~~~~~~~ f'acsimile from
. 'aforement;:ipned ..lac'simi,le' tb,i,s. documerrt ,
InvestigatiQo File. #
by,_
\
,
Oft,
12/08/2009
,288A-~F~145486:'~
12L Q2_L 20
0 ;1 b6 b7C b7E
~~
~.
"
had been. 'attac.be:d 'and ~i,s':made:'a !;a~t; of
,~ ,_c.;..a.;..'m;..Jpli..b.;..e.;...;;.l,;;,l,:..' _c~' .;.,;a.;,;.l,;;;,i.;,;.f...;,o.;,;.r.;.,;n;.;,;i;.;,;'a;,..' Date,di¢tate4,
_
-NA
--------------------
~
'Thi$ ~t.m'lent oontains neither recomrnendatiol:ls flOf «>n~I\lsiOtl$of the FBI. 11i$ the property of the "it an~ its ¢ontcnU are t.IOC to be distribute4 ou'tsi~ yOUtage~y. . ;
:
fBI aM
is Ioatle~ to Yout ~gen¢y;
b6 b7C
•
f'D·)02 (Rev. 10>-6·95)
"
,.
•
. . 1·
FEDERAL BUREAU OF INVESTIGATION
Date of tr~s«iption
0 3/ 0 Z /2 0 1 0
b6 b7C b7E
The abov~ referenced letter had been attached and 1s made a part of thi~sdocument.
Investigation on File /I by
01/23/2010
288A-SF-145486 ~ SAl
This d«urnent cootains nej~r r~ndations II ~ its contents are not to be 4istri~ted
at
CamEbell, California
,?-
I
Date d ietated
b6 b7C
(via .facsimile) NA
Z2b~
ID~ tf }J/ f};,
not con¢lI,lSionsof the FBI. It is the property of the FBI an4 is lQaned to your .ge~y; OIortSideyour agelXy.
•
UNCLASSIFIED·
•
"FEDERAL;BUREAU ·OF INVESTIGATION
:Date~
01/14/2010
To:· .san Fr'ancJsco ;From:·
San Francis'co Squad. Ci'z/sa1 ':
Jose .RA'
,SA,
~----~------------------~
::::::~ B::: ....I---------------'---,..I~ Case ID #:. -Titie:·
(pendingvY
288A-S-F-145486:
AN'T~I:-SEC; 'ON'S'UB(S), et al;' .1MAGtSHACK - V'ICT~tM;, COM:PUTER :IN'tRUSION
'SynoI>sis:·
Details:·
b6 b7C
To Claim Stat:ist'ics. On Jantiar
12
b6 b7C b7E
2010,
'Or),October 8, 200.9, :Ima_geshac,kprovided sA !-ol_ 'hard drtves and consent; 'to search t,bose hard drives.
UNCLASSIFIED
___.I, w:it,b sh(
..-UNCLASSIFIED -To:- San tranc1sco .Re::
288A';'SF':';1~5486:"
From:- San Fr-anc1s-co
•
01/14/2010
Accomplishment_ Information:: NurrlbeI':-
1-
type:- CIP 27-03 (f) 'ORDE:R SERVED I1'U:- crs iTU:: LJAISON' WI_TH,otHE"R ,A~tNC'.( Claimed
BY',:
SSN:
Name:: .__--==--==----_
squads
Nuinbe_r-:-
C';'2
......
b6 b7C
'8
:-rype :. : CIP VICtIM -tD/ .l,N'I'ERVlEWE'O "ITU:: CONSENSUbL SEARCH Claime.d
'~¥:I
ssa.
Name:-
'Squad
'
::L...-,,....C'""x2.,....-----
.....
..
UNCLASStFIED 2
•
FD-302 (Rev, 10..6-95)
-
•
·1. -FEDERAL BUREAU OF INVEsTIGATION
Pate ohl'ao~iption
0:i
L 2 7 12 0 1.2
Agent I I returned six hard, d~ive.s tol at hi_s plac-e of empkoyment; .IMAGESAACK, 2_36 Sant:a Cruz Avenue, L9S G_atos, Ca~_ifornia, 95030. A c-opy of th~ signed :£0"0-597 Unit-ed -St-at-es Department of Justice Fed~r-al 'bure-au of Investigation Receipt :for t>_roperty Rec-eived/R~tu~ned/Released/Sei_zed had been placed in a l~ enveIop and sent to the f_ile.
On April
lnvestigatiotlce file by
*
4/27/2012
2 S SA - SF -1454 'S~
S6
27. 2012. speci1l
cl
at
b6 b7C
Los Gatos, California ~~~~~~~~~~~~---------------------------------------------Date ~ktite4
'_'.;;.N,;.;;.A~
I
nus «loWXIent CQfttlinS ncithet te«>mmen4atiol:l$ not eon~h.lSions 01 the fBI. It is the property it an\i its contents ate not to be distribl.lte4 Ol.l'tsi4eyow .g~y.
_ b6 b7C
'(>( the
FBI and is loaned to yow agency;
•
(Rev.OS..Ql·ZOO8)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
Date:
ROUTlNE
04/27/2012
San Francisco
From:
San _Franc-isco Squad Ct2/Sa~~~~ : S~
~
Approved By: Drafted
b6 b7C
By: (Closed)/'
Case 1D #: 288A-SF-14S486 Title:
Synopsis:
/~
ANT~-SEC; UNSUB(S), et ali IMAGESHACK - VICTIM COMPUTER INTRUSION To Close Captioned
Details: l\ssistant
I
Case.
I
~nit:d State~ 'l\ttorney (AUSA)
I
I and
Special Agent (SA) have discussed captioned investigat~ on -~nd l.S s atus on _numerous occasions. On March 16-, 2012, AU?Al I jn)IUir~d via emai_; -if captioned investig-ati
b6 b7C
I.retut:ned the hard drives -in capt_ioned case back to t_he
It is -recommended that capt_ioned c-ase be closed and that col_lected on c-aptioned case be destcroyed and/of -retut:ned
ct~>~o-': u e l\z~~J-.\\.
UNCLASSIFIED ~
~00ll2~
UNCLASSIFIED
To:- San Eo"rancisco -From:- San ":£i'i'anGlsc'o Re: 288A-S:£i'-~_{S486-, '04/27/2012
put~suant ,to' Eo"Bt policy., -';['he:te~ 'axe 'no pending leads inves tigat,ion: re9:uired:' on capt Ioned case ,
++
,UNCLASsIFIED
2,
01:',f"urthe1:'
,.
U.S. DeI>~rtm.f Justice f(Jnited States Attorney Northern District of California DD: (408) 5)5·5061 FAX:(408) J35·5066
150 Almaden Boulevard, Suite 900 .SanJose; California '95113
Aprfl'18', 2012'
Special Agent Federal Bureau of Investigation ;1919 S>Bascom Avenue, Sulte'400 'Campbell, CA 95008
b6 b7C "
RE': 'JmageShack'Intrusion,
'pear Special-Agent
CJ 1
This letteris to confirm that my office-has closedthe investigation intothe ImageShack .intrusion by agroup known as Anti-Sec, Based on our conversations, you have conducted an ,exhaustive investigation and have been unable to identify the individual responsible for the intrusion .. If'you find new,evidence, 'please re-submitthe casefor prosecution, I appreciate allof'your. work on tlie case. .Please do not hesitate to me if you have any questions. Lean be reached a~ I ,Very.truly ¥ours, ',MEcINDAJIAAG·
AssistantUnited States Attorney
.,
.. j ,
" "
.,
I
'
.'
FEDERAL FOI/PA DELETED FOI/PA#
BUREAU
OF INVESTIGATION
PAGE INFORMATION 1204913-0
Total Deleted Page(s) Page 6 b6; b7C; b7E;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
7 8 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 43
-
-
SHEET
29
b6; b7C; b7E; b7E; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
1A Envelope Case ID: 288A-SF-145486-1A -------------------------------------------------------------------------------
SF
1 ! !
SF
ORIGINAL NOTES RE INTERVIEW OF~I ~ FD-597 RECEIPT FOR PROPERTY; FD-941 CONSENT TO SEARCH COMPUTERS; ONE CD WITH PRINTED COPIES
2 ! SILICON VALLEY RCFL REPORT OF EXAMINATION DATED 11/17/2009; ! AND 08/09/2010 AND RETURN TO AGENCY RECEIPT DATED 08/19/2010 .! (NO REFERENCE SERIAL)
-----------------------------------------------------------------------------b6 !
SF
3 ! -ORIGINAL PACKAGE COPY FD192 (CHAINS OF CUSTODY) lA'D ! -ORIGINAL 1B2 ENCLOSED
b7C !
SF
4 ! -ORIGINAL PACKAGE COPY FD-192 OF 1B1 (EVIDENCE RETURNED) ! -COPY OF A SIGNED FD-597 ----------------------------------------~-------------------------------------! SF 5 ! FD-597 RECEIPT FOR PROPERTY RETURNED Tol ! IMAGESHACK ON 4/27/12 (REF SERIAL 14) ~. ----------~~ !
., ~
------------------------------------------------------
--------------------~---~'
----------~------------------------------7------~------------------------------
,,
,
,..:
,
.
f''''';'''''''''-'''''
Ml'tllitEl
'. 'J.
~!
I
'&
')
Q
it
"
';
:J' U$$
~ Uti w.."
: P,
f
, '
1
I
j
"
!
,,!f
1o
" ,! ,!
;-
t
; I
\:::;
o
o
, "
.
;.
~
<;
!
FD-340b(ReV. 4-11'()3)
Field Office Acquiring Evidence _~~:::;:',/;.._..
I'
I
_
",'
,
j
'1 1
Serial # of Originating Docnment
,.
f51,c
From ,i ~
.,
<
..
,
, .1
1\)1 of' 'M»)1
Date Received
~~J~ (N~
I I 1 1
r
£.g(t+~r-)t45tf~b.
Fale Number
'
j
"'
,
1
1
!1
k..JI'-a.e VA
ofContribuwrllnterYiewee)
I
,1
~
'
,
,
~
5·(:(1.
By
To Be Returned
,
," ; r
0
..e:( No
Yes
Receipt Given. 0 Yes ffNo Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure
\ s
I
I'
i:
o
Yes,
~o
Federal Taxpayer Information (FTI)
, 1
0 Title:
"
ld"" No
Yes '
Po-lll--5f"v; Ut(!~J 1: SV\ A"Q. fi-rlA"tt-
Reference:
v
!VJ7 Nt
D~~"~\.('~~
_
(Communice.1ion En.closillg Material)
Descriptioll:
6!f
Originalnotes Ie interview of
I
b6 b7C
oj t
,~I J
.. , c
.......
"','."'~""
, .. ".~
..
,
"'_~"¥~
..... "',"''''''''''''o-__.~.'~<.Q.i;.I~rt
..... _j
'.
•
•
•
•
·U.S. GPO:2004-307-714/90013
•
- --"
-
-
-
FD-597 (Rev 8-11-94)
•
-- ---
-
Page
~
•
--
-
-
of
UNITED STATES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property Received/Returned/Released/Seized File #
::z W (1-- 'B£- t-\ ~~
On (date)
---iE2~c_+~ooLJ\-n~c~. -l?.l-;-J
__.p~D~Ol_9-l-.
_
item(s) listed below were: ~Receivect From Returned To D Released To D Seized
o
(Name)~L----.---_-----,:-----;-_J-1
__
~---=-_~~-=--_
(Street Address),__,.j==~"'_P'""'~4~U~e~c~~!...!:,-,-~c=::;\~c..~" -cCl~:;~{.l.c::t""--P\\.o..L)...J.!~~""a."y:.r-."'-Idz4't==-G~C~Y'-4::2"--f./....L..I£b)t..c;..,---'*!..L.....L/~00~__ .::_<'
(City)
--=L=-=:-'?_(~~~;4€:l-....1fu~s:......,.., __;(?I..:.....!..::A-~_
_fj.,.;:,5:::>.-.J,;.O~a~D.t_--------------:..-_
I
Description of Item(s): ~
h.l.
r-d m....r- M(I'_J
_
b6 b7C b7E
~
-
.,.-
./
L Received
L
/"
/
->
-> .>
Received From:
-
->
->
.>
-
b6 b7C
•
FD-941 (2-26-01)
CONSENT TO SEARCH COMPUTER(S) I, ~L
___'I---------' have been asked by Special Agents of the
Federal Bureau ofInvestigation (FBI) to permit a complete search by the FBI or its designees of any and all computers, any electronic and/or optical data storage and/or retrieval system or medium, and any related computer peripherals, described below:
"HPr(2..'O~-Je
:
(
b6
~r~p~TljIS4~2~kie:b~4~Q~d£ejC8~rJ§~e~d~2rl~~I~,,~m~b~er~(~jfE?~1~'2~jl~9~bl~e~\:::::::::::::::::::::::::::::::I~~lr_--_-_-_-_-_-_-_ ~".'
"RrlrimJ
M,d;, CnmmJfe""ripbmJ,
c
control, and/or have access to, for any evidence ofa crime or other violation of the law. The required s, s, and/or specific directions for computer entry are as follows:
_
I have been advised of my right to refuse to consent to this search, and I give permission for this search, freely and voluntarily, and not as the result of threats or promises of any kind. I authorize those Agents to take any evidence discovered during this search, together with the medium in/on which
JU)
OR")
a..D\)~
Date
b6 b7C
Date
Location
July 10th Hack On July 10th, at approximately 7 pm PST, ImageShack's services were compromised by a hacking group named anti-sec. The first complaint came in at 6:59pm pst. Anti-sec gained access to one of our database servers. Server named:
iI
They posted this message after the attach on multiple security threads:
I
This message linked back to the antisec's website:
On Thu, 23 JuI 2009 we received an email froml'provided some information on his site which was also hacked by the same group.
I
email_from email from] attachment: '-------
.....
I Anti-Sec info The group we believe has at least two
I
I
some website ed underl
I
I ._______.
_..~ which he
b6 b7C b7E
,.
August 2 Hack On August 2 early in the morning about 12:50am pst we were compromised again. They were unable to effect s as we stop them in time. We have chat logs of our employee included.
b6 b7C b7E
Chat logs:
Estimated
company loses
\__\ I __\1 C---- I \1
_____ I I_I __ I I \ __ \ I
\ I
______ I I I \ I I I I
I__ I I __ I \1
II __ \_I \ \\ I\ \ _ >\ \1
>\ \1
> \1
Proudly presents ... I I__
C-) '_ , _\ I _' II _' II _\' I __ I
I
___I
'_\ I _' II __ I
II I
I I I I I I I C-I I C-I I __ I x., \ I I I C-I I C--I I_I_I I_I I_I\ __ ,_I\ __ , I\ I I I I_I I_I\ __ ,_I\
<
I_I
\_\ I
__ I I I
Anti-sec. We're a movement dedicated to the eradication of full-disclosure. We wanted to give everyone an image of what we're all about. Full-disclosure is the disclosure of exploits publicly - anywhere. The security industry uses full-disclosure to profit and develop scare-tactics to convince people into buying their firewalls, anti-virus software, and auditing services. Meanwhile, script kiddies copy and paste these exploits and compile them, ready to strike any and all vulnerable servers they can get a hold of. If whitehats were truly about security this stuff would not be published, not even exploits with silly edits to make them slightly unusable. As an added bonus, if publication wasn't enough, these exploits are mirrored and distributed widely across the Internet with a nice little ment embedded in them for the crew or website which first
••
,I
exposed the vulnerability to the public. It's about money. While the world is difficult to change, and money will certainly continue to be a very important in the eyes of many, our battle is that of the removal of full-disclosure for the purpose of making it harder for the security industry to exploit its consequences. It is our goal that, through mayhem and the destruction of all exploitive and detrimental communities, companies, and individuals, full-disclosure will be abandoned and the security industry will be forced to reform. How do we plan to achieve this? Through the full and unrelenting, unmerciful.elimination of all ers of full-disclosure and the security industry in its present form. If you own a security blog, an exploit publication website or you distribute any exploits ... "you are a target and you will be rm'd. Only a matter of time." This isn't like before. This time everyone and everything is getting owned.
Signed: The Anti-sec Movement "No images were harmed in the making of this ... image."
b7E
Replacing images ...
b7E
If you think that we oppose your website, our advise is to pack it up and shut it down, because we're coming for you. - anti-sec.
iProudty presents ... Anti-sec.
We're a movement dedicated
to the
eradiCation of -
isclosure. We wanted to give
everyone a~ jm8g~ of what wet'reall abo4t ·
i
I
FuH-disclosJre is the disclosure of exploi~ publicly - anywhere. e secu'rity industry uses fulldiSClosure:t? profit :and develop scare-tactics to convince into bUying their f rewalis. anti-virus software, and alldi~ing services. '
Meanwhi~e" knpt ~ddies copy and pasaeiihese expJoits and vulnerable Servers lthey can gat a hold ofl If whitehats were published. 'riot. • exploits with silly edits to make them I
. ~ :
'
I if publica.Uonwasn't lenough, these exploits I !"
a nice little ment embedded' inbility to the publ'b.,' '-. .:';, ~,-. . _-.
I~ th.J. ready to strike any and all about se;curitythis stuff would nof ut:'lusable. .-
'
mirrq.red and distributed for the crew or website ...'.... ',..,n. !
-
I"'AI~l.n;I\I
continue to be for the purpose
~Iimination:,6(all own a secvri~
:;iciu wmi~'
o
I,, f
I 'J\:) ~
~'f't=<:;='-:
File Number
I
/1+{pJ
FO-340 (Rev. 4-11-03)
Field Office Acquiring Evidence
_-";";::~=-_-'__
--' __
-'-
_
I. i
Serial # of Originating
'.1,
!
~)<j
Date Receive~
&J;
From
Document.
-:-
_
_"\.::..~_:;' ;._I::.-;D:::;.__
Sv,. Gu.,40-CkP
--'-_
,
ili~ :.f2e.=
I
I.
II
,
i
'(Address)
!
I'
I. •f
(Name ofContribu'ltTlfnitrviewee)
I.
I
!.
t
'By
! i
---S--4A-::::::;'
To Be Returned
j,
, , . 1
'.. 1 . I
I
LI
!
I
I----~~c
Receipt Given !J'1ifo Grand Jury Material - DisseminateOnly Pursuant to Rule 6 (e) Federal Rules of CriminalProcedure
1
I
•
'
T1. ~ .'No. ~
.
!,
DYes
I
V)
I I.
g,.NO
DYes FederalTaxpayer Information (fTI)
\
!,.
CJ...NO
0 Yes 0 Yes
CJ\
\
!
!l-
.;
i Reference:
"-..:....-_ .(Corillnunication Enclosing Material)
I i
I ).
I Description:
S;;'0:
;:
0 Originalnotes re interview of
VL
I~ ~
~7~-)-.R B,".,;-~;: i
-\--. ~ 4
E>Dzlo=
'-t
. fkea, '~;y
& c.,!4{
Ii
!.
R/ I f ,/:l-O{ I> ~\'
,, t
t
r
".i~.."'",,"..""...~""""~·!: ,
.
--~~---
-
_---
,
:
~,
.
'"
,~
.'
'
,t
'f: ' ('J.
.... \..../.J
:
18-1 (Re'~1-26-2007)
/' e-
' '--
$
4600 Bohannon Drive Suite 200 Menlo Park, CA 94025
Silicon Valley Regional Computer Forensic Laboratory
REPORT OF EXAMINATION To:
San Francisco SanJoseRA
SAlL-
Date:
____~
August 9, 2010
Case ID No.: 288A-SF-145486
Lab No.:
SV-09-0162
Reference:
Communication (Request for Service) dated October 20, 2009 Imaging Report dated November 17, 2009
Ref No.:
N/A
Title:
ANTISEC UNSUBS; (V) IMAGESHACK
Date specimen received:
b6 b7C
October 21, 2009
Specimens:
b6 b7C b7E Request:
l
On October 20,2009, Special Agent! Federal Bureau of Investigation, requested that the above noted specimens, property of ImageShack, be examined pursuant to a signed consent form. She requested that the following items be searched for, identified (if present), documented, and reported on by the SVRCFL: 1) Hacking rootkits and logs Summary of Examination:
Attached and made part of this report is Imaging Report dated November 17, 2009. While this report addresses the examination processes, the attached Imaging Report addresses the imaging of the submitted evidence. 0 Page 1 of3 Enclosures:
For Official Use Only
1 2
3
These files were exported to a digital report. The other hard drives provided did not contain anything that appeared to be relevant. Details of Examination:
SAl I provided thd I Legal authority for the examination was provided as a signed consent form that was reviewed by the examiner prior to starting the examination. ~ used the examination image for review. The following processes were performed: 1 2
Derivai ive Evi A.
Disposition of Evidence:
1) All original items.!
~obe returned to submitting aaencv.
2)
288A-SF-145486 SV-09-0162 Page 2 of3 For Official Use Only
b6 b7C b7E
3) ~~ __ ~~ __ ~ __ ~ __ ~~~ ~ until its released to the investigator with this report. 4) Special handling instructions include: a. All files contained on this DVD have the potential to contain viruses and other malicious code exported from the examined computer media. Therefore, this DVD should not be viewed on any networked computer OR any computer connected to the Internet. It is recommended this DVD only be viewed on a standalone workstation designed for the purpose of evidence review. Please consult your systems for assistance and guidance. b. In certain investigations, files and information containing contraband such as pornographic images and trade secrets may have been discovered and copied onto this DVD. This can also include pornographic and obscene images of children. Extraordinary care must be taken to safeguard this material and properly secure it when not being used for investigative or legal purposes. The SVRCFL recommends this DVD be secured in appropriate storage, such as an evidence facility, when not being reviewed by the investigator. c. File attributes such as time/date stamps are dependent on several factors such as computer date/time settings and time zones. Where possible and feasible, dateitime attributes have been preserved and details can be found in the electronic report contained herein. d. THIS DVD SHOULD NOT BE DUPLICATED or DISSEMINATED to parties outside of the requesting law enforcement agency or prosecutor's office without first consulting with Silicon Valley RCFL. e. This DVD is intended primarily for law enforcement and prosecution use. It is not recommended that this DVD work product be used for evidentiary hearings, trials, or other official proceedings. If any contents of this DVD are needed for a legal proceeding, the Silicon Valley RCFL should be ed so that the relevant items can be provided in a form suitable for these purposes.
b7E
b6 b7C Examiner:
Silicon Valley Regional Computer Forensic Lab Computer Analysis Response Team
288A -SF-145486 SV-09-0162 Page 3 of3 For Official Use Only
18-1 (Rev. 3-26.-2007)
"
'" 4600 Bohannon Drive Suite 200 Menlo Park, CA 94025
Silicon Valley Regional Computer Forensic Laboratory
REPORT OF EXAMINATION To:
San Francisco San Jose RA s.A...... 1
Date:
----'
November 17,2009
CaseIDNo.:288A-SF-145486
Lab No.:
b6 b7C
SV-09-0162
Reference: Communication (Request for Service) dated October 20, 2009
Ref.No.:
N/A
Title:
Image Shack
Datespecimensreceived:
October 21, 2009
Specimens:r------------------------------,
b6 b7C b7E Request:
Refer to the final Report of Examination for information on services requested. This report relates to the imaging processes only. Summaryof Examination:
Digital evidence media items were imaged to media to be retained as archives, and to staging media for future forensic examination by an assigned forensic examiner.
Enclosures:0
Page 1 of3 For Official Use Only
Details of Examination:
Prior to conducting any forensic process, I reviewed the legal authority, presented as a "Consent to Search" form. Upon submission to the SVRCL, each submitted item was inventoried. As part of the inventory process, each item was assigned a unique SVRCFL bar code, and was entered into the SVRCFL evidence system. Where appropriate, make, model, and serial number for each imaged item was recorded, and each item was digitally photographed. To preserve the original evidence and minimize any risk of damage to the original, an exact copy of the -accessible data located on the evidentiary items was created onto staging media. (The exact copy will hereafter be referred to as an image.) The images were created using approved and appropriate forensic imaging software to write to forensically clean staging media prepared for use in an examination. Unless otherwise noted, the original evidence was write-protected using a hardware-write protection device to prevent any unintentional or accidental destruction or modification of the original evidence. An archive copy was also made using approved and appropriate software. The staging media will be used in the examination phase to further satisfy the request, while the archive copy will be retained in the SVRCFL evidence control room in order to preserve the evidence should it be required in the future for authentication or court processes. b7E
L...-__
.....I1
All the original evidence was returned to the SVRCFL evidence control
room. The following processes were performed during imaging of the original evidence: Physical Examination of Evidentiary items Write Protect Media Hardware Geometry and System Information Create Image
b7E NlA
SV-09-0162 Page 2 of3 For Official Use Only
--------------------------------------------
Verification Items ima ed: 1.
2. 3. 4.
5. 6. Derivative Evidence (DE) generated during the course of this examination includes thefollro~~~·n~ _, 1.
b7E
2. 3.
4. 5. 6. Stagin media used durin the course of this examination includes the following: 1.
Disposition of Evidence:
All original evidence items returned to the SVRCFL evidence control room. All DE items will be retained in the SVRCFL evidence control room for a period of five years in order to preserve the evidence in the event additional forensic processes or legal proceedings require its use. After this time, the DE will be returned to the requestor's agency for disposition. This imaging of this case is complete. The staging media will be given to an examiner for additional forensic processing. b6 b7C
Silicon Valley Regional Compter Forensics Lab Computer Analysis Response Team
N/A
SV-09-0162 Page 3 of3 For Official Use Only
Return to Agency Evidence Receipt
Silicon Valley RCFL Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050
SV-09-0162 Evidence Details Total numberof evidenceitems processedon this receipt:9
Description: MediaContainer:AccordionFolder StorageLocation:[Undetermined] Make:
Model:
Serial Number:
Case 10 I Lab number: SV-09-0162
SVE028018
Agency Case Number: 288A-SF-145486
i.an Designation, lJeslgnatlon t:xpl.: Not Examined(NE), [No designation explanation)
Intake Container I Seal: None I None
ECF Container I Seal: PlasticBag I Heat Seal
Intake Damage: [No damagerecorded]
Tracking Number:
Description: Hard Drive:HOD StorageLocation:[Undetermined]
riliJh~·
Model:
I
I
I
I
I
I
SVE028019
Case 10 I Lab number: SV-09-0162
Agency Case Number: 288A-SF-145486
Lab Designation / Designation Expl.: Ouestioned(0), [No designationexplanation]
Intake Packagmg: [Not recorded)
ECF Contamer I Seal I Packaging: [Not recorded)
Intake Damage: [No damagerecorded]
Tracking Number:
Description: HardDrive: HDD StorageLocation:[Undetermined]
b7E
Make,
I
I
I
I
Mode'·
I
SVE028020
Case 10 I Lan numner: SV-09-0162
Agency Case Number: 288A-SF-145486
Lab Designation, Designation Expl.: Ouestioned(0), [No designationexplanalion]
Intake Packaging: [Not recorded]
ECF Container I Seal I Packaging: [Not recorded]
Intake Damage: [No damagerecorded)
Tracking Number:
Property I Evidence Receipt Date me Date/Time 08/1912010 12:30 PM
Released sy
I
tI
Received sy
't
r~VRCFL
(Phone:OOO'()O()'OOOO)'
I
NnmclQ aepCY
~FBI(Phone:
b6 b7C ·Indlcates
the WJtne:ss Ole
3
o
Return to Agency Evidence Receipt
Silicon Valley RCFL
= Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050
SV-09-0162 Evidence Details Total numberof evidenceitems processedon this receipt:9
Description: Hard Drive:HDD StorageLocation:[Undetermined] Make·
I
I
I
Serial Number:
J
I
Mode:
I
SVE028021
Case 10 I LaOnumoer: SV-09-0162
Agency case rmmDer: 288A-SF-145486
Lab DeSignation I Designation Expl.: Ouestioned(0), [No designationexplanation]
lntake Packaqing: [Not recorded]
ECF Contamer I Seal I Packaging: [Not recorded]
Intake Damage: [No damagerecorded]
Tracking Number:
Description: Hard Drive:HDD StorageLocation:[Undetermined]
I
Model:
I
I
I
SVE028022
case IU I Lao number:
I
SV-09-01B2
Agency Case Number: 288A-SF-145486
Lab Designation I Designation Expl.: Ouestioned(0), [No designationexplanation]
lntake PacKagmg: [Not recorded]
ECF Contamer I Seal I PacKagmg: (No! recorded]
Intake Damage: [No damagerecorded]
Tracking Number:
b7E
Description: Hard Drive:HDD StorageLocation:[Undetermined] Make-
I
Ser al Numoer:
I
I
I
SVE028023
Case 10 I Lao nurneer: SV-09-01B2
I
Agency Case Number: 288A-SF-145486
Lab Designation I Designation Expl.: Questioned(0), [No designationexplanation]
Intake Pacl
ECF Contamer I Seal I PacKagmg: (Not recorded]
Intake Damage: [No damagerecorded]
Tracking Number:
Property I Evidence Receipt uate nne Date/Time 08/1912010 12:30 PM
KeleaseClsy
I
:
N9mc/AgGDG~ VRCFL (Phone:
RecelveClBy Name/OgeDe"
OOQ..O()().OOOO) •
IFBI (Phon.:
I
b6 b7C
Sig
'ndlCOltes the Witness acted as an
"""""
-ClY" ~ f 3 Document Generation Date: 08/19/2010
Return to Agency Evidence Receipt
Silicon Valley RCFL Regional Computer Forensics Laboratory 4600 Bohannon Drive Suite 200, Menlo Park CA 94025 650-289-3000 FAX: 650-289-3050
SV-09-0162 Evidence Details Total numberof evidenceitems processedon this receipt:9
Description: Hard Drive:HDD StorageLocation:[Undetermined]
I
I
I
b7E
II Case 10 LaoI number:
SVE028024
I
I
SV-09-0162
Agency Case Number: 288A-SF-145486
Lab Designation I Designation Expl.: Questioned(Q), [No designationexplanation]
lntake PacKaging: [Not recorded]
ECF Container I Seal I PacKaging: [Not recorded]
Intake Damage: [No damagerecorded]
Tracking Number:
Description: MediaContainer:plasticbag StorageLocation:[Undetermined] Make:
Model:
sertat Numller:
Case 10 I Lao numner: SV-09-0162
SVE030246
Agency Case Number: [No AgencyCase Number]
Lab Designation I Designation Expl.: Not Examined(NE). [No designation explanation]
Intake Container I Seal: None I None
ECF Container I Seal: Paper Bag I Heat Seal
Intake Damage: [No damagerecorded]
Tracking Number:
Description: DVD: digitalreport StorageLocation:[Undetermined] MaKe:
MOclel:
Serial Number:
Case 10 I Lab number: SV-09-0162
SVE029747
Agency Case Number: [No AgencyCase Number]
Lab Designation I Designation Expl.: DerivativeEvidence(DE).[No designation explanation]
Intake PacKagmg: [Not recorded]
ECF Container I Seal I Packaging: [Not recorded]
Intakeuamage: [No damagerecorded]
Tracking Number:
Property I Evidence Receipt Date ime OatelTlme 0811912010 12:30 PM
Ke easeo tly NamclAgency Jann Hayes, SVRCFL (Phone: 000-000-0000) •
xece vea tly Name/Agency
MelanieAdams. F81(Phone: 408-99~633)
b6 b7C -Indicates the Witness Dele
f3 10
·"~f'·..., \'
,,
,
·1
Q FD-340 (Rev. 4-11-03)
File Number
_.
~f- t4'5~Ab
J: rel="nofollow">%2> A
Field Office Acquiring Evidence
~
--_.:::3"".ctF---'--------------
Serial # of Originating Document
_ ' _,... :;
-Date Received .
IfJ - ~
From
_
-,
L
4 \ ~'\ !~~( "' \ --r~~
\.
, r
.
(Name'of Contributor/Interviewee)
• ...;1:,
:.
_
(Address)
(City and State)
b6 b7C
~--_r---------------------------
BYL_ To Be Returned
0 0
0 0
Yes
No ,I
Receipt Given Yes No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) FederalRules ofCriminal·Procedtire No DYes .:
o
•
Federal Taxpayer Information (FTI)
0' Ti~e:
--If """'-p
~t\
ONo
Yes
,
.
: :,_.':".;:;:_.;...
0 ~ /'I
.~,
....
. :'
.,{: Rererence:
~-----------------------(Communication Enclpsing Material)
i,:.
,
'"
/'
;, I!i "
.
\
1, •
•
.~. I'
. '". ~
.;;.
,
... ~
08/19/10 19:29:55
ICMIPR01 Page 1
FD-192
Title and Character of Case: ANTI SEC Date Property Acquired:
Source from which Property Acquired: SV-RCFL
08/19/2010 Anticipated Disposition: Acquired By:
Case Agent:
I
b6 b7C
Date Entered
Description of Property: 1B 2 ONE (1) CD LABELED SV-09-0162 (DERIVATIVE EVIDENCE OF 1B1) Barcode: E4189947
Location: SJECR
r,,1 , t1
PRESS3
v-,
'
.....
Case Number: Owning Office:
288A-SF-145486 SAN FRANCISCO
..
08/19/2010
.....
I' .".,
•
.."I
'
....'
'_ .... ',.,.
.j.iC.' •
¥
FD-IOO4 Revised 9-16-2009
FEDERAL BUREAU OF INVESTIGATION
EVIDENCE CHAIN-OF-CUSTODY
Evidence Type:
o General
o Drug
)Zf CART
nValuable
o Firearm/Weapon o Firearm/Other
Special Handling Instructions
o o o o
Batteries HAZMAT Reg, Charging Other
o Biohazard o Latents o None
o o
FGJ Refrigerate
Signat
11)~)lu
Printe
Signature:
do
3.?y_
-
Printed Narr Reason:
~,~I Relinquished Custody
r
4/.11(12-
S\~
Reason:
/0 l-rt
Printea Namel Reason:
Signature:
Printed Name:
Printed Name:
Reason:
Reason:
Date and Time
Accepted Custody
Signature:
Signature:
Printed Name:
Printed Name:
Reason:
Reason:
Relinquished Custody
Accepted Custody
Date and Time
Signature:
Signature:
Printed Name:
Printed Name:
Reason:
Reason:
Firearms Certification: Printed Name: CaseID:
Signature:
~8~A - Sf - (4548'blB:__ .2...=-
\0
~~3er'
Date and Time
rJD-l3/
://4-,'01 Accepted Custody
Date and Time
~ \~l
l L/'27/1z
Sign t-
Signature:
Relinquished Custody
y
Accepted Custody
Date and Time
Signature:
-
PrintedNam
2.../
. Relinquished Custody
Date and Time
Accepted Custody
Date and Time
~)1 /J;) 1~/'·.dt2.-v
)J.,SVf"""
Reason: Collected
Relinquished Custody
Reason:--r.:;-
Date and Time
Initial Receipt
Date:
Date and Time
Date and Time
Date and Time
_
Barcode:_"""'E~4,-.;...>\R1....---,---I-?4-1-r_-q--
b6 b7C
.,
..
')1,1
;'"
'.
1~'
FD-340b (Rev. HI-03)
,
,
File Number
cfl.eJA·,- <; F· 145 4 g-:c
Field Office Acquiring Evidence
----1oS!..If------·---
~~..... "~" - ...... t '.;.._~
Serial # of or:ginating D.ocU~)nt
4 / 3D L .,£ () 1
Date Received'
.From
(Name of Contributorllntcrviewee)
t-~-~
(Address)
I-
~L:---------I~r -
b6
I. f
b7C
B~
'\:::i~:-:.' '.r .A~.~~>:.;~'~'-.._. _~ .
-c
.-,- -,'" ...'. mz:;~..:.'z..\'.).\:'tk;~ '" ~":';"_.~\ -c, •
1<.,'..•.,
d,,<:: " " .'.
To Be Returned DYes 0 NQ Receipt Given 0 'Yes 0 'Grand Jury Material" Disseminate Only Pursuant to Rule 6 (e) ....~ed~ral Rules of Criminal Procedure -, . , DYes No
No
.
q
Federal Taxpayer Informatlon.ff'Tf) .: DYes' ::-"".,
D
No
.flAJ \ T( ..TI
Title:
. '.:
Referencee .--
~~-':--:----_ (Communication Enclosing ¥.tcri~I)'
,
,/
P""'P.OOI
0
Original notes re intervlew of
-D:r~1tt!::19:!fr I' -~d ~ hitred -s'/p L tcl· Oy
.. ,.~~
I
f;O
,J_....8 g_A_-_g~f__14j~'54...;.,;;;.;;o.~b~' ....... l,!\oiiIiIW' :f ' #;'' 4~~,
I.
...
' ..
.--
• A'
"
'';-10/21/09 12:08:07
ICMIPR01 Page 1
FD-192
Title and Character of Case: ANTI SEC Date Property Acquired:
Source from WhiTh Property Acquired: IMAGESHACK, C/O_ 1263 N. SANTA CRUZ 263 N SANTA CRUZ AVE #100 LOS GATOS CA 95030
10/08/2009
Case Agent:
Anticipated Disposition: Acquired By:
I Date Enteredb6
Description of Property: 1B 1
Barcode: E4189643
Case Number: Owning Office:
Location: SJECR
b7C b7E
PRESS3
10/09/2009
288A-SF-145486 SAN FRANCISCO
(Ib/)
FD-IOO4 Revised 9-16-2009
FEDERALBUREAUOF INVESTIGATION
EVIDENCE CHAIN-OF-CUSTODY
o Drug o Valuable
Evidence Type: 0 General ~CART
o Firearm/Weapon o Firearm/Other
Special Handling Instructions
o o o o
Batteries
HAZMAT Req. Charging Other
o Biohazard o Latents o None
o o
r bJ'" "JJ2..r.r
I
Printed Name
Relinquished Custody
_.......
Reason:
Reason:
Date and Time
I
(t"]i?/.),-
Reason:
'to
rn I
Signature:
,0
I
---=S~f---L!=14::::J=..-.=.5......:A~R:0L.=...· _
(tJCJ~ Date and Time'
I
J
IO·.~.£.o.....
['.K@
Sign t-Printed Name:
...) {)
e-: .r.:>_...J Date:
~=__
Date and Time'
'/)2))z.
-
Signature: 1B: __
II
Accep~edCustody
Reason:
v/I~I (0
printedNa~
I~K.p1'l'....Reason: ~tOJb-9\,e_-
4/~1(Itl I
Firearms Certification: Printed Name: . Case ID:
loft-l/rYj
Accepted Custody
Date and Time
I
1
l
g"/l<1)
711-iYL Date and Time
aAf.?OulJ'l J
Reason:
Relinquished Custody
Printed Name:
Accepted Custody
Printed NarvJ
l
Signaturel
l )O/2A/b7
~
Reason: ·T~/'J._~i:::tLo •..;t--::k;_....&dZCJ!!l
----
"I/-IA -c ,.,.... \- -10
..
Date and: . Time
AccepVedCustody
Signature:
SignaJ Printed Name:
(OOnn •
~I[C:tQO
Date and' Tim~
Relinquished Custody
7
Reason:
Printed Name
q~
I
SA- J
IO{'l/1J4
Printed Name
Io A-tv-.
lolz{/o~
Date and Time
Signature:
10)"/d7 Date and Time
signat~
Printed Name:
/ : ~Pr-... Accepted Custody
if.
Relinquished Custody
Signature:
I
Date and Time
Printed Name]
Reason:~
Printed Name:
/0/Dft')IJ7
Reason: Collected
~
-r:
l-
Signat
FOI Refrigerate
Relinquished. Custody
Reason:
Date and Time
Initial Receipt
Barcode:
L
lD~~
_
--.l..::t:::.....£4-4-R1'f~Cj~r;:::....::4'=f--"'):...._
b6 b7C
.. EVIDENCE
CHAIN-OF-CUSTODY
Continuation Page Relinquished Custody
2=
Signa~ Printed Name:
I
QO.11
Reason:
r:.....j
Accepted Custody
Date and Time
Relinquished Custody
b6 b7C
Signature:
~/~II~
Printed Name:
IJ-'cg;_
Reason:
Accepted Custody
Date and Time
Signature:
Signature:
Printed Name:
Printed Name:
Reason:
Reason:
, Relinquished Custody
...
Date and Time
Signature:
Printed Name:
Printed Name:
Reason: '
Reason: .
Signature:
Signature:
Printed Name:
Printed Name:
Reason: ;
Reason:
Relinquished Custody
Printed Name:
Printed Name:
Reason: '
Reason:
"
Date and Time
Signature:
-
Reason: '
Case ID: _
Accepted Custody Signature:
Printed Name:
Printed Name: Reason:
. O.fLf
__.,2L=--,-+-~
r:
/4C"4 _,__J__
w-
-'-~-=-F-;___~
IB:
-1-
Date and Time
Date and Time
~
Signature:
Relinquished Custody
,
Accepted Custody
Date and Time
Signature:
...
Date and Time
Accepted Custody
Date and Time
Date and Time
,
Accepted Custody
Signature:
, Relinquished Custody
Date and Time
Barcode:
Date and Time
•
"
EVIDENCE CHAIN-OF-CUSTODY Continuation Page Relinquished Custody ,
Accepted Custody
Date and Time
Signature:
Signature:
Printed Name:
Printed Name:
Reason:
Reason:
Relinquished Custody
Accepted Custody
Date and Time
Signature:
Signature:
Printed Name:
Printed Name:
Reason: ,
, Relinquished
Custody
Date and Time
.
~,
Date and Time
,
Reason: .
Date and Time
Accepted Custody
Signature:
Signature:
Printed Name:
Printed Name:
Reason: :
Date and· Time
•
Reason: '"
, Relinquished
Custody
Date and Time
Accepted Custody
Date and Time
:
,
Signature:
Signature:
Printed Name:
Printed Name:
Reason: ;
Reason:
.
RelinquisoeaCiIstody
- -
- - Dai£an-dTime
--
-
..
---AccepfectCiistody
Time ~
Signature:
Signature:
Printed Name:
Printed Name:
"
Reason: .
Reason:
Relinquished
Custody
'""'" ,
Date and Time
Signature:
Reason: .
. _._~-~'---=.-__ - ..:.. __
-'--
IB:
Accepted Custody
Date and Time
Signature:
-.
Printed Name:
,.
Reason:
..
Printed Name:
Case ID: __
Datearrd+l
-'--
.!. ,.,
Barcode:
--,
- :
:
-597 (Rev 8-11-94)
I'"
Page
!
_-I-'r__
I
of
I
UNITED STATES DEPARTMENT OF JUSTICE FEDERAL BUREAU OF INVESTIGATION Receipt for Property Received/Returned/Released/Seized
On (date) --f'i/&.-L-ffin.~~'___'__1+-·I____.CJ-=-7~"7-( ___,d=-p"'-'I'-'<:::2.::::='
(Name)JL
_
item(s) listed Received OCReturned Released Seized
o o o
below were: From To To
-r-_j---:---/7n~--\--:----------'-~'
(Street Address)...,---"=- .......... "---'Z-"-f.L.::.-'-!.-=---"...<..;:o""""~_,_-"'-"..........:...._..:p-.;.__,.~~~~~4""--'--=-'..__
. _
b6 b7C b7E
Description of Item(s):
"
t ..
b6 b7C
Received By:
Received Fr
---------~------~--~==---
'(
o
o
18[£)
FO-340 (Rev. 4-11-03)
-=2=--~~-l-·tt.!_,.......::n:.....J6=~----!..t--lI.f:......5~-Vc':p~L...:.'1-,:s......,---
File Number __
Field Office Acquiring Evidence
Sc
-~~J---_-r-
if ,27 /)..Dn.
Date Received _
_
ILf
Serial # of Originating Docrment
From
_
Federal Bureau of Investigation 1919 .S. Bascom Avenue Suite # 400 Campbell, CA 95008 (City and State)
~I
By
To Be Returned 0 Yes -B-1'io Receipt Given 0 Yes ..g-,q:o Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules ofCrirninal Procedure DYes Federal TaxpayerInformation (FTJ) 0: Ye's
•
.Q-NO .....Q.No
Title: b6 b7C Re~r~ce:
/'
Description:
~-~~~~~--~~---------------
(Communication Enclosing Material)
0 Original notes re interviewof
ru-6-!]
&Jb::-;~
f2e.Mte-, Iff? __ /
.;:.
I~
I?
tA-CS)
, ..
FEDERAL FOI/PA DELETED FOI/PA# Total Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
BUREAU
OF INVESTIGATION
PAGE INFORMATION 1204913-0
Deleted Page (s) 9 - b3; b6; b7C; 11 - b3; b6; b7C; 18 - b3; b6; b7C; 20 - b3; b6; b7C; 26 - b3; b6; b7C; 27 - b3; b6; b7C; 28 - b3; b6; b7C; 29 - b3; b6; b7C; 35 - b3; b6; b7C; 38 - b3; b6; b7C; 39 - b3; b6; b7C; 40 - b3; b6; b7C; 43 - b3; b6; b7C; 44 b3;
45 47 50 55 57
-
b3; b3; b3; b3; b3;
b6 ; b6 ; b6 ; b6 ; b6 ;
SHEET
19
b7C; b7C; b7C; b7C; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
•
•
....(!<$"'~0\1.31-2003)
FEDERAL BUREAU OF INVESTIGATION
To:
Date:
ROUTINE
Precedence:
ATTN: Computer Intrusion Unit #2
Cyber Division
SSA From:
I
San Francisco Squad CY-2/Sarn~J~o~s~e~RA~ : SA~
Approved Drafted
I
~ ~ b6 b7C
By: By:
10/08/2009
I
I
/4Slfmt5
I
Case ID #: 288A-SF-~
(pending),-l~ 288A-SF-NEW-GJ (Pending)? l
Title:
ANTI-SEC; UNSUB(S), et ai; IMAGESHACK - VICTIM; COMPUTER INTRUSION
Synopsis:
To Open'Case and subfiles.
On October 8, 2009, Special Agent (SA)I with employees of IMAGESHACK located at 236 North Santa Cruz Avenue, Los Gatos, California, 95030, to discuss two recent computer intrusions of IMAGESHACK servers. IMAGESHACK is a company which provides internet image hosting. Details:
I met
IMAGESHACK advised SAl Ithat the first computer intrusion occurred on July 10, 2009 at approximately 7 pm Pacific Standard Time (PST). A group by the name of ANTI-SEC gained access to one of t~e company database servers. The server the hacker(s) accessed_ I for IMAGESHACK customers to include I I
b6 b7C b7E
~
~~I. In addition, the ac er s pos e a message on e internet which claims the ANTI-SEC is a movement dedicated to the eradication of full disclosure. Their message further explained they plan to achieve this "through the full and unrelenting, unmerciful elimination of all ers of full-disclosure and the security industry in its present form."
()41t {OIOOl
/fPt /)U
b6 b7C
I
-
~
• v
t... To:
Re:
San Francis~ From: San Francisco 288A-SF-NEW, 10/08/2009
•
IMAGESHACK advised this computer intrusion affected aRproximately 50 million images and every that was on their b6 b7C b7E
On August 2, 2009, IMAGESHACK believes the same hacker(s) came back and gained access to their servers again. IMAGESHACK has full and com lete 10 s. It is a arent the hacker s
b6 b7C b7E
Jui b6 b7C b7E
the August attack able
IMAGESHACK
believes the
to
~~~~I IMAGESHACK I $26,000.
estimates
It is requested
their losses at approximately
that the following
Grand Jury
subfiles be opened:
SUB GJ
It is requested that the new case and subfiles be opened and assigned to SAl I
••
2
b6 b7C
;
:J
,",
•
•
.~,
I
u.s. Department
of Justice
Federal Bureau of Investigation
In Reply, Please Refer to FileNo.
/
450 Golden Gate Ave. San Francisco, CA 94102 (415) 553-7400
288A-SF-145486-GJ~~
Nov.embe r 10, 2009 Honorable Joseph P. Russoniello United States Attorney Northern District of California 450 Golden Gate Avenue San Francisco, California 94102 Attention: Assistant United States Attorney
b6 b7C
ANTI-SEC; UNSUB(S), et ali IMAGESHACK - VICTIM; COMPUTER INTRUSION Dear Sir: Pursuant to the above captioned investigation, the Federal Bureau of Investigation (FBI) requests that the below listed individuals be placed on the Federal Grand Jury 6E list, in as much as they may require access to grand jury information during the course of the investigation: NAME
AGENCY FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI FBI
POSITION Special Agent Special Agent Special Agent Special Agent Special Agent Special Agent Special Agent Supervisory Special Agent Intelligence Analyst SST Evidence Control Technician Evidence Control Technician
b6 b7C
•
Should you have any questions regarding this matter, please do not hesitate to r-=s""'A_,_,_I San Jose Resident Agency, telephone number ....I ___,
-...J1
b6 b7C
Sincerely, Stephanie Douglas Special Agent in Charge
By: Supervisory Special Agent
2
b6 b7C
'.
.
-
.
ED-302 (Rev, 10-6-95)
•
'
;
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
GRAND JURy MATERIAL
- DISSEMINATE
PURSUANT
12/14/2009
TO RULE 6(e)
~1
On December 14, 2009, Spectal Agent~(~S~A~,)_~I served a Grand Jurv subpoena via. facsimile tol I
attached
Investigation on File # by
I
The file copy of the Grand Jury Subpoena and is made a part of this document.
""?: I
[
b6 b7C
I
has been
(via facsimile)_
12/14/2009 at Campbell, California ----~----------
288A-SF-145486-GJ
SAl
The subooena I
r
b3 b6 b7C
Date dictated'
NA
.1
This document contains neither recommendations nor conclusions of-the FBI. It is the property of the FBI and is loaned to your agency; it and its contents, are not to be distributed outside your agency.
d(
I
.~-
:A0110 (Rev.12/89) Subpoena to Testify Be~
•
•
and Jury
Wniteb ~tates 11Bistrirt<1:ourt NORTHERN
.'.
CALIFORNIA
DISTRICTOF
TO:
r
SUBPOENA TO TESTIFY BEFOREGRAND JURY IBPOENA EOR'
b3
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States.District Court at the place, date and time specified below.
PLACE
COURTROOM
United States District Court 280 South First Street San Jose, CA 95113
As directed by the court
DATEANDTIME January 6, 2010 at 9:30 a.m.
YOU AREALSO COMMANDED to bring with you the following document(s) or object(s):*
Please see attachment. Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena and no appearance will be necessary.
IZI Pleaseseeadditional information on reverse. This subpoena shall remain in effect until you ar'~~~WJ~~JNlepart behalf of the court. ¢'Q' . (>0
R
by the court or by an officer acting on
(';.
~U~.S~.M~A~G~IS~TRA~TE~ruD~~G~E~O~R~C=L~E~RK~O~F~C~O~UR~T~~~~ ~~~~~---------------------------RICHARD W. WIEK!NG December 11, 2009
U.S. ATTORNEY
This subpoena is issued on application of the United States of America
JOSEPH P. RUSSONIELLO United States Attorne * If not
applicable, enter "none".
b6 b7C
'AOll0
(Rev. 12/89)
Subpoena
to Testify Bef.and
Jury
RETURN OF SERVICE (1) DATE
RECEIVED BY SERVER
PLACE
j d- ) ) 't J d-O''()
,
UAlt
SERVED
b3 b6 b7C
1"1
1'.).- ) \ \.f I ')_-L) o i
::.tKVtU UN lI"KINI NAlllt)
.
::.tKVtU tH ll"'KIN I NAMt}
p(L~J1
,S
~-
TRAVEL
~
STATEMENT OF SERVICE FEES
I
SERVICES
.i->
ITOTA~
DE'CLARATION OF SERVER (2)
I declare under penalty of perjury under the laws of the United States of America that the foregoing information contained in the Return of Service ~nd Statement of 1:', .,,; Fp.p.<: is trueand r.n rect Executed on
fY'a be-~M DATE
).Do, ,
"Ffj;-
,
) '7;
A_;, \'
1>P-J/6l)
/.~MA
, ADDRESS OF SERVER
!lif~'I2~
~
/7,,-:r
9({!)(_)..{Y'
-
ADDITIONAL INFORMATION
~Vttj
y/.{_
~)'~/~
fII
(1) (2) ,
As to who may serve a SUbpoenaand the manner of its service see Rule 17(d), Federal Rules of Criminal Procedure, or Rule 45(c), Federal Rulesof Civil Procedure. "Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rulesof Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs (28 USC1825, Rule 17(b) Federal Rules of Criminal Procedure)".
•
FD-448 (Rev. 6-2-97)
.,
•
'
FBI FACSIMILE COVER SHEET
PRECEDENCE
CLASSIFICATION
D
D Top Secret D Secret D Confidential D Sensitive
Immediate
D Priority [ZJ Routine
Time Transmitted: Sender's Initials: .,LI __ Number of Pages: _4=-(including cover sheet)
--L
_
_
[ZJ Unclassified Date:
To:
12/14 /2009
Name of Office
Attn: Room
From:
Telephone
b3 b6 b7C
FBI San Francisco - San Jose Office Name of Office
Subject:
Preservation Request
Originator's Name:
Special Agent 1
Originator's Facsimile Number:
L--
ITelephone: ....1 '--
.1__---
_
Approved: Brief Description of Communication Faxed:
_
WARNING Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information, disclosure, reproduction, distribution, or use of this information is prohibited (IS.USC, § 641). Please notify the originator or the local FBI Office immediately to arrange for proper disposition.
FD-302 (Rev. 10-6-95)
• - 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
12/14/2009
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) b3 b6 b7C
On December 14, 2009, Special Agent~(s~A~)~I------------~l served a Grand Jury subpoena via facsimile tol
r
The file copy of the Grand Jury Subpoena has been attached and is made a part of this document.
~.
Investigation on File # by
12/14/2009
----------------
at
Campbell, California
(via facsimile)
4--~==========~--------~~-----~------------------~ S_A;I _rI-------------~~c 288A-SF-145486-GJ ......
Date dictated
NA
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. _____________
..J
t.A0110 (Rev. 12/89) Subpoena to Testify Befo.nd
•
Jury
mlniteb ~tate5 1!listrirt QCourt NORTHERN
DISTRICTOF
CALIFORNIA
TO: SUBPOENA TO TESTIFY BEFOREGRAND JURY SUBPOENAFOR:
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the-United States District Court at the place, date and time specified below.
COURTROOM
PLACE
United States District Court 280 South First Street San.Jose, CA 95113
As directed by the court
DATE AND TIME January 6,2010 at 9:30 a.m.
YOU ARE ALSO COMMANDED to bring with you the following
document(s) or object(s):*
Please see attachment. Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena and no appearance will be necessary.
IZ1 Pleaseseeadditional information on reverse. This subpoena shall remain in effect until you ar~~~fi/;i~ behalf of the court. .~'>' .
~ U.S. MAGISTRATE JUDGE OR CLERK OF COURT RICHARD W. WIEKING December 11, 2009
This subpoena is. issued on application of the United States of America
JOSEPH P. RUSSONIELLO United States Attorne * Ifnot applicable, enter "none".
b3 b6 b7C
.~~
•
,
, AOll0
(Rev. 12/89) Subpoena to Testify Bef
rand Jury
RETURN OF SERVICE II) DATE
PLA
RECEIVED BY SERVER
1~))LjJ'UnJ1 UAIt:
SERVED
PLALt:
/2) IV jZODj
!>I:KVI:U UN (pKINI NAIIlI:)
I SERVED BY (PKIN I
NAMt:)
IIILt:
Spe
..»
STATEMENT OF SERVICE FEES
TRAVEL
I
~-
b3 b6 b7C
-
tt--~+
I
SERVICES_______________
TOTAL
~
DECLARATION OF SERVER (2)
I declare under penalty of perjury under the laws of the United States of America that the foregoing information contained in the Return of Service and Statement of Service Fees is true ann correct Executed on
t'1.Ji Oe,~/!/L. ka1 )_OU! DATE
r0.J./ ~f-1
S" AhO,-Otv-.. Ih--P.
.
rfL~()
ADDRESS OF SERVER
.t~.~ p/,dL ADDITIONAL INFORMATION
fplrleA V/'A.
teo,.,
(lA-
96{)O(~
<~
~
(1) (2)
As to who may serve a subpoena and the manner ot its service see Rule 17(d), Federal Rulesot Criminal Procedure, or RUle45(c), Federal Rulesot Civil Procedure. "Fees and mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United States or an officer or agency thereof (Rule 45(c), Federal Rules of Civil Procedure; Rule 17(d), Federal Rules of Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs (28 USC1825, Rule 17(b) Federal Rules of Criminal Procedure)".
>
•
Fb-448'-(Rev. 6-2-97) I
•
" .
FBI FACSIMILE COVER SHEET
PRECEDENCE
CLASSIFICATION
D Immediate D Priority
D D D D
Time Transmitted: Sender's Initials: L:J -===-----Number of Pages: ___;3'-(including cover sheet)
Top Secret Secret Confidential Sensitive [Z] Unclassified
[Z] Routine
Date:
To:
_
12/14/2009
Name of Office
:-jL J
Facsimile Num_b_er-:-:: Attn: Name
From:
FBI
San
--=:--:---:-
....a..--:::--
Room
Francisco _ San Name of Office
Jose
_
Telephone b3 b6 b7C
Office
Subject:
Originator's Name:
Special
Agent
Originator's Facsimile Number: L
I
ITelephone:
L-
....J------
J--------------------
Approved: Brief Description of Communication Faxed:
-,..
WARNING Information attached to the cover sheet is U.S. Government Property. If you are not the intended recipient of this information, disclosure, reproduction, distribution, or use of this information is prohibited (IS.USC, § 641). Please notify the originator or the local FBI Office immediately to arrange for proper disposition.
•
FD-302 (Rev. 10-6-95)
•
j)
- 1-
FEDERAL BUREAU OF INVESTIGATION
Date of transcription
12/29/2009
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) received
On December 23, 2009, Special Agent (sA)1 a response to a Federal Grand Jury Subpoena
(~r_Qm_1 ..._
T_h_e_r_e_S_p_Q_D_S_e __ i_D_C_l__.l]ded the following
1
~I
Vla facslmlie
....J
LI
b3 b6 b7C
The above referenced response provided byl has been attached and is made a part of this documen~t~.------------------~
Investigation on
12/23/2009
at
File #
288A-SF-145486/GJ
/2
~
SAl
I
Campbell,
California Date dictated
(via facsimile) ,.N_A
..................... ...,
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.
b6 b7C
~------------------------------~Cl~5~1 -7
18002234893
~ 12/23/2009 12:28 PM
14085581096
FBI CYBER
4085581.
12/14/2009 16:13
~
PAGE 01/04
FD·448 (Rev. 6-2-97)
FBI FACSIMILE
COVER SHEET
PRECEDENCE
CLASSIFICATION
o Immediate
o Top Secret
o Priority 00
Time Transmitted:
o Secret o Confidential o Sensitive
Routine
IZJ
Sender's Initials:
Number of Pages: ___:3:;..._ (including cover sheet)
_
Unclassified
Date: 12/14/2009
To:
FacsimileNumber: Attn:
I
Name of Office
. --~N~a-m-e-----------------L~R~o-o-m--~T=e'l-ep~h-o-n-e-----
b3
b6 b7C From:
FBI San Francisco - San Jose Office Name of Office
Su~e~:;_
~----------------------~-------
Special Handling Instructions:
Originator's Name:
Special Agent
_
I Telephone:
I
.__
oo::=o==!..
~
Originator's Facsimile Number:
Approved: Brief Description of CommunicationFaxed:
-------------~---------------------WARNING
Information attached 10 the COYersheet is U.S, Government Property. If yOU are not the intended recipient of this information. disclosure, reproduction, distribution, or usc of this informationis prohibited (IS.USC, § 641). Please notizy the originator or the loc!il FBI Office immediately to arrange fol' n.to...ru:s_disool;iliM _~ __ L-~~~=-~~~-
_-~
J ,., ' FD-302 (Rev. 10-6-95)
•
"
•
(1
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
GRAND JURy MATERIAL
- DISSEMINATE
PURSUANT
01/06/2010
TO RULE 6(e)
On January 6, 2010, Special Agent~I~~~ __~~ __~lreceived a response via facsimile to the abovementioned Grand Jury sUbfoena from I _
I
I The information, which was provided in paper format, included the following informa~ion: b3 b6 b7C
(jj ~
Investigation on
at 01/06/2010 ----------------
A~#
288A-SF-145486-GJ
by
SAl
/lp
Campbell, California Date dictated
N/A
I
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.
b6 b7C
FD-302 (Rev. 10-6-95)
- 1-
FEDERAL BUREAU OF INVESTIGATION
Date of transcription
GRAND JURy MATERIAL On a Grand Jur
- DISSEMINATE
PURSUANT
03/05/2010
TO RULE 6(e)
2010, Special A~~~~~ and Court Order
~~~ed
b3 b6 b7C
The file copy of the Grand Jury Subpoena and the Cour Order has been attached and is made a part of this document.
Investigation on
03/05/2010
at
Campbell, California
File #
288A-SF-145486-GJ .......-~
by
SAl
Date dictated
(via facsimile)
~=========---. NA
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.
b6 b7C
OJ 09-1 2009R02026
.A0110 (Rev. 12/89) Subpoena to Testify Before Grand Jury
mlniteb ~tates ]!listrict <1:ourt NORTHERN
DISTRICT OF
CALIFORNIA
_TO~
SUBPOENA TO' TESTIFY BEFOREGRAND JURY SUBPOENA FOR:
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District. Court at the place, date and time specified below.
PLACE
COURTROOM
United States District Court 280 South First Street San Jose, CA 95113
As directed by the court DATEAND TIME March 17, 2010 at 9:30 am
YOUAREALSOCOMMANDEDto bring with you the following document(s) or object(s):* -See Attachment-
Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this . subpoena and no appearance will be necessary.
[{]
Pleaseseeadditional information on reverse.
This subpoena shall remain in effect until you ar ~»!~~~~~epart behalf of the court. :~~.
by the court or by an officer acting on ('>0b .
U.S. MAGISTRATE JUDGE OR C;LERK OF COURT RICHARD W. WIEKING March 3, 2010
This subpoena is issued on application of the United States of America
JOSEPH P. RUSSONIELLO United States Attorne
* If not
applicable, enter "none".
b3 b6 b7C
A0110 (Rev. 12/89) Subpoena to Testify Before Grand Jury
RETURN OF SERVICE (1) DATE
RECEIVED BY SERVER
PLACE
b3
J/O/3fJlD UAII:
SERVED
b6 b7C
PLA~
3 is: )~D ;D'
·1
StKVtU UN (I"KININAMI:)
I :>tKVtUIH (I"KININAMI:)
TITll:
gpe:Dt~ ~tSTATEMENT OF SERVICE FEES TRAVEL
1SERVICES
.~--'
.:.1 TOTAL
-
.......
DECLARATION OF SERVER (2)
I declare under penalty of perjury under the laws of the TInited States of America that the foregoing rrect information contained in the Return of Service Executed on
S" mar-vA DATE
d:DID
r«-:]_ ~)
~
..(,
ADDRESS OF SERVER
SAP
('4 h\Jo1d1
hI".
t!IT
L .../L(£511
-
9SVt>cr'
ADDITIONAL INFORMATION
~Jq_;)
(1)
(2)
VIA-
~C6',~lv
Asto who may servea subpoena and the manner of its serviceseeRule 17(d),FederalRulesof Criminal Procedure,or Rule4S(c),FederalRulesof Civil Procedure. "Feesand mileage need not be tendered to the witness upon service of a subpoena issued on behalf of the United Statesor an officer or agency thereof (Rule 45(c), Federal Rulesof Civil Procedure; Rule 17(d),Federal Rulesof Criminal Procedure) or on behalf of certain indigent parties and criminal defendants who are unable to pay such costs(28 USC1825,Rule 17(b)FederalRulesof Criminal Procedure)".
FD-302 (Rev. 10-6-95)
•
• - 1-
FEDERAL BUREAU OF INVESTIGATION
Date of transcription
03/31/2010
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) On March 29, 2010, Special Agent I I received via u.S. Postal service a resnonse to a Grand Jurv subnoena from
b3 b6 b7c
~
V
Investigation on File #
03/29/2010 at Campbell, ----~--~-------
288A-SF-145486-GJ
~ SAl
g-:
California Date dictated
NA
b6
-r================~__~lb7C
I
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency.
••
FD-302 (Rev. 10-6-95)
• - 1-
FEDERAL BUREAU OF INVESTIGATiON
Date of transcription
11/22/2010
GRAND JURY MATERIAL - DISSEMINATE PURSUANT TO RULE 6(e) b3 b6 b7C
served
A copy of the abovementioned Grand Jury Subpoena has been attached and is made a part of this document.
Investigation on
11/22/2010 at ----~~--------
File #
288A-SF-145486-GJ
by
S_A~
cr
Campbell, California Date dictated
(via facsimile) NA ----------------------
~
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it and its contents are not to be distributed outside your agency. '----------------
-------------
_
b6 b7C
---- -----------
-------------~
y'
OJ 09·1 2009R02026
.AO110 (Rev.12/89) Subpoena to Testify Before Grand JulY
Wntteb 5>tates i1Bistrict ([ourt NORTHERN
DISTRICTOF
CALIFORNIA
TO:
SUBPOENA TO TESTIFY BEFOREGRAND JURY SUBPOENAFOR:
YOU ARE HEREBY COMMANDED to appear and testify before the Grand Jury of the United States District Court at the place, date and time specified below.
PLACE
COURTROOM
United States District Court 280 South First Street San Jose, CA 95113
As directed by the court DATE N TIME December 8, 2010 at 9:30 am
YOU ARE ALSO COMMANDED to bring with you the following
document(s) or object(s):*
-See Attachment-
Compliance with this subpoena will be deemed satisfactory when you provide all the materials to the agent serving this subpoena. No appearance will be necessary.
IZI Pleasesee additional information
on reverse.
U.S: MAGISTRATEJUDGE OR CLERK. OF COURT RICHARD W. WIEKING November 22, 2010
ONE NUMBER OF AS I TANT U.S.ATTORNEY This subpoena Is issued on application of the United States of
America MELINDA HAAG, United States Attorne • Ifnot applicable, enter "none".
sSist~a. 150 Almaden Blvd., Suite 9 0 San Jose, CA 95113 (408) 5 Special Agent Melanie Adam,
ttorney.
l-/
61 1(408) 369-8900
b3 b6 b7C
•
'j.
• A0110 (Rev.12/89) Subpoenato Testify BeforeGrand Jury
RETURNOF SERVICEIII DATE
RECEIVED BY SERVER
PLACE
/1)2-2-12-,;;>
/D
UAlt
t'LALt.
SERVED
b3 b6 b7C
I
I
J I ) 2- 2-- 12-;;> ) 0
::>tHVtU UN It'HIN I NAliIltJ
.,
,
. ~tKVtU tly WHIN I NAMt.J
IllLt
5pq TRAVEL
/
»->:
_-
Cc'-,\"
&
~"t -
STATEMENT OF SERVICEFEES I SERVICES ________
ITOTA~
DECLARATION OF SERVER(2)
I declare under penalty of perjury under the laws of the United States of America that the forel!o·ng information contained in the Return of Service a t Executed on
.;:;t ;)_ r...~
~)UJI!.J"/J~.r Q..oI (.) DATE
~tm~ttHVtK
/ 4j
I <::j
[:
f::l.,,,,,
P/.II
..4ve II---<.~
ADDRESSOF SERVER
c?~
:2....1_ ,
tA_,.._
q,ftJlYf-'
ADDITIONAL INFORMATION
~JfJt{
(1) (2)
Jlit
~UI
"",~Iv
As to who may servea subpoena and the manner of its serviceseeHUle17101.I"ederalRulesof Criminal Procedure.or Rule 45(c). Federalxutes or Livil Procedure. "Feesand mileage need not be tendered to the witness upon serviceof a subpoena issuedon behalf of the United Statesor an officer or agency thereof (Rule45{c),Federal Rules.of Civil Procedure;Rule !7(d). Federal Rulesof Criminal Procedure)or on behalf of certain Indigent parties and criminal defendantswho are unable to pay such costs (28USC1825,RuleI 7(b) FederalRulesof Criminal Procedure}".
FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) Page 2 b3; b6; b7C; Page 3 b3; b6; b7C; Page 4 b3; b6; b7C; Page 5 b3; b6; b7C; Page 6 b3; b6; b7C; Page 7 b3; b6; b7C; Page 8 b3; b6; b7C; Page 9 b3; b6; b7C; Page 10 b3; b6 ; b7C; Page 11 b3; b6 ; b7C; Page 12 b3; b6 ; b7C; Page 13 b3; b6 ; b7C; Page 14 b3; b6 ; b7C; Page 15 b3; b6 ; b7C; Page 16 b3; b6 ; b7C; Page 17 b3; b6 ; b7C; Page 18 b3; b6 ; b7C; Page 19 b3; b6 ; b7C; Page 20 b3; b6 ; b7C; Page 21 b3; b6 ; b7C; Page 22 b3; b6 ; b7C; Page 23 b3; b6 ; b7C; Page 24 b3; b6 ; b7C; Page 25 b3; b6 ; b7C; Page 26 b3; b6 ; b7C; Page 27 b3; b6 ; b7C; Page 28 b3; b6 ; b7C; Page 29 b3; b6 ; b7C; Page 30 b3; b6 ; b7C; Page 31 b3; b6 ; b7C; Page 32 b3; b6 ; b7C; Page 33 b3; b6 ; b7C; Page 34 b3; b6 ; b7C; Page 35 b3; b6 ; b7C; Page 36 b3; b6 ; b7C; Page 37 b3; b6 ; b7C; Page 38 b3; b6 ; b7C; Page 39 b3; b6 ; b7C; Page 40 b3; b6 ; b7C; Page 41 b3; b6 ; b7C; Page 42 b3; b6 ; b7C; Page 43 b3; b6 ; b7C; Page 44 b3; b6 ; b7C; Page 45 b3; b6 ; b7C; Page 46 b3; b6 ; b7C; Page 47 b3; b6 ; b7C; Page 48 b3; b6 ; b7C; Page 49 b3; b6 ; b7C;
-
-
724
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103
-
-
b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b6 ; b7C; b3 ; b6; b7C; b3 ; b6; b7C; b3 ; b6; b7C; b3 ; b6; b7C;
b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3; b3;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page
266
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373
-
b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3
; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page
374
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589
-
b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3
; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643
-
b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3 b3
; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ; ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page
644
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725
-
b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ; b3 ;
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
FEDERAL BUREAU OF INVESTIGATION FOI/PA DELETED PAGE INFORMATION SHEET FOI/PA# 1204913-0 Total Deleted Page(s) 151 Page 8 b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; Page 9 b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - PERSUANT TO SEALED COURT ORDER; Page 11 Page 13 - b6; b7C; b7D; Page 14 - b6; b7C; b7D; Page 15 - b6; b7C; b7D; Page 16 - b6; b7C; b7D; Page 17 - b6; b7C; b7D; Page 18 - b6; b7C; b7D; Page 24 - b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - PERSUANT TO SEALED ORDER; Page 25 Page 26 - b6; b7C; OTHER - DOCUMENTS PERSUANT TO SEALED COURT ORDER; OTHER - Sealed Order; Page 37 Page 38 - b6; b7C; OTHER - SEALED ORDER; Page 39 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 40 Page 41 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 42 OTHER - Sealed Order; Page 43 OTHER - Sealed Order; Page 44 OTHER - Sealed Order; Page 45 Page 46 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 47 Page 48 - b6; b7C; OTHER - SEALED ORDER; OTHER - Sealed Order; Page 49 OTHER - Sealed Order; Page 50 OTHER - Sealed Order; Page 51 Page 52 - b7D; OTHER - SEALED ORDER; Page 53 - b7D; OTHER - SEALED ORDER; Page 54 - b6; b7C; OTHER - SEALED ORDER; Page 58 - b6; b7C; Page 59 - b6; b7C; Page 60 - b6; b7C; b7E; Page 61 - b6; b7C; b7E; Page 62 - b6; b7C; b7E; Page 68 - b6; b7C; OTHER - Persuant to Sealed Order; Page 71 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 72 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 73 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 74 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 75 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 76 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER;
-
-
-
Page 77 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 78 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 79 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 80 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 81 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 82 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 83 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 84 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 85 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 86 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 87 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 88 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 89 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 90 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 91 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 92 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 93 - b6; b7C; b7D; b7E; Page 94 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 95 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 96 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 97 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 98 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 99 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 100 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 101 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 102 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER; Page 103 - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT ORDER;
Page 104 ORDER; Page 105 ORDER; Page 106 ORDER; Page 107 ORDER; Page 108 ORDER; Page 109 ORDER; Page 110 ORDER; Page 111 ORDER; Page 112 ORDER; Page 113 ORDER; Page 114 ORDER; Page 130 Page 131 Page 132 Page 133 Page 134 Page 135 Page 136 Page 137 Page 138 Page 142 Page 143 Page 144 Page 145 Page 146 Page 147 Page 148 Page 149 Page 150 Page 151 Page 152 Page 153 Page 154 Page 155 Page 156 Page 157 Page 158 Page 159 Page 160 Page 161 Page 162 Page 163 Page 164
- b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT - b6; b7C; b7D; OTHER - DOCUMENTS OBTAINED FROM SEALED COURT -
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D;
Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page Page
165 166 167 168 169 170 171 172 173 174 175 176 177 178 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204
-
b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6; b6;
b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C; b7C;
b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; b7D; XXXXXXXXXXXXXXXXXXXXXXXX X Deleted Page(s) X X No Duplication Fee X X For this Page X XXXXXXXXXXXXXXXXXXXXXXXX
•
·t (R:ev.05-01-2008)
•
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
ROUTINE
Precedence: To:
Date:
Cyber
From:
Attn:
SSAI CCU-~2~------------~
Attn:
Victim-Witness Coordinator
San Antonio Cyber C-4 SA
Con tac t : Approved Drafted
By: By:
1/17/2012
____~
L...-
b6 b7C
~
I ~~TtK~L~~5~~~-~' ----~o~
Case ID #: 288A-SA~ Title:
(Pending) I"""" 1~-SA-58304-K (Pending)- 2)~ ~IDf_Pr "!>A"'(P3f.Uia ...~:r- , I I ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
To open case and GJ subfile.
On 11/08/2011 containinql
Details:
a CHS provided writer with a CD I b6 b7C b7D b7E
D
I
I
ACS and searches on the term I resulted in a hit on case 288A-AT-99,96. serial J~J-.~T~h~l~is--s-e-r~i~a~l~ b6 is an FD-302 of an 2006 interview ofJ lat his b7C residence inl lin which he I I I The information provided the following:
I
Name:~I
~
OPEN&ASSIG
UNCLASS IFI~ass/Alpha: __ Zti~,~II.....L::J....---,._J. Case Agent: ~~~=~-r'-f SRC Code:..Q!:L '_~-=---=~"'""M I Codes:;_~~~_:"::::i=-+Assess PI IDENTITYTH DATE:,__ .1.=-..l-l.---lo.!::::;"_ __
To: Re:
•
UNCLASSIFIED
Cyber From: San Antonio 288A-SA-NEW, 1/17/2012
Telephone: IL........ Associate ~~a~mwe~s~;~n~o~n~e~ Addresses: ! Businesses: none
• ~
b6 b7C
It is requested that the case and Grand Jury subfile be opened.
UNCLASSIFIED 2
,)
•
. To: Re:
UNCLASSIFIED
Cyber From: San'Antonio 288A-SA-NEW, 1/17/2012
LEAD (8) : Set Lead 1:
(Info)
CYBER AT CCU2, DC For information only. Set Lead 2:
(Info)
SAN ANTONIO AT SAN ANTONIO, TEXAS To advise Victim-Witness Coordinator of case initiation.
••
•
UNCLASSIFIED 3
Case ID: 288A-SA-63452
•
•
lA Envelope
OTHER SEALED ORDER
------------~------------------------------.-~--------------------~ SA 1 SEARCH WARRANT RESULTS FOR 1--------I
~-------~------j~~~I----------------------------------------------------------------------------------------------------------------------------~---
---------------------~---------------------------------------------------------
---------------~---------------------------------------------------------------
----------------------------------------------------------------------~-------! ! ---------------------------------------------------------~------------------------------------------------------------------~------------------------------------------------------~-
------------------------------------------------------
!.
!
.
I~
_)
MDI 23;._;:;_~A_-_:__);4-_'.. ~_~:...;_'S_'L t _,__;_~ I_;_:_~~__
FD-340 (Rev. 4-11-03)
File Number __
Field Office Acquiring Evidence
S'1'" .A.II Will ;D
Serial # of Originating Document Date Receiv~e::d-====;_--4-;-·
-,
_
=--====-
_-_~_;_'-_' _'2._t?_I_L
_
OTHER SEALED ORDER
From __ (NameofContributor/Interviewee)
(Address),
_---------=j(City
BY __
~~Jt~·LI
andState)
~I
~_~_c
__
To Be Returned 0 Yes ~ No Receipt Given 0 Yes [it'No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure DYes Federal Taxpayer Information (FTI)
o
Yes
[i;?' No
d'~o
Title:
Rererence:
~
_
(Communication Enclosing Material)
OTHER SEALED ORDER
e
S'
~.,. " ,,;-¥-_
1
'C,,,,
1
DocLab Note //
ITEMS(S) CANNOT BE .
SCANNED DESCRIPTION
.'
I
c)
u
FD·340(Rev. 4-11·03)
I_88_~A-_' 51+-,.f\_- (b_~_lJ-~_7-_-_.!.._1 A~~j-=-__
File Number __
Field Omce Ac:qulrln&Evfdence
.'
_+-~..::..>.;..'1..;._~.A:.....,..·."'~~_" __i_;:o=--",--
Serial # of Originating Doc:ul,ieJlf'
.
Date Received From
_.;_I
...,.-
o..;:·:;..·....ll"-· _-'-
_ _
101(O! 20 (2... ---~~~~~~------------~-~~
---------~---~------------------~--------------(Name of ContributorlInterviewee) 1
(AddrcsI)
i~
(City1s....)
5A-
·i
By
~
To Be Returned
0
-,
~
Yes
___ '"
g No
,I
i·
cf
Receipt Given 0 Yes No Grand Jury Material- Disseminate Only Pursuant to Rule 6 (e) Federal Rules of Criminal Procedure.tL Yes U No Federal Taxpayer Information (FfI) DYes c:l No
o
J /
"-;
Title:
b6 b7C
~
j
I
Reference: (Communication Encklsing Material)
I I
'1 ~
.1
Origin~lnotes re interview of
I .......
FBI SAN ANTON,IO CYBER SQUAD C-4
FAX TRANSMITTAL SHEET
2__-_~-_f_L __
Date: __
Y-
Number of Pages: (Includin.g
_
OTHER
Fax S::h=e=:et:!...) _--------,\
To: __
~I__ ------------~=-~-----------
Fax Number:
J _----====-l------L
From: Number:
L__===-J Fax: \L__
Office:
b6 ~ b7C
-___l--
Reference:
--~~---------------------
I
I \
I
I
\ I
I
I
I
!......-~~
-_._---
:~
FD-S42 (Rev. 03-23-2009)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
ROUTINE
Precedence:
To:
Date: 02/09/2012
San Antonio
From:
San Antonio Cyber/C-4 : SA
Approved By: Drafted By: Case ID #: Title:
b6 b7C
I
~==========~--~ ~I ~ 288A-SA-63452
(Pending)"'"
1
ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
To claim statistical accomplishment. b6 b7C b7E
UNCLASSIFIED
b6 b7C
I I ,
'(
'r.;
UNCLASSIFIED To: Re:
San Antonio From: San Antonio 288A-SA-63452, 02/09/2012
Accomplishment
Infor.mation:
Number: 1 Type: ClP 2703(f) ORDER SERVED lTU: ClP Claimed SSN: Name Squa: C-4
BI"
~~~~------------~
b6 b7C
••
UNCLASSIFIED 2
INFORMATION NEEDED F~M AGENT FOR COMPLETION (Complete one form for each defendant)
OF CRIMIIIl
OPENING
I.
NAME & AKA'S OF SUBJECT:
ADDRESS.~· __~
FORMS:
Antisec
~---------------
ID#: SEX:~M==~~D~O~B~:~I=-~ ~ ARREST DATE:~n~a~ SSN:L_ _J-------COUNTRY OF CITIZENSHIP: ~U~S~A~ IMMIGRANT STATUS: NON-RESIDENT / UNDOCUMENTED
__ ___ __
/
LEGAL
PERMANENT
RESIDENT
IS THIS A SINGLE AGENCY, SHARED AGENCY OR TASK FORCE CASE? AGENT/AGENCY:
~FwB~I~
__ AGENCY
Any other agency involved: AGENT/AGENCY: ANTICIPATED CHARGES:
__
/
VALID
VISA
LIST ALL:
CASE #: 2BBA-SA-63452
b6 b7C
AGENCY CASE #:
Title 18 USC 1030, Title 18 USC 2261 A(2) (A) (LIST LEAD CHARGE FIRST)
ESTIMATED DOLLAR LOSS: ~n~o~n~e~
__
IN WHAT COUNTY OR COUNTIES DID THE CRIME OCCUR?
DOES SUBJECT HAVE COUNSEL? ~U~n~k~n~o~w~n~ IF YES, CIRCLE ONE: FEDERAL DEFENDER / APPOINTED
_rl=c=o=u=n=ty~-------
L-
___ /
RETAINED
/
PRO SE
And LIST COUNSEL'S NAME AND ADDRESS:__~N~A~
__
IF THIS IS A BANK FRAUD CASE, IS THERE A PROGRAM AGENCY INVOLVED? (i.e., Comptroller of the Currency, FDIC, etc.) IF SO, LIST AGENCY AND THEIR FILE NUMBER' n/a
ARE THERE ANY VICTIMS IN THIS CASE? Yes IF SO, WHOM? Texas Commission on Jail Standards website at www.tcjs.tx.us IS THIS A SENSITIVE CASE?~N~
__
GIVE SHORT SYNOPSIS OF CASE: Subject of case is involved in computer hacking with the Anonymous group. Subject conducted unauthorized activity against www.tcjs.tx.us as part of a computer intrusion attack against the site.
.." (Rev. 65-01-2008)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Precedence: 'To:
Date:
PRIORITY
San Antonio
From:
Attn:
SIA ...1
02/27/2012"
___~
San Antonio Cyber C-4 ; SA
Approved By: Drafted By:
L..--i
_p
~I! A
L--I
Case ID #: 28~-SA-63452
(Pending) ~
b6 b7C
~
I
Title:
~ ~ANTISEC; TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS Synopsis:
Request Sosi
lassistance on captioned case.
Details: Writer requests sosl lassistance due to the overwhelming amount of time-sensitive data bein r vided by a CHS. This data often contains b7D
Due to the amount, and frequency, of the data, it is not possible to provide timely updates to the affected FBI field . offices and law enforcement agencies while also addressing current CIP National Security and CIP Criminal case load. It is anticipated that sosl I assistance will consist of reading email, watching videos, and crnducting online research regarding CIP Criminal hacktivism. SOS_ assistance is requested to assist C-4 Cyber in mitigating hacktivism threats which are presently ongoing in FBI San Antonio's AOR and in other FBI Field Office AORs. CHS reporting is arriving daily, but becomes stale if not utilized immediately to assist in preventing or responding to CIP Criminal Hacktivism threats. The duration of the captioned case is unknown and will be commensurate with the operational life of the CHS.
J
I
Without SO~ assistance, there is a substantial risk of losing valuable information being provided by UNCLASSIFIED
b6 b7C
UNCLASSIFIED To: Re:
San Antonio From: San Antonio 288A-SA-63452, 02/27/2012
the CHS into CIP Criminal Hacktivism threats and the ability to mitigate these threats in a timely manner through prevention of attacks or mitigation of known or attempted intrusions.
UNCLASSIFIED
2
l-
UNCLASSIFIED
I
To: Re:
San Antonio From: San Antonio 288A-SA-63452, 02/27/2012
LEAD (s)
:
Set Lead 1:
(Action)
SAN ANTONIO AT SAN ANTONIO, TEXAS matter .
Please assign sos~I
~
••
•
UNCLASSIFIED 3
to captioned
b6 b7C
Ep-542 (Rev. 03-23-2009)
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
ROUTINE
Date:
02/20/2012
San Antonio
From:
San Antonio Cyber/C-4 : SA
Approved By: b6 b7C
Drafted By: Case ID #: Title:
288A-SA-63452
1
(Pending)........
ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
To claim statistical accomplishment.
Details: To date, during the course of this investigation, writer has accomplished numerous achievements. The owners of www.lcso.org and www.pbso.org were notified of treser activity against their sites.
I
I
The sUbjecT~~o~£~t~b~e~'~'n~1wTe~s~t~i~a~a.t~j.o~n~I----------------'_I~"JS b6
identifiedthrQ~
UNCLASSIFIED
b7C b7D
To: Re:
•
UNCLASSIFIED
San Antonio From: San Antonio 288A-SA-63452, 02/09/2012
Accomplishment
Infor.mation:
Number: 2 Type: CIP VICTIM ED/INTERVIEWED ITU: CIP Claimed BY:I SSN: Name: Squad :L...-...,.c.,..-....,4.-----------. Number: 1 Type: CIP SUBJECT IDENTIFIED ITU: CIP Claimed By °1 SSN: Name: Squad:~-C=--4~------~ Number: 1 Type: CIP IN~ORMANT/ASSET DEVELOPED ITU: CIP Claimed By.~o---------~
~;:~:I
Squad'~:-~C~--4------~
Number: 1 Type: CIP CONSENSUAL MONITORING CONDUCTED ITU: CIP Claimed BYro-----------,
~~:~: I Squad
:!--.... C.... -....,4..---------~
••
UNCLASSIFIED
2
b6 b7C
•
(Rev. 05-0),,2008) t
UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
ROUTINE
San Francisco
Date: Attn:
04/11/2012
San Jose RA SA L-I
From:
----1
San Antonio Cyber/C-4 : SA
Approved By: Drafted By:
L...--
Case ID #: Title:
b6 b7C
288A-SA-63452
___..lll (Pending)/
,\
ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
Request location of subject of captioned case.
Enclosure's): Encrosed for San Jose are two recent photographs of ""__ __ ! -;:::::::::::::=._--,
I
Details:
On
b6 b7C b7D b7E
UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE
UNCLASSIFIED To: Re:
San Francisco 288A-SA-63452,
From: San Antonio 04/11/2012
b6 b7C b7E
confirmation
of the location
of this ca tioned case.
of
I
r~------~Il~'s~b-e~l~l~'eved
to reside in
The subject's full name is I DOB: SSAN: [ I possible cellular telephone number I las~ known ad~ress: I ~----------------~ ~J This residence is~I ~ primary residence. Other possible residents at L.t-h-a-t--l-o-c-a-t....,i-o-n--m-a-y~be
r---------,l
I
b6 b7C
I
I appears to be currently
Pertinent subject ofLI
I
to this lead is the fact that I
Iwas the ~
L
See case 288A-AT-99196 for further informatiQn. Please be aware that I Imay bel
UNCLASSIFIED/fLAW ENFORCEMENT SENSITIVE 2
b6 b7C b7E
, ,
. .,)
UNCLASSIFIED To: Re:
San Francisco From: San Antonio 288A-SA-63452, 04/11/2012
LEAD (s)
:
Set Lead 1:
(Action)'
SAN FRANCISCO AT SAN JOSE, CALIFORNIA Please determine
the current
residen~c~e~o~f~I
r.
land determine whether he currently is~I 1 I Please include information on any electronic equipment that may be observed in subject's possession .
••
UNCLASSIFIED//LAW ENFORCEMENT SENSITIVE 3
~ __~
~
b6 b7C
FBI SAN ANTONIO CYBER SQUAD C-4
FAX TRANSMITTAL SHEET Date: __ Number of Pages: __
Y_-_r..&;;.,,_~-_12
It
Jr---.....;....._-------,
_
_
(InclucUD.g Fax Sheet)
To:
Fax Number:
_"L-I
--'-
From:
SA
Number:
omce: Fax:
Reference:
,
b6
b7C b7E
L--
__'
_
f~
•
~..
(Rev. 05-01-2008)
UNCLASSIFIED//FOR OFFICIAL USE ONLY
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
ROUTINE
Date:
04/20/2012
Cyber
Attn:
SSAL.CCU-~2~----------~ SSAI CCU-~l-----------~
San Antonio
Attn:
CI-l
From:
SSA~I---------------, CT-4
San Antonio Cyber/C-4 : SA
Approved By: L-Ir--_ -__ - _- _-_-_......I...JojI[a~
I
Drafted By: Case ID #: Title:
......
288A-SA-63452
__._.....,
.
I
*
b6 b7C
(Pending)" \
ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
(U//JOUO)L.-
__......
I Details:
~I
(UjjFOUO)
I
-----------------------
UNCLASSIFIED//FOR OFFICIAL USE ONLY
b6 b7C
__......I~~~ b7E
'"
. UNCLASSIFIED To: Re:
San Francisco From: San Antonio 288A-SA-63452, 04/11/2012
LEAD (s): Set Lead 1:
(Info)
CYBER AT CCU-1, WASHINGTON, DC No hard copy to follow. Set Lead 2:
For information only.
(Info)
CYBER AT CCU-2, WASHINGTON, DC No hard copy to follow. Set Lead 3:
For information only.
(Action)
SAN ANTONIO AT SAN ANTONIO, TEXAS For evaluation by CI-l for actionable value. Set Lead 4:
(Action)
SAN ANTONIO AT SAN ANTONIO, TEXAS For evaluation by CT-4 for actionable value .
••
UNCLASSIFIED//FOR OFFICIAL USE ONLY 46
•
•
(Rev, 05-01-2008)
UNCLASSIFIED//FOR OFFICIAL USE ONLY
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
ROUTINE
Date:
Sacramento
From:
04/20/2012
Attn: CY-1
San Antonio Cyber/C-4 : SA
Approved By: Drafted By: Case ID #:
288A-SA-63452
(Pend i nq L>
y:~;
b6 b7C
~~TISECi Title: ~ TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS ~S_yn __O_D_S_;_S_.
(T_T_/_/F_O_T_ID~r.L-
Enclosure(s): Enclosed for Sacramento is a CD-ROM containing a copy of the database table in MS Excel format.
UNCLASSIFIED//FOR OFFICIAL USE ONLY OTHER Persuant to Sealed Court Order b6 b7C b7D
~
, t
To: Re:
•
UNCLASSIFIED
Sacramento From: San Antonio 288A-SA-63452, 04/20/2012
• b7E
UNCLASSIFIED//FOR OFFICIAL USE ONLY 2
UNCLASSIFIED To: Re:
,
Sacramento From: San Antonio 288A-SA-63452t 04/20/2012
LEAD (s)
:
Set Lead 1:
(Action)
SACRAMENTO AT SACRAMENTO
I
(U//FOUO)I
b7E
••
UNCLASSIFIED//FOR OFFICIAL USE ONLY 3
UNCLAS$IFIED,
FEDERAL
~F INVESTIGATION
ROUTINE
Precedence: To:
BOFl~U
• Date:
05/01/2012
San Antonio
From:
San Antonio Cyber/C-4 Con tact:
Approved Drafted
By: By:
Case ID #: Title:
I
I
~========----~ I I 288A-SA-63452
b6 b7C
~l~
(Pending)
ANTISEC; TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis: Details:
~----------------------------~ SA
To claim stati$tical accomplishment. To date, writer has used a CRS on multiple occasions to b6 b7C b7D
I
)
OTHER Persuant to Sealed Court Order b6 b7C b7D
UNCLASSIFIED
:f
UNCLASSIFIED
To: Re:
San Antonio From: pan Antonio 288A-SA-63452, 02/0~/2014
Accomplishment
•
Infor.matiq~:
Number: 1 Type: CIP SUBJECT IDENT~fIED ITU: CIP Claimed By:I SSN: Name: Squad:~~C---4--------------~ Number: 1 Type: CIP SEARCH WARRANT OBTAINED AND EXECUTED ITU: CIP Claimed BY:I SSN: Name: Squad: C-4
~~~------------~
Number: 1 Type: CIP CONSENSUAL MONITORING CONDUCTED ITU: CIP Claimed By~· ~
~;~~:~I--~~------------~ Squad:
C-4
Number: 1 Type: CIP COMPROMISED SITE IDENTIFIED ITU: CIP Claimed By:~ ~ SSN: I Name: ~ ~ ....I Squad: C-4
••
UNCLASSIFIED,
2
b6 b7C
•
•
I..
(Rev. 05-01-2008)
UNCLASSIFIED//FOR OFFICIAL USE ONLY
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
Date:
ROUTINE
San Antonio
From:
San Antonio Squad CI-1 : SA
Approved By:
Attn:
SA -r=-~--____J Cyber!C-4 L..I
I
]
I
I
~
~L..-
_
Drafted By:' Case ID #: Title:
288A-SA-63452
05/03/2012
(Peridd.nq )
-
1
b6 b7C
ANTISEC TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) - VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
Coverage of lead.
Full Investigation Initiated:
01/17/2012
Details: San Antonio CI-1 received a SA-63452 serial #14 lead #3. Special ~~~~~~ __~ __~~ ~ and Staff Operations Specialist (SOS) conducted logical investigation of e-mail addresses. To date, FBI San Antonio CI-1 ha~ exhausted all investigative resources and no priority threats to national security warranting further investigation were identified. In the event additional derogatory information is discovered, FBI San Antonio CI-1 will consider opening an investigation. FBI San Antonio CI-1 considers this lead covered.
UNCLASSIFIED//FOR OFFICIAL USE ONLY
b6 b7C
UN~ASSIFIED//FOR OFFICIAL us!ltNLY To: Re:
San Antonio From: San Antonio 288A-SA-63452, 05/03/2012
LEAD (8)
:
Set Lead 1:
(Info)
SAN ANTONIO AT SAN ANTONIO, TX C-4 for information only. Read and clear .
••
UNCLASSIFIED//FOR OFFICIAL USE ONLY 2
(Rev. 05-01-2008)
UNCLASSIFIED
•
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
Date:
PRIORITY
OS/25/2012
San Antonio
From:
San Antonio Cyber C-4 :
SAl~----------------------------,
Approved By:
__.I \ q,
Drafted By: L...---
Case ID #: 288A-SA-63452 Title:
I
(Pending) ~
b6 b7C
I
aka I I ANTISECi TEXAS COMMISSION ON JAIL STANOARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
Case update and investigative plan. ·' Details: Writer currently has no CHS coverage of the subject of the captioned case and no more open-source leads. A lead was sent tol I RA, IDivision, to attempt to physically locate subJect at filS last known physical address. To date, I IRA has been unable to locate the subject.
r
~ ~IRA has a CHS that may be able to gain access to the subject online and writer has requested that this be attempted. Writer has also requested I I RA to «onti plle attempt to locate the subject. Writer will work withtto provide any needed information or Grand Jury subpoenas.
fO
Upon locating the subject, whether online or physically, writer will use all means available to observe the online activity, especially the IP addresses used, by the subject. It is anticipated that this will enable writer to link past known attacks to the subject beyond a reasonable doubt .
•• UNCLASSIFIED
b7D
•
•
FD-302 (Rev. 10-6-95)
- 1FEDERAL BUREAU OF INVESTIGATION
Date of transcription
rI
05/31/2012
~O~n~~M~a~y~3~1~, 2012, an employment request was faxed to the State ofl lEmplOymenf Development Department (EDD), via facsimile number I . The request asked for employment information from 01/01/2010 through present for the following individual:
b6 b7C b7D
Name: DOB: SSAN: Attached and made a part of this document is a copy of the request faxed to EDD_
Investigation on
05 / 31/2012
File #
288A-SA-63452 /l
by
S_A~
b7D atL-1
q
...J....-------Date dictated
a1
not dictated
~------------------~--~~--------------~~._-
This document contains neither recommendations nor conclusions of the FBI. It is the it and its contents are not to be distributed outside your agency.
~lle~!1
:nd
?our-:: le~
b6 b7C
•
•
U.S. Department of Justice Federal Bureau of Investigation
In Reply, Please Refer to
File No.
28 8A -SA -63452
May 31, 2012 Attention:
To Whom It May Concern
Re:
Employment
Dear State ofL..I
for L..I
~FmplOyment
...... Development
Please provide employment information through present for the following individual:
Department: from 01/01/2010
b6 b7C b7D
Name: DOB: SSAN:
Sincerely yours, b6 b7C
SpecJ.al Agent
./
,\
'\/
)Ov ,
\0
I
" .'
•
it1
. (Rev. 03-23-2009) FD-542
UNCLASSIFIED
FEDERAL BUREAU OF INVESTIGATION
Precedence: To:
ROUTINE
Date:
06/08/2012
San Antonio
From:
San Antonio Cyber/C-4 : SA
Approved By:
b6 b7C
Drafted By: Case ID #: Title:
288A-SA-63452
(Pending)./
d-D
ANTISECi TEXAS COMMISSION ON JAIL STANDARDS (TCJS.STATE.TX.US) VICTIM COMPUTER INTRUSIONS - CRIMINAL MATTERS
Synopsis:
To claim statistical accomplishment.
Details: On 6/7/2012, an I~I~R~(~n~U~mb~~e~r~I ~ ~ was published based on CHslreporting. The subject of b7D the IIR was (U//FOUO) Identification of Internet Relay Chat (IRC) Channels Used by Anonymous , as ofl I
UNCLASSIFIED
To: Re:
•
UNCLASSIFIED
San Antonio From: San Antonio 288A-SA-63452, 06/08/2012
Accomplishment
•
Infor.mation;
Number: 1 Type: CIP POSITIVE INTELLIGENCE PRODUCT GENERATED (E.G. IIR) ITU: CIP Claimed By~· ~
~::~:~I------------------~ Squad: C-4
••
UNCLASSIFIED 2
b6 b7C
UNCLASSIFIED
FD-l023
FEDERAL BUREAU OF INVESTIGATION CHSREPORTING DOCUMENT
(07/24/2010)
HEADER
IDt
Source Date:""'0"""3~/~0-=2-=/-=2-=0-=-1=-2--___' b7D CaseAgenr Name_ Field!------OfficejDivisioSan Antonio
b6 b7C
.....
n: Squad: C Four Date of 02/22/2012 List all present includin g
yourseI1i---------,
b6 b7C
(Do not include the CHS.): Type of e-Mail Date of 03/02/2012 Report: Substantiv e CaseFile Number: 288A-SA-63452 DCheck if Grand Jury restrictions apply Source Reporting: CHSprovided the following through email:
b6 b7C •
,.
UNCLASSIFIED
-----------------------------------------------
UNCLASSIFIED
FD-l023
FEDERAL BUREAU OF INVESTIGATION CHS REPORTINGDOCUMENT
(07/24/2010)
HEADER
Source I Date: 12/06/2011 Case Agenq Name~~ Field Offlce/Dlvlslo San Antonio
~~~~~----~ ~
n: Squad: C Four Date of 11/08/2011 : List all present including,.-
b6 b7C ~
yourself]
(Donorla_.
~
include the CHS.): Type of In Person : •
Count~ UNITED STATES City: Lackland AFB Stat: Texas Date of 12/06/2011 Report: . Substantiv e Case File .....__ Number: 288~UB
A
2.. i~A" S4- , ~lfst b6 b7C b7D
-
--
- -------
--
--_
---------------------------------------------------------,
DCheck if GrandJury restrictions apply The report mentions a full report provided by1:hesource:
r-1-------------,lan4
~s being potential actors in the LulzSecgroup. Belowis the L..-
___'
b6 b7C
This is your guide to making senseof everything on this disc. All times in file names are Central.
[[DISCLAIMER]]
b6 b7C b7D
•
FD-l023
UNCLASSIFIED
•
FEDERAL BUREAU OF INVESTIGATION CHS REPORTINGDOCUMENT
(07/24/2010)
HEADER
IDtL
Source Date: 05/10/2012 Case Agent Name:1 Field Office/Division: Ls-a-n-A-n-t-o-n-io----'
___.
b7D
b6 b7C
Squad: C Four
Date of : 05/01/2012
I
List all present including vourself.L (Do not include the CHS.): Type of : e-Mail
___,J
Date of ReportLI
.....I
Substantive Case File Number: 288A-SA-63452 Source Reporting:
b7D
Page 1 of 26
b6 b7C b7D