27 March 1999
Source: Hardcopy from Seattle, WA, postmarked 12 March 1999.

See related files: http://jya.com/cejfiles.htm

Note: xx indicates that text was not legible.

1

BASIS OF INVESTIGATION

On April 21, 1998, Royal Canadian Mounted Police (RCMP) Investigator STEVE FOSTER identified CARL JOHNSON as the subscriber of an Internet account which was involved in threatening activity.

BACKGROUND

On April 1, 1997, IRS Inspectors executed a search warrant on the residence of JAMES BELL (case 7-9610-0046). BELL was the proponent of a scheme he called "Assassination Politics", where anonymous persons could use the Internet to post a reward for the death of Government officials. In BELL's scheme, an assassin could place a "bet" on which day the Government official would die, and then collect the reward if his death prediction was accurate. BELL often discussed the Assassination Politics scheme with an Internet discussion group known as the "Cypherpunks". BELL had discussed the scheme in e-mail messages with a Cypherpunk using the name "TOTO". BELL was arrested by Inspectors on May 16, 1997. Copies of many of the documents involved in the BELL investigation, including copies of the search warrant, were posted to the Internet by members of the Cypherpunks.

RESULTS OF INVESTIGATION

On September 30, 1998, JOHNSON was indicted for violating Title 18, United States Code, Section 115, Threatening Federal Officials.

DETAILS OF INVESTIGATION (EXHIBIT)

On June 23, 1997, an anonymous message was posted on the Cypherpunks Internet group. The message stated that a "Dead Lucky" Assassination Politics (AP) computer program (Bot) had been implemented due to the "unconstitutional actions of Federal employees". The message listed as "leading eCa$h candidates for dying at an opportune time" three IRS Inspection employees and a Magistrate Judge, all of whom were listed on BELL's search warrant. The posting included dollar figures for each person named. (3, 2)

On September 4, 1997, a second anonymous posting to the Cypherpunks group also discussed "Dead Lucky", and cross-referenced an Internet Web Page. The Web Page contained the actual interactive Dead Lucky program, and stated "If you can correctly predict the date and time of death of others, then you can win large prizes payable in untaxable, untraceable eca$h". The site also stated that until rules were posted it was for entertainment purposes only." (4, 5 )

On December 9, 1997, an encrypted message was anonymously posted to the Cypherpunks group titled "Encrypted InterNet DEATH THREAT!!! / ATTN: Ninth District Court Judges / PASSWORD: sog". This message contained additional threatening statements involving appeals court Judges hearing an encryption case, and contained the statement "I can also be tied into Jim Bell's Worldwide Conspiracy to assassinate government authorities, through my implementation of an Assassination Bot..." (6)

RCMP Investigator FOSTER reported that the RCMP was investigating CARL JOHNSON regarding documents on his Internet web page, and had executed a search warrant on (8, 9)

____________________________________________________________________

Form 2028.WR Rev 11\95      Department of the Treasury - Internal Revenue Service

2

JOHNSON's residence. RCMP seized one of JOHNSON's computers and another was seized by Canadian Customs authorities. RCMP also established through Sympatico, the Internet provider, and phone records that JOHNSON was the person who was maintaining the Web site which contained the Dead Lucky program.

FOSTER provided a copy of the computer encryption "Secret Key Ring" which was located on one of JOHNSON's computers. Using encryption software, Inspectors were able to directly link a "secret key" on the "ring" as having been the key which was used to sign the December 9, 1997 death threat message. (11)

FOSTER also provided documents seized from JOHNSON's residence during the execution of RCMP's search warrant. Among these was a September 7,1997 message in which "Toto" states "INFOWAR DECALRED!!!" and discusses disseminating encryption secret keys he has created among members of the "Magic Circle". Other documents were related to a possibly threatening e-mail message sent to Washington State Legislator KAREN SCHMIDT. (9)

An analysis of the contents of JOHNSON's computers revealed a variety of evidence that JOHNSON was involved in sending threatening e-mail messages to the President of the United States, Microsoft Chairman BILL GATES, and U.S. Senators FEINSTEIN and KENNEDY. The computers also contained copies of the "Dead Lucky" web Site program and evidence that JOHNSON had used anonymous remailers to send messages. Also on the computers were outgoing messages discussing the effects of the "AP-Bot" which included the statement "The Sympatico AP-BOT received bets on the times of demise of even some of the lowliest government paperwork shufflers involved in Jim's (BELL) case." (10, 31)

On June 3,1998 an unexploded firebomb was discovered in an Estevan, Canada Courthouse. Canadian police reported that JOHNSON had been formally charged in the attempted bombing and that a warrant had been issued for his arrest. On June 8, 1998, an anonymous posting to the Cypherpunks group indicated that the Courthouse bomber was on a "middle-leg of the .. SoftTarget Tour of Planet Terra." Also on June 8, 1998, reporter DECLAN MCCULLAGH received four encrypted e-mail messages notifying him that two bombs had been placed in Canada, signed by "A. Fiend". "A. Fiend" had also been used as the signature on an e-mail death threat to BILL GATES, which was located on JOHNSON's computer. (12, 13, 15, 10, 27)

Microsoft Corporation reported that they had received two Internet death threats to BILL GATES, (relating to documents found on JOHNSON's computers). (27, 28)

On July 27,1998, JOHNSON was interviewed by agents of the U.S. Secret Service. JOHNSON stated that the December 9, 1997 death threat message "looks like my stuff", and he explained what he meant by some of the statements. JOHNSON also referenced doing a harmful bomb with a fella from the old days, but he did not comment further on the subject. JOHNSON denied that he intended to harm any Government employees. JOHNSON told the agents his Social Security Number (SSN) was 608-33-5345, and acknowledged using various aliases including "Toto". (17)

On August 13,1998, a message from "toto" was posted to the Cypherpunks list in which the (18)

____________________________________________________________________

Form 2028.WR Rev 11\95      Department of the Treasury - Internal Revenue Service

3

author discussed getting thrown out of the Plaza Hotel in Las Vegas after making a bomb threat. Plaza Hotel security later confirmed the incident and identified a picture of JOHNSON. (24)

On August 18,1998, JOHNSON was arrested by Inspectors in Tucson, Arizona. During a search incident to arrest, Inspectors discovered various documents and computer disks linking him to various Internet messages. Among the items located on the disks was a duplicate copy of the "secret key ring" linked to the December 9, 1997 death threat message, as well as a "public key" which could have been used to send the bomb notification messages to reporter MCCULLAGH. Inspectors also discovered two Las Vegas pawnshop receipts where JOHNSON listed his SSN as 608-33-5345. When interviewed, JOHNSON stated that he did not understand his (Miranda) rights. JOHNSON spit on an Inspector during processing. (19, 20)

The Social Security Administration reported that JOHNSON's correct SSN was 456-45-0297, and that SSN 608-33-5345 has never been issued. (23)

Documents obtained from Kino Community Hospital in Arizona revealed that JOHNSON listed his SSN as 608-335-345 on a January 1998 registration form. (28)

After the arrest and complaint involving JOHNSON became public, members of the Cypherpunks group were able to "hack" the public key portion of the encryption program which had authenticated the December 9, 1997 death threat message. The Cypherpunks were able to create a fake "public key" which falsely authenticated the message. Also posted to the Internet were passwords used by JOHNSON. (30)

On October 13, 1998, an anonymous poster posted to the Cypherpunks an authentic copy of both the public and secret key used to encrypt the December 9, 1997 death threat message. (32)

Handwritten letters from JOHNSON were obtained from Reporter DECLAN MCCULLAGH. The letters were written by JOHNSON in September 1998, while he was in custody. Among the statements were "..the Complaint seems to amount to... one Entertainment BOT and one anonymous email 'authenticated' by what I suspect will turn out to be a Communal 'Magic Circle' PGP digital signature", "BTW, the 'Dead Lucky AP-Bot' received just three votes..", and "This even 'after' taking into account my spitting in a US Treasury Agent's eye.." one of the letters was addressed to Magistrate Judge NANCY FIORA and was signed "A Violent Psycho Killer To Re Named Later." (40)

Interviews with other members of the "Magic Circle" revealed that it was a creation of JOHNSON's, and that JOHNSON had distributed some PGP secret keys. (38, 39, 41)

____________________________________________________________________

Form 2028.WR Rev 11\95      Department of the Treasury - Internal Revenue Service

4

Description  (Page)

1 Memorandum of Interview or Activity, Chronology of Events Involving CARL JOHNSON, September 25, 1998. [Not in this package; probably the document at http://jya.com/irs092598.htm] (9-14)

2 Memorandum of Interview or Activity, Information Relating to the Investigation of JAMES BELL, April 21, 1998. (15-19)

3 Memorandum of Interview or Activity, "AP Bot Results" Threatening Internet Message, June 26. 1997. (20-21)

4 Memorandum of Interview or Activity, Second Internet Message Involving "Dead Lucky", September 4, 1997. (22-23)

5 Memorandum of Interview or Activity, Review of Internet "Dead Lucky" Web Site, September 4, 1997. (24-25)

6 Memorandum of Interview or Activity, Internet Death Threat Message, December 9, 1997. (26-36)

7 Memorandum of Interview or Activity, Review of December 14, 1997 Internet Messages from Human Gus-Peter, July 15, 1998. (37-41)

8 Memorandum of Interview or Activity, Documents Obtained from the Royal Canadian Mounted Police Involving CARL JOHNSON, May 13, 1998. (42-55) [Not in this package.]

9 Memorandum of Interview or Activity, Documents Seized During the Search Warrant of CARL JOHNSON's Residence, October 27, 1998. (56-89) [Not in this package.]

10 Memorandum of Interview or Activity, Review of Information Contained on CARL JOHNSON's computers, November 23, 1998. (90-171)

11 Memorandum of Interview or Activity, Analysis of CARL JOHNSON's Computer Encryption Keys and the December 9, 1997 "Encrypted InterNet DEATH THREAT!!!" Message, July 7, 1998. (172-175)

12 Memorandum of Interview or Activity, DEL BLOCK, Estevan Police Department, June 10, 1998. (176-180)

13 Memorandum of Interview or Activity, Anonymous "Breaking News" Message Posted to the Cypherpunks Group, June 10, 1998. (181-183)

____________________________________________________________________

Exhibit List Sheet.WR Rev 10/95      Page # ___5___     Department of the Treasury - Internal Revenue Service

14 Memorandum of Interview or Activity, Review of the Internet Article The Xenix Chainsaw Massacre, June 10,1998. (184)

15 Memorandum of Interview or Activity, DECLAN MCCULLAGH, June 11, 1998. (185)

16 Memorandum of Interview or Activity, Messages Posted to the Cypherpunks List from lreed@,west.cscwc.pima.edu, August 25,1998. (186-193)

17 Secret Service Interview of CARL JOHNSON, July 27, 1998. (194-198) [Not in this package.]

18 Memorandum of Interview or Activity, Deaf Cons 5.9 Internet Message, August 14, 1998. (199-200)

19 Memorandum of Interview or Activity, Arrest of CARL EDWARD JOHNSON, August 18, 1998. (201-215)

20 Memorandum of Interview or Activity, Contents of the 11 Disks Seized During the Search Incident to Arrest of CARL JOHNSON, September 23, 1998. (216-241)

21 Memorandum of Interview or Activity, LINDA LOU REED, August 18, 1998. (242)

22 Memorandum of Interview or Activity, LINDA LOU REED, August 20, 1998. (243-245)

23 Memorandum of Interview or Activity, JOHN MCCLEOD, Social Security Administration, August 24, 1998. (246-247)

24 Memorandum of Interview or Activity, ERIC STATZ, Plaza Hotel, August 27, 1998. (248)

25 Memorandum of Interview or Activity, DIANE GAGLIANO, The Pawn Place, August 27, 1998. (249-250)

26 Memorandum of Interview or Activity, JADA AHERN, September 2, 1998. (251)

27 Memorandum of Interview or Activity, DAVE SULLIVAN, Microsoft Security, September 24, 1998. (252)

____________________________________________________________________

Exhibit List Sheet.WR Rev 10/95      Page # __6____     Department of the Treasury - Internal Revenue Service

28 Memorandum of Interview or Activity, Records of Microsoft Corporation, November 5, 1998. (253-258)

29 Memorandum of Interview or Activity, Message Involving the AP Bot, May 31, 1997. (259-261)

30 Memorandum of Interview or Activity, Forged PGP Key, September 24, 1998. (262-269)

31 Memorandum of Interview or Activity, Messages Posted to the Cypherpunks Involving CARL JOHNSON, December 10, 1998. (270-294)

32 Memorandum of Interview or Activity, Public Posting of the Son of Gomez PGP Keys, October 14, 1998. (295-305)

[Exhibits 33-44 not in this package.]

33 Memorandum of Interview or Activity, PAUL BARRINGTON, October 13, 1998. (306)

34 Memorandum of Interview or Activity, ROBERT & PAULINE MCWILLIAMS, October 14, 1998. (307-308)

35 Memorandum of Interview or Activity, JAMES CHOATE JR, October 13, 1998. (309-310)

36 Affidavit of LANCE COTTRELL,October 20, 1998. (311-321)

37 Memorandum of Interview or Activity, IGOR CHUDOV, October 23, 1998. (322-328)

38 Memorandum of Interview or Activity, CHARLES MCCRACKIN, November 10, 1998. (329-331)

39 Memorandum of Interview or Activity, WILLIAM DENNEY, November 10, 1998. (332-334)

40 Memorandum of Interview or Activity, CARL JOHNSON Letters and E-mail with DECLAN MCCULLAGH, December 4, 1998. (335-376)

____________________________________________________________________

Exhibit List Sheet.WR Rev 10/95      Page # ___7___     Department of the Treasury - Internal Revenue Service

41 Affidavit of BLANC WEBER, December 1, 1998. (377-378)

42 Affidavit of Custodian of Hospital Records, BONNIE SOUKUP, October 23, 1998. (379-388)

43 Memorandum of Interview or Activity, Criminal History Records, CARL JOHNSON, April 21, 1998. (389)

44 Form 8273, Assault, Threat, Harassment Incident Report. (390-391)

____________________________________________________________________

Exhibit List Sheet.WR Rev 10/95      Page # ___8___     Department of the Treasury - Internal Revenue Service

Subject Matter/Remarks

The following information was developed during the investigation of JAMES BELL, 7-9610-0046:

In October 1996, Internal Security initiated an investigation of BELL after it was learned that BELL had initiated Operation "LocatIRS", and was obtaining the names and home addresses of IRS employees in connection with a Portland, Oregon based Common Law Court. The investigation revealed that BELL was the author and proponent of a scheme named "Assassination Politics" (AP), which BELL had repeatedly posted and discussed on the Internet.

BELL's Assassination Politics scheme proposed that an Internet based organisation take "bets" on the deaths of Government employees. Persons wishing to see a Government employee dead could voluntarily contribute to a pool of money, which would be awarded to the correct "predictor". Once the amount of money contributed for an individual reached a high enough level, an assassin would place a "bet" on the date of that persons death, and would collect the money upon carrying out the killing. BELL proposed using the anonymous nature of the Internet, digital encryption technology, and digital money, to operate the scheme. BELL stated that if enough IRS employees were assassinated in this manner, the rest would resign and the Government would collapse.

On March 16, 1997, the IRS Vancouver, Washington office was attacked with the noxious chemical Mercaptan. BELL later confessed to using a syringe to spray the Mercaptan through the door frame of the Federal building.

On April 1, 1997, Inspectors executed a search warrant on the residence of BELL, and among other things seized BELL's computers. Inspectors discovered that stored on one of BELL's computers were numerous electronic mail (E-mail) messages, including hundreds of messages relating to the Cypherpunks Internet group, and several messages from toto@sk.sympatico.ca. Among the messages from "Toto" was a message dated March 31, 1997 (one day prior to the search warrant) which discussed Assassination Politics. Also discovered during the search were various dangerous and deadly chemicals.

BELL was arrested on May 16, 1997. On July 18, 1997, BELL pled guilty to one count of 26 USC 7212(a) Corruptly Obstructing and Impeding Employees of the IRS, and one count of 42 USC 408(a)(7)(B) Using a False Social Security Number. BELL was sentenced on December 12, 1997 to 11 months in prison.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 15  Exhibit # 2        Department of the Treasury-Internal Revenue Service

Following the April 1, 1997 search warrant, a considerable amount of attention was paid to the BELL investigation both by the media and by the Cypherpunks Internet Group. A copy of the BELL search warrant was obtained by one of the Cypherpunks and placed on an Internet Web Page.

The affiant for the BELL search warrant was listed as (Inspector) JEFFREY GORDON. The warrant itself was issued by Magistrate Judge J. KELLEY ARNOLD. Attached to the search warrant return, a computerised inventory sheet showed that the search warrant inventory was conducted by (Inspector) CINDY BROWN. The search warrant return itself listed Inspector CINDY NELSON as the person the inventory was made in the presence of.

Inspector's note: CINDY NELSON was a background investigator formerly employed out of the Seattle Internal Security office. At the time of the BELL search warrant she was no longer employed by the IRS, and her name was listed on the search warrant return in error. NELSON had no other involvement in the BELL case other than her name being inadvertently included on the search warrant return. "Inspector CINDY NELSON" was later included on an anonymous threatening message.

Attachment: E-mail Document.

[Note: This package did not include attachments. See skip in page numbers; those missing were probably were used in attachments.]

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 16  Exhibit # 2        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

As part of the investigation of JAMES BELL (case 7-9610-0046) Inspectors monitored publicly available messages involving the "Cypherpunks" Internet group. Any of the group members could send an electronic message (E-mail) to all other group members by sending the message to the group E-mail address. Each message was also stored on a "Cypherpunk Archive" Web Page, which was publicly available to any Internet user.

In a message dated June 23, 1997, an anonymous sender sent an E-mail message titled "AP Bot Results". The message identified "Dead Lucky" as an Assassination Politics Bot" and listed Magistrate Judge J. Kelley Arnold, Jeffrey Gordon, Cindy Nelson, and Cindy Brown as "Leading eCa$h candidates for dying at an opportune time to make some perennial loser "Dead Lucky".

Inspector's note: As of September 28, 1998, the E-mail message continued to be available on the Cypherpunk Archive Web Page located at http://www.inet-one.com/cypherpunks/dir.97.06.19-97.06.25/msg00307.html [Note: Active hyperlinks indicate that cited URLs were available 27 March 1999.]

Attachment: Dead Lucky message.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 20  Exhibit # 3        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

A review of the publicly available Cypherpunk Archive Internet Web Site revealed a second anonymous message, which was dated September 4, 1997. This message, referenced the Internet Web Site http://www3.sk.sympatico.ca/carljohn/AP/AP.htm.

Attachment: We Have A Winner message.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 22  Exhibit # 4        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

A review of the Internet Web Site http://www3.sk.sympatico.ca/carljohn/AP/AP.htm was conducted after an E-mail message linked it with a threatening message titled "Dead Lucky". A review of the Web Site revealed that it appeared to be an attempt to implement parts of Assassination Politics", an essay written by JAMES BELL (7-9610-0046) .

The Web Site stated "If you can correctly predict the date and time of death of others then you can win large prizes payable in untaxable, untraceable eca$h." The Web Site had data entry lines for Name of Future Deceased, Location, Predicted Date of Death, and Predicted Time of Death. The Web Page noted that the "Contest will officially begin after Posting of Rules and Announcement of Official Starting Date (Until then it is for Entertainment Purposes Only)". The site also listed "Official Judge: James Bell".

Additional review of other information on the http://www3.sk.sympatico.ca/carljohn/ [available 27 March 1999] Web Site revealed the following:

1. A copy of JAMES BELL's essay "Assassination Politics".

2 References to the Electronic mail (e-mail) address toto@sk.sympatico.ca

Research of the http://www3.sk.sympatico.ca/ Web Site revealed under the heading "Sympatico Personal Web Pages" the listing "carljohn (Larry Wayne Johnson)".

A search of postings made to the Usenet portion of the Internet was made using the publicly available search program DejaNews. Among the postings found while searching for the e-mail address toto@sk.sympatico.ca was an unrelated December 16,1996 message sent by toto@.sk.sympatico.ca. In this message toto@sk.sympatico.ca was identified as CARL JOHNSON.

Attachment Internet Documents.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 24  Exhibit # 5        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On December 9, 1997 an anonymous message was posted to the Cypherpunks Internet group with the subject listed as "Encrypted InterNet DEATH THREAT!!! / ATTN: Ninth District Court Judges / PASSWORD: sog". The message was encrypted with the publicly available software PGP (pretty good privacy), but Inspectors were able to decrypt the message using PGP and the password which was listed in the subject line.

The message contained a five page rambling statement, including the following:

I feel it is necessary to make a stand and declare that I stand ready and willing to fight to the death against anyone who takes it upon themselves to try to imprison me behind an ElectroMagnetic Curtain. This includes the Ninth District Court judges...

I will shortly provide information for any LEA which wishes to prosecute me for my coming 'physical' death threat, on how to hunt me down like the filthy dog that I am....

I will share the same DEATH THREAT!!!' with Judges Fletcher, Nelson and Bright that I have shared with the President and a host of Congressional and Senatorial representatives:

"you can fuck some of the people all of the time, and all of the people some of the time, but you are going to end up in a body bog or a pine box before you manage to fuck all of the people all of the time."

Am I going to whack you out? Maybe...

I can also be tied into Jim Bell's Worldwide Conspiracy to assassinate government authorities, through my implementation of an Assassination Bot....

attachment: Message

Inspector's note: Also attached is a December 5, 1997 Cypherpunks message which explains the Cypherpunks' interest in Judges Fletcher, Nelson, and Bright.

Subject Matter/Remarks

On December 14, 1997, two messages from "Human Gus-Peter" were posted to the Cypherpunks mailing list.

A message from "Human Gus-Peter <hg-p@dev.null" was sent with the subject "Jim Bell Revisited". The following were among the statements in the message:

The government's armed assault on Ma and Pa Bell's residence took place within hours of an email being sent to him containing a rough draft of a chapter of an InterNet published manuscript describing and lauding Bell's AP system.

...

The winter wind blows both ways

It is also easy to reach the conclusion that the AP-BOT results sent to the Oregonian and to the officials involved (via their internal email systems) played a hand in the judges 'vacation' before Bell's delayed sentencing. (Or that petty government officials involved in Bell's case were not impressed with the fact that they were becoming the source of valuable digital prizes in the AP-BOT community, without receiving the same protection as those who were behind the criminal malefeasance directed at Bell.)

A message from Human Gus-Peter toto@sk.sympatico.ca was sent with the subject "InfoWar EndGame (Part III of the True Story of the InterNet). This message included a copy of the December 9, 1997 "Encrypted InterNet DEATH THREAT!!!" message.

Inspector's note: What appeared to be the original outgoing version of the Jim Bell Revisited message was found on a computer seized from JOHNSON

Attachment: Messages

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 37  Exhibit # 7        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

Copies of the contents of three computers which formerly were in the possession of CARL JOHNSON, were obtained from RCMP Investigator STEVE FOSTER and reviewed. The computers contained an extensive amount of information referencing JOHNSON, Toto, TruthMonger, Cypherpunks, and others involved in the investigation. The following was among the information contained on the computers:

Toshiba Laptop 2.1 Gigabyte computer, seized from JOHNSON by Canadian Customs Officer BILL MITCHELL during border crossing:

5/21/97 Magic Folders (hidden files) program.

6124/97 SOG PGP message encrypted to SOG709 password, and second encryption to BELL's PGP key.

1/9/98 TruthMonger e-mail message to BILL GATES with "Will Be: DEATH THREAT !!! to Follow...", "In my last thinly veiled death threat to BadBillyC ", "stopping in at Tacoma and Portland and ringing a few AP Bells", "I suppose it is proper serial killer etiquette to provide a legitimate death threat", "which container did I put the rincin in?". (12/12/97 header date)

1/14/98 RINCIN AP anonymous message posted to Cypherpunks involving the deadly Toxin Ricin. (12/17/97 file date)

1/15/98 TruthMonger e-mail message to the President with "I'm going to count to ten...", "GunSight I've got trained on BadBillyG", "Look out of your office window. Do you see the sniper, sitting on the rooftop of Ok, just kidding ", "my thinly veiled virtual-death-threats against sundry world leaders and titans of industry..", I honestly consider myself a viable prospect as a corporate/political assassin", "stalking..(the President)..with a Stihl chainsaw" and "TRIN -- the Revolution is NOW!"

3/9/98 Outgoing Toto e-mail message to "Attila" with "Once upon a time, TruthMonger spaketh: in my last thinly veiled death threat to BadBillyC" and "if the fuckers try to put me in a pen and feed me garbage, then they are going to find out that animal diseases that kill humans are not a sickness, they are revenge."

3/14/98 TRIN "Targets" folder containing information (and some addresses) about the Federal Law Enforcement Training Center (FLETC), Bureau of Export Administration, and Treasury Department Agencies. Including a separate file with the names of the FLETC Board of Directors.

3/20/98 Outgoing Toto e-mail message to BILL GATES "I'm still planning your assassination, my support of you is only to shorten the line ahead of me" and "Blanc, Jeff, are you in position? Can you get off a clean shot?"

3/21/98 Outgoing e-mail from Toto to BLANC WEBER discussing the "I'm still planning your assassination message."

3/22/98 Outgoing Toto e-mail sent through an anonymous remailer to BILL GATES, containing an exchange between Toto and BLANC WEBER in which WEBER asks him to "leave my name out of this".

3/31/98 JOHNSON sends "CNN-Deathmonger" message to Cypherpunks, including a reference to "Weber's anger over the TruthMonger Cult of One Clan including references to her in their Death Threat!!! (s) against an unnamed billionaire from Redmond, Washington".

4/5/98 outgoing e-mail to the President (and other) including justified killing discussion.

4/5/98 automated response e-mail from the whitehouse.

Public and Secret PGP key rings

Tower Case Desktop 540-megabyte computer, seized during a search warrant by RCMP Investigator FOSTER:

4/3/97 Assassination Politics text, in Internet document format.

4/5/97 For Whom The Bell Trolls story involving JIM BELL (file date)

4/7/97 Jbell1 file containing information from the BELL search warrant affidavit.

5/9/97 Agentq~1 file containing letter from JOHNSON describing and attempting to sell his Internet stories

5/24/97 The "Dead Lucky" assassination program (ap.htm).

9/6/97 Iwarannounce (InfoWar Announced) document with message to "ALEC" discussing the "opening day of InfoWar" and discussing the PGP key distribution.

9/6/97 Proof of CoE file mentioning "CoE Identities in new venture". (CoE = Circle of Eunuchs)

9/13/97 Kc file containing e-mail purporting to be from KENT CRISPIN to the President (probably forged headers) including "do you know what happened to Jim Bell?...He made a stink so he didn't have any rights, eh?"

9/16/97 MartinGate file containing the e-mail message from TruthMailer to BILL GATES titled "!!! DEATH THREAT !!! and signed "A. Fiend" (Not CC'd to Cypherpunks).

9/16/97 InfoWar web page document containing a copy of the e-mail message from TruthMailer to BILL GATES Stied "!!! DEATH THREAT !!!".

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 91  Exhibit # 10        Department of the Treasury-Internal Revenue Service

11/4/97 E-mail from the Sympatico System Administrator to carljohn@sk.sympatico.ca instructing him not to continue using the forged return address of fred@dev.null.

11/4/97 A second e-mail exchange between Toto and the Sympatico System Administrator discussing the forced addresses.

12/10197 The "Dead Lucky" assassination program file is PGP encrypted to the toto@sk.sympatico.ca key (from file date)

12/13197 TruthMailer file containing an incoming copy of the 12/9/97 Encrypted InterNet DEATH THREAT!!!" message.

12/13/97 Outgoing E-mail message involving JIM BELL's sentence and Judge BURGESS in which Toto points ERIC CORDIAN to the "carljohn" Assassination Bot web site

12/14/97 E-mail message from Human Gus-Peter to Cypherpunks titled "Jim Bell Revisited." (Message appears in the trash.mbx but appears to be the original due to the lack of "incoming" headers) The message includes the statements:

"the Government's armed assault on Ma and pa Bell's residence took place within hours of an email being sent...lauding Bell's AP system",

"It is also easy to reach the Conclusion that the AP-BOT results sent to the Oregonian and to the Federal officials involved (via their internal email systems) played a hand in the judges 'vacation' before Bell's delayed sentencing (Or that petty government officials involved in Bell's case were not impressed with the fact that they were becoming the source of valuable digital prizes in the AP-BOT community, without receiving the same protection as those who were behind the criminal malefeasance directed at Bell.)

The corollary to this is that we are moving closer to a country where we will need to take up arms in both meatspace and cyberspace if we wish to defend our basic human rights.

12/14/97 Second e-mail message to Cypherpunks from Human Gus-Peter, containing the following:

The Sympatico AP-BOT received bets on the times of demise of even some of the lowliest government paperwork shufflers involved in Jim's case. The Netcom AP-Bot received belated bets on the times of demise of *all* of the government casualties in the OKC offensive. (Definitely a political statement...)

Jim's political statement *has* made a difference in the implementation of, and experimentation with, AP-BOTs. His persecution has made those steps both real and meaningful for the participants. There is currently an AP-BOT accessible from an Eternity Server which is serving as a test of the ability of underground InterNet activity to become widespread and remain covert and untouchable in its operation. (For each unit bet on the choice of the individual, it is *required* to generate an extra unit which is automatically used to bet on the demise of the Big Guy. This requirement is designed to take the exercise beyond the realm of being merely a 'fun game.')

Anyone who easily dismisses Jim Bell as a 'loon' is probably not in great danger of dropping their dime.

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 92  Exhibit # 10        Department of the Treasury-Internal Revenue Service

Plain and simple: Jim Bell is a political prisoner of the men, women and children who steal your money at gunpoint.

Jim Bell's human and civil rights were Violated more over vague public speech involving those who control the money spigot than were those of Terry McNichols over the violent deaths of over a hundred citizens.

God help us all if anyone ever bombs the Treasury.

Uncle Monger

12/17/97 "666" file including SSN discussion and "Threatening PRES, but he can't floor me, As long as PRZ don't backdoor me, Giving out my cleartext to the Feds." (PRZ is PGP founder PHIL R. ZIMMERMAN [sic]).

12/18/97 LMOS file involving hg-p@dev.null (hg-p = Human Gus Peter).

12/24/97 Outgoing e-mail message from Toto to Cypherpunks through an anonymous remailer and signed "TruthKidMonger", regarding "Digital Revolutionaries". Including the statements "The Revolution is Now!" and "The tools of encryption and anonymity are the weapons of the Digital Revolution."

Acer laptop 326 megabyte computer obtained by Estevan Police Sergeant DEL BLOCK from JOHNSON's nephew (nephew will not testify):

4/28/98 Message from DaveNull@hotmail.com to Cypherpunks including "I think I should go down to a local school and start randomly slaughtering children."

5/14/98 An e-mail message from Toto to BILL GATES sent through an anonymous remailer.

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 93  Exhibit # 10        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On July 1, 1998, Royal Canadian Mounted Police (RCMP) Investigator STEVE FOSTER provided electronic copies of PGP public and secret key rings, which he located on a laptop computer seized from CARL JOHNSON. An analysis was made of the December 9, 1997 "Encrypted InterNet DEATH THREAT!!! / ATTN: Ninth District Court Judges / PASSWORD: sog" message using PGP encryption software and JOHNSON's secret key ring. The following information was obtained:

The initial message had been posted to the Cypherpunks Internet mailing list, and is still available in the Cypherpunk Internet archive at http://infinity.nus.edu.sg/cypherpunks/dir.97.12.04-97.12.10/msg00356.html. [See http://www.inet-one.com/cypherpunks/dir.97.12.04-97.12.10/msg00356.html ] The entire message except for the title was fully encrypted using PGP software. Using the password "sog" (shown in the title line and the initials of Son of Gomez), the message was decrypted and included the following statement:

I will share the same 'DEATH THREAT!!!' with Judges Fletcher, Nelson and Bright that I have shared with the President and a host of Congressional and Senatorial representatives:

"You can fuck some of the people all of the time, and all of the people some of the time, but you are going to end up in a body bag or a pine box before you manage to fuck ail of the people all of the time."

Am *I* going to whack you out? Maybe...

The message also contained an encrypted PGP Signature, which was not decipherable using only the PGP software and password. When the secret key ring from JOHNSON's computer was added to the PGP software program, the program was able to decrypt the signature as "son of gomez <InfoWar@dev.null". A review of the secret key ring revealed that this signature file was one of the secret keys which was contained in the ring.

PGP software is designed to provide both the ability to encrypt messages to keep their content secret, and an authentication procedure to allow for positive verification of the sender's identity. This authentication procedure requires the sender to establish a secret key, to be used to both decode messages sent to him and to create the digital signature which authenticates messages he sends as coming from him. Normally, the creator of the secret key is the only one to possess the key, to prevent others from forging his signature or encrypting his documents. As an additional security precaution, a password is required in conjunction with the secret key.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 172  Exhibit # 11        Department of the Treasury-Internal Revenue Service

Because of this authentication function in the PGP software, it can be concluded that the creator of the "Encrypted InterNet DEATH THREAT!!!" message had access to the secret key contained on JOHNSON's computer.

Additional analysis of JOHNSON's secret key ring revealed the following as among the 27 secret keys:

Toto < toto@sk.sympatico.ca

C. J. Parker < toto@sk.sympatico.ca

TruthMailer < tm@dev.null

TruthMonger < tm@dev.null

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 173  Exhibit # 11        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

BLOCK stated the following:

He is investigating CARL JOHNSON for the attempted bombing of a courthouse in Estevan, Canada. He expects charges to be filed soon against Johnson, because he has significant evidence against him. Two individuals saw JOHNSON at the Courthouse with the container which contained the bomb.

The bomb was tightly packed into a computer case, located in a basement utility room in the Courthouse. It consisted of bottles appearing to contain gas, as well as other liquids, possibly diesel or kerosene. There were shotgun shells in some of the bottles as well as wrapped in tissue and soaked in liquid. There was also a large box of 500 matches. Another bottle contained a mixture of unidentified liquids which were having a chemical reaction. This bottle also contained a baggie with a shotgun shell in it. The bottle was destroyed by the bomb squad because of the unknown chemical reaction that was taking place, and may have been some sort of chemical igniter.

Outside of the computer case was another container of gasoline and more matches and shotgun shells. There were also several homemade bomb igniters consisting of packs of matches with cigarettes attached. These were not lit.

JOHNSON apparently planted the device on June 1, 1998, which was when the witnesses saw him with the computer case in the courthouse. On June 3, 1998 Johnson contacted his nephew by phone from the U.S. JOHNSON asked the nephew to place the current daily newspaper in the room with the device, and instructed him not to leave fingerprints on the paper. The nephew advised police of the bomb. It appears that JOHNSON wanted the newspaper left to establish an alibi, since it would show that he was in the U.S. when the paper and bomb were left.

On June 9,1998, he served another search warrant on JOHNSON's residence. He located an original "Wanted Dead or Alive" document that JOHNSON had posted to the Internet directed at the Royal Canadian Mounted Police. He also located various documents tying JOHNSON to the Internet address toto, as well as documents in which anonymous remailers were used.

BLOCK later advised that JOHNSON had formally been charged with placing an explosive device and that a warrant had been issued for JOHNSON's arrest. BLOCK provided copies of some of the handwritten documents seized from JOHNSON's residence. The following was among the documents:

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 176  Exhibit # 12        Department of the Treasury-Internal Revenue Service

1. "BbillyG fled country from Virtual Threat to get whacked with a MeatSpace Pie."

2. "The C.J. Parker Hate Page by C.J. Parker" which included the statement "We intend to begin on 19 April an unrestricted subliminal InfoWar Fair." (A similar C.J. Parker Hate Page was posted to Cypherpunks and contained the misspelling "Terroroist", which also appeared in the possible threat to Washington State Legislator KAREN SCHMIDT).

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 177  Exhibit # 12        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

A June 8, 1998 anonymous message was posted to the Cypherpunks Internet group. The message contained similarities to previous messages known to have been posted by CARL JOHNSON, and contained details about a bombing in Canada in which JOHNSON has been charged. In the message, it is stated that the bomber "placed the bomb before embarking on a middle-leg of the TruthMonger SoftTarget Tour of Planet Terra." (TruthMonger is a known alias for JOHNSON). The message also referenced an RCMP plan to "drive a known madman crazy enough to finally put him away turned bad, and resulted in a backlash of death and destruction..."

Attachment: Message

Inspector's note: During the 8/18/98 search incident to arrest of JOHNSON, Inspector's seized a computer disk containing the opening paragraphs of this message.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 181  Exhibit # 13        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

A review of the Internet Web Site http://bureau42.base.org/public/xenix/xenbody.html was conducted after it was noted that this web site was referenced in the signature line of an E-mail message recovered from JAMES BELL's computer, which had been sent by "toto". "toto" is an alias known to be used by CARL JOHNSON.

The Internet site contained a 53 page essay titled lathe Xenix Chainsaw Massacre" by "Son of Gomez" (Son of Gomez is also believed to be an alias used by JOHNSON). The rambling essay contained what appeared to be an autobiographical story involving JOHNSON, and some of the information mentioned could be directly correlated with known information about JOHNSON. The following was contained in the essay:

"In the end, it turned out they took offence to a small incident in Killeen, Texas, where I was charged with pulling a knife on five armed police officers. I thought it was a fair fight, but I guess they know my history and thought I should have waited for more police officers to arrive before making any trouble, just to make it even on both sides. I explained to Ms. Hooters that I got the charges reduced to a misdemeanor by threatening the judge's life, but that didn't seem to cut much ice with her."

Inspector's note: NCIC records revealed that JOHNSON was arrested on 1/16/80 in Killean [sic], Texas and charged with resisting arrest. He was sentenced to one year probation and a $350 fine.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 184  Exhibit # 14        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

MCCULLAGH was contacted regarding information he may have involving CARL JOHNSON. MUCCULLAGH stated the following:

He is a reporter for Time Inc., and covered the JIM BELL case. He also occasionally participates in the Cypherpunks Internet group. On June 8, 1998 he received four separate anonymous e-mail messages. The messages were all encrypted and contained the following:

Declan,

You might want to notify the RCMP that there are bombs in two public buildings 11 kilometers from Mongeritaville, home of the Bienfait Nutly News. Then again, you might not...

A. Fiend

On June 10, 1998 he received the following anonymous e-mail message:

Wednesday, June 10, 1998 -18:55:07 MET

Declan,

Have you recently received any mail from Montana containing floppy disks and audio tapes? If so, could you confirm this with an email to Jim Choate?

Thanks

He sent an e-mail to CHOATE in response, and CHOATE denied knowledge of the e-mail message.

Inspector's note: Canadian police advised Internal Security that JOHNSON had recently been in Montana. JOHNSON is known to use the alias "MONGER", and lived in Bienfait, Canada.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 185  Exhibit # 15        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

Beginning in June 1998 a large number of messages were posted to the Cypherpunks list from the Internet account "Linda Reed--PCC West Campus CSC<lreed@west.cscwc.pima.edu". Based on the content and style of these messages, they appeared to be written by CARL EDWARD JOHNSON. A review of these messages revealed the following among the information they contained:

6/17/98 Discusses mailing disks to DECLAN MCCULLAGH and a "second" device planted in Canada.

6/20198 Discusses JAMES BELL and disrupting the Seattle court computer system

7/20/98 Discusses his "virtualnuclear Diskette Bomb Soft Target World Tour", and details of the Canadian Courthouse bomb incident.

7/25/98 Discusses using "biochemical agents" in terrorist type attacks.

7/27/98 Discusses wanting to take revenge against the RCMP, and also states a belief that James Bell was "setup" and "railroaded". The following was also contained in this message:

Unless one is prepared to actually take action to prevent the abuse of authority, and to hold those responsible for high-handed, unethical and illegal actions against the Citizens, then the process of 'discussion' on these issues is mere Philosophical Masturbation.

The rEvolution is NOW!

All that really needs to be said, is "BOOM!"

Inspector's note: JOHNSON admitted to the Secret Service that he was sending messages using REED's account.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 186  Exhibit # 16        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On August 13, 1998 a message was posted to the Cypherpunks Internet group from toto@fhouse.org titled Deaf Cons 5.9. This message was similar in style and substance to other messages posted by CARL EDWARD JOHNSON. It was noted that the message discussed an apparent incident at the Plaza Hotel in Las Vegas in which the author of the message was thrown out of the hotel for making a bomb threat.

Attachment: Message

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 199  Exhibit # 18        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On August 18, 1998 Inspectors located JOHNSON's vehicle, a 1986 mazda pickup truck, license #AAF746 parked in front of The Rialto bar in Tucson, Arizona. A person matching the description and 1995 booking photo of JOHNSON was also observed in the vicinity of the vehicle. Inspectors established surveillance on the suspect and vehicle and requested assistance from the Tucson Police Department. Prior to the arrival of Tucson Police, Inspectors observed the suspect enter the vehicle and sit in the driver's seat. Inspectors placed the suspect in custody and conducted a Search Incident to Arrest (SIA) of both the suspect's person and the passenger compartment of the vehicle.

During the SIA of the suspect's person the following were among the documents discovered in the suspect's wallet:

Arizona Drivers License A00983536, CARL EDWARD JOHNSON, 05/06/49

Canada Certificate of Citizenship, CARL EDWARD JOHNSON, 05/06/49

Saskatchewan Drivers License, CARL E JOHNSON, May 6, 1949

Saskatchewan Health Service card, CARL EDWARD JOHNSON, 05/49

Saskatchewan Vehicle Registration, 86 Mazda Pickup MF746, CARL E JOHNSON

Saskatchewan Summons (Ticket) dated July 11, 1997, CARL JOHNSON, 05/06/49

North Dakota Toyota Vehicle Registration, CARL EDWARD JOHNSON, issued 5/15/95

Picture Identification (home made) in the name of C.J. PARKER

Dog Vaccination Certificate, owner C.J. PARKER, Bienfait.

Post-it notes containing the statement "Read + Evaluate Novels Re: Making it plain that am not contemplating or advocating physical meatspace violence against the President."

1/14/98 Prescription for CARL JOHNSON

8/15/98 Kino Hospital Slip, C.J. PARKER, 5/06/49.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 201  Exhibit # 19        Department of the Treasury-Internal Revenue Service

Business Card, LINDA LOU REED

Business Card, JEREMY SHERIDAN, U.S. Secret Service

8/3/98 The Pawn Place Receipt, CARL EDWARD JOHNSON, SSN:608-33-5345

8/4/98 The Pawn Place Receipt, CARL EDWARD JOHNSON, SSN:608-33-5345

Other items seized during the SIA of JOHNSON's person included:

"LINDA LOU" T-shirt worn by JOHNSON

Dog Tag in the name of CARL D JOHNSON

The following were among the items seized during the SIA of the vehicle cab:

Nine computer diskettes. Of these, two were wrapped separately in duplicate e-mail message printouts dated 3/29/98 titled "Diskette Bombs - DANGER - Educational Use Only". Another of the nine computer disks was labeled "Sony Screen Saver 119 cpunx.zip=truthchapter BNN.TXT=Nutly News"

Geoscope 30X (telescope/microscope?)

The Little Drummer Girl paperback (underlined references to bombs)

Envelope addresses to C.J. PARKER, Saskatchewan, Canada.

Various electronic mail messages addressed to SOG, including:

7/31/98 nsa backroom strongarming

8/1/98 Did you really write PGP (involves Secret Service visit) signed "Your Pal and CoConspirator, Toto"

8/5/98 Jim Bell Latest

8/7/98 RE: The Pigs Are Getting Bolder

8/7/98 NSA / CIA internet monitoring

Printout of PIMA!.TXT, "Pima Communist College - SPACE ALIENS HIDE MY DRUGS!!!"

Various handwritten documents, including the statements:

"RSA/LEA Challenge, Encrypted File telling where buried innocent children" (RSA is computer encryption software, LEA is Law Enforcement Agents/Agencies.)

"Cypherpunks Action Project, College Credits in Anarchy"

"Bell shares in secret conspiracy against Cypherpunks list"

"Great American Hero/Monster sign for Hometown of T MCV" (TIMOTHY MCVEIGH)

"Seattle A recovered stolen ca... of people with criminal records not rectified in computer as to provide probable cause"

"Terrorist@collusion.org"

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 202  Exhibit # 19        Department of the Treasury-Internal Revenue Service

"The Warriors Wisdom" notebook, including the following handwritten statements:

"Knowledge Database, TOTO Structure"

"Gil, can't get lawyer for $ settlement because Indian won't get much."

"List. Glasses, Locking Briefcase for stuff (court). Computer, Tobacco Pouch. Garbage Bags"

"U.S. Court Stuff. Big head/eyed Chihuahuas bred for disease/$"

"Tim, TOTO Promotion"

Book "The Business of Spying" (Estevan library).

Various documents relating to the Las Vegas DEFCON (computer hacker) convention. Several of the listed seminars were circled, including "John Q. Newman, Author of - How not to be located when on the run."

During the course of the vehicle SIA, Inspectors noted two additional computer disks in plain view in the bed of the pickup truck. These disks were also seized.

After being taken into custody, JOHNSON was advised of his rights from IRS Document 5280. When asked if he understood his rights JOHNSON stated "no", and the questioning was terminated.

While awaiting booking at the Federal Correctional Facility, JOHNSON spit into the eye of Inspector MASON.

Attachments: Documents

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 203  Exhibit # 19        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

The 11 computer disks seized from JOHNSON were provided to Computer Investigative Specialist J. RABATIN for examination and duplication. The disks had been seized during the search incident to arrest (SIA) of CARL JOHNSON, and a search warrant was obtained to examine the contents. A review of the electronic files obtained by RABATIN revealed the following:

Disk 1:

This disk contained numerous files containing graphic photos as well as two photos of bomb components. These were "linked" to a document titled TRIN-1 (The Revolution is Now) dated 3/25/98. Another file titled "Thanks" discussed a "TRIN plan" for April 19.

Disk 2:

This disk was in partially damaged condition. Among the files were several labeled "Cpunks" or "Cpunx". A file titled bnn.txt and dated 5/29/98, contained the opening paragraphs of the 6/8/98 "Breaking News" message which was anonymously posted to the Cypherpunks group.

Disk 3:

This CD-ROM disk contained music and did not contain computer files.

Disk 4: (5" disk from truck bed)

This disk contained various SAHMD (Space Aliens Hide My Drugs) files, the only dated file has the date July 28, 1997. In SAHMD6 the author discusses living in Bienfait and that he has "incorporated" his residence and named it "Mongeritaville". The message also references the "Nutly News" and "Defcon McCullagh Chainsaw" (all of which relate to the anonymous bomb messages sent to DECLAN MCCULLAGH). Five of the seventeen files were named using "SOG" as the file extension (SOG = Son of Gomez).

Disk 5: (5" disk from truck bed)

This disk contained duplicate copies of the SAHMD messages found on disk 4, with some files showing dates of July 1997. Seven of the twenty two files were named using "SOG" as the file extension.

Disk 6:

This disk appears to contain Warez (pirated commercial software) files (we are having trouble reading the disk).

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 216  Exhibit # 20        Department of the Treasury-Internal Revenue Service

Disk 7:

This disk appears to be a duplicate of Disk 1.

Disk 8:

This disk contained commercially produced utility files.

Disk 9:

This disk contained a file titled "TERROR.PLN", dated 5/30/98. The only contents of the file were the words "FUCK YOU ! ! !" There was also a file titled "The Rastafa.txt", dated 4/9/98. This file contained a discussion of the RCMP's computer seizure and the RCMP hate page, JIM BELL, Truthmonger, Cypherpunks and other events relating to JOHNSON.

The disk also contained multiple copies of PGP secret and public keys. These keys were virtually identical to those found on the laptop seized from JOHNSON by Canadian Customs, with the difference being that a few keys had been added. The only new secret key added was "Last Canadian Outlaw lco@dev.null", created on 4/9/98.

The keys on this disk contained both the secret and public portions of the "son of gomez InfoWar@dev.null" key, and tests using PGP revealed that this key also successfully decrypted and authenticated the December 9, 1997 "Threat" message. The "son of gomez Infowar@dev.null" key contained an identical PGP "fingerprint" when compared to the key found on the Canadian Customs seized laptop, proving that the keys are duplicates of the same origin.

A separate Public key file contained on the disk contained a copy of the public key of DECLAN MCCULLAGH (which was used to encrypt the June 8, 1998 bomb messages sent to MCCULLAGH. This public key was not present on JOHNSON's computer seized by Canadian Customs, indicating that JOHNSON acquired the key at a later date. The fact that MCCULLAGH's key was contained in a separate file and also was not on JOHNSON's computer is consistent with the theory that JOHNSON obtained the key specifically to send the encrypted bomb messages to MCCULLAGH).

Disk 10:

This disk contained commercially produced utility files.

Disk 11:

This disk contained commercially produced utility files.

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 217  Exhibit # 20        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

REED was contacted regarding her association with CARL EDWARD JOHNSON. REED stated the following:

She knows CARL JOHNSON as CJ. JOHNSON has stayed at her residence in the past but she has not seen him for a few weeks. The lreed@west.cscwc.pima.edu Internet account is hers. JOHNSON used this account unbeknownst to her. The Space Aliens Hide My Drugs messages were written by JOHNSON. JOHNSON is a writer but harmless. She does not know his current whereabouts, but he may be staying in his vehicle or with friends. She does not know the name of the friends, other than possibly "Bob".

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 242  Exhibit # 21        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

REED was re-interviewed and stated the following:

She was aware that CARL JOHNSON had been arrested, because a friend of hers had seen the arrest and had contacted her.

JOHNSON had never mentioned to her anything about planting a bomb in a courthouse in Canada. He had discussed being angry with the RCMP over them seizing his computer, and had discussed the RCMP having abused someone's rights in Canada.

She first met JOHNSON about 10 years ago. She was a volunteer with Tucson radio station KXCI, and JOHNSON was a musician who played guitar and wrote songs. The station played his music and she met him when he came by the station. She knew him as C.J. PARKER, and at that time he was known as "The King of Country Porn" music. In the past they would hang out and go drinking together when he was in Tucson, although she no longer drinks. JOHNSON has always been a renegade, and when he was younger he had undergone electro-shock therapy.

JOHNSON was in Tucson for a few weeks in March of 1998. During this time he helped her install and configure a modem on her home computer. As part of setting up the modem she gave him the password to her Internet account at Pima Community College. She was an instructor at the College during the spring semester. This was her only Internet account, but she did not use it after the end of May, 1998, which was when the semester had ended.

She first became aware that JOHNSON was using the account when the Secret Service interviewed JOHNSON at her residence (on 7/27/98). That night JOHNSON admitted to her that he had been using the account and her computer to post messages to the Internet. JOHNSON was a "night owl", and she believes that he was using the computer at night while she slept. After the Secret Service interview she checked her computer and determined that there were no computer files from JOHNSON on it.

The day after the Secret Service interview she contacted Pima College and learned that they were investigating the account due to a complaint. Pima terminated the account, and did not renew her contract to teach. She believes that her contract was not renewed due to JOHNSON's use of her account.

Upon being shown a copy of the first page of the June 20, 1998 Bienfait Reptilian News - SPACE ALIENS HIDE MY DRUGS!!!" message, she stated that she did not write this message and that JOHNSON did. JOHNSON told her within the last month that "Space Aliens Hide My Drugs" was the name of a novel he was writing.

Based on her conversations with JOHNSON, she was also aware that he used the name "TRUTHMONGER" in his writings, to identify himself as someone who exposed the truth. She was also aware that "TOTO" was a nickname he used. She thought this nickname had something to do with the movie Wizard of Oz, and she was aware that JOHNSON and his brother LARRY were involved in something called "Red Shoes" which may have also related to the movie.

She had received e-mail correspondence from JOHNSON were [sic] he used the e-mail account toto@sympatico.com. She was not specifically aware of him using the account toto@.fhouse.org but she had recently received a phone message from the Fun House company, which might be related. She was aware that Son of Gomez was a name which appeared in one of JOHNSON's stories. She was not familiar with the names Human Gus Peter or Bianca. She was not familiar with JOHNSON's web site or"Dead Lucky".

JOHNSON recently ran out of his medication, and he drinks alcohol a lot. He had been staying with her at her residence in Tucson since around the end of June, 1998, but she made him leave after she found out about his use of her Internet account. She has never seen JOHNSON harm anyone, but she has seen him lose patience, throw things, and use profanity.

JOHNSON has mentioned to her the Cypherpunks group and indicated that they like his writings.

At the request of Inspectors, REED wrote the following statement on a copy of the June 20, 1998 "Bienfait Reptilian News - SPACE ALIENS HIDE MY DRUGS!!!" message:

"I did not write this CJ did, using my account + computer. Linda Reed"

Attachment: Message with statement.

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 244  Exhibit # 22        Department of the Treasury-Internal Revenue Service

[Has handwritten notation: "I did not write this CJ did, using my account & computer. Linda Reed]

Bienfait Reptilian News - SPACE ALIENS HIDE M...   Page 1 of 6

Bienfait Reptilian News - SPACE ALIENS HIDE MY DRUGS!!!

• To: cypherpunks@toad.com
• Subject: Bienfait Reptilian News - SPACE ALIENS HIDE MY DRUGS!!!
• From: Linda Reed--PCC West Campus CSC <lreed@west.cscwc.pima.edu>
• Date: Sat, 20 Jun 1998 12:14:30 MST
• Sender: owner-cypherpunks@Algebra.COM

RIP/BNN - SPACE ALIENS HIDE M DRUGS!!!
_______________________________________

Bienfait Nutly News--Desert Storm / Texas Tornado Special:
[BNN-Tucson, Arizona--THE 'FOUR CORNERS' SEARCH FOR A PAIR OF
Certified CopKillers took a bizarre twist today, when it was
learned that the Author of SPACE ALIENS HIDE M DRUGS was
apparently serving merely as a diversionary decoy for LEA's
involved in the search, while an unknown compatriot was busy
either providing clandestine supply support for the pair, or
perhaps even arranging transportation for the suspects to a
safehouse located outside of the search area.
  Under cross-examination by a variety of LEA/Spooks, the 
RCMP involved in setting up the Author on a variety of charges
under the Criminal Code Of Canada admitted that they had been
holding back evidence suggesting that the Author was not acting
alone in his TRIN VirtualNuclear Diskette Bomb Soft Target
World Tour. Newspapers dated after the Author's flight to
semi-safety south of the forty-ninth parallel were found at
the scene of the first VirtualNuclear Device discovered by
the Royal Canadian Mounted Police at the Court House eleven
KILLometers from MongerItaVille, home of the Bienfait Nutly
News, where the Author was scheduled to be railroaded into
serving a four-year sentence for 'Failure To Appear' on the
'Dog At Large' charges trumped up by local Bienfait officials
under RCMP direction.

  "There were two different sets of newspapers dated after
the Author's flight from Canada found at the scene of the
First VirtualNuclear Device." an RCMP official foolishly
revealed to the Flying Spook assigned by the US Air Force
to investigate the Author, never considering that the agent
may have been 'turned' by the Circle of Eunuchs into a
secret ally. "We traced the placement of one of the sets
of newspapers to the Author's nephew, Human Gus-Peter, who
had been promised a new state-of-the-art computer in return
for helping to obstrufucate the details behind the placement
of the TRIN VNDB Device. The second set of newpapers, from
an earlier date, were obviously placed by an unknown entity,
working in collusion with the Author from the beginning."

  The Flying Spook, in his first action as the new editor-

http://infinity.nus.edu/sg/cypherpunks/dir.98.06.15-98.06.21/msg00143.html

[See http://www.inet-one.com/cypherpunks/dir.98.06.15-98.06.21/msg00143.html ]

Page 245 Exhibit 22

Subject Matter/Remarks

MCCLEOD was contacted regarding Social Security Numbers (SSN) used by CARL EDWARD JOHNSON. After checking the Social Security Administration computer system, MCCLEOD stated the following:

The SSN: 456-45-0297 is assigned to CARL JOHNSON. The last name PARKER is also listed on this account.

The SSN: 608-33-5345 has not been issued and is not assigned to JOHNSON.

MCCLEOD provided a copy of his report to Inspectors.

Attachment: Report.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 246  Exhibit # 23        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

STATZ was interviewed after Inspectors discovered an Internet message in which CARL JOHNSON described being thrown out of the Plaza Hotel during the "DEF-CON" computer hacker convention (held 7/31/98 - 8/2/98) for making a bomb threat. STATZ stated the following:

During the recent convention of computer users he responded to a report of a suspicious package in the Triple Crown room, in the convention area of the hotel. He contacted an unidentified person who was attending the convention. The person said he observed a male (later identified as CARL JOHNSON) wrap a computer disk in a paper and place it on the table. The unidentified person stated that he asked JOHNSON what he was doing, and JOHNSON replied "I have seen bombs packaged like that before."

STATZ contacted JOHNSON and escorted him from the hotel. The package was later opened and determined to contain a computer disk, which they threw away. At the time of the incident, he did not obtain identification from any of the persons involved, and no report was taken. No video of the incident is available.

STATZ was shown a copy of a 1995 RCMP booking photo of JOHNSON. STATZ identified JOHNSON as the person involved in the incident.

Inspector's note: During the 8/18/98 search incident to arrest of JOHNSON, Inspectors discovered several documents from the DEF-CON convention. Inspectors also discovered two computer diskettes each of which were which were wrapped separately in copies of a computer printout describing "Diskette Bombs".

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 248  Exhibit # 24        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

GAGLIANO was contacted after Inspectors discovered two pawn shop receipts in the possession of CARL JOHNSON which contained false Social Security Numbers. GAGLIANO provided copies to Inspectors of the original documents in the possession of The Pawn Place which show JOHNSON's signatures.

Attachment: Documents.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 249  Exhibit # 25        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

AHERN was interviewed regarding messages sent from the electronic mail (E-mail) account toto@fhouse.org. AHERN stated the following:

She is the owner/operator of a small Internet Service Provider (ISP) known as Fhouse. Persons wishing to establish an e-mail account log on through a bulletin board system and sign up for an account, giving their name, address, phone number, and date of birth. She then confirms the phone number given to ensure it is accurate and turns on the service.

After reviewing her records, she noted three accounts relating to C.J. PARKER. These accounts were in the names Toto, SOG, and Son of Gomez. The address given was 1800 W. Magee, Tucson, AZ, with a phone number of (520) 544-0401. The date of birth given was June 5, 1949. This information was given through the use of computers, and there were never any written applications.

She recalled that she called the phone number given and personally spoke with C.J. PARKER to confirm the number. There was nothing else unusual or memorable about the call. PARKER was supposed to send in a $10.00 payment but never did.

As of September 2, 1998 PARKER's e-mail account was receiving a high volume of e-mail primarily from two accounts, Attila@hun.org and Gomez0@pacbell.net.

Inspector's note: C.J. PARKER is a known alias of CARL JOHNSON.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 251  Exhibit # 26        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

Microsoft Security was contacted after it was noted that several messages to the Cypherpunks group from aliases used by CARL JOHNSON contained threatening statements involving Microsoft and/or its Chairman, BILL GATES. After reviewing the security files, SULLIVAN stated the following:

He located two security reports of threatening electronic messages received involving aliases used by JOHNSON. The messages had been received from "Truthmailer" and "Truthmonger". He located the security reports but he was unsure if Microsoft had kept complete copies of the original messages.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 252  Exhibit # 27        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

Records relating to threatening messages received by the Microsoft Corporation were obtained through the use of a Federal Grand Jury Subpoena. The records revealed that the following e-mail messages had been received by Microsoft:

On September 16, 1997 a message from TruthMailer tm@dev.null was sent to BILL GATES. The subject of the message was "!!! DEATH THREAT !!!". The message stated that the author had sent a death threat message and had forged BILL GATES' signature on it. The message was signed "A. Fiend"

On March 20, 1998 a message from toto@sk.sympatico.ca was sent to billg@microsoft.com. The message included the statement "I'm still planning your assassination.."

Attachments Documents

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 253  Exhibit # 28        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On September 5, 1998, Cypherpunk ADAM BACK posted a message to the Cypherpunks list in which he stated that he had researched his archives of Cypherpunks messages and located a link to the web site which contained the Assassination Politics Bot. BACK included a copy of a May 31, 1997 message from "DeathMonger".

A check of the Cypherpunks archives located on the Internet at http://www.inet-one.com/cypherpunks located a copy of the message titled Re:The Bible Code.

Attachment: Messages.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 259  Exhibit # 29        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On December 9, 1997, an encrypted anonymous threatening message was posted to the Internet "Cypherpunks" group. The message contained a PGP encrypted digital signature. Inspectors were able to directly link this signature to a digital PGP "key" found on CARL JOHNSON's laptop computer (and later on a disk in his possession). This information was included on a Complaint filed against JOHNSON on August 5, 1998. JOHNSON was arrested on August 18, 1998.

On September 1, 1998 CARL JOHNSON's sister, ALIA JOHNSON, posted a message to the Cypherpunks list in which she stated:

"My brother, Carl E. Johnson aka C.J.Parker aka toto has asked me to let you know that he is in prison in Florence, Arizona near Tucson under federal charges of threatening the life of a federal officer... "

On September 8, 1998 Cypherpunk JOHN YOUNG posted a copy of the Complaint against JOHNSON on the Internet.

A variety of messages were then posted to the Cypherpunks list discussing the possibility that"Toto" may have distributed or posted multiple copies of his PGP keys, thus raising the possibility that the key's existence on CARL JOHNSON's computer was not irrefutable evidence that he was the author of the threatening message.

An effort was made by the Cypherpunks to locate both secret and public keys relating to JOHNSON. Although some keys were located and posted (or reposted) to the list, none were the "son of gomez InfoWar@dev.null" public or secret key that authenticated the threatening message.

On September 18, 1998, Cypherpunk JOHN YOUNG posted the following message to the Cypherpunk group:

This allegedly is forwarded from CJ, though from an unknown Source so think twice:

Thu. Sep 09 1998

part of a communication received via the anonymous route:

"In the meantime, I hope that anyone who has possession of the PGP Secret Keys for Toto, TruthMonger, Son of Gomez,

Magic Circle, etc., feels free to use them to digitally sign messages to the CyperPunks Disturbed Male LISP.

"Passwords: sog, sog709, sog709cejCJP,sog709cjpCEJ, D'Shauneaux, D'shauneaux, and others..."

A comparison of the given passwords to the secret key files found on JOHNSON's computer revealed that the passwords were authentic and could be used to encrypt or decrypt messages using JOHNSON's keys. It was specifically noted that password "sog709cejCJP" was the authentic password for the "toto toto@sk.sympatico.ca" secret key and was also the authentic password for the "son of gomez InfoWar@dev.null" secret key. The "toto" account was the primary Internet account used by JOHNSON, while the "son of gomez" key was used in the threatening message. It was also noted that password "sog709" was the authentic password for the "truthmonger tm@dev.null" secret key.

On September 19, 1998, Cypherpunk ADAM BACK posted a message titled "CHALLENGE? Toto/signature attack w. unpublished public key". BACK proposed creating a fake public key which could be used to create a false PGP authentication of the December 9, 1998 threatening message. BACK discussed the technical aspects of making such an "attack".

On September 22, 1998, an anonymous message was posted to the Cypherpunks group titled "CHALLENGE response". The message contained a Public key named "Toto, too?". This public key contained the same "Key ID", 0x2541C535, as the "son of gomez InfoWar@dev.null" public and secret key found on JOHNSON's computer. A test of this public key against the digital signature on the December 9, 1997 encrypted threat message revealed that the PGP software (mistakenly) authenticated the message as having been written by "Toto, too?". It was noted that although the Key ID was the same, this key contained a different "PGP fingerprint" from the "son of gomez" key.

The PGP User's Guide was reviewed for information regarding Digital Signatures. The following statements were located:

PGP uses digital signatures to provide message authentication...The recipient (or anyone else) can verify the digital signature by using the sender's public key to decrypt it..This proves that the sender was the true originator of the message..because the sender alone posses [sic] the private key that made that signature. Forgery of a signed message is not feasible, and the sender cannot later disavow his signature...

The message digest algorithm used by older versions of PGP is the MD5 Message Digest Algorithm... In 1996, MD5 was all but broken by Hans Dobbertin, a German cryptographer. While MD5 was not completely broken at that time, it was discovered to have such serious weaknesses that no one should keep using it to generate signatures. Further work in this area might completely break it, thus allowing signatures to be forged.

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 263  Exhibit # 30        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

The following is a listing of some of the messages posted to the Cypherpunks internet Mailing List involving CARL JOHNSON. Messages which are not shown elsewhere in the report are attached to this exhibit.

5/21/97 "The Bell Plan" message is posted to Cypherpunks by Toto (per PGP signature) "I cannot in good conscious allow Jim Bell's persecution...to pass by without taking personal action to support him."

5/23/97 The complaint against JIM BELL is posted to the Internet and announced on Cypherpunks.

5/31/97 A reference is made to the Assassination Politics Bot web site in a message to Cypherpunks from "DeathMonger" (Exhibit 29)

6/23/97 Anonymous "Dead Lucky" message is posted to Cypherpunks list, naming a Magistrate Judge and Inspectors. The message is posted using the "lucifer" anonymous remailer (Exhibit 3)

7/18/97 BELL pleads guilty, a copy of the press release is e-mailed to Cypherpunks and Toto by IRS.

7/29/97 Message from "TruthMonger" to the Cypherpunks list involving JIM BELL, containing the statement "Did you know that when he arrested, there were no Assassination Bot's in existence, and that there are now at least six prototypes currently in operation?"

9/4/97 Second message involving Dead Lucky posted to Cypherpunks, referencing the Assassination Politics Bot at the CARLJOHN web page. (Exhibit 4)

9/16/97 "!!! DEATH THREAT !!!" message sent to BILL GATES from truthmailer tm@dev.null. The message is signed "A. Fiend". (Exhibits10, 27, 28)

9/16/97 Forged KENT CRISPIN e-mail to the President, mentioning BELL (Exhibit 10)

9/24/97 Copy of a "!!! DEATH THREAT !!!" message sent to Senator KENNEDY from hc@dev.null is posted to Cypherpunks, including "..fucked their friend..for making a stink with the IRS".

9/24/97 Copy of a "!!! DEATH THREAT !!!" message sent to Senator DIANE FEINSTEIN from hc@dev.null is posted to Cypherpunks.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 270  Exhibit # 31        Department of the Treasury-Internal Revenue Service

xx/28/97 A.B. Terroroist at@dev.null sends a potentially threatening e-mail message to legislator KAREN SCHMIDT, with a copy to the Cypherpunks. (Exhibit 9)

12/9/97 "Encrypted InterNet DEATH THREAT!!! / ATTN: Ninth District Court Judges / PASSWORD: sog" message is posted to Cypherpunks, from "hc@dev.null". (exhibit 10, 11)

12/9/97 The toto@sk.sympatico.ca account password is publicly posted to the Usenet (password is changed the next day by Sympatico).

12/14/97 Toto posts InfoWar document to the Cypherpunks, which included a copy of the "Encrypted InterNet DEATH THREAT!!! / ATTN: Ninth District Court Judges". (exhibit 10, 11 )

12/14/97 Message from "Human Gus-Peter hg-p@dev.null" discussing the "AP-BOT results" and their effect on the Judge and government officials involved in the BELL case. (Exhibit 10)

12/14/97 Second message from "Human Gus-Peter hg-p@dev.null" discussing BELL and the AP-BOT " (Exhibit 10)

12/24/97 Outgoing e-mail message from Toto to Cypherpunks discussing "Digital Revolutionaries" and stating "The Revolution is Now!". (Exhibit 10)

1/9/98 E-mail from TruthMonger to Bill Gates and Cypherpunks titled "Will Be: DEATH THREAT !!! to Follow..." and mentioning "In my last thinly veiled death threat to BadBillyC...". Also "stopping in at Tacoma and Portland and ringing a few AP Bells". Contains misspelled word "RINCIN". (Exhibit 10, 27, 28)

1/14/98 "RINCIN AP" (misspelled) anonymously posted to Cypherpunks. (Exhibit 10)

1/15/98 E-mail from TruthMonger to the President and Cypherpunks titled "I'm going to count to ten ", mentions a "GunSight I've got trained on BadBillyG". Also "look out of your office window. Do you see the sniper, sitting on the rooftop of....OK, just kidding". "I honestly consider myself a viable prospect as a corporate/political assassin" (Exhibit 10)

3/22/98 Message from Toto to the Cypherpunks "I send weekly death threats to Bill Gates..."

3/25/98 "Potential Bill Gates Assassins Union" message sent to Cypherpunks.

3/31/98 JOHNSON sends "CNN-Deathmonger" message to Cypherpunks, including a reference to "Weber's anger over the TruthMonger Cult of One Clan including references to her in their Death Threat!!! (s) against an unnamed billionaire from Redmond, Washington". (Exhibit 10)

4/11/98 Message to Cypherpunks from sonofgomez@hotmail.com includes "Question of the Week: How many dead bodies does it take to spell: "I TOLD YOU I WAS CRAZY!!!"

4/14/98 Toto posts "The Official C.J. Parker Hate Page" to Cypherpunks, containing the misspelled word "terroroist". The post also identifies "C.J. Parker (aka - Toto, TruthMonger #0, #1, #709)".

4/19/98 "Wanted / Dead or Alive" message posted to Cypherpunks.

xx/28/98 Message from DaveNull@hotmail.com to Cypherpunks including "I think I should go down to a local school and start randomly slaughtering children." (Exhibit 10)

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 271  Exhibit # 31        Department of the Treasury-Internal Revenue Service

6/8/98 Bienfait Nutly News message posted to Cypherpunks discussing the Estevan bomb. (Exhibit 13)

6/17/98 A message posted to Cypherpunks from the LINDA REED account discusses mailing disks to MCCULLAGH and a "second" device in Canada. (Exhibit 16)

6/20/98 A LINDA REED BNN message to Cypherpunks discusses a "virtualnuclear Diskette Bomb Soft Target World Tour" and specifics of the Canadian Courthouse bomb incident. (Exhibit 16)

7/20/98 A LINDA REED message to Cypherpunks discusses JAMES BELL and disrupting the Seattle court computer system. (Exhibit 16)

7/25/98 A LINDA REED message to Cypherpunks discusses using "biochemical agents" in terrorist type attacks. Includes misspelled word "Rincin". (Exhibit 16)

7/27/98 A LINDA REED message to Cypherpunks discusses JIM BELL and states "The rEvolution is NOW! All that really needs to be said, is "BOOM!" (Exhibit 16)

7/31/98 Anonymous message to Cypherpunks describes JOHNSON's interview with the Secret Service.

8/1/98 E-mail from toto@fhouse.org to Cypherpunks containing "PRZ, Some guys from the Secret Service came to see me about the Death Threats I've been sending you." (Exhibit 19)

8/13/98 Message to Cypherpunks from toto@fhouse.org discussing his being thrown out of the Plaza Hotel for making a bomb threat. (Exhibit 18)

Attachments: Messages

____________________________________________________________________

Form 8052.WR Rev 09/95       Page # 272  Exhibit # 31        Department of the Treasury-Internal Revenue Service

Subject Matter/Remarks

On October 13, 1998, an anonymous message was sent to the Cypherpunks internet mailing list titled "ATTN: Blacknet, sog's keys 4 sale". The message offered to sell the "son of gomez" PGP key. The message contained an encrypted PGP message which the message stated was the "son of gomez" key, and the message claimed to be from "Toto".

On October 14, 1998, a message was posted to the Cypherpunks list from ADAM BACK. BACK explained that he had decrypted the PGP information contained in the October 13, 1998 message using a previously posted "Blacknet" PGP key. BACK provided a copy of the decrypted message, which began "ATTN: Jeff Gordon". The message contained the "son of gomez" public and private keys, as well as what was claimed to be the password of CARL JOHNSON's Sympatico Internet account. The message stated "I sent much of my outgoing mail through CJ's system because he had so many hackers and system intruders that he was a oneman 'Crowds' unit." The message claimed to be from "Toto".

An analysis of the posted secret key revealed that it contained an identical "PGP Fingerprint" to the "son of gomez" PGP keys that were found on JOHNSON's laptop computer and on a computer disk in his possession. This verifies that the key posted on the Cypherpunks list was an authentic copy of JOHNSON's "son of gomez" PGP key, and can be used to encrypt/decrypt "son of gomez" messages and create "authentic" digital signatures.

____________________________________________________________________ Form 8052.WR Rev 10/95       Page # 295  Exhibit # 32        Department of the Treasury-Internal Revenue Service

[End of package]