|
Cryptome DVDs. Donate
$25 for two DVDs of the Cryptome collection of 47,000 files from June 1996
to January 2009 (~6.9 GB). Click Paypal or mail check/MO made out to John
Young, 251 West 89th Street, New York, NY 10024. The collection includes
all files of cryptome.org, cryptome.info, jya.com, cartome.org,
eyeball-series.org and iraq-kill-maim.org, and
23,100 (updated)
pages of counter-intelligence dossiers declassified by the US Army Information
and Security Command, dating from 1945 to 1985.The DVDs will be sent anywhere
worldwide without extra cost. |
|
31 August 1997
Source: Hardcopy from Greg Broiles
(www.parrhesia.com)
FILED
AUG 25 1997
RICHARD W. WIEKING
CLERK, U.S. DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
MICHAEL J. YAMAGUCHI
United States Attorney
JOEL R. LEVIN
Chief, Criminal Division
GEORGE D. HARDY
Assistant United States Attorney
450 Golden Gate Avenue
San Francisco, CA 94102
Telephone: (415) 436-6851
Attorneys for Plaintiff
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
UNITED STATES OF AMERICA, ) Criminal No. 97-00197 - VRW
)
Plaintiff, ) GOVERNMENT'S MOTION TO
) PARTIALLY SEAL RECORD
v. ) OF GUILTY PLEA
)
CARLOS FELIPE SALGADO, JR. )
)
Defendant. )
______________________________)
COMES NOW the United States of America, by and through
counsel of record, Michael J. Yamaguchi, United States Attorney,
and George D. Hardy, Assistant U.S. Attorney, and hereby files this
motion to partially seal the record of the Rule 11, Federal Rules
of Criminal Procedure, hearing on August 25, 1997, during which
defendant CARLOS FELIPE SALGADO, JR. entered guilty pleas to Counts
One, Two, Four, and Five of the indictment pending against him.
This motion is being made for the purpose of protecting the
identity of the victims of the defendant's criminal conduct, and is
based on the attached declaration of counsel.
[1]
DATED: August 25, 1997 Respectfully submitted,
MICHAEL J. YAMAGUCHI
United States Attorney
[Signature]
GEORGE D. HARDY
Assistant U.S. Attorney
[2]
DECLARATION OF GEORGE D. HARDY
I, GEORGE D. HARDY, do declare and say:
l. I am an Assistant U.S. Attorney in the Northern District
of California, and have been assigned to prosecute the case of
United States v. Carlos Felipe Salgado, Jr.
2. I was present on August 25, 1997, before the Honorable
Vaughn R. Walker, when defendant Salgado entered guilty pleas to
Counts One, Two, Four, and Five of the indictment pending against
him.
3. During the defendant's colloquy with the Court regarding
the factual basis for the guilty pleas to Counts One and Two, the
defendant specifically identified two victims of his criminal
conduct by name. Later in the colloquy there was an additional
reference to the names of the victims.
4. I have been advised by the Federal Bureau of
Investigation that the public release of the identity of the two
victims could cause serious financial and security difficulties for
the victims. Until now, the victims have been identified only to
the defense, as part of the criminal discovery in the case.
5. The difficulties facing these victims include the
probability that additional hackers will seek to challenge these
computer systems, once the defendant's successful efforts are
revealed; and the loss of business due to the perception by others
that computer systems may be vulnerable.
6. I have also been advised by the Federal Bureau of
[1]
Investigation that companies victimized by computer intruders are
quite reluctant to come forward and report illegal intrusions,
fearing that the revelations could have an impact on their business
operations that might overshadow the specific damage inflicted by
the intruder on their systems. Such an environment provides a
perfect medium in which computer hackers flourish.
7. Until the date of the guilty pleas, the identities of
these victims have been protected, consistent with the policy of
encouraging victims to come forward. The victims realize that had
the case proceeded to trial, their identities would have been
revealed. However, because the case did not proceed to trial;
there seems to be no good reason to reveal the information now; and
several very good reasons not to reveal it.
8. The defendant's counsel was contacted regarding this
motion. She expressed a willingness to agree to it, but only if
the government agreed to limit in some way the government's
appropriate public release of the defendant's guilty pleas as a
deterrent to others. Such an arrangement was not acceptable to
the government. Defendant's counsel therefore indicated that she
would like to file an opposition to this motion; but would agree
that pending the resolution of this issue, that the identities of
the victims could be protected.
I declare the foregoing to be true and correct to the best of my
knowledge and belief.
DATED: August 25, 1997 [Signature]
GEORGE D. HARDY
[2]
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
UNITED STATES OF AMERICA, ) Criminal No. 97-00197 - VRW
)
Plaintiff, )
)
)
)
) O R D E R
CARLOS FELIPE SALGADO, JR. )
)
Defendant. )
______________________________)
Considering the foregoing motion and declaration of counsel,
IT IS ORDERED that the portion of the proceedings before this Court
on August 25, 1997, during which defendant Carlos Felipe Salgado,
Jr., identified the victims of his criminal conduct, is hereby
sealed until further order of the Court.
DATED: [Blank] [Blank]
THE HONORABLE VAUGHN R. WALKER
UNITED STATES DISTRICT COURT JUDGE
FILED
JUN 23 1 23 PM '97
RICHARD W. WIEKING
CLERK
U.S. DISTRICT COURT
NO. DIST. OF CA.
MICHAEL J. YAMAGUCHI
United States Attorney
Attorney for Plaintiff
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
UNITED STATES OF AMERICA, ) CRIMINAL NO. CR97 00197 VRW
)
Plaintiff, ) VIOLATIONS: Title 18, United
) States Code, Section 1030(a)(4)
v. ) - UNAUTHORIZED ACCESS OF
) COMPUTER IN FURTHERANCE OF
) FRAUD; Title 18, United States
CARL0S FELIPE SALGADO, JR., ) Code Section 1030(a)(5)(B) -
) UNAUTHORIZED ACCESS OF COMPUTER
Defendant. ) CAUSING DAMAGE; United States
) Code, Section 1029(a)(2) -
) TRAFFICKING IN STOLEN CREDIT
) CARD NUMBERS; Title 18, United
) States Code, Section 1029(a)(3)
) - POSSESSING MORE THAN FIFTEEN
) STOLEN CREDIT CARD NUMBERS
) WITH INTENT TO DEFRAUD
)
) [San Francisco Venue]
______________________________)
I N D I C T M E N T
COUNT ONE
(18 U.S.C. S1030(a)(4) - Unauthorized Access Of
Computer In Furtherance Of Fraud)
The Grand Jury charges that:
In or about March, 1997, from the City of Daly City, County
of San Mateo, State and Northern District of California,
1
CARLOS FELIPE SALGADO, Jr.,
defendant herein, did knowingly and with intent to defraud, access
a protected computer, which was used in interstate and foreign
commerce and communication, without authorization, and by means of
such conduct, did further the intended fraud and obtain credit card
numbers with a combined credit limit in excess of one billion
dollars; in violation of Title 18, United States Code, Section
1030(a)(4).
COUNT TWO
(18 U.S.C. S1030(a)(4) - Unauthorized Access Of
Computer In Furtherance Of Fraud)
The Grand Jury further charges that:
On or about May 4, 1997, from the City of Daly City, County of
San Mateo, State and Northern District of California,
CARLOS FELIPE SALGADO, JR.,
defendant herein, did knowingly and with intent to defraud, access
a protected computer, which was used in interstate and foreign
commerce and communication, without authorization, and by means of
such conduct, did further the intended fraud and obtain credit card
numbers with a combined credit limit in excess of one million
dollars; in violation of Title 18, United States Code, Section
1030(a)(4).
//
//
//
2
COUNT THREE
(18 U.S.C. S1030(a)(5)(B) - Unauthorized Access of
Computer Causing Damage)
The Grand Jury further charges that:
On or about March 28, 1997, from the City of Daly City, County
or san Mateo, State and Northern District of California,
CARLOS FELIPE SALGADO, JR.,
defendant herein, did intentionally access a protected computer,
affecting interstate and foreign commerce and communication,
without authorization, and as a result of such conduct, recklessly
caused damage; in violation of Title 18, United States Code,
Section 1030(a)(5)(B).
COUNT FOUR
18 U.S.C. S1029(a)(2) - Trafficking In Stolen
Credit Card Numbers)
The Grand Jury further charges that:
Between on or about May 7, 1997, and on or about May 14, 1997,
and during a one year period, in the City and County of San
Francisco, State and Northern District of California, and
elsewhere,
CARLOS FELIPE SALGADO, JR.,
defendant herein, did knowingly and with intent to defraud traffic
in unauthorized access devices, that is, stolen credit card
numbers, and by such conduct did affect interstate commerce and did
obtain something of value aggregating in excess of one thousand
3
dollars; in violation of Title 18, United States Code, Section
1029(a)(2).
COUNT FIVE
(18 U.S.C. S 1029(a)(3) - Possessing Fifteen Or More
Stolen Credit Card Numbers With Intent to Defraud)
The Grand Jury further charges that:
On or about May 21, 1997, at the San Francisco International
Airport, and elsewhere within the State and Northern District of
California,
CARLOS FELIPE SALGADO, JR.,
defendant herein, did knowingly and with intent to defraud, possess
more than fifteen access devices, that is, approximately 100,000
credit card numbers, which were unauthorized and stolen, and by
such conduct did affect interstate commerce; in violation of Title
18, United States Code, Section 1029(a)(3).
DATED: [Blank] A TRUE BILL.
[Signature]
FOREPERSON
[Signature]
MICHAEL J. YAMAGUCHI
United States Attorney
(Approved as to Form) [Initials]
AUSA Hardy
4
FILED
MAY 22 11 08 AM '97
RICHARD W. WEIKING
CLERK
DISTRICT COURT
NO. DIST. OF CA.
[Form]
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
ORDER SETTING CONDITIONS OF
RELEASE AND APPEARANCE BOND
DATE: 5-22-97
CASE NUMBER: 13-97-302570?
NAME OF DEFENDANT: CARLOS FELIPE SALGADO, JR.
ADDRESS OF DEFENDANT: 99 EVERGREEN AVE. DALY CITY, [Illegible]
TELEPHONE NUMBER: (415) 334-779?
[Snip blanks]
AMOUNT OF BOND: $100,000
[X] UNSECURED PR
[Snip blanks]
TIME AND DATE OF NEXT APPEARANCE: 9:30 6-11-97
COURTROOM 17
CONDITIONS OF RELEASE AND APPEARANCE
Defendant is subject to each condition checked:
X Defendant shall appear at all proceedings as ordered by the Court and
shall surrender for service of any sentence imposed.
X Defendant shall not commit any federal, state, or local crime.
X Defendant shall not harass, threaten, intimidate, injure, tamper
with, or retaliate against any witness, victim, informant, juror, or
officer of the Court, or obstruct any criminal investigation. See
18 U.S.C. 1503, 1510, 1512, and 1513, on reverse side.
X Defendant shall not travel outside the Northern District of California,
that is, these counties: Alameda, Contra Costa Del Norte, Humboldt,
Lake Marin, Mendocino, Monterey, Napa, San Benito, San Francisco,
San Mateo, Santa Clara, Santa Cruz. and Sonoma. See map on reverse
side.
X Defendant shall report in person. immediately upon release, and
as directed and by telephone every [blank] by 4:00 P.M. to the U.S.
Pretrial Office in [blank]. See addresses and telephone numbers on
reverse side.
[Snip blanks]
X The following conditions also apply:
1) Whatever computer equipment is in parent's house shall be removed
within 24 hours.
2) No access to computer terminals.
3) Premises and person shall be subject to search and seizure by PTS
as deemed necessary
4) Deft shall reside with parents.
CONSEQUENCES OF DEFENDANT'S FAILURE TO OBEY CONDITIONS OF RELEASE
Payment of the full amount of this bond shall be due forthwith, and all
cash or property posted to secure it shall be forfeited. Judgment may
be entered and executed against defendant and all sureties jointly and
severally.
An arrest warrant for defendant shall issue immediately, and defendant
may be detained without bail for the rest of the proceeding.
Defendant shall be subject to consecutive sentences and fines for
failure to appear and/or for committing an offense while on release.
See 18 U.S.c. 3146 and 3147, on reverse side.
We, the undersigned, have read and understand the terms of this bond
and acknowledge that we are bound by it until duly exonerated.
SIGNATURE OF DEFENDANT SIGNATURE OF SURETY
[Signature] [Signature]
SIGNATURE OF MAGISTRATE
[Signature]
FILED
MAY 22 1997
RICHARD W. WIEKING
CLERK, U.S. DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
[Form]
United States District Court
NORTHERN DISTRICT OF CALIFORNIA
UNITED STATES OF AMERICA
V.
CARLOS FELIPE SALGADO, JR. CRIMINAL COMPLAINT
CASE NUMBER: 3.97-30257 OEW
I, the undersigned complainant being duly sworn state the following
is true and correct to the best of my knowledge and belief.
SEE ATTACHMENT A
in violation of Title 18 United States Code.
Section(s) 1029(a)(2) (trafficing in stolen
credit card numbers)
1030(a) (4) (unauthorized access of computer)
I further state that I am a(n) FBI Special Agent and that this
complaint is based on the following facts:
SEE ATTACHMENT B
COUNT ONE COUNT TWO
PENALTY: 10 years in custody PENALTY: 5 years in custody
S250,000 fine, $250,000 fine
3 years supervised release 3 years supervised release
$100 penalty assessment $100 penalty assessment
APPROVED: [Initials]
AUSA Hardy
PROCESS: N/A
Continued on the attached sheet and made a part hereof: [X] Yes
[Signature]
Signature of Complainant
CALLEN D. DALRYMPLE
Special Agent
Federal Bureau of Investigation
Sworn to before me and subscribed in my presence,
Date 5-22-97 at San Francisco CA
[Signature]
Owen E. Woodruff, Jr.
United States Magistrate Judge
ATTACHMENT A
COUNT ONE
Between on or about May 2, 1997, and May 21, 1997, within the State and Northern
District of California, defendant CARLOS FELIPE SALGADO, JR., aka "Smak",
did knowingly, and with intent to defraud, traffic in unauthorized access
devices affecting interstate commerce, to wit, over 100,000 stolen credit
card numbers, and by such conduct did obtain in excess of $1000; in violation
of Title 18, United States Code, Section 1029(a)(2).
COUNT TWO
On or about March 28, 1997, within the State and Northern District of California,
defendant CARLOS FELIPE SALGADO, JR., aka "Smak", did knowingly, and with
intent to defraud, access a protected computer affecting interstate commerce
without authorization, and by means of such conduct, did further the intended
fraud and did obtain something of value, to wit, valid credit card numbers;
in violation of Title 18, United States Code, Section 1030(a)(4).
ATTACHMENT B
AFFIDAVIT IN SUPPORT OF COMPLAINT
| UNITED STATES OF AMERICA |
) |
|
|
) |
SS. |
| NORTHERN DISTRICT OF CALIFORNIA
|
) |
|
I, CALLEN D. DALRYMPLE, Special Agent, Federal Bureau of Investigation,
United States Department of Justice, having been duly sworn, do depose and
state as follows:
INTRODUCTION
1. I am a Special Agent of the Federal Bureau of Investigation (FBi), United
States Department of Justice, and have been so employed for approximately
five and one-half years. I was assigned to the FBI's San Diego Division from
January 1992 through December of 1995. I was transferred to the FBI's San
Francisco Division and assigned to a newly-created Computer Intrusion Threat
Assessment (CITA) Squad in January of 1996. During my career as an FBI Special
Agent, I have primarily been assigned to investigate " white collar crime"
matters, including various types of fraudulent activity in violation of the
laws of the United States. I have conducted investigations or participated
in investigations into violations of Title 18, United States Code, Section
371 (Conspiracy); Title 18, United States Code, Section 1029 (Fraud and Related
Activity in Connection With Access Devices); Title 18, United States Code,
Section 1030 (Fraud and Related Activity in Connection With Computers); Title
18, United States Code, Section 1343 (Fraud By Wire), Title 18 United States
Code, Sections 1956 and 1957 (Money Laundering), Title 18 United States Code,
Section 2314 (Interstate
1
Transportation of Stolen Property), and Title 18, United States Code, Section
2511 (Unauthorized Interception and Disclosure of Wire, Oral or Electronic
Communications). Before becoming an FBI Special Agent, I received a Bachelor
of Science degree in Accounting and a Master of Business Administration degree
in Financial Planning, which includes the study of Computer Systems. During
my tenure as an FBI agent, I have gained experience conducting computer fraud
and abuse investigations which included investigations into the unauthorized
access of telephone company computer systems, unauthorized access and use
of cellular telephones, and the unauthorized access of consumer credit reporting
agencies. I have also gained experience in methods of investigating computer
fraud and abuse. These investigative methods include surveillance techniques,
pen registers CDD, electronic monitoring, undercover recordings,
conduct of interviews and interrogations related to computer crimes and the
use of confidential informants. I and/or the other agents involved in this
investigation have used all of these investigative techniques during this
investigation. I have also received classroom and practical instruction,
pertaining to computer fraud and abuse, from both the FBI and private sources,
such as the University of California at San Diego Supercomputer Center.
STATEMENT OF FACTS
2. An internet service provider (ISP) is a company that sells access to the
Internet for a fee. The owner of an ISP, on March 31, 1997, notified the
FBI of the following:
While performing routine maintenance on the Internet servers on Friday, March
28, 1997, technicians discovered that the servers had been broken into by
an intruder. Investigation by technicians revealed a "packet sniffer" installed
on the system. The packet sniffer program was being used to capture user
ID's and passwords of
2
authorized users. The technicians then discovered that the intruder was still
logged onto the system. As the technicians backed-up affected files, the
intruder was deleting files and covering his/her tracks on the server. To
stop the attack, the server was removed from the Internet connection and
the technicians built another server to replace the hacked server.
As the intrusion was occurring, a customer (hereafter CW) notified the owner
of the ISP that he was also on the server during the incident. CW explained
that he had engaged the perpetrator in an Internet Relay Chat (IRC) conversation.
During this conversation, the intruder wrote that he had broken into the
ISP's server and bragged about how easy it was to compromise the server.
The intruder wrote that he had removed all of the credit card numbers from
one of the sites on the server and offered to sell the credit card numbers
to the CW. The intruder also offered a total of 60,000 credit card numbers
that he had hacked from other sources.
Based on information provided by the CW and computer log files, the ISP's
technicians logged onto the Internet using another domain ID and tried to
contact the intruder. The intruder's terminal was idle. The technicians traced
the intruder's ID back to a user account and port address at the University
of California at San Francisco. The traced address matched the user ID and
address of the person to whom the CW had chatted with via IRC.
3. Thereafter, the CW began working with the FBI in an undercover capacity.
3
Under the direction of the FBI, the CW made contact with the intruder to
determine if the intruder was still intent on selling the stolen ("hacked")
credit card numbers. Contact was made originally via IRC (as described above).
Subsequently, the CW and the intruder (who called himself "Smak") began to
communicate using encrypted electronic mail. Beginning on May 2, 1997, and
continuing to May 21, 1997, "Smak" and the CW exchanged over 50 e-mail messages.
"Smak" 's messages to the CW were received at an FBI-controlled address in
San Jose, California. Each of the communications was recorded and maintained
as evidence.
4. "Smak" quickly made it clear that he had the ability to hack into computers
and extract valid credit numbers which he would offer for sale. On May 4,
1997, "Smak" 's e-mail message read in part:
"There may be a delay in our business together of a day or so. It's not
necessarily a bad thing. Let met explain. This morning i[sic] was reading
a business magazine article about online transactions on the internet and
a particular niche in services. A couple companies were mentioned that generated
SEVERAL MILLION dollars in CC [credit card] transactions a week! I decided
to go exploring and got into their sites. The article was right! However,
i[sic] need to explore the sites for a a [sic] little while to establish
firm control and locate machine extractable data. I think it is worth it.
--Smak"
5. Negotiations between the CW (acting at the direction of the FBI) and "Smak"
continued toward the goal of a large purchase of "hacked" credit card numbers.
"Smak" had already represented that he had available 60,000 credit card numbers
(see above). The negotiations quickly led to a sale of 710 credit card numbers
for $710. This was intended as
4
a sample of the larger group of credit cards available for sale. The numbers
were delivered to the CW as an attachment to an encrypted e-mail message.
Fifteen numbers were chosen at random for verification. The numbers were
determined to be valid credit card numbers issued by financial institutions
with credit limits between $5000 and $12,000. "Smak" was paid by use of a
Western Union transfer to offices in the San Francisco Bay Area. For
identification purposes, "Smak" described himself as looking "Latin", with
"black hair, tan-dark skin, black eyes, no visible birthmarks, beard, mustache,
about 5'5", and heavy".
6. At the direction of the FBI, the CW continued to communicate with "Smak"
using e-mail. Negotiations led to the delivery, once again by encrypted e-mail
from "Smak", of 580 credit card numbers at $5 apiece, on May 13, 1997. A
small sample of the cards purchased were researched with the issuing bank
and found to be valid. The purchase limits on the cards ranged from $2000
to $25,000. In payment for these credit card numbers, two Western Union transfers
of $1450 each were made to San Francisco Area Western Union offices for the
benefit of "Smak", utilizing code names and general descriptions. On May
15, 1997, "Smak" indicated in an encrypted e-mail message that he had picked
up the two payments.
7. The negotiations between the CW and "Smak" culminated with the agreement
to meet at the San Francisco International Airport on May 21, 1997, at 11:15
a.m. to exchange a large number of stolen credit card numbers for approximately
$260,000. On that day, the CW, under the direction and control of the FBI,
met "Smak" at the appointed hour and place. "Smak" delivered an encrypted
CD containing over 100,000 stolen credit card numbers. After the validity
of the credit card information was confirmed through decryption of the data
on the
5
CD, "Smak" was taken into custody by the FBI.
8. After being advised of his constitutional rights, "Smak" agreed to waive
those rights and speak to the FBI. He then identified himself as CARLOS FELIPE
SALGADO, JR., a 36-year old resident of Daly City. He also acknowledged that
he had "hacked" into various computers and stolen all of the credit card
numbers delivered to the CW on the prior occasions, as well as the credit
card numbers in his possession at the time of arrest. In particular, he
acknowledged that on March 28, 1997, he "hacked" into the server of the San
Diego ISP referenced above in paragraph 2 and thereby obtained credit card
information with intent to defraud.
[Signature]
CALLEN D. DALRYMPLE
Special Agent
Federal Bureau of Investigation
Sworn to before me this 22nd day of May, 1997.
[Signature]
UNITED STATES MAGISTRATE JUDGE
NORTHERN DISTRICT OF CALIFORNIA
6
[End]
Digitized and hypertexted by JYA/Urban
Deadline