--------------------------------------------------- THE CHICAGO INDICMENT OF TWO LEGION OF DOOM MEMBERS --------------------------------------------------- UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION ) UNITED STATES OF AMERICA ) ) v. ) No. ) Violations: Title 18, United ROBERT J. RIGGS, also known ) States Code, Sections as Robert Johnson, also ) 1030(a)(6)(A) and 2314 known as Prophet, and ) CRAIG NEIDORF, also known ) as Knight Lightning ) COUNT ONE The SPECIAL APRIL 1987 GRAND JURY charges: PROPERTY INVOLVED 1. At all times relevant herein, enhanced 911 (E911) was the national computerized telephone service program for handling emergency calls to the police, fire, ambulance and emergency services in most municipalities in the United States. Dialing 911 provided the public immediate access to a municipality's Public Safety Answering Point (PSAP) through the use of computerized all routing. The E911 system also automatically provided the recipient of an emergency call with the telephone number and location identification of the emergency caller. 2. At all times relevant herein, the Bell South Telephone Company and its subsidiaries ("Bell South") provided telephone services in the nine state area including Alabama, Mississippi, Georgia, Tennessee, Kentucky, Lousiana [sic, North Carolina, South Carolina and Florida. 3. At all times relevant herein, the E911 system of Bell South was described in the text of a computerized file program known as the Bell South Standard Practice 660-225-104SV Control Office - 1 - Administration of Enhanced 911 Services for Special and Major Account Centers date March, 1988 ("E911 Practice"). The E911 Practice was a highly proprietary and closely held computerized text file belonging to the Bell South Telephone Company and stored on the company's AIMSX computer in Atlanta, Georgia. The E911 Practice described the computerized control and maintainence [sic of the E911 system and carried warning notices that it was not to be disclosed outside Bell South or any of its subsidiaries except under written agreement. COMPUTER HACKERS 4. At all times relevant herein, computer hackers were individuals involved with the unauthorized access of computer systems by various means. 5. At all times relevant herein, the Legion of Doom (LOD) was a closely knit group of computer hackers involved in: a. Disrupting telecommunications by entering computerized telephone switches and changing the routing on the circuits of the computerized switches. b. Stealing proprietary computer source code and information from companies and individuals that owned the code and information. c. Stealing and modifying credit information on individuals maintained in credit bureau computers. - 2 - d. Fraudulently obtaining money and property from companies by altering the computerized information used by the companies. e. Disseminating information with respect to their methods of attacking computers to other computer hackers in an effort to avoid the focus of law enforcement agencies and telecommunication security experts. 6. At all times relevant herein ROBERT J. RIGGS, defendant herein, was a member of the LOD. 7. At all times relevant herein CRAIG NEIDORF, defendant herein, was a publisher and editor of a computer hacker newletter [sic known as "PHRACK." 8. At all times relevant herein, a public access computer bulletin board system (BBS) was located in Lockport, Illinois which provided computer storage space and electronic mail services to its users. The Lockport BBS was also used by computer hackers as a location for exchanging and developing software tools for computer intrusion, and for receiving and distributing hacker tutorials and other information. E-MAIL 9. At all times relevant herein electronic mail (e-mail) was a computerized method for sending communications and files between individual computers on various computer networks. Persons who sent or received e-mail were identified by an e-mail address, similar to a postal address. Although a person may have more than - 3 - one e-mail address, each e-mail address identified a person uniquely. The message header of an e-mail message identified both the sender and recipient of the e-mail message and the date the was [sic message sent. 10. Beginning in or about September, 1988, the exact date begin unknown to the Grand Jury, and continuing until the return date of this indictment, at Lockport, in the Northern District of Illinois, Eastern Division, and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, defendants herein, together with others known and unknown to the Grand Jury, devised and intended to devise and participated in a scheme and artifice to defraud and to obtain money and other things of value by means of false and fraudulent pretenses and representations, well knowing at the time that such pretenses, representations and promises were false when made. OBJECT OF FRAUD SCHEME 11. The object of the fraud scheme was to steal the E911 Practice text file from the computers of Bell South Telephone Company though [sic the use of false and fraudulent pretenses and representations and to conceal all indications that the text file had been stolen; and to thereafter publish the information about the E911 Practice text file in a hacker publication for dissemination. - 4 - OPERATION OF FRAUD SCHEME 12. It was part of the fraud scheme that the defendant NEIDORF would and did advise the defendant RIGGS that he had assembled a group of computer hackers for the purpose of distributing computer information. 13. It was further part of the scheme that the defendant RIGGS would and did steal sensitive proprietary Bell South information files including the E911 Practice text file by gaining remote unauthorized access to computers of the Bell South Telephone Company. 14. It was further part of the scheme that the defendant RIGGS would and did disguise and conceal the theft of the E911 Practice text file from Bell South Telephone Company by removing all indications of his unauthorized access into Bell South computers and by using account codes of legitimate Bell South users to disguise his authorized use of the Bell South computer. 15. It was further part of the scheme that RIGGS would and did transfer in interstate commerce a stolen E911 Practice text file from Atlanta, Georgia to Lockport, Illinois through the use of an interstate computer data network. 16. It was further part of the scheme that defendant RIGGS would and did store the stolen E911 Practice text file on a computer bulletin board system in Lockport, Illinois. 17. It was further part of the scheme that defendant NEIDORF, utilizing a computer at the University of Missouri in Columbia, Missouri would and did receive a copy of the stolen E911 text file - 5 - from defendant RIGGS through the Lockport computer bulletin board system through the use of an interstate computer data network. 18. It was further part of the scheme that defendant NEIDORF would and did edit and retype the E911 Practice text file at the request of the defendant RIGGS in order to conceal the source of the E911 Practice text file and to prepare it for publication in a computer hacker newsletter. 19. It was further part of the scheme that defendant NEIDORF would and did transfer the stolen E911 Practice text file through the use of an interstate computer bulletin board system used by defendant RIGGS in Lockport, Illinois. 20. It was further part of the scheme that the defendants RIGGS and NEIDORF would publish information to other computer hackers which could be used to gain unauthorized access to emergency 911 computer systems in the United States and thereby disrupt or halt 911 service in portions of the United States. 22. It was further a part of the scheme that the defendants would and did misrepresent, conceal, and hide, and cause to be misrepresented, concealed and hidden the purposes of ane [sic the acts done in furtherance of the fraud scheme, and would and did use coded language and other means to avoid detection and apprehension - 6 - by law enforcement authorities and to otherwise provide security to the members of the fraud scheme. 23. In or about December, 1988, at Lockport, in the Northern District of Illinois, Eastern Division, and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, defendant herein, for the purpose of executing the aforesaid scheme, did knowingly transmit and cause to be transmitted by means of a wire communication in interstate commerce certain signs, signals and sounds, namely: a data transfer of a E911 Practice text file from Decatur, Georgia to Lockport, Illinois. In violation of Title 18, United States Code, Section 1343. - 7 - COUNT TWO The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count One of this Indictment as though fully set forth herein. 2. On or about January 23, 1989, at Lockport, in the Northern District of Illinois, Eastern Division and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, the defendants herein, for the purposes of executing the aforesaid scheme did knowingly transmit and cause to be transmitted by means of a wire communication in interstate commerce certain signs, signals and sounds, namely: a data transfer of a E911 Practice text file from Decatur, Georgia to Lockport, Illinois, an edited and retyped E911 Practice text file from Columbia, Missouri, to Lockport, Illinois. In violation of Title 18, United States Code, Section 1343. - 8 - COUNT THREE The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count One of this indictment as though fully set forth herein. 2. In or about December, 1988, at Lockport, in the Northern District of Illinois, Easter Division, and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, defendants herein, did transport and cause to be transported in interstate commerce from Decatur, Georgia, to Lockport, Illinois, a computerized text file with a value of $5,000 or more, namely: A Bell South Standard Practice (BSP) 660-225-104SV- Control Office Administration of Enhanced 911 Services for Special Services and Major Account Centers dated March, 1988; valued at approximately $79,449.00 the defendants then and there knowing the same to have been stolen, converted, and taken by fraud; In violation of Title 18, United States Code, Section 2314. - 9 - COUNT FOUR The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count one of this Indictment as though fully set forth herein. 2. On or about January 23, 1989, at Lockport, in the Northern District of Illinois, Eastern Division, and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, defendants herein, did transport and cause to be transported in interstate commerce from Columbia, Missouri, to Lockport, Illinois, a computerized textfile with a value of $5,000 or more, namely: An edited Bell South Standard Practice (BSP) 660-225- 104SV- Control Office Administration of Enhanced 911 Services for Special Services and Major Account Centers dated March, 1988; valued at approximately $79,449.00. the defendants, then and there knowing the same to have been stolen, converted, and taken by fraud; In violation of Title 18, United States Code, Section 2314. - 10 - COUNT FIVE The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count One of this Indictment as though fully set forth herein. 2. On or about December, 1988, at Lockport, in the Northern District of Illinois, Eastern Division and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, the defendants herein, knowingly and with intent to defraud, trafficked in information through which a computer may be accessed without authorization and by such conduct affected interstate commerce; In violation of Title 18, United States Code, Section 1030(a)(6)(A). - 11 - COUNT SIX The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count One of this Indictment as though fully set forth herein. 2. In or about January, 1989, at Lockport, in the Northern District of Illinois, Eastern Division and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, the defendants herein, knowingly and with intend to defraud, trafficked in information through which a computer may be accessed without authorization and by such conduct affected interstate commerce; In violation of Title 18, United States Code, Section 1030(a)(6)(A). - 12 - COUNT SEVEN The SPECIAL APRIL 1987 GRAND JURY further charges: 1. The Grand Jury realleges and incorporates by reference the allegations of paragraphs 1 through 22 of Count One of this Indictment as though fully set forth herein. 2. In or about February, 1989, at Lockport, in the Northern District of Illinois, Eastern Division and elsewhere, ROBERT J. RIGGS, also known as Robert Johnson, also known as Prophet, and CRAIG NEIDORF, also known as Knight Lightning, the defendants herein, knowingly and with intent to defraud, trafficked in information through which a computer may be accessed without authorization and by such conduct affected interstate commerce; In violation of Title 18, United States Code, Section 1030(a)(6)(A). A TRUE BILL: F O R E P E R S O N UNITED STATES ATTORNEY - 13 - ------------------------------------------------------------------------- This press release was attacthed to the indictment. We reprint it here to present the federal side of the case. It originally appeared in PIRATE Magazine. We have checked the text against the original for accuracy. ------------------------------------------------------------------------- INFORMATION RELEASE FROM: U.S. Department of Justice DATE: February 6, 1990 IRA H. RAPHAELSON, United States Attorney for the Northern District of Illinois, and PATRICK T. McDONNELL, Special Agent In Charge of the United States Secret Service in Chicago, today announced the indictment of Robert J. Riggs, 20, of %address deleted%, and Craig M. Neidorf, 19 %address deleted%, on charges that between December, 1988 and February, 1989 they entered into a scheme to steal and publish to other hackers highly proprietary and sensitive information about the operation of Bell South's Enhanced 911 emergency communication system. The seven count indictment charges Riggs and Neidorf with Interstate Transportation of Stolen Property, Wire Fraud and Violations of the Computer Fraud and Abuse Act of 1986. Specifically, the indictment charges that Riggs, also known as "Robert Johnson" and "The Prophet", stole a copy of Bell South's highly proprietary and closely held computer program that controlled and maintained the E911 system. Bell South's E911 system controls emergency calls to the police, fire, ambulance and emergency services in municipalities of the nine state region served by Bell South; Alabama, Mississippi, Georgia, Tennessee, Kentucky, Louisiana, North Carolina, South Carolina, and Florida. The indictment alleges that in December 1988 Riggs stole the E911 data valued at $79,449.00 by using a computer outside the telephone company to call into the telephone company computer in which the computer file was stored. The indictment charges that Riggs then transferred the E911 data to a computer bulleting board in Lockport, Illinois from which Neidorf, also known as "Knight Lightning", down loaded it for publication in a computer hacker publication known as "PHRACK." The indictment charges that Riggs was a member of a closely knit group of computer hackers known as the Legion of Doom whose members are involved in numerous illegal activities including: *Disrupting telephone service by entering the telephone companies switches (which are computers) and changing the routing of telephone calls. *Stealing computer data from individuals and companies. *Stealing and modifying individual credit histories. *Fraudulently obtaining money and property from companies by altering information in their computers. *Disseminating information about attacking computers to other computer hackers in an effort to shift the focus of law enforcement agencies to those other hackers and away from the Legion of Doom. The indictment charges that as part of their fraud scheme Riggs and Neidorf disclosed the stolen information %reportedly PHRACK #24-eds.% about the operation of the enhanced 911 system to other computer hackers so that they could unlawfully access the E911 system and potentially disrupt or halt other 911 service in the United States. If convicted on all counts of the indictment Riggs faces a maximum possible prison sentence of 32 years and a maximum possible fine of $222,000.00; and Neidorf faces a maximum possible prison sentence of 31 years and a maximum possible fine $122,000.000. In announcing the return of the indictment, Mr. Raphaelson noted that the allegations of the indictment have far reaching implications for the health and welfare of individuals in the United States who rely on their telephones as a lifeline to the outside world. Mr. Raphaelson stated, "People who invade our telecommunications and related computer systems for profit or personal amusement create immediate and serious consequences for the public at large. No one should be made to suffer loss of life or severe injury as a result of hackers who have compromised emergency networks. The telecommunications industry and law enforcement community have become attentive to these crimes and those who choose to use their intelligence and talent to disrupt these vital networks will find themselves vigorously prosecuted." Raphaelson stated that the indictment in Chicago and a companion indictment in Atlanta are the initial results of a year long investigation by agents of the United States Secret Service in Chicago, Atlanta, Indianapolis, New York, St. Louis and Kansas City. Raphaelson further noted that pursuant to Court Orders, technical and expert assistance was provided to the United States Secret Service by telecommunication companies including Bell South and its subsidiaries, Southwestern Bell, NYNEX (New York), and Bellcore. Raphaelson particularly praised the actions of Bell South for its proactive position in bringing their intrusion problems to the attention of law enforcement officials and for its formation of an Intrusion Task Force to analyze and respond to the intrusions noted in the Chicago and Atlanta indictments. Assistant United States Attorney William J. Cook, who heads the Computer Fraud and Abuse Task Force, and Assistant United States Attorney Colleen D. Coughlin presented the case to the federal grand jury and will be trying the case in the United States District Court in Chicago. Members of the public are reminded that the indictment is only a charge and is not evidence of guilt. The defendants are entitled to a fair trial at which time it will be the government's burden to prove their guilt beyond a reasonable doubt. *** END ***