FEDERAL BUREAU OF INVESTIGATION
NATIONAL COMPUTER CRIME SQUAD

The FBI's National Computer Crime Squad (NCCS) investigates violations of the Federal Computer Fraud and Abuse Act of 1986. These crimes cross multiple state or international boundaries. Violations of the Computer Fraud and Abuse Act include intrusions into government, financial, most medical, and Federal interest computers. Federal interest computers are defined by law as two or more computers involved in the criminal offense, which are located in different states. Therefore, a commercial computer which is the victim of an intrusion coming from another state is a "Federal interest" computer.

COMPUTER CRIMES THE NCCS INVESTIGATES INCLUDE -

• Intrusions of the Public Switched Network (the telephone company)
• Major computer network intrusions
• Network integrity violations
• Privacy violations
• Industrial espionage
• Pirated computer software
• Other crimes where the computer is a major factor in committing the criminal offense

PROCEDURES THE COMPUTER USER SHOULD INSTITUTE BOTH PRIOR TO BECOMING A COMPUTER CRIME VICTIM AND AFTER A VIOLATION HAS OCCURRED INCLUDE -

• Placing a login banner to ensure that unauthorized users are warned that they may be subject to monitoring.
• Turn audit trails on.
• Consider keystroke level monitoring if adequate banner is displayed.
• Request trap and tracing from your local telephone company.
• Consider installing caller identification.
• Make backups of damaged or altered files.
• Maintain old backups to show the status of the original.
• Designate one person to secure potential evidence.
• Evidence can consist of tape backups and printouts. These should be initialed by the person obtaining the evidence. Evidence should be retained in a locked cabinet with access limited to one person.
• Keep a record of resources used to reestablish the system and locate the perpetrator.

For notices to alert users to potential security problems and information on related subjects, contact the Computer Emergency Response Team (CERT) at cert@cert.org or the Forum of Incident Response and Security Teams (FIRST) at first-sec@first.org. The FIRST home page is at www.first.org/first.

ADDITIONAL ACTIONS AVAILABLE TO PROTECT THE COMPUTER USER INCLUDE -

• Encryption of files.
• Encryption of transmissions.
• Use of one-time password generators.
• Use of Kerberos.
• Use of secure firewalls.

THE FBI's National Computer Crime Squad, located within the Washington Metropolitan Field Office, has national jurisdiction, and coordinates many of its investigations with FBI counterparts in foreign countries where a case shares mutual interest. The NCCS includes personnel who have:

• Degrees in the computer sciences.
• Prior work experience in industry and academic institutions.
• Basic and advanced commercial training.
• Knowledge of basic data and telecommunications networks.
• Experience with UNIX and other computer operating systems.

Contact the FBI's National Computer Crime Squad through the Washington Metropolitan Field Office at nccs@fbi.gov, or call (202) 324-9164.

To be contacted for a confidential consultation please E-mail: jmatk@tscm.com or send a letter via US Mail to: James M. Atkinson Granite Island Group 127 Eastern Avenue #291 Gloucester, MA 01931-8008 or call: Telephone: (978) 381-9111 URL: http://www.tscm.com/