The Corner Pub

programmed to mail details of all computer accounts it pene- trated around the world back to a US machine, the computer known as GEMPAK? Because the author of the worm was an American, of course! Therefore it is not our problem, the French told the Americans. It is your problem.

Most computer security experts know it is standard practice among hackers to create the most tangled trail possible between the hacker and the hacked. It makes it very difficult for people like the FBI to trace who did it. So it would be dif- ficult to draw definite conclusions about the nationality of the hacker from the location of a hacker’s information drop-off point — a location the hacker no doubt figured would be investigated by the authorities almost immediately after the worm’s release.

Tencati had established the French connection from some computer logs showing NASA under attack very early on Monday, 16 October. The logs were important because they were relatively clear. As the worm had procreated during that day, it had forced computers all over the network to attack each other in ever greater numbers. By 11 a.m. it was almost impossible to tell where any one attack began and the other ended.

Some time after the first attack, DST sent word that certain agents were going to be in Washington DC regarding other matters. They wanted a meeting with the FBI. A representative from the NASA Inspector General’s Office would attend the meeting, as would someone from NASA SPAN security.

Tencati was sure he could show the WANK worm attack on NASA originated in France. But he also knew he had to document everything, to have exact answers to every question and counter-argument put forward by the French secret service agents at the FBI meeting. When he developed a timeline of attacks, he found that the GEMPAK machine showed X.25 network connection, via another system, from a French computer around the same time as the WANK worm attack. He followed the scent and contacted the manager of that system. Would