CIO — WE’RE GOING TO CONVINCE YOU that you should call the FBI if your company is ever the victim of a computer crime. That’s right, the Federal Bureau of Investigation. The feds. Government agents. Now, before you say "I don’t think so" in your most sarcastic voice, read on. n There’s a prevailing misconception that as soon as you pick up the phone to call the FBI, teams of agents will swoop
down on you with guns drawn to confiscate your computers and seize control?effectively closing down your business. That’s how it happens in the movies. This is life. Here’s how it really happens.
Usermagnet had survived distributed denial-of-service attacks before, but nothing like what it experienced on a Sunday night in February of last year. Packet kiddies?international hacking groups comprising teenagers looking for a thrill?had taken over an online Java chat channel the company was hosting.
"It was vicious. These guys were completely suppressing our circuits," recalls Rick Ross, president of the Cary, N.C., Web services company. "We’re talking 50 megabits per second massively overloading our servers. It went on for something like 14 hours."
When he and Vice President of Development Mike Sick went looking for other channel users under attack, they found the same assault happening simultaneously in at least a dozen places. The pair also found a friend who had managed to start a conversation with one of the hackers and gained access to his system. "There was a large amount of information on a whole hacker network," says Ross. There was also a list of about 500 machines the group had compromised and the passwords used to hack each unit. "We said, ’Whoa, we’re over our heads here.’"
After calling the FBI and getting its approval, Ross and Sick set out to turn several of the group members into informants. One of the hackers even asked to have a pizza sent to his house as a show of fidelity. Meanwhile, federal agents tracked entry points, contacted ISPs, pored over logs, monitored hacking channels and contacted owners of each machine that had been hit. The result? As this issue went to press, the one nonjuvenile member of the group had pleaded guilty and was awaiting sentencing.
To Call or Not to Call
Calling the Feds is still filed under unthinkable acts in most organizations. The few brave companies that have made the call and lived to tell the tale say they got the help they needed and in some cases saw the perpetrators arrested. (See "Outbreak," Page 72, to read about one company’s experience with the FBI as it battled a virus attack.)
