TAKEDOWN: Transcripts: February 13-14

Kevin On Demand!

February 13-14, 1995

He seems paranoid now.

Start: 1995 Feb 13 15:45:36
Total Run Time: 12:51
From NETCOM-min1.netcom.net to netcom19.netcom.com.
Kevin behaves worried and paranoid, after finding some of his back doors closed. He seems to have become a bit more vindictive and destructive, and open Markoff's account to anyone on the network. He's suspicious that someone might be on to him, and he tries to see which back doors have disappeared in an attempt to find out where he might have been monitored. Also, as his back door on netcomsv has disappeared, Kevin is suspicious that someone may have tampered with his tools to give him away. After seeing that his tools on Netcom have not been touched, he seems to relax a bit.

Spooked

Start: 1995 Feb 14 11:23:54
Total Run Time: 7:15
From NETCOM-rtp1.netcom.net to netcom15.netcom.com.
Frustrated that his back door on one of Netcom's machines has been closed, tries password ".fukhood" for the benefit of Robert Hood, should he be watching. Spooked, and moving lots of things around.

How vulnerable are we?

Start: 1995 Feb 14 13:15:59
Total Run Time: 19:09
From NETCOM-min2.netcom.net to netcom4.netcom.com.
Changes password on the Well to "no,panix". Wipes out the Well accounting file.
This is the incident that made the Well wonder if kevin had become destructive; we see in reality paranoid behavior and carelessness. He changes passwords on several other accounts, presumably because he is suspicious that the Well is on to him and that his existing patterns have been discovered.

Moving and hiding

Start: 1995 Feb 14 13:40:36
Total Run Time: 15:36
From NETCOM-atl7.netcom.net to netcom6.netcom.com.
On the Well, cleaning up; panicked? Paranoid behavior, moving stuff from the dono account to others, like cybertek. Looking for additional places where he could have been logged; cleaning up.

Who or what tipped him off?

Start: 1995 Feb 14 13:56:34
Total Run Time: 3:08
From netcom4.netcom.com to well.sf.ca.us.
About 8 hours before his arrest. Something has tipped him off about the Well, and he immediately heads for the files of the chief sysadmin, Pei. Checks to see if nkosi still has his back door.

Kevin's last trip to the Well

Start: 1995 Feb 14 22:08:19
Total Run Time: 1:54
From escape.com to well.sf.ca.us.
This is Kevin's last Well session, checking his buried nuts less than half an hour before he was arrested by the FBI. At this point he again seemed comfortable, but his apartment complex had been surrounded by FBI agents, U.S. Marshals, and local law enforcement officials.