February 9. The trail from the Well leads to Netcom Online Communications Services, a nationwide Internet services provider based in San Jose, California. Tsutomu drives to San Jose in the evening and begins setting up a monitoring system there. The effort is complicated by the torrent of data that is passing through the Netcom network. Special tools are required to set up a monitoring operation and Tsutomu works through the night to have monitoring set up by the next morning, when the attacker usually comes online.

February 10. Monitoring at Netcom, Tsutomu is able to determine the attacker's identity when - in a keyboard session with a confederate in Israel - the intruder complains that his picture has appeared on the front page of the New York Times. Mitnick and the Israeli are systematically breaking in to the machines of computer security experts hunting for information on system vulnerabilities. Mitnick is trying to mask his location by connecting to the Internet via different Netcom local telephone numbers around the country, but he appears to be coming from Raleigh, North Carolina, most frequently.