ATTACHMENT A AFFIDAVIT. A. Introduction 1. I am a Special Agent of the Federal Bureau of Investigation (FBI) and

Transcription

1 ATTACHMENT A AFFIDAVIT I, Kenneth Carl Heitkamp, being duly sworn, depose and state as follows: A. Introduction 1. I am a Special Agent of the Federal Bureau of Investigation (FBI) and have been so employed since November I am currently assigned to the Cyber Crimes Squad of the Boston Field Office of the FBI. I have previously been assigned to the bank fraud and health care fraud squads. As a member of the Cyber Crimes Squad, my responsibilities include the investigation of crimes involving computer fraud and abuse and wire fraud under Title 18, United States Code (U.S.C.) Sections 1030 and 1343, respectively, as well as investigations involving other crimes committed through the use of computers and the Internet. 2. As a Special Agent of the Federal Bureau of Investigation, I have participated in numerous investigations of "white collar" crimes, including Internet and computer fraud, and other frauds, including mail and wire fraud. I have participated in the execution of numerous search warrants, including search warrants involving searches and seizures of computers, computer equipment, software, computer media and other electronically stored information and have been the affiant on approximately 8 of those warrants. I am also familiar with and have participated in all the normal methods of investigation, including, but not limited to, visual surveillance, questioning of witnesses, and the use of informants. 3. I have received training in Internet and computer related crimes and the tracking of Internet usage. Based on my training and experience, I am familiar with the means by which individuals use computers to commit various criminal offenses. 4. Prior to becoming a Special Agent of the Federal Bureau of Investigation, I worked for the Internal Revenue Service as a Revenue Agent for approximately five

2 years and previous to that, I worked for a CPA firm located in New York State. I am also a registered CPA in the State of New York. 5. I submit this affidavit in support of a complaint charging Van T. Dinh, [*Redacted by FindLaw*], Phoenixville, PA 19460, with unauthorized access to a protected computer, mail and wire fraud and securities violations. Specifically, as more fully set forth below, I am of the opinion that there is probable cause to believe that Van Dinh is guilty of causing damage in connection with unauthorized access to a protected computer in violation of Title 18, United States Code, 1030; committing mail and wire fraud in violation of Title 18, U.S.C, Section 1341 and 1343; and of knowingly executing a scheme and artifice to (1) defraud the Investor and others in connection with a security and to (2) obtain by means of false and fraudulent pretenses, money and property in connection with the purchase and sale of a security, in violation of Title 18, U.S.C, Section 1348 and Title 15, U.S.C, Sections 78j(b) and 78ff(a) and 17 C.F.R. Section B-5 (manipulative and deceptive devised and contrivances in connection with the purchase and sale of a security in contravention of Rule 10b-5 of the Rules and Regulations promulgated by the United States Securities and Exchange Commission). These violations arise in connection with Dinh unlawfully accessing a computer belonging to an individual, identified herein as the Investor and using information gained through that intrusion to make unlawful trades through the Investor s on-line brokerage account. 6. The information contained herein is based on my personal knowledge of this investigation, gained through the review of various records including trading records, bank records, Internet protocol (or IP ) 1 information, documents produced by 1 The Internet Protocol (or "IP") is the method or protocol by which data is sent from one computer to another on the Internet. Each computer (known as a host ) on the Internet has at least one IP address that uniquely identifies it from all other computers on the

3 Dinh, as well as from conversations with representatives of the Securities and Exchange Commission, Office of Internet Enforcement. Given the limited purposes of this affidavit, I have not included every fact known to me regarding the facts and circumstances of the underlying investigation. B. Dinh s Purchase of Cisco Options 7. From June 18 through June 27, 2003 an individual named Van Dinh purchased approximately 9,120 put option contracts for the common stock of Cisco Systems, Inc. ( Cisco ) at the strike price of $15.00 per share, expiration date July 19, 2003, through his online trading account at Cybertrader.com at a cost of approximately $91, (the Cisco options ). This was verified through documents and records obtained from Cyber Trader which confirmed that the purchases were done through account number [*Redacted by FindLaw*], in the name of Van T. Dinh, [*Redacted by FindLaw*], Phoenixville, PA Each put contract gave him the right to sell 100 shares of Cisco common stock at $15.00 per share, if the share value fell to that price or below, until the contract s expiration on July 19, He paid $10.00 per contract for a total purchase price of approximately $91,200. Had the stock price fallen to $15.00 or less prior to the expiration of the pur contracts, he would have been able to sell 100 shares (per contract) for the new stock price. For example, had the stock price fallen to $14.00 per share, his ability to sell those shares for $15.00 would have resulted in a total profit of $912,000 (not including transaction costs). Thus, in the unlikely event that the value of Cisco shares had fallen relatively precipitously during the short period of the life of the contracts, Dinh would have stood to make a lot of money - a highly speculative but potentially very lucrative play. 8. On July 10, 2003, approximately nine days before the expiration date of Internet. In this way, the IP address information is the Internet equivalent of a telephone number.

4 the Cisco options, Cisco s stock was trading at approximately $19 per share, making it likely that Dinh s $15 Cisco put options would be worthless at the time they expired. C. The Unlawful Intrusion 9. On July 7, 2003, the Investor, a member of Stockcharts.com s stockcharting forum, who lived in Westborough, MA, received a seemingly benign message from an individual named Stanley Hirsch. Based on records obtained from Stockcharts.com, at least 50 other members of the stock charting forum also received the same . In this message, Stanley Hirsch asked if the members maintained their own websites. The Investor responded to this inquiry, thus providing his personal address to Stanley Hirsch. 10. On July 8, 2003, following his response to Stanley Hirsch, the Investor, through his personal address, received an invitation to participate in a socalled beta test of a new stock-charting tool. The sender, identified as Tony T. Riechert, provided a link in the message to enable the Investor to download a computer program that purported to be the stock-charting application. 11. The purported application sent to the Investor was actually a disguised Trojan that contained a series of keystroke-logging programs. Keystroke-logging programs such as these enable one Internet user to remotely monitor the actual keystrokes of another Internet user, in this case the Investor, who unsuspectingly installed the programs on his computer. A Trojan is a program in which malicious or harmful code is concealed or hidden inside apparently harmless programming or data, in such a way that it can get control of the breached computer and do its chosen form of damage (for example, as in the instant case, logging keystrokes on the victim computer). 12. Once the Investor had installed the program on his computer, the individual who sent the keystroke-logging programs to the Investor was able to use the

5 intrusion programs to identify an online TD Waterhouse account held by the Investor and to extract the password and login information for that account. 13. On July 11, 2003, the intruder who had obtained the Investor s TD Waterhouse account information used the information to log into the Investor s TD Waterhouse account and place a series of buy orders for the Cisco options, more fully described above, depleting almost all of the account s available cash (approximately $46,986.00). 14. The buy orders, executed on the Chicago Board Options Exchange, were filled with 7,200 Cisco put options sold from Van Dinh s account, meaning that Dinh was the counter-party to the purchase of the Cisco options through the Investor s account. As a result of the execution of these buy orders, Dinh avoided at least $37,000 of losses (some of the funds taken from the Investor's account was commission cost) and the Investor s account was virtually depleted of all cash. It is noteworthy that these purchases from the Investor s account represented the options entire trading market for that day. Four days later, the Investor informed the SEC of the intrusion into his computer and of the unauthorized activity in his TD Waterhouse account and provided the information detailed above. 15. Following the receipt of this information from the Investor, investigators from the SEC and the FBI obtained and reviewed tracking information concerning the relevant traffic and other electronic communications. 16. The Investor and other members of Stockcharts.com received the deceptive stock-charting from TonyRiechert@myrealbox.com on July 8. By tracing the s relevant IP trail, it was determined that this came from Lockdown Corporation, which essentially provided an anonymizing service to its subscribers, including Van Dinh, which essentially hides the identity of the original

6 sender from the recipient. The Lockdown account accessed by Dinh was in the name Van T. Dinh, [*Redacted by FindLaw*], Phoenixville, PA. Information obtained from Lockdown revealed that the "Tony Riechert" originated from a Verizon subscriber. Based on information provided by Lockdown, on this same day, the same Verizon account holder also accessed the TD Waterhouse website and a hacker website that offered the opportunity to download various keystroke-logging programs. 17. Further information obtained from Lockdown established that during the time of the July 11, 2003 trades, this same Verizon account holder had again accessed Lockdown. Information from Lockdown showed that the Verizon account holder went through Lockdown to an Australian Internet service provider. TD Waterhouse confirmed that the fraudulent trades were placed through the same Australian Internet Service Provider. 18. Information subpoenaed from Verizon showed that the Verizon account that logged into Lockdown at the time of the "Tony Riechert" on July 8, 2003 and at the time the option purchases were made on July 11, 2003 was in the name Tri V. Dinh, [*Redacted by FindLaw*], Phoenixville, PA 19460, whom I believe to be one of Van Dinh's parents. In other words, the "Tony Riechert was sent, through Lockdown, from Dinh's home computer on July 8, Similarly, Dinh s home computer accessed LockDown and was logged into an Australian service provider during the period in which all of the orders were submitted on July 11, The Investor provided law enforcement with a copy of the program that he inadvertently loaded onto his computer as a result of his opening the "Tony Riechert" . We were able to upload this program onto one of our own computers and then identify the locations to which this key stroke logging program was sending the captured data. Specifically, the key stoke data was being sent to address kslogs@utvinternet.com, an server located in Ireland with a return address of

7 an server located in Germany. It was apparently set up this way to ensure that key stroke data that could not be delivered to the kslogs account would then be delivered to the ksupdate account, rather than being returned to the Investor's account. 20. Based on other information subpoenaed in connection with this investigation, I know Van Dinh to have brokerage accounts in his name and at the address of [Redacted by FindLaw], Phoenixville, PA at the following brokerages: Equity Trading On-Line; Cyber Trader; My discount Broker; American Express Financial Advisors; Ameritrade; Southwest Securities; interactive Brokers and Firstrade Securities. D. Corroborating Documents and Information Obtained from Dinh 21. On August 1, 2003, Van Dinh voluntarily appeared at the SEC and voluntarily provided SEC attorneys with approximately 2 notebooks worth of information and documentation. Included in those materials were the following: a. A document stating that he used the address infogoldrain@utvinternet.com. This was the originating address of the Stanley Hirsch originally sent to some members of Stockcharts.com, including the Investor, on July 7, 2003; b. A document stating that he used address TonyRiechert@myrealbox.com). This was the originating address of the Tony Riechert received by the Investor, on July 8, 2003, which contained the deceptive stock-charting and the hyper-link to the purported stock-charting application that caused the Investor to unwittingly download the keystroke-logging programs onto his computer;

8 c. A document in which he stated that he has used more than ten computer intrusion programs, including at least one of the keystroke-logging programs sent to the Investor and other stockcharts.com users, thus indicating his familiarity with hacking programs; d. A document in which he stated that he used the addresses kslogs@utvinternet.com and ksupdate@gmx.net. According to the Investor, following his discovery of the unauthorized access to his computer and the subsequent fraudulent trades from his on-line brokerage account, he then noticed that several unauthorized, outgoing s had been sent from his computer to addresses kslogs@utvinternet.com and ksupdate@gmx.net. As set forth above, these were the two addresses to which the key stroke data was sent after being intercepted by the key stroke logging program the Investor had unwittingly installed on his computer. Thus, although the keystroke-logging programs apparently deleted the content of these s from the Investor's sent file, they likely contained the key stroke-logging or other information the program gleaned from the Investor's computer. H. Conclusion 22. Based on the foregoing, it is my conclusion that there is probable cause to believe that Van Dinh has caused damage in connection with unauthorized access to a protected computer in violation of Title 18, U.S.C., 1030, committed mail and wire fraud in violation of Title 18, U.S.C., 1341 and 1343, and that Dinh knowingly executed a scheme and artifice to (1) defraud the Investor and others in connection with a security and to (2) obtain by means of false and fraudulent pretenses, money and

9 property in connection with the purchase and sale of a security, in violation of Title 18, U.S.C., Section 1348 and Title 15, United States Code, Sections 78j(b) and 78ff(a) and 17 C.F.R. Section B-5 (manipulative and deceptive devised and contrivances in connection with the purchase and sale of a security in contravention of Rule 10b-5 of the Rules and Regulations promulgated by the United States Securities and Exchange Commission). Specifically, as more fully set forth above, there is probable to cause to believe that Dinh, from his home computer: 1) ed the keystroke-logging programs (disguised as the stock-charting application) to the Investor; 2) used the keystrokelogging programs to extract from the Investor s home computer information about his TD Waterhouse online brokerage account (including his password); and 3) placed, from the Investor s account, the unauthorized buy orders for the 7,200 Cisco options. KENNETH CARL HEITKAMP Special Agent, Federal Bureau of Investigation Sworn to and subscribed before me this day of October, JUDITH GAIL DEIN U.S. MAGISTRATE JUDGE