Re: Hunting for Mr Badmouth

["Meritt James" <meritt_james () bah com>]

Just an idea, and not one (insert standard disclaimer suitable for
lawyers here)...  if this was posted on a yahoo message board, a search
through the yahoo message boards for this individual might be
informative (for instance, a search for 'JWMeritt' would be
http://search.yahoo.com/search?x=op&va=JWMeritt&va_vt=any&vs=groups.yahoo.com&vd=all&fl=0&ei=ISO-8859-1&vm=p&n=20
)  The suggestions for reading headers would be good in those cases that
headers are available, as would the yahoo logs for those times in which
he/she/it was posting.  And you may well get instances that he/she/it is
talked about, and not just when he/she/it was doing the talking.  Ask
them.

BUT if you want to pursue the course legally, the standards for
"defamation" become much stricter, as are the rules for admissable
evidence.  Cybercrime is a very interesting, and extensive, topic and if
that is the way you are going I echo the recommendation to bring in a
lawyer (ack!  cough!) NOW!  Perhaps, if you are really, really ticked
contact the FBI through Infraguard contacts.

Jim

"Champion, Steve" wrote:
> An excellent comment Mr. James.   Could you elaborate on what the
> differences in the approaches would be?
>
> Thank You
> Steve Champion
> Sr. Data Security Analyst
> The Methodist Hospital.
>
> -----Original Message-----
> From: Meritt James [mailto:meritt_james () bah com]
> Sent: Wednesday, August 27, 2003 11:40 AM
> To: Bob Walker
> Cc: security-basics () securityfocus com
> Subject: Re: Hunting for Mr Badmouth
>
> Welcome to the wonderful world to "track the hacker!"  A relevant
> question:  Do you desire just "tracking him down" or do you wish the
> evidence suitable for admission into a court of law?  There are
> different requirements and if you start one without consideration for
> the other you may accidently "poison the well"...
>
> Jim
>
> Bob Walker wrote:
> > I'm hoping this board can help me.  I've been tasked with trying to
> > track down an individual who posted some comments to a yahoo message
> > board defaming a company.  Is there any way to track this individual,
> > short of a court order to yahoo?  His profile is private, and (duh!)
> > he's not responding to postings to email.
> >
> > Any ideas on a direction to look or a tool to use would be greatly
> > appreciated.
> >
> > Bob
> ---------------------------------------------------------------------------
> > Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
> > October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
> > technical IT security event.  Modeled after the famous Black Hat event in
> > Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
> > Symantec is the Diamond sponsor.  Early-bird registration ends September
> 6.Visit us: www.blackhat.com
> >
> ----------------------------------------------------------------------------
>
> --
> James W. Meritt CISSP, CISA
> Booz | Allen | Hamilton
> phone: (410) 684-6566
>
> ---------------------------------------------------------------------------
> Attend Black Hat Briefings & Training Federal, September 29-30 (Training),
> October 1-2 (Briefings) in Tysons Corner, VA; the world's premier
> technical IT security event.  Modeled after the famous Black Hat event in
> Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.
> Symantec is the Diamond sponsor.  Early-bird registration ends September
> 6.Visit us: www.blackhat.com
> ----------------------------------------------------------------------------
>
> -----------------------------------------
> ____________________________________________________________________________________
> ****CONFIDENTIALITY NOTICE****
> This e-mail is the property of The Methodist Hospital and/or its relevant affiliates and may contain confidential and 
> privileged material for the sole use of the intended recipient(s). Any review, use, distribution or disclosure by 
> others is strictly prohibited. If you are not the intended recipient(or authorized to receive for the recipient), 
> please contact the sender and delete all copies of the message.  Thank you.

-- 
James W. Meritt CISSP, CISA
Booz | Allen | Hamilton
phone: (410) 684-6566

---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
technical IT security event.  Modeled after the famous Black Hat event in 
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------