FEDERAL BUREAU OF
INVESTIGATION
NATIONAL COMPUTER CRIME SQUAD



Contact the FBI's National Computer Crime Squad through the Washington Metropolitan Field
Office at (202) 324-9164.



The FBI's National Computer Crime Squad (NCCS) investigates violations of the FederalComputer Fraud and Abuse Act of 1986. These crimes cross multiple state or internationalboundaries. Violations of the Computer Fraud and Abuse Act include intrusions into government,
financial, most medical, and Federal interest computers. Federal interest computers are defined bylaw as two or more computers involved in the criminal offense, which are located in different states.
Therefore, a commercial computer which is the victim of an intrusion coming from another state is a"Federal interest" computer.



COMPUTER CRIMES THE NCCS INVESTIGATES INCLUDE -

Intrusions of the Public Switched Network (the telephone company)
Major computer network intrusions
Network integrity violations

Privacy violations
Industrial espionage
Pirated computer software
Other crimes where the computer is a major factor in committing the criminal offense

PROCEDURES THE COMPUTER USER SHOULD INSTITUTE BOTH PRIOR TO BECOMING A COMPUTER
CRIME VICTIM AND AFTER A VIOLATION HAS OCCURRED INCLUDE -

Placing a login banner to ensure that unauthorized users are warned that they may be subject
to monitoring.

Turn audit trails on.

Consider keystroke level monitoring if adequate banner is displayed.

Request trap and tracing from your local telephone company.

Consider installing caller identification.

Make backups of damaged or altered files.

Maintain old backups to show the status of the original.

Designate one person to secure potential evidence.

Evidence can consist of tape backups and printouts.

These should be initialed by the person obtaining the evidence. Evidence should be retained in a locked cabinet with access limited toone person.
Keep a record of resources used to reestablish the system and locate the perpetrator.
For notices to alert users to potential security problems and information on related subjects, contact
the Computer Emergency Response Team (CERT) or the Forum of Incident Response and SecurityTeams (FIRST). CERT and FIRST are separate organizations not affiliated with the FBI. Personsdesiring to contact the FBI's National Computer Crime Squad regarding a computer crime mattershould do so by
calling the telephone number listed on this page. Do not send e-mail to CERT orFIRST intended for the FBI.





Contact the FBI's National Computer Crime Squad through the Washington Metropolitan Field
Office at (202) 324-9164.