Somewhere along the way, Rosen managed to get Par's things returned from the Secret Service raids. He passed the outdated computer and other equipment back to Par, along with disks, print-outs and notes.
Par gathered up every shred of evidence from his case, along with a bottle of Jack Daniels, and made a bonfire. He shredded print-outs, doused them in lighter fluid and set them alight. He fed the disks into the fire and watched them melt in the flames. He flipped through the pages and pages of notes and official reports and let them pull out particular memories. Then he crumpled up each one and tossed it in the fire. He even sprinkled a little Jack Daniels across the top for good measure.
As he pulled the pages from a Secret Service report, making them into tight paper balls, something caught his eye and made him wonder. Many hackers around the world had been busted in a series of raids following the first Thanksgiving raid at Par's house back in 1988. Erik Bloodaxe, the MOD boys, the LOD boys, The Atlanta Three, Pad and Gandalf, the Australians—they had all been either busted or raided during 1989, 1990 and 1991.
How were the raids connected? Were the law-enforcement agencies on three different continents really organised enough to coordinate worldwide attacks on hackers?
The Secret Service report gave him a clue. It said that in December 1988, two informants had called Secret Service special agents in separate divisions with information about Par. The informants—both hackers—told the Secret Service that Par was not the `Citibank hacker' the agency was looking for. They said the real `Citibank hacker' was named Phoenix.
Phoenix from Australia.
Chapter 5 — The Holy Grail.
So we came and conquered and found; riches of Commons and Kings.
— from `River Runs Red', Blue Sky Mining.
There it was, in black and white. Two articles by Helen Meredith in The Australian in January 1989.2 The whole Australian computer underground was buzzing with the news.
The first article appeared on 14 January:
Citibank hackers score $500,000
An elite group of Australian hackers has lifted more than $US500,000 ($580,000) out of America's Citibank in one of the more daring hacking crimes in Australia's history.
Australian federal authorities were reported late yesterday to be working with American authorities to pin down the Australian connection involving hackers in Melbourne and Sydney.
These are the elite `freekers' of white collar crime …
The Australian connection is reported to have used a telephone in the foyer of Telecom's headquarters at 199 William Street in Melbourne to send a 2600-hertz signal giving them access to a trunk line and ultimately to a managerial access code for Citibank.
Sources said last night the hackers had lifted $US563,000 from the US bank and transferred it into several accounts. The money has now been withdrawn …
Meanwhile, Victorian police were reported yesterday to be systematically searching the homes of dozens of suspects in a crackdown on computer hackers …
An informed source said Criminal Investigation Bureau officers armed with search warrants were now searching through the belongings of the hacking community and expected to find hundreds of thousands of dollars of goods.
An informed source said Criminal Investigation Bureau officers armed with search warrants were now searching through the belongings of the hacking community and expected to find hundreds of thousands of dollars of goods.
The second article was published ten days later:
Hackers list card hauls on boards
Authorities remain sceptical of the latest reports of an international hacking and phreaking ring and its Australian connection.
Yesterday, however, evidence continued to stream into the Melbourne based bulletin boards under suspicion …
In the latest round of bulletin board activity, a message from a United States hacker known as Captain Cash provided the Australian connection with the latest news on Australian credit cards, provided by local hackers, and their illegal use by US hackers to the value of $US362 018 ($416112).
The information was taken from a computer bulletin board system known as Pacific Island and used actively by the Australian connection.
The message read: `OK on the 5353 series which we are closing today—Mastercard $109 400.50. On the 4564 series—Visa which I'll leave open for a week
$209417.90. And on good old don't leave home without someone else's: $43 200.
`Making a grand total of
$362018.40!
`Let's hear it for our Aussie friends!
`I hear they are doing just as well!
`They are sending more numbers on the 23rd! Great!
`They will be getting 10%
as usual…a nice bonus of
$36 200.00!'
The bulletin board also contained advice for phreakers on using telephones in Telecom's 199 William Street headquarters and the green phones at Spencer Street Station in Melbourne—to make free international calls …
Phoenix, another local bulletin board user, listed prices for
`EXTC'- tablets …
Late Friday, The Australian received evidence suggesting a break-in of the US Citibank network by Australian hackers known as The Realm …
The gang's US connection is believed to be based in Milwaukee and Houston. US Federal authorities have already raided US hackers involved in Citibank break-ins in the US.
A covert operation of the Bureau of Criminal Intelligence has had the Australian connection under surveillance and last week took delivery of six months' of evidence from the Pacific Island board and associated boards going by the name of Zen and Megaworks …
The Australian hackers include a number of Melbourne people, some teenagers, suspected or already convicted of crimes including fraud, drug use and car theft. Most are considered to be at the least, digital voyeurs, at worst criminals with a possible big crime connection.
The information received by The Australian amounts to a confession on the part of the Australian hackers to involvement in the break-in of the US Citibank network as well as advice on phreaking … and bank access.
The following is taken directly from the bulletin board … It was stored in a private mailbox on the board and is from a hacker known as Ivan Trotsky to one who uses the name Killer Tomato:
`OK this is what's been happening …
`While back a Sysop had a call from the Feds, they wanted Force's, Phoenix's, Nom's, Brett Macmillan's and my names in connection with some hacking The Realm had done and also with some carding meant to have been done too.
`Then in the last few days I get info passed to me that the Hack that was done to the Citibank in the US which has led to arrests over there also had connections to Force and Electron …'
DPG monitoring service spokesman, Mr Stuart Gill, said he believed the Pacific Island material was only the tip of the iceberg.
`They're far better organised than the police,' he said.
