◆ SpookStack

11. The LexisNexis Representative provided me with copies of the log files pertaining to userids TOOMANYSECRETS, PROTAGONIST, LOCUST, VAISHNAV, and NU1UJB, including the following information: (a) date and time stamp; (b) IP address that accessed the userid; (c) the query entered; (d) the LexisNexis database searched; (e) the type of search; and (f) how the account was accessed, e.g. through the internet or through a network such as the New York Times’ Intranet. 12. I have reviewed the LexisNexis log files identified above and based on that review and my conversations with LexisNexis personnel have determined the following: {a} searches were performed in various different LexisNexis libraries for the following, among other queries: (1) “Adrian Lamo”; (2) various other individuals who have the last name “Lamo” or who, base rch using various DIE databases including formerly had the last name “Lamo”; {3) an address in California that, based on my xesearch using various databases including appears to be the home address of the parents of ADRIAN LAMO, the defendant, and is the same address as the billing address for cellular telephone number (415) 505-HACK; (4) other addresses on the same street as the above address; (5) names of various reputed hackers; {6) executives of America On-Line (“AOL”); and (7) various individuals believed to be associated ‘with ADRIAN LAMO, the defendant, in the hacking community. . {b) on February 26, 2002 (the same date that the author of the Article first notified the New York Times that its network had been compromised by ADRIAN LAMO, the defendant), in a four minute period queries were made in the LexisNexis NEWS library’® 30 The LexisNexis NEWS library contains stories from newspapers, magazines, wire services, transcripts and -8- FBI(19-cv-1495)-234