◆ SpookStack

URLIOUETUE Ho CONTRINED ALL INFORM EEREIN DATE 1S iM ADR RYS — b6 -1,-2 02/27/2002 12:79 PM ’ b7C -1,-2 To: cot Subject: AP, CNET, Reuters, MSNBC re: intranet hack The Associated Press The materials in the AP file were compiled by The Associated Press. These materials may not be republished without the express written consent of The Associated Press. February 27, 2002, Wednesday, BC cycle 12:36 AM Eastern Time SECTION: Business News LENGTH: 197 words HEADLINE: Hacker says he saw Social Security numbers inside New York Times' network DATELINE: NEW YORK. BODY: A San Francisco hacker says he found security lapses in The New York Times’ internal computer network that exposed Social Security numbers for op- red page contributors and other sensitive files. Adrian Lamo, 21, a part-time Internet security consultant, said Tuesday that he hacked the newspaper's Web site and snooped around numerous times about 10 days ago. He said he found at least seven misconfigured servers, allowing savvy users to enter the newspaper's private network through its public Web site. He said he browsed through names and Social Security numbers of the paper's employees, home delivery customers' orders and contact information used by writers and editors on the Metro and Business desks. He said he accessed a database of 3,000 contributors to the Times' op-ed page, which included Social Security numbers for celebrities and government officials. Lamo said that the SecurityFocus Web site notified the newspaper of what he had done and that the newspaper patched the holes he found but did not acknowledge the incursion. A telephone message left at the newspaper's corporate communications division was not FBI(19-cv-1495)-1629