UNDERGROUND

he help Tencati? _Mais oui._ The machine is at your disposal, Monsieur Tencati.

Tencati had never used an X.25 network before; it had a unique set of commands unlike any other type of computer communications network. He wanted to retrace the steps of the worm, but he needed help. So he called his friend Bob Lyons at DEC to walk him through the process.

What Tencati found startled him. There were traces of the worm on the machine all right, the familiar pattern of login failures as the worm attempted to break into different accounts. But these remnants of the WANK worm were not dated 16 October or any time immediately around then. The logs showed worm-related activity up to two weeks before the attack on NASA. This computer was not just a pass-through machine the worm had used to launch its first attack on NASA. This was the development machine.

Ground zero.

Tencati went into the meeting with DST at the FBI offices prepared. He knew the accusations the French were going to put forward. When he presented the results of his sleuthwork, the French secret service couldn't refute it, but they dropped their own bombshell. Yes they told him, you might be able to point to a French system as ground zero for the attack, but our investigations reveal incoming X.25 connections from else- where which coincided with the timing of the development of the WANK worm.

The connections came from Australia.

The French had satisfied themselves that it wasn't a French hacker who had created the WANK worm. _Ce n'est pas notre_ _problème_. At least, it's not our problem any more.

It is here that the trail begins to go cold. Law enforcement and computer security people in the US and Australia had ideas about just who had created the WANK worm. Fingers were pointed, accusations were made, but none stuck. At the end of the day, there was coincidence and innuendo, but not enough evidence to launch a case. Like many Australian