n 0 :': z :x. :x :

14
IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS (") r- I"-.) COUNTY DEPARTMENT, CRIMINAL DIVISION ,., 0::00 c:::> ..." i, nO :,::" fTl 0""' ,- CO :;:K x .... ,. I r T"l W \) .r"\ -- PEOPLE OF THE STATE OF ILLINOIS, ) 0 :"': '·n C hI :; -0 z" :x. :x W :J :<-I:E ;::gz N Plaintiff, c: N ::0 -I v. No. 08 CR-10502 ANNABEL K. MELONGO Defendant . MOTION TO COMPEL DISCOVERY OR TO DISMISS Comes now the defendant , ANNABEL K. MELONGO, Pro Se, and asks that this Honorable Court , pursuant to Supreme Court Rule 411, et seq., compels the State to produce additional discovery information and delivers it to the Accused, pursuant to the broad power and discretion granted to this Court by the Illinois Supreme Court; and as grounds for said request alleges and states: 1. The indictment in this cause alleged that the defendant committed Computer Tampering, Count I and II , on or about April 2008, and Count III, on or about May 1, 2006 , in violation of 720 ILCS, 5/16D-3 of the Illinois Complied Statutes by remotely accessing Save-A-Life Foundation ( "SALF") servers/computer .

Upload: trinhdiep

Post on 23-Mar-2018

215 views

Category:

Documents


2 download

TRANSCRIPT

Page 1: n 0 :': z :x. :x :

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS (") r- I"-.)

COUNTY DEPARTMENT, CRIMINAL DIVISION ,.,

~

0::00 c:::> ~""o ..." i, nO :,::" fTl 0""' ,- CO O -'~.· :;:K x .... ,. I "'<'I!.t~

r T"l _.~

W \) .r"\ --PEOPLE OF THE STATE OF ILLINOIS, ) 0 :"': '·n C hI:; -0 z " :x. :x -I~C

W :J :<-I:E ;::gz N Plaintiff,

c: N ::0 -I

v. No. 08 CR-10502

ANNABEL K. MELONGO

Defendant.

MOTION TO COMPEL DISCOVERY OR TO DISMISS

Comes now the defendant, ANNABEL K. MELONGO, Pro Se, and asks that this Honorable Court, pursuant

to Supreme Court Rule 411, et seq., compels the State to produce additional discovery information and

delivers it to the Accused, pursuant to the broad power and discretion granted to this Court by the

Illinois Supreme Court; and as grounds for said request alleges and states:

1. The indictment in this cause alleged that the defendant committed Computer Tampering, Count

I and II , on or about April 2008, and Count III, on or about May 1, 2006, in violation of 720 ILCS,

5/16D-3 of the Illinois Complied Statutes by remotely accessing Save-A-Life Foundation ( "SALF")

servers/computer.

Page 2: n 0 :': z :x. :x :

2. Allegedly a Cook County Grand Jury was convened in Cook County, pursuant to 725 ILCS 215/1 et

seq.

3. Allegedly, the Judge supervising the aforesaid Statewide Grand Jury somehow determined that

Cook County, Illinois, was the proper venue .

4. The Defendant was presented with a transcript of the proceeding of said Cook County Grand

Jury.

5. Discovery tendered to the Defendant provided, among other documents, police reports from the

Schiller Park Police Department, Three CDs, correspondence from the Illinois Attorney General,

reports of Attorney General forensic expert, list of deleted files, printouts of logs and Email

communications of various parties .

6. The reports of the expert is misleading, open-ended and incomplete without any data with

underlies the charges made by the State.

7. That the People have individuals identified as witnesses, including lay witnesses (civilian) who

were in communication with each other and collaborated in rendering opinion s, including

opinions on ultimate issues on this cause.

8. On April 14th, 2009, Defendant filed a Motion For Additional Discovery. It's not until November

12th, 2009, that the State responded to Defendant's motion. In the response however, the

evidence supporting the charges couldn't be provided stating liThe People's investigation is

ongoing". The Defendant has documents in her possession testing to the contrary, attached

Exh ibits "A"_"C".

Page 3: n 0 :': z :x. :x :

9. The Defendant has knowledge and belief that the re exist s the followi ng documents in the

possess ion of witnesses for the People and she contends that she has the right to copy and

review sa id documents in order to determine whether they conta in evidence material to her

defense or tending to establish her in nocence:

A. Any evidence relating to Count I. Including, but not limited to, forensic examination

data/evidence, log files of computer data server, confessions, witness statements, video, tapes

recordings, radio communications and handwritten or typed memoranda. The data provided

so far to the Defendant is lacking such evidence.

B. Any evidence relating to Count II. Including, but not limited to, forensic examination

data/evidence, log files of computer data server, confessions, witness statements, video,

tapes recordings, radio communications and handwritten or typed memoranda. The data

provided so far to the Defendant is lacking such evidence.

C. Any evidence relating to Count III . Including, but not limited to, forensic examination

data/evidence, log files of SAVE A LIFE Foundation founder's computer, confessions, witness

statements, video, tapes record ings, radio communications and handwritten or typed

memoranda. The data provided so far to the Defendant is lacking such evidence.

D. Provide All communications ( emails, memos, faxes, documents of any kind) between Don

Peters (computer consultant) and any individua l at SAlF regarding the incident/progress of

system recovery.

E. Provide All communications ( emails, memos, faxes, documents of any kind) between Don

Peters and Detective Martin regarding his report to Carol Spizzirri and his recovery findings.

Page 4: n 0 :': z :x. :x :

Specifically as mentioned in the police report "other people prior to him having access to and

'working' on the SAlF system;

F. HAND-WRITTEN copy of complaints related to reports #06-3714 and #06-3219 with Carol

Spizzirri as complainant. As well as copies of complaints signed by Carol Spizzirri on 10/31/06

in front of judge Urso in Rolling Meadows.

G. Page '7' of "Investigative Follow Up Report" of the Schiller Park Police Department is

missing.

H. Copy of report faxed by Sgt. leach from Kansas City Police to Detective Martin.

I. Contact Information of the "Experts" mentioned in the Grand Jury Transcript, page 8, lines

15 -24. Contact Information should be address, phone, fax( if available) and corporate email( if

available ). Also provide All communications ( emails, memos, faxes, documents of any kind)

between ANY SAlF's employee with the said experts if the communication documents are

different from those already requested.

J. Defendant has been provided with ONLY list of deleted files. Defendant needs to know

which deleted files belonged to which accessed servers/computer.

K .. Evidence of intrusion of SAlF servers and computer using GO-TO-MY-PC software. As stated

by both the State and the Forensic report.

l. Creation date of All "Typed Uris" mentioned in the forensic report. Since the Defendant

used her laptop to accomplish her job as network administrator and programmer while

working at SAlF, the dates when those uris were typed are crucial.

Page 5: n 0 :': z :x. :x :

M. Creation and Modification dates of ALL SALF related files listed in t he Forensic Report.

Defendant has reasons to believe that NONE of those files constitute viable evidence; since

the files were created either long before the Defendant was employed at SALF or during her

last day at the company.

N. Date of creation of ALL the usernames and passwords found on the Defendant's laptop.

Since the Defendant used her laptop to accomplish her job as network administrator and

programmer while working at SALF, the dates those username and passwords were saved are

crucial.

O. Creation and Deletion dates of "Two links files found in the Recycle Bin for a network

connection to Save- A- Life Foundation" as mentioned in the forensic report. Since the

Defendant used her laptop to accomplish her job as network administrator and programmer

while working at SALF, the dates those files were created and deleted are crucial.

P. Copy of email Defendant sent to SALF employees as mentioned in the police report.

Q. Disclose the identity of the person with email dated May 4, 2006 at 9:41 pm from 'Technical

Support'. Including the name and address of the person sending the E-mail to Carol Spizzirri.

Attached Exhibit liD".

R. Copies of ALL papers documents( bills, SALF related documents, travel tickets, paycheck

stubs, currency exchange receipts or any other document) taken from Defendant's apartment

during the execution of the search warrant.

Page 6: n 0 :': z :x. :x :

WHEREFORE, the Defendant prays that this Honorable Court compels the State to produce and

deliver to the Accused the following :

A. All documentation requested and delineated in Paragraph 9, above.

B. Whatever other relief this Honorable Court deems relevant, necessary, and just to ensure the

Accused her right to full discovery necessary and proper to a preparation of a bona fide defense.

In case the State is unable to provide ALL information as requested, the Defendant further asks this

Honorable Court to dismiss the indictment.

ANNABEL K. MELONGO

P.O Box 1537

Addison, IL 60101

630/220-4132

Respectfu Iy submitted,

ANNABEL K. MELONGO

Annabel Melongo
Text Box
Page 7: n 0 :': z :x. :x :

IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS

COUNTY DEPARTMENT, CRIMINAL DIVISION

PEOPLE OF THE STATE OF ILLINOIS, )

) Plaintiff, )

) v. )

) ANNABEL K. MELONGO )

) Defendant. )

No. 08 CR-10502

NOTICE OF FILING

TO: Robert Podlasek Assistant State 's Attorney - Cook County

Julie Gunnigle Assistant State's Attorney - Cook County

Kyle G. French Assistant Attorney General-Illinois Attorney General

PLEASE TAKE NOTICE that on February 3th, 2010, I have filed with the Clerk of the

Circuit Court of Cook County, Illinois, a MOTION TO COMPEL DISCOVERY OR TO DISMISS, a copy of which is herewith served upon you.

Annabel Melongo

P.O Box 1537 Addison, IL 60101

630-220-4132

CERTIFICATE OF SERVICE

I served this Notice of Filing and documents referred to therein upon counsel as listed above

via personal service on February 3 th ,2010 prior to 5:00 p.m in 13 th Floor, 2650 S. California Ave., Chicago, Illinois.

_~- '0-103/ /u

Annabel Melongo
Text Box
Page 8: n 0 :': z :x. :x :

._. __ . - ----- - - - -

Lisa Madigan AT TORNEY GENERAL

October 20, 2006 Via Postal Courier

OFFICE OF THE ATTORNEY GENERAL STATE OF ILLINOIS

Assistant States Attorney Scott A. Biestek District 3, Office of the Cook County States Attorney 2121 Euclid Avenue Rolling Meadows, Illinois 60008

re: Save A Life Foundation Matter

Dear Scott:

Per our telephone conversation, the following materials for the above-referenced matter accompany this correspondence in anticipation of our meeting:

• forensic examiner's cover letter; • Report of Digital Forensic Examination and Media Report CDROM and • Detective William Martin's draft report and related transmittal email.

The following criminal statutory provisions contain felony charges that may apply to the matter: 720 ILCS 5116D-3 (Computer Tampering), 720 ILCS 5116D-4 (Computer Fraud),720 ILCS 5116G-15 (Identity Theft) and 720 ILCS 5/14 (Eavesdropping).

Detective Martin, Senior Computer Evidence Recovery Technician Monge and I are looking forward to discussing the matter with you at your office located at 2121 Euclid Avenue, Rolling Meadows, on Monday, October 30, 2006 at 9:30 A.M.

Encls. cc:

Sincerely,

~~ Assistant Attorney General Office of the Illinois Attorney General High Tech Crimes Bureau Direct Voice: 312-814-1155 Email: [email protected]

Detective William Martin, via facsimile 847-671-9389 (w/o encls.) SCERT Shahna Monge, via personal delivery (w/o encls.)

500 South Second Street, Springfield. lIIinois 62706 • (217) 782·1090 • TTY: (217) 785-2771 • Fax: (217) 782-7046 100 Wen Randolph Srreec, Chicago, Illinois 60601 • (312) 814-3000 • TTY: (312) 814-3374 • Fax: (312) 814-3806

EXh{bit 10

1001 EaSt Main. Carbondale, Illinois 62901 • (618) 529-6400 • TTY: (6181529-6403 • Fax: tlillll .~ 2q-h41(' .-.

Page 9: n 0 :': z :x. :x :

Office of the Attorney General High Tech Crimes Bureau

Regional Computer Forensic Lab - Chicago Forensic Report - 09/ 18/2006

RCFL Case Nmnber:

Case Agent:

Forensic Examination Performed by:

Case Classification:

Suspect ( Case Name) :

High Tech Crimes Bureau:

Forensic Procedure SUllllll31Y:

HTCB-06-0 1-1028

Detective William Maliin Schiller Park Police Department

Shahna G. Monge, EnCE Senior Computer Evidence RecovelY Technician Illinois Attorney General 's Office High Tech Crime Bureau Chicago, IL 60601

Computer Tampering

Annabel Melongo

A.A.G. David Haslett, Bureau Chief Deputy Chief of Investigations Daniel F enaro Deputy Chief Michael Sullivan - ICAC Coordinator A.A.G. Abigail Abraham, Prosecutor A.A.G. Kyle French, Prosecutor A.A.G. Elizabeth Lepic, Prosecutor

The hard drive £i·om the computer system relating to tlils case was locked (write-protected) via the use of the Encase Fast Bloc IDE to SCSI imaging device. The hard drive was then imaged to a separate hard drive within the forensic computer. The ZIP media was imaged to the same hard drive witllln the forensic computer, and a separate file was created for each ZIP disk. The ZIP media was acquired though Encase 's network acquisition and the ZIP drive was locked to prevent writing to the media through Encase in DOS mode before the acquisition was beglm. The CD media was imaged to the same hard drive within the forensic computer, and a separate file was created for each CD. The forensic CD drive does not have writing capabilities. The USB thumb drive was imaged to the same hard drive witlllll the forensic computer. The thumb drive was write-blocked by the use of a Windows registry change that prohibits any writes being made to any media connected via USB.

1

Page 10: n 0 :': z :x. :x :

This imaging process entailed the creation of an evidence file ( disk image) in which the hard drive/ZIP/CDiUSB thumb drive were recreated sector by sector in a forensic environment utilizing forensic software licensed and registered to Shahna G. Monge, Senior Computer Evidence RecovelY Technician a11cl/or the Illinois Att011ley General.

This process allowed the forensic examination to proceed without alteling any of the original files fi-om the suspect media, and also preserved File, Disk and Volume Slack. This also allowed the unallocated sectors of the disk to be searched and examined. The process detailed above also allowed for forensic examination of RAM Slack.

Forensic Report SwmnalY:

I reviewed the case files provided by Detective Mrutin, Schiller Park Police Deprut1l1ent. After review of the search WruTrult, it was detenllined that I would attempt to recover any infonnation that would constitute evidence of the offense Computer Tampering and also detelIDine ownership/control ancl/or dominion over the data.

The forensic examination was completed and forensic repOlts ru'e listed under their respective names and were provided as sepru'ate documents (files) to Detective Mmtin.

Dming the comse of the examination I observed the following: Please refer to the included Forensic Report for detailed infOlIDation regarding the following.

• Two link files were fOlmd in the Recycle Bin for a network connection to Save A Life Foundatioll.

• Log files for the program Go To My PC were discovered. Go To My PC is a program that allows remote access to another computer.

• A log file for the Jakalia service were discovered that contained entries for the specific date and time of the intlUsioIl. Jakarta is a project to create rul open-somce java-based selver.

• Connection settings were found in the Microsoft network c01ll1ections phonebook resident on the laptop computer.

• Within a restore point "snapshot" that was automatically created by the computer, there was a text document discovered naIlled "domain. txt" that contains infonnation relating to a computer on the domain savealifefou.

• A cookie file containing IF information for comcast server with IP 24.15.202.102 was discovered. File last written 04/28/06 09:43 : 13hrs.

• Several instrulces of the IP 24.15.202.102 were discovered on the evidence. Please see the forensic repOli for f1.l1ther details.

• The URL ft ·p-:·/I7·0·.·1·4·2·.·2·5·1· .·2-4-2·; ·· was found in the regishy in the folder "TypedURLs" for Windows user Administrator. It also shows that an FTP session (or file transfer protocol) session was initiated by the Windows user Administrator for the IP 70.142.251.242.

2

Page 11: n 0 :': z :x. :x :

• •

• • •

The IP shown of24.15.202.102 was located in the regishy in the folder "TypedURLs". It is shown as it was typed by the Windows user Administrator.

The URL h·t-t·p·:·N 'w'w·w' .'g'o't'o·mYP·c·.'c·o·m'/ '" was found in the registIy in the folder "TypedURLs" by the Windows user Administrator.

The URL h·t·t·p·:';'; 'm·a·i·I· .·s·a·l·f· .·oTg'/"· was found in the registly in the folder "TypedURLs" for Windows user Adminish·ator.

What appeaJ:s to be user name and password ([email protected]:hennan·) for the website www.salf.org:2095/Webmail. was fotmd in the Protected Storage System Provider folder for SID (System ill) that cOlTesponds to Windows user AdtninistI·ator.

s'g'h 'o'l·aT@·s'a·I·f-. ·oTg" ·s'g·h·o'I'a'f'8·8·9·9"· appears to be infollnation typed in at URL shown of http://70.142 .251.2411

The URL of H ·p·: ·;';·7·O' .·1·4·2·.·2·5·1· .·2·4·2·/-d'o·c·u·m·e·n·t·s·" was found in the regishy in the folder "TypedURLs" for Windows user Adtninistrator. It also shows that an FTP session (or file transfer protocol) session was initiated by the Windows user AdministI'ator for the IP 70.142.251 .242 and the folder "documents"

The executable file for the setup of the program Go To My PC, which allows remote access to other computers, was discovered under the Adminish'ator account on the laptop computer.

The executable file for the program Go To My PC, which allows remote access to other computers, was discovered under the Achninistrator account on the laptop computer.

Several web pages (.htm) files were discovered that showed emails associated with [email protected] and what appears to be Annabel Melongo's Roosevelt University email account that contain references to different individuals with Save A Life Foundation. Please see the forensic repOlt for more detailed infOlmation. These pages can also be vie\ved separately and can be found in the folder named "Email".

One Word document was discovered that contained the name "Saquan Gholar" Connection infolmation for "scantron" was discovered shown in a java script page contained

within a folder named "new version", located on a USB thumbdrive. A URL was discovered for http://70.236.105.150 that was titled Scantron System. A URL was discovered for http://70.142.251.241 that was titled SALF Scantmn System. Several different files that appear to relate to ID cards for various SALF employees were

discovered. This information was found in a folder on a USB thumbdt'ive named "TMP". Several images that appear to be parts of a website associated with Save A Live Foundation

were discovered. These images were found in a folder named "IMAGES", which was located on a USB thumbch·ive.

Several different files were discovered that appear to be database items from Save A Life Foundation.

Several images, documents and one web page were discovered that contain infOlmation relating to ownership/control and/or dominion over the data.

The Recycle Bin report is also included that shows files that were contained in the recycle bin before it was emptied.

The Media Report can be fOlmd here and it contains infOlmation peliaining to the evidence that was tumed over to our lab for analysis.

3

Page 12: n 0 :': z :x. :x :

The Duplicate Digital Evidence (DDE), created on CD, will remain in the ESR until termination of this investigation. The DDE created on the forensic computer hard drive will be erased in preparation for future unrelated examinatiollS.

The original evidence is to be returned to Detective Maliin for retentioll.

Appeudix A

Appeudix B

Reporting Examiner: Shahna G. Monge, EnCE Senior Computer Evidence Recovery Technician Office of the illinois Attomey General - High Tech Crime Bureau 188 W. Randolph, Chicago, IL

4

Page 13: n 0 :': z :x. :x :

I -- s~!;i~;:!;·;;k-i~l·i~Jq;-~·;~·l~~l ···~~; '·I;r)k;~;~~;l,;;; "c" If ()fl . ' ? I ' 1 :=J . lid IeJeas.c:d titt: iLfJ.ns .. 1Q.M.'L MougL.:,.sn .. tbllLSlte.could. processllmiiellls tlu ilny evidence felat.illg.Jn... tllis incidenl . Rt f had.. her sigilli IC SduHer PaJk J'mpcI1y.JnYJ:utury.Conlrot Shed gliowillg the .. .cllahl ... of cwaody o f the. c.vitkuGt: ..

28 Sep 06- R!Lwas .. CDCltact,:d .. by Ms M nge.,. WM.lld ' i ~led that .dH~.fru:e.osl<: lfnalysis on t.J.r.e .. il.cms. .... _ ..... . suhmit.ted .. wascnrnpJetf.audtl!,; rej1ortafl(tlht! il.cJlts .. wCfC.. ready. !jLhY. frJUf'ned In R/ I ... lUI .. and..DeL .. . Knell .. w.elll loJ.he I~CFL in Chicllgo. and rCi.:tl\·crcd I:h(; itcrns nom MiL Ivlonge. Is./I's rlittlbmughulle tlyitiel1ce baclcLO SPI'D where it.was n:.JJ.J1llcd !.l.u .he .t::vidence tDck.'lr tilu,llc..keeping.

R/ I then made ampy_of Ms. }..1C!flge's c,) '>!~r 1.eu.cE.;lJldti)[cusi,:"leport SlllllflUlL), trOl1l

lite CD s.he. providcLlRfL ] ] lC SUIlllflJHY s.how.ed t hat ~I'LLMclQngo clul access tht SALI;_~e(yeL .. remotely, hMLa . .cflrlJJ;;t.~L 11' .IlLldre...'ISJlf 2 .<L I S.202 10.2 . .Jl lt 2R Apr CJ6, haviHg acc.:s.s loJl'ls .. Spiu.irri's emaiLltGcoOnLllnd passwurd, email" !HI her Ro.o.scvdLllni 'lClsily email account-with JJ:f.eIl:'lncl:s..tO . · ru:liyi.UlIal;; .a(.s.~ I Ii , iJ won t dOCllJ11.ent CUlllaiJlinilr the name SruluarLGllDlaJ'.,..JP arldrt:&'ic!I 11ssnciaLc,L viLh .sALF Scaotcon.B..y 'lcm,jrnagesJI OJIl.lhc S.ALI-,-wcbsite, database i.tClUsJi:olfl the SALE scrVJ:L.....

lJ Oct.06 ,,- 1i.lL~pClke .. wi thML l'Lcl)ch limnlhc minoJS AG's 01l'u:iL .. Mc...Ercuch advised Ulllt he hlliL.. l:oo!Jjjnated .. aJneeting.hct.weeJLhiOls.elf ... A,SA.Hi.estek , aud l{fl, so lhar. j\SA BiesJ.ek couJ.d..re'1ic..w aU _ oCrhc t:.'lidence alld In .der ermine jf Iher.eis..r:nough..evldellCe.lD. cbarge Ms. MeIOl1go wilh.lLfelo!l~dIL tltis case. .. ... _ ____ _ ., ....

J}ct...ob." .. RLt alnl)g...\~ilh M(...EH~llch .Jl.llrl...l\ls .. 1JOflgt::~J)Jt:t Wuli <'\SA Bi t:!iICK illf.dC[CllCC to_this _ casc ... AO.er .rc\'ie.wiug.aIl ofUle evenls rdated 10 tbis . .cas.e •. .A.'l t.\.BICsLcK ... appcoy.cd two co.unL'Lof ... ~

pUler TamperingagainsLMs.. Meiollgo. ASA Bmslek.alsn slateUJJlill!le. .wou!u.contjJllli: tnJnnk . other ..dliIrgcs..t.LmLcfluld he filed in this ca;;e(u:. envcsdropping), Rif prepareJi cnfllpta.ints .agB.insl

tvfs.. MeJongn, .. which were {~.f!wf!d fur accufllcyJJ}lASA llic.'il~h. ASA.l3it:!itek.ruhllie.t.l RLLto. ....... _ ..... . . ttcmpt to makc...c.on1llc.L Wil1LMLMe1ll11gn..sollC J.ime. today_l[llIlis..unabJ.c..to..LUak:e.t.:onlacUulh ___ _ tel, .A.SA Bieslck asked to he.floutieu ruu.l llc...lmuh.Ln:lake...al1aignmcnls lll.havI:.lill aIrest warrant. .

SW!lul..(1uLagllins.l .M.s ..... i\Jclnngo_nn 3..l GCLOn. _._ . ..- .... _._ ____ _,. Ri LamL!)e.L.Ku.ch .. t.hcn . .w cnt ttl IvtL.lvl do [11:\0'.5 .. llpartrm:nt.,hlll. wei e .u.tlilhle. to .. 1luk e cn ntacLw.i ih her ttlefC_RfJ's .did.howe'LeLspealcLO. her land lord, Chin, Bing.C. who stated.tllat,\-!s. M.elongo had recently iofocmedhim Iha l she .. was movHlg ow al.l:hc end o[tllelllUJ1tlLand IbaLstH~ l-'1as...CllfJ.ellll¥ [hree l1lonths hehind,oll heLJCnLlvjr..CfJ.iIl also statcl.i.tlwl he .. knew lhil1 Ms .. MdQngo had a par.t-lime ·nh.a t. a rllai: '~ caUe.d ... Cl1iJdre.n:s .. Wotld. ill Barringioll . .R1rs..attem.pred..lu.!.ocate Childrell's_W orld, hUl weu::.l.lll.'iuccessJilL .. R/L1hen ... c.ontIlC!ed ASA.iliestek:.and.inlormed him of Itft's results, ASAJ3.iestek d.\'ise,LllLL10 11ring .M.L . 'p.izzirri to cnJJtLDJl.1 L OCl.06 ill order filf M.:LSpi7..z.irri to sign thtL ._._

colllp]aints .. anJJ1A\·e.ilLl.,u rcst walrallllssucilluLMs MdoJ)gQ...R/\ then J.;Of) lac/cd 15 .. Spl.zzirn and lll.ildt: arntignJlJ !':llts .Wilh ht:Llo go heron: ajudge IHl 3 1 Oct 06 l(lsign the c.omplaints

Case dns.cd ...

th tdTillle 30 Oct 06/1530

Page 14: n 0 :': z :x. :x :

Carol Spizzirri

From: Sent: To: Subject:

Technical Support ([email protected]) Thursday, May 04,20069:41 PM Carol Spizzirri Re: FW: Regarding the prior email. ..

Looking for the IP address of the IT person from the mail log on the server

--------------------------------------------------- (. ) bash-2.05b# grep 24.15.202 . 102 /var/log/exim mainlog ~",,~tI )t(v'tf

2006-05-01 20:31:40 1Fajjo-0002WM-Eb <= cspizzirri@salf .org U=ftpsalf P=local S=6270 [email protected] 2006-05-01 23;01:31 1Fam4o-0007NG-U3 <E [email protected] U=ftpsalf P=local S=4221 [email protected]

t., ..... ,. ',¥ This is the actual record showing her sending the email FROM Carol's email address to her own Yahoo based email address. Note the IP in the log .. .

bash-2.05b# grep 1Fajjo-0002WM-Eb /var/log/exim_mainlog

2006-05-01 20:31:40 IFajjo-0002WM-Eb <= [email protected] U=ftpsalf P=local S=6270 [email protected] 2006-05-01 20:31:41 1Fajjo-0002WM-Eb =>melongo [email protected] R=lookuphost T=remote smtp H=mx2.mail.yahoo.com-[67.28.113.70) 2006-05-01 20:31:41 1Fajjo-0002WM-Eb Completed

Again second message going fr om Carol's address to her Yahoo Email Address:

2006-05-01 23:01:31 1Fam40-0007NG-U3 <= [email protected] U=ftpsalf P=local S~4221 [email protected] 2006-05-01 23:01:35 1Fam40-0007NG-U3 => me1ongo [email protected] R=lookuphost T=remote smtp H=mx2.mail.yahoo.com-[67.28.113.72) 2006-05-01 23:01 :35 1Fam40-0007NG-U3 Completed

On 5 / 4/06, Carol Spizzirri <cspizzirri@salf . org> wrote : > > > -----Original Message-----> From: Christian B. Sass (mailto:[email protected]) > Sent: Monday, May 01, 2006 11:31 PM > To: Carol Spizzirri > Cc: [email protected]; vdavis@salf . org; Brian J. Salerno > Subject: Regarding the prior email ... > > Carol , > > :> I noticed that you weren't actually included in the recipient list of the > following email, which may explain the cryptic voice mail you might have > already heard from me . > > > :> :> :>

:> On May 1, 2006, at 8: 17 PM, Melongo Annabel wrote: > >