|Sunday, July 7, 1996, 6:19pm EDT (10:19pm GMT)||Hillyard posted a message to mindspring.local.atlanta saying he and others despised me.|
|Sunday, July 7, 1996, from about 6pm EDT (10pm GMT) until almost 9pm EDT (1am GMT)||I began receiving email from Richard Hillyard, using his account at MindSpring (email address firstname.lastname@example.org, IP address 188.8.131.52). After the second message, I replied via email stating that I wished no further communication with him, and copied my message to email@example.com. He sent one more email, then started sending more copies of the same messages, as well as new and increasingly obscene messages, arrived after being sent through two anonymous remailers (flame.alias.net and shell.portal.com), and I complained to MindSpring again. Then obscene email was sent to Katie's mailbox through the same anonymous remailers, with much of the same verbiage. The switch was surprisingly stupid (just how anonymous could he possibly think he was at that point? He had signed his name, Richard Hillyard, to one of the emails he sent to me.
MindSpring did finally lock Hillyard out of his account. Annoyed and curious as to who this stranger was, I started doing research on him using various directories and search engines on the internet. I found that he had quite a history of abuse, making me wonder just why he was getting away with forging messages and sending abusive email while keeping his MindSpring account. (I'm making some of the information I gathered during that research and from various resources in the year since then available to those interested in the case.)
|Sunday, July 7, 1996, approximately 10pm EDT (3am GMT)||Annoyed that it took MindSpring several hours to stop the email I was receiving from Hillyard, I posted a request for information to mindspring.discussion, asking if others had also received harassing email from Hillyard. I made it clear in that message that I knew who Hillyard was and that if he continued to harass me I would publish his street address, phone number and other information that he'd made available on the net. I told him that he was very foolish to harass people when he'd been so free with information about his own family.|
|Monday, July 8, 1996, time unknown||According to Hillyard, he called MindSpring saying he couldn't access his account. At one time he claimed they said nothing to him about the account being abused. At another time he said his account had been hacked by someone who had the password, and that MindSpring changed the password and told him to be more careful in the future.|
|Friday, July 12, 1996, beginning around 9:30 am EDT (about 1:30pm GMT)||Hillyard posted a response to my message in mindspring.discussion and emailed a copy to me, despite having been told not to send me any email. Half an hour later he sent and posted another message, having changed it and added a few more personal attacks--and the phrase "I am threatening you." He claimed that he had never heard of me before my message on 7/8, that there had never been any messages sent to me or about me from his account and stated that any more "vicious attacks" from me would be forwarded to his attorney. He suggested that I might have hacked his account, and began forge-cancelling posts made by anyone who did not agree with him. All the fraudulent cancel messages were from the IP address 184.108.40.206, which was assigned to Richard Hillyard. He also claimed to have no idea what an anonymous remailer was, despite the fact that he'd been posting from his MindSpring account with an anon.penet.fi email address since May (he hadn't yet known how to use one properly in May and June, but he obviously knew what a remailer was well before July--and he had shown the same sort of cowardice he later displayed when attacking me in pseudo-anonymity, asking people to mailbomb someone with whom he had disagreed). He'd also been testing Private Idaho, a utility designed to make it easier to achieve anonymity on the net, in June from his MindSpring account.|
|Saturday, July 13 thru Sunday, July 14||One of the people whose posts were fraudulently cancelled by Hillyard posted a public notice to MindSpring's news administrator, Esa Ahola. He noted that a post he'd made at 10:59am had been cancelled, as had posts by two other users--but that neither he nor the other users cancelled the posts. Esa replied that the messages had been forge-cancelled and that he was investigating. Another user whose posts were forge-cancelled complained publicly. Someone else pointed out the fact that Hillyard's IP address was in all the forged cancellations, and I mentioned that it was also in the obscene email I received as well as posts made by Hillyard (using the names firstname.lastname@example.org, email@example.com, firstname.lastname@example.org, and email@example.com, among others) to rec.sport.football.college and various aquarium-related newsgroups in the past. I posted the headers of an obscene message Hillyard had forged in another person's name to rec.sport.football.college, and another message in which Hillyard asked other people to mailbomb someone he didn't like. In some of his posts to the aquaria newsgroups Hillyard also gave his email addresses at work at the CDC. I also expressed extreme dissatisfaction with the fact that MindSpring was still providing Hillyard with internet access.|
|Sunday, July 14, 1996, 8:19pm||Hillyard sent another email to me saying that he would "respond by courier to (me) at the address of your apartment this week." I forwarded the email to MindSpring, asking them why I was still receiving email from Hillyard, when they knew he had been told not to send me any email and their own acceptable use policy states that sending email to someone who has stated that they do not wish to correspond with you is harassment. No response from MindSpring.|
|Sunday, July 14, 1996, 8:56pm||Hillyard sent me yet another email. The subject line was "apology". He claimed that 23-year-old son and 21-year-old daughter's boyfriend sent the original email messages to me, and that his "children" (his term) had been punished. He stated that he believed his reactions were wholly justified since it wasn't his fault that his account had been used to harass us. I believe he realized at that point that he'd screwed up and was definitely going to lose his MindSpring account. I saw no need to reply.|
|Monday, July 15, 1996, 2:58pm||On July 15, Mike McQuary, MindSpring's CEO, took the unusual step of responding in mindspring.discussion to the many users who wanted to know why MindSpring, an ISP that was known for stomping out net abuse with absolutely no mercy, had permitted an obvious abuser to continue using their system for a week after they were first notified of their actions. He said that Hillyard's account had been cancelled, and that from now on MindSpring would enforce a "one strike and you're out" policy regarding net abuse. Thinking that would be the end of the incident, I discarded most of the email he'd sent--I have no reason to keep such unpleasantness on my system.|
|Monday, July 15, 9:18pm||I received email from Duck4267@gnn.com. The message said "Your fun is about to begin. Watch your back! I got your name off of a usenet newsgroup. You should be receiving hundreds of messages from secret admirers." A short time later a message from the same account appeared in atl.general, quoting one of the messages from the original discussion in mindspring.local.atlanta that started the whole mess back on July 7. It was, in fact, one of the same messages quoted in the anonymous email sent to me and Katie and July 7. Only a current or former MindSpring subscriber would have access to those messages. The message was a fairly mild attack on me and another person who'd disagreed with Hillyard. That person also received an email from "Duck" that evening.|
|From 4:30am Tuesday, July 16 to 3:28am Wednesday, July 17, 1996||Dick Coward used one of the anonymous remailers Hillyard used to send the obscene messages on July 7 (flame.alias.net) as well as a new remailer (basement.replay.com) to make four cowardly posts to alt.sex.prostitution and alt.sex.services. All four posts claimed to be "Undre" (the handle of another person who had disagreed with Hillyard, and whose posts Hillyard had cancelled), stated that I was a prostitute offering "Olympic specials" and instructed those interested in my services to send me email for details. Please note that those messages appeared a day after I received the email from Duck4267@gnn.com that was purportedly a response to those posts.
I began receiving hundreds of emails from men wanting to make appointments. I received nasty flaming email from people attacking me because they believed me to be a prostitute who had put a picture of my child on my web site, saying I was a terrible mother and so on. Some of these people threatened to contact the department of family and children's services to try and have my daughter taken from me. I finally had to set up an autoresponder explaining that I am not a prostitute and did not post those messages. I explained the conflict between myself and Hillyard and the previous harassment, and provided all the information I had about Hillyard as I'd warned him I would. I did not encourage anyone to harass Hillyard. The flow of email slowed after a few days, but hasn't ever entirely ended.
|Tuesday, July 16, 1996, 6:17pm||Duck4267@gnn.com made more posts to atl.general, attacking MindSpring and me in the same way that the messages from the CDC did. In one of those messages, "Duck" admitted that he was Hillyard.
I also received email from someone asking permission to include me in their adult entertainment directory. My answer was, of course, no. I was pleased that at least they asked!
|Wednesday, July 17, 1996||I contacted the Dekalb County police about the problem for the first time, but they wouldn't even take a police report, insisting that anything on the internet was simply not their problem. They said even if it were in their jurisdiction, it be a civil offense and therefore I'd have to get a private attorney to take it to court.
I began seeking help from other sources, and contacted the CyberAngels, which is the online presence of the well-known Guardian Angels. They were very helpful. While I did not need technical help as much as most of the people who contact them about harassment on the internet, their encouragement was very important to me. I have remained in contact with them since then, and they have been very supportive.
|Tuesday, July 17, early morning||Sometime in the wee hours of July 17 someone attacked MindSpring's web/ftp servers and took them down. MindSpring's engineers had to restore from a backup tape, and it took several hours to get them running properly again.|
|Tuesday, July 17 thru Thursday, July 19||Someone began posting messages to atl.general attacking me and MindSpring, and issuing forged cancel messages for posts from those who disagreed with them. The messages crowed loudly about MindSpring's web/ftp servers being down, although most people outside MindSpring engineering didn't even know of the outage yet. The posts and cancel messages came from machines inside the offices of the CDC in Atlanta--the same machines he had used before and after this incident to post messages to other newsgroups using several of his acknowledged email addresses. Hillyard had previously listed himself in several of the "people directories" on the web and had given his email address at work at the CDC, as well as his home address and phone number. The CDC gets its newsfeed from airnews.net, so that appears in most of the headers of messages posted through the CDC. The handles used were "firstname.lastname@example.org" (The Centipede or Mr. Legg) and email@example.com. Hillyard had also used the "centipede" alias in posts to rec.sport.football.college.|
|Tuesday, July 17, 1997||I and many other MindSpring customers complained to firstname.lastname@example.org and email@example.com about the messages coming from their systems. I never received any replies to those messages, and as far as I know neither did anyone else. The CyberAngels suggested that I contact Hillyard's boss at the CDC, so I started trying to find out who that might be.|
|Wednesday, July 18, 1997||I learned that Hillyard worked in the CDC's Information Resource Management Office as a contractor, that the contract firm was The Orkand Cooperation, and that Jim Seligman was the director of that department. That department, as I understand it, is in charge of all the computers for the CDC's operations and is considered a high security area. I began trying to reach Mr. Seligman, who was apparently out of town.|
|Wednesday, July 18, 10:46pm||Hillyard posted a message to atl.general with the subject line "This is the real Richard Hillyard." In his message he claimed that he had never made any posts before that one to atl.general, and that he was not "Duck" or "Centipede," but that someone else at the CDC may have been posting the messages and he would "put a stop to it." He again blamed his 23-year-old son Ricky for harassing me, and said that Ricky had gone back to Florida to live with his mother because he was angry about being punished. He tried to imply that he didn't know anything was going on until he read something in mindspring.discussion a week after the original incident, and that he confronted his son right then--implying that he wasn't responsible for the messages he posted to that newsgroup or the forged cancellations there. He said he had talked about the matter with some people at work and that maybe they were sending the messages. If so, he's one of the unluckiest people on earth--first his kid gets him in trouble, then his coworkers? Using the same tactics, the same language, the same targets? After that, the only messages in the relevant threads that came from the CDC were the forged cancellations (not just of "Duck" and "Centipede's" remarks, but posts by anyone who had participated in those discussions). Mark Barnett posted a copy of the same message to mindspring.discussion, stirring up further discussion about Hillyard.|
|Sunday, July 22, 1996||I finally spoke to Mr. Seligman on the phone, and he asked that I email him all the posts that were made from the CDC and any other relevant information. Seligman later told a Dekalb County police detective that at first he assumed I was a jilted lover of Hillyard's who wanted to make trouble for him. After he saw the evidence, though, he realized that he'd been too hasty. He had his own technical people verify the facts, then had a meeting with Hillyard and someone from Orkand. That meeting took place sometime in late July or early August. They put Hillyard on notice that he wasn't to use the CDC's computers for anything that wasn't work related and told him that further misuse of those systems would result in losing his job. Hillyard was not, however, told that they had also put a packet sniffer on the network connections of the machines he used there, to track anything he sent via their system. Seligman asked that I notify him if I saw any posts from the CDC system to any newsgroups.|
|*I do not provide direct links to newsgroups in the mindspring.* hierarchy, as they are only accessible to MindSpring's customers. In fact, neither of these groups exists now, as MindSpring reorganized all the groups in its hierarchy.|