January 27. Bruce Koball, a Berkeley, California software designer finds hundreds of megabytes of software in an account he has been using infrequently on the Well, a Sausalito, California online service. Late in the evening he receives the next day's edition of the New York Times, which contains a profile of Tsutomu. He realizes it is Tsutomu's software that has been illegally stashed in his account.
January 28. Koball calls Tsutomu and tells him his stolen data is on the Well. Tsutomu calls the Well and asks them to remove his stolen data and electronic mail. Well managers ask Tsutomu to come to Sausalito to help with their security problems. He already has commitments, but he asks Andrew Gross to go in his place.
February 4. A fourth voice mail message, complaining about the posting of the first two messages, is left.
February 5. Andrew calls Tsutomu and tells him that the situation is far more serious than he expected. He has found millions of dollars worth of stolen software. Tsutomu agrees to drive down from a ski cabin in Truckee, California the next day and help.
February 7. Tsutomu sets up additional monitoring gear and finds that the intruder is using the Well as a staging base for attacks on corporate and university computers all over the Internet. The attacker keeps his tools at the Well and then uses them to break-in to a succession of systems. He finds a series of clues that the attacker may be Kevin Mitnick, a well known computer criminal, who is a fugitive for a parole violation and who is suspected in a number of computer break-ins.