Gary McKinnon intrusions into NASA and US military networks (indicted 2002)
What happened
On 12 November 2002 a federal grand jury in Alexandria, Virginia returned a seven-count indictment against Gary McKinnon, a British citizen, and a grand jury in Newark returned a further one-count indictment. Prosecutors alleged that between March 2001 and March 2002 he accessed and damaged without authorisation 92 computers belonging to the US Army, Navy, Air Force, Department of Defense and NASA, together with six computers belonging to private businesses, at a total estimated loss of approximately $900,000. The Virginia indictment lists NASA installations at Hampton, Virginia; Houston, Texas; Greenbelt, Maryland; Huntsville, Alabama; Moffett Field, California; and Herndon, Virginia. The alleged conduct was consistent across targets: obtaining administrator privileges, installing the remote-access tool RemotelyAnywhere, copying files containing usernames and encrypted passwords, and deleting user accounts and critical system files, including approximately 1,300 user accounts. The New Jersey count concerns Naval Weapons Station Earle at Colts Neck, where prosecutors alleged McKinnon took 950 passwords from servers between April and June 2001 and forced the network's shutdown on 23 September 2001; that computer, in Computerworld's words, "was used by the Navy to monitor the identity, location, physical condition, staffing, battle readiness and resupply of Navy ships in the area".
HOLD RECOMMENDED. The sourcing is sound but the space nexus is the weakest in this batch: the charging documents establish that NASA computers at six named locations were compromised and say nothing about whether any of them was a mission system. Everything mapped here is charged conduct, not adjudicated fact; McKinnon was never tried, and the UK Home Secretary blocked his extradition in October 2012. Two matters that define the case publicly are deliberately unmapped because they bear on the case rather than on the technique record: his stated motive of searching for suppressed information about unidentified flying objects, and the extradition proceedings. The brief for this work dated the incident 1999-2001; the charging documents cover February 2001 to March 2002 and the record follows them. Two of the four techniques SPARTA is recorded as citing for McKinnon rest on a September 2000 article about a different defendant, Jason Diekman, and are rejected on that basis rather than on scope. SCOPE UNDETERMINED, recorded 2026-08-22. Whether this record belongs in this corpus has not been established, and the hold recommended above is the same question asked before the boundary was written down. A record is admitted here when a space system, meaning a spacecraft, a mission ground segment, a tracking or command path or a launch system, is in the attack path; the victim being a space-sector organisation is expressly not the test. What the sources establish is the conduct on each machine: administrator privileges obtained, a remote-access tool installed, files of usernames and encrypted passwords copied, and about 1,300 user accounts and critical system files deleted, across 92 US Army, Navy, Air Force, Department of Defense and NASA computers and six private-business computers. The NASA machines are identified by installation location only and no source describes the function of any of them. The one endpoint whose function is described, the Naval Weapons Station Earle system, monitored the identity, location, condition, staffing, readiness and resupply of Navy ships and has no space element. The technique rationales on this record already characterise the systems named as agency IT rather than mission systems, and no cited source either confirms that characterisation or contradicts it. A charging document, Department of Justice statement, NASA Office of Inspector General report or later court filing naming a spacecraft, a mission operations or tracking and command network, a ground station, or mission or telemetry data among what was reached would settle it one way; a source characterising the reached NASA machines as general-purpose agency computers with no connection to mission infrastructure would settle it the other. Three retrievals are the most likely to do either: the Department of Justice announcement of 12 November 2002, a court-issued copy of the Eastern District of Virginia indictment, and the UK extradition judgments. Both Department of Justice releases were read on 23 August 2026 and neither settles it. There are two, a week apart, and the one held here as a source is the later: the 12 November Eastern District of Virginia announcement, and the 18 November District of New Jersey one on the Naval Weapons Station Earle intrusion. NASA appears four times in the first and once in the second, always as a victim or an investigating agency and never with a machine's function described; spacecraft, telemetry, tracking, ground station, launch, satellite and orbit appear zero times in both, and the only two occurrences of mission are Earle's munitions resupply, already recorded as having no space element. Both fail the naming condition outright, and both fail the characterising one, because silence about what the machines were is no characterisation. Absence on both, not a near miss. Outstanding: a court copy of the indictment, and the UK judgments. The record stays published while the question is open, under decisions entry 189.
Attack vector
According to prosecutors, scanning of tens of thousands of systems followed by exploitation of known Windows vulnerabilities, then acquisition of administrator privileges and installation of the RemotelyAnywhere remote-access tool.
Operational impact
The Naval Weapons Station Earle network was forced into shutdown on 23 September 2001, and prosecutors described one military network shutdown lasting three days. No source found for this record states any operational effect on a NASA mission, spacecraft or ground control system; NASA installations appear in the charging documents as locations of compromised computers, without their function being characterised.
Data compromised
Files containing usernames and encrypted passwords; 950 passwords taken from seven servers at Naval Weapons Station Earle. Approximately 1,300 user accounts and unspecified critical system files were deleted rather than taken.
Disclosed
2002-11-12
SPARTA techniques evidenced
Each row is a technique this record evidences, with the reasoning and the source that attests to it.
What relationship, confidence, and evidence mean on the rows below
- Relationship
What kind of link this is between the technique and the target.
Mitigates: the target actively prevents, detects, or recovers from the technique.
Addresses: the target governs the technique or is relevant to it, without interdicting it. Most governance and policy obligations sit here.
Triggers obligation: the technique occurring is what triggers the duty the target imposes.
Relates to: related to the technique, but the target neither interdicts nor governs it. Used sparingly.
- Confidence
How strongly the source supports this mapping, not how severe the technique is.
High: the source supports the mapping squarely.
Moderate: supported, with a qualification such as a cross-tactic reading that stays operationally sound.
Low: the source reaches the technique only in part.
- Evidence
How close to the source text the mapping was made.
Direct: a verbatim excerpt of the cited source was read against the technique, and the rationale argues from that excerpt.
Derived: the mapping follows from the source's scope or structure, with no on-point excerpt addressing the technique.
Inferred: reached by composition through another framework, or by domain reasoning the source does not support on its face.
Prosecutors alleged that the Naval Weapons Station Earle network was forced into shutdown on 23 September 2001, eliminating rather than degrading its use, and that one military network was shut down for three days. IMP-0003 is the elimination of the use, access or operation of a system for a period. The edge is derived because IMP-0003 is written around denying ground controllers and interested parties access to a spacecraft or its data, and the Earle system is naval logistics monitoring with no space nexus.
The indictment alleges deletion of approximately 1,300 user accounts and of critical system files, and prosecutors described one military network shutdown lasting three days. IMP-0005's scope covers destroying data and commands, not only destroying a spacecraft, and destroyed data is what is charged. Confidence is moderate because this is charged conduct that was never tried, and because the systems named are agency IT rather than mission systems.
The indictment alleges that McKinnon obtained administrator privileges and installed RemotelyAnywhere, a remote-access tool, on compromised systems across a campaign of roughly thirteen months. That is retained access maintained by deliberate tooling rather than a single opportunistic entry. The edge is derived because the charging documents place the compromised NASA machines by installation location without characterising any of them as mission ground infrastructure with end-to-end reach to a spacecraft, which is PER-0003's own qualifier.
Considered and not mapped
These techniques were considered for this record because a source, a related record or SPARTA's own catalogue pointed at them. Each was read against what the sources say and not mapped. The reason is given in full.
No source reports data being siphoned from NASA mission ground infrastructure. What is charged is intrusion, credential copying and destruction.
The indictment alleges McKinnon copied files containing usernames and encrypted passwords, and took 950 passwords from Earle. Credentials are not the mission data IMP-0006 is about, and no source reports mission or science data leaving any NASA system. The same distinction is applied on
noaa-nesdis-intrusion-2014, where credential and configuration theft is also not mapped to IMP-0006.Cited by SPARTA against the Telegraph profile of McKinnon. Nothing in the case involves renting time on a commercial ground network or on ground-station-as-a-service, legitimately or through a compromised customer account. A pure context citation.
Not actually cited for McKinnon. The SPARTA reference behind these two is a September 2000 article in The Register whose subject is Jason Diekman, a 20-year-old arrested in California and charged over intrusions into JPL and into university systems at Stanford, Harvard and Cornell. It cannot be about McKinnon: it predates the charged conduct by five months. This is a counting error in the brief, not a mapping decision. Its sibling
REC-0009is rejected on the same ground. Seenasa-jpl-gap-analysis.md.Not actually cited for McKinnon. The SPARTA reference behind these two is a September 2000 article in The Register whose subject is Jason Diekman, a 20-year-old arrested in California and charged over intrusions into JPL and into university systems at Stanford, Harvard and Cornell. It cannot be about McKinnon: it predates the charged conduct by five months. This is a counting error in the brief, not a mapping decision. Its sibling
REC-0008is rejected on the same ground. Seenasa-jpl-gap-analysis.md.
Sources
The published accounts this record rests on. The tier is SafeMode Space's own assessment of the source, and the reason for it is given beside it. What the tiers mean and how they are assigned: the source tiers.
A source is listed when a mapped technique rests on it, or when it disputes the account. One the curators read but neither cited nor recorded as disputing the record is not listed, so an absence here means neither is true rather than that nobody looked.
Tier 2: A public transcription of a court document, not a court-issued copy. The underlying document is primary; the transcription is not, so the tier reflects the copy rather than the original. Every figure taken from it is corroborated independently by the Computerworld report.
Tier 1: The prosecuting department's own announcement of the indictments, and the authoritative statement of what was charged.
Tier 2: Named same-day reporting on the indictments by an established trade title, reporting the prosecution's account. Independent of the transcription used as source 1, which is why it is the corroborating check on its figures.
Every source SafeMode Space reproduces, and on what terms: sources and attribution.