131 how Computer intruders operate 371 Internet is increasing. Computer intrusions have become such a problem that it is considered to be a national security risk by many developing countries. Despite the seriousness of this problem, many organizations are reluctant to report intrusions to law enforcement for a variety of reasons. Given the growing threat, it is important to track down the perpetrators of these crimes, bring them to justice, and discourage others from following in their footsteps. Even if an organization decides not to prosecute an individual who targets their systems, a thorough investigation can help determine the extent of the damage, prevent future attacks, and mitigate any associated liabil- ity to shareholders, customers, or other organizations that were attacked. This chapter discusses how to investigate computer intruders and presents ways to determine an intruder's intent, motivations, and skill level. 13.1 hOW COMPuTER INTRuDERS OPERATE A thorough understanding of the tactics and techniques used by criminals is essential to the successful investigation of criminal behavior. Just as this is true