GT Docs 9

From: "Antonakakis, Manos" </O=EXCHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP
(FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=7E6B0AFC581E477DB35A37C3A3A79AEB-ANTONAKAKIS>
Sent on: Saturday, August 4, 2018 6:52:59 PM
To: Angelos D. Keromytis >
Subject: Re: Curious
Call and I will explain.
—
Manos Antonakakis | manos@gatech.edu
Georgia Institute of Technology
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Angelos D. Keromytis
Sent: Saturday, August 4, 2018 1:52:22 PM
To: Antonakakis, Manos
Subject: Re: Curious
??
> On Aug 4, 2018, at 1:50 PM, Antonakakis, Manos <manos@gatech.edu> wrote:

>
> No news this week because I was in DC for private business JMS. Just got of the phone with Chris. He got some
feedback from the Brandon and his team. It looks like we have been played, big time.
>
> While I will handle my political exposure in GT alone, I will make sure that Panos, Jeremy and Thanos will not publish
anything they found so far, I would like your thoughts and guidance on the effort that me and my team should spend on
this problem moving forward. Evidently, they do not care about us or our research. They care about getting fast access to
the GT network. That's it.
>
>—
> Manos Antonakakis | manos@gatech.edu
> Georgia Institute of Technology
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: Jonathan M. Smith <jms@cis.upenn.edu>
> Sent: Saturday, August 4, 2018 9:59:05 AM
> To: Antonakakis, Manos
> Subject: Curious
>
> Manos:
> Any progress on things?
>
> On another note, I was screwing around with the readership feature of the
> online paper archival at Penn and it now has a geo interface. I have attached
> a snapshot from it - quite interesting!
> Best,
> -JMS
>
> Jonathan M. Smith
> Professor of CIS and Pompa Chair
> T: 215.898.9509; E: jms@cis.upenn.edu<mailto:jms@cis.upenn.edu>
>
>
>
Sent on: Wednesday, October 25, 2017 4:41:18 PM
To: Antonakakis, Manos <manos@gatech.edu>
Subject: Re: CV
Cool.
> On Oct 25, 2017, at 11:37, Antonakakis, Manos <manos@gatech.edu> wrote:

>
> FYI-
>
>—
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: Ahamad, Mustaque
> Sent: Wednesday, October 25, 2017 10:35 AM
> To: Sarkar, Vivek; Gavrilovska Habl, Ada; Orso, Alessandro; Lee, Wenke; Kim, Taesoo; Navathe, Shamkant B; Lance
Fortnow; Ammar, Mostafa H; Payton, Kenya V; Antonakakis, Manos
> Subject: FW: CV
>
> Stelios just sent his CV. See attached.
>
> Vivek, have you been in touch with him about possible dates? Hopefully the week of 11/27 works for him. He did not
want to visit before Thanksgiving and several of us are away the week of December 4.
>
> He can come 11/27 evening, do the talk on the 28th and leave on the 29th. Alternatively, he can come on the 29th, talk
on the 30th and get done on December 1st. There is a DARPA PI meeting on December 1st but those attending it can
meet Stelios on Thursday.
>
> Also copying Manos whom he should meet. Please include him as you work to figure out the visit dates.
>
> Mustaque
>
>
> On 10/25/17, 10:24 AM, "Stelios Sidiroglou-Douskos" <stelios@csail.mit.edu> wrote:
>
> Hi Mustaque,
>
> Attached you will find an updated CV.
> Please let me know if you need anything else from my end.
>
> best,
> Stelios
>
>
>
>
Sent on: Tuesday, May 8, 2018 7:08:54 PM
To: Tejas Patel <tejas@kududyn.com>
CC: Schneck, Christopher (contr-i2o) <christopher.schneck.ctr@darpa.mil>; Keromytis, Angelos
<angelos.keromytis@darpa.mil>; Smith, Jonathan <jonathan.smith@darpa.mil>
Subject: Re: Cyber Threat Initiatives
Will do, yes.
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Tejas Patel <tejas@kududyn.com>
Sent: Tuesday, May 8, 2018 12:33:45 PM
Cc: Schneck, Christopher (contr-i2o); Keromytis, Angelos; Smith, Jonathan
Manos,
Likewise. Let me know logistics and I'll work it into my schedule.
Regards,
Tejas
Tejas Patel
Principal investigator
Kudu Dynamics
+1 919-332-3191 (c)
tejas@kududyn.com<mailto:tejas@kududyn.com>
On Tue, May 8, 2018 at 8:41 AM, Antonakakis, Manos <manos@gatech.edu<mailto:manos@gatech.edu>> wrote:

Yes, Sir. Will do.
—
Manos Antonakakis | manos@gatech.edu<mailto:manos@gatech.edu>
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Schneck, Christopher (contr-i2o) <christopher.schneck.ctr@darpa.mil<mailto:christopher.schneck.ctr@darpa.mil>>
Sent: Tuesday, May 8, 2018 7:20:54 AM
To: Antonakakis, Manos; Keromytis, Angelos; Smith, Jonathan; tejas@kududyn.com<mailto:tejas@kududyn.com>
Subject: RE: Cyber Threat Initiatives
Manos,
I planned on coming out on the 7th so count me in for the meetings. Let me
know when you have nailed down a time for the morning meeting.
Chris Schneck
DARPA I2O SETA
Office: 571-218-4429
Cell: 571-524-3821
-----Original Message-----
From: Antonakakis, Manos <manos@gatech.edu<mailto:manos@gatech.edu>>
Sent: Monday, May 7, 2018 4:38 PM
To: Keromytis, Angelos <angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>; Smith, Jonathan
<jonathan.smith@darpa.mil<mailto:jonathan.smith@darpa.mil>>; Schneck, Christopher (contr-i2o)
<christopher.schneck.ctr@darpa.mil<mailto:christopher.schneck.ctr@darpa.mil>>; tejas@kududyn.com<
mailto:tejas@kududyn.com>
Subject: Fw: Cyber Threat Initiatives
Not sure if any/all of you need to be here. We would be happy to have you.
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Antonakakis, Manos
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY; Farrell, Michael D;
Mitchell, Michael F
Cc: Demar, Jeremy; Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI
AFOSI/ICON; VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY; GEE, TYSON L SA
USAF AFOSI AFOSI/XRC
Very cool, Jason.
I will work with Michael to get you first thing in the morning. We will have
breakfast and lunch served at the meeting, which will be held at Klaus
Advance Computer Building. We will nail down the room as we get closer.
If you do not mind give me a call so I can assess the time we

want based on the things you and your team want to hear from us.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
<jason.stambaugh@us.af.mil<mailto:jason.stambaugh@us.af.mil>>
Sent: Monday, May 7, 2018 4:32:21 PM
To: Antonakakis, Manos; Farrell, Michael D; Mitchell, Michael F
Manos,
I am tentatively projecting 3 individuals (me & 2 others). To my knowledge,

there are no dietary restrictions but I will verify.
Thanks very much!
Jason D. Stambaugh, SA, USAF

Deputy PM for Cyber Training
AFOSI Cyber Investigations & Ops
Comm: (571) 305-8850

DSN: 240-8850
NSTS: 918-5739
SIPR: jason.d.stambaugh2.mil@mail.smil.mil<mailto:jason.d.stambaugh2.mil@mail.smil.mil>
JWICS: jason.stambaugh@af.ic.gov<mailto:jason.stambaugh@af.ic.gov>
From: Antonakakis, Manos [mailto:manos@gatech.edu<mailto:manos@gatech.edu>]
Sent: Monday, May 7, 2018 11:27 AM
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
<jason.stambaugh@us.af.mil<mailto:jason.stambaugh@us.af.mil>>;
Farrell, Michael D <Michael.Farrell@gtri.gatech.edu<mailto:Michael.Farrell@gtri.gatech.edu>>; Mitchell, Michael F
<michael.mitchell@ece.gatech.edu<mailto:michael.mitchell@ece.gatech.edu>>
Cc: Demar, Jeremy <jdemar3@gatech.edu<mailto:jdemar3@gatech.edu>>; Keromytis, Angelos
<angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>; OGBUAWA, OKECHUKWU N SA USAF AFOSI
AFOSI/ICON
<okechukwu.ogbuawa@us.af.mil<mailto:okechukwu.ogbuawa@us.af.mil>>; VELEZ, STEPHYNIE E SA USAF AFOSI
AFOSI/XRCY
<stephynie.velez@us.af.mil<mailto:stephynie.velez@us.af.mil>>; GEE, TYSON L SA USAF AFOSI AFOSI/XRC
<tyson.gee@us.af.mil<mailto:tyson.gee@us.af.mil>>
Subject: [Non-DoD Source] Re: Cyber Threat Initiatives
Jason, I am setting up a room for the day. Can you give me a count of people
you will have with you, and if there are any dietary restrictions?
Michael M., this is for your records --- the visit on June 7th, right before
the PI meeting.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Monday, May 7, 2018 11:15:27 AM
To: Antonakakis, Manos; Farrell, Michael D
Great! What time would you like to sync up...and where?
Thanks & Regards,

Comm: (571) 305-8850

DSN: 240-8850
NSTS: 918-5739
From: Antonakakis, Manos [mailto:manos@gatech.edu<mailto:manos@gatech.edu>]
Sent: Wednesday, May 2, 2018 5:28 PM
<jason.stambaugh@us.af.mil<mailto:jason.stambaugh@us.af.mil>>;
Farrell, Michael D <Michael.Farrell@gtri.gatech.edu<mailto:Michael.Farrell@gtri.gatech.edu>>
Cc: Demar, Jeremy <jdemar3@gatech.edu<mailto:jdemar3@gatech.edu>>; Keromytis, Angelos
<angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>; OGBUAWA, OKECHUKWU N SA USAF AFOSI
AFOSI/ICON
<okechukwu.ogbuawa@us.af.mil<mailto:okechukwu.ogbuawa@us.af.mil>>; VELEZ, STEPHYNIE E SA USAF AFOSI
AFOSI/XRCY
<stephynie.velez@us.af.mil<mailto:stephynie.velez@us.af.mil>>; GEE, TYSON L SA USAF AFOSI AFOSI/XRC
<tyson.gee@us.af.mil<mailto:tyson.gee@us.af.mil>>
This works for my team too. Booked my calendar for the entire morning.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Wednesday, May 2, 2018 8:41:13 AM
To: Farrell, Michael D
Cc: Antonakakis, Manos; Demar, Jeremy; Keromytis, Angelos; OGBUAWA,
OKECHUKWU N SA USAF AFOSI AFOSI/ICON; VELEZ, STEPHYNIE E SA USAF AFOSI
AFOSI/XRCY; GEE, TYSON L SA USAF AFOSI AFOSI/XRC
Michael,
The morning of the 7th sounds great to me. I'll check with my colleagues to
determine their availability.
Thanks & Regards,

Comm: (571) 305-8850

DSN: 240-8850
NSTS: 918-5739
From: Farrell, Michael [mailto:Michael.Farrell@gtri.gatech.edu<mailto:Michael.Farrell@gtri.gatech.edu>]
Sent: Wednesday, May 2, 2018 8:33 AM
Cc: Antonakakis, Emmanouil K <manos@gatech.edu<mailto:manos@gatech.edu>>; Demar, Jeremy
<jdemar3@gatech.edu<mailto:jdemar3@gatech.edu>>; Keromytis, Angelos
<angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>;
OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON
<okechukwu.ogbuawa@us.af.mil<mailto:okechukwu.ogbuawa@us.af.mil>>;
VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY <stephynie.velez@us.af.mil<mailto:stephynie.velez@us.af.mil>>;
GEE, TYSON L SA USAF AFOSI AFOSI/XRC <tyson.gee@us.af.mil<mailto:tyson.gee@us.af.mil>>
Hi Jason,
We'd be happy to sit down, as Manos mentioned. Also understand that it

makes sense logistically to try and tag it into an existing trip. Happy to
try and accommodate.
June 8 itself will be quite busy for us in hosting the meeting all day.
June 7 I have a few prior commitments already on the books, but I'm not
needed for the entire session so this could work. I'd suggest morning on
this day instead I afternoon as some of the team has a meeting in the
afternoon already planned.
Look forward to hosting you.
Best,
Michael
> On May 2, 2018, at 08:12, STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY

<jason.stambaugh@us.af.mil<mailto:jason.stambaugh@us.af.mil>> wrote:
>
> Manos,
>
> We would love to come to Georgia! We can absolutely keep this at unclass
for the meeting. If the other team members need to make contact afterward
via high-side channels, we can work that out.
>
> Would it be possible to schedule a day around the 8th to have the more
detailed meeting, since we'll already be in town?
>
> Thanks & Regards,
>
> Jason D. Stambaugh, SA, USAF
> Deputy PM for Cyber Training
> AFOSI Cyber Investigations & Ops
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
> SIPR: jason.d.stambaugh2.mil@mail.smil.mil<mailto:jason.d.stambaugh2.mil@mail.smil.mil>
> JWICS: jason.stambaugh@af.ic.gov<mailto:jason.stambaugh@af.ic.gov>
>
> -----Original Message-----
> From: Antonakakis, Manos [mailto:manos@gatech.edu<mailto:manos@gatech.edu>]
> Sent: Tuesday, May 1, 2018 8:18 PM
> To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
<jason.stambaugh@us.af.mil<mailto:jason.stambaugh@us.af.mil>>; Farrell, Michael D
<Michael.Farrell@gtri.gatech.edu<mailto:Michael.Farrell@gtri.gatech.edu>>; Demar, Jeremy
<jdemar3@gatech.edu<mailto:jdemar3@gatech.edu>>
> Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>; OGBUAWA,
OKECHUKWU N
SA USAF AFOSI AFOSI/ICON <okechukwu.ogbuawa@us.af.mil<mailto:okechukwu.ogbuawa@us.af.mil>>; VELEZ,
STEPHYNIE E
SA USAF AFOSI AFOSI/XRCY <stephynie.velez@us.af.mil<mailto:stephynie.velez@us.af.mil>>; GEE, TYSON L SA USAF
AFOSI AFOSI/XRC <tyson.gee@us.af.mil<mailto:tyson.gee@us.af.mil>>
> Subject: [Non-DoD Source] Re: Cyber Threat Initiatives
>
> Great Jason.
>
> Michael Farrell and Jeremy Demar should be in this meeting too. Michael is
CoPI (from GTRI) in this project and holds all necessary clearances for
discussions that needs to happen on the high side. Jeremy came out for the
Navy long time ago, and he is leading threat research in my team. I suspect
that you will have to work with him long-tem for any data sharing between
the two teams.
>
> Now, we could host you here at GT/GTRI and also have space for a
classified meeting made available. Note, only Michael for my team can attend
such a meeting. Thus, it would be the most beneficial for me to keep
everything at UNCLASSIFIED//FOUO level.
>
> If you want us to fly out, we could. Whatever works best for you and your
team.
>
> Angele, I am not sure if you, JMS, Tejas or Chris should also attend this
meeting.
>
> Thanks,
>
>-
> Manos Antonakakis | manos@gatech.edu<mailto:manos@gatech.edu>
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
> Sent: Monday, April 30, 2018 8:59:02 AM
> Cc: Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON;
VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY; GEE, TYSON L SA USAF AFOSI
AFOSI/XRC
> Subject: RE: Cyber Threat Initiatives
>
> Great! We will likely be in attendance for the Atlanta event on 8 Jun.
We should shoot for a date between 25 & 29 June for a more in-depth,
follow-on meeting. Both Stephynie and I will be in the office that week,
unless one of us has to make a trip to Hawaii.
>
> The first week of July looks pretty good too.
>
> Thanks & Regards,
>
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
>
>
> From: Antonakakis, Manos [mailto:manos@gatech.edu<mailto:manos@gatech.edu>]
> Sent: Friday, April 27, 2018 5:08 PM
> To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
> Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>; OGBUAWA,
OKECHUKWU N
SA USAF AFOSI AFOSI/ICON <okechukwu.ogbuawa@us.af.mil<mailto:okechukwu.ogbuawa@us.af.mil>>; VELEZ,
STEPHYNIE E
SA USAF AFOSI AFOSI/XRCY <stephynie.velez@us.af.mil<mailto:stephynie.velez@us.af.mil>>; GEE, TYSON L SA USAF
AFOSI AFOSI/XRC <tyson.gee@us.af.mil<mailto:tyson.gee@us.af.mil>>
>
> Hey Jason, good to hear from you!
>
> Yes, lets get something on the calendar and go from there. In the HACCS
meeting you saw just a small set of what we are working on. We plan to
expose a larger portion of their operations (current and past) in the
upcoming PI meeting in Atlanta (June 8th). I would suggest we schedule
something for mid/late June so you and your team will get the opportunity to
be exposed to the full spectrum of research we are doing on this particular
actor.
>
> I can fly out to meet you guys, or we are more than happy to host you at
Georgia Tech. Totally up to you.
>
> Does that sound reasonable to you?
>
> Thanks,
>
>-
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY
> Sent: Wednesday, April 25, 2018 2:11:55 PM
> Cc: Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON;
VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY; GEE, TYSON L SA USAF AFOSI
AFOSI/XRC
> Subject: Cyber Threat Initiatives
>
> Manos,
>
> Sorry for the delay in my follow up from our brief interaction at HACCS.
> I'd like to get you linked up with our ops side of the house to discuss
what you've learned about a threat we are interested in. We can host you
here in Quantico, out in San Antonio, or we can travel to you (whichever is
most convenient). As I mentioned previously, I would hope we could promote
a mutually-beneficial information-sharing relationship.
>
> For now, let's try to nail down a location, date, & time to meet and go
from there.
>
> Looking forward to this discussion!
>
> Thanks & Regards,
>
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
>
>
>
>
From: Keromytis, Angelos <angelos.keromytis@darpa.mil>
Sent on: Monday, May 7, 2018 9:44:05 PM
To: Antonakakis, Manos <manos@gatech.edu>; Smith, Jonathan <jonathan.smith@darpa.mil>; Schneck, Christopher
(contr-i2o) <christopher.schneck.ctr@darpa.mil>; tejas@kududyn.com
I don't know yet. Plan without me.
From: Antonakakis, Manos <manos@gatech.edu>
To: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Smith, Jonathan <jonathan.smith@darpa.mil>; Schneck,
Christopher (contr-i2o) <christopher.schneck.ctr@darpa.mil>; tejas@kududyn.com
Subject: Fw: Cyber Threat Initiatives
Not sure if any/all of you need to be here. We would be happy to have you.
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY; Farrell, Michael D; Mitchell, Michael F
Cc: Demar, Jeremy; Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON; VELEZ, STEPHYNIE E SA
USAF AFOSI AFOSI/XRCY; GEE, TYSON L SA USAF AFOSI AFOSI/XRC
Very cool, Jason.
I will work with Michael to get you first thing in the morning. We will have breakfast and lunch served at the meeting,
which will be held at Klaus Advance Computer Building. We will nail down the room as we get closer.
If you do not mind give me a call so I can assess the time we want based on the things you and your team
want to hear from us.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>
Sent: Monday, May 7, 2018 4:32:21 PM
To: Antonakakis, Manos; Farrell, Michael D; Mitchell, Michael F
Manos,
I am tentatively projecting 3 individuals (me & 2 others). To my knowledge, there are no dietary restrictions but I will
verify.
Thanks very much!

Comm: (571) 305-8850

DSN: 240-8850
NSTS: 918-5739
SIPR: jason.d.stambaugh2.mil@mail.smil.mil
JWICS: jason.stambaugh@af.ic.gov
From: Antonakakis, Manos [mailto:manos@gatech.edu]
Sent: Monday, May 7, 2018 11:27 AM
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>; Farrell, Michael D
<Michael.Farrell@gtri.gatech.edu>; Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
Cc: Demar, Jeremy <jdemar3@gatech.edu>; Keromytis, Angelos <angelos.keromytis@darpa.mil>; OGBUAWA,
OKECHUKWU N SA USAF AFOSI AFOSI/ICON <okechukwu.ogbuawa@us.af.mil>; VELEZ, STEPHYNIE E SA USAF AFOSI
AFOSI/XRCY <stephynie.velez@us.af.mil>; GEE, TYSON L SA USAF AFOSI AFOSI/XRC <tyson.gee@us.af.mil>
Jason, I am setting up a room for the day. Can you give me a count of people you will have with you, and if there are any
dietary restrictions?
Michael M., this is for your records --- the visit on June 7th, right before the PI meeting.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Monday, May 7, 2018 11:15:27 AM
To: Antonakakis, Manos; Farrell, Michael D
Great! What time would you like to sync up...and where?
Thanks & Regards,

Comm: (571) 305-8850
DSN: 240-8850
NSTS: 918-5739
Sent: Wednesday, May 2, 2018 5:28 PM
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>; Farrell, Michael D
<Michael.Farrell@gtri.gatech.edu>
Cc: Demar, Jeremy <jdemar3@gatech.edu>; Keromytis, Angelos <angelos.keromytis@darpa.mil>; OGBUAWA,
OKECHUKWU N SA USAF AFOSI AFOSI/ICON <okechukwu.ogbuawa@us.af.mil>; VELEZ, STEPHYNIE E SA USAF AFOSI
AFOSI/XRCY <stephynie.velez@us.af.mil>; GEE, TYSON L SA USAF AFOSI AFOSI/XRC <tyson.gee@us.af.mil>
This works for my team too. Booked my calendar for the entire morning.
Thanks,
-
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Wednesday, May 2, 2018 8:41:13 AM
To: Farrell, Michael D
Cc: Antonakakis, Manos; Demar, Jeremy; Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON;
VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY; GEE, TYSON L SA USAF AFOSI AFOSI/XRC
Michael,
The morning of the 7th sounds great to me. I'll check with my colleagues to determine their availability.
Thanks & Regards,

Comm: (571) 305-8850

DSN: 240-8850
NSTS: 918-5739
From: Farrell, Michael [mailto:Michael.Farrell@gtri.gatech.edu]
Sent: Wednesday, May 2, 2018 8:33 AM
To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>
Cc: Antonakakis, Emmanouil K <manos@gatech.edu>; Demar, Jeremy <jdemar3@gatech.edu>; Keromytis, Angelos
<angelos.keromytis@darpa.mil>; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON
<okechukwu.ogbuawa@us.af.mil>; VELEZ, STEPHYNIE E SA USAF AFOSI AFOSI/XRCY <stephynie.velez@us.af.mil>; GEE,
TYSON L SA USAF AFOSI AFOSI/XRC <tyson.gee@us.af.mil>
Hi Jason,
We'd be happy to sit down, as Manos mentioned. Also understand that it makes sense logistically to try and tag it into an
existing trip. Happy to try and accommodate.
June 8 itself will be quite busy for us in hosting the meeting all day.
June 7 I have a few prior commitments already on the books, but I'm not needed for the entire session so this could work.
I'd suggest morning on this day instead I afternoon as some of the team has a meeting in the afternoon already planned.
Look forward to hosting you.
Best,
Michael
> On May 2, 2018, at 08:12, STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil> wrote:
>
> Manos,
>
> We would love to come to Georgia! We can absolutely keep this at unclass for the meeting. If the other team members
need to make contact afterward via high-side channels, we can work that out.
>
> Would it be possible to schedule a day around the 8th to have the more detailed meeting, since we'll already be in
town?
>
> Thanks & Regards,
>
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
> SIPR: jason.d.stambaugh2.mil@mail.smil.mil
> JWICS: jason.stambaugh@af.ic.gov
>
> From: Antonakakis, Manos [mailto:manos@gatech.edu]
> Sent: Tuesday, May 1, 2018 8:18 PM
> To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>; Farrell, Michael D
<Michael.Farrell@gtri.gatech.edu>; Demar, Jeremy <jdemar3@gatech.edu>
> Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil>; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON
>
> Great Jason.
>
> Michael Farrell and Jeremy Demar should be in this meeting too. Michael is CoPI (from GTRI) in this project and holds all
necessary clearances for discussions that needs to happen on the high side. Jeremy came out for the Navy long time ago,
and he is leading threat research in my team. I suspect that you will have to work with him long-tem for any data sharing
between the two teams.
>
> Now, we could host you here at GT/GTRI and also have space for a classified meeting made available. Note, only
Michael for my team can attend such a meeting. Thus, it would be the most beneficial for me to keep everything at
UNCLASSIFIED//FOUO level.
>
> If you want us to fly out, we could. Whatever works best for you and your team.
>
> Angele, I am not sure if you, JMS, Tejas or Chris should also attend this meeting.
>
> Thanks,
>
>-
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>
> Sent: Monday, April 30, 2018 8:59:02 AM
> Cc: Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON; VELEZ, STEPHYNIE E SA USAF AFOSI
> Subject: RE: Cyber Threat Initiatives
>
> Great! We will likely be in attendance for the Atlanta event on 8 Jun. We should shoot for a date between 25 & 29 June
for a more in-depth, follow-on meeting. Both Stephynie and I will be in the office that week, unless one of us has to make
a trip to Hawaii.
>
> The first week of July looks pretty good too.
>
> Thanks & Regards,
>
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
>
>
> From: Antonakakis, Manos [mailto:manos@gatech.edu]
> Sent: Friday, April 27, 2018 5:08 PM
> To: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>
> Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil>; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON
>
> Hey Jason, good to hear from you!
>
> Yes, lets get something on the calendar and go from there. In the HACCS meeting you saw just a small set of what we
are working on. We plan to expose a larger portion of their operations (current and past) in the upcoming PI meeting in
Atlanta (June 8th). I would suggest we schedule something for mid/late June so you and your team will get the
opportunity to be exposed to the full spectrum of research we are doing on this particular actor.
>
> I can fly out to meet you guys, or we are more than happy to host you at Georgia Tech. Totally up to you.
>
> Does that sound reasonable to you?
>
> Thanks,
>
>-
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY <jason.stambaugh@us.af.mil>
> Sent: Wednesday, April 25, 2018 2:11:55 PM
> Cc: Keromytis, Angelos; OGBUAWA, OKECHUKWU N SA USAF AFOSI AFOSI/ICON; VELEZ, STEPHYNIE E SA USAF AFOSI
> Subject: Cyber Threat Initiatives
>
> Manos,
>
> Sorry for the delay in my follow up from our brief interaction at HACCS.
> I'd like to get you linked up with our ops side of the house to discuss what you've learned about a threat we are
interested in. We can host you here in Quantico, out in San Antonio, or we can travel to you (whichever is most
convenient). As I mentioned previously, I would hope we could promote a mutually-beneficial information-sharing
relationship.
>
> For now, let's try to nail down a location, date, & time to meet and go from there.
>
> Looking forward to this discussion!
>
> Thanks & Regards,
>
>
> Comm: (571) 305-8850
> DSN: 240-8850
> NSTS: 918-5739
>
>
>
>
>
Sent on: Wednesday, January 31, 2018 5:29:20 PM
Subject: Re: Daniel
Oh well.
> On Jan 31, 2018, at 12:13, Antonakakis, Manos <manos@gatech.edu> wrote:

>
> Angele please tell Jonathan that Alenka kill this case internally. The reason was that he works too close to her area (?!?).
>
> My apologies, but I tried.
>
>—
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: Jonathan M. Smith <jms@cis.upenn.edu>
> Sent: Monday, January 29, 2018 2:59 PM
> Subject: Daniel
>
> https://www.cis.upenn.edu/~danielg3/
>
> -JMS
>
> Jonathan M. Smith
> Pompa Professor, Professor of CIS
> University of Pennsylvania
> Philadelphia, PA 19104
Sent on: Monday, August 28, 2017 2:35:01 PM
CC: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>; dagon@sudo.sh
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Monday, August 28, 2017 2:34:59 PM
Subject: Re: DARPA domains
Attachments: Nameless.txt (961 Bytes)
Sent on: Wednesday, November 29, 2017 3:43:52 AM
To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB <danielle.gambino@us.af.mil>
CC: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>; Maddern,
Thomas (contr-i2o) <Thomas.Maddern.ctr@darpa.mil>
Subject: Re: DARPA EA PI Meeting - Draft Slides Due
Danielle, you should have the slides via AMRDEC.
As I noted in the AMRDEC email, while I have no problem presenting them in the PI meeting, I think we should restrict the
electronic distribution of this deck. There are too many TTPs listed that if they are accidentally leaked, we will be loosing
unique sources and methods we are using for this type of attribution analysis.
I will leave the final decision to Angelos, Tejas and Tom on this one.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Tuesday, November 28, 2017 5:32:06 PM
To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB
Cc: Keromytis, Angelos; Patel, Tejas (contr-i2o); Maddern, Thomas (contr-i2o)
Hey Danielle, I will send over the slide late Wednesday. Tejas and/or Angelos can explain the reason.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB <danielle.gambino@us.af.mil>
Sent: Tuesday, November 28, 2017 9:39:29 AM
To: ncostigan@behaviosec.com; ideutschmann@behaviosec.com; Brian Kirk; wrightr@ainfosec.com; dorar@ainfosec.com;
scott.tenaglia@invincea.com; chris.greamo@invincea.com; Antonakakis, Manos; mikef@kududyn.com; James Nuttall;
Ben.Radford@soteradefense.com; Emmy.thompson@soteradefense.com; James.lobb@soteradefense.com; Michelle
Lossau; schwab@isi.edu; brigidannc@usc.edu
Cc: Keromytis, Angelos; Patel, Tejas (contr-i2o); Maddern, Thomas (contr-i2o); GAMBINO, DANIELLE M CIV USAF AFMC
AFRL/RIGB
Subject: DARPA EA PI Meeting - Draft Slides Due
Good Morning,
This is a friendly reminder that your draft presentation material is due within three (3) days prior to each presentation.
Please upload your slides into the TFIMS file storage area. Alternatively, you are welcome to send the slides via AMRDEC
(in case TFIMS is giving you a hard time).
Looking forward to seeing everyone on Friday!
Safe Travels,
Danielle
Computer Scientist, Cyber Operations Branch (RIGB)

Air Force Research Laboratory
COMM: (315) 330-4822 DSN: 587-4822
NIPR: Danielle.Gambino@us.af.mil
JWICs: Danielle.Gambino@rome.ic.gov
Sent on: Wednesday, November 29, 2017 4:21:47 PM
Subject: Re: DARPA EA PI Meeting - Presentation Slide Distribution Statements
Folks, I just sent the properly annotated slides to everyone but Angelos. At this point I do not think there is anything else
that needs to be done from the GT side for the PI meeting.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Wednesday, November 29, 2017 10:46:19 AM
To: ncostigan@behaviosec.com; ideutschmann@behaviosec.com; Brian Kirk; wrightr@ainfosec.com; dorar@ainfosec.com;
scott.tenaglia@twosixlabs.com; Antonakakis, Manos; mikef@kududyn.com; James Nuttall;
Ben.Radford@soteradefense.com; Emmy.thompson@soteradefense.com; James.lobb@soteradefense.com;
schwab@isi.edu; brigidannc@usc.edu
Subject: DARPA EA PI Meeting - Presentation Slide Distribution Statements
Good Morning,
In preparation for Friday's PI meeting, we need to ensure the distribution markings are properly added to your slides.
Kudu and GT please add the following markings to your slides:
DISTRIBUTION F. Further Distribution authorized only as directed by AFRL/RIGB 525 Brooks Road, Rome NY 13441 or
higher DoD authority. 29 NOV 2017.
All other teams, please add the following to your slides:
DISTRIBUTION C. Distribution authorized to U.S. Government Agencies and their contractors; Administrative or
Operational Use; 29 NOV 2017. Other requests for this document shall be referred to AFRL/RIGB 525 Brooks Road, Rome
NY 13441.
Let me know if you have any questions.
v/r,
Danielle
Sent on: Monday, December 4, 2017 9:38:52 PM
Subject: Re: DARPA EA PI Meeting Slides
Just sent them to you via ARMDEC.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Monday, December 4, 2017 4:05:17 PM
To: ncostigan@behaviosec.com; ideutschmann@behaviosec.com; Brian Kirk; wrightr@ainfosec.com;
scott.tenaglia@twosixlabs.com; Antonakakis, Manos; mikef@kududyn.com; James Nuttall;
Ben.Radford@soteradefense.com; schwab@isi.edu
Cc: Keromytis, Angelos; Patel, Tejas (contr-i2o); Maddern, Thomas (contr-i2o); GAMBINO, DANIELLE M CIV USAF AFMC
AFRL/RIGB
Subject: RE: DARPA EA PI Meeting Slides
All,
My apologies, please keep the distro statement on the slides presented on Friday.
For future presentations, please do not include the distro statement.
Danielle
From: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB
Sent: Monday, December 04, 2017 3:13 PM
To: 'ncostigan@behaviosec.com' <ncostigan@behaviosec.com>; 'ideutschmann@behaviosec.com'
<ideutschmann@behaviosec.com>; 'Brian Kirk' <bkirk@behaviosec.com>; 'wrightr@ainfosec.com'
<wrightr@ainfosec.com>; 'scott.tenaglia@twosixlabs.com' <scott.tenaglia@twosixlabs.com>; 'Antonakakis, Manos'
<manos@gatech.edu>; 'mikef@kududyn.com' <mikef@kududyn.com>; 'James Nuttall' <james@kududyn.com>;
'Ben.Radford@soteradefense.com' <Ben.Radford@soteradefense.com>; 'schwab@isi.edu' <schwab@isi.edu>
Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>; 'Maddern,
Thomas (contr-i2o)' <Thomas.Maddern.ctr@darpa.mil>; GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB
<danielle.gambino@us.af.mil>
Subject: DARPA EA PI Meeting Slides
Good Afternoon,
It was so great seeing everyone on Friday! This is a friendly reminder that the final version of your presentations are due
NLT December 15. Please send them to everyone on the "cc" line via AMRDEC SAFE.
Angelos has requested that the distribution statements be removed from your presentations.
Let me know if you have any questions.
Kindest Regards,
Danielle
Computer Scientist, Cyber Operations Branch (RIGB) Air Force Research Laboratory
COMM: (315) 330-4822 DSN: 587-4822
From: Keromytis, Angelos<angelos.keromytis@darpa.mil>
Sent on: Wednesday, November 29, 2017 2:45:12 PM
To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB<danielle.gambino@us.af.mil>
CC: Antonakakis, Manos<manos@gatech.edu>; Patel, Tejas (contr-i2o)<tejas.patel.ctr@darpa.mil>;
Maddern, Thomas (contr-i2o)<Thomas.Maddern.ctr@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Wednesday, November 29, 2017 2:45:12 PM
Subject: Re: DARPA EA PI Slides Distro Statements
Attachments: Nameless.txt (3.66 KB)
I think only these and Kudu’s need to be Distro F. The rest can be B or C.
On Nov 29, 2017, at 09:35, GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB <danielle.gambino@us.af.mil>
wrote:
Manos: Thank you - downloaded successfully.
Angelos, Tejas, Tom: We need distribution markings on all the EA slides being presented on
Friday - these especially. Attached guidance as a reference. i.e. " DISTRIBUTION STATEMENT F.
Further Distribution authorized only as directed by AFRL/RIGB 525 Brooks Road, Rome NY
13441 or higher DoD authority. DD MMM YYYY." Please advise how you would like the
statement to read and I will send it out to all the performers.
Kindest Regards,
Danielle
Sent: Tuesday, November 28, 2017 10:44 PM
Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <

tejas.patel.ctr@darpa.mil>; Maddern, Thomas (contr-i2o) <Thomas.Maddern.ctr@darpa.mil>
Subject: [Non-DoD Source] Re: DARPA EA PI Meeting - Draft Slides Due
Danielle, you should have the slides via AMRDEC.
As I noted in the AMRDEC email, while I have no problem presenting them in the PI meeting, I
think we should restrict the electronic distribution of this deck. There are too many TTPs listed
that if they are accidentally leaked, we will be loosing unique sources and methods we are
using for this type of attribution analysis.
I will leave the final decision to Angelos, Tejas and Tom on this one.
Thanks,
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Tuesday, November 28, 2017 5:32:06 PM
To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB
Hey Danielle, I will send over the slide late Wednesday. Tejas and/or Angelos can explain the
reason.
Thanks,
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Tuesday, November 28, 2017 9:39:29 AM
To: ncostigan@behaviosec.com; ideutschmann@behaviosec.com; Brian Kirk;

wrightr@ainfosec.com; dorar@ainfosec.com; scott.tenaglia@invincea.com;
chris.greamo@invincea.com; Antonakakis, Manos; mikef@kududyn.com; James Nuttall;
Ben.Radford@soteradefense.com; Emmy.thompson@soteradefense.com;
James.lobb@soteradefense.com; Michelle Lossau; schwab@isi.edu; brigidannc@usc.edu
Cc: Keromytis, Angelos; Patel, Tejas (contr-i2o); Maddern, Thomas (contr-i2o); GAMBINO,
DANIELLE M CIV USAF AFMC AFRL/RIGB
Subject: DARPA EA PI Meeting - Draft Slides Due
Good Morning,
This is a friendly reminder that your draft presentation material is due within three (3) days
prior to each presentation. Please upload your slides into the TFIMS file storage area.
Alternatively, you are welcome to send the slides via AMRDEC (in case TFIMS is giving you a
hard time).
Looking forward to seeing everyone on Friday!
Safe Travels,
Danielle
Computer Scientist, Cyber Operations Branch (RIGB) Air Force Research Laboratory
COMM: (315) 330-4822 DSN: 587-4822
<Distribution Statements.png>
From: Antonakakis, Manos <manos@gatech.edu>
Sent on: Monday, June 4, 2018 2:27:35 PM
To: Smith, Jonathan <jonathan.smith@darpa.mil>
CC: Kintis, Panagiotis <kintis@gatech.edu>; Keromytis, Angelos <angelos.keromytis@darpa.mil>; Schneck, Christopher
(contr-i2o) <christopher.schneck.ctr@darpa.mil>
Subject: Re: DARPA Riser Selection
Ok, let meet in my office then at 15.30. Pano, send invites all around.
Thanks,
---
Typos due to mobile device ...
> On Jun 4, 2018, at 09:24, Smith, Jonathan <jonathan.smith@darpa.mil> wrote:

>
> Manos:
> Of course; before dinner.
> -JMS
>
>
> On 6/4/18, 9:09 AM, "Antonakakis, Manos" <manos@gatech.edu> wrote:
>
> JMS, Thursday we will have the AFOSI folks from San Antonio in the lab all day. They want a deeper dive into the
analysis we will present in the PI meeting on Friday. Chris and Tejas will be there as well.
>
> If we going to make this Thursday, it has to be late afternoon (around 15.00 or later).
>
> Thanks,
>
>—
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: Smith, Jonathan <jonathan.smith@darpa.mil>
> Sent: Monday, June 4, 2018 9:06:39 AM
> To: Kintis, Panagiotis; Antonakakis, Manos
> Cc: Keromytis, Angelos; Schneck, Christopher (contr-i2o)
> Subject: Re: DARPA Riser Selection
>
> Do you have time on Thu. afternoon?
> -JMS
>
>
> From: "Kintis, Panagiotis" <kintis@gatech.edu>
> Date: Friday, June 1, 2018 at 4:10 PM
> To: "Antonakakis, Manos" <manos@gatech.edu>
> Cc: "Kintis, Panagiotis" <kintis@gatech.edu>, Jonathan Smith <jonathan.smith@darpa.mil>, Angelos Keromytis
<angelos.keromytis@darpa.mil>, Christopher Schneck <christopher.schneck.ctr@darpa.mil>
> Subject: Re: DARPA Riser Selection
>
> I am truly honored to participate in the Symposium as a DARPA Riser. JMS, thank you so much for the nomination and
your help! I really appreciate the opportunity to talk about our work to the rest of the community!
>
> I am available any time next week to discuss about next steps.
>
> Thank you,
>
> Panagiotis (Panos), Kintis.
> hxxxp://about.me/kintis
> kintis@gatech.edu<mailto:kintis@gatech.edu>
> panagiotious@gmail.com<mailto:panagiotious@gmail.com>
> P Think before you print!
>
>
> On Jun 1, 2018, at 15:53, Antonakakis, Manos <manos@gatech.edu<mailto:manos@gatech.edu>> wrote:
>
> Pano, you should thank JMS for this.
>
> Next week, JMS will be in town alongside Angelo and Chris. We should discuss what would be in the best interest of the
program for you to present in D60.
>
> Thanks,
>
>—
> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
>
>
> ________________________________________
> From: Kintis, Panagiotis
> Sent: Friday, June 1, 2018 3:37:44 PM
> Subject: Fwd: DARPA Riser Selection
>
> Received the invite for the Symposium! Need to prepare for a presentation now. We should probably talk about this
after Friday!
>
> Panagiotis (Panos), Kintis.
> hxxxp://about.me/kintis
> kintis@gatech.edu<mailto:kintis@gatech.edu>
> panagiotious@gmail.com<mailto:panagiotious@gmail.com>
> P Think before you print!
>
> Begin forwarded message:
>
> From: DARPA60 <DARPA60@darpa.mil<mailto:DARPA60@darpa.mil>>
> Subject: DARPA Riser Selection
> Date: June 1, 2018 at 15:16:44 EDT
> To: "'panagiotious@gmail.com<mailto:panagiotious@gmail.com>'"
<panagiotious@gmail.com<mailto:panagiotious@gmail.com>>, "'kintis@gatech.edu<mailto:kintis@gatech.edu>'"
<kintis@gatech.edu<mailto:kintis@gatech.edu>>
> Cc: "Smith, Jonathan" <jonathan.smith@darpa.mil<mailto:jonathan.smith@darpa.mil>>, "Wilkerson, Kiely (contr-i2o)"
<Christine.Wilkerson.ctr@darpa.mil<mailto:Christine.Wilkerson.ctr@darpa.mil>>, "Veney, Charlene (contr-i2o)"
<Charlene.Veney.ctr@darpa.mil<mailto:Charlene.Veney.ctr@darpa.mil>>, DARPA60
<DARPA60@darpa.mil<mailto:DARPA60@darpa.mil>>, "Higgins, Stacey (contr-fld)"
<stacey.higgins.ctr@darpa.mil<mailto:stacey.higgins.ctr@darpa.mil>>
>
> Dear Mr. Kintis,
>
> Congratulations! The Defense Advanced Research Projects Agency (DARPA) has selected you to participate in the D60,
the Agency's 60th Anniversary Symposium, as a DARPA Riser. The events take place September 5-7, 2018, at the Gaylord
National in National Harbor, Maryland.
>
> Please see attached for an official selection letter from Dr. Steven H. Walker, DARPA Director.
>
> Confirmation of your participation is required no later than June 15, 2018. Please email your response to
darpa60@darpa.mil<mailto:darpa60@darpa.mil>.
>
> We look forward to working with you!
> Best regards,
> D60 Planning Team
>
>
>
>
>
Sent on: Thursday, November 29, 2018 12:43:55 AM
To: Newman, Randyll E - GOV <randyll.e.newman@NCIS.NAVY.MIL>; Farrell, Michael D <Michael.Farrell@gtri.gatech.edu>
CC: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Schneck, Christopher (contr-i2o)
<christopher.schneck.ctr@darpa.mil>
Subject: Re: Data source
Hey Randyll, very please to meet you today. As we talked about, let's coordinate with Michael and get you and you team
visiting Georgia Tech.
Chris/Angelos, this is just an FYI-. If we want to be part of this meeting, we would be happy to include you.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Newman, Randyll E - GOV <randyll.e.newman@NCIS.NAVY.MIL>
Sent: Wednesday, November 28, 2018 9:47:55 AM
Subject: Data source
Manos
It was nice to meet you. I would like to come down to GTRI and see what you have to offer and to present our needs to
you.
Tejas Patel advised GTRI has a data source he was using. Can we get access this data source?
Randyll Newman
Deputy Assistant Director
NCIS Cyber Capabilities Integration
(571) 305-9904
From: Rodney Joffe <rodney.joffe@team.neustar>
Sent on: Friday, February 12, 2021 5:17:55 PM
To: Manos Antonakakis <manos@gatech.edu>
CC: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
Subject: Re: Data subscription extension
We’re on it.
> On Feb 12, 2021, at 11:51 AM, Antonakakis, Manos <manos@gatech.edu> wrote:
>
> OK, let start asap. I cannot go back to DARPA and say that I cannot do this because GT is not moving fast enough. I will
lose face.
>
> Manos
>
> From: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
> Date: Friday, February 12, 2021 at 11:31 AM
> To: Antonakakis, Manos <manos@gatech.edu>, Rodney Joffe <rodney.joffe@team.neustar>
> Subject: RE: Data subscription extension
>
> Manos,
>
> It really depends on how quickly the subsidiary is able to get registered in the system (outside of our control), send us
the quote, and how responsive they are to the inquiries and requests for documentation that procurement needs. I would
say probably 3 weeks on the short side accounting for some back and forth between supplier and contracting officer.
>
> Rodney,
>
> Would you please have the new company register as a vendor in our system. No action on our part can be completed
until we have the quote and the new company’s registration is done. This link will allow for a new account to be set up,
including routing details for payments on future invoices. A new PO will be issued.
>
>
https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwd5.myworkdaysite.com%2Fsupplier%2Fgatech%2FSUPPL
>
> Let me know if you have questions!
>
>M
>
>
> From: Antonakakis, Manos <manos@gatech.edu>
> Sent: Friday, February 12, 2021 9:29 AM
> To: Rodney Joffe <rodney.joffe@team.neustar>; Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
> Subject: Re: Data subscription extension
>
> Rodney this makes sense.
>
> Michael, can I get an ETA on this being one?
>
> Thanks, Manos
>
> From: Rodney Joffe <rodney.joffe@team.neustar>
> Date: Thursday, February 11, 2021 at 9:39 PM
> To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
> Cc: Antonakakis, Manos <manos@gatech.edu>
>
> Hello Michael,
>
> Thank you for the opportunity.
>
> I will have the quote prepared for you by Monday. It will be a new quote, with the same general terms and conditions as
the original contract. However, it will cover 3 months, and it will confirm that if needed, an additional PO for the remainder
of 2021 will be valid at the same rate and terms.
>
> Will this work for your purposes, or will you need any other changes?
>
> One point from Neustar’s side - we now contract for all sensitive contracts through our Government Subsidiary, ERP
Services, Inc, a wholly owned subsidiary of Neustar, Inc. I assume this will also not be an issue for you?
>
> Regards
> Rodney
> =======================
> Rodney Joffe
> SVP, and Fellow
> National Security Executive
> Neustar, Inc.
> 45980 Center Oak Plaza
> Sterling VA 20166
> USA
> +1 202-533-2900 Direct
> +1 602-418-6471 Cell
> rodney.joffe@team.neustar
>
> > On Feb 11, 2021, at 5:05 PM, Mitchell, Michael F <michael.mitchell@ece.gatech.edu> wrote:
>>
> > Good Afternoon Rodney,
>>
> > I spoke with Manos earlier today regarding the short term extension of our project and the need to extend our data
subscription. Would you be able to provide me with a quote for the additional period you discussed? I would greatly
appreciate it!
>>
> > Thanks,
>>
> > Michael Mitchell
>>
> > Research Operations Program Manager
> > GEORGIA Institute
> > of TECH nology
> > School of Electrical and Computer Engineering
> > 777 Atlantic Drive NW
> > Atlanta, GA 30332-0765
> > Office: 404-385-8122
> > Mobile: 770-655-8039
>
Sent on: Wednesday, April 14, 2021 7:42:47 PM
To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
CC: Manos Antonakakis <manos@gatech.edu>; Colin Monaghan <colin.monaghan@team.neustar>
Subject: Re: Data subscription extension
Hello Michael,
Many thanks. Putting it into process now.
Regards
Rodney
> On Apr 14, 2021, at 2:31 PM, Mitchell, Michael F <michael.mitchell@ece.gatech.edu> wrote:
>
> Hey Rodney,
>
> I was following up on the requisition that I put in for this and found that the PO was executed for this. The PO number is
PO-5145022. If you have not yet done so, would you please send an invoice for this PO to apinvoices@gatech.edu with a
subject line of PO-5145022?
>
> Let me know if you have any questions or need help on this.
>
> Thanks!
>
> Michael
>
> From: Rodney Joffe <rodney.joffe@team.neustar>
> Sent: Friday, February 12, 2021 2:57 PM
> To: Antonakakis, Manos <manos@gatech.edu>
> Cc: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>
> Hi Manos and Michael,
>
> We think we have accurately completed the registration form. Please let me know if there is anything else needed.
>
> Thanks!
> Rodney
>
>
>> On Feb 12, 2021, at 11:51 AM, Antonakakis, Manos <manos@gatech.edu> wrote:
>>
>> OK, let start asap. I cannot go back to DARPA and say that I cannot do this because GT is not moving fast enough. I
will lose face.
>>
>>
>>
>> Manos
>>
>>
>>
>> From: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>> Date: Friday, February 12, 2021 at 11:31 AM
>> To: Antonakakis, Manos <manos@gatech.edu>, Rodney Joffe <rodney.joffe@team.neustar>
>> Subject: RE: Data subscription extension
>>
>> Manos,
>>
>>
>>
>> It really depends on how quickly the subsidiary is able to get registered in the system (outside of our control), send us
the quote, and how responsive they are to the inquiries and requests for documentation that procurement needs. I would
say probably 3 weeks on the short side accounting for some back and forth between supplier and contracting officer.
>>
>>
>>
>> Rodney,
>>
>>
>>
>> Would you please have the new company register as a vendor in our system. No action on our part can be completed
until we have the quote and the new company's registration is done. This link will allow for a new account to be set up,
including routing details for payments on future invoices. A new PO will be issued.
>>
>>
>>
>>
https://urldefense.com/v3/__https://nam12.safelinks.protection.outlook.com/?url=https*3A*2F*2Fwd5.myworkdaysite.com*2Fsupp
PReRde8WJTHWYIs0KygzULJChquUn_8DaNlm777TynPgnw$
>>
>>
>>
>> Let me know if you have questions!
>>
>>
>>
>> M
>>
>>
>>
>>
>>
>> From: Antonakakis, Manos <manos@gatech.edu>
>> Sent: Friday, February 12, 2021 9:29 AM
>> To: Rodney Joffe <rodney.joffe@team.neustar>; Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>> Subject: Re: Data subscription extension
>>
>>
>>
>> Rodney this makes sense.
>>
>>
>>
>> Michael, can I get an ETA on this being one?
>>
>>
>>
>> Thanks, Manos
>>
>>
>>
>> From: Rodney Joffe <rodney.joffe@team.neustar>
>> Date: Thursday, February 11, 2021 at 9:39 PM
>> To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>> Cc: Antonakakis, Manos <manos@gatech.edu>
>> Subject: Re: Data subscription extension
>>
>> Hello Michael,
>>
>> Thank you for the opportunity.
>>
>> I will have the quote prepared for you by Monday. It will be a new quote, with the same general terms and conditions
as the original contract. However, it will cover 3 months, and it will confirm that if needed, an additional PO for the
remainder of 2021 will be valid at the same rate and terms.
>>
>> Will this work for your purposes, or will you need any other changes?
>>
>> One point from Neustar's side - we now contract for all sensitive contracts through our Government Subsidiary, ERP
Services, Inc, a wholly owned subsidiary of Neustar, Inc. I assume this will also not be an issue for you?
>>
>> Regards
>> Rodney
>> =======================
>> Rodney Joffe
>> SVP, and Fellow
>> National Security Executive
>> Neustar, Inc.
>> 45980 Center Oak Plaza
>> Sterling VA 20166
>> USA
>> +1 202-533-2900 Direct
>> +1 602-418-6471 Cell
>> rodney.joffe@team.neustar
>>
>>> On Feb 11, 2021, at 5:05 PM, Mitchell, Michael F <michael.mitchell@ece.gatech.edu> wrote:
>>>
>>> Good Afternoon Rodney,
>>>
>>> I spoke with Manos earlier today regarding the short term extension of our project and the need to extend our data
subscription. Would you be able to provide me with a quote for the additional period you discussed? I would greatly
appreciate it!
>>>
>>> Thanks,
>>>
>>> Michael Mitchell
>>>
>>> Research Operations Program Manager
>>> GEORGIA Institute
>>> of TECH nology
>>> School of Electrical and Computer Engineering
>>> 777 Atlantic Drive NW
>>> Atlanta, GA 30332-0765
>>> Office: 404-385-8122
>>> Mobile: 770-655-8039
>>
>>
>>
>>
>
Sent on: Wednesday, January 31, 2018 8:53:56 PM
To: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
CC: Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: Dates and IPs
Will do tonight. Catching up with many things today.
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
Sent: Wednesday, January 31, 2018 3:13:05 PM
Cc: Keromytis, Angelos
Subject: Dates and IPs
Manos,
Have you had a chance to look at the sheet Angelos gave you on a Monday?
Regards,
Tejas
Sent from my iPhone

Sent on: Friday, February 2, 2018 12:52:13 AM
CC: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Friday, February 2, 2018 12:52:12 AM
Subject: Re: Dates and IPs
Sent on: Monday, February 18, 2019 2:59:56 AM
To: Adm. Mike Mullen <mike.mullen@mgmconsulting.net>
CC: Charlie Gottdiener <Charles.Gottdiener@team.neustar>; Achanta, Venkat <Venkat.Achanta@team.neustar>; Manos
Antonakakis <manos@gatech.edu>; Dr. Angelos Keromytis Ph.D. <angelos@gatech.edu>; Karin Vernazza
<karin.vernazza@mgmconsulting.net>
Subject: Re: Dinner, Kyma Greek Restaurant
Ack. I will add her as an option attendee.
At Neustar our EAs get the notifications automatically.
> On Feb 17, 2019, at 9:58 PM, Mike Mullen <mike.mullen@mgmconsulting.net> wrote:
>
> Rodney, as you generate these schedules, please copy Karin. Thanks, Mike
>
>> On Feb 17, 2019, at 4:57 PM, Joffe, Rodney <Rodney.Joffe@team.neustar> wrote:
>>
>> When: Wednesday, March 27, 2019 6:05 PM-8:00 PM. (UTC-05:00) Eastern Time (US & Canada)
>> Where: 3085 Piedmont Rd NE, Atlanta, GA 30305
>>
>> *~*~*~*~*~*~*~*~*~*
>> https://buckheadrestaurants.com/restaurant/kyma/
>> <Mail Attachment.ics>
>
Sent on: Tuesday, February 27, 2018 12:31:51 AM
To: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>; Keromytis, Angelos <angelos.keromytis@darpa.mil>; Denz, Mary
(contr-i2o) <mary.denz.ctr@darpa.mil>; Maddern, Thomas (contr-i2o) <Thomas.Maddern.ctr@darpa.mil>; Beltz, Steven
<steven.beltz@darpa.mil>
Subject: Re: Dinner
Folks, it will take me roughly 20 minutes to drive up the 5th street during that time of the day. May I trouble you with a
.5M (or 10 minutes) walk between Renaissance and Klaus Advance Computing building?
https://maps.google.com/?q=118a+Ferst+Dr+NW&entry=gmail&source=g
I will be waiting you downstairs and will drive you to and from the restaurant. The 5th street is notoriously bad that time
of the day.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
Sent: Monday, February 26, 2018 1:19 PM
To: Keromytis, Angelos; Denz, Mary (contr-i2o); Maddern, Thomas (contr-i2o); Beltz, Steven; Antonakakis, Manos
Subject: Dinner
When: Thursday, March 1, 2018 6:30 PM-8:30 PM.
Where: Kyma, 3085 Piedmont Rd NE, Atlanta, GA 30305
Reservations are for 1830.
Manos and Angelos to coordinate transportation to/from hotel (Renaissance, 866 W Peachtree St NW, Atlanta, GA 30308)
to Kyma (3085 Piedmont Rd NE, Atlanta, GA 30305).
Angelos, Mary, and Tom will be together.

Tejas will be arriving separate.
Steve has not booked tickets yet and is a maybe.
Sent on: Tuesday, February 27, 2018 1:11:38 AM
CC: Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>; Denz, Mary (contr-i2o) <mary.denz.ctr@darpa.mil>; Maddern,
Thomas (contr-i2o) <Thomas.Maddern.ctr@darpa.mil>; Beltz, Steven <steven.beltz@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Tuesday, February 27, 2018 1:11:37 AM
Subject: Re: Dinner
Sent on: Friday, April 6, 2018 4:51:51 PM
To: Smith, Jonathan <jonathan.smith@darpa.mil>
CC: Everett, John <john.everett@darpa.mil>; Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: Discussion follow up and information sharing
Here you go, JMS.
campus2-rtr (cisco WS-C6509-V-E) -> BCDC1-rtr (cisco WS-C6509-V-E) -> bcdc-nexus-K29-UP-A (cisco Nexus 5596
Chassis with FEXs)
campus2-rtr#sh ver
Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.1(2)SY6, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Thu 10-Sep-15 01:36 by prod_rel_team
ROM: System Bootstrap, Version 12.2(50r)SYS2, RELEASE SOFTWARE (fc1)
campus2-rtr uptime is 1 year, 35 weeks, 3 days, 21 hours, 19 minutes

Uptime for this control processor is 1 year, 28 weeks, 13 hours, 45 minutes
System returned to ROM by Stateful Switchover
System restarted at 20:29:54 EDT Sat Sep 17 2016
System image file is "bootdisk:s2t54-advipservicesk9-mz.SPA.151-2.SY6.bin"
Last reload reason: power-on
This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to

export@cisco.com.
cisco WS-C6509-V-E (M8572) processor (revision ) with 1785856K/262144K bytes of memory.

Processor board ID FOX1418GY6U
CPU: MPC8572_E, Version: 2.2, (0x80E80022)
CORE: E500, Version: 3.0, (0x80210030)
CPU:1500MHz, CCB:600MHz, DDR:600MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
Last reset from power-on

57 Virtual Ethernet interfaces
102 Gigabit Ethernet interfaces
44 Ten Gigabit Ethernet interfaces
16 Forty Gigabit Ethernet interfaces
2543K bytes of non-volatile configuration memory.
Configuration register is 0x2102
bcdc1-rtr#sh ver
Cisco IOS Software, s2t54 Software (s2t54-ADVIPSERVICESK9-M), Version 15.2(1)SY1a, RELEASE SOFTWARE (fc6)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Tue 29-Sep-15 15:57 by prod_rel_team
ROM: System Bootstrap, Version 12.2(50r)SYS3, RELEASE SOFTWARE (fc1)
bcdc1-rtr uptime is 1 year, 14 weeks, 4 days, 3 hours, 35 minutes

Uptime for this control processor is 1 year, 14 weeks, 4 days, 3 hours, 36 minutes
System returned to ROM by reload at 05:37:25 EST Wed Dec 21 2016
System restarted at 05:38:58 EST Wed Dec 21 2016
System image file is "bootdisk:s2t54-advipservicesk9-mz.SPA.152-1.SY1a.bin"
Last reload reason: Admin CLI
This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to

export@cisco.com.
cisco WS-C6509-V-E (M8572) processor (revision ) with 1785856K/262144K bytes of memory.

Processor board ID FOX1210G4ZX
CPU: MPC8572_E, Version: 2.2, (0x80E80022)
CORE: E500, Version: 3.0, (0x80210030)
CPU:1500MHz, CCB:600MHz, DDR:600MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
Last reset from s/w reset

62 Virtual Ethernet interfaces
102 Gigabit Ethernet interfaces
117 Ten Gigabit Ethernet interfaces
8 Forty Gigabit Ethernet interfaces
2543K bytes of non-volatile configuration memory.
Configuration register is 0x2102
bcdc-nexus-K29-UP-A# sh ver
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Documents: http://www.cisco.com/en/US/products/ps9372/tsd_products_support_series_home.html
Copyright (c) 2002-2013, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained herein are owned by
other third parties and are used and distributed under license.
Some parts of this software are covered under the GNU Public
License. A copy of the license is available at
http://www.gnu.org/licenses/gpl.html.
Software
BIOS: version 3.6.0
loader: version N/A
kickstart: version 6.0(2)N2(3)
system: version 6.0(2)N2(3)
Power Sequencer Firmware:
Module 1: version v5.0
Microcontroller Firmware: version v1.0.0.2
SFP uC: Module 1: v1.0.0.0
QSFP uC: Module not detected
BIOS compile time: 05/09/2012
kickstart image file is: bootflash:///n5000-uk9-kickstart.6.0.2.N2.3.bin
kickstart compile time: 12/17/2013 2:00:00 [12/17/2013 07:52:59]
system image file is: bootflash:///n5000-uk9.6.0.2.N2.3.bin
system compile time: 12/17/2013 2:00:00 [12/17/2013 11:02:31]
Hardware
cisco Nexus 5596 Chassis ("O2 48X10GE/Modular Supervisor")
Intel(R) Xeon(R) CPU with 8253856 kB of memory.
Processor Board ID JAF1521CNNE
Device name: bcdc-nexus-K29-UP-A

bootflash: 2007040 kB
Kernel uptime is 1507 day(s), 1 hour(s), 36 minute(s), 32 second(s)
Last reset at 972228 usecs after Sat Feb 15 07:42:54 2014
Reason: Reset Requested by CLI command reload

System version: 6.0(2)N2(3)
Service:
plugin
Core Plugin, Ethernet Plugin, Fc Plugin
bcdc-nexus-K29-UP-A#
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Smith, Jonathan <jonathan.smith@darpa.mil>
Sent: Friday, April 6, 2018 11:47:19 AM
Cc: Everett, John; Keromytis, Angelos
Manos:
Is it possible to get us the software/firmware versions running on the routers?
Thanks,
-JMS
On 4/6/18, 7:44 AM, "Antonakakis, Manos" <manos@gatech.edu> wrote:
cisco Nexus 5596 Chassis with FEXs

Sent on: Friday, April 6, 2018 7:55:35 AM
CC: Everett, John <john.everett@darpa.mil>; Smith, Jonathan <jonathan.smith@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Friday, April 6, 2018 7:45:55 AM
Sent on: Thursday, June 14, 2018 7:09:50 PM
CC: Schneck, Christopher (contr-i2o) <christopher.schneck.ctr@darpa.mil>; Smith, Jonathan <jonathan.smith@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Thursday, June 14, 2018 7:09:47 PM
Subject: Re: DNS Data Availability
Sent on: Friday, November 17, 2017 7:39:54 PM
To: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
Subject: Re: DoD Employee looking for contact info (Cyber Attribution Team)
ack
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Friday, November 17, 2017 2:25:14 PM
To: Antonakakis, Manos; Patel, Tejas (contr-i2o)
Subject: RE: DoD Employee looking for contact info (Cyber Attribution Team)
Ignore the fact she's at NPS or the Navy. Respond as you would to anyone else.
-Angelos
Sent: Friday, November 17, 2017 2:07 PM
To: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <tejas.patel.ctr@darpa.mil>
Subject: Fwd: DoD Employee looking for contact info (Cyber Attribution Team)
How should I handle this?
---
Typos due to mobile device ...
Begin forwarded message:
From: "Keen, Kayla (CIV)" <knkeen@nps.edu <mailto:knkeen@nps.edu> >

Date: November 17, 2017 at 12:42:16 EST
To: "manos@gatech.edu <mailto:manos@gatech.edu> " <manos@gatech.edu <mailto:manos@gatech.edu> >
Professor Antonakakis,
My name is Kayla Keen. I am a DoD civilian employee, currently pursuing my PhD in Computer Science at the Naval
Postgraduate School (NPS). I am trying to narrow down a topic for my dissertation research and am particularly interested
in attribution information gained from binaries. I found your research in my deep dive, and was interested in learning
more. Please let me know if you are interested in collaborating; I would be happy to set up a short meeting.
R,
Kayla
Kayla Keen
(443) 975-8064
knkeen@nps.edu <mailto:knkeen@nps.edu>
kayla.keen@navy.mil <mailto:kayla.keen@navy.mil>
________________________________
From: Toon, John D [john.toon@comm.gatech.edu <mailto:john.toon@comm.gatech.edu> ]

Sent: Thursday, November 16, 2017 6:00 PM
To: Keen, Kayla (CIV)
Cc: kayla.keen@navy.mil <mailto:kayla.keen@navy.mil>
Hi Kayla,
Thanks for your interest. I might suggest you contact Manos Antonakakis. He’s a professor in our School of Electrical
Engineering and one of the principal researchers involved in the work.
manos@gatech.edu <mailto:manos@gatech.edu>
From: Keen, Kayla (CIV) [mailto:knkeen@nps.edu]

Sent: Thursday, November 16, 2017 7:59 PM
To: Toon, John D <john.toon@comm.gatech.edu <mailto:john.toon@comm.gatech.edu> >
Cc: kayla.keen@navy.mil <mailto:kayla.keen@navy.mil>
Subject: DoD Employee looking for contact info (Cyber Attribution Team)
John,
I saw you listed as a POC in the following article: http://www.rh.gatech.edu/news/584327/17-million-contract-will-help-

establish-science-cyber-attribution <http://www.rh.gatech.edu/news/584327/17-million-contract-will-help-establish-
science-cyber-attribution>
My name is Kayla Keen. I am a DoD civilian employee, currently pursuing my PhD in Computer Science at the Naval
Postgraduate School (NPS).
I am trying to narrow down a topic for my dissertation research and am particularly interested in security aspects of
computing, including attribution.
Specifically, I was hoping you could provide contact information for Michael Farrell (https://iisp.gatech.edu/michael-farrell)
or another POC on the Attribution team.
Thanks!
R,
Kayla
Kayla Keen
(443) 975-8064
knkeen@nps.edu <mailto:knkeen@nps.edu>
kayla.keen@navy.mil <mailto:kayla.keen@navy.mil>
Sent on: Wednesday, September 6, 2017 1:19:30 AM
To: Aaron, David (NSD) <David.Aaron2@usdoj.gov>;
CC: Myers, Zachary (USAMD) <Zachary.Myers@usdoj.gov>; Mitchell, Nicolas (USAMD) <Nicolas.Mitchell@usdoj.gov>;
Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: DOJ contact - Case #2
Hey David, very pleased to meet you Sir.
Dave Dagon (CCed) and I are working on a full report for you. We expect to have this ready by the 15th, however, this
depends on both the load at the Georgia Tech cluster and the findings as more analysis comes to us from the Attribution
Framework.
Please stay tuned --- we will pass information to you asap.
BTW, can you guys use PGP at all?
Cheers,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Aaron, David (NSD) <David.Aaron2@usdoj.gov>
Sent: Tuesday, September 5, 2017 6:22:32 PM
Cc: Myers, Zachary (USAMD); Mitchell, Nicolas (USAMD); Keromytis, Angelos
Subject: DOJ contact - Case #2
Manos,
Angelos passed along your email address. I’m his contact at DOJ for Case #2. I wanted to introduce myself in case we have
additional information or follow-up questions. I’ve copied my colleagues, Zach Myers and Nick Mitchell.
Thank you very much for your work on this.
-David
David Aaron
U.S. Department of Justice
(202) 307-5190
Sent on: Wednesday, September 6, 2017 12:38:49 AM
To: Aaron, David (NSD) <David.Aaron2@usdoj.gov>
CC: Antonakakis, Manos <manos@gatech.edu>; Myers, Zachary (USAMD) <Zachary.Myers@usdoj.gov>;
Mitchell, Nicolas (USAMD) <Nicolas.Mitchell@usdoj.gov>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Wednesday, September 6, 2017 12:38:44 AM
Subject: Re: DOJ contact - Case #2
Sent on: Saturday, March 31, 2018 10:57:51 PM
To: Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: Domains used in a spear-phish
Give me a call when you see this.
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Saturday, March 31, 2018 11:43:52 AM
Subject: Re: Domains used in a spear-phish
Lowest priority. Wait until after the paper.
Dr Angelos D. Keromytis
Program Manager, Information Innovation Office (I2O)
DARPA
675 N. Randolph Street
Arlington, VA 22203
(T) 571-218-4290
Angelos.Keromytis@darpa.mil<mailto:Angelos.Keromytis@darpa.mil> (NIPR)
Angelos.Keromytis@darpa.smil.mil<mailto:Angelos.Keromytis@darpa.smil.mil> (SIPR)
Angelos.Keromytis@darpa.ic.gov<mailto:Angelos.Keromytis@darpa.ic.gov> (JWICS)
On Mar 31, 2018, at 11:35 AM, Antonakakis, Manos <manos@gatech.edu<mailto:manos@gatech.edu>> wrote:
I will take a look at it. Panos is working on a paper.
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Keromytis, Angelos <angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil>>
Sent: Saturday, March 31, 2018 11:31:27 AM
Subject: Fwd: Domains used in a spear-phish
Can you ask Pano to take a *quick* look?
Dr Angelos D. Keromytis
Program Manager, Information Innovation Office (I2O)
DARPA
675 N. Randolph Street
Arlington, VA 22203
(T) 571-218-4290
Angelos.Keromytis@darpa.mil<mailto:Angelos.Keromytis@darpa.mil><mailto:Angelos.Keromytis@darpa.mil> (NIPR)
Angelos.Keromytis@darpa.smil.mil<mailto:Angelos.Keromytis@darpa.smil.mil><mailto:Angelos.Keromytis@darpa.smil.mil>
(SIPR)
Angelos.Keromytis@darpa.ic.gov<mailto:Angelos.Keromytis@darpa.ic.gov><mailto:Angelos.Keromytis@darpa.ic.gov>
(JWICS)
Begin forwarded message:
From: "Ha, Henry K. (CYD) (FBI)" <hha@fbi.gov<mailto:hha@fbi.gov><mailto:hha@fbi.gov>>

Subject: Domains used in a spear-phish
Date: March 30, 2018 at 10:59:47 AM EDT
To: "angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil><mailto:angelos.keromytis@darpa.mil>"
<angelos.keromytis@darpa.mil<mailto:angelos.keromytis@darpa.mil><mailto:angelos.keromytis@darpa.mil>>
Cc: "Knapp, Chad A. (OC) (FBI)" <caknapp@fbi.gov<mailto:caknapp@fbi.gov><mailto:caknapp@fbi.gov>>, "Valentine,
Dennis N. (ITADD) (FBI)" <dnvalentine@fbi.gov<mailto:dnvalentine@fbi.gov><mailto:dnvalentine@fbi.gov>>
PM Angelos Keromytis,
FYI, I received your contact information from my colleague, SSA Chad Knapp.
I am currently looking into a spear-phish campaign that occurred between February 26, 2018 and March 27, 2018. The
emails included links to the following domains: "cloud-conf.org<http://cloud-conf.org><http://cloud-conf.org>" and
"zacksmarket.com<http://zacksmarket.com><http://zacksmarket.com>".
I was wondering if you could check your holdings for information relating to those domains. It would be great to see if
there was also activity before and after the date range listed above.
Please let me know if you have any questions. Thank you.
Regards,
FBI SSA Henry Ha
Desk: 703-633-5644
From: Keromytis, Angelos<angelos.keromytis@darpa.mil>
Sent on: Tuesday, January 30, 2018 11:18:23 AM
To: Chen, Tim<tim@domaintools.com>
CC: Antonakakis, Manos<manos@gatech.edu>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Tuesday, January 30, 2018 11:18:22 AM
Subject: Re: DomainTools POC
Attachments: Nameless.txt (752 Bytes)
Tim, nice to meet you too. How’s your Wednesday?

Best,
-Angelos
On Jan 26, 2018, at 19:28, Chen, Tim <tim@domaintools.com> wrote:
Thanks Manos.
Hi Angelos,
Very nice to meet you. I will make myself available to you at any time.
Here is my personal cell number: . Otherwise, happy to set up a dedicated time

to speak next week.
Tim
On Thu, Jan 25, 2018 at 9:13 PM, Antonakakis, Manos <manos@gatech.edu> wrote:
Anegle, please meet Tim. He is running DomainTools and he can answer all questions you
might have around the WHOIS data GT uses for our analysis and modeling.
Tim, Angelos is our Program Manager from DARPA. You can trust him fully.
Thanks, Manos
Sent on: Wednesday, December 13, 2017 4:58:51 PM
To: Hall, John <John.Hall@team.neustar>
CC: Joffe, Rodney <Rodney.Joffe@team.neustar>
Subject: Re: EA Option Year for NEUSTSAR
John, please work with Michael directly. The funds are here, and I approved this PO yesterday in the internal system.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Hall, John <John.Hall@team.neustar>
Sent: Wednesday, December 13, 2017 11:48 AM
Cc: Joffe, Rodney
Subject: EA Option Year for NEUSTSAR
Hi Manos,
I hope you and your team are doing well as we head into the holiday season
and end of calendar year. I have been working with Michael Mitchell to
try to get the PO for the first EA option year of our DNS data. If you
take a look below, you’ll see that Michael is doing what he can to work
with your contracting folks but, since its pretty important for us to be
able to book the option year in 2017, I’m writing to ask you to take a
quick look at the situation. If there is anything I can do to facilitate,
I will make myself available for a call and can even fly down if that
would help.
Thanks in advance - looking forward to working with you on HACCS in the

new year!
John W Hall
Neustar, Inc. / Sr. Director Federal Business
[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
___________________________________________________________________________
__________
The information contained in this e-mail message is intended only for the
use of the recipient(s) named above and may contain
confidential and/or privileged information. If you are not the intended
recipient you have received this e-mail message in error
and any review, dissemination, distribution, or copying of this message is
strictly prohibited. If you have received this
communication in error, please notify us immediately and delete the
original message
____________________________________________________________
On 12/11/17, 5:00 PM, "Mitchell, Michael F"
<michael.mitchell@ece.gatech.edu> wrote:
>Hey John,
>
>I have everything on my end to submit this for issuing the PO. I know the
>person who usually works on these types of POs and I will get in contact
>with her and see if we can move this through their process quickly.
>
>Thanks for your help!
>
>MM
>
>-----Original Message-----
>From: Hall, John [mailto:John.Hall@team.neustar]
>Sent: Monday, December 11, 2017 12:16 PM
>To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>Cc: Carter, Anita M <anita.carter@ece.gatech.edu>
>Subject: Re: [EXTERNAL] RE: Georgia Tech BuzzMart, PO#: 2100362915
>
>Hello Michael / Anita, Are you all etc provide an update on your process?
>
>Thanks in advance
>
>John W Hall
>Neustar, Inc. / Sr. Director Federal Business
>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>__________________________________________________________________________
>_
>__________
>
>The information contained in this e-mail message is intended only for the
>use of the recipient(s) named above and may contain confidential and/or
>privileged information. If you are not the intended recipient you have
>received this e-mail message in error and any review, dissemination,
>distribution, or copying of this message is strictly prohibited. If you
>have received this communication in error, please notify us immediately
>and delete the original message
>____________________________________________________________
>
>
>
>
>
>
>
>
>
>
>
>On 12/8/17, 12:09 PM, "Hall, John" <John.Hall@team.neustar> wrote:
>
>>Hi Michael / Anita, I just wanted to confirm that you have what you
>>need to complete the award process. Are you still able to get this
>>complete before we go into the weekend? Did the amended quote I sent
>>yesterday satisfy your needs?
>>
>>I appreciate your help here!
>>
>>John W Hall
>>Neustar, Inc. / Sr. Director Federal Business
>>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>>_______________________________________________________________________
>>___
>>_
>>__________
>>
>>The information contained in this e-mail message is intended only for
>>the use of the recipient(s) named above and may contain confidential
>>and/or privileged information. If you are not the intended recipient
>>you have received this e-mail message in error and any review,
>>dissemination, distribution, or copying of this message is strictly
>>prohibited. If you have received this communication in error, please
>>notify us immediately and delete the original message
>>____________________________________________________________
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>On 12/7/17, 10:51 AM, "Hall, John" <John.Hall@team.neustar> wrote:
>>
>>>Michael, Here is the original quote with an expiration date of 12/19/17.
>>>Let me know if this is what you are looking for or if you want me to
>>>build out a new quote for year 2 (aka option year 1)?
>>>
>>>Thanks for working on this - I know that these things can be
>>>especially tedious even when you're not new to the process.
>>>
>>>John W Hall
>>>Neustar, Inc. / Sr. Director Federal Business
>>>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>>>______________________________________________________________________
>>>___
>>>_
>>>_
>>>__________
>>>
>>>The information contained in this e-mail message is intended only for
>>>the use of the recipient(s) named above and may contain confidential
>>>and/or privileged information. If you are not the intended recipient
>>>you have received this e-mail message in error and any review,
>>>dissemination, distribution, or copying of this message is strictly
>>>prohibited. If you have received this communication in error, please
>>>notify us immediately and delete the original message
>>>____________________________________________________________
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>On 12/7/17, 9:42 AM, "Mitchell, Michael F"
>>><michael.mitchell@ece.gatech.edu> wrote:
>>>
>>>>Good Morning John
>>>>
>>>>First let me start by apologizing for the delay on this. This is
>>>>something that we should have been able to get this turned around
>>>>much faster than we have so far. Given my newness to this position I
>>>>have had some difficulty getting things moving in the right direction
>>>>and getting this process started. I am working very closely with
>>>>procurement to get this done.
>>>>
>>>>I will need a new quote for the $350,000 this year in order to get
>>>>things approved, since the old quote was only good until 12/01/2016.
>>>>Once I have that I will be able to work on finalizing the new PO.
>>>>
>>>>Again my deepest apologies for the delay, and just be patient a bit
>>>>longer so I can get this done.
>>>>
>>>>
>>>>Michael Mitchell
>>>>
>>>>Research Operations Program Manager
>>>>GEORGIA Institute
>>>>of TECH nology
>>>>School of Electrical and Computer Engineering
>>>>777 Atlantic Drive NW
>>>>Atlanta, GA 30332-0765
>>>>
>>>>
>>>>
>>>>-----Original Message-----
>>>>From: Hall, John [mailto:John.Hall@team.neustar]
>>>>Sent: Thursday, November 30, 2017 12:26 PM
>>>>To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>>>>Cc: Carter, Anita M <anita.carter@ece.gatech.edu>
>>>>Subject: Re: [EXTERNAL] RE: Georgia Tech BuzzMart, PO#: 2100362915
>>>>
>>>>Hi Michael - as you can imagine, I am getting inquiries on the
>>>>possibility of booking this order this month. Do you have an update?
>>>>Would a call to Manos improve our probability of getting an order by
>>>>tomorrow?
>>>>
>>>>Sorry to press but would really appreciate your help if there is a way.
>>>>
>>>>Thanks in advance!!
>>>>
>>>>John W Hall
>>>>Neustar, Inc. / Sr. Director Federal Business
>>>>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>>>>_____________________________________________________________________
>>>>___
>>>>_
>>>>_
>>>>_
>>>>__________
>>>>
>>>>The information contained in this e-mail message is intended only for
>>>>the use of the recipient(s) named above and may contain confidential
>>>>and/or privileged information. If you are not the intended recipient
>>>>you have received this e-mail message in error and any review,
>>>>dissemination, distribution, or copying of this message is strictly
>>>>prohibited. If you have received this communication in error, please
>>>>notify us immediately and delete the original message
>>>>____________________________________________________________
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>On 11/28/17, 2:37 PM, "Mitchell, Michael F"
>>>><michael.mitchell@ece.gatech.edu> wrote:
>>>>
>>>>>Hey John,
>>>>>
>>>>>We are working through the process on our end. I will reach out and
>>>>>see if this can be completed this week or not and let you know if
>>>>>this is possible.
>>>>>
>>>>>Thanks!
>>>>>
>>>>>-----Original Message-----
>>>>>From: Hall, John [mailto:John.Hall@team.neustar]
>>>>>Sent: Tuesday, November 28, 2017 11:56 AM
>>>>>To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>>>>>Subject: Re: [EXTERNAL] RE: Georgia Tech BuzzMart, PO#: 2100362915
>>>>>
>>>>>Hi Michael - Hope you had nice thanksgiving holiday. Thought I¹d
>>>>>touch base to check your status on your po process. Is there
>>>>>anything else you need from me? Do you think there is any
>>>>>possibility of getting us the PO this week so we can book it in
>>>>>November?
>>>>>
>>>>>Let me know / thanks in advance
>>>>>
>>>>>John W Hall
>>>>>Neustar, Inc. / Sr. Director Federal Business
>>>>>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>>>>>____________________________________________________________________
>>>>>___
>>>>>___
>>>>>_
>>>>>__________
>>>>>
>>>>>The information contained in this e-mail message is intended only
>>>>>for the use of the recipient(s) named above and may contain
>>>>>confidential and/or privileged information. If you are not the
>>>>>intended recipient you have received this e-mail message in error
>>>>>and any review, dissemination, distribution, or copying of this
>>>>>message is strictly prohibited. If you have received this
>>>>>communication in error, please notify us immediately and delete the
>>>>>original message
>>>>>____________________________________________________________
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>On 11/20/17, 11:03 AM, "Mitchell, Michael F"
>>>>><michael.mitchell@ece.gatech.edu> wrote:
>>>>>
>>>>>>Hey John,
>>>>>>
>>>>>>Thanks for getting this to me. The total number is accurate, the
>>>>>>yearly totals are a bit different, but not a big deal.
>>>>>>
>>>>>>Based on what I am seeing in out internal accounts we had issued a
>>>>>>PO for $1,000,000. We have executed and paid for that in full. Now
>>>>>>we need to create and issue a PO for the new amount of $350,000 per
>>>>>>the outline you provided. Right?
>>>>>>
>>>>>>MM
>>>>>>
>>>>>>-----Original Message-----
>>>>>>From: Hall, John [mailto:John.Hall@team.neustar]
>>>>>>Sent: Monday, November 20, 2017 10:52 AM
>>>>>>To: Mitchell, Michael F <michael.mitchell@ece.gatech.edu>
>>>>>>Subject: FW: Georgia Tech BuzzMart, PO#: 2100362915
>>>>>>
>>>>>>Hi Michael, Here is the original award email with the two
>>>>>>attachments we discussed. Let me know if you have any questions or
>>>>>>concerns.
>>>>>>
>>>>>>Thanks in advance!
>>>>>>
>>>>>>John W Hall
>>>>>>Neustar, Inc. / Sr. Director Federal Business
>>>>>>[ T ] (571) 246-2407 [ E ] john.hall@neustar.biz
>>>>>>___________________________________________________________________
>>>>>>___
>>>>>>_
>>>>>>___
>>>>>>_
>>>>>>__________
>>>>>>
>>>>>>The information contained in this e-mail message is intended only
>>>>>>for the use of the recipient(s) named above and may contain
>>>>>>confidential and/or privileged information. If you are not the
>>>>>>intended recipient you have received this e-mail message in error
>>>>>>and any review, dissemination, distribution, or copying of this
>>>>>>message is strictly prohibited. If you have received this
>>>>>>communication in error, please notify us immediately and delete the
>>>>>>original message
>>>>>>____________________________________________________________
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>On 12/22/16, 4:08 PM, "support@sciquest.com" <support@sciquest.com>
>>>>>>wrote:
>>>>>>
>>>>>>>Attached to this email is Purchase Order Number 2100362915 for
>>>>>>>Georgia Institute of Technology. Please note that there may be
>>>>>>>additional supporting documents attached as well.
>>>>>>
>>>>>
>>>>
>>>
>>
>
Sent on: Sunday, January 28, 2018 12:49:42 PM
To: Smith, Jonathan <jonathan.smith@darpa.mil>; Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: EA Site Visit: GTRC
Gentlemen, the time for this invite is Mon 1/29/2018 12:00a - 4:00a. That is tomorrow, which is not possible. The EA site
visit was set up by Tejas to be on Friday 02/03, between 13.00 and 17.00 (after Alenka's review).
Am I missing something here or this is just a mistake?
Many thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Smith, Jonathan <jonathan.smith@darpa.mil>
Sent: Sunday, January 28, 2018 6:09:11 AM
To: Beltz, Steven; Danielle Gambino (danielle.gambino@us.af.mil); Denz, Mary (contr-i2o); Keromytis, Angelos; Maddern,
Thomas (contr-i2o); Antonakakis, Manos
Subject: EA Site Visit: GTRC
When: Monday, January 29, 2018 12:00 AM-4:00 AM.
Where: Klaus Advanced Computing Building, Ferst Dr NW, Atlanta, GA 30313
Sent on: Sunday, January 28, 2018 4:45:33 PM
CC: Smith, Jonathan <jonathan.smith@darpa.mil>
Signed by: KEROMYTIS.ANGELOS.D.1501999799 on Sunday, January 28, 2018 4:45:32 PM
Subject: Re: EA Site Visit: GTRC
Sent on: Saturday, April 21, 2018 3:48:04 PM
To: Gregory Neal Akers (gakers) <gakers@cisco.com>; Smith, Jonathan <jonathan.smith@darpa.mil>
CC: Kim Deane (kdeane) <kdeane@cisco.com>; Keromytis, Angelos <angelos.keromytis@darpa.mil>
Subject: Re: E-introduction
Status update, Gentlemen.
JMS, talked with Greg and Jared (leader of the forensic team our of Knoxville) this morning. We have a game-plan in mind,
and we will update you as discoveries being made.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
Sent: Wednesday, April 18, 2018 8:44:47 PM
To: Gregory Neal Akers (gakers); Smith, Jonathan
Cc: Kim Deane (kdeane); Keromytis, Angelos
Hey Greg, pleased to meet you, Sir. My mobile is
Feel free to call me anytime you want. Regarding tomorrow; I am extracting my wisdom teeth in the morning, so it might
take some time before I can speak over the phone (and you can understand me over both my accent and swelling). We
can try, but I cannot promise that I will be able to talk with enough clarity. :)
It is likely that Friday I will be in better condition to talk over the phone. If you have an open slot sometime throughout
the day, perhaps we get on a call then?
My plan is to share all technical details around this phenomenon (per JMS's note) over the phone.
Thanks,
—
FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668
________________________________________
From: Gregory Neal Akers (gakers) <gakers@cisco.com>
Sent: Wednesday, April 18, 2018 8:06:16 PM
To: Smith, Jonathan
Cc: Antonakakis, Manos; Kim Deane (kdeane); Keromytis, Angelos
Thank you Jonathan !
Manos,
It is a great pleasure to meet you. I am traveling tomorrow most of the day. Is there a number I could try to reach you on
when I am in a position to speak ?
-g
Sent from my iPhone

And you already know I can't type!
> On Apr 18, 2018, at 7:52 PM, Smith, Jonathan <jonathan.smith@darpa.mil> wrote:
>
> Dear Greg,
> Manos Antonakakis is a Professor at GA Tech, and PI of an
> effort under my colleague Angelos Keromytis' EA program.
> Manos has unparalleled visibility into DNS traffic and uncovered
> the situation we discussed today at 11. I just got off the
> phone with him and outlined your capabilities and passed
> on your cautionary information. He proposed a strategy that
> makes sense in terms of maintaining observability while
> being able to experiment. I will let him share this with you.
>
> Dear Manos,
> Greg Akers is a Senior VP at Cisco and expert in your current
> domain of concern. He is aware of the situation and knows
> how to get the information you need without disturbing your
> operations. Please share your concerns, plan and any info
> Greg or his team requests.
>
> Best,
> -JMS
>
> Jonathan M. Smith
> Jonathan.Smith@darpa.mil
> T: 703.526.4176; C: 571.481.7228
>
>
From: Angelos Keromytis
Sent on: Wednesday, September 27, 2017 8:01:12 PM
To: McLaughlin, Steven W<swm@coe.gatech.edu>
CC: Antonakakis, Manos<manos@gatech.edu>
Subject: Re: email trouble
You mean 4:30?

On Sep 27, 2017, at 14:07, McLaughlin, Steven W <swm@coe.gatech.edu> wrote:
Will call at 3:30 - thx!
Get Outlook for iOS

From: Angelos Keromytis
Sent: Wednesday, September 27, 2017 11:27:47 AM
To: McLaughlin, Steven W
Cc: Antonakakis, Manos
Subject: Re: email trouble
Yes, I can do 4:30pm for half an hour, or 5:30pm until whenever. Let me know what works.
Btw, can you forward me the bounce you received for your email from the other day, if you still have it?
Thanks,
-Angelos
> On Sep 27, 2017, at 10:14, McLaughlin, Steven W <swm@coe.gatech.edu> wrote:

>
> Angelos
> I did get your email and sent you a text this morning to see of we could talk later this afternoon…
copying Manos too…
>
> All the best
> Steve
>
> ********
> Steve McLaughlin
> Dean and Southern Company Chair
> College of Engineering
> Atlanta, GA 30332
> ********
>
>
>
>
> On 9/27/17, 9:20 AM, "Angelos Keromytis" < > wrote:
>
> Steve, not sure if you received my email from yesterday…anyway, looks like there’s email problems
between my mail server and GT. Please use my iCloud email address for now.
> -Angelos
>
>
>
>
Sent on: Saturday, June 17, 2017 4:47:38 PM
To: Manos Antonakakis <manos@gatech.edu>
CC:
Subject: Re: trip to Atlanta
Oh, so now you don’t think I’m pretty?
> On Jun 16, 2017, at 2:52 PM, Antonakakis, Emmanouil K <manos@gatech.edu> wrote:
>
> the last six months or so I have been bossed around from other members of the Keromytis family. Have a
feeling that you bossing me around will be a walk in the park --- and frankly you would make a prettier boss _by miles_ in
comparison to my previous (bald) experience. ;-)
>
> The only thing I cannot help you with is spa, mani-peti, shopping etc. That is domain. The closest I can come
is my name on the credit card used for all these.
>
> As said, you will have a floor (not a room) to your self. So, I am pretty sure we can manage having you around.
Of course you will be staying with us.
>
> Cheers,
>
> Manos
>
> ________________________________________
> From:
> Sent: Friday, June 16, 2017 1:06 PM
> To: Angelos Keromytis;
> Cc: Antonakakis, Emmanouil K
> Subject: Re: trip to Atlanta
>
> Thanks, honey, for arranging the flights.
>
> I’ve added to this line.
>
> Now then, Manos, are you really ready!!?? I’m going to pull out my inner diva and boss you around that weekend. That’s
assuming you are around.
> And, more importantly, , will you be there to boss him around too and have him drop us for spa, lunch &
shopping?
>
> :-) :-) :-)
>
> Seriously, are you guys around? I’m happy to get a hotel and a car and wander about with a gps….I am *very*
comfortable on my own!
>
>
>
>
>
>
>
>> On Jun 16, 2017, at 10:32 AM, Angelos D. Keromytis wrote:
>>
>> DCA -> ATL with American 4535 (8pm -> 10:04pm) on June 23
>> ATL -> DCA with American 4680 (7:25pm -> 9:30pm) on June 26
>>
>> -Angelos
>>
>
Sent on: Saturday, June 24, 2017 1:06:12 AM
To: Manos Antonakakis <manos@gatech.edu>;
CC:
Subject: Re: trip to Atlanta
And cell number is
> On Jun 23, 2017, at 8:04 PM, wrote:

>
> Howdie!
> Just boarded flight. Leaving 20 minutes late. I'm on American 4535.
> See you in a few!
>
>
> Sent from my iPhone
>
> On Jun 22, 2017, at 8:44 PM, Antonakakis, Emmanouil K <manos@gatech.edu> wrote:
>
>> Hey , having dinner with and we are looking forward to your visit tomorrow. She managed to get
Sunday off, so she will have a lot of time to show you around too.
>>
>> We will both be waiting for you at the airport tomorrow night.
>>
>> Safe travels!
>>
>> Manos and
>>
>> ---
>> Typos due to mobile device ...
>>
>> On Jun 21, 2017, at 09:06, wrote:
>>
>>> This is almost funnier because we know the results today!
>>> https://m.youtube.com/watch?v=L_OVlVR3LWI
>>>
>>> Sent from my iPad
>>>
>>> On Jun 17, 2017, at 12:02 PM, Manos Antonakakis <manos@gatech.edu> wrote:
>>>
>>>> On Sat, Jun 17, 2017 at 11:47:38AM -0400, Angelos D. Keromytis wrote:
>>>>> Oh, so now you don’t think I’m pretty?
>>>>
>>>> H i l a r i o u s!!!!!
>>>>
>>>> --
>>>> Manos Antonakakis | manos@gatech.edu
>>>> Georgia Institute of Technology
>>>> FF7D 4FDF 9115 8077 92D2 5B59 5120 5E89 BE1B 3668

GT Docs 9

Uploaded by

Copyright:

Available Formats

GT Docs 9

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

GT Docs 9

Uploaded by

Copyright:

Available Formats

From: "Antonakakis, Manos" </O=EXCHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP

Call and I will explain.

> On Aug 4, 2018, at 1:50 PM, Antonakakis, Manos <manos@gatech.edu> wrote:

> On Oct 25, 2017, at 11:37, Antonakakis, Manos <manos@gatech.edu> wrote:

Will do, yes.

Likewise. Let me know logistics and I'll work it into my schedule.

On Tue, May 8, 2018 at 8:41 AM, Antonakakis, Manos <manos@gatech.edu<mailto:manos@gatech.edu>> wrote:

Very cool, Jason.

If you do not mind give me a call so I can assess the time we

I am tentatively projecting 3 individuals (me & 2 others). To my knowledge,

Thanks very much!

Jason D. Stambaugh, SA, USAF

Comm: (571) 305-8850

Great! What time would you like to sync up...and where?

Thanks & Regards,

Jason D. Stambaugh, SA, USAF

Comm: (571) 305-8850

Thanks & Regards,

Jason D. Stambaugh, SA, USAF

Comm: (571) 305-8850

We'd be happy to sit down, as Manos mentioned. Also understand that it

Look forward to hosting you.

> On May 2, 2018, at 08:12, STAMBAUGH, JASON D SA USAF AFOSI AFOSI/XRCY

I don't know yet. Plan without me.

Very cool, Jason.

Thanks very much!

Jason D. Stambaugh, SA, USAF

Comm: (571) 305-8850

Great! What time would you like to sync up...and where?

Thanks & Regards,

Jason D. Stambaugh, SA, USAF

Thanks & Regards,

Jason D. Stambaugh, SA, USAF

Comm: (571) 305-8850

Look forward to hosting you.

> On Jan 31, 2018, at 12:13, Antonakakis, Manos <manos@gatech.edu> wrote:

Danielle, you should have the slides via AMRDEC.

Looking forward to seeing everyone on Friday!

Computer Scientist, Cyber Operations Branch (RIGB)

Kudu and GT please add the following markings to your slides:

All other teams, please add the following to your slides:

Let me know if you have any questions.

Just sent them to you via ARMDEC.

For future presentations, please do not include the distro statement.

Manos: Thank you - downloaded successfully.

From: Antonakakis, Manos [mailto:manos@gatech.edu]

Sent: Tuesday, November 28, 2017 10:44 PM

To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB <danielle.gambino@us.af.mil>

Cc: Keromytis, Angelos <angelos.keromytis@darpa.mil>; Patel, Tejas (contr-i2o) <

Subject: [Non-DoD Source] Re: DARPA EA PI Meeting - Draft Slides Due

Danielle, you should have the slides via AMRDEC.

Manos Antonakakis | manos@gatech.edu

Georgia Institute of Technology

From: Antonakakis, Manos

Sent: Tuesday, November 28, 2017 5:32:06 PM

To: GAMBINO, DANIELLE M CIV USAF AFMC AFRL/RIGB

Cc: Keromytis, Angelos; Patel, Tejas (contr-i2o); Maddern, Thomas (contr-i2o)

Subject: Re: DARPA EA PI Meeting - Draft Slides Due

Manos Antonakakis | manos@gatech.edu

On 4/6/18, 7:44 AM, "Antonakakis, Manos" <manos@gatech.edu> wrote:

Can you ask Pano to take a quick look?