I was right about one thing: Shimmy very quickly learned of our break-in. Because JSZ and I were both so focused on getting a copy of his files, we didn’t notice that he was running "tcpdump"—a network monitoring tool to capture all network traffic. We also didn’t notice that a program called "cron" was periodically emailing his system logs to Andrew Gross, Shimmy’s assistant. Gross realized the logs were getting smaller and tipped off Shimmy that something suspicious was going on. As soon as Shimmy looked through the logs, he realized he had been hacked.