Canadian authorities arrested the teen in the Montreal area over the weekend and charged him on Monday but kept the records sealed because of his age.
ABCNEWS has learned that Mafiaboy has been charged with at least one of the attacks that took down leading Web sites such as Yahoo!, CNN.com, Amazon.com and E*TRADE.
The attacks alarmed Internet users across the globe and shook the e-commerce industry because of the ease with which major sites were made inaccessible. The attackers took over computers around the world and used them to bombard victims sites with so much data that users could not access them.
School Computer Used in Attacks
Investigators were able to trace the attacks to Mafiaboy by examining the log files of a computer at a University of California at Santa Barbara research lab, which was among those used to attack the CNN.com site.
A hacker electronically broke into the UCSB computer on Feb. 8 and instructed it to send large amounts of traffic to CNN.coms Web site, campus network programmer Kevin Schmidt told ABCNEWS.com.
The Royal Canadian Mounted Police is expected to announce the arrest in a press conference Wednesday at 10:30 a.m. ET. The Justice Department and the FBI, which assisted in the investigation, also are expected to make a statement afterward.
Revealing Chat Room Logs
ABCNEWS.com first reported that Mafiaboy was one of the top suspects on Feb. 16. ABCNEWS.com reported that the FBI obtained chat room logs showing that Mafiaboy asked others what sites he should take downbefore the sites were attacked.
Internet security expert Michael Lyle told ABCNEWS.com at the time that he communicated with Mafiaboy and the 15-year-old claimed credit for attacking not only CNN.com but also E*TRADE and several smaller sites. Mafiaboy also shared technical information that only someone involved in the attacks would know, Lyle said.
Mafiaboy was saying What should I hit next? What should I hit next? and people on the channel were suggesting sites, and Mafiaboy was saying, OK, CNN, said Lyle, the chief technology officer for Recourse Technologies Inc., an Internet security company in Palo Alto, Calif.
And shortly thereafter the people on the channel would be talking about CNN going down. If you look at the time stamps on the logs, they also coincide with CNN going down.
Lyle said the log files show similar discussions prior to the Feb. 9 attacks on E*TRADE and several other smaller sites.
A subscriber called Mafiaboy previously held two accounts with Delphi Supernet, a Montreal Internet service provider that Toronto-based ISP Internet Direct bought last year.
The accounts were closed in March 1998 because Mafiaboy violated subscriber policies, but Internet Direct would not say what the violations entailed.
ABCNEWS' Simon Surowicz contributed to this report.