The FBI should start with the a court order and to get the domain registrar to reveal the identity of the person/organization, that registered the domain name lulzsecurity.com which happens to be registered in the Bahamas and can be viewed at : (http://whois.domaintools.com/lulzsecurity.com) as
c/o lulzsecurity.com
N4892 Nassau
Bahamas
Tel: +852.81720004Of course, most likely they used an alias/fake identity. But the hackers had to have left a financial trail when they purchased and registered that domain name, or that phone number, PO Box.