****************************************************************************
>C O M P U T E R U N D E R G R O U N D<
>D I G E S T<
*** Volume 1, Issue #1.02 (April 2, 1990) **
****************************************************************************
MODERATORS: Jim Thomas / Gordon Meyer
REPLY TO: TK0JUT2@NIU.bitnet
SUBSCRIBE TO: INTERNET:TK0JUT2@NIU.BITNET@UICVM.uic.edu
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.
--------------------------------------------------------------------
DISCLAIMER: The views represented herein do not necessarily represent the
views of the moderators. Contributors assume all responsibility
for assuring that articles submitted do not violate copyright
protections.
--------------------------------------------------------------------
-------------------------------------------------------------------
IN THIS ISSUE:
File 1: Messages Received
File 2: Hacking in England (news article)
File 3: The FBI and BBS Surveillance (PHRACK Reprint)
--------------------------------------------------------------------
This is the third issue, and if you haven't received either of the first
two even though you have subscribed, let us know. It means that mail is not
getting through the gateway. If you know of anybody who has added their
name to the mailing list but has not received any issues yet, let us know.
We apologize for the problems, especially duplicate files, in the CuD 1.02
mailing. We are still working out mailing glitches.
As some of you noticed, file headers still contain the addresses of all
those to whom the batch is sent. We have broken the batches down into
groups of about 25, so you are only seeing a portion of the list. However,
this is still unacceptable. We are working on the problem. Until then, we
will either break batches down into groups of 5, or, most likely, send them
out individually, which is a drag with about 150 subscribers. We are
experimenting with LISTSERV, and have asked comserve for suggestions.
If you know of anybody who has added their name to the mailing list but has
not received any issues yet, let us know. We apologize for the problems,
especially duplicate files, in the CuD 1.02 mailing. We are still working
out mailing glitches.
--------------------------------------------------------------
We have received many, many requests of the files we listed. Providing an
archive service may not have been one of our better ideas. At the moment
(middle of the term) we don't have the time to comply with the heavy
request load. But, we remain convinced that such an archival service is
needed, because such files are not currently preserved in libraries. So,
we are exploring options. We have encountered the following problems:
1. Time (or lack of it) and digging out files on an ad hoc basis
2. Size: Most of the ascii files are over 100 K, and some systems have
kicked these back. A complete set of some files would run as high as 5
megs, and to send these out would jam most systems, even if sent out over a
few days.
Possible solutions:
1. Upload them to a local (DeKalb) BBS from which they could be downloaded.
We would have to obtain university permission, but there is currently a
multi-line BBS here that could handle such requests.
2. Send them out by snail mail to anybody who wanted to send disks and a
self-addressed, stamped envelop. We could then put them in a ZIP file to
reduce space by about 60 percent and return them.
Any other suggestions??
From the material we're getting, it looks like we can put an issue out
about once a week. We will send them in the early part of the week to avoid
weekend mail-jams.
--------------------------------------------------------------------
"COMPUTER ABUSE" OR "CONTROLOGY?"
In a forthcoming article (CONTEMPORARY CRISES, 1990), Ray Michalowski and
Erdwin Pfuhl argue that in the years following the 1986 passage of the
federal computer abuse laws, and despite additional state laws, there were
very few prosecutions or indictments of hackers. Yet, in recent months,
hacker prosecutions seem to be making local and national news. Is there
*really* an upsurge in abuse, or are law enforcement authorities
over-reacting to media hype and hysteria by dramatizing their "concern"
through over-enforcement? Jason Ditton (in his book CONTROLOGY) and Mark
Fishman have argued that too often "crime waves" are do not reflect an
increase in unacceptable behaviors as much as they do social responses to
public fears or publicity surrounding a given type of incident. More
simply, there are often not "crime waves," but rather "control waves." To
dramatize competency and effectiveness, government agencies and law
enforcement officials respond to images of "danger" by dramatizing their
concern in the form of "crackdowns." The current Draconian anti-drug
legislation is one example. We suppose that the good news is that whenever
the government declares war on something, it's been lost (witness the "war
on poverty," the "war on crime," the "war on drugs"). This military
metaphor does not work well as a social policy, but the repercussions are a
fiscal drain and a gradual loss of Constitutional freedoms. If you come
across stories in your local papers on any aspect of computer prosecution
(use of computers in felonies, prosecution, indictments, or arrests of
hackers, confiscation of computer equipment, etc.), please transcribe the
articles (including source, date and page numbers), and pass them along.
HOWEVER, BE SURE NO COPYRIGHTS ARE INFRINGED. We assume that contributors
have checked, because we cannot check every article that comes in. Thanks.
J&G
--------------------------------------------------------------------
***************************************************************
*** Computer Underground Digest Issue #1.02 / File 1 of 3 ***
***************************************************************
From: mnemonic@walt.cc.utexas.edu(Mike Godwin)
Message-Id: <9003311359.AA25162@vondrake.cc.utexas.edu>
To: TK0JUT2%NIU.BITNET@UICVM.uic.edu
Subject: Re: Computer Underground Digest, Issue 1.01
Writes Mark Seiden:
"(Note for the Tomorrow File: A new source of revenue for lawyers: store
your hacker-client's backup tapes, which would then be protected as
privileged communication?)"
Unfortunately, backup tapes probably are probably not "privileged communication"
within the meaning of attorney-client privilege. A court or magistrate could
almost certainly order its production by the attorney in whose custody it was.
The only possible theory of non disclosure that comes to mind is the
work-product doctrine, and even that doctrine would apply only if the backup
were made specifically for the purpose of preparing for litigation.
In general, attorney-client privilege only applies to things that clients
SAY (or write) to their attorneys, not things they GIVE to their attorneys.
And, incidentally, the attorney-client privilege cannot, in itself, be "a
source of revenue" for lawyers. Once you've contracted for an attorney-client
relationship, your attorney has to keep privileged communications secret even
if you *don't* ask him to or pay for him to.
(You can, of course, give him specific permission to disclose such information.)
--Mike
==============================================================================
----------------------------------
Pat Townson of TELECOM DIGEST passed the following along to us. %eds%.
Any responses?!?
--------------------
Subject: More L.O.D.
To: "Submission to comp.dcom.telecom" <telecom@eecs.nwu.edu>
Date: Mon, 2 Apr 90 16:03:54 EST
From: Don H Kemp <dhk@teletech.uucp>
Message-Id: <9004021603.AA12172@teletech.UUCP>
As reported in AT&T's Consultant Liason Program electronic
newsletter "Newsbriefs":
>
> LEGION OF DOOM -- ... A government affadavit alleged that in June
> hackers believed to be Legion of Doom members planted software
> "time bombs" in AT&T's 5ESS switching computers in Denver, Atlanta
> and New Jersey. These programs ... were defused by AT&T security
> personnel before they could disrupt phone service. ... New York
> Newsday, p. 15, 4/1.
>
--
Don H Kemp "Always listen to experts. They'll
B B & K Associates, Inc. tell you what can't be done, and
Rutland, VT why. Then do it."
uunet!uvm-gen!teletech!dhk Lazarus Long
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+ END THIS FILE +
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
***************************************************************
*** Computer Underground Digest Issue #1.02 / File 2 of 3 ***
***************************************************************
------------------------------------
Some English Members of Parliament seem as hell-bent on hysteria-mongering
as some here in the U.S. The following was passed on from a Southerner who
thought it of interest %eds%.
--------------------------------------------------------
Civil Liberties
HACKED TO PIECES
Jolyon Jenkins Refuses to Panic over Computer Crime
%From NEW STATESMAN & SOCIETY, Feb. 9, 1990: p. 27%
Why should anyone other than spotty youths and hi-tech fraudsters care
about new legislation to ban computer hacking? For this reason: laws made
in response to moral panic usually fail to catch the real villains and end
up pushing back civil liberties for everyone else. The Computer Misuse
Bill, published two weeks ago by Tory MP Michael Colvin and likely to
become law, is just such a measure.
The debate over hacking is like the panic over video nasties: a new
technology which people view with suspicion, ill-founded anecdotal
research, and overblown language. Emma Nicholson MP, who set this hare
running with a private member's bill last year, is the chief culprit. In a
recent interview with the SUNDAY CORRESPONDENT MAGAZINE she said that
hackers were "malevolent, nasty, evil-doers" who "fill the screens of
amateur %computer% users with pornography". She claimed that European
Greens hack into the comupters of large companies and use the information
they extract to carryout "bombings and fires". When asked to justify the
allegations she produced a back copy of an anarchist magazine called
INSURRECTION, whose contents fell somewhat short of the required proof, and
then cited "unofficial secret-service trackers close to the Dutch
government", who could not be named.
Nicholson has produced a dossier of "hacking incidents" that she insists
are so confidential that she refuses to reveal the sources to anyone, even
the Law Commission, which recently completed an investigation of the
subject. This makes it hard to assess the quality of her information. But
one of the cases is identifiable and does not inspire confidence in the
rest. It concerns someone who allegedly put a "logic bomb" in the computer
system of a British airline. This is almost certainly the case of Jim
McMahon who was prosecuted last year at Isleworth Crown Court. After three
and a half weeks the judge stopped the case because he was satisfied that
McMahon was innocent and that the most likely suspect was the chief
prosecution witness. The police had fingered the wrong man--not because of
any gap in the law but because they carried out their investigation
incompetently. Nonetheless, the case apparently remains in the Nicholson
dossier.
The Colvin bill proposes to punish with six months in prison anyone who
gains, or tries to gain, "unauthorised access" to information stored on a
computer. Emma Nicholson is not wholly to blame, because the English Law
Commission produced similar proposals last year. But they are still
objectionable, for several reasons. First, it is like criminalising
trespass. Someone who gains unauthorised access to PHYSICAL premises has
not normally thereby committed a criminal offence, but only a tort, and it
is up to the aggrieved part to start civil proceedings against the
trespasser.
Second, it means that information held on computer becomes property. In
general, information is not protected by law: if I steal a piece of paper
that has valuable facts written on it, it is only the paper I steal, not
the facts. Information held in confidence can be protected (to an
increasing extent) by law; copyright protects the FORM in which information
is held; but you cannot copyright a fact--and the Colvin bill erodes that
principle.
Third, it won't prevent hacking. Emma Nicholson admitted as much in a
debate at Imperial College last month. But she said that it was important
that society should express its moral disapproval of hacking. Experience
suggests that unenforceable moral disapproval is as likely to lead to an
increase in the frowned-on activity as to a reduction.
Fourth, almost all serious computer misuse can be brought before the courts
under existing laws, such as fraud, criminal damage, or theft of
electricity. And in a few years time, hacking by telephone will become
virtually impossible, because System X phone exchanges will be able to tell
the manager of a computer system the number someone is calling from.
Many successful hacks depend on nothing more sophisticated than correctly
guessing a password--such as when I correctly guessed that an ITN
journalist had chosen as his password "ITN". The remedy may be equally
straightforward: use less easily guessable passwords. Further restricting
freedom of information is not the answer.
---- END ----
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+ END THIS FILE +
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
***************************************************************
*** Computer Underground Digest Issue #1.02 / File 3 of 3 ***
***************************************************************
Following the discussion of FBI surveillance in CuD 1.02, the
following was sent in. The contributor's anonymity is protected %eds.%
-----------------------
Date: Sun, 01 Apr 90 17:06 CDT
Subject: FBI BBS Surveillence (PHRACK Article)
----------------------
==Phrack Inc.==
Volume Two, Issue 23, File 10 of 12
In The Spirit Of The Vicious Circle Trilogy...
Phrack Inc. Presents
*****************************************
*** ***
*** Big Brother Online ***
*** ***
*** by Thumpr Of ChicagoLand ***
*** ***
*** June 6, 1988 ***
*** ***
*** Special Thanks To Hatchet Molly ***
*** ***
*****************************************
The United States Government is monitoring the message activity on several
bulletin boards across the country. This is the claim put forth by Glen L.
Roberts, author of "The FBI and Your BBS." The manuscript, published by The
FBI Project, covers a wide ground of FBI/BBS related topics, but unfortunately
it discusses none of them in depth.
It begins with a general history of the information gathering activities of the
FBI. It seems that that the FBI began collecting massive amounts of
information on citizens that were involved with "radical political" movements.
This not begin during the 1960's as one might expect, but rather during the
1920's! Since then the FBI has amassed a HUGE amount of information on
everyday citizens... citizens convicted of no crime other than being active in
some regard that the FBI considers potentially dangerous.
After discussing the activities of the FBI Roberts jumps into a discussion of
why FBI snooping on BBS systems is illegal. He indicates that such snooping
violates the First, Fourth, and Fifth amendments to the Constitution. But he
makes his strongest case when discussing the Electronic Communications Privacy
Act of 1987. This act was amended to the Federal Wiretapping Law of 1968 and
But as with all good laws, it was written in such broad language that it can,
and does, apply to privately owned systems such as Bulletin Boards. Roberts
(briefly) discusses how this act can be applied in protecting *your* bulletin
board from snooping by the Feds.
How to protect your BBS: Do NOT keep messages for more than 180 days. Becaus
the way the law is written, messages less then 180 days old are afforded more
protection then older messages. Therefore, to best protect your system purge,
archive, or reload your message base about every 150 days or so. This seems
silly but will make it harder (more red tape) for the government to issue a
search warrant and inform the operator/subscriber of the service that a search
will take place. Roberts is not clear on this issue, but his message is state
emphatically... you will be better protected if you roll over your message bas
sooner.
Perhaps the best way to protect your BBS is to make it a private system. This
means that you can not give "instant access" to callers (I know of very few
underground boards that do this anyway) and you can not allow just anyone to b
a member of your system. In other words, even if you make callers wait 24
hours to be validated before having access you need to make some distinctions
about who you validate and who you do not. Your BBS needs to be a PRIVATE
system and you need to take steps to enforce and proclaim this EXPECTED
PRIVACY. One of the ways Roberts suggests doing so is placing a message like
this in your welcome screen:
"This BBS is a private system. Only private citizens who are not
involved in government or law enforcement activities are authorized
gained from this system to any government agency or employee."
Using this message, or one like it, will make it a criminal offense (under the
ECPA) for an FBI Agent or other government snoop to use your BBS.
The manuscript concludes with a discussion of how to verify users and what to
do when you find an FBI agent using your board. Overall, I found Roberts book
to be moderately useful. It really just whetted my appetite for more
information instead of answering all my questions. If you would like a copy o
the book it sells for $5.00 (including postage etc). Contact;
THE FBI PROJECT
Box 8275
Ann Arbor, MI 48107
Visa/MC orders at (313) 747-7027. Personally I would use a pseudonym when
dealing with this organization. Ask for a catalog with your order and you wil
the FBI would be interested in knowing who is doing business with this place.
The manuscript, by the way, is about 20 pages long and offers references to
other FBI expose' information. The full citation of the EPCA, if you want to
look it up, is 18 USC 2701.
Additional Comments: The biggest weakness, and it's very apparent, is that
Roberts offers no evidence of the FBI monitoring BBS systems. He claims that
they do, but he does not give any known examples. His claims do make sense
however. As he states, BBS's offer a type of "publication" that is not read b
any editors before it is "published." It offers an instant form of news and
one that may make the FBI very nervous. Roberts would do well to include some
supportive evidence in his book. To help him out, I will offer some here.
* One of the Ten Commandments of Phreaking (as published in the
famous TAP Magazine) is that every third phreaker is an FBI agent.
This type of folklore knowledge does not arise without some kind of
justification. The FBI is interested in the activities of phreakers
and is going to be looking for the BBS systems that cater to them. I
your system does not, but it looks like it may, the FBI may monitor i
just to be sure.
* On April 26, 1988 the United States Attorney's Office arrested 19
people for using MCI and Sprint credit card numbers illegally. These
numbers were, of course, "stolen" by phreakers using computers to hac
them out. The Secret Service was able to arrest this people by posin
as phone phreaks! In this case the government has admitted to placin
there, the success of theis "sting" will only mean that they will try
it again. Be wary of people offering you codes.
* In the famous bust of the Inner Circle and the 414s, the FBI monitore
electronic mail for several months before moving in for the kill.
While it is true that the owners of the systems being hacked (Western
Union for one) invited the FBI to snoop through their files, it does
establish that the FBI is no stranger to the use of electronic
snooping in investigating crimes.
Conclusion: There is no reason to believe that the government is *not*
monitoring your bulletin board system. There are many good reasons to believe
that they are! Learn how to protect yourself. There are laws and regulations
in place that can protect your freedom of speech if you use them. You should
take every step to protect your rights whether or not you run an underground
system or not. There is no justification for the government to violate your
rights, and you should take every step you can to protect yourself.
I have no connections with Roberts, his book, or The FBI Project other then
being a mostly-satisfied customer. I'm not a lawyer and neither is Roberts.
No warranty is offered with this text file. Read and use it for what you thin
it is worth. You suffer the consequences or reap the benefits. The choice is
yours, but above all stay free.
=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+
+ END CuD #1.02 +
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
!