****************************************************************************
>C O M P U T E R U N D E R G R O U N D<
>D I G E S T<
*** Volume 2, Issue #2.01 (Aug 31, 1990) **
****************************************************************************
MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet)
ARCHIVISTS: Bob Krause / Alex Smith
USENET readers can currently receive CuD as alt.society.cu-digest.
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views. CuD material may be reprinted as long as the source is
cited. It is assumed that non-personal mail to the moderators may be
reprinted, unless otherwise specified. Readers are encouraged to submit
reasoned articles relating to the Computer Underground.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent the
views of the moderators. Contributors assume all responsibility
for assuring that articles submitted do not violate copyright
protections.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
CONTENTS:
File 1: Moderators' Corner
File 2: Proposed changees in Computer Abuse Act (S.2476)
File 3: CPSR Seeks FBI data on Bulletin Board Monitoring
File 4: Computers, Social Responsibility, and Political Action
File 5: Another experience with the SS
File 6: CU in the News
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
----------------------------------------------------------------------
********************************************************************
*** CuD #2.01, File 1 of 6: Moderator's corner ***
********************************************************************
Date: August 31, 1990
From: Moderators
Subject: Moderators' Corner
++++++++++
In this file:
1) ERRATA (National Computer Security Conference)
2) LAW ENFORCEMENT POLICY OF "FORFEITURE DEALS"
++++++++++++++++++
Errata: National Computer Security Conference
++++++++++++++++++
In CuD 2.00, a typo occured indicating that "Dorothy Denning will present
my paper on computer hackers." This *should have read* that Dorothy Denning
will present *her* paper on computer hackers. We regret the error, even
though it could have padded our vitas.
++++++++++++++++++++
Law Enforcement Forfeiture "Deals"
++++++++++++++++++++
The recent crackdowns by law enforcement on computer hackers raise serious
questions about Constitutional protections in investigations. One of the
most troublesome practices is that of confiscating all computer and in some
cases non-computer equipment, including printers, telephone answering
machines, cassette tapes, books, personal papers, and other articles
totally unrelated to the alleged offense. Some of the victims of
confiscations have neither been indicted nor are under suspicion for
wrong-doing. Others alleged to have infringed on the law have lost material
unrelated to the offense of which they are suspected.
A troublesome practice seems to be emerging from the confiscations. The
victims are offered a "deal" in which they must choose between having
their equipment forfeited in exchange either for a guilty plea or the
dropping of charges and suffering only a material loss, or fighting the
charges and, even if innocent, running the risk of lengthy delays in the
return of the equipment. For those whose livelihood is invested in the lost
articles, this is not a pleasant choice. The costs of fighting charges,
especially if one is innocent (and we still have a judicial system
supposedly based on presumptive innocence), can far exceed the value of the
equipment. Even if all charges are dropped in exchange for forfeiture, the
result is punishment without trial. Law enforcement officials may argue
that the choice is voluntary, but such a choice is coercive, and a coercive
choice is not a voluntary choice.
The irony of this new version of "Let's Make a Deal" is that those
entrusted to protect the Constitution seem to be hell-bent on subverting
it. The Fourth, Sixth, and Seventh Amendments guarantee protection of
property against unreasonable seizure, and due process protections,
including a trial. It seems that the "forfeiture deals" are justice at its
worst, and the due process model of justice embodied by Constitution
principles has broken down. Agents seem to be trying cases in the media
with hyperbole, disinformation, and distortion, and are abusing their power
and status to punish by forfeiture what they cannot punish in court. It's
a no-win situation for victims, but even worse, it erodes respect for law
and law enforcement by creating a new form of social control by police that
has historically been the domain of the courts. To my mind, the forfeiture
practice is an abuse of law and perhaps even borders on lawlessness.
Jim Thomas
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Date: August 15, 1990
From: Moderators
Subject: Proposed changees in Computer Abuse Act (S.2476)
********************************************************************
*** CuD #2.01: File 2 of 6: Computer Abuse Act Amendment ***
********************************************************************
+++++++++++++++++++++++++
Proposed amendments in the computer abuse act, reported previously in CuD,
do not seem to go far enough in removing the ambiguity from the language of
the Act that currently gives broad powers to federal agents to target those
they perceive as "dangerous" who in fact may not be. Following is the text
of the revision. We invite responses (moderators).
++++++++++++++++++++++++
*******************************************************************
The following is the text of S.2476, a bill proposed to amend
Title 18. For more information, contact:
Committee on the Judiciary
United States Senate
Washington, DC 20510-6275
A summary of the changes follows the text of the bill.
*******************************************************************
101st CONGRESS
2D Session S.2476
To amend title 18 of the United States Code to clarify and expand legal
prohibitions against computer abuse
------------------------------------
IN THE SENATE OF THE UNITED STATES
April 19 (legislative day, April 18), 1990
Mr. Leahy (for himself, Mr. Humphrey, and Mr. Kohl) introduced the
following bill; which was read twice and referred to the Committee
on the Judiciary
------------------------------------
A BILL
To amend title 18 of the United States Code to clarify and
expand legal prohibitions against computer abuse.
1 Be it enacted by the Senate and House of Representa-
2 tives of the United States of America in Congress assembled,
3 SECTION 1. SHORT TITLE.
4 This Act may be cited as the "Computer Abuse Amend-
5 mends Act of 1990".
6 SEC.2. FINDINGS.
7 The Congress finds that--
8 (1) the maintenance of the security and integrity
9 computer systems has become increasingly critical to
10 national security, interstate and foreign commerce,
- 2 -
1 communications, education, science, and technology in
2 the United States;
3 (2) the deliberate abuse of computers and comput-
4 er systems to cause damage, disruption, and interfer-
5 ence with the efficient functioning of computer systems
6 has created significant problems for both government
7 and nongovernment computer systems, and such abuse
8 creates real and potential problems for national securi-
9 ty, commerce, business, science, and education, and
10 imposes significant burdens on interstate and foreign
11 commerce;
12 (3) in light of rapid developments in computer
13 technology, it is necessary to revise and clarify existing
14 Federal laws governing computer security and abuse to
15 assure that novel forms of serious computer abuse are
16 clearly prohibited; and
17 (4) it is the intent of this Act to exercise the full
18 scope of the powers of Congress under the Commerce
19 Clause of the United States Constitution to regulate
20 forms of computer abuse which arise in connection
21 with, and have a significant effect upon, interstate or
22 foreign commerce.
- 3 -
1 SEC.3. AMENDMENTS TO THE COMPUTER FRAUD AND ABUSE
2 ACT.
3 (a) PROHIBITION.--Section 1030)(a)(5) of title 18,
4 United States Code, is amended to read as follows:
5 "(5)(A) through means of or in a manner affecting
6 a computer used in interstate commerce or communica-
7 tions, knowingly causes the transmission of a program,
8 information, code, or command to a computer or
9 a computer system if the person causing the transmission
10 intends that such program, information, code or
11 command will damage, disrupt, alter, destroy, or mis-
12 appropriate the functioning, use, programs, systems,
13 databases, or other information of or contained in the
14 affected computer or computer system and the trans-
15 mission of the harmful component of the program,
16 information, code, or command--
17 "(i) occured without the knowledge and au-
18 thorization of the persons or entities who own or
19 are responsible for the computer system receiving
20 the program, information, code, or command; and
21 "(ii)(I) causes loss or damage to one or more
22 other persons of a value aggregating $1,000 or
23 more during any one-year period; or
24 "(II) modifies or impairs, or potentially modi-
25 fies or impairs, the medical examination, medical
- 4 -
1 diagnosis, medical treatment, or medical care of
2 one or more individuals; or
3 "(B) through means of or in a manner affecting a
4 computer used in interstate commerce or communica-
5 tions, knowingly causes the transmission of a program,
6 information, code or command to a computer or com-
7 puter system if the person caused the transmission with
8 reckless disregard for whether the transmission will
9 damage, disrupt, alter, destroy or misappropriate the
10 functioning, use programs, systems, databases, or other
11 information of or contained in the affected computer or
12 computer system and the transmission of the harmful
13 component of the program, information, code, or com-
14 mand--
15 "(i) occured without the knowledge and au-
16 thorization of the persons or entities who own or
17 are responsible for the computer system receiving
18 the program, information, code, or command; and
19 "(ii)(I) causes loss or damage to one or more
20 other persons of a value aggregating $1,000 or
21 more during any one-year period; or
22 "(II) modifies or impairs, or potentially modi-
23 fies or impairs, the medical examination, medical
24 diagnosis, medical treatment, or medical care of
25 one or more individuals; or".
- 5 -
1 (b) PENALTY.--Section 1030(c) of title 18, United
2States Code is amended--
3 (1) by striking "and" after the semicolon at the
4 end of paragraph (2)(B);
5 (2) in paragraph (3)(A) by inserting "(A)" after
6 "(a)(5)"; and
7 (3) in paragraph (3)(B) by striking the period at
8 the end thereof and inserting "; and"; and
9 (4) inserting at the end thereof the following:
10 "(4) a fine under this title or imprisonment for not
11 more than 1 year, or both, in the case of an offense
12 under subsection (a)(5)(B).".
13 (c) DEFINITION.--Section 1030(e) of title 18, United
14States Code, is amended--
15 (1) in paragraph (6), by striking "and" after the
16 semicolon;
17 (2) in paragraph (7), by striking the period and in-
18 serting "; and";
19 (3) by adding after paragraph (7) the following
20 new paragraph:
21 "(8) the term 'access' means--
22 "(A) to gain access to the stored or displayed
23 information or to the functions of a computer or
24 computer system in such a way that infor-
- 6 -
1 mation can be seen or otherwise deciphered or
2 such functions can be performed; or
3 "(B) to transmit, or cause the transmission
4 of, a program, information, code, or command to a
5 computer or computer system under circumstances
6 where the person causing the transmission in-
7 tends, or reasonably expects, that such program,
8 information, or command will significantly
9 damage, disrupt, alter, destroy, or misappropriate
10 the functioning, use, programs, systems, data-
11 bases, or other information of or contained in that
12 computer or computer systems, whether or not
13 the persons causing th transmission gains access
14 in the manner described in subparagraph (A).".
15 (d) CIVIL ACTION.--Section 1 3 of title 18, United
16 States Code, is amended by adding at the end thereof the
17 following new subsection:
18 "(g) Any person who suffers damage or loss by reason
19 of a violation of this section may maintain a civil action against
20 the violator to obtain compensatory damages and injunctive
21 relief or other equitable relief.".
<<END>>
********************************************************************
SUMMARY OF LEAHY/HUMPHREY COMPUTER ABUSE AMENDMENTS ACT OF 1990
(Provided by Senator Leahy's office)
********************************************************************
NEW CRIME
Makes it a felony intentionally to cause harm to a computer or the information
stored in it by transmitting a computer program or code (including computer
viruses) without the knowledge and authorization of the person responsible for
the computer attacked.
Makes it a misdemeanor recklessly to cause harm to a computer or the
information stored in it by transmitting a computer program or code (including
computer viruses) without the knowledge and authorization of the person
responsible for the computer attacked.
JURISDICTION
Covers harm to any computer or program that involves $1,000 worth of damage or
tampering with medical records.
PENALTY
Find and/or imprisonment for up to five years for the felony. Fine and/or
imprisonment for up to one yer for the misdemeanor.
CIVIL CAUSE OF ACTION
Creates a new, civil cause of action for those harmed by a violation of the
Act for compensatory or injunctive relief.
DEFINITION OF "ACCESS"
Defines "access" -- a term used throughout the Computer Fraud and Abuse Ace --
to cover the remote transmission of a program to affect a computer or the
information stored in it.
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Date: July 24, 1990
From: Computer Professionals for Social Responsibility
Subject: CPSR Seeks FBI data on Bulletin Board Monitoring
********************************************************************
*** CuD #2.01: File 3 of 6: CPSR Seeks FBI BBS monitoring data ***
********************************************************************
+++++++++++++
The following notice from CPSR is reprinted with permission.
+++++++++++++
LAWSUIT SEEKS FBI RECORDS ON COMPUTER MONITORING
Computer Professionals for Social Responsibility filed a lawsuit in
Federal District Court today to obtain information from the FBI about the
monitoring of computer bulletin boards.
Marc Rotenberg, director of the CPSR Washington Office, said that the
disclosure of the records would provide a starting point for an informed
discussion about the proper scope of computer crime investigations. He
said that the FBI's failure to respond to CPSR's original Freedom of
Information Act request made the lawsuit necessary.
A computer bulletin board is a publicly accessible computer system that is
designed to promote the exchange of views and information. Computer
bulletin boards are also used for confidential communications that are
directed to one or more specific parties.
The Freedom of Information Act provides a legal right for individuals to
obtain records held by government agencies. Under the law, agencies are
required to respond within ten working days. When agencies fail to respond
within a reasonable period of time, requesters often begin legal
proceedings to obtain the information.
CPSR filed the original FOIA request in August, 1989. After a series of
letters from CPSR to the FBI failed to produce a response, the FOIA request
was considered at a Congressional hearing in February, 1990. A subsequent
letter from the Treasury Department revealed that the Secret Service was in
fact monitoring computer bulletin boards. The FBI's activities are still
not known.
The lawsuit comes at a time of growing concern over the conduct of
computer crime investigations directed toward "computer hackers." In one
case, charges were dropped against a newsletter publisher after claims that
a confidential business document was disclosed turned out to be false. In
another case a game manufacturer in Austin, Texas suffered substantial
business losses after a Secret Service raid earlier this year, though no
charges were ever brought against the owner or his company.
The case is CPSR v. FBI. Civil Action No. 90-2096, U.S. District Court for
the District of Columbia, August 28.
For more information contact, the CPSR Washington Office, 1025 Connecticut
Ave., NW, Suit 1015, Washington DC 20036 (202) 775-1588 or
rotenberg@csli.stanford.edu.
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Date: 19 August, 1990
From: Bob Gleason
Subject: Computers, Social Responsibility, and Political Action
********************************************************************
*** CuD #2.01: File 4 of 6: Computers, Social Responsibility ***
********************************************************************
++++++++++++++++++++++++++
In a recent discussion on The Well, there have been debates about how to
respond to law enforcement attacks on "hackers." Topics incuded how to
educate the public, whether it is better to use the metaphor of "war" or
"peace" in responding, and how, in general, does one mobilize a large group
to address what are perceived to be threats to civil liberties. George
Gleason argues for conciliation, but recognizes that the resolution lies
in the broader problem of public apathy and wider social issues.
+++++++++++++++++++++++++++++++
Twenty-five percent of Americans own personal computers. It is most
likely that these individuals come almost entirely from the more
privileged half of society. Most of the people who use computers do so in
routine capacities such as clerical jobs or academic writing. Awareness
of the political and personal empowerment possibilities of the computer,
is limited to a small subculture, many of whose members are concentrated
in the Bay Area and the urban Northeast.
The fine points on which our arguments rest lie outside of the
experience of most of the population. We are talking about specialised
knowledge, and even though it has broad implications, it is difficult to
understand without at least a certain familiarity with some of this
specialised knowlede base. The position is similar to that of geneticists
engaged in engineering microbes to alter plant behavior, and faced with
public opposition to improbable consequences of their work.
The other face of the debate over "elitism" rests on the contents of my
statement, to which I next turn.
Here we see a mainstream culture which is engaged in behavior that is
ecologically and in other ways non-sustainable. We also see a vast scale
of aacquiescence in a political agenda of creeping authoritarianism. We
also see the continuation of cultural norms that support greed and
self-centeredness to the exclusion of other values.
A person can take an attitude of support for these cultural norms, or of
mere acceptance of them, or of opposition to them. Those who support can
be seen as doing so out of commitment to either an actual or potential
benefit they may realize from their position: for instance a high-paying
job in the military-industrial bureaucracy, or the symbolic identification
with nationalistic themes, etc. More typical, and in fact the large
majority by most measures, is a mood of acquiescence, plus or minus some
grumbling. My argument is based on the position that acquiescence is
nearly as problematic as active malice, and that acquiescence represents
the utter abdication of personal responsibility for ethical choice.
Now for any given individual, one or more of the following can be true:
-He or she is being manipulated by the media or other large institutions.
-He or she is more interested in personal gain than in public issues which
involve consequences to others. -He or she is under sufficient pressure
of circumstance as to have no opportunity to engage in various acts of
personal liberation, public opposition, or even basic creativity. (For
example, parenthood plus a full-time job).
In the last case we can see at minimum the decision that the status quo is
better than taking a chance on the unknown. Whether this decision is
"right" or "wrong" isn't up to me. The question I have to raise though
is, "How bad do things have to get before people rise up?" The extreme
case can be seen in the black community: economic oppression, the
destruction of an entire generation by drugs, poverty, violence, etc. One
wonders why the signs of collective outrage have not become more evident
in that community: the history of the political repression in the 60s
supplies part of the answer.
However, most people in the mainstream aren't under that kind of extreme
pressure of circumstances. For them, acquiescence is either a matter of
being manipulated or being selfish.
Are we going to say that the public are brainwashed? Does this imply that
we ourselves are relatively free of brainwashing? That would be awfully
elitist, wouldn't it?; and as well, would create a mass "victim" role. If
we truly believe that brainwashing by TV and so on is the cause of the
predicament, we are left facing a force that is so powerful as to be
unstoppable: How can our calls to freedom and lofty ideals ever begin to
compete with the pleasures of the shopping mall and consumption lifestyle?
How can our press conferences and pamphlets be heard and seen above the
din of commercial jingles and junk mail? What have we to offer that can
satisfy basic needs and desires? A meager existence in cramped housing
and on a hippie diet, made tolerable by an ethic of sustainability? There
is no substantial alternative economy anywhere in view. Our alternative
culture is either barely able to survive or supported by rare cases of
vast success whose effects even so are not able to build a truly
large-scale example which can become self-supporting.
Instead, are we going to say that the public are acting selfishly? That
would cast the majority in a moderate version of the role of "Good
Germans." Instead of an absence of insight and will, there would be an
absence of ethics and basic compassion. The result of this is even more
dire: it is not that people don't know what they want, it's that they want
more or less what they're getting, *including* the consequences of
intolerance and repression and injustice. In that case, what alternative
have we to offer? Simulations of public executions, to stem the desire
for the real thing? Simulations of other forms of evil, which serve to
disguise good done in secret? That appears rather Machiavellian. Or
instead should we fold inwardly and hide from the rising tide? A limited
escape if that.
Sixty percent of the public don't vote. Sixty five percent of people
under 35 years of age don't read newspapers or watch broadcast news
(source Newsweek poll a few weeks ago). When "don't know" is compounded
with "don't care," we are in deep shit.
Fact is, I believe that there may be some way out. As Huxley said,
"Nothing less than everything is truly sufficient." It does cause me much
despair to see that the vast majority of our resources are committed to
fighting a holding action where success is measured in the absence of
defeat. I believe that a key element in the overall solution needs to
take the form of cohesive examples of alternative economic and cultural
entities. Integral neighborhoods, intentional communities (not the same
as "hippie communes" thank you), cooperative enterprises; generating a
sustainable *and* prosperous way of living by higher ideals and deeply
considered values. Not isolated on little islands, but integrated with
the overall economic and cultural sphere while retaining distinct
identity. And of course, publicized as such, to provide accessible models
from which to proceed further. . . .
We all have our cynical moods. Contemplating the overall scale of the
predicament of what used to be called "civilization," is frightening and
can as easily give rise to despair as it does inspiration and hope for
change. I think one thing we all share here is a commitment to creating a
better world in many ways. Argument and debate are valuable ways of
clarifying views and reaching a more cohesive synthesis.
My cause of despair is that a huge amount of talent and energy and
resources are going into what is basically the equivalent of defence
expenditures. On very many fronts. Realistically I'd like to suggest a
concentration of political effort in one specific geographic area, to
create and maintain an area which is conducive toward the creation of real
alternative institutions of all kinds. From a strong and solid base like
that, we can move outward and affect other areas. There are plenty of
other ways to get at an agenda that actually moves forward instead of
fighting defensively. I think the people who talk in terms of educating
our opponents are on the right track: not us/them, but "all of us," and
solving problems together. "Nothing less than everything is truly
sufficient," isn't a cry of despair but an affirmation of the need for
everyone to play whatever part their conscience moves them toward.
Forward!
***************
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Subject: Another experience with the SS
From: Anonymous, somewhere in Texas
Date: Tue, 28 Aug 90 21:14:19 CDT
********************************************************************
*** CuD #2.01: File 5 of 6: Another Experience with the SS ***
********************************************************************
++++++++++++++++++++++++++++++++++
%The moderators deleted the identity of the following article's author because
of legitimate concerns for his welfare. He is considered by those familiar
with his situation to be another victim of recent SS activity, and the need
to conceal his identity further illustrates the chilling effect on freedom
of speech that the SS has created--moderators.%
+++++++++++++++++++++++++++++++++++++++++
I just remembered a Texas tie-in to the LOD name. I found this in Mike
Cochran's book "And deliver us from evil," from Texas Monthly Press. In
the concluding essay, he wrote,
And, if there was a roll call for bizarre Texas crime, it surely
would include:
[ (accounts of mayhem removed)
-- The Legion of Doom, an up-scale group of student vigilantes who
used dead cats, car bombs, and other forms of intimidation to shape
up the riffraff at Fort Worth's Paschal High. Their misguided crusade
got them in a heap of trouble, but they all escaped jail.
Speaking of reading... I re-read CUD 1.18 today. There are parts of John R.
Simpson's response to Representative Don Edwards' FOI inquiry that, ahem, do
not compute. Like this:
"We do not keep records of the bulletin boards which we have
monitored but we can provide information concerning a particular
board if we are given the name of the board."
Well, maybe they'd go check the board out again. But, as "records of the
bulletin boards which we have monitored" may include communications program
dialing directories and call logs, as well as telephone records of outgoing
calls, I know that what Simpson has said isn't true. Let's see what's on
those disks and phone bills, Uncle Sam!
But the real corker is:
"No, the U.S. Secret Service has not created a computer bulletin
board nor a network which was offered to members of the public. We
have created an undercover bulletin board which was offered to a select
number of individuals who had demonstrated an interest in conducting
criminal activities. This was done with the guidance of the U.S.
Attorney's Office and was consistent with the Electronic Communications
Privacy Act."
When I was interviewed by the Secret Service in early 1990, SS Agent Timothy
Foley discussed the UNIX system known as "attctc", formerly called "killer."
Agent Foley discussed the status of jolnet and attctc, claiming that "I own
jolnet" and "I own attctc." He also asked me why I thought AT&T would fund
attctc. His answer to his own question was that attctc existed "for the
"for the purpose of monitoring the hacker community." When it was still
running, attctc was once referred to as "the largest mail hub in the
Southwest." Did AT&T provide Secret Service agents with access to attctc? I
had this view of attctc as a kink in the image of AT&T as an all-devouring
monopoly, and approved of it as good for the image of AT&T. But if it was a
listening post, well, I take it all back. It was >very< available to the
public.
What role did Uncle Sam and the Secret Service have in the management, funding
and operation of attctc?
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Date: August 30, 1990
From: <Michael.Rosen@SAMBA.ACS.UNC.EDU>
Subject: CU in the News
********************************************************************
*** CuD #2.01: File 6 of 6: The CU in the News ***
********************************************************************
Source: Computerworld, Aug. 27, 1990, pg. 6, News Shorts
"NSA Denise Killing Security Center"
The National Security Agency (NSA) last week denied a published account
that said the agency is dismantling its National Computer Security Center,
a semipublic unit of the supersecret agency that was established by the
U.S. Department of Defense in 1982 to evaluate and certify the security, or
levels of trust, of computer systems. A spokeswoman for NSA said the
center is being restructured to align its activities more closely with
NSA's communications security work. The move was prompted by the blurring
of distinction between telecommunications and computer systems, she said.
Patrick Gallagher will remain director of the center, and the center will
continue to meet its commitments to industry for product evaluation and
certification, the spokeswoman said.
************************************************************
Source: Computerworld, Aug 20, 1990, p. 74:
"Bozhe Moy! Hackers and viruses already plague Soviets"
There have already been computer crimes and virus attacks in the USSR.
Over the last several years, the number of incidents has appeared to
increase along with other forms of crime.
One of the earliest cases of a computer virus in the USSR occurred in 1988
when an unidentified programmer at the Gorky Automobile Works on the Volga
River was charged with deliberately using a virus to shut down an assembly
line in a dispute over work conditions. The man was convicted under
Article 206, the so-called hooliganism law, which provides for a jail term
of up to six years for "violating public order in a coarse manner and
expressing a clear disrespect toward society."
The comments about viruses heard at a number of meetings are worth
reporting:"We are ready to meet the problem." (Moscow State University);
"Viruses come from international exchanges but some day soon come from
here." (National Academy of Economics); "The USSR recently joined Interpol.
A requirement of that organization is that member states' police
departments must ensure date security. The result has been that the police
management has now become sensitized to that issue." (National Academy of
Economics); "On the physical side [of security], we close what needs to be
closed. Some say that only a sentry will be sufficient." (A Soviet bank
security official); "How have we responded to viruses? Up until now we
suffer." (Institute for Information Problems in the Information Sciences
Department of the Academy of Sciences of the USSR).
According to various Westerners, pirated software is all over the USSR, and
the Soviets often get hit with viruses when they buy these "forbidden
fruits" via the Hong Kong or Swiss connections. A number of the 70 known
Bulgarian viruses also appear to be prevalent, along with two Soviet
strains: Victor and a variant of the Vienna virus.
According to Aryeh Goretsky at McAffee Associates, a computer security
firm, other viruses that have been confirmed by Soviet and Eastern European
antiviral programmers include the following: Yankee Doodle, Vacsina,
Microsoft88 (534), Sunday, Amstrad or Pixel, Disk Killer 170X, Stoned, Ping
Pong, Vienna, Jerusalem, Friday the 13th COM, Pakistani Brain, Disk Killer
and W-13. Programs available to combat viruses are Aidstest by Lozynky
and Anti-Kot and Anti-Kor by Kotik. Some Western antivirus programs and
some homegrown versions were also found at various Soviet sites.
It is noteworthy that viruses are increasing, even though a form of data
security exists in the Soviet Union. This security is of the most basic
type: It is largely composed of guards and locked doors restricting
access to computer rooms.
Other simple measures are used, such as limiting links between computers
and systems and access controls to files. These measures are far from
adequate,however, given the pressure to acquire and distribute
microcomputers and to establish networks.
What makes the situation worse is the lack of trained data security
personnel, data security standards and tools, data security supports and,
in some instances (but not in others), lack of knowledge of security
techniques beyond basic approaches.
Sadly, it appears certain that there will be an onslaught of computer
crimes and virus attacks in the near future. If (and when) perestroika can
lead to computer linkages of even a minimal sort, the types of crime and
abuse problems that have become part of life in the West will be found in
the USSR. A mixture of homegrown hackers, outsiders and even some business
managers will create what could be a very fearful situation for the Soviet
authorities. How they will respond to this challenge is, to a large
degree, based on what authority will be functioning in the near future.
Decisions about what information to protect and how to do it are not being
developed in the USSR today. Unfortunately, it appears that these
decisions will be put off there as they were in the U.S. for too long.
Soviet computerists, both in state enterprises and the fledgling private
sector, can learn about information security from U.S. experiences. The
main issue is to try to be like us while avoiding the many problems
(including security problems) that we developed in association with
computerization.
-Sanford Sherizen
********************************************************************
Source: Computerworld, August 20, 1990, pg. 102, Inside Lines:
When a young computer hacker broke into an unclassified computer at the
Pentagon last November, the U.S. Air Force was quick to draw a bead on him.
The Air Force's Office of Special Investigations (OSI) is the only federal
agency with a full-time staff of computer crime investigators, according
to the OSI. There are 14 Air Force computer crime cops stationed
at air bases around the world. The group was instrumental in tracking
down the Hannover hacker, profiled in _The Cuckoo's Egg_ by Clifford Stoll.
Talk with Soviet users
From Computerworld, August 20, 1990, pg. 74, no author.
Network connections to and from the USSR are few but growing all the time.
Some of the choices include a bulletin board that provides electronic mail
and teleconferencing with Soviet computer users called the San Francisco/
Moscow Teleport located at 3278 Sacramento St., San Francisco, Calif. 94115
(415) 931-8500. Another connection is through Peacenet via Jeff Sears,
(415) 923-0900.
A Russian text processing mailing list, Rustex-L, is also available.
It is administered by Dimitri Vulius, Department of Mathematics, City
University of New York Graduate Center, who can be contacted at
DLV%CUNYVMS1.BITNET@cunyvm.cuny.edu.
An excellent overview of Soviet technological growth is provided
in a book entitled _Chip in the Curtain: Computer Technology in the
Soviet Union_ by David A. Wellman, Washington, D.C., National Defense
University Press, 1989. (202) 475-0948.
From Computerworld, August 20, 1990, pg. 74, no author.
********************************************************************
------------------------------
**END OF CuD #2.01**
********************************************************************
!