Newsgroups: bit.listserv.pacs-l
Date:         Tue, 7 Apr 1992 09:31:01 CDT
From:         Public-Access Computer Systems Forum <LIBPACS@UHUPVM1.BITNET>
Subject:      Conference Report, Part 2 of 4

From: Steve Cisler <sac@apple.com>
Subject: Conference Report, Part 2 of 4

Computers, Freedom, and Privacy-2: A Report
Steve Cisler

Ethics, Morality, and Criminality

Mike Gibbons of the FBI chaired this session which was one of the
central themes for all present. In the same room we had law
enforcement (LE) representatives from state, local, and federal
governments, civil libertarians, and convicted computer criminals, as
well as some victims.

The FBI views the computer as a tool, and Gibbons told a story about
the huge raid on Lyndon LaRouche's data center in Virginia where
400 LE types took part.  I had the feeling that Gibbons was telling his
own hacker story because the audience would appreciate the
challenges that faced him more than LE supervisors without a
technical knowledge of computers would appreciate it. He was also
involved in the Robert Morris case.

Mike Godwin of EFF agrees that it is not  ethical to access other
people's computer without permission, but Mike represents those
who may have acted unethically but still have rights.

Case involving Craig Neidorf of _phrack_ who felt that his
publication of a  Bell South document was within the 1st amendment
.  Bell South pegged the Document cost was $70K because it included
the Vax workstation and the software in the cost! There was a
question whether that document was property at all. LE folks can
make good faith mistakes, but Craig had to spend $100,000 and that
the prosecutor and Secret Service never admitted they were wrong.

Jim Settle from FBI sets policy on computer crime and supervisor of
computer crime squad.  Background in Univacs in 1979. There is not a
lot of case law on computer crimes. LE was computer stupid and is
not out there to run over people's rights.  They discuss moral issues
even when an action was legal.

Don Delaney of the New York State Police:  He has been dealing
with PBX and calling card fraud; he talks to students about perils of
computer crime,

and works with companies who have been hit. Everyday one corp
has called him. $40,000 to $400K loss in a short time. He has found
glitches in the PBX software; he complained that few PBX
salespeople tell the customers about remote access units through
which criminals gain access. Once this happens the number is sold on
the street in New York at about $10 for 20 minutes. Even Westchester
County Library was hit. People used binoculars to read the PIN
numbers on caller's cards as they dialed in Grand Central Station.
Delaney called this 'shoulder surfing' and noted that  cameras,
camcorders, and binoculars are being used regularly.

Mitch Kapor raised the issue of the Digital Telephony Amendment.
It is proposed legislation to amend 18 USC 2510 (govt. can intercept
communications on showing probable cause as they did with John
Gotti) Settle of the FBI asked: "What happens if the technology says
you can't do it? You change the tech. to allow it or  you repeal the law
that allows wire tap.  Don Parker of SRI  said it is essential to have
wiretap ability as a tool for LE.

Digital Telephony Amendment -more info...

The FBI under the Department of Justice has authority to use
wiretaps in its operations. This has been one of the most effective
tools that law enforcement has, but with the advent of digital
telephony such as ISDN, the LE community is worried that no
capability exists to intercept these digital signals, and this will
preclude the FBI and other LE officials from intercepting electronic
communications.

The FBI proposes an amendment to the Communications Act of 1934
to require electronic services providers to ensure that the
government will e able to intercept digital communications. There
are a number of parts to the bill:

1. the FCC shall determine the interception needs of the DOJ and
issue regulations 120 days after enactment.

2. Service providers and pbx operators to modify existing telecomms
systems within 180 days and prohibit use of non-conforming
equipment thereafter, with penalties of $10,000 per day for willful
offenders.

3. Gives FCC the authority to compensate the system operators by
rate structure adjustment for required modifications. That is, the
user will pay for this decreased security desired by the government.

Godwin said he believes that wiretap is okay when procedures are
followed, but   you have to decide what kind of society you want to
live in. The FBI asked, "Are you going to say that crime okay over the
phones and that it should not be controlled?" He implied that not
making changes to the law would leave cyberspace open to
sophisticated criminals, many of whom have more resources for
technology that does the LE community.
For more information on this there is a 10 page legislative summary.

Someone asked a question about the Inslaw case and PROMIS
software. Why didn't the case get pursued by FBI?  DOJ rep could
not comment on it because the case involves charges against the
DOJ. (I cannot because the case is Byzantine in its complexity and is
thought by some to be as far-reaching as the JFK assassination. It
would take a megabyte to cover the facts.)

Evening of Day One:

There were Birds of a Feather (BOF) sessions that were less formal
and with less attendance. Nevertheless, it was one of the high points
of the conference. Where else would one find the law enforcement
types switching roles with computer intruders who had to defend a
system against an attack? Kudos to Mike Gibbons for setting this up.
There were also a panel of hackers (I use the term in the broadest
and non-pejorative sense) including Emmanuel Goldstein--the nom
de plume for the editor of 2600: The Hacker's Weekly; Craig Neidorf,
founder of phrack; Phiber Optik, a young man who recently plea
bargained to a couple of charges; and Dorothy Denning, chair of the
CS department at Georgetown University.

Goldstein (this was a character in Orwell's 1984 who was a front for
the establishment!) sees hackers as intellectuals on a quest for bugs
which, when corrected, help the system owner.He is extremely
frustrated over media treatment of hackers, yet he was open to a
Japanese camera crew filming the casual meetings of 2600 readers
that took place in the hotel lobby throughout the conference.   He said
that hackers and system administrators work together with each
other in Holland.

As an example of lax system management there was a military
computer during the middle east war had a password of TKuwait'.
Don Parker of SRI believes that Goldstein should not continually
blame the victim. Many of the hackers and publishers strongly
believed that  "knowing how things work is not illegal."The current
publisher of Phrack said, " I believe in Freedom of Speech and want
to  tell people about new technology." Most librarians would agree,
but much of the problem was what some people did with that
knowledge. An interesting discussion follow about who was
responsible for security: vendors, system administrators, or public
law enforcement personnel. Phiber Optik is now maintaining a Next
machine on the Net and complained that answers to technical
questions cost $100 per hour on the Next hotline.

Electronic Money: Principles and Progress

Eric Hughes, DigiCash

Electronic money uses public key encryption. People can recognize
your digital signature but cannot read it. The goal is to create a bank
on the Internet that only uses software and affords the user complete
anonymity. There is the bank, the buyer, and the seller. Money flows
from the bank  in a money loop. Bank does not know what is signs but
it knows that it did sign it and will honor the electronic check.  This
would allow financial transactions and privacy for the buyer. In a
library setting this would mean I could buy an item electronically (a
document, image, code) and nobody could link it with my name. My
buying habits would be private, and a person roaming through the
transactions might see that someone purchased a computer
simulation "Small furry animals in pain" but not who.

Doing database queries in privacy will be more and more important
as the network is used for more business activities. The DigiCash
scheme  has multi-party security and is a safe way of exchanging
files and selling them in complete privacy.  It's also very cheap and
the unlinkability is very important.

In the discussion session the issue of drug lords using the system was
raised. DigiCash has limited its transactions to less than $10,000, and
most would be far less. A British attendee said that stores had to keep
extensive records for VAT tax audits, so EEC and US regulations
would conflict with the goals of DigiCash.

Other panels included "Privacy and misuse in regional health
databanks" (Molla Donaldson, Institute of Health, National
Academy of Sciences) and "International Privacy: Current
Developments" (Marc Rotenberg, CPSR).

Part 2 of 4
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU