From: twcaps@tennyson.lbl.gov (Terry Chan)
Newsgroups: alt.folklore.urban
Subject: Re: The salami strikes back  (No, not THAT one)
Date: 17 Dec 1992 07:43:42 GMT
Organization: Department of Redundancy Department
Reply-To: TWChan@lbl.gov (Terry Chan)
NNTP-Posting-Host: 128.3.12.117

styri@nta.no writes:

  +Urban legends came up as a topic during lunch today, and one story that
  +may be relevant to a recent thread came up - the salami attack. One version
  +of the story goes like this:
  +
  +Crooked programmer modifies program to siphon off small ammounts of money
  +generated by an incorrect rounding procedure, eg. during calculation of
  +interest, and direct the money to his/her account.
  +
  +There are several other versions, but today one of my fellow lunchers
  +claimed that if you consider the amount of transactions in the average
  +US bank it would take decades to get really rich using this technique.
  +(That is - stealing fractions of cents...) I'm curious about this, but
  +haven't found any good references in my office. 

Interesting question.  I thought about this when I was first 
told of this type of crime in 1984.  One reference I have 
refers to the "salami technique" in a list of 12 categories
of computer abuse.  One technique they describe was:

  "...called 'rounding down,' is used to round fractional
   remainders down to the nearest whole, placing those 
   tiny fractions into an unauthorized account.  When this
   operation is performed repeatedly on numerous transactions,
   the fractions in the unauthorized account can grow into
   considerable sums of money."

         S.D. Halper, et al., _Handbook of EDP Auditing_, 
           Warren, Gorham, & Lamont, 1985.

Their classification of computer abuse categories was based
on "[a] subsequent study done for the [U.S.] Department of 
Justice in 1979."  However, they do not list the study.  But,
since UC Berkeley is a federal depository library, I checked
and found that the relevant publications of the DoJ in 1979 are:

1. Colton, Kent W.
     Police and computer technology : a decade of experience since the Crime
   Commission summary / Kent W. Colton.  Washington, D.C. : U.S. Dept. of
   Justice, Law Enforcement Assistance Administration, National Institute of
   Law Enforcement and Criminal Justice : for sale by the Supt. of Docs., U.S.
   Govt. Print. Off., [1979].
       UCB   Main      HV7936.A8 C58

7. SRI International.
     Computer crime : criminal justice resource manual.  [Washington, D.C.] :
   National Criminal Justice Information and Statistics Service, Law
   Enforcement Assistance Administration, U.S. Dept. of Justice : [for sale by
   the Supt. of Docs., U.S. Govt. Print. Off.], 1979.
       UCB   Documents HV6773 .S181 1979

While I cannot give any info on the volume of transactions,
perhaps these docs may give some further insight.  I was
told at the time that to counter the "salami" technique
was one of the reasons for calculating out balances to 
several significant digits.


Terry "Crime?  Computers?  Naaah..." Chan
--
Energy and Environment Division   | Internet:  TWChan@lbl.gov
Lawrence Berkeley Laboratory      | 
Berkeley, California  USA  94720  | Carpe Per Diem