From: rita@eff.org (Rita Marie Rouvalis)
Subject: EFFector Online 3.09
Followup-To: comp.org.eff.talk 
Originator: rita@eff.org
Keywords: borland, e-mail, security
Organization: Electronic Frontier Foundation
Date: Mon, 9 Nov 1992 15:38:15 GMT


########## ########## ########## |          COMPUTER SPIES
########## ########## ########## |         by Mitchell Kapor
####       ####       ####       | 
########   ########   ########   |BUILDING BLOCKS AS STUMBLING BLOCKS
########   ########   ########   |   A Commentary on the 15th NCSC
####       ####       ####       |        by Rebecca Mercuri 
########## ####       ####       |
########## ####       ####       |           THIS OLD DOS
=====================================================================
EFFector Online           November 9, 1992                Issue  3.09
           A Publication of the Electronic Frontier Foundation
                            ISSN 1062-9424
=====================================================================


                             Computer Spies
                           by Mitchell Kapor

Can a company lawfully eavesdrop on its employees' telephone calls? Not 
if they have an expectation of privacy. But, at least in most states, 
the employer can monitor conversations if it tells the workers that that 
is what it is going to do.  

That old legal issue surfaces in a new technological context in Silicon 
Valley, with disturbing consequences for your ability to defend key 
information assets. Take a look at how Borland International, a company 
that should know better after almost a decade on the leading edge of 
technology, may have hurt itself in a case involving an apparent theft of 
trade secrets.  

The allegations in the tangled legal affair are by now well known. On 
Sept. 1 Eugene Wang, a vice president of Borland's computer languages 
division, abruptly jumped ship to join competitor Symantec Corp. A 
pattern of suspicious behavior in Wang's final days suggested that 
perhaps he had traded Borland secrets along with his job. Borland had no 
proof, but it knew where to look. Borland executives opened Wang's MCI 
Mail account, where they found, they said, a number of messages that 
they believe prove Wang delivered Borland product plans, memos and other 
sensitive documents to Symantec. The evidence thus uncovered led to 
police searches of Wang's and Symantec Chief Executive Gordon Eubanks' 
homes and Symantec offices, to a pending criminal investigation of Wang 
and Eubanks and to a civil suit by Borland against Symantec.  

What has been scarcely addressed in newspaper coverage of these events 
is what this case means to the rapidly growing business of electronic 
mail.  

Let's back up and consider the law that protects electronic mail users, 
the federal Electronic Communications Privacy Act of 1986. The privacy 
act protects messages while in transmission on a public mail service 
such as MCI, as well as after messages are received and stored on that 
service.  

Borland and its attorneys, in a hurry to prove their suspicions about 
Wang, justified their intrusion into the mailbox as a property right: 
Borland was paying the bills for Wang's MCI account. "E-mail is like an 
in-box on someone's desk,' says Borland spokesman Steven Grady in 
defense of the search. "When they leave, it reverts to the corporation."  

Case closed? Not quite. Borland's metaphors fall apart when tested 
against the realities of electronic mail. Unlike in-boxes on an 
abandoned desk, E-mail requires a password, and it can be administered 
by a wholly separate communications company, like MCI. As it stands, in 
a criminal case Wang could challenge the legality of all the evidence 
collected on the basis of the messages found in his MCI account. He may 
also have grounds for a countersuit under the electronic privacy act and 
California law, which goes further in protecting individual privacy.  

It's easy to understand the anger Borland executives felt in discovering 
an apparent information hemorrhage. But the methods employed by Borland, 
which likes to flaunt its "barbarian" ways, may have been a little too 
barbarian by the standards of the federal statute. The one thing for 
sure is that all parties will be involved in a lengthy and expensive 
court battle to sort this out. The final result may be a draw between 
Borland and Symantec, and a new definition of privacy for the rest of 
corporate America.  

Borland could have strengthened its case against Wang if it had followed 
the recommendation of the Electronic Mail Association to announce its 
policies on electronic mail. As it was, a source says the Santa Cruz 
County District Attorney staff took potential violations of the 
electronic privacy act so seriously that they used a top computer-crime 
prosecutor from the San Francisco area to help write the search 
warrants.  

Despite Borland's hard-learned lessons, it continues to refuse to 
implement a formal E-mail privacy policy that declares just when 
electronic messages sent from company equipment are company property. 
Perhaps Borland is afraid that announcing such a policy would simply 
remind miscreants to erase incriminating E-mail files before they are 
found. If so, that's naive and shortsighted.  

Some companies may be reluctant to announce in advance that they are 
constantly snooping. So be it, but then they should refrain from 
scanning MCI in-boxes. Whatever they do, they have to confront the 
reality of the enormous power of digital media. In an age when a 
company's most valuable property  may be intangible the source code for 
a software package, for example an E-mail account may amount to an 
unlocked door on a warehouse.  

The electronic privacy act's procedures may need streamlining, and the 
Borland case may be the ratchet that makes the adjustments. By the time 
Borland could have obtained court authorization to examine Wang's 
electronic mail, some of the messages might have been deleted by MCI's 
automated five-day cleanup function. New legislation requires fine-
tuning in the light of the complexities of real world situations in 
order to be effective for the purposes for which it was originally 
designed. But the lesson here is that corporations must begin to adjust 
their own policies to fit the technologies they use.  

from Forbes Magazine November 9 1992  

Mitch Ratcliffe, editor-at-large for MacWEEK, provided research assistance
for this column.  

                   -==--==--==-<>-==--==--==-

                     BUILDING BLOCKS TO SYSTEM SECURITY

                            By Rebecca Mercuri
                      (mercuri@gradient.cis.upenn.edu)

         A Report from the 15th National Computer Security Conference 
                    October 13 -16, Baltimore, Maryland.


I attended the 15th National Computer Security Conference with the hope 
of coming away with some solutions for the security problems I had 
encountered over the past few years. I left with a longer list of
problems, and the vague feeling that our industry has become remiss in
providing us with answers that we can use, or has answers and is either
incapable or unwilling to yield them publicly. 

Let me state clearly here that this comment does not reflect negatively
on the conference organizers. They performed their task well, creating a 
superbly orchestrated event that covered a broad spectrum of
topics. Indeed, "rookies" were liberally mixed on panels with esteemed
"greybeards" and many women (sans beards) were in evidence as session
chairs and presenters (although I was somewhat dismayed to note that
females appeared to constitute less than 10% of the attendees, lower
than in the computing community in general). The breadth and extent of
the conference does not allow one reporter to describe it fully, so I
offer these remarks merely as comment and commentary, perhaps to 
stimulate discussion. 

The conference had an international flavor. The keynote was by Roland
Hueber (Directorate General of the Commission of the European
Communities) and the closing plenary on International Harmonization
serving as bookends. There were repeated calls for cooperation in
developing global security standards, with the primary advantages of
such appearing to be in commerce. In the wake of the cold war, there
seems to be a spirit of openness in this regard.  I offer the
speculation that it may be foolhardy to enter into conformity of thought
and solutions.  Diversity, particularly in commerce, inspires
creativity. Monopoly, or single-mindedness, often leaves one at risk of
exploitation by a strong central power, or of attack by those who are
close enough or who understand the system well enough to side-track it
We may need "fault-tolerant" and "diversified" answers.

It is useful to juxtapose thoughts about covert channels with those
about encryption systems. For the uninitiated, covert channels are
created when  internal intermittent polling is performed in an effort to
conceal illicit data collection activities. Bob Morris provided the
statistic that 1/10 of a bit per second is enough to expose a key in
approximately 1 month. This is at current processing rates, but one can
extrapolate out the Silicon Valley curve and surmise that our current
key encryption systems will be inadequate within the end of the century
(if not now, perhaps).

In the quest for security tools one encounters the debate on provability 
and formal top level specification. With respect to covert channels, 
Virgil Gligor referred to "formal top level specification as an
unmitigated waste of time," saying that data structures and source may
not map to the top level, there may not be enough relevant details
provided, and excessive false illegal flows may occur. Earl Boebert
stated that formal proving methods have worth in analysis of
specifications, but have failed utterly in spec/code, code/object, and
code/behavior correspondence. Still, formal methods have their
supporters, most notably SRI, as indicated by John Rushby, 
one of their directors (who also publicly revealed that there had been a 
major successful break-in at the lab last month). Interestingly, the
panel on Intrusion Detection was chaired by SRI's Teresa Lunt, who
discussed the use of expert systems to encode vulnerabilities, attack
methods and known suspicious behaviors.  Steve Snapp expressed the
divide and conquer approach, saying that there may be no single
generalizable model of intrusion, and that static, incidence/existence,
and data driven methods should all be used.

The matter of viruses was explored throughout various sessions. The
general consensus of opinion seemed to be that rigorous procedures and
policies need to be implemented so that recovery is possible to some
level following contamination or invasion. 

In the talks I attended, no clear method for handling the recovery from
a "new" virus (that can not be eradicated with existing software) was
offered. This was not consoling to someone who had just last week left a
client's law office with the admonishment "don't use any of the text
files that you've created in the last 6 months until I can find out what
the new virus strain is that appears to have adhered to some unknown
quantity of them."  Here too, the standardization on certain operating
systems and environments (such as Microsoft Windows(TM)), and uniform
acceptance of specific tools (such as the legal community's reliance on
Word Perfect(TM)) encourages the proliferation of attacks that could
potentially disable large sectors of the user base.

Losses seem to be tied heavily to the bottom line. In banking, it may
not be advantageous to implement a $10M or more security system that
still does not assure total impenetrability when insurance coverage can
be obtained at a cost of $1M (even if this price only remains low until
there is a hit). 

In health care, as described in Deborah Hamilton's award-winning paper, 
the bottom line may indeed be one or more people's lives. As true with
drug approvals, it is easy to see that holding back an inadequately
tested computer system may cost more lives than providing it while
make improvements and corrections. How does one weigh security,
reliability and verifiability issues when there is a crying need for
access to the developing technology? We are faced with a moral dilemma
without a governing body to set policies.

The area of privacy was eloquently addressed by Attorney Christine
Axsmith who said that our reasonable expectations of privacy, as
expressed by the 4th Amendment, protect people, not just places. But she
went on to say that with regard to the computer industry, the Privacy
Act and other legislation efforts still suffer from a lack of court
rulings necessary to define their interpretations. Will our efforts to
improve security undermine privacy?  

Curt Symes (from IBM) stated that "we'll all be using smart cards in the 
future, for a higher level of authentication." Does this mean that I
will eventually be required to be bioidentified (DNA, fingerprint,
retinal scan, voiceprint) in order to obtain access to my own data and
research?  A chilling thought.

In conclusion, to paraphrase Peter Neumann, perhaps the conference theme 
"Information Systems Security: Building Blocks to the Future" should be 
read not as "building-blocks" (the small bricks), but as "building
BLOCKS" or obstacles to our future as security professionals. There is a
sense of urgency now -- many of us need more than a foundation of toy
blocks, requiring true solutions which appear to not be forthcoming.
What we don't want are systems and design structures that are so
cumbersome as to impede computational progress.  Discussion may be
fruitful, but let us put our noses to the grindstone and provide
functional tools and answers, rather than guidelines and assertions.
While some are working in this direction, many others are needed.

NCSC '92 -- Comment and Commentary
Copyright (c) 1992 by Rebecca Mercuri. All Rights Reserved.
Reposting and/or reprint not granted without prior written permission
from the author. Address questions, response and corrections to:
mercuri@gradient.cis.upenn.edu


                   -==--==--==-<>-==--==--==-


                         THIS OLD DOS


Hi, I'm Bob Wheeler Dealer, and welcome to This Old DOS.  Last week you 
may remember we renovated the Charles Babbage Family computer.  We 
upgraded their antique CPM to the IBM operating system known as MS DOS.  
And this week on This Old DOS, we're continuing our renovation by 
installing a brand new operating system, supposed to be real easy to 
use, called Windows.  And boy am I excited.  So let's go around back and 
see how Norm is doing with it.

Bob:  Hi Norm; how's it going?

Norm: Oh, hi Bob.  Well as you can see I'm about to install Windows on 
our old machine.

Bob: No glass in these Windows, huh Norm? Ha ha.

Norm: Ha ha. That's right, just a handful of floppy disks.  This is an 
attempt at making an IBM PC work *a little bit more* like an Apple 
Macintosh.  Instead of typing commands, you just move a lot of little 
pictures around on a screen.

Bob: I can't wait.  Sounds simple enough; let's take a whack at it.

Norm: Well, ok, the first thing we do is install these disks.  Pop them 
in the computer and follow the uh directions on the screen.  Here you 
try (sound of hard drive grinding).  That's it.

Bob: Simple enough.

Norm: Ok, Bob, now the machine wants to know if you want to modify your 
config.sys or change your autoexec.bat to automatically load when the 
machines boots up.  What do you want to do?

Bob: What's a config.sys? I don't anything about this stuff.

Norm: Never mind, it's ok Bob, I'll take care of it.  There.  Now to be 
really state of the art, we've got to upgrade our microprocessor (sound 
of sawing).  That's the computer chip inside inside so that these 
Windows will work fast enough.  Otherwise, you know, you might as well 
go out and get a cup of coffee while the screen draws pretty pictures, 
heh heh.  So let me get one of these uh 486 chips.  We've got a crane 
here.  Hey fellas.. fellas!  You wanna load that puppy here inta place?  
Careful!  (sound of machinery) Don't bend the pins!  There, all snapped 
in.

Bob: All right, now we're ready to open Windows, right?

Norm: Not on your life, Bob.  While we're at it we're building an 
extention onto the memory board for those fat, greedy programs that 
gobble the stuff up.  I'll just hammer a few of these 4 megabyte chips 
into place (bang bang). There, now we've got 16 megabytes on board.  
Narly, man!

Bob: All right, let her rip, Norm.

Norm: Not so fast, Bob!  Those big Windows programs need lots and lots 
of storage space. Charles talked to his banker and decided to spring for 
that 200 megabyte beauty there.  Hand me that..uh

Bob: You mean this thing here? (groaning and grunting)

Norm: Yeah, that's the hard drive.  Ah, thanks.  And they want to do 
multimedia.. you know sound, graphics, computer games... the latest -- 
so we'll add on a new super VGA monitor..

Bob: Something else?

Norm: A CD ROM drive..

Bob: Something else? More stuff?

Norm: Yeah, we have a sound board and special speakers if you want that 
great sound.

Bob: This .. this isn't so simple anymore!

Norm: Well,  we're just about ready to go.  That's about it.

Bob: All right now, with all this preparation Norm, this had better be 
great.

Norm: Well, I hope so, let's (sound of drive grinding) load up Word 
Perfect, Lotus 1.-2-3, Excel, and FileMaker Pro and watch her rip!  
(beep.. crash).  Oh-oh.

Bob: What happened?  What happened?

Norm: Well, it looks like a system crash.

Bob: Oh no!

Norm: Don't worry! We can fix this thing.  We can fix it.

Bob: What do we do now, give up?

Norm: No, Never! We drop everything and start over.  That's the American 
Way.  You keep changing stuff until you find what's wrong.

Bob: Now, how long is this gonna take?  I haven't got all weeks to..?

Norm:  Don't worry! We'll I'll have this thing running like top, Bob.  
In the mean time you can go back in my shop there and use my Mac.

Bob: All right, you keep working at it Norm.  We're out of time folks.  
Join us tomorrow  for the start of our new 50-part series:  "How to 
install and maintain a Local Area Network."  Until then, bye bye for 
This Old DOS!

(c) Copyright National Public Radio (R) 1992. The segment by NPR's Ira 
Plato was originally broadcast on National Public Radio's "Talk of the 
Nation" on September 11, 1992 and is used with permission of National 
Public Radio.  Any unauthorized duplication is prohibited.


                   -==--==--==-<>-==--==--==-


         MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION

If you support our goals and our work, you can show that support by
becoming a member now. Members receive our bi-weekly electronic
newsletter, EFFector Online, the @eff.org newsletter
and special releases and other notices on our activities.  But because
we believe that support should be freely given, you can receive these
things even if you do not elect to become a member.

Our memberships are $20.00 per year for students, $40.00 per year for
regular members.  You may, of course, donate more if you wish.

Our privacy policy: The Electronic Frontier Foundation will never, under
any circumstances, sell any part of its membership list.  We will, from
time to time, share this list with other non-profit organizations whose
work we determine to be in line with our goals. If you do not grant
explicit permission, we assume that you do not wish your membership
disclosed to any group for any reason.

---------------- EFF MEMBERSHIP FORM ---------------

Mail to: The Electronic Frontier Foundation, Inc.
    155 Second St. #39
    Cambridge, MA 02141

I wish to become a member of the EFF  I enclose:$__________
    $20.00 (student or low income membership)
    $40.00 (regular membership)
    $100.00(Corporate or company membership.
    This allows any organization to
    become a member of EFF. It allows
    such an organization, if it wishes
    to designate up to five individuals
    within the organization as members.)

    I enclose an additional donation of $

Name:

Organization:

Address:

City or Town:

State:     Zip:    Phone:(    )     (optional)

FAX:(    )    (optional)

Email address:

I enclose a check [  ]   .
Please charge my membership in the amount of $
to my Mastercard [  ]     Visa [  ]    American Express [ ]

Number:

Expiration date:

Signature:

Date:

I hereby grant permission to the EFF to share my name with
other non-profit groups from time to time as it deems
appropriate   [  ]  .
      Initials:

Your membership/donation is fully tax deductible.
=====================================================================
     EFFector Online is published by
     The Electronic Frontier Foundation
     155 Second Street, Cambridge MA 02141
     Phone: +1 617 864 0665 FAX: +1 617 864 0866
     Internet Address: eff@eff.org
 Reproduction of this publication in electronic media is encouraged.
 Signed articles do not necessarily represent the view of the EFF.
 To reproduce signed articles individually, please contact the authors
 for their express permission.
=====================================================================
     This newsletter is printed on 100% recycled electrons.
-- 
Rita Marie Rouvalis              rita@eff.org 
Electronic Frontier Foundation   | And he spun himself right down 
155 Second Street                | into the ground. Now wasn't that 
Cambridge, MA 02141 617-864-0665 | lucky?  --Deadsy 
Newsgroups: comp.org.eff.news,comp.org.eff.talk