Date: Sat, 12 Dec 1992 02:54:21 +0200
From: Jyrki Kuoppala <jkp@cs.hut.fi>
Newsgroups: comp.society.privacy
Subject: DOJ Authorizes Keystroke Mo (really DOJ asks consent..)
Organization: Helsinki University of Technology, Finland.
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 113, Message 9 of 9

In article <comp-privacy1.111.4@pica.army.mil>, Dave Banisar <banisar@washofc writes:
>  DOJ Authorizes Keystroke Monitoring
>Subject: DOJ Authorizes Keystroke Monitoring

This headline seems somewhat misleading (except if DOJ has previously
recommended against monitoring).  Actually U.S. Dept of justi(n)c(as)e
and CERT are recommending system administrators to post login banners
to get consent for monitoring from users.

I don't think the biggest problem here is keystroke monitoring per se,
and I can think of situations where monitoring would be appropriate
and an OK thing to do.  For example, I think monitoring an intruder
using an account is OK with permission from the person who is the real
account holder.  Perhaps also in some very safety-critical,
security-critical or privacy-critical environments.

But what I very seriously dislike and think is Orwellian is this as
part of the recommended login banner:

"      Anyone using this system expressly consents to such monitoring
       and is advised that if such monitoring reveals possible
       evidence of criminal activity, system personnel may provide the
       evidence of such monitoring to law enforcement officials."

Basically, the message is announcing "we have the power to watch
everything you do and we will use that power whenever we like and will
report any wrongdoings to the Big Brother", and DOJ and CERT are
suggesting that everyone put that message as their login banner.

If I got this right, this means that the login banner causes
acceptance of monitoring keystrokes (and possibly other monitoring) no
matter whether the use is authorized or not.  I think this is an
unacceptable loss of privacy for all the users - it seems the users
lose all claims for privacy by using the system.  This opens the
system for routine surveillance of every action by every user.  If the
system admin feels like scanning the mail of every user, the user has
no recourse, no way to stop it.

CERT says that it is a simple matter of pointing out a problem with
the U.S. law.  The law recognizes a fundamental right, the right to
privacy.  This is not a bug of the law, it's a feature.  I agree that
it is a reasonable goal and a good tool to be able to legally monitor
intruders, but the "bug fix" CERT and the U.S. justice department are
proposing is much worse than the problem itself.

Also, I agree it is a good idea to publish a policy of how far privacy
extends and how and when it may be violated - but this is not a
message publishing a policy, this is a message to get "consent" for
any kind of monitoring from every user of the system.

The paranoid minds might say the announcement is clearly aimed
expressly for the purpose of making routine surveillance legal and all
the talk about intruders is just smoke and mirrors.  I will refrain
from claiming that.  But it doesn't really matter - the end result is
the same in any case.

//Jyrki