From: francis@ircam.fr (Joseph Francis)
Newsgroups: comp.unix.programmer,comp.admin.policy
Subject: Re: logging outgoing telnet sessions to catch 'hackers' (summary)
Date: 15 Apr 92 18:50:18 GMT
Organization: IRCAM, Paris (France)

In article <vijay.703271720@cdsun.fnal.gov> vijay@cdsun.fnal.gov (Vijay Gurbani) writes:
>>>l1ngo@copper.denver.colorado.edu (Swift) writes:
>>>>Let me clarify this. I only intended to log which hosts a user connects to.
>>>>Usually, this is all that's needed to find a hacker (at the very least, it
>>>>narrows down the list of "suspects").
>>>
>>>I don't believe that is any of your business. Where someone telnets to,
>>>who they send mail to, etc., should not be logged. Your plan sounds
>>>an awful lot like "Big Brother" to me.
>
>I beg to differ. Getting an account on a system is not a *right*, it is a 
>*priviledge*, much like getting a driving licence. As with any priviledge,

(btw privilege)

>there is a certain amount of responsibility that goes into maintaining your
>end of the contract. For the account holder, that means no surreptitious
...
>question is how can the system maintainer know that the account holder is
>keeping his end of the bargain up? By keeping log files, of course. 

This presumes that someone will be guilty. It is also tantamount to 1)
mandatory blood testing for drugs 2) wiretapping 3) making lists of
delivered letter return addresses (called "Mail Cover") 4)
credit-rating checks 5) traffic violations reported on backs of
licenses (soon to appear in California). 6) Universal identification
codes.

>Stretching my license analogy, just having a license to drive does not give
>the licensee (account holder) the right to speed, and/or disregard traffic
>protocols. If they do, they are held accountable to the police (system
>maintainer). How does the police make sure that the licensee holds up his/her
>end? By snooping (radar guns, hiding in an alley, etc) of course! Now would
>you say that the police was violating your rights by shooting his radar gun
>in your direction!?!

Yes. What this is is a presumption of guilt, that there are "guilty
people", and that you must "find them". The contrary is to believe
that people are innocent unless there is proof that a crime has
occurred, then attempt to deduce who performed the crime. The point of
controlling behavior isn't to its own end, but to protect all from the
injustices and dangers created by a few. On a computer, the
perpetrator of an invasion, or of a hacking on another system, or any
number of violations of a code of ethics should be investigated when
found. If there is just cause to set up a "trap" (there has been
account tampering; someone from a remote site has complained that your
computer has been mail bombing, forging netnews; etc.) logfiles are
perfectly acceptable. Otherwise, they are, if used for "monitoring", quite
an invasion. 

Because in the United States you have the "right" to have a telephone,
it doesn't give anyone (including the US government) the "right" to
listen to what you say or monitor where you call in case you are doing
things which might be illegal. One believes people regulate their own
conduct, and that subsequent to proof of crime investigations commence.

I have had the feeling since the mid-80's that people (in the US) have
forgotten that the point of Police and policing efforts isn't to "find
criminals", but rather when crime a crime occurs to find the
perpetrators and punish them according to law. The former is a "Police
State" and the latter is a free state.
-- 
| Le Jojo: Fresh 'n' Clean, speaking out to the way you want to live
| today; American - All American; doing, a bit so, and even more so.
Newsgroups: comp.unix.programmer