From: bill@chaos.cs.umn.edu ()
Subject: Re: What a sendsys bomb actually is...
Organization: University of Minnesota, Minneapolis, CSci dept.
Date: Tue, 14 Apr 1992 10:32:14 GMT

sloan@cis.uab.edu (Kenneth Sloan) writes:

>In article <1992Apr13.093620.7673@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>>In article <1992Apr10.202347.10050@cis.uab.edu> sloan@cis.uab.edu (Kenneth Sloan) writes:
>>>In article <1992Apr10.094952.23398@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>>>>...
>>>Let's be careful here.  There are enough truly criminal acts that we
>>>don't need to be sloppy and brand *every* instance of, say, creating
>>>mail with a bogus return address as "criminal".  For one thing, I
>>>believe that this is false; for another, I think that it *ought* to be
>>>false. 
>>
>>It's not necessarily criminal.  That's for the 'trial process' (or
>>whatever its analog is in the particular context, e.g. student
>>discipline committee) to decide, and one would hope that they'd take
>>all factors into account.  It is certainly 'prosecutable'

>What would the charge be?  Remember - in you original article you
>claimed that this was probably illegal in both the UK and the US.  I'll
>take you word (below) on UK law.  But I'm very interested in a specific
>reference to a US statute.  Quite simply, I think you are wrong.

>>Notice that we are not
>>simply talking about munged 'return' ('reply-to') addresses; we are
>>talking about forgery of all of 'from', 'sender', and 'path'-type
>>headers so as to completely disguise the origin of a piece of mail.

>Yes.  Again - what US statute do you have in mind?

>And (to start a related thread - presaged by the disclaimer that all
>analogies are flawed) - suppose I place a physical, handwritten letter
>in a US mailbox - and write on the envelope an incorrect, even
>misleading, return address.  Have I violated any statute?  Is what I've
>done illegal?  Should it be?
wouldn't it depend on the content s ofthe letter.
if the letter were really a bomb would it make any difference?
if the sendsys bomb were not carring a forged header would it make
any difference?


>>
>>Just grabbed a copy of our regulations.  Relevant ones are:
>>
>>  1.  Users are permitted to use computer facilities only for purposes
>>  approved by their Head of Department.  The use of systems, packages,
>>  and utilities for non-authorised purposes ... is forbidden.

>Hopelessly vague.  Perhaps this would stand up in a UK court of law.  

>A simple question: where do I find the list of "purposes approved by
>their Head of Department."
one would presume this would be posted near their advisors office, i have 
no problem with this.


>>
>>  2.  The use of a personal identifier or pass word allocated to another
>>  user is strictly prohibited, as is the communication of such information
>>  to a third party.

>I can't tell anyone your userid?  Suppose I want to refer George to you
>- suppose he's asked me a question that I think you can answer.  How can
>I enable him to send mail to you?  
accually this is vauge, but in some places this maybe the case.
then _you_ would need to forward the mail, and stay in the loop. wierd
yes. required?, in some places, not most edu locations.


>Do you begin to see how difficult it is to legislate this issue?
no one said it would be easy. but if we didn't have a**holes  on 
computers then none of this would be neccessary!!!


>>
>>  4.  Any attempt to penetrate the security and privacy of data or
>>  programs supplied by another user, or any action which interferes with
>>  the proper operation of any computer facility, is forbidden.

>Any action?  No mention of 'intent'?  Is "proper operation" defined
>anywhere? 
one would hope this has further clarification elsewhere


>>
>>I don't like laws which embody an 'intent' clause, as that makes it
>>difficult to decide whether you can do something or not.  I prefer to
>>leave that decision to the 'trial' level.  We recently had a case of
>>forgery in which someone sent forged Valentines to the secretaries in
>>(I think) the Engineering Department. 

>"Forgery" has a well defined meaning in law.  Are you sure that this
>case meets that definition?  In the US?

>>    It was good humored, the secs
>>enjoyed it, and while it was considered a violation of our rules, the
>>'punishment' was a gentle reminder of the rules.  Forgery for sendsys
>>bombing would be a hanging offense, I suspect.  There's a continuum,
>>but I don't believe it can be formalised into the rules.
>>

>You seem to be making my case, not yours.

>>I'm not sure of the state of play in the US at this point, but in the
>>UK we are also subject to a 'Computer Misuse' law which in theory, at
>>least, would make it an offense even to dial a wrong number with your
>>modem. 

>You have my sympathies.  Let's get back to whether creating e-mail with
>an incorrect header is illegal in the US, please.

>>...
>>This drastically restricts usability of the machines.  No compilers or
>>interpreters (because we can't allow user-written programs to run), and
>>some interesting packages can't be put up because they can't be secured
>>in this environment.

>Let's get this straight: you have a computer center where it is
>impossible to compile or interpret a user-written program?  How quaint.
>Can I use a spread-sheet interpreter?
i believe he ment on the public pc's, but yes it seems more like a term
center not a computer center, kinda like some librarys.


>> The main point is
>>that provision of a GOOD service for users requires that users and staff
>>be honest with each other, respect each others' rights (even if we don't
>>like them), and cooperate with each other.

>I agree.  What in the world does this have to do with the legal system?
>What role do the police, the courts, and the legislature have in
>fostering this spirit of good feeling?
roasting the ones that don't play well together.


>>  Forgery is lying. 
ummmm. yes sr. your honor i didn't write this email message. :)
(do you get it)


>Is lying illegal in the UK?  I don't think it's illegal in the US, yet.

>>... I will stick
>>by the feeling that forgery is prima facie grounds for suspecting misuse,
>>and that anyone who feels that a forgery is justified in some particular
>>case had better be able to defend this belief, and had better have some
>>damn convincing reasons.  (Forging a sendsys 'cancel' would convince me,
>>for example.)

>Sorry - the question before the house is whether any of this is
>*illegal* in both the UK and the US.  Not if it is a good thing, or
>anti-social, or acceptable in polite society.  Is it illegal?
>(and, as above...is it even "forgery"? - if you want to discuss
>legality, let's stick to the legal definitions of such words - not the
>vernacular.)
i agree.


>It is entirely too easy to deal with difficult problems by passing
>legislation and involving the police and the courts.  I agree with much
>of what you say - my only point in this discussion is to contest your
sorry i havn't shed any light on this. do we have any legal people out there?
i promise not to roast you just because so many ...... no no bill
you just said you'd leave the nice lawers alone.

>claim that "forging" an e-mail message (or Usenet article) is illegal
>in the US.

>>
>>(And, yes, forgery is almost certainly an offense against the Misuse of
>>Computers legislation over here,

>But not in the US (yet), I claim.

>>... so suspects should thank us whenever
>>WE decide to nail them, and to preempt the process of law by saying
>>afterwards that we don't believe there are grounds for legal action.)

>Wait a minute.  That sounds like "lying" to me.  Perhaps even
>conspiracy, and being an accomplice after the fact.  Interfering with
>justice.  Now, *those* are illegal.  "Pre-empt the law"?

>"Oh what a tangled web we weave..."

>Using the word "illegal" ought to be illegal.
hairy hey!
if only we could just play and not need to protect ourselves from the
idiots who would not repect others privacy and property.
hey harvard!!!!!
where's the lay students on this one???
bill pociengel
consultant sysadmin@,dot.state.mn.us

hell no i didn't generate that name. hey we've got someone who named their
machine dash ???
confusing as all hell, yea you try reading it outloud.

bill @chaos.cs.umn.edu
--
bill@chaos.cs.umn.edu