From: sloan@cis.uab.edu (Kenneth Sloan)
Newsgroups: news.admin
Subject: Re: What a sendsys bomb actually is...
Date: 10 Apr 92 20:23:47 GMT
Organization: CIS, University of Alabama at Birmingham

In article <1992Apr10.094952.23398@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>...
>  At many
>sites, for example, it is trivial to create mail with forged sender
>id's.  [If you DO any of these things, it is very likely that you are
>violating the law, at least in the US and the UK, and almost certain
>that you are violating the terms and conditions of use which you agreed
>to when you got your computer account or your net connection.]

Let's be careful here.  There are enough truly criminal acts that we
don't need to be sloppy and brand *every* instance of, say, creating
mail with a bogus return address as "criminal".  For one thing, I
believe that this is false; for another, I think that it *ought* to be
false. 

Now, I will grant that creating a sendsys bomb is most likely a
prosecutable offense. But, I claim that this is because of the resulting
flood of mail that is the expected and foreseeable result of creating
that particular type of mail with a "forged" sender id.  I maintain that
the criminality comes from the intended and expected flood of mail - and
has nothing whatsoever to do with the particular mechanism used to
generate that flood of mail.  A truly dedicated prosecutor might even
try to bring charges against the designers and manufacturers of the bomb
mechanism, but I don't think it would be an extraditable offense - so
Henry and Geoff can breathe easy.

In my opinion, the sendsys idea depends on a view of the net which is
(sadly) out of date.  But, it still serves a purpose - roughly
equivalent to the ignition key in an automobile.  Clearly, anyone can
start a car without the ignition key.  The point is that if you catch
someone doing this, they can't reasonably plead ignorance of any
wrongdoing, or claim that they did it "accidently".  {insert obligatory
recognition that all analogies are flawed, including this one}
 
However, branding every person who has ever created a piece of mail with
a "forged" sender id as a criminal is simply counterproductive.  The
legal system is not the right way to deal with this "problem" (in case
you haven't noticed - I believe that there are lots of interesting and
defensible reasons for *occasionally* perpetrating this crime - just be
sure never to inhale!)

If the "contract" at your institution specifically forbids the creation
of "forged" mail - I would very much like to see the specific language
that you believe contains this prohibition.  I also pity you for having
to submit to such draconian authority and such petty rule-makers.

Granted - such prohibitions are necessary in some shops.  But, I don't
think too many of these shops are connected to USElessNET.

[For the record: anyone in *my* shop who creates a sendsys bomb would be
as far gone, and as quickly, as I could manage.  Anyone who manages to
forge an "innocuous" (yes, in my judgement) mail message will be told
"cute.  now - how about doing something more useful with your time?"  
In neither case would the local constabulary have anything to say about it.]



-- 
Kenneth Sloan                   Computer and Information Sciences
sloan@cis.uab.edu               University of Alabama at Birmingham
(205) 934-2213                  115A Campbell Hall, UAB Station 
(205) 934-5473 FAX              Birmingham, AL 35294-1170
Xref: sparky news.admin:3485 news.groups:9769 news.newusers.questions:2246