From: smee@bristol.ac.uk (Paul Smee)
Newsgroups: news.admin
Subject: Re: What a sendsys bomb actually is...
Date: 14 Apr 92 09:55:54 GMT
Reply-To: P.Smee@bristol.ac.uk (Paul Smee)
Organization: University of Bristol

In article <1992Apr13.151438.11485@cis.uab.edu> sloan@cis.uab.edu (Kenneth Sloan) writes:
>In article <1992Apr13.093620.7673@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>>It's not necessarily criminal.  That's for the 'trial process' (or
>>whatever its analog is in the particular context, e.g. student
>>discipline committee) to decide, and one would hope that they'd take
>>all factors into account.  It is certainly 'prosecutable'
>
>What would the charge be?  Remember - in you original article you
>claimed that this was probably illegal in both the UK and the US.  I'll
>take you word (below) on UK law.  But I'm very interested in a specific
>reference to a US statute.  Quite simply, I think you are wrong.

I might be.  It's been a long time since I moved over from the States.
I'm led to believe from various comments I've seen here and in
alt.security and alt.hackers that I am correct, but if no-one with more
recent US experience wants to provide info, I will withdraw my claim as
far as the US goes.

>And (to start a related thread - presaged by the disclaimer that all
>analogies are flawed) - suppose I place a physical, handwritten letter
>in a US mailbox - and write on the envelope an incorrect, even
>misleading, return address.  Have I violated any statute?  Is what I've
>done illegal?  Should it be?

The weakness here is that the email headers are not only the envelope,
they are also the 'signature'.  I believe that if you make a paper-mail
habit of signing other people's names to your correspondence without
their prior consent, you are running the risk of criminal or civil
legal proceedings.

>>
>>Just grabbed a copy of our regulations.  Relevant ones are:
>>
>>  1.  Users are permitted to use computer facilities only for purposes
>>  approved by their Head of Department.  The use of systems, packages,
>>  and utilities for non-authorised purposes ... is forbidden.
>
>Hopelessly vague.  Perhaps this would stand up in a UK court of law.  
>A simple question: where do I find the list of "purposes approved by
>their Head of Department."

These are internal regs, and they WILL stand up before our internal
disciplinary committee.  Disciplinary committee decisions have on
occasion been challenged by civil action (though admittedly none that
I'm aware of which were computer-related) and the committee normally
wins those.  To find the 'list etc', contact your head of Department --
though your Departmental computing rep SHOULD have made you aware of
them when he or she signed your request for registration.  We DO try to
make it very clear to users before we register them what the terms and
conditions are.  Among other things, the user must sign a copy of the
regs, ending 'I have read the above regulations and agree to abide by
them', before being registered, so if nothing else I suppose we could
fall back on breach of contract.  

Pragmatically, and as far as I am aware, we have never had anyone
attempt to defend against an internal disciplinary procedure by saying
'we didn't realize that was against the rules'.  The people we 'get'
KNOW that what they were doing was an offence.  In any case where we
are unhappy, but believe the user involved might be simply misguided,
we do talk to them first, and tell them not to do it again.  If they
do do it again, then we nail them.  (However, if there are any Bristol
users out there who think I've just provided them a loophole, NOTE that
this is 'normal practice', not a promise.)

>>  2.  The use of a personal identifier or pass word allocated to another
>>  user is strictly prohibited, as is the communication of such information
>>  to a third party.
>
>I can't tell anyone your userid?  Suppose I want to refer George to you
>- suppose he's asked me a question that I think you can answer.  How can
>I enable him to send mail to you?  

You can tell him my 'mail name', which is definitely NOT the same as my
'personal identifier'.  (Though yes, maybe we could clean this bit up.
Comments always welcome.)

>>We recently had a case of
>>forgery in which someone sent forged Valentines to the secretaries in
>>(I think) the Engineering Department. 
>
>"Forgery" has a well defined meaning in law.  Are you sure that this
>case meets that definition?  In the US?

I am certain that it meets the definition within the UK.  As I said
earlier, I am (only) led to believe that it does within the US.

>>    It was good humored, the secs
>>enjoyed it, and while it was considered a violation of our rules, the
>>'punishment' was a gentle reminder of the rules.  Forgery for sendsys
>>bombing would be a hanging offense, I suspect.  There's a continuum,
>>but I don't believe it can be formalised into the rules.
>
>You seem to be making my case, not yours.

Maybe we don't disagree as strongly as we think, and are just having
trouble agreeing with the words.

>>This drastically restricts usability of the machines.  No compilers or
>>interpreters (because we can't allow user-written programs to run), and
>>some interesting packages can't be put up because they can't be secured
>>in this environment.
>
>Let's get this straight: you have a computer center where it is
>impossible to compile or interpret a user-written program?  How quaint.
>Can I use a spread-sheet interpreter?

No.  However, let's get this completely straight.  You cannot do any of
these things in the unsupervised 24-hour access rooms, which most of
our rooms are.  You CAN do them in some of the supervised
working-day-only labs.  No, we're not happy about this.  However, back
in the days when you could do them in the 24-hour rooms (as far as we
were concerned), you couldn't actually do them anyway, as our machines
were being virused faster than we could undo them.  A lot of this was
careless users spreading infections by not following our 'safe use'
guidelines, but at least 2 (to my knowledge, and I'm not directly
involved so don't often find these things out) of our undergrads were
deliberately seeding the labs with viruses, to demonstrate their
'cleverness'.

Also, this comment applies only to the PCs.  You can use the 24-hour
PCs as terminals to connect to one of the mainframes or minis, and run
user-written progs there to your heart's content.  Undergrads who need
computing as an official part of their coursework are registered as a
matter of course.  Other undergrads need only get their 'tutor'
(roughly, Faculty advisor) to co-sign a request for such registration.
This is normally pretty much a rubber-stamp job, designed only to make
sure that they have had the 'Departmental guidelines' explained to
them, and that they've got the paperwork right.

>> The main point is
>>that provision of a GOOD service for users requires that users and staff
>>be honest with each other, respect each others' rights (even if we don't
>>like them), and cooperate with each other.
>
>I agree.  What in the world does this have to do with the legal system?
>What role do the police, the courts, and the legislature have in
>fostering this spirit of good feeling?

The answer is that you've got to have mechanisms available for dealing 
with sociopaths, and there doesn't seem to be an alternative way of
doing that.  I would certainly welcome suggestions.

>>... so suspects should thank us whenever
>>WE decide to nail them, and to preempt the process of law by saying
>>afterwards that we don't believe there are grounds for legal action.)
>
>Wait a minute.  That sounds like "lying" to me.  Perhaps even
>conspiracy, and being an accomplice after the fact.  Interfering with
>justice.  Now, *those* are illegal.  "Pre-empt the law"?

It's a general principle of British law for *most* 'crimes' against
specific identified victims, that a case will not be prosecuted unless
the victim agrees to file a complaint.  In general, our hackers and
crackers, when they do offend, offend against us.  And, most offenses
against us are internal.  So, it is within our rights in such cases to
tell the police that we don't 'believe there are grounds for legal
action', and to deal with things internally.  Note we are not saying
'no crime was committed', we are saying 'it only bothered us, and we
don't believe you need to get involved'.  I don't know the state of
formal US law in this regard, but I do know that MIT had a similar
relationship with the local police, and that you had to go pretty over
the top to turn a disciplinary offense (even if it fit the definition
of some 'crime') into a police matter.

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132