From: sloan@cis.uab.edu (Kenneth Sloan)
Subject: Re: What a sendsys bomb actually is...
Organization: CIS, University of Alabama at Birmingham
Date: Mon, 13 Apr 1992 15:14:38 GMT

In article <1992Apr13.093620.7673@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>In article <1992Apr10.202347.10050@cis.uab.edu> sloan@cis.uab.edu (Kenneth Sloan) writes:
>>In article <1992Apr10.094952.23398@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>>>...
>>Let's be careful here.  There are enough truly criminal acts that we
>>don't need to be sloppy and brand *every* instance of, say, creating
>>mail with a bogus return address as "criminal".  For one thing, I
>>believe that this is false; for another, I think that it *ought* to be
>>false. 
>
>It's not necessarily criminal.  That's for the 'trial process' (or
>whatever its analog is in the particular context, e.g. student
>discipline committee) to decide, and one would hope that they'd take
>all factors into account.  It is certainly 'prosecutable'

What would the charge be?  Remember - in you original article you
claimed that this was probably illegal in both the UK and the US.  I'll
take you word (below) on UK law.  But I'm very interested in a specific
reference to a US statute.  Quite simply, I think you are wrong.

>Notice that we are not
>simply talking about munged 'return' ('reply-to') addresses; we are
>talking about forgery of all of 'from', 'sender', and 'path'-type
>headers so as to completely disguise the origin of a piece of mail.

Yes.  Again - what US statute do you have in mind?

And (to start a related thread - presaged by the disclaimer that all
analogies are flawed) - suppose I place a physical, handwritten letter
in a US mailbox - and write on the envelope an incorrect, even
misleading, return address.  Have I violated any statute?  Is what I've
done illegal?  Should it be?

>
>Just grabbed a copy of our regulations.  Relevant ones are:
>
>  1.  Users are permitted to use computer facilities only for purposes
>  approved by their Head of Department.  The use of systems, packages,
>  and utilities for non-authorised purposes ... is forbidden.

Hopelessly vague.  Perhaps this would stand up in a UK court of law.  

A simple question: where do I find the list of "purposes approved by
their Head of Department."

>
>  2.  The use of a personal identifier or pass word allocated to another
>  user is strictly prohibited, as is the communication of such information
>  to a third party.

I can't tell anyone your userid?  Suppose I want to refer George to you
- suppose he's asked me a question that I think you can answer.  How can
I enable him to send mail to you?  

Do you begin to see how difficult it is to legislate this issue?

>
>  4.  Any attempt to penetrate the security and privacy of data or
>  programs supplied by another user, or any action which interferes with
>  the proper operation of any computer facility, is forbidden.

Any action?  No mention of 'intent'?  Is "proper operation" defined
anywhere? 

>
>I don't like laws which embody an 'intent' clause, as that makes it
>difficult to decide whether you can do something or not.  I prefer to
>leave that decision to the 'trial' level.  We recently had a case of
>forgery in which someone sent forged Valentines to the secretaries in
>(I think) the Engineering Department. 

"Forgery" has a well defined meaning in law.  Are you sure that this
case meets that definition?  In the US?

>    It was good humored, the secs
>enjoyed it, and while it was considered a violation of our rules, the
>'punishment' was a gentle reminder of the rules.  Forgery for sendsys
>bombing would be a hanging offense, I suspect.  There's a continuum,
>but I don't believe it can be formalised into the rules.
>

You seem to be making my case, not yours.

>I'm not sure of the state of play in the US at this point, but in the
>UK we are also subject to a 'Computer Misuse' law which in theory, at
>least, would make it an offense even to dial a wrong number with your
>modem. 

You have my sympathies.  Let's get back to whether creating e-mail with
an incorrect header is illegal in the US, please.

>...
>This drastically restricts usability of the machines.  No compilers or
>interpreters (because we can't allow user-written programs to run), and
>some interesting packages can't be put up because they can't be secured
>in this environment.

Let's get this straight: you have a computer center where it is
impossible to compile or interpret a user-written program?  How quaint.
Can I use a spread-sheet interpreter?

> The main point is
>that provision of a GOOD service for users requires that users and staff
>be honest with each other, respect each others' rights (even if we don't
>like them), and cooperate with each other.

I agree.  What in the world does this have to do with the legal system?
What role do the police, the courts, and the legislature have in
fostering this spirit of good feeling?

>  Forgery is lying. 

Is lying illegal in the UK?  I don't think it's illegal in the US, yet.

>... I will stick
>by the feeling that forgery is prima facie grounds for suspecting misuse,
>and that anyone who feels that a forgery is justified in some particular
>case had better be able to defend this belief, and had better have some
>damn convincing reasons.  (Forging a sendsys 'cancel' would convince me,
>for example.)

Sorry - the question before the house is whether any of this is
*illegal* in both the UK and the US.  Not if it is a good thing, or
anti-social, or acceptable in polite society.  Is it illegal?
(and, as above...is it even "forgery"? - if you want to discuss
legality, let's stick to the legal definitions of such words - not the
vernacular.)

It is entirely too easy to deal with difficult problems by passing
legislation and involving the police and the courts.  I agree with much
of what you say - my only point in this discussion is to contest your
claim that "forging" an e-mail message (or Usenet article) is illegal
in the US.

>
>(And, yes, forgery is almost certainly an offense against the Misuse of
>Computers legislation over here,

But not in the US (yet), I claim.

>... so suspects should thank us whenever
>WE decide to nail them, and to preempt the process of law by saying
>afterwards that we don't believe there are grounds for legal action.)

Wait a minute.  That sounds like "lying" to me.  Perhaps even
conspiracy, and being an accomplice after the fact.  Interfering with
justice.  Now, *those* are illegal.  "Pre-empt the law"?

"Oh what a tangled web we weave..."

Using the word "illegal" ought to be illegal.



-- 
Kenneth Sloan                   Computer and Information Sciences
sloan@cis.uab.edu               University of Alabama at Birmingham
(205) 934-2213                  115A Campbell Hall, UAB Station 
(205) 934-5473 FAX              Birmingham, AL 35294-1170
Newsgroups: news.admin