From: sloan@cis.uab.edu (Kenneth Sloan)
Subject: Re: What a sendsys bomb actually is...
Organization: CIS, University of Alabama at Birmingham
Date: Tue, 14 Apr 1992 14:25:44 GMT

In article <1992Apr14.095554.29192@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>In article <1992Apr13.151438.11485@cis.uab.edu> sloan@cis.uab.edu (Kenneth Sloan) writes:
>>...
>>And (to start a related thread - presaged by the disclaimer that all
>>analogies are flawed) - suppose I place a physical, handwritten letter
>>in a US mailbox - and write on the envelope an incorrect, even
>>misleading, return address.  Have I violated any statute?  Is what I've
>>done illegal?  Should it be?
>
>The weakness here is that the email headers are not only the envelope,
>they are also the 'signature'.  I believe that if you make a paper-mail
>habit of signing other people's names to your correspondence without
>their prior consent, you are running the risk of criminal or civil
>legal proceedings.

This is the crux of the matter.  I do not believe that any piece of
e-mail (or USElessNET article) that I have ever seen contains a
"signature".  This is an extremely difficult problem - which does not go
away by simply declaring it solved.  If (as I claim) there is no
signature, then forgery is not possible.

Further, I am glad to see that you notice the difference between a
single forgery and making a habit of it.  I would go further and point
out that your risk of prosecution is minimal unless other details of
your habit demonstrate an intent to defraud (and, in a civil suit -
actual damages).  It's the fraud (and damages) that matters - not
necessarily the marks you make on the paper.

Remember, I'm trying to stay on point, and want to discuss only acts
barred by law.  Internal regulations, social customs, peer pressure,
etc. are not the issue (for the simple reason that I agree that these
methods of enforcing polite behavior - sorry, behaviour - are
appropriate.  

If I send a piece of paper mail (that matters) then I "sign" it, using
my "signature".  If I issue a memo (that matters) then I "sign" (perhaps
only initial) it.  If I send a FAX (that matters) - a careful lawyer
will ask for something other than simply the FAX before considering the
document to be "signed".  [some don't - I don't think they are careful
enough.  I certainly don't think that they will win if someone later
disclaims a FAX'ed document.  Any case law out there? Case law that will
stand up under review?]

>...
>
>These are internal regs, and they WILL stand up before our internal
>disciplinary committee.

Fine.  You seem to have a rather relaxed view of due process - but it's
beside the point.  I agree that "internal handling" is appropriate.
But...issuing an internal regulation does not make an act "illegal".

>...
>Maybe we don't disagree as strongly as we think, and are just having
>trouble agreeing with the words.

Of course.  The key word is "illegal".

There is a tendency to believe that declaring some act "illegal"
somehow causes that act to fade away, even disappear entirely.  This
is demonstrably false.  

Further, there is the problem of writing unambiguous legislation that
will be correctly interpreted by police and the courts.  Putting the
power of the state behind sloppily written laws based on ill-though out
concepts is an (often demonstrated) prescription for disaster.  You have
no assurances that *your* interpretation of what is appropriate will be
the one used when someone is incarcerated and brought to trial.
"Illegal" is a strong word, and deserves respect - not to mention a
healthy dose of raw fear.

Going back to my analogy: if posting a letter with an incorrect return
address were illegal, then I would be breaking the law every time I paid
my American Espress bill (I think that's the one) - because I use the
preprinted enveloped they send me, which has their address in both the
"to: field" and the "from: field".  

It has occurred to me that I can simply post my bill without affixing a
stamp - and the bill will be correctly delivered - no matter which
address the Post Office chooses to use.  Perhaps this is why AmEx (I
think...) does this?

On the other hand, if I "improved" on this situation, by addressing
*all* my mail to non-existant addresses, but putting the correct address
as the "return address" - then I could avoid all postage, and all of my
mail would be correctly delivered.  Great idea, right?  Wrong.  

While incorrectly labelling an individual (even an occasional - monthly)
letter is not illegal, I'm quite sure that the Post Office would get
around to prosecuting me if I did this to every letter, for the purpose
of evading the cost of postage.  "Theft of service" comes to mind.

Note that the individual acts are not (should not) be illegal.  Only the
continued pattern, and the (inferred) intent of evading the cost of
postage. 

Similarly, I believe we should reserve the force of law for a continued,
obviously intentional, pattern of behavior which causes measurable harm.
Trying to outlaw every act which "could be" used to cause harm is
senseless, and leads to computer centers where you cannot compute.

Sloan's Theorem (with apologies to Goedel): any system which is
sufficiently powerful to do useful work can be abused to cause harm.

"`Forgeries` don't kill file systems; e-mail floods kill file systems!"

As for sendsys (the start of all this) - I'm slowly coming to the
conclusion that sendsys is the electronic equivalent of a "Saturday
Night Special".  Illegitimate use now so outweighs legitimate use that
it's time to think about banning sales and distribution - and nearing
the time when we ought to ban manufacture.  Still no need for
extradition proceedings, but...

-- 
Kenneth Sloan                   Computer and Information Sciences
sloan@cis.uab.edu               University of Alabama at Birmingham
(205) 934-2213                  115A Campbell Hall, UAB Station 
(205) 934-5473 FAX              Birmingham, AL 35294-1170
Newsgroups: news.admin