From: jet@boxer.nas.nasa.gov (J. Eric Townsend)
Subject: Keystroke Monitoring Update
Organization: Numerical Aerodynamic Simulation, NASA Ames
Date: 18 Dec 92 17:11:07


forwarded -- jet@nas.nasa.gov did not write this --

from PRIVACY Forum Digest, Vol. 01: Issue 28

Date:    Fri, 11 Dec 92 16:14:09 EST
From:    dds@csmes.ncsl.nist.gov (Dennis D. Steinauer)
Subject: DoJ Has NOT "Authorized" Keystroke Monitoring

The Subject line on the recent reposting by David Banisar of the 7 Dec 92
advisory from CERT/CC is highly misleading and inappropriate.  As with some
newspapers, it is important that people read more than just the headlines.

The Department of Justice hasn't "authorized" anything.  Rather, they are
advising system administrators that certain activities, namely the
monitoring or recording of user-to-computer session transmissions (hence
"keystroke monitoring") MAY be found illegal in certain circumstances and
that notice should be given to users.

The CERT advisory was extracted from a letter to the National Institute of
Standards and Technology (NIST) from DoJ.  Justice asked NIST in its role of
providing computer security guidance to Government to circulate the letter
and provide appropriate guidance.  We have made the letter available,
without comment, through several government and other channels (including
CERT, I4, etc.).

The letter is intended to advise system administrators of an ambiguity in
U.S. law that makes it unclear whether session monitoring, often conducted
by system administrators who suspect unauthorized activity, is basically the
same as an unauthorized telephone wiretap.  I repeat, the law is *unclear*
-- and the fact that one can argue either way on the issue does not clarify
the law as currently written.  DoJ advises, therefore, that if system
adminstrators are conducting session monitoring or anticipate the need for
such monitoring, they should ensure that all system users be notified that
such monitoring may be undertaken.

The DoJ advice, therefore, is not "authorizing" anything -- even implicitly.
They have simply observed the types of activities that diligent system
managers often undertake (a la Cliff Stoll in "The Cuckoo's Egg") in an
attempt to protect their systems from unauthorized users, and they have
rendered some prudent legal advice.

Clearly, there are lots of issues here -- technical and otherwise -- that
will need to be discussed and sorted out.  Indeed, changes in
agency/organizational policies and even the law are probably needed.
However, none of this changes the fact that system administrators need now
to be aware of the potential impact of their activities, and the DoJ advice
attempts to do this.

We (NIST) are developing additional guidance for system administrators to
assist them in implementing the DoJ recommendations.  I expect that others
will be doing likewise.  We also hope to encourage discussion of the related
technical and other issues.  In the meantime, system adminstrators are well
advised to read the basic DoJ advice and examine their systems and agency
policies to determine if, where, and how notices should be provided to users.
We welcome comments and suggestions, particularly regarding approaches that
various organizations take in dealing with this issue.

=====
Dennis D. Steinauer
National Institute of Standards and Technology
A-216 Technology
Gaithersburg, MD 20899 USA
(301) 975-3359
(301) 948-0279 Facsimile
DSteinauer@nist.gov (e-mail)
NIST Security BBS: 301-948-5717 (cs-bbs.nist.gov)
                                                                                                          
 
==========================END OF FORWARDED MAIL=========================
--
             J. Eric Townsend --  jet@nas.nasa.gov -- 415.604.4311
              '92 R100R, DoD# 0378, BMWMOA, AMA, ACLU, EFF, CPSR
                                "HotHead Rules!"
Newsgroups: comp.org.eff.talk