From: kadie@cs.uiuc.edu (Carl M. Kadie)
Subject: []  DoJ Has NOT "Authorized" Keystroke Monitoring
Followup-To: alt.comp.acad-freedom.talk
Organization: University of Illinois, Dept. of Comp. Sci., Urbana, IL
Date: Mon, 11 Jan 1993 08:31:19 GMT

[A repost - Carl]

Date: Fri, 18 Dec 1992 02:35:52 EDT
From: Dorothy Denning <denning@CS.GEORGETOWN.EDU>
Subject:  DoJ Has NOT "Authorized" Keystroke Monitoring

Dave Banisar posted a message a while back with the headline "DOJ
Authorizes Keystroke Monitoring."  The following article by Dennis
Steinauer of NIST clarifies just what exactly the DOJ really said.

Dorothy Denning
denning@cs.georgetown.edu
+++++++
from PRIVACY Forum Digest, Vol. 01:Issue 28

Date--Fri, 11 Dec 92 16:14:09 EST
From--dds@csmes.ncsl.nist.gov (Dennis D. Steinauer)
Subject--DoJ Has NOT "Authorized" Keystroke Monitoring

The Subject line on the recent reposting by David Banisar of the 7 Dec
92 advisory from CERT/CC is highly misleading and inappropriate.  As
with some newspapers, it is important that people read more than just
the headlines.

The Department of Justice hasn't "authorized" anything.  Rather, they
are advising system administrators that certain activities, namely the
monitoring or recording of user-to-computer session transmissions
(hence "keystroke monitoring") MAY be found illegal in certain
circumstances and that notice should be given to users.

The CERT advisory was extracted from a letter to the National
Institute of Standards and Technology (NIST) from DoJ.  Justice asked
NIST in its role of providing computer security guidance to Government
to circulate the letter and provide appropriate guidance.  We have
made the letter available, without comment, through several government
and other channels (including CERT, I4, etc.).

The letter is intended to advise system administrators of an ambiguity
in U.S. law that makes it unclear whether session monitoring, often
conducted by system administrators who suspect unauthorized activity,
is basically the same as an unauthorized telephone wiretap.  I repeat,
the law is *unclear* -- and the fact that one can argue either way on
the issue does not clarify the law as currently written.  DoJ advises,
therefore, that if system adminstrators are conducting session
monitoring or anticipate the need for such monitoring, they should
ensure that all system users be notified that such monitoring may be
undertaken.

The DoJ advice, therefore, is not "authorizing" anything -- even
implicitly.  They have simply observed the types of activities that
diligent system managers often undertake (a la Cliff Stoll in "The
Cuckoo's Egg") in an attempt to protect their systems from
unauthorized users, and they have rendered some prudent legal advice.

Clearly, there are lots of issues here -- technical and otherwise --
that will need to be discussed and sorted out.  Indeed, changes in
agency/organizational policies and even the law are probably needed.
However, none of this changes the fact that system administrators need
now to be aware of the potential impact of their activities, and the
DoJ advice attempts to do this.

We (NIST) are developing additional guidance for system administrators
to assist them in implementing the DoJ recommendations.  I expect that
others will be doing likewise.  We also hope to encourage discussion
of the related technical and other issues.  In the meantime, system
adminstrators are well advised to read the basic DoJ advice and
examine their systems and agency policies to determine if, where, and
how notices should be provided to users.  We welcome comments and
suggestions, particularly regarding approaches that various
organizations take in dealing with this issue.

=====
Dennis D. Steinauer
National Institute of Standards and Technology
A-216 Technology
Gaithersburg, MD 20899 USA
(301) 975-3359
(301) 948-0279 Facsimile
DSteinauer@nist.gov (e-mail)
NIST Security BBS: 301-948-5717 (cs-bbs.nist.gov)
-- 
Carl Kadie -- I do not represent any organization; this is just me.
 = kadie@cs.uiuc.edu =
Newsgroups: alt.comp.acad-freedom.talk