HDTenEightyP/NetNews huggingface dataset:
From: spm2d@garnet.cs.Virginia.EDU (Steven P. Miale)
Newsgroups: comp.admin.policy
Subject: Re: ethics of logging telnet destinations (was Re: logging outgoing...)
Date: 16 Apr 92 02:28:14 GMT
Article-I.D.: garnet.1992Apr15.222814
Reply-To: spm2d@garnet.cs.Virginia.EDU (Steven P. Miale)
Organization: University of Virginia

First, could you please use carriage returns? The wrap-around makes it
difficult
to edit. Thanks.

In article <33032@darkstar.ucsc.edu>, shandon@cats.ucsc.edu (Timothy
Daniel Kolar) writes:
|> In article <1992Apr15.205702.29713@murdoch.acc.Virginia.EDU>,
spm2d@uvacs.cs.Virginia.EDU
|> (Steven P. Miale) writes:
|> 
|> |> If the police want to watch me, or the FBI wishes to tap my phone,
it
|> |> is my understanding that they have to suspect me of a crime
BEFORE
|> |> they start logging.
|> 
|> I believe that is true.  However, I believe it is also true that the
accounting logs kept by
 the phone company are considered valid evidence--even the logs that
were kept before a person
 becomes 
|> a suspect.

I disagree with this also. But that's another discussion.
Besides, I believe that the evidence the telephone company usually
presents
is taken when they suspect someone, get the proper forms or whatnot,
and monitor them.

|> I'm sure there must be a ruling somewhere about this kind of thing. 
Any legal folks out
 there know of precedents?

I'm not sure. Perhaps the EFF would know. (In fact, perhaps we should
also discuss
this in the EFF group.)

|> |> You seem to feel that it is fine whether or not you are being
accused;
|> |> I do not. The ability to monitor everyone does not mean that you
|> |> should; ...
|> 
|> I concur with both of these statements, although (obviously) I don't
feel that the second
 is applicable here.  I have no problems with logging all telnet
connections (logging, not
 recording).

Problem is, how can you insure both are not being done?
If you allow logging telnet connections, such that you'd check over them
only
if a crime had been committed, why not record, and have even more
evidence?
I don't feel that way. I know you don't feel that way, and I doubt many
people
reading this do.
But if one step is taken, the other will probably follow. Rights are
seldom given back.
I'd like to be an optimist and think that all everyone will only use
the
telnet logs for good. I trust the roots here. But not all people in
power are so trustworthy.



Steve

--
Steven Miale - spm2d@virginia.edu   | Backwards compatibility is
backward.
Undergraduate Researcher            |
Department of Computer Science      |
University of Virginia              |
Xref: sparky comp.admin.policy:708 rec.games.mud:4828
From: richardt@Apple.COM (Richard Threadgill)
Newsgroups: comp.admin.policy,rec.games.mud
Subject: Re: MUDS: Network menace, or just another service?
Date: 13 Apr 92 00:49:24 GMT
Organization: Apple Computer Inc., Cupertino, CA

Of course, all of this discussion of the Acceptable Use Policy may very soon
become moot, as it is now undergoing Congressional review.  Thus far, the
reports have been mixed, but the AUP was subjected to fairly severe
criticism in the last round of hearings and the NSF is busily pouring 
over their justifications for the AUP.

RichardT
Xref: sparky comp.admin.policy:689 rec.games.mud:4581
From: spp@reef.cis.ufl.edu (Stephen Potter)
Newsgroups: comp.admin.policy,rec.games.mud
Subject: Re: MUDS: Network menace, or just another service?
Date: 7 Apr 92 06:38:56 GMT
Article-I.D.: uflorida.35010
Organization: Univ. of Florida CIS Dept.

Just a followup to Jon Aker's post, CIRCA reviewed it policy and changed it
slightly, after a number of the MUDders complained to the administration.
The restriction at CIRCA is now only on it's two big machines.  The two
smaller machines (max users: 35 and 10) are allowed to access the MUDs,
because the most use they get is from the social and MUD accounts.  Most
classes use the larger machines and only spill over to the small machines
when a project is due and everyone is rushing at the last minute.  Also,
class acounts have seniority on all machines, so if they need to get on,
it kicks the social and MUDDERS off.

-- 
"There are worlds out there where the sky is burning.  The sea's asleep, and
the rivers dream.  People made of smoke and cities made of sound.  Somewhere
there's danger.  Somewhere there's injustice.  Somewhere else the tea's getting 
cold. 	Come on Ace, we've got work to do." -Dr Who, spp@reef.cis.ufl.edu
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: morgan@ms.uky.edu (Wes Morgan)
Subject: Re: DRAFT Student Access/Use Policy
    <CKD.92Apr13172604@loiosh.eff.org> <1992Apr14.151655.19264@eff.org>
Date: Tue, 14 Apr 1992 16:00:17 GMT
Organization: The Puzzle Palace, UKentucky
X-Bytes: 

kadie@eff.org (Carl M. Kadie) writes:
>
>(opinional?) A report is given to users and the university every so
>often (once a semester?) summarizing the punishments that were imposed
>that period.

Actually, I've been thinking about this aspect of the policy.  I think
that a "policy history" would be extremely valuable in handling future
violations.  I'd like to be able to reference past incidents, for ques-
tions such as "Has this happened before?" and "How was it handled in
the past?".  I'm considering a "sanitized" notebook, with names removed.
A typical entry might be:

-------------------------------------------------------------------------
Date: 4/14/92

Incident: User attempting to crack passwords

Situation: On 4/14/92, examination of /usr/adm/sulog revealed that the
	   user was making extensive use of the su(1) command.  The en-
	   tries in /usr/adm/sulog indicated that the user was attempting
	   to access several different userids, none of which were his own.
	   The conclusion was reached that the user was attempting to
	   determine the passwords for other userids.

Violation: Sections X.X, Y.Y, and Z.Z of the ECC Access and Use Policy.
	   Sections A.A, A.B, and A.C of the Code of Student Conduct.

Actions:   The user's access was immediately revoked.  The relevant in-
	   formation was forwarded to the Dean of Students for possible
	   disciplinary action.  The user was contacted through his
	   Department Chairman.

	   When the user contacted ECC, he was informed that the Dean
	   of Students was considering disciplinary action.  The user
	   was directed to the Dean of Students' office for further
	   information about the disciplinary process.  Pending the
	   Dean of Students' decision, the user's access was restored;
	   however, he was placed in a restricted shell (rsh(1)), which
	   prevented him from accessing either the su(1) command or the
	   directories of other users.

Resolution:The Dean of Students chose to issue a written reprimand.  After
	   the conclusion of the proceedings, the user's access was restored
	   to its original state.

Reference: Judicial Board Proceeding #92-04-01
--------------------------------

I would think that such a notebook would be invaluable in the implementation
of consistent restrictions/revocations.  It seems that many shops decide on
restrictions/revocations in a rather cavalier, "off the cuff" manner; a refer-
ence such as this might help prevent that.

While this "sanitized" version should be available for public review, the
specifics of each case should be protected by the "student records privacy"
laws/regulations/procedures.

-- 
 morgan@ms.uky.edu    |Wes Morgan, not speaking for|     ....!ukma!ukecc!morgan
 morgan@engr.uky.edu  |the University of Kentucky's|   morgan%engr.uky.edu@UKCC
 morgan@ie.pa.uky.edu |Engineering Computing Center| morgan@wuarchive.wustl.edu
        "I was going to rip your head off, but I'm past that now."
Organization: Bar-Ilan University Computing Center, Israel
Date: Wednesday, 15 Apr 1992 11:03:43 IST
From: Hank Nussbacher <HANK@BARILVM.BITNET>
Newsgroups: comp.admin.policy
Subject: Re: Logging outgoing telnet sessions

>I don't believe that is any of your business. Where someone telnets to,
>who they send mail to, etc., should not be logged. Your plan sounds
>an awful lot like "Big Brother" to me.

The phone company records every phone call you make.  No one looks
at it until either you feel the bill is wrong and request a detailed
bill or the police feel there is a need to look at who you have been
calling (assuming you are a drug dealer or blackmailer).  You may feel
that the phone company is invading your privacy, but fortunately the
justice system as well as society does not.

The same is true with recording outgoing Telnet sessions.  No one could
care less where you are telneting to, and the logs are usally so large
that *no* sysadmin reads them.  They are there for cases of hacking.

Hank Nussbacher
Bar-Ilan University
Israel
Newsgroups: comp.admin.policy,rec.games.mud
From: ckd@eff.org (Christopher Davis)
Subject: Re: MUDS: Network menace, or just another service?
Organization: Electronic Frontier Foundation Tech Central
Date: Wed, 1 Apr 1992 03:47:16 GMT

 shane> == shane alan johns <sjohns@mango.ucs.indiana.edu>

 shane> What I would like to know is whether or not MUDs actually are
 shane> forbidden by Internet.  If they ARE, then whether or not a
 shane> sys.admin believes it is educational is irrelevant!  What does
 shane> Internet have to say on the issue of MUDs?  Is it an improper
 shane> use of Internet?

Rule #1: The Internet is an extremely diverse network of networks.

Corollary: The only "laws" that can be applied to the entire Internet
are on the order of laws of nature, like "Follow the TCP/IP specs or you
won't be able to talk to anyone."

There could, certainly, be parts of the Internet that MUDs are forbidden
within; I can think of a couple university campus networks that fit the
bill without really trying.

There are, on the other hand, also portions of the Internet where MUDs
are explicitly *not* forbidden, or are even encouraged.  Certainly they
are not in contravention of the "acceptable use" policies, such as they
are, of the commercial IP providers.

On the third hand (hey, Zaphod Beeblebrox here), there are parts of the
network that may or may not prohibit MUDs, but haven't explicitly
decided one way or the other (like the NSFNET backbone).  The
educational value of a MUD is of importance in this case, since the
NSFNET acceptable use policy states that the network is for use in
support of research & education.

My personal feeling is that if it gets people who would otherwise never
touch a computer to start using them (I know people who wouldn't have
done anything more than word processing who learned how to use Unix just
to compile IRC clients), it's educational.  Of course, I don't run the
NSFNET, so I wouldn't count on that interpretation holding.
--
Christopher Davis <ckd@eff.org> |    ECONOMIC OBSERVATIONS DEPARTMENT
System Manager & Postmaster     |  "There's always something going out of
Electronic Frontier Foundation  |      business in Central Square."
+1 617 864 0665  NIC: [CKD1]    |   -Rita Marie Rouvalis <rita@eff.org>
Xref: sparky comp.admin.policy:712 alt.comp.acad-freedom.talk:1592
From: jds@ecsvax.uncecs.edu (Jane Smith)
Newsgroups: comp.admin.policy
Subject: Electronic Mail Association?
Summary: looking for Electronic Mail Association Publication
Keywords: mail,privacy,policy
Date: 8 Apr 92 18:34:30 GMT
Distribution: usa
Organization: UNC Educational Computing Service

I'm looking for a white paper published last fall by
the Electronic Mail Association in Arlington, VA. The reference is from
a column called Tech Talk in _Working Woman_, April 1992.

It "takes an employer step-by-step through the process of writing an
e-mail policy."

You ever hear of this group or think the paper might be available
online?

-- 
--Jane
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: shandon@cats.ucsc.edu (Timothy Daniel Kolar)
Newsgroups: comp.admin.policy
Subject: Re: ethics of logging telnet destinations (was Re: logging outgoing...)
Date: 16 Apr 92 00:42:41 GMT
Article-I.D.: darkstar.33032
Organization: University of California, Santa Cruz

In article <1992Apr15.205702.29713@murdoch.acc.Virginia.EDU>, spm2d@uvacs.cs.Virginia.EDU (Steven P. Miale) writes:

|> If the police want to watch me, or the FBI wishes to tap my phone, it
|> is my understanding that they have to suspect me of a crime BEFORE
|> they start logging.

I believe that is true.  However, I believe it is also true that the accounting logs kept by the phone company are considered valid evidence--even the logs that were kept before a person becomes 
a suspect.

I'm sure there must be a ruling somewhere about this kind of thing.  Any legal folks out there know of precedents?

This does drift from the point, though.  My ethics do not correspond 1-1 with the U.S. legal code.

|> You seem to feel that it is fine whether or not you are being accused;
|> I do not. The ability to monitor everyone does not mean that you
|> should; ...

I concur with both of these statements, although (obviously) I don't feel that the second is applicable here.  I have no problems with logging all telnet connections (logging, not recording).


|> > 	Safety also entails protecting the information from 
|> > unauthorized access (ironically, backups make that harder instead of
|> > easier).  
|> How so?

In general terms it creates one more copy of the data that you have to protect.  In concrete terms, it means that you have to trust the people doing the backups, have a secure place to store the tapes, make sure
the person requesting you load the tape is the person they should be,
etc.

I know of at least one specific case at UCSC where a coveted program
was lifted off of backup tapes by an unscrupulous student operator (who isn't with us any more).  I now keep my private files crypted when
not in use...
 
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: ckd@eff.org (Christopher Davis)
Subject: Re: DRAFT Student Access/Use Policy
Organization: Electronic Frontier Foundation Tech Central
	<1992Apr13.152305.18668@eff.org> <1992Apr13.144306.3022@ms.uky.edu>
	<1992Apr13.195228.24575@eff.org>
Date: Mon, 13 Apr 1992 21:27:39 GMT

 Carl> == Carl M. Kadie <kadie@eff.org> 

 Wes> "Any restrictions placed on your computing access must be 
 Wes> directly related to the charges filed against you.  Any
 Wes> restrictions must be approved by the Director of Engineering
 Wes> Computing prior to their initiation."

 Carl> Let me make up a scenario. A user apperently sends a million lines of
 Carl> "Wow! I sure can waste paper" to the laser printer." This wastes about
 Carl> 2000 pages of paper and $25 dollars worth of toner.

 Carl> You bring him/her up on charges. (At the very least he or she should
 Carl> have to pay for the waste and get a formal warning from the school.)

 Carl> The question is, should you also prohibit the user from using the
 Carl> printer while the case is pending? The policy as written seems to say
 Carl> yes. But to me this seems that punishment before establishing guilt
 Carl> (unless you really think the user is stupid enough to do it again
 Carl> while awaiting a University hearing.)

I would say that a restriction like "can only print 100 pages a week"
would be a reasonable reaction to that sort of abuse, without
completely prohibiting the user from using the printer(s).  Restrictions
are not necessarily all-or-nothing affairs.

I, personally, find the policy Wes is creating to be fair to both the
users and the system administration/staff: a tough compromise under the
circumstances of a university community.  (I have the enviable situation
of having a small, private user base rather than a large and continually
changing set of users; this allows informal problem-solving to go much
farther than it might in a larger community.  Of course, the fact that
it's hard to get face-to-face meetings with users who are in different
time zones can also hinder the process... ;-)

(And, of course, I've never had problems with Carl printing too much on
our printers; I don't think he's ever printed *anything* on our
printers, and he's certainly never been by to pick it up... ;-)

--
Christopher Davis <ckd@eff.org> |    ECONOMIC OBSERVATIONS DEPARTMENT
System Manager & Postmaster     |  "There's always something going out of
Electronic Frontier Foundation  |      business in Central Square."
+1 617 864 0665  NIC: [CKD1]    |   -Rita Marie Rouvalis <rita@eff.org>
Xref: sparky comp.admin.policy:696 rec.games.mud:4736
From: michaell@syma.sussex.ac.uk (Michael Lazarou)
Newsgroups: comp.admin.policy,rec.games.mud
Subject: Re: MUDS: Network menace, or just another service?
Summary: Its legal (ish)
Date: 9 Apr 92 19:59:03 GMT
Organization: University of Sussex at Brighton

In article <1992Apr3.195242.9965@dg-rtp.dg.com>, waugh@rtpnet05.rtp.dg.com (Matthew Waugh) writes:
> In article <1992Apr1.195157.296@news.iastate.edu> john@iastate.edu (John Hascall) writes:
> >
> >The NFSnet Acceptable Use Policy also has a clause which says
> >(paraphrased), "Anything legal on a member (regional) network
> >is legal on the backbone".
>
> Could you not para-phrase, and quote the exact wording, and where you
> picked this version of the AUP from? It's not in my copy, and if
> true, would tend to make the NSFNet pretty fair game. When it
> [ deleted ]

I think the idea is that individual sites should be responsible for security
on the way in. Instead of having security on the local sites stopping people
from connecting to muds, the remote sites are supposed to have security
stopping outside access.

"Anything legal on a member (regional) network is legal on the backbone" can
be interpreted in lots if different ways.

If a member is running a legal program then it is legal for it to be connected
to the rest of the backbone is one interpretation.

If a member says its ok then its ok with the rest of us is another.

But what do I know. I wont be getting remote port access for another month or
four, if at all.

--
     _\|/_
      o o                 ZONE Child               michaell@cogs.susx.ac.uk
       O                                           michaell@syma.susx.ac.uk
      `-'          INSSOMNIAK - I MUST SLEEP       michaell@central.susx.ac.uk
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: gaynor@blaze.rutgers.edu (Silver)
Newsgroups: comp.admin.policy,rec.games.mud
Subject: Re: MUDS: Network menace, or just another service?
Date: 14 Apr 92 01:45:45 GMT
Followup-To: comp.admin.policy
Organization: Rutgers Univ., New Brunswick, N.J.

richardt@Apple.COM (Richard Threadgill) writes:
> Of course, all of this discussion of the Acceptable Use Policy may
> very soon become moot, as it is now undergoing Congressional review.

Would some kind soul in-the-know please followup with specifics?
What is the purpose for reviewing the NSFNet's Acceptable Use Policy?
What are the possible consequences of this review with respect to the policy?

Regards, [Ag]-the-uninformed
Xref: sparky comp.admin.policy:714 alt.comp.acad-freedom.talk:1597
From: edguer@ces.cwru.edu (Aydin Edguer)
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
Subject: Re: DRAFT Student Access/Use Policy
Keywords: opinions welcome.......
Date: 13 Apr 92 16:51:07 GMT
Article-I.D.: usenet.1992Apr13.165107.6102
Organization: Computer Engineering and Science, Case Western Reserve University

>>>}It is important to note that the ECC staff will make arrangements for
>>>}large mailing lists; however, we will not support mailing lists whose
>>>}subjects violate University policy, State law, or Federal law.
>>>}(In any situation where this is a possibility, the University Counsel
>>>}will be asked for a decision.)
>
>>I know that this particular example has been bounced around for years, but
>>what about a "child porn image list"?  What about a list that passes out
>>credit card numbers?
>
> These lists are already prohibited because they are illegal. Do you
> really want to take even partial responsibility for the lists that you
> do approve of? What if you give it an official University OK, and
> *then* it starts being used for credit cards?
>
> I'm enclosing a reference.

Your reference has no bearing on the situation as posed.  If you read your
own reference, it refers to "administrators ... exercis[ing] control over
the content of student publications".

The ECC staff is _NOT_ exercising control over the content of the publication.
The ECC staff is asking to exercise control over the creation of the
publication.  This is similar to the position many schools have that
only recognized student organizations can make use of school facilities.

In order for your reference to have any bearing, the ECC staff would need
to exercise "the power of prior review" on the messages posted to the lists
they approve.  This is not what the ECC is asking for.

Aydin Edguer
Resident, Planet Earth
Newsgroups: comp.admin.policy,rec.games.mud
From: ckd@eff.org (Christopher Davis)
Subject: Re: MUDS: Network menace, or just another service?
Organization: Electronic Frontier Foundation Tech Central
	<1992Apr03.030121.23110@anomaly.sbs.com>
	<1992Apr3.130147.26219@news.iastate.edu>
Date: Fri, 3 Apr 1992 19:37:38 GMT

 John> == John Hascall <john@iastate.edu> 

 John>  (8) Any traffic originating from a network of another member agency of
 John>      the Federal Networking Council if the traffic meets the acceptable
 John>      use policy of that agency.

Regional networks are not member agencies of the FNC.  This clause
refers to traffic from the NASA Science Internet, the Energy Sciences
Network (DOE), et. al.

None of these networks allow commercial traffic ;-)
--
Christopher Davis <ckd@eff.org> |    ECONOMIC OBSERVATIONS DEPARTMENT
System Manager & Postmaster     |  "There's always something going out of
Electronic Frontier Foundation  |      business in Central Square."
+1 617 864 0665  NIC: [CKD1]    |   -Rita Marie Rouvalis <rita@eff.org>
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk