From: kadie@eff.org (Carl M. Kadie)
Subject: Computers and Academic Freedom News 02.45 (Digest)
Originator: kadie@eff.org
Organization: The Electronic Frontier Foundation
Date: Tue, 6 Oct 1992 18:50:50 GMT

Computers and Academic Freedom News
Vol. 02, No. 45


----------------------------------------------------------------------

From: banseng@iti.gov.sg (John B. Tan)
Subject: Article 0 -- Abstract of CAF-News 02.45

[Week ending September 13, 1992

========================== KEY ================================
The words after the numbers are a short PARAPHRASES of the
articles, or QUOTES from them, NOT AN OBJECTIVE SUMMARY and
not necessarily my opinion.
===============================================================

  [This week's guest editor is John B. Tan.

   We need new guest (or regular) editors, for information send
   email to kadie@eff.org. Issues #41,43,46-48 are in production.
   - Carl]

Notes 1-2 are about an incident of intellectual property theft

1.  ("A definite beginner in my profession":) One of my projects is being
distributed as networked resources without my consent or the copyright
statement intact.  This person is influential and powerful within my
profession and by fighting I may put my fledgling career at risk.  I need
advice badly.
    <199209080137.AA01381@eff.org>

2.  Only you yourself can decide whether or not to resist.  Should you
decide to fight:   (1)  Keep a meticulous log of all contacts and
conversations regarding the incident.  (2)  Seek out allies stronger than
your offender.  'Many schools have some form of "professional conduct"
board who's mission is to review such charges.  In other cases, it may be
the Dean or VP for Academic Affairs.'  (3)  Make your case with the key
individual(s) identified above.
    <1992Sep8.120236.4910@scott.skidmore.edu>

Note 3 is a critique of the computer policy of University of Hawaii,
College of Engineering, University of Hawaii at Manoa.

3.   The policy, although a pretty good attempt at making the rules
explicit, violates legal and moral requirements for due process, privacy,
free expression, and user participation in some places.  It asserts that
computer use is a privilege and not a right, which, if not well clarified,
will allow "sys admins the authority to summarily suspend users from the
computer *before* establishing that the user has done anything".  The
policy also empowers a sys admin to search a user's email and files without
having to seek higher authorization or to notify the user.  The policy was
apparently created and enforced without the participation of the user
community.
   <1992Sep8.163018.8554@eff.org>

Note 4-5 is about a student being denied a hearing under the Student Due
Process Policy at WSU.

4.  Things have not changed in WSU (writes John Palmer).  Only recently in
1991,  the "C&IT denied a student account to someone, and when that someone
tried to get a judicial hearing under the Student Due Process Policy, the
C&IT (and university attorneys) argued that the student wasn't being
disciplined, but was being denied access to "protect other users", so he
didn't have any rights at all."  A letter from the C&IT said that the
Student Due Process Policy "applies only when the University (or another
charging party) seeks to discipline a student, [and] 'Discipline' consists
of expulsion, suspension, probation, etc."  The letter goes on to add that
"What has happened [is not disciplinary action but] is that the C&IT has
declined to facilitate your access to the computer because of your past
history of abusing the University computing system."
   <1992Sep8.171858.8639@tygra.Michigan.COM>

5.  [Carl writes,with supporting annotated references available from ftp.] 
"Ohio State University used the same kind of Humpty Dumpty redefinition of
words when they expelled Steven Brack from the computer. (We are not
authorized to punish you, therefore the stuff we did to you must not be
punishment.) I'm confident that if such a case every got the court, the
University would lose."
  <1992Sep8.212232.16054@eff.org>

Note 6 is about a court decision on a free speech dispute at SFA University

6.  A year ago, a group of students at Stephen F. Austin University (the
Young Conservatives of Texas) hung fliers which read, "SEX and politics are
a lot alike. You don't have to be good at them to enjoy them."  SFA
officials called the fliers sexist and tried to bar the group from posting
them.  With the help of the American Civil Liberties Union (ACLU), the
students filed a federal lawsuit May 15, asking that the SFA sign-posting
policy be overturned.  A settlement has apparently being reached, with an
undetermined amount of money included, and the new policy agreed to allows
the poster that started the controversy, and allows school officials "to
regulate how large posters can be and where they are placed."  However,
"the school may take down a sign that the president deems will incite
fights or ``imminent lawlessness'' - concepts defined strictly by federal
courts."
   <1992Sep8.183722.834@m.cs.uiuc.edu>

Note 7 is summary of the 1992-1993 Guidelines for use of Campus and Network
Computing Resources at Princeton University

7.  This framework for "responsible, considerate, and ethical behavior" in
the use of the university's computing resources include reminders to users
not to: "intentionally seek information ...  belonging to other people"; 
"decrypt or translate encrypted material, or obtain [unauthorized] system
privileges";  tie up computing resources in "excessive game playing or
other trivial applications [such as the] sending [of] frivolous or
excessive mail".   A user's absence from a public computer or workstation
should be "no longer than warranted by a visit to the nearest restroom" and
"a device unattended for more than ten minutes may be assumed to be
available for use".  Electronic mail "must meet the same standards for
distribution or display as if they were tangible documents" and changes to
electronic information contained in the network "will be considered forgery
if it would be considered so on a tangible document or instrument."
<1992Sep8.193517.12597@eff.org>

Notes 8 - 10 discusses some issues on E-mail Privacy/Snooping

8.  The Background:  A staff worker of MCI Mail, looked into the contents
of ex-employee Eugene Wang's MCI Mail account, and discovered Borland's
marketing plans and other confidential information sent to Symantec Corp. 
This brought civil suits against Gordon Eubanks, president of Symantec, and
Wang.  The Question:  Did the staff worker have the RIGHT to read Wang's
email?
<1992Sep9.231718.1863@PacBell.COM>

9.  What the staff worker did seems apparently legal.  The Electronic
Communications Privacy Act (ECPA) of 1986 specifically exempts providers of
electronic communications services from the prohibitions against seeing the
messages.  In addition, the worker has the right to divulge what is
inadvertently discovered to law enforcement agencies if it pertains to a
crime.  However, did the worker stumble upon the evidence by chance or was
he actually snooping around?
   <BuDuGM.EIB@rice.edu>

10.   When I was a LAN administrator for a medium sized company, what I did
when closing a user account was nuke the email, make a quick pass through
their directories and nuke anything that appeared to be personal. 
Remaining files were referred to their supervisor.  "Yes, we read 'private'
files. But it was our job to cleanup the account, and better *us* than
their supervisor! I frankly couldn't have told you the next day what had
been in 90% of the files that got deleted as 'personal'".  I could read any
file on the LAN, but there are something like 4 gigabytes of files out
there and therefore if I *wanted* to snoop, it will not be possible,
there's just too much to go thru!
   <1992Sep11.234228.25430@qiclab.scn.rain.com>

11.  "This isn't necessarily true, particularly if you want to "target" a
few individuals with well-organized directories."!
   <BuGAKy.J47@ef2007.efhd.ford.com>

12.  Although the employee of the mail provider is permitted some access, I
don't think they are allowed to go on snooping expeditions.  However, from
the [long sections from the law apart from the ECPA quoted], it would
appear that employees of service providers are definitely protected if they
access messages as part of their normal duties.  "It's not clear what the
penalties are for improper disclosure by an employee as they are not
directly listed.  The previous section ... includes fines of $5000 and
imprisonment up to 6 months for unlawful access if no commercial advantage
occurs (much worse if commercial advantage occurs), but says that conduct
authorized by a provider is excepted.  Very confusing." If reading someone
else's mail, before it is deleted, is normal procedure at MCI Mail,
customers should be told and they might be upset.  
   <1992Sep12.165743.7720@blaze.cs.jhu.edu>

- John B. Tan]







In this issue:

Diane Kovacs     19  Intellectual Property Theft...Help.
Leo D. Geoffrion 43  >
Carl M. Kadie   179  >policy
John Palmer      59  Wayne State University's <>ehavior Continues Unabated....
Carl M. Kadie    98  >
Carl M. Kadie    40  [UPI] SFA free speech flap settled
Carl M. Kadie   222  New Princeton Policy
John P. Gloria   50  >Article on E-mail Privacy/Snooping
Joseph Watters   88  >
Leonard Erickson 55  >
Mike O'Connor    21  >
Bill Bogstad    144  >MCI E-mail Snooping (VERY LONG)


Computers and Academic Freedom News

Managing Editor:  Carl M. Kadie (kadie@eff.org)
Administration:   William W. Arnold (caf-talk-request@eff.org, warnold@eff.org)
Associate Editor: Elizabeth M. Reid (emr@eff.org)
Associate Editor: Paul Joslin (joslin@tso.uc.edu)
Associate Editor: Adam C. Gross (ag3j+@andrew.cmu.edu)
Associate Editor: Mark C. Sheehan (sheehan@unixpop.ucs.indiana.edu)
Associate Editor: John F. Nixon (fnixon@sol.utc.edu)

To contribute to the list, send email to "caf-talk@eff.org". Your note
will appear immediately on the caf-talk mailing list and in the
alt.comp.acad-freedom.talk newsgroup.

Back issues are available via anonymous ftp to ftp.eff.org. The
directory is pub/academic/news. Abstracts of CAF-news are in file
pub/academic/abstracts. The CAF archive is also available via email.
For information, send email to archive-server@eff.org. Include the
line:

send acad-freedom README

Disclaimer: This CAF-News abstract was compiled by a guest editor or a
regular editor (Paul Joslin, Elizabeth M. Reid, Adam C. Gross, Mark C.
Sheehan, or Carl M. Kadie). It is not an EFF publication. The views an
editor expresses and editorial decisions he or she makes are his or
her own.

The addresses for the list are:
	comp-academic-freedom-talk@eff.org     - for contributions to the list
		or	caf-talk@eff.org
	listserv@eff.org    - for automated additions/deletions
                (send email with the line "help" for details.)
	caf-talk-request@eff.org    - for administrivia

        Also, if you read newsgroups, look for alt.comp.acad-freedom.talk
        and alt.comp.acad-freedom.news.
------------            

------------------------------

From caf-talk Caf Sep  7 21:37:19 1992
Newsgroups: alt.comp.acad-freedom.talk
From: DKOVACS@Kentvm.Kent.edu (Diane Kovacs)
Subject: Article 1--Intellectual Property Theft...Help.
Date: Tue, 8 Sep 1992 01:25:17 GMT

Well folks ... I am so angry my hands are shaking.  I need advice and
I need it badly.  What do I do when someone influential and powerful
in my profession is taking one of my projects and apparently trying to
pass it off as belonging to a particularly influential and powerful
organization in my profession (names hidden to protect me.).

This person is representing the project as belonging to the organization
because a disk copy was adapted for printing .  When the printing took
place the carefully written description of the selection process and
attribution to original e-sources and network people was deleted.
My copyright statement remains intact.  Yet this person wants to use
the disk copy to give away to people to run as a networked resources without
consulting with me or leaving the copyright statement intact.  I am
disillusioned to say the least.  I am a definite beginner in my profession
and have reason to worry that by fighting this I could put my career at risk.,
      dkovacs@kentvm.kent.edu


------------------------------

From caf-talk Caf Sep  8 08:10:26 1992
Newsgroups: alt.comp.acad-freedom.talk
From: ldg@scott.skidmore.edu (Leo D. Geoffrion)
Subject: Article 2--Re: Intellectual Property Theft...Help.
Date: Tue, 8 Sep 1992 12:02:36 GMT

In article <199209080137.AA01381@eff.org> DKOVACS@Kentvm.Kent.edu (Diane Kovacs) writes:
>Well folks ... I am so angry my hands are shaking.  I need advice and
>I need it badly.  What do I do when someone influential and powerful
>in my profession is taking one of my projects and apparently trying to
>pass it off as belonging to a particularly influential and powerful
>organization in my profession (names hidden to protect me.).
>

Ouch!  That is indeed a deep mess!

First question to consider...
    Do you want to fight or surrender?  Only you can decide that and
    don't let outsiders (including me) talk you in or out of fighting.
    
Assuming you do want to fight...
    Step 1:  keep a meticulous log of all contacts and conversations
    regarding the incident.  Include copies of your orignal work and 
    how the offender "doctored" it.  Documentation is the single most 
    powerful weapon in making your case.

    Step 2:  Locate the correct complaint point
    I'd take a long hard look at the organizational structure of the 
    school to see what your options may be.  The key is to locate 
    possible allies who are positioned even stronger than your
    offender.

    For example, many schools have some form of "professional conduct"
    board who's mission is to review such charges.  In other cases, it
    may be the Dean or VP for Academic Affairs.

    Step 3:  Make your case
    Most schools are highly sensitive to intellectual property issues,
    and if your case is solid, you stand a reasonable chance of a fair
    hearing.  I'd meet with the key individual(s) identified above and
    discuss the case fully and carefully.  Impress them with the
    accuracy of your facts, dates, etc...
-- 
Leo Geoffrion, Skidmore College Computer Services, Saratoga Springs, NY 12866
EMAIL: ldg@scott.skidmore.edu   VOICE: (518) 584-5000 Ext. 2919



------------------------------

From caf-talk Caf Sep  8 12:30:52 1992
Newsgroups: alt.comp.acad-freedom.talk,comp.org.eff.talk
From: kadie@eff.org (Carl M. Kadie)
Subject: Article 3--Re: policy
Date: Tue, 8 Sep 1992 16:30:18 GMT

This is a critique of the computer policy of University of Hawaii,
College of Engineering, University of Hawaii at Manoa. The policy
seems to be a pretty good attempt at making the rules explicit.
Several parts of the policy, however, likely violates legal and moral
requirements for due process, privacy, free expression, and user
participation.

I. Due process

The policy asserts several times that computer use is a privilege not
a right. I don't know what this means. It might be an assertion that
the University can act arbitrarily, if so it is legally meaningless.
For while use of computers may not be a "right", due process is. This
right cannot be asserted away. The policy could be improved by
removing or clarifying these assertions.

The policy gives sys admins the authority to summarily suspend users
from the computer *before* establishing that the user has done
anything. The policy thus authorizes illegal violations of user's due
process rights and gives sys admins more authority than professors
have. It also violates a tenet of academic freedom:

"Pending action on the charges, the status of a student should not be
altered, or his right to be present on the campus and to attend
classes suspended, except for reasons relating to his physical or
emotional safety and well being, or for reasons relating to the safety
and well-being of students, faculty, or university property."
  - From the Joint Statement on Rights and Freedoms of Students

The policy could be improved by being made consistent with the law on
due process and the principles of academic freedom.

II. Privacy

The policy allows a sys admin to search a users email and files at the
sys admins' own discretion: no higher authorization is required, no
notice must be given to the subject of the search - even after the
search.

The policy could be improved having the University treat searches of
assigned disk space the same as it treats searches of assigned office
space and dorm rooms. As it stands, the policy may be an illegal
violation of user's right to be free of "unreasonable searches".
[4th Amendment]

III. Free Expression

The policy prohibits the sending of frivolous message. The word
"frivolous" is too vague. The policy could be improved by removing it.

IV. User Participation

The policy was apparently created and is apparently enforced without
the participation of the user community. This is contrary to the
principles of academic freedom. It is also likely contrary do the U.
of Hawaii's policy making procedures. (It is also unwise.)

- Carl Kadie

ANNOTATED REFERENCES

(All these documents are available on-line. Access information follows.)

=================
faq/policy
=================
q: What guidance is there for creating or evaluating a computer policy?

=================
statements/caf-statement
=================
This is an attempt to codify the application of academic freedom to
academic computers. It reflects our seven months of on-line discussion
about computers and academic freedom. It covers free expression, due
process, privacy, and user participation.

Comments and suggestions are very welcome (especially when posted to
CAF-talk). All the documents referenced are available on-line.
(Critiqued).

=================
statements/caf-statement.critique
=================
This is a critique of an attempt to codify the application of academic
freedom to academic computers. It reflects our seven months of on-line
discussion about computers and academic freedom. It covers free
expression, due process, privacy, and user participation.

Additional comments and suggestions are very welcome (especially when
posted to CAF-talk). All the documents referenced are available
on-line.

=================
law/due-process.french
=================
Quotes about the due process requirements of "notice of charges" and
"find of facts" at a formal administrative hearing. The quotes are
from:

_The Redefinition of the Exclusionary Rule as to Student Procedural
Due Process in High Education_. A monograph from the Office of the
General Counsel [of Southern Illinois University] by Dr. Larry L.
French, General Counsel, 1977.

=================
faq/email.policies
=================
q: Do any universities treat email and computer files as private?

=================
academic/student.freedoms.aaup
=================
Joint Statement on Rights and Freedoms of Students -- This is the main
U.S. statement on student academic freedom.

=================
law/constitution.us
=================
The Constitution of the United States

=================
policies/seas.ucla.edu
=================
Computer policy for UCLA's SEASnet (Critiqued)

=================
policies/seas.ucla.edu.critique
=================
Critique of computer policy for UCLA's SEASnet

Summary: "It seems like a pretty good policy. I especially like that
it covers both users and sys admins. Also, it lays out clear rules and
disciplinary procedures. And, it acknowledges the user's privacy.

I think it could be improved (perhaps with the participation of users)
by clarifying the prohibition against noncommercial personal use.
Also, procedure by which a sys admin is authorized to search user
files should be made clear and it should be made consistent with the
University's general search procedures (or its telephone search
procedures).  Finally, users should not be punished for rule
infractions until and unless it is determined such infractions have
occurred."

=================
=================

These document(s) are available by anonymous ftp (the preferred
method) and by email. To get the file(s) via ftp, do an anonymous ftp
to ftp.eff.org (192.88.144.4), and get file(s):

  pub/academic/faq/policy
  pub/academic/statements/caf-statement
  pub/academic/statements/caf-statement.critique
  pub/academic/law/due-process.french
  pub/academic/faq/email.policies
  pub/academic/academic/student.freedoms.aaup
  pub/academic/law/constitution.us
  pub/academic/policies/seas.ucla.edu
  pub/academic/policies/seas.ucla.edu.critique

To get the file(s) by email, send email to archive-server@eff.org.
Include the line(s) (be sure to include the space before the file
name):

send acad-freedom/faq policy
send acad-freedom/statements caf-statement
send acad-freedom/statements caf-statement.critique
send acad-freedom/law due-process.french
send acad-freedom/faq email.policies
send acad-freedom/academic student.freedoms.aaup
send acad-freedom/law constitution.us
send acad-freedom/policies seas.ucla.edu
send acad-freedom/policies seas.ucla.edu.critique
-- 
Carl Kadie -- I do not represent EFF; this is just me.
 =kadie@eff.org, kadie@cs.uiuc.edu =


------------------------------

From caf-talk Caf Sep  8 15:38:43 1992
Newsgroups: mi.misc,alt.comp.acad-freedom.talk,comp.org.eff.talk
From: jp@tygra.Michigan.COM (John Palmer)
Subject: Article 4--Wayne State University's Bad Behavior Continues Unabated....
Date: Tue, 8 Sep 92 17:18:58 GMT

In article <1992Sep7.022305.23714@cs.wayne.edu> delledg@jake.cc.wayne.edu (De Vaughn Elledge) writes:
">
">I could tell you stories about WSU. I was a student there for 8 years
">Summary: They (the C&IT) treat the students like dirt, have no policy
">in place for students to challenge denial of access to university 
">computing facilities. They were not nice people back then. I don't know
">if things have changed at all.
">
" Things have changed a lot since then. I've never been treated like dirt
" by the C@IT and there is a policy in place for denial of access to
" Computing Facilites. I've been here since '85 haven't had trouble with
" the C@IT...most trouble I've had is dealing with Profs/T.A.'s/etc who
" speak english with a heavy accent.  
"
"

Well, actually, the case that I heard of recently, the C&IT denied a 
student account to someone, and when that someone tried to get a judicial
hearing under the Student Due Process Policy, the C&IT (and university
attorneys) argued that the student wasn't being disciplined, but was
being denied access to "protect other users", so he didn't have any
rights at all. Here is a copy of the letter sent to that student. I've
deleted her name.

-----<BEGINNING OF LETTER>-------

September 23, 1991

<NAME OF STUDENT DELETED>

Dear Ms. <NAME DELETED>,

Thank you for your letter of September 12, 1991. I believe that you 
misunderstand the Student Due Process Policy. This policy applies 
only when the University (or another charging party) seeks to discipline
a student. "Discipline" consists of expulsion, suspension, probation, etc. 

At present, no one is seeking to discipline you. If the neccessity should
arise to do so, the Student Due Process Policy will certainly apply, since
academic disciplinary actions cannot be taken without compliance with
the Policy.

What has happened is that the C&IT has declined to facilitate your access
to the computer because of your past history of abusing the University
computing system. In light of that history, C&IT is not obliged to 
continue to do business with you. 

Yours Very Truly, 

Wesley Steele
Manager, C&IT Security/Standards.

------< END OF LETTER>-----

As you can see, this all took place in 1991, so I don't think things are
any different. 


------------------------------

From caf-talk Caf Sep  8 17:22:40 1992
Newsgroups: mi.misc,alt.comp.acad-freedom.talk,comp.org.eff.talk
From: kadie@eff.org (Carl M. Kadie)
Subject: Article 5--Re: Wayne State University's Bad Behavior Continues Unabated....
Date: Tue, 8 Sep 1992 21:22:32 GMT

jp@tygra.Michigan.COM (John Palmer) writes:


>-----<BEGINNING OF LETTER>-------

>September 23, 1991

><NAME OF STUDENT DELETED>

>Dear Ms. <NAME DELETED>,

>Thank you for your letter of September 12, 1991. I believe that you 
>misunderstand the Student Due Process Policy. This policy applies 
>only when the University (or another charging party) seeks to discipline
>a student. "Discipline" consists of expulsion, suspension, probation, etc. 
[...]

=================================

Ohio State University used the same kind of Humpty Dumpty redefinition
of words when they expelled Steven Brack from the computer. (We are
not authorized to punish you, therefore the stuff we did to you must
not be punishment.) I'm confident that if such a case every got the
court, the University would lose.

- Carl

ANNOTATED REFERENCES

(All these documents are available on-line. Access information follows.)

=================
law/goss-v-lopez.fischer
=================
Comments from _Teacher's and the Law_, 3rd edition, by Louis Fischer,
et al. Published in 1991 by Longman. It reports that the Supreme Court
says that some modicum of due process is necessary unless the matter
is trivial or there is an emergency.

=================
law/goss-v-lopez.mnookin
=================
Comments from _In the Interest of Children_, R. Mnookin (Ed.),
Franklin E.  Zimring and Rayman L.  Solomon (Contrib. Authors). It
reports that the Supreme Court says that some modicum of due process
is necessary unless the matter is trivial or there is an emergency.
Also,

=================
law/constraints.constitutional
=================
Comments from _A Practical Guide to Legal Issues Affecting College
Teachers_ by Partrica A. Hollander, D. Parker Young, and Donald D.
Gehring.  (College Administration Publication, 1985).  Discusses the
constitutional constraints on public universities including the
requires for freedom of expression, freedom against unreasonable
searches and seizures, due process, specific rules.

=================
cases/brack@acs.ohio-state.edu
=================
All the early notes from CAF-talk related to Steven Brack, Ohio State,
and Academic Computer Services.

=================
cases/brack@ohio-state.edu
=================
The letters from Ohio State University to Steven Brack including his
letter of dismissial. Also comments on the letters.

=================
=================

These document(s) are available by anonymous ftp (the preferred
method) and by email. To get the file(s) via ftp, do an anonymous ftp
to ftp.eff.org (192.88.144.4), and get file(s):

  pub/academic/law/goss-v-lopez.fischer
  pub/academic/law/goss-v-lopez.mnookin
  pub/academic/law/constraints.constitutional
  pub/academic/cases/brack@acs.ohio-state.edu
  pub/academic/cases/brack@ohio-state.edu

To get the file(s) by email, send email to archive-server@eff.org.
Include the line(s) (be sure to include the space before the file
name):

send acad-freedom/law goss-v-lopez.fischer
send acad-freedom/law goss-v-lopez.mnookin
send acad-freedom/law constraints.constitutional
send acad-freedom/cases brack@acs.ohio-state.edu
send acad-freedom/cases brack@ohio-state.edu
-- 
Carl Kadie -- I do not represent EFF; this is just me.
 =kadie@eff.org, kadie@cs.uiuc.edu =


------------------------------

From caf-talk Caf Sep  8 14:41:20 1992
From: kadie@herodotus.cs.uiuc.edu (Carl M. Kadie)
Newsgroups: alt.comp.acad-freedom.talk,alt.censorship,alt.politics.correct,soc.college
Subject: Article 6--[UPI] SFA free speech flap settled
Date: 8 Sep 92 18:37:22 GMT

Copyright 1992 by UPI.  Reposted with permission from the ClariNet
Electronic Newspaper newsgroup clari.local.texas. For more info on
ClariNet, write to info@clarinet.com or phone 1-800-USE-NETS.

	DALLAS (UPI) -- Conservative students at Stephen F. Austin University
and school officials have apparently reached a settlement in a free
speech dispute that stemmed from fliers the group posted a year ago.
	Young Conservatives of Texas hung fliers featuring a startling quote
>from former Republican Sen. Barry Goldwater. It read, ``SEX and politics
are a lot alike. You don't have to be good at them to enjoy them.''
	Officials at the Nacogdoches school called the fliers sexist and
tried to bar the group from posting them. But two Young Conservatives
members, Michael Bartlow and Guy Hatch, hung the fliers anyway. They
said the school's policy was a violation of their First Amendment rights
by requiring
	Joe Cook, regional director of the American Civil Liberties Union,
said an undetermined amount of money is included in the settlement.
	With the help of the ACLU, a favorite target of conservative attacks,
the students filed a federal lawsuit May 15, asking that the SFA sign-
posting policy be overturned.
	Cook said, ``It's a significant free-speech case.'' He said that
under the policy, students were not allowed to post anything without
permission.
	SFA general counsel Yvette Clark said the new policy agreed to under
the settlement would allow the poster that started the controversy.
	The new policy, acceptable under First Amendment law as 'time, place
and manner`` restrictions, allows school officials to regulate how large
posters can be and where they are placed. It also says posters must show
the group's name, telephone number and contact person.
	But the school may take down a sign that the president deems will
incite fights or ``imminent lawlessness'' - concepts defined strictly by
federal courts.



--
Carl Kadie -- kadie@cs.uiuc.edu -- University of Illinois at Urbana-Champaign


------------------------------

From caf-talk Caf Sep  8 15:35:57 1992
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: kadie@eff.org (Carl M. Kadie)
Subject: Article 7--New Princeton Policy
Date: Tue, 8 Sep 1992 19:35:17 GMT


	1992-1993 Guidelines for use of Campus and Network
	Computing Resources

	Princeton University makes available computing and
	network resources which may be used by University
	undergraduates, graduate students, faculty and
	staff. The resources administered by the Office of
	Computing and Information Technology (CIT) are
	intended to be used for educational purposes and to
	carry out the legitimate business of the
	University. Appropriate use of the resources
	includes instruction, independent study, authorized
	research, independent research, and the official
	work of the offices, departments, recognized
	student and campus organizations, and agencies of
	the University.

	The computing and network resources of the
	University may not be used by members of the
	University community for commercial purposes or for
	financial gain.

	Those who avail themselves of the campus and
	network computing resources are required to behave
	in their use of the technology in a manner
	consistent with the University's code of conduct.
	As stated in Princeton University Rights, Rules,
	Responsibilities:

	"Respect for the rights, privileges, and
	sensibilities of each other is essential in
	preserving the spirit of community at Princeton.
	Actions which make the atmosphere intimidating,
	threatening, or hostile to individuals are
	therefore regarded as serious offenses. Abusive or
	harassing behavior, verbal or physical, which
	demeans, intimidates, threatens, or injures another
	because of his or her personal characteristics or
	beliefs is subject to University disciplinary
	sanctions...."

	As also noted in Rights, Rules, Responsibilities:

	"Unauthorized or fraudulent use of the University's
	computing resources is a serious violation of
	University regulations. Duplicating software which
	is protected by copyright or trade secret law is a
	violation of the law."

	The University has subscribed to the statement on
	software and intellectual rights distributed by
	EDUCOM, the non-profit consortium of colleges and
	universities committed to the use and management of
	information technology in higher education, and
	ITAA, the Information Technology Association of
	America, a computer software and services industry
	association:

	"Respect for intellectual labor and creativity is
	vital to academic discourse and enterprise. This
	principle applies to work of all authors and
	publishers in all media. It encompasses respect for
	the right to acknowledgement, right to privacy, and
	right to determine the form, manner, and terms of
	publication and distribution.

	"Because electronic information is volatile and
	easily reproduced, respect for the work and
	personal expression of others is especially
	critical in computer environments. Violations of
	authorial integrity, including plagiarism, invasion
	of privacy, unauthorized access, and trade secret
	and copyright violations, may be grounds for
	sanctions against members of the academic
	community."

	The framework of responsible, considerate, and
	ethical behavior expected by the University extends
	to cover use of campus microcomputers and
	workstations, general-use computers such as phoenix
	and PUCC, use of campus network resources, and use
	of networks throughout the world to which the
	University provides computer access. The following
	list does not cover every situation which pertains
	to proper, or improper, use of the resources, but
	it does suggest some of the responsibilities which
	you accept if you choose to use a University
	computing resource or the network access which the
	University provides.

	1.  If you have any computer account, you are
	responsible for the use made of that account. You
	should set a password which will protect your
	account from unauthorized use, and which will not
	be guessed easily.  If you discover that someone
	has made unauthorized use of your account, you
	should change the password and report the intrusion
	to a CIT Information Center. You should change your
	password on a regular basis, to assure continued
	security of your account.

	2.  You must not intentionally seek information
	about, browse, obtain copies of, or modify files,
	passwords, or tapes belonging to other people,
	whether at Princeton or elsewhere, unless
	specifically authorized to do so by those
	individuals. (Note: if an individual has explicitly
	and intentionally established a public server, or
	clearly designated a set of files as being for
	shared public use, others may assume
	authorization.)

	3.  You must not attempt to decrypt or translate
	encrypted material, or obtain system privileges to
	which you are not entitled. Attempts to do any of
	these will be considered serious transgressions.

	4.  If you encounter or observe a gap in system or
	network security, you must report the gap to the
	Manager, CIT Information Centers. You must refrain
	from exploiting any such gaps in security.

	5.  You must refrain from any action which
	interferes with the supervisory or accounting
	functions of the systems or that is likely to have
	such effects.

	6.  You must be sensitive to the public nature of
	shared facilities, and take care not to display on
	screens in such locations images, sounds or
	messages which could create an atmosphere of
	discomfort or harassment for others. You must also
	refrain from transmitting to others in any location
	inappropriate images, sounds or messages which
	might reasonably be considered harassing.

	7.  You must avoid tying up computing resources for
	excessive game playing or other trivial
	applications;  sending frivolous or excessive mail
	or messages locally or over an affiliated network;
	printing excessive copies of documents, files,
	images or data. You must refrain from using
	unwarranted or excessive amounts of storage;
	printing documents or files numerous times because
	you have not checked thoroughly for all errors and
	corrections; or running grossly inefficient
	programs when efficient ones are available. You
	must be sensitive to special need for software and
	services available in only one location, and cede
	place to those whose work requires the special
	items.

	8.  You must not prevent others from using shared
	resources by running unattended processes or
	placing signs on devices to "reserve" them without
	authorization. Your absence from a public computer
	or workstation should be no longer than warranted
	by a visit to the nearest restroom. A device
	unattended for more than ten minutes may be assumed
	to be available for use, and any process running on
	that device terminated. You must not lock a
	workstation or computer which is in a public
	facility. You must also be sensitive to performance
	effects of remote login to shared workstations:
	when there is a conflict, priority for use of the
	device must go to the person seated at the keyboard
	rather than to someone logged on remotely.

	9.  The University presents for your use many
	programs and data which have been obtained under
	contracts or licenses saying they may be used, but
	not copied, cross-assembled, or reverse-compiled.
	You are responsible for determining that programs
	or data are not restricted in this manner before
	copying them in any form, or before reverse-
	assembling or reverse-compiling them in whole or in
	any part. If it is unclear whether you have
	permission to copy such software or not, assume
	that you may not do so.

	10. If you create or maintain electronically-stored
	information which is important to your work or to
	the University in general, you are responsible for
	making frequent backups of the information.

	11. Messages, sentiments, and declarations sent as
	electronic mail or sent as electronic postings must
	meet the same standards for distribution or display
	as if they were tangible documents or instruments.
	You are free to publish your opinions, but they
	must be clearly and accurately identified as coming
	from you, or, if you are acting as the authorized
	agent of a group recognized by the University, as
	coming from the group you are authorized to
	represent. Attempts to alter the "From" line or
	other attribution of origin in electronic mail,
	messages, or postings, will be considered
	transgressions of University rules.

	12. If you create, alter, or delete any electronic
	information contained in, or posted to, any campus
	computer or affiliated network it will be
	considered forgery if it would be considered so on
	a tangible document or instrument.

	13. You must not create and send, or forward,
	electronic chain letters.

	14. You should be aware that there are Federal,
	State and sometimes local laws which govern certain
	aspects of computer and telecommunications use.
	Members of the University community are expected to
	respect these laws, as well as to observe and
	respect University rules and regulations.

-- 
Carl Kadie -- I do not represent EFF; this is just me.
 =kadie@eff.org, kadie@cs.uiuc.edu =


------------------------------

From caf-talk Caf Sep  9 19:21:38 1992
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: jpglori@srv.PacBell.COM (John P. Gloria)
Subject: Article 8--Re: Article on E-mail Privacy/Snooping
Date: Wed, 9 Sep 1992 23:17:18 GMT

In article <1992Sep9.121142.4840@ms.uky.edu> morgan@ms.uky.edu (Wes Morgan) writes:
>There is an interesting article in the September 1992 issue of "Corporate
>Computing".  Entitled "E-mail Snooping", it's an overview of the current
>controversy in email privacy.  It included discussion of the Epson case,
>comments from Eastman Kodak and several other firms, and an editorial by
>William F Buckley.  It's an interesting piece of reading material.
>
>I called Corporate Computing, and they refused my request to post the
>article or excerpts thereof.  (I realize that they have a healthy business 
>in selling reprints, but this seems a bit extreme.)
>
>I noticed something else interesting.  The article includes an interview
>with a director of the Electronic Mail Association.  After digging through
>several name servers (and nic.ddn.mil), I discovered that the EMA doesn't
>even have a registered domain!  Ya just gotta love it.......
>
>--Wes
>-- 
>MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
>morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
>morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
>  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu

The Wednesday, Sept. 9, 1992 issue of the San Francisco Examiner has an
interesting article of how the "Email's trail of evidence in software case"
has brought civil suits against Gordon Eubanks, president of Symantec Corp., 
and Eugene Wang, a former executive of Borland International.  At this point in 
time, everything is "alleged" to have happened.  In a nutshell the DA office
has what they consider evidence in which both parties communicated using
MCI Mail. The contexts of the message have been determined to be marketing
plans and other confidential information from Borland that have aided
Symantec in the battle for software market share.

Apparently when Wang resigned, his MCI Mail account was closed.  According
to the paper, MCI Mail saves messages for five days and then deleted. All
these came to light when a staff worker was closing the account and "looked"
into Wang's account and was suprised on the contents of the messages.  This
started court orders to search offices/residences on both parties. 

Question:  did the staff worker have the RIGHT to read Wang's email?
When I close accounts, I tar everything to tape and then remove everything.
I don't have time to read user's files or email that is still in queue.

-- 
        ---------  John Gloria - jpglori@pacbell.com	--------	
 		"You cannot depend on your eyes when your imagination
	       is out of focus."   -     Mark Twain


------------------------------

From caf-talk Caf Sep 10 19:52:26 1992
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: jaw@owlnet.rice.edu (Joseph A. Watters)
Subject: Article 9--Re: Article on E-mail Privacy/Snooping
Date: Thu, 10 Sep 1992 22:00:22 GMT

In article <1992Sep10.190922.900@dcatlas.dot.gov>, joet@dcatlas.dot.gov (Joe Trott) writes:
|> jpglori@srv.PacBell.COM (John P. Gloria) writes:
|> 
|> >Question:  did the staff worker have the RIGHT to read Wang's email?
|> >When I close accounts, I tar everything to tape and then remove everything.
|> >I don't have time to read user's files or email that is still in queue.
|> 
|> No, he did *not* have the right (unless a prior contract specified otherwise)
|> to view Wang's email.  He should be prosecuted, found as guilty as he is,
|> and treated as harshly as possible.  That said, the evidence that Wang was
|> involved in crimes of his own *exists*.  It cannot be ignored.  Two wrongs
|> do not make a right.  Wang should also be tried, convicted, and probably
|> shot ("if you don't like the consequences of your actions...").
|> 
|> -JTT
|> 

Not so fast.  The Electronic Communications Privacy Act of 1986
specifically exempts providers of electronic communications services
from the prohibitions against seeing the messages:

        Section 2701.  Unlawful access to stored communications

             (a)  Offense.-- Except as provided in subsection (c) of this
        section whoever --

                 (1)  intentionally  accesses  without  authorization a
            facility through which an electronic communication service is
            provided; or

                 (2)   intentionally exceeds an authorization  to access
            that facility;

        and  thereby obtains, alters, or prevents authorized access to a
        wire  or  electronic  communication while  it  is  in electronic
        storage  in  such  a  system shall be  punished  as  provided in
        subsection (b) of this section.

[...]

             (c)   Exceptions.-- Subsection (a) of this section does not
        apply to conduct authorized--

                 (1)  by  the  person  or  entity  providing  a  wire or
            electronic communications service;

In addition, the worker has the right to divulge what is inadvertently
discovered to law enforcement agencies if it pertains to a crime:

        Section 2702.  Disclosure of contents

             (a) Prohibitions.-- Except as provided in subsection (b)--

                 (1)   a  person  or  entity  providing   an electronic
            communication  service  to  the public  shall  not knowingly
            divulge   to  any  person  or  entity  the  contents   of a
            communication  while in electronic storage by  that service;

[...]

             (b)   Exceptions.--  A  person or  entity  may  divulge the
        contents of a communication --

[...]
                 (6) to a law enforcement agency, if such contents --

                      (A)  were  inadvertently obtained  by  the service
                 provider; and

                      (B) appear to pertain to the commission of a crime.

The only possible issue is whether the worker's discovery was
inadvertent.  Given that he/she was not specifically looking for
evidence of a crime, and was in the process of doing a normal account
deletion, it seems to me that it was inadvertent in the context of the
law.  I am not familiar with the all of the details of the case, so
there may be a subtlety involving how they came across the information,
but as far as I can tell, that worker was completely within the
allowances of the law on this one.

-- 
Joseph A. Watters, Jr.		jaw@owlnet.rice.edu
Deputy Director, Owlnet
Rice University
Houston, Texas


------------------------------

From caf-talk Caf Sep 11 21:16:42 1992
From: leonard@qiclab.scn.rain.com (Leonard Erickson)
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
Subject: Article 10--Re: Article on E-mail Privacy/Snooping
Date: 11 Sep 92 23:42:28 GMT

joet@dcatlas.dot.gov (Joe Trott) writes:

>jpglori@srv.PacBell.COM (John P. Gloria) writes:

>>Apparently when Wang resigned, his MCI Mail account was closed.  According
>>to the paper, MCI Mail saves messages for five days and then deleted. All
>>these came to light when a staff worker was closing the account and "looked"
>>into Wang's account and was suprised on the contents of the messages.  This
>>started court orders to search offices/residences on both parties. 

>>Question:  did the staff worker have the RIGHT to read Wang's email?
>>When I close accounts, I tar everything to tape and then remove everything.
>>I don't have time to read user's files or email that is still in queue.

>No, he did *not* have the right (unless a prior contract specified otherwise)
>to view Wang's email.  He should be prosecuted, found as guilty as he is,
>and treated as harshly as possible.  That said, the evidence that Wang was
>involved in crimes of his own *exists*.  It cannot be ignored.  Two wrongs
>do not make a right.  Wang should also be tried, convicted, and probably
>shot ("if you don't like the consequences of your actions...").

When i was one of the LAN administrators for a medium sized company, we
didn't *have* a policy on such things (though we were agitating to get
the higher ups to *set* one)

What we did when closing a user account was nuke the email, make a quick
pass through their directories and nuke anything that appeared to be personal,
and make a scan for files marked as being owned by them elsewhere. 

After cleaning up the "personal" stuff, and nuking "irrelevant" stuff
(like config files for various programs), any remaining files were referred
to their supervisor to see if they were "needed". (ie for their replacement
or as general company data, sday a process spec the person had been writing).

Anything that wasn't "needed" got nuked. 

Yes, we read "private" files. But it was our job to cleanup the account,
and better *us* than their supervisor! I frankly couldn't have told you
the next day what had been in 90% of the files that got deleted as 
"personal". 

In fact as I had occasion to tell users who were worried about the fact that
I could read any file on the LAN "There are something like 4 gigabytes of
files out there. *Thousands* of them. Even if I *wanted* to snoop, there's
too much to go thru!"


-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/51	 Leonard.Erickson@f51.n105.z1.fidonet.org
(The CIS & Fido addresses are preferred)


------------------------------

From caf-talk Caf Sep 12 02:12:25 1992
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: mjo@ef2007.efhd.ford.com (Mike O'Connor)
Subject: Article 11--Re: Article on E-mail Privacy/Snooping
Date: Sat, 12 Sep 1992 05:43:46 GMT

In article <1992Sep11.234228.25430@qiclab.scn.rain.com>
70465.203@compuserve.com writes:

:In fact as I had occasion to tell users who were worried about the fact that
:I could read any file on the LAN "There are something like 4 gigabytes of
:files out there. *Thousands* of them. Even if I *wanted* to snoop, there's
:too much to go thru!"

This isn't necessarily true, particularly if you want to "target" a
few individuals with well-organized directories.  

						...Mike

-- 
 Michael J. O'Connor           |  Internet:  mjo@fmsrl7.srl.ford.com
 Ford Motor Company, OPEO      |  UUCP:      ...!{backbone}!fmsrl7!mjo
 20000 Rotunda, Bldg. 1-3001   |  Phone:     +1 (313) 248-1260
 Dearborn, MI  48121           |  Fax:       +1 (313) 323-6277


------------------------------

From caf-talk Caf Sep 12 13:02:02 1992
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: bogstad@rhombus.cs.jhu.edu (Bill Bogstad)
Subject: Article 12--Re: MCI E-mail Snooping (VERY LONG)
Date: Sat, 12 Sep 1992 16:57:43 GMT

In article <BuFKv7.FBJ@rice.edu> jaw@owlnet.rice.edu (Joseph A. Watters) writes:
>I'm sorry, but there seem to be some confusion about the facts in your
>original post.  Wang worked for Borland International.  He had an MCI
>Mail account.  MCI is the electronic communications service provider.
>An *MCI* staff worker was closing the account, not a Borland employee.
>...

	This still isn't clear to me.  Was it a Borland employee or an
MCI employee.

>The MCI worker is part of the service provider and is explicitly exempt
>from the prohibitions on reading another person's stored electronic
>communications.  Unless I seriously misunderstand how MCI Mail works, I
>wouldn't think that a Borland employee could close/look into another
>person's MCI mail account.  If the mail messages were somehow stored on
>a Borland system before they were sent out to/through MCI Mail
>(although the original post seems to indicate something else), if that
>Borland employee's duties are to maintain the mail accounts, then
>he/she is still considered to be part of an electronic communications
>service provider, because in this case, Borland is also a provider.
>Thus, again, according to the ECPA, what the employee apparently did
>was legal.

	Actually, it might not be.  If the employee involved was not part of
the "provider" then we either have someone illegally breaking into someone
else account OR the account was owned by Borland in which case they can
decide who gets access to it.  (Actually, this might bring up an analogy
with the idea of wiretaping employees phones.  Doesn't sound ethical
to me, but it might be legal...)  On the other hand, the employee might
be part of a service provider: MCI (or Borland if they did some of the work).
In this case, the employee is permitted some access, but I don't think they
are allowed to go on snooping expeditions.  Relevant sections from the
law after the ECPA of 1986 was enacted might be:

[My comments are at end or in brackets like this]

Title 18

Chapter 119 Wire and Electronic Communications Interception and Interception
of Oral Communications

Sections 2511 Interception and disclosure of wire, oral, or electronic
communications prohibited.
...
(2) (a) (i) It shall not be unlawful under this chapter for an operator of a
switchboard, or an officer, employee, or agent of a provider of wire or
electronic cummunication service, whose facilities are used in the
transmission of a wire communication, to intercept, disclose, or use that
communication in the normal course of his employement while engaged in any
activity which is a necessary incident to the rendition of his service or to
the proteciton of the rights or property of the provider of that srvice,
except that a provider of wire communication service to the public shall not
utilize service observing or random monitoring except for mechanical or
service quality control checks.

[Note "necessary incident".  Was it necessary?]

[or this may be the relevation section]

Chapter 121 Stored Wire and Electronic Communications and Transational
Records Access

Sections 2702. Disclosure of contents

(a) Prohibitions. -- Except as provide in subsection (b) --

(1) a person or entity providing an electronic communication service to the
public shall not knowingly divulge to any person or entity the contents of a
communication while in electornic storage by that srvice; and

(2) a person or entity providing remote computing servie to the public shall
not knowingly divulge to any person or entity the contents of any
communication which is carried or maintained on that service --

	(A) on behalf of, and received by means of electronic transmission
	from (or created by means of computer processing of communications
	received by means of electrnoic transmission from), a subscriber or
	customer of such service;

	(B) solely for the purpose of providing storage or computer
	processing services to such subscriber or customer, if the provider
	is not authorized to access the contents of any such communications
	for purpose of providing any service other than storage or computer
	processing.

(b) Exceptions.-- A person or entity may divulge the contents of a
communication --

	(1) to the addresses or intended recipient of such communication or
	an agent of such adddressee or intended recipient;

	(2) as otherwise authorized in section 2516, 2511 (2) (a), or 2703
	of this title;

[Note: 2516 and 2703 talk about warrants, 2511 is excerpted above.]

	(3) with the lawful consent of the originator or an addressee or
	intended recipient of such communication, or the subscriber in the
	case of a remote computing service;

	(4) to a person employed or authrized or whose facilities are used to forward such communication to its destination;

	(5) as may be necessary incident to the rendition of the service or
	to the protection of the rights or property of the provider of that
	service; or

	(6) to a law enforcement agency, if such contents --

		(A) were inadvertently obtained by the service provider; and

[inadvertent?????]

		(B) appear to pertain to the commission of a crime.

[How did messages appear to pertain to commission of a crime?  Would have to
see them to know.  Just who did this employee tell, it doesn't appear like
they were authorized to go to Borland at all even if they know that a crime
was being committed against them.  They would have to go to the authorities
first.]

COMMENTS

	Employees of service providers are definitely protected if they
access messages as part of their normal duties.  That brings up the question
of whether it is necessary as part of someones duties to read messages left
in someones account before it is deleted.  If that is in fact normal
procedure at MCI Mail, I would think that customers would like to know about
it and might be upset.  It's not clear what the penalties are for improper
disclosure by an employee as they are not directly listed.  The previous
section (not shown above) includes fines of $5000 and imprisonment up to 6
months for unlawful access if no commercial advantage occurs (much worse if
commercial advantage occurs), but says that conduct authorized by a provider
is excepted.  Very confusing.  Oh, another thing I found interesting was
there is a prohibiton of use in evidence of improperly intercepted wire or
oral communications, but electronic (computer) communications are not
mentioned in that section.  It would seem from my laymens reading that
although it might be illegal for an MCI employee to deliberately look for
incriminating mail if they found any it could still be used in court.
Particularily if you look at the last exception (6) above...  Anyone really
interested in these issues should probably obtain copies of the relevant
section of law and consult a lawyer who specializes in this area for
anything important.

				Bill Bogstad




------------------------------

End of Computers and Academic Freedom News (Digest)
************************************
-- 
Carl Kadie -- I do not represent EFF; this is just me.
 =kadie@eff.org, kadie@cs.uiuc.edu =
Xref: sparky alt.grad-student.tenured:54 soc.college.grad:1901 soc.college.gradinfo:1444