HDTenEightyP/NetNews huggingface dataset:
From: jaw@owlnet.rice.edu (Joseph A. Watters)
Subject: Re: MCI E-mail Snooping
Keywords: Corporate Computing, September 1992
Organization: Rice University
Date: Fri, 11 Sep 1992 20:28:18 GMT

In article <huh?>, jpglori@srv.PacBell.COM (John P. Gloria) writes:
|> >>>Question:  did the staff worker have the RIGHT to read Wang's email?
|> >
[...]
|> >
|> >It isn't a question of whether you have the _time_; the question is, do you
|> >have the _right_?
|> >
|> >Unless it's in the contract, how can the answer be anything but "NO!"?
|> >Why would it be in the contract?  Who would sign such a contract?
|> >
|> >-JTT
|> >
|> 
|> The ramifications on this particular case will certainly test an
|> individual's right to e-mail privacy vs the company's right to
|> access employee's accounts.  The paper did not elaborate on exactly
|> why the staff worker read the e-mail.  It appeared the worker, IMHO,
|> was snooping around without just cause. Of course, a company policy
|> could exist that gives them the right to peruse an account.  Afterall,
|> Wang held a high office, and there could be some messages that needed to 
|> be re-directed to his successor.  

I'm sorry, but there seem to be some confusion about the facts in your
original post.  Wang worked for Borland International.  He had an MCI
Mail account.  MCI is the electronic communications service provider.
An *MCI* staff worker was closing the account, not a Borland employee.
At least, that is what I read from your post:

> Apparently when Wang resigned, his MCI Mail account was closed.
> According to the paper, MCI Mail saves messages for five days and then
> deleted.  All these came to light when a staff worker was closing the
> account and "looked" into Wang's account and was suprised on the
> contents of the messages.  This started court orders to search
> offices/residences on both parties.

The MCI worker is part of the service provider and is explicitly exempt
from the prohibitions on reading another person's stored electronic
communications.  Unless I seriously misunderstand how MCI Mail works, I
wouldn't think that a Borland employee could close/look into another
person's MCI mail account.  If the mail messages were somehow stored on
a Borland system before they were sent out to/through MCI Mail
(although the original post seems to indicate something else), if that
Borland employee's duties are to maintain the mail accounts, then
he/she is still considered to be part of an electronic communications
service provider, because in this case, Borland is also a provider.
Thus, again, according to the ECPA, what the employee apparently did
was legal.  It doesn't have to be in any contract.  Given the
information we on the net have, I don't really think that we are in a
position to determine (or decide for ourselves) whether what the
person did was illegal or outside his/her "rights".


-- 
Joseph A. Watters, Jr.		jaw@owlnet.rice.edu
Deputy Director, Owlnet
Rice University
Houston, Texas
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: exuptr@exu.ericsson.se (exuptr@exu.ericsson.se)
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
Subject: Re: MCI E-mail Snooping
Keywords: Corporate Computing, September 1992
Date: 10 Sep 92 22:21:43 GMT
Organization: Ericsson Network Systems, Inc.

In article <1992Sep10.170535.1335@ms.uky.edu> morgan@ms.uky.edu (Wes Morgan) writes:
>From: morgan@ms.uky.edu (Wes Morgan)
>Subject: Re: MCI E-mail Snooping
>Keywords: Corporate Computing, September 1992
>Date: Thu, 10 Sep 1992 21:05:35 GMT

>jpglori@srv.PacBell.COM (John P. Gloria) writes:
>>
>>Apparently when Wang resigned, his MCI Mail account was closed.  According
>>to the paper, MCI Mail saves messages for five days and then deleted. All
>>these came to light when a staff worker was closing the account and "looked"
>>into Wang's account and was suprised on the contents of the messages.  This
>>started court orders to search offices/residences on both parties. 
>>
>>Question:  did the staff worker have the RIGHT to read Wang's email?

Who paid for it?  Was it really a "personal" account, or was it a business 
account.

>I wouldn't think so, but I'd have to read an MCI Mail contract to be sure.
>(I don't use any commercial email services, so I'm on foreign soil.....)

 ----------------------------------------------------------------------------
    "This must be Thursday.  I never could get the hang of Thursdays"
                                                       - Douglas Adams
  - Patrick Taylor                                       (Arthur Dent)
    Ericsson Network Systems
    exuptr@exu.ericsson.se                       "Don't let the .se fool you"
    or exuptr@ZGNews.Lonestar.Org, exu.exuptr@memo.ericsson.se
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: morgan@ms.uky.edu (Wes Morgan)
Subject: Re: MCI E-mail Snooping
Keywords: Corporate Computing, September 1992
    <1992Sep9.231718.1863@PacBell.COM>
Organization: The Puzzle Palace, UKentucky
Date: Thu, 10 Sep 1992 21:05:35 GMT

jpglori@srv.PacBell.COM (John P. Gloria) writes:
>
>Apparently when Wang resigned, his MCI Mail account was closed.  According
>to the paper, MCI Mail saves messages for five days and then deleted. All
>these came to light when a staff worker was closing the account and "looked"
>into Wang's account and was suprised on the contents of the messages.  This
>started court orders to search offices/residences on both parties. 
>
>Question:  did the staff worker have the RIGHT to read Wang's email?

I wouldn't think so, but I'd have to read an MCI Mail contract to be sure.
(I don't use any commercial email services, so I'm on foreign soil.....)

>When I close accounts, I tar everything to tape and then remove everything.
>I don't have time to read user's files or email that is still in queue.

I follow the same pattern......I don't have time to snoop either.

--Wes

-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu
Newsgroups: comp.admin.policy
From: jfd@octel.com (John F. Detke)
Subject: E-mail, use in criminal cases
Organization: Octel Communications Corporation
X-Newsreader: Tin 1.1 PL5
Date: Tue, 15 Sep 1992 18:03:41 GMT

Hi,
I've been following the Bourland v. Symatec case as much as the Santa Cruz
paper & the net will let me, and find it fascinating. Aside from the 
questions of "Email snooping" and "how much of your past experience can
you take with you", I haven't seen discussed the question of "can Email
be submitted as evidence?". And if the answer is yes, how do you verify
the sender, recipient, date and other trivial "facts"? I know all to well how 
easily email can be forged, how can it be proved that Mr Wang actually 
sent/recieved those messages? 

I seem to recall that this came up in Irangate, but that was email/messages
pulled from backup tape, not from some admin type snooping someone`s account.
If I can/do snoop an account, can't I also creativly alter/create/delete mail?

With the new fax-modem's on networks, we have a similar problem. I recently
bought a house, and went thru all the preliminaries via fax. Couldn't that
data be scanned & massaged, to change me offer or counter-offer? Would that
be leagally binding? Are computers really new tools for creating new work
for laywers?

What interesting times we live in.
jfd

-- 
John F. Detke, jfd@octel.com	| "The only thing Columbus discovered was that
Octel Communications Corp	|  he was lost" 
890 Tasman Dr. M/S 5-4		|		-- An Osage
Milpitas CA 95035		|
Newsgroups: comp.admin.policy
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Subject: Re: Screen lock (was Re: [comp.admin.policy]  Re: New Prince
Organization: Fachschaft Informatik, Uni Karlsruhe
Date: Mon, 14 Sep 1992 09:45:16 GMT
X-News-Reader: VMS NEWS 1.23

In <1992Sep12.024831.8616@news.iastate.edu> john@iastate.edu writes:

>  We considered a similar hack to xlock -- but decided that it would take
>  about a day for some student to ftp and compile a virgin copy and about
>  another day for it to find its way to all the usual xlock abusers.

But maybe it is possible to hack the program that controls user login,
e.g. xdm to count idle time and log the user out after N minutes of no
action. The trick is that the user cannot replace this program as it is
run by root.

>  For now, we just tell people to feel free to reboot if the workstation
>  has been xlocked 15 minutes.

Sub-sub-optimal either, IMHO...


MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
OS/360 devotes 26 bytes of the permanently resident date-turnover routine
 to the proper handling of Dec.31 on leap years. That might have been
 left to the operator. - Fred Brooks (1975)
Xref: sparky comp.admin.policy:1002 comp.security.misc:1229 comp.unix.programmer:4614
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Newsgroups: comp.admin.policy,comp.security.misc,comp.unix.programmer
Subject: Locking terminals (was Re: New Princeton Policy)
Summary: Enabling terminal locking with timeout - proposal
Date: 10 Sep 92 16:18:35 GMT
Followup-To: comp.security.misc
Organization: Fachschaft Informatik, Uni Karlsruhe
X-News-Reader: VMS NEWS 1.23

[A crossposting from comp.admin.policy - note the Followup]

I have criticized a statement in Princeton's user policy that
prohibits locking of terminals to enable other users to get access to
that machine.

In <BuBxzz.A21@rice.edu> jaw@owlnet.rice.edu writes:

>  In article <CKD.92Sep9143724@loiosh.eff.org>, ckd@eff.org (Christopher Davis) writes:
>  |>  Olaf> This means: 'If you must go to the restroom you HAVE to leave the
>  |>  Olaf> terminal open, so that other users can terminate your session if
>  |>  Olaf> they need the machine.' This is IMO simply unacceptable. Other
>  |>  Olaf> policies would REQUIRE to lock the terminal to prevent tampering
>  |>  Olaf> with your account.
>  |> 
>  |> MIT's Athena workstation policy is that you can lock it for no more than
>  |> 20 minutes before someone can feel free to reboot it or otherwise
>  |> "forcibly unlock" it.  The "standard" screenlocker has a displayed timer

Rebooting is not the way of choice, I think...

>  |> of "how long I've been locked".
>  |> 
>...  
>  At Rice, we have an X windows lockscreen program with a twenty minute
>  timer.  After twenty minutes, the lockscreen itself logs the user out.
>  The logout is pretty clean.  The only thing we haven't solved yet is
>  how to get the user's .logout file to be read on logout by the
>  lockscreen program.

What about the following?

A locking program that 
- displays the time it is running,
- after N minutes provides a button which will log the user out (with
N preferrably to be specified in a configuration file),
- perhaps communicates with other workstations in the cluster, to
enable the logout only when no other workstation is idle.

I leave the gory details of the implementation to the people who know
X (that excludes me, unfortunately ;-)

(Just an idea: At Karlsruhe we have a login process running under X
(whats the name? xdm? I'm not sure) that executes an ~/.xsession
script and logs the user out cleanly after the end of this script
(which may end in 'exec twm'); could it be implemented that the pid of
this process gets stored in a file and it simply killed for logout?
That should clean up everything.)
MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
Der gr"une Punkt ist halt genauso sinnvoll wie ne T"UV-Plakette
 auf nem Schrotthaufen. - Thomas Volkmar Worm
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: morgan@ms.uky.edu (Wes Morgan)
Subject: Re: MCI E-mail Snooping
Keywords: Corporate Computing, September 1992
    <1992Sep11.184731.10583@PacBell.COM> <BuFKv7.FBJ@rice.edu>
Organization: The Puzzle Palace, UKentucky
Date: Sat, 12 Sep 1992 16:55:58 GMT

In article <BuFKv7.FBJ@rice.edu> jaw@owlnet.rice.edu (Joseph A. Watters) writes:
>
>The MCI worker is part of the service provider and is explicitly exempt
>from the prohibitions on reading another person's stored electronic
>communications.  

I was under the impression that these prohibitions were only subject
to exemption *in the performance of one's official duties*.  The most
common example of this "performance-based" exemption is the well-known
fact that the phone company may 'listen' to a conversation if they are
checking line quality.  Another example, also based in the telephone
industry, is the fact that a PhoneCo Customer Service person may listen
in on your conversation with an operator (to evaluate the quality of
service rendered by said operator).

If there is some account removal procedure that requires the examination
of electronic mail for a *personal* account, I'd like to hear more about 
it!

If Borland was paying for the MCI Mail account, I could understand a
review of the electronic mail BY BORLAND; that would be a matter of
corporate policy for Borland.

I cannot envision a situation in which the "common carrier", MCI, would
have the need or the contractual right to read its customers' email.

--Wes

-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu
Newsgroups: comp.admin.policy
From: ckd@eff.org (Christopher Davis)
Subject: Re: New Princeton Policy
Organization: Electronic Frontier Foundation Tech Central
Date: Wed, 9 Sep 1992 18:37:26 GMT

Olaf> == Olaf Titz <S_TITZ@iravcl.ira.uka.de> 

 Princeton> 8.  You must not prevent others from using shared resources
 Princeton> by running unattended processes or placing signs on devices
 Princeton> to "reserve" them without authorization. Your absence from a
 Princeton> public computer or workstation should be no longer than
 Princeton> warranted by a visit to the nearest restroom. A device
 Princeton> unattended for more than ten minutes may be assumed to be
 Princeton> available for use, and any process running on that device
 Princeton> terminated. You must not lock a workstation or computer
 Princeton> which is in a public facility.

 Olaf> This means: 'If you must go to the restroom you HAVE to leave the
 Olaf> terminal open, so that other users can terminate your session if
 Olaf> they need the machine.' This is IMO simply unacceptable. Other
 Olaf> policies would REQUIRE to lock the terminal to prevent tampering
 Olaf> with your account.

MIT's Athena workstation policy is that you can lock it for no more than
20 minutes before someone can feel free to reboot it or otherwise
"forcibly unlock" it.  The "standard" screenlocker has a displayed timer
of "how long I've been locked".

Perhaps Princeton could provide a similar one with a button (cleaner
than a reboot, especially since MIT Athena workstation can't have rlogin
users ;-) that would only appear after N minutes, saying "break lock and
kill X server".  This would protect accounts while keeping workstation
resources available.
--
Christopher Davis   | ]CALL -151       
<ckd@eff.org>       | *300: 20 DD FB 60
System Administrator| *3D0G            
EFF +1 617 864 0665 | ]CALL 768        
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk
From: mjo@ef2007.efhd.ford.com (Mike O'Connor)
Subject: Re: Article on E-mail Privacy/Snooping
X-Disclaimer: Not an official spokesperson for Ford OPEO
Reply-To: Mike O'Connor <mjo@fmsrl7.srl.ford.com>
Organization: International Affairs, Overseas Engineering, "Fordz"
Date: Sat, 12 Sep 1992 05:43:46 GMT

In article <1992Sep11.234228.25430@qiclab.scn.rain.com>
70465.203@compuserve.com writes:

:In fact as I had occasion to tell users who were worried about the fact that
:I could read any file on the LAN "There are something like 4 gigabytes of
:files out there. *Thousands* of them. Even if I *wanted* to snoop, there's
:too much to go thru!"

This isn't necessarily true, particularly if you want to "target" a
few individuals with well-organized directories.  

						...Mike

-- 
 Michael J. O'Connor           |  Internet:  mjo@fmsrl7.srl.ford.com
 Ford Motor Company, OPEO      |  UUCP:      ...!{backbone}!fmsrl7!mjo
 20000 Rotunda, Bldg. 1-3001   |  Phone:     +1 (313) 248-1260
 Dearborn, MI  48121           |  Fax:       +1 (313) 323-6277
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: jpglori@srv.PacBell.COM (John P. Gloria)
Subject: Re: Article on E-mail Privacy/Snooping
Keywords: Corporate Computing, September 1992
Organization: Pacific * Bell
Date: Wed, 9 Sep 1992 23:17:18 GMT

In article <1992Sep9.121142.4840@ms.uky.edu> morgan@ms.uky.edu (Wes Morgan) writes:
>There is an interesting article in the September 1992 issue of "Corporate
>Computing".  Entitled "E-mail Snooping", it's an overview of the current
>controversy in email privacy.  It included discussion of the Epson case,
>comments from Eastman Kodak and several other firms, and an editorial by
>William F Buckley.  It's an interesting piece of reading material.
>
>I called Corporate Computing, and they refused my request to post the
>article or excerpts thereof.  (I realize that they have a healthy business 
>in selling reprints, but this seems a bit extreme.)
>
>I noticed something else interesting.  The article includes an interview
>with a director of the Electronic Mail Association.  After digging through
>several name servers (and nic.ddn.mil), I discovered that the EMA doesn't
>even have a registered domain!  Ya just gotta love it.......
>
>--Wes
>-- 
>MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
>morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
>morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
>  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu

The Wednesday, Sept. 9, 1992 issue of the San Francisco Examiner has an
interesting article of how the "Email's trail of evidence in software case"
has brought civil suits against Gordon Eubanks, president of Symantec Corp., 
and Eugene Wang, a former executive of Borland International.  At this point in 
time, everything is "alleged" to have happened.  In a nutshell the DA office
has what they consider evidence in which both parties communicated using
MCI Mail. The contexts of the message have been determined to be marketing
plans and other confidential information from Borland that have aided
Symantec in the battle for software market share.

Apparently when Wang resigned, his MCI Mail account was closed.  According
to the paper, MCI Mail saves messages for five days and then deleted. All
these came to light when a staff worker was closing the account and "looked"
into Wang's account and was suprised on the contents of the messages.  This
started court orders to search offices/residences on both parties. 

Question:  did the staff worker have the RIGHT to read Wang's email?
When I close accounts, I tar everything to tape and then remove everything.
I don't have time to read user's files or email that is still in queue.

-- 
        ---------  John Gloria - jpglori@pacbell.com	--------	
 		"You cannot depend on your eyes when your imagination
	       is out of focus."   -     Mark Twain
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: jpglori@srv.PacBell.COM (John P. Gloria)
Subject: Re: MCI E-mail Snooping
Keywords: Corporate Computing, September 1992
Organization: Pacific * Bell
Date: Fri, 11 Sep 1992 18:47:31 GMT

In article <1992Sep11.162036.3932@dcatlas.dot.gov> joet@dcatlas.dot.gov (Joe Trott) writes:
>morgan@ms.uky.edu (Wes Morgan) writes:
>
>>>Question:  did the staff worker have the RIGHT to read Wang's email?
>
>>>I don't have time to read user's files or email that is still in queue.
>
>>I follow the same pattern......I don't have time to snoop either.
>
>It isn't a question of whether you have the _time_; the question is, do you
>have the _right_?
>
>Unless it's in the contract, how can the answer be anything but "NO!"?
>Why would it be in the contract?  Who would sign such a contract?
>
>-JTT
>

The ramifications on this particular case will certainly test an
individual's right to e-mail privacy vs the company's right to
access employee's accounts.  The paper did not elaborate on exactly
why the staff worker read the e-mail.  It appeared the worker, IMHO,
was snooping around without just cause. Of course, a company policy
could exist that gives them the right to peruse an account.  Afterall,
Wang held a high office, and there could be some messages that needed to 
be re-directed to his successor.  
-- 
  ---------  John Gloria - jpglori@sysengr.pacbell.com	--------	
  "I have great faith in fools - self-confidence my
   friends call it."        Edgar Allan Poe
Newsgroups: comp.admin.policy,alt.comp.acad-freedom.talk,misc.legal.computing
From: morgan@ms.uky.edu (Wes Morgan)
Subject: Article on E-mail Privacy/Snooping
Keywords: Corporate Computing, September 1992
Date: Wed, 9 Sep 1992 16:11:42 GMT
Organization: University Of Kentucky, Dept. of Math Sciences

There is an interesting article in the September 1992 issue of "Corporate
Computing".  Entitled "E-mail Snooping", it's an overview of the current
controversy in email privacy.  It included discussion of the Epson case,
comments from Eastman Kodak and several other firms, and an editorial by
William F Buckley.  It's an interesting piece of reading material.

I called Corporate Computing, and they refused my request to post the
article or excerpts thereof.  (I realize that they have a healthy business 
in selling reprints, but this seems a bit extreme.)

I noticed something else interesting.  The article includes an interview
with a director of the Electronic Mail Association.  After digging through
several name servers (and nic.ddn.mil), I discovered that the EMA doesn't
even have a registered domain!  Ya just gotta love it.......

--Wes
-- 
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan 
morgan@ms.uky.edu   | Engineering  Computing |   morgan@wuarchive.wustl.edu
morgan@engr.uky.edu | University of Kentucky | JWMorgan@dockmaster.ncsc.mil
  Mailing list for AT&T StarServer S/E  - starserver-request@engr.uky.edu
Newsgroups: comp.admin.policy
From: berger@atropa (Mike Berger)
Subject: Re: Should Alums have access to school accounts?
Organization: University of Illinois at Urbana
Date: Wed, 9 Sep 1992 17:05:13 GMT

pollock@milton.u.washington.edu (Joe Pollock) writes:
>As we prepare to get on the internet, we are considering also considering
>the issue of alum access.  The alumni association wishes to keep in contact
>with as many individuals as possible, and is attempting to find out how many
>of our alumni have some form of e-mail access, and how many would use it for
>contacts.
>I'm a bit envious of those of you who say "Give the Alumni Association
>a spare workstation."  At this time, we have one workstation for our
>Internet connection, and several AT&T 3B2's for DOS networking and UNIX
>classroom support.  Quite frankly, the UNIX environment has not been
>particularly popular here, in a liberal arts environment,  and it's
>difficult to generate support for resources used by a very small fraction
>of the community.  
*----
This is an issue of policy, not resources.  If you believe the POLICY
should be to give accounts to alumni, that's the important thing.  Let
the Alumni Association BUY their own machine (or get an alum who works
for a computer company to donate one).
--
	Mike Berger
	Department of Statistics, University of Illinois
	AT&TNET     217-244-6067
	Internet    berger@atropa.stat.uiuc.edu
Newsgroups: comp.admin.policy