From: smee@bristol.ac.uk (Paul Smee)
Newsgroups: news.admin
Subject: Re: What a sendsys bomb actually is...
Date: 13 Apr 92 09:36:20 GMT
Reply-To: P.Smee@bristol.ac.uk (Paul Smee)
Organization: University of Bristol

In article <1992Apr10.202347.10050@cis.uab.edu> sloan@cis.uab.edu (Kenneth Sloan) writes:
>In article <1992Apr10.094952.23398@bristol.ac.uk> P.Smee@bristol.ac.uk (Paul Smee) writes:
>>...
>>  At many
>>sites, for example, it is trivial to create mail with forged sender
>>id's.  [If you DO any of these things, it is very likely that you are
>>violating the law, at least in the US and the UK, and almost certain
>>that you are violating the terms and conditions of use which you agreed
>>to when you got your computer account or your net connection.]
>
>Let's be careful here.  There are enough truly criminal acts that we
>don't need to be sloppy and brand *every* instance of, say, creating
>mail with a bogus return address as "criminal".  For one thing, I
>believe that this is false; for another, I think that it *ought* to be
>false. 

It's not necessarily criminal.  That's for the 'trial process' (or
whatever its analog is in the particular context, e.g. student
discipline committee) to decide, and one would hope that they'd take
all factors into account.  It is certainly 'prosecutable' -- though
again, the 'detecting' person or body might decide in some contexts not
to try that; if they do, it's then up to the 'judicial process' to
determine whether the prosecution is valid.  Notice that we are not
simply talking about munged 'return' ('reply-to') addresses; we are
talking about forgery of all of 'from', 'sender', and 'path'-type
headers so as to completely disguise the origin of a piece of mail.

Just grabbed a copy of our regulations.  Relevant ones are:

  1.  Users are permitted to use computer facilities only for purposes
  approved by their Head of Department.  The use of systems, packages,
  and utilities for non-authorised purposes ... is forbidden.

  2.  The use of a personal identifier or pass word allocated to another
  user is strictly prohibited, as is the communication of such information
  to a third party.

  4.  Any attempt to penetrate the security and privacy of data or
  programs supplied by another user, or any action which interferes with
  the proper operation of any computer facility, is forbidden.

I don't like laws which embody an 'intent' clause, as that makes it
difficult to decide whether you can do something or not.  I prefer to
leave that decision to the 'trial' level.  We recently had a case of
forgery in which someone sent forged Valentines to the secretaries in
(I think) the Engineering Department.  It was good humored, the secs
enjoyed it, and while it was considered a violation of our rules, the
'punishment' was a gentle reminder of the rules.  Forgery for sendsys
bombing would be a hanging offense, I suspect.  There's a continuum,
but I don't believe it can be formalised into the rules.

I'm not sure of the state of play in the US at this point, but in the
UK we are also subject to a 'Computer Misuse' law which in theory, at
least, would make it an offense even to dial a wrong number with your
modem.  (It is badly miswritten, and we tried unsuccessfully to explain
to Parliament WHY it is miswritten, but we got it.  We 'believe' they
would be reasonable about honest wrong numbers, but...)  

More importantly, we are subject to the 'Data Protection Act', which
basically is intended to protect personal data from misuse.  One of its
features is that it makes the site responsible for how data is used.
If one of our users violates the DPA, *we* can get nailed.  So, it is
somewhat important to us that when people do things, they do them under
their own names, so that we can retain accountability.  Our rules
reflect this.

Far as 'Draconian' goes, it is unfortunate, but we do have a minority
of users who have made it necessary to restrict services greatly.  It
pisses me off.  Best example:  We have a large number of PCs available
in public areas for general use -- mostly student use, as staff tend to
have office machines.  Between virusing (including a couple of users
intentionally spreading viruses) and 'cracking', we were finding it
increasingly difficult to keep them running.  Now, all of our public
PCs run a modified BIOS which will not permit users to run ANYTHING
except a few officially installed packages from the hard disk, will not
allow users to write to drive C:, and will not permit booting from, or
running things from, floppy.

This drastically restricts usability of the machines.  No compilers or
interpreters (because we can't allow user-written programs to run), and
some interesting packages can't be put up because they can't be secured
in this environment.  It means we've got a very poor service as
compared with what we SHOULD be offering, in an ideal world; but, a
much better one than we were able to give in a hostile environment.  It
pisses us off, because the time we spent doing this COULD have been
used doing things which made life better for the users.  It drastically
restricts 'good guy' users, who if they need a full PC have to use one
of the limited-hours supervised PC rooms, rather than the 24-hour
ones.  But, with our current manning levels, our choice was between
restricting the PCs, and taking them out altogether.  (Indeed in one of
the worst rooms, in a dorm, we did have to replace the PCs with dumb
terminals for about 3 months.)

For similar reasons, we took network mail away from undergrads for
several years, and it's only recently (thanks to a few nice guys, like
me for one) that the center has been persuaded to give it back to
them.

I'm getting a bit off the track, so. to get back...  The main point is
that provision of a GOOD service for users requires that users and staff
be honest with each other, respect each others' rights (even if we don't
like them), and cooperate with each other.  Forgery is lying.  This goes
against 'honesty'.  Now, certainly, there are times when a little white
lie helps grease the wheels and make things run better, but I will stick
by the feeling that forgery is prima facie grounds for suspecting misuse,
and that anyone who feels that a forgery is justified in some particular
case had better be able to defend this belief, and had better have some
damn convincing reasons.  (Forging a sendsys 'cancel' would convince me,
for example.)

(And, yes, forgery is almost certainly an offense against the Misuse of
Computers legislation over here, so suspects should thank us whenever
WE decide to nail them, and to preempt the process of law by saying
afterwards that we don't believe there are grounds for legal action.)

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132
Newsgroups: news.admin,news.groups,alt.config,comp.org.eff.talk,alt.religion.kibology