Date:  5 Oct 92 17:41:28 GMT
From: "J. Porter Clark" <jpc@avdms8.msfc.nasa.gov>
Newsgroups: comp.society.privacy
Subject: Re: Big Brother has this message on file!
Organization: NASA/MSFC
X-Submissions-To: comp-privacy@pica.army.mil
X-Administrivia-To: comp-privacy-request@pica.army.mil
X-Computer-Privacy-Digest: Volume 1, Issue 088, Message 10 of 12

On 28 Sep 1992, I posted a message to comp.security.privacy which
started out like this:

> I just found out last week that the local network management
> organization is archiving all network traffic onto 8 mm tape and has
> been doing so for at least six months.  They plan on keeping this data
> indefinitely.

I went on to vent righteous indignation about the possibility of misuse
or (at the very least) gratuitous exploitation of this data and the
waste of magnetic tape.

I based my claims about the traffic archiving system on information I
obtained during a training course for LAN managers which I attended.
This information was not correct.  I have discussed the operation of
the system with the person who developed and operates it, and I humbly
offer the following corrections.

Our Network Management Center does in fact operate a High-Speed
Ethernet Capture System which is capable of monitoring only one or two
of the 80 or more segments which make up the local network.  The NMC
monitors only specific segments in response to requests to troubleshoot
specific problems.  These problems include broadcast or multicast
storms and LAT dropouts.

The most important correction is that the tapes are NOT kept for an
indefinite period of time.  Instead, they are kept for 1-2 weeks before
being reused.  (This was precisely the recommendation I made in the
earlier post.)  However, tapes containing unusual network events are
kept longer.

I had also recommended that the system strip out the messages and keep
only the headers of network packets.  The NMC claims that it is
necessary to keep the messages to troubleshoot certain types of
problems, including a LAT dropout problem.

There are plans to extend the capabilities of this system, but not
greatly.  The current system can miss packets during high traffic
periods, and the NMC hopes to eventually eliminate this problem.

Network Management Center strongly agreed with my privacy concernes and
pointed out that all Ethernet networks should be treated as unsecure
lines.  PROMISCUOUS reading programs are common on almost any network
host. Only their lack of performance and overrun detection limit their
network wire-tapping capability on a busy segment. They recommend an
attitude of treating Ethernet like an old time party line with a nosy
busy-body who tries to listen to every call.

In my earlier post, I asked if anyone knew of a good reason (legal or
ethical, perhaps) for not having the net police archive all network
traffic for practically forever.  I didn't get any responses better
than something along the lines of "There's probably something illegal
about it."  I would still like to hear from anyone who has any insight
into this problem.
-- 
J. Porter Clark    jpc@avdms8.msfc.nasa.gov or jpc@gaia.msfc.nasa.gov
NASA/MSFC Communications Systems Branch

ICON: A picture or symbol that stands for a word.  Icons are often used
in programs for young children who cannot yet read.
	-- some doctor's waiting-room magazine