Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/LEGAL/CIVLIB.TXT

Text File | 1994-07-17 | 25KB | 486 lines

Civil Liberties in Cyberspace:
When does hacking turn from an exercise
of civil liberties into crime?

by Mitchell Kapor

published in Scientific American,
September, 1991.


On March 1, 1990, the U.S. Secret Service raided the offices of Steve
Jackson, an entrepreneurial publisher in Austin, Tex. Carrying a
search warrant, the authorities confiscated computer hardware and
software, the drafts of his about-to-be-released book and many business
records of his company, Steve Jackson Games. They also seized the
electronic bulletin-board system used by the publisher to communicate
with customers and writers, thereby seizing all the private electronic
mail on the system.


The Secret Service held some of the equipment and material for months,
refusing to discuss their reasons for the raid. The publisher was forced
to reconstruct his book from old manuscripts, to delay filling orders
for it and to lay off half his staff. When the warrant application was
finally unsealed months later, it confirmed that the publisher was
never suspected of any crime.


Steve Jackson's legal difficulties are symptomatic of a widespread
problem.  During the past several years, dozens of individuals have been
the subject of similar searches and seizures. In any other context, this
warrant might never have been issued. By many interpretations, it
disregarded the First and Fourth Amendments to the U. S. Constitution,
as well as several existing privacy laws. But the government proceeded
as if civil liberties did not apply. In this case, the government was
investigating a new kind of crime -- computer crime.


The circumstances vary, but a disproportionate number of cases share a
common thread: the serious misunderstanding of computer-based communi-
cation and its implications for civil liberties. We now face the task
of adapting our legal institutions and societal expectations to the
cultural phenomena that even now are springing up from communications
technology.


Our society has made a commitment to openness and to free
communication. But if our legal and social institutions fail to adapt
to new technology, basic access to the global electronic media could be
seen as a privilege, granted to those who play by the strictest rules,
rather than as a right held by anyone who needs to communicate. To
assure that these freedoms are not compromised, a group of computer
experts, including myself, founded the Electronic Frontier Foundation
(EFF) in 1990.


In many respects, it was odd that Steve Jackson Games got caught up in a
computer crime investigation at all. The company publishes a popular,
award-winning series of fantasy roleplaying games, produced in the
form of elaborate rule books. The raid took place only because law
enforcement officials misunderstood the technologies -- computer
bulletin-board systems (BBSs) and on-line forums -- and misread the
cultural phenomena that those technologies engender.


Like a growing number of businesses, Steve Jackson Games operated an
electronic bulletin board to facilitate contact between players of its
games and their authors. Users of this bulletin-board system dialed in
via modem from their personal computers to swap strategy tips, learn
about game upgrades, exchange electronic mail and discuss games and
other topics.


Law enforcement officers apparently became suspicious when a Steve
Jackson Games employee -- on his own time and on a BBS he ran from his
house -- made an innocuous comment about a public domain protocol for
transferring computer files called Kermit. In addition, officials
claimed that at one time the employee had had on an electronic
bulletin board a copy of Phrack, a widely disseminated electronic publi-
cation, that included information they believed to have been stolen from
a BellSouth computer.


The law enforcement officials interpreted these facts as unusual
enough to justify not only a search and seizure at the employee's
residence but also the search of Steve Jackson Games and the seizure of
enough equipment to disrupt the business seriously. Among the items
confiscated were all the hard copies and electronically stored copies of
the manuscript of a rule book for a role-playing game called GURPS
Cyberpunk, in which inhabitants of so-called cyberspace invade
corporate and government computer systems and steal sensitive data.
Law enforcement agents regarded the book, in the words of one, as "a
handbook for computer crime."


A basic knowledge of the kinds of computer intrusion that are
technically possible would have enabled the agents to see that GURPS
Cyberpunk was nothing more than a science fiction creation and that
Kermit was simply a legal, frequently used computer program.
Unfortunately, the agents assigned to investigate computer crime did not
know what -- if anything -- was evidence of criminal activity.
Therefore, they intruded on a small business without a reasonable
basis for believing that a crime had been committed and conducted a
search and seizure without looking for "particular" evidence, in vi-
olation of the Fourth Amendment of the Constitution.


Searches and seizures of such computer systems affect the rights of
not only their owners and operators but also the users of those systems.
Although most BBS users have never been in the same room with the
actual computer that carries their postings, they legitimately expect
their electronic mail to be private and their lawful associations to
be protected.


The community of bulletin-board users and computer networkers may be
small, but precedents must be understood in a greater context. As
forums for debate and information exchange, computer-based bulletin
boards and conferencing systems support some of the most vigorous
exercise of the First Amendment freedoms of expression and association
that this country has ever seen. Moreover, they are evolving rapidly
into large-scale public information and communications utilities.


These utilities will probably converge into a digital national public
network that will connect nearly all homes and businesses in the U.S.
This network will serve as a main conduit for commerce, learning,
education and entertainment in our society, distributing images and
video signals as well as text and voice.  Much of the content of this
network will be private messages serving as "virtual" town halls,
village greens and coffeehouses, where people post their ideas in public
or semipublic forums.


Yet there is a common perception that a defense of electronic civil
liberties is somehow opposed to legitimate concerns about the
prevention of computer crime. The conflict arises, in part, because
the popular hysteria about the technically sophisticated youths known as
hackers has drowned out reasonable discussion.


Perhaps inspired by the popular movie _WarGames_, the general public
began in the 1980s to perceive computer hackers as threats to the
safety of this country's vital computer systems. But the image of
hackers as malevolent is purchased at the price of ignoring the
underlying reality -- the typical teenage hacker is simply tempted by
the prospect of exploring forbidden territory. Some are among our best
and brightest technological talents: hackers of the 1960s and 1970s,
for example, were so driven by their desire to master, understand and
produce new hardware and software that they went on to start companies
called Apple, Microsoft and Lotus.


How do we resolve this conflict? One solution is ensure that our scheme
of civil and criminal laws provides sanctions in proportion to the
offenses. A system in which an exploratory hacker receives more time in
jail than a defendant convicted of assault violates our sense of
justice. Our legal tradition historically has shown itself capable of
making subtle and not-so-subtle distinctions among criminal offenses.


There are, of course, real threats to network and system security. The
qualities that make the ideal network valuableQits popularity, its
uniform commands, its ability to handle financial trans