CD-ROM Aktief 1995 #3/CDA3.iso/survival/ecpafido.txt

Text File | 1994-07-27 | 22KB | 462 lines

--- Following message extracted from SYSOP18 @ 1:374/14 ---
    By Christopher Baker on Thu Jul 21 01:23:11 1994
From: Michael Hess
To: Floyd Drennon
Date: 19 Jul 94  20:03:00
Subj: Final word on BBS's and the ECPA 1/2

Floyd Drennon requested a closed session to tell Michael Hess:

 FD> Hi Michael,

 FD> 15 Jul 94, 18:00, Michael Hess wrote to Paul Nebeling:

 MH>> attorney in your specific area for a legal opinion. I did. That's how
 MH>> I got my opinion. From several attorneys.

 FD> And for everyone you find to support your position, someone else can find
 FD> another who will say exactly the opposite.  Bottom line - there hasn't
 FD> been a definitive case concerning a hobbiest board so any advice you
 FD> receive at this point will be the unfounded opinion of the person
 FD> providing it.

Here is my .02 cents worth that cost me about $20.00 today to compile. I'm sure
after reading it you and others may have a different outlook when trying to
deny that the ECPA of 1986 has no application:

         AMATEUR BBS NETWORK APPLICATION OF THE ELECTRONIC
         COMMUNICATIONS PRIVACY ACT OF 1986: BOON OR BANE?
         =================================================

By Michael Hess, copyright 1994

9:05 a.m. July 19th, 1994

FEDERAL INFORMATION CENTER......................[phone]

Notes: Has no information or referral about ECPA 1986.
===
9:12 a.m.

FEDERAL COMMUNICATIONS COMMISSION...............[phone]
(PUBLIC AFFAIRS) 1919 M St. NWst Washington DC 20554

Notes: Has no idea what the ECPA 1986 is. So I looked in my trusty
database and called the:
===
9:20 a.m.

NATIONAL CRIMINAL JUSTICE REFERENCE SERVICE
BOX 6000  ROCKVILLE, MD.........................[phone]

Notes: Central clearinghouse for information on law enforcement and
criminal  justice.  Publishes bulletins and reports, provides
computer searches.

One relevant reference: End Run Around the Fourth Amendment; Why Roving
Surveillance Order is Un-Constitutional. 1990, Vol. 28 1990 American
Criminal Justice pp. 143-160.

Database only reaches up to 1990, no reference to Jackson Games v.
Secret Service 1990 as of yet. Referred me to the:
===
9:35 a.m.

FLORIDA DEPARTMENT of LAW ENFORCEMENT, COMPUTER CRIME DIVISION

contact: Jeff Herig.............................[phone]

Notes: Jeff could only offer a personal opinion. He wonders why in the
world folks in an amateur network would think their policy would negate
federal law?

His opinion is if a reasonable expectation of privacy exists then a
communication would be covered by the ECPA. This would include private
sysop comment areas, sysop mail areas, any communication that is not
readily accessible to the public.

As an aside, many of the training sessions that Jeff attends make
repeated reference to the Steve Jackson Games case. The training
sessions make it clear that electronic mail IS protected by the
Electronic Communications Privacy Act of 1986 and that investigators are
to keep the ECPA and particulars of the Steve Jackson Games case firmly
in mind when investigating a BBS. Then referred me to the:
===
11:03 a.m.

UNITED STATES DEPARTMENT of JUSTICE, COMPUTER CRIMES DIVISION

Dan Schneider...................................[phone]

Notes: Dan could not give specific advice either. However, he made it
clear that a company, group, or amateur policy can NOT supercede or
negate federal law. He took notes and is checking with his superior and
will get back to me.
===
11:25 a.m.

While I'm waiting let's see what we have learned so far and how we can
apply it.

The test keeps coming back to expectation of privacy and the
Fourth Amendment. For instance, our local Net 375 1.10 policy states:

     "...fraternization.  This conference (SYSOP375) is to be
     kept private; only the sysop and co-sysop may have read
     or read/write access to it.  There are many other local..."

It would seem that there may be a reasonable expectation of privacy at
the local level. Does the policy above this (Region 18 1.06 policy)
negate this at a regional level? This policy states:

     8.   Local Net Policies

    "It is the responsibility of each net to determine the method
     of selecting coordinators for that net.  Nets are encouraged
     to formulate local policies describing the method and (if
     appropriate) the timing of this process, as well as any
     other local procedural issues deemed appropriate by the net
     membership.  No local net policy may conflict with existing
     policies at the region, zone or interzone level..."

It appears that at least in one section of the regional policy that
a local net policy defers to the zone or interzone level, no other
search appears necessary. The relevent section in International
FidoNet 4.07 policy is as follows:

     2.1.6  Private Netmail

     "...The word "private" should be used with great care, especially
     with users of a BBS.  Some countries have laws which deal with
     "private mail", and it should be made clear that the word
     "private" does not imply that no person other than the recipient
     can read messages.  Sysops who cannot provide this distinction
     should consider not offering users the option of "private mail..."

Todays BBS software has many improved features, especially in security
and mail handling ability. Many sysops participate in sysop only message
conferences. The exclusion of the general user public is accomplished by
security levels or other means through the software package. Many systems
also use email software as a "front end" that may handle the reading
of a sysop only area [or use a third piece of software, a "sysop editor"]
or other private conferences without ever passing these to the BBS
software that offers public areas.

     ..."If a user sends a "private message", the user has no control
     over the number of intermediate systems through which that
     message is routed.  A sysop who sends a message to another
     sysop can control this aspect by sending the message direct
     to the recipient's system, thus guaranteeing that only the
     recipient or another individual to whom that sysop has given
     authorization can read the message.  Thus, a sysop may have
     different expectations than a casual user..."

International FidoNet policy further points out however that a "sysop
may have different expectations than a casual user." It would seem on
the face of it that a sysop in Net 375 would have a reasonable
expectation of privacy based on three written organizational policies
and indeed the Fourth Amendment and the ECPA.

Would the level of reasonable expectation of privacy diminish when
applied to a closed or restricted message conference on a regional or
North American scale? It does not seem so based on the volume of email
in administrative conferences when the question of opening them to the
general public arises. Thus it can be deduced that for a sysop, whether
at a local, regional or North American level at the least, the technology
does indeed exist and is in general use to exclude the general user public
from access to certain message conferences.

     2.1.6.1  No Disclosure of in-transit mail

     "...Disclosing or in any way using information contained in private
     netmail traffic not addressed to you or written by you is
     considered annoying behavior, unless the traffic has been released
     by the author or the recipient as a part of a formal policy
     complaint.  This does not apply to echomail which is by definition
     a broadcast medium, and where private mail is often used to keep
     a sysop-only area restricted..."

International FidoNet policy makes three important distinctions in the
above. Disclosing private netmail when you are not the intended
recipient or the recipients authorized agent is prohibited and well
within [at least] US law. Secondly, "echomail" is excluded from the
"no disclosure" clause with a dubious caveat that "private mail" in a
sysop only messa