NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/alt/comp/acadfre/talk/3679

Internet Message Format | 1992-12-11 | 4.2 KB

Xref: sparky alt.comp.acad-freedom.talk:3679 comp.org.eff.talk:7576 comp.security.misc:2169 alt.privacy:2576
Newsgroups: alt.comp.acad-freedom.talk,comp.org.eff.talk,comp.security.misc,alt.privacy
Path: sparky!uunet!zaphod.mps.ohio-state.edu!sdd.hp.com!spool.mu.edu!umn.edu!csus.edu!netcom.com!strnlght
From: [e-mail] (David Sternlight)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Message-ID: <[e-mail]>
Organization: Netcom - Online Communication Services (408 241-9760 guest)
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Fri, 11 Dec 1992 19:39:41 GMT
Lines: 72


Jyrki's latest comments, unlike his earlier ones, are thoughtful and
well reasoned, and reflect the kind of person it would be a pleasure
to know. Let's see more of that Jyrki here, and let the other one
go.

As to the substance, he raises a hard issue to which I don't know the
answer, though I have some views in the matter. That is the issue of
inadvertently learning something about an "innocent" when legitimately
pursuing a suspect, and as a consequence discovering that the
'innocent" isn't. In the present instance it's about monitoring the
keystrokes of, say, a system intruder, and discovering the keystrokes
of someone he's talking to as an inevitable by-product.

As I understand both the law and ethics, if one discovers the
commission of a crime by someone through illegal surveillance
without probable cause, the fruits of that discovery won't be
accepted by U.S. courts. Thus the requirements for probable
cause and legal searches and seizures.

No problem there--things seem pretty clear. The problem arises when
one discovers a crime by someone during perfectly legal operations
against another party.

A few examples: The police stop a car for erratic driving,
and have reason to suspect drugs. They search the car, and find
drugs, which prove, after investigation and testimony to belong
to a passenger. As I understand it, they can legally prosecute
the passenger.

The NSA legally monitors an overseas conversation and discovers
evidence of the commission of a crime by a U.S. citizen located in the
U.S. Assuming they are willing to reveal the source, as I understand
it they can legally pass the evidence to the appropriate law
enforcement agency to bring charges and the monitored conversation
may, NSA willing, be introduced into evidence.

The police get a search warrant because of suspected drugs, and on
entering the premises discover a counterfeiting press and plates,
which turn out to belong to a resident in the household not named in
the search warrant. As i understand it, they may prosecute, using that
evidence.

Ma Bell monitors customer service calls for quality control reasons,
and discovers a crime being planned/discussed/described. As I understand
it they may turn that over to the police, and it may be used for
prosecution.

Finally, we come to the present case. I think that if even some
of the above examples are accurate, there's nothing wrong with
the announcement and the practice, as long as it's made clear that
any keystroke monitoring is being done not on the random user, but
on those who arouse suspicion (such as unregistered remote users,
or attempts to probe password files, restricted system files, etc.
that are egregious enough not to be inadvertent). It's the classic
case of monitoring one end of something properly, and discovering
something about the other end of that something, which one might
not have been able to legally monitor on its own.

Now I agree with Jyrki that such practices can sometimes be
fraudulent attempts to get around the prohibition against
direct monitoring of the "innocent" end of the relationship. Thus
one should insist on a clear demonstration of probable cause for
the monitoring of the "suspect" end before accepting any evidence
about wrong-doing at the "innocent" end. But a blanket prohibition
against using the "fruits" of what's inadvertently discovered at
the "innocent" end seems to me to be inappropriate.

Others may legitimately disagree, and to save time I acknowledge that
I can see reasons why they may hold a contrary position to mine.

David