NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/alt/comp/acadfre/talk/3697

Internet Message Format | 1992-12-16 | 4.3 KB

Xref: sparky alt.comp.acad-freedom.talk:3697 comp.org.eff.talk:7587 comp.security.misc:2180 alt.privacy:2583
Newsgroups: alt.comp.acad-freedom.talk,comp.org.eff.talk,comp.security.misc,alt.privacy
Path: sparky!uunet!gatech!ncar!news.miami.edu!cybernet!pineal.math.fau.edu!spc
From: [e-mail] (Sean 'Captain Napalm' Conner)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Message-ID: <[e-mail]>
Sender: [e-mail]
Organization: Florida Atlantic University, but who cares?
References: <[e-mail]> <[e-mail]> <[e-mail]>
Date: Fri, 11 Dec 1992 22:12:25 GMT
Lines: 74

In article <[e-mail]> [e-mail] (Jyrki Kuoppala) writes:
>
>I wasn't expressing myself clearly, and I apologize for that.  I
>didn't flame about keystroke monitoring per se, and I can think of
>situations where monitoring would be appropriate and an OK thing to
>do.  For example, I think monitoring an intruder using an account is
>OK with permission from the person who is the real account holder.
>
>But what I very seriously dislike and referred to as "fascism"
>(Orwellian, if you like) is this as part of the recommended login
>banner:
>
>"      Anyone using this system expressly consents to such monitoring
>       and is advised that if such monitoring reveals possible
>       evidence of criminal activity, system personnel may provide the
>       evidence of such monitoring to law enforcement officials."
>
>Basically, the message is announcing "we have the power to watch
>everything you do and we will use that power whenever we like and will
>report any wrongdoings to the Big Brother", and CERT is suggesting
>that everyone put that message as their login banner.  After
>cooperating with the government justice department for the wording, no
>less.
>
  Well, I was forwarded (is that a word? 8-) the CERT advisory, and after
thinking about it, I decided on the following wording:

  This system is for the use of authorized users only (and as of now, there
are ONLY 10 (ten) authorized users on this system).  Individuals using this
computer system without authority, or in excess of their authority, are
subject to having all of their activities on this system monitored and
recorded by the System Administrator (me 8-)

  In the course if monitoring individuals improperly using this system, the
activities of authorized users may also be monitored to determine the exent
of damage done by said unauthrized individual (ie. See if other accounts
have been compromised, etc ... )

  Anyone using this system expressly consents to such monitoring if it
proves that such monitoring is needed.

        -- Your friendly System Administrator

  I hope I came across with the fact that monitoring will ONLY be done if we
are, in fact, experiencing a [cr|h]acker on the system.  If anyone on this
computer are doing anything illegal, but are doing it in such a way that
they aren't exceeding their authority on THIS machine won't be monitored,
because I have no reason to suspect their activities (and I wouldn't want to
spend the time to see if they are doing anything illegal anyway.  I respect
privacy, and I have better ways to spend my time than being a spook-tool
8-).

>CERT says that it is a simple matter of pointing out a problem with
>the U.S. law.  The law recognizes a fundamental right, the right to
>privacy.  This is not a bug of the law, it's a feature.  I agree that
>it is a reasonable goal and a good tool to be able to legally monitor
>intruders, but the "bug fix" CERT and the U.S. justice department are
>proposing is much worse than the problem itself.
>
  It was my impression that you didn't have to use their wording, just as
long as you indicated that you will 'monitor' the system in case of
unauthorized usage.

>Also, I agree it is a good idea to publish a policy of how far privacy
>extends and how and when it may be violated - but this is not a
>message publishing a policy, this is a message to get "consent" for
>any kind of monitoring from every user of the system.
>
  hmmmmmm ... good point.  But you have to get their consent sometime.  If a
user doesn't like the policy, then they have to accept the fact that they
won't be using this system (unless by Boss tells me otherwise ... 8-)

  -spc (Besides, if I monitor everyone else, who monitors me? 8-)