NetNews Usenet Archive 1992 #30/NN_1992_30.iso/spool/comp/security/misc/2215

Internet Message Format | 1992-12-14 | 4.7 KB

Path: sparky!uunet!zaphod.mps.ohio-state.edu!saimiri.primate.wisc.edu!ames!agate!stanford.edu!rock!concert!duke!news.duke.edu!ee.egr.duke.edu!jpe
From: [e-mail] (John P. Eisenmenger)
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystr
Message-ID: <[e-mail]>
Date: 14 Dec 92 15:01:01 GMT
References: <[e-mail]> <[e-mail]>
Sender: [e-mail]
Lines: 86
Nntp-Posting-Host: ee.egr.duke.edu

palmer@Trade_Zone.msfc.nasa.gov (Paul (Cliffy) Palmer) writes:


>In article [e-mail], [e-mail] (Jyrki Kuoppala) writes:
>>
>>If you turn the paranoia knob clockwise, what you get is a login
>>banner designed to get consent to any surveillance from each and every
>>user by using "computer security" and "intruders" as smoke & mirrors.
>>
>>//Jyrki

>If while visiting a friend, I used his phone and he listened in on the
>conversation, I would not feel that my rights had been violated.  I
>would think him very rude and would not use his phone again.  Now if he
>were visiting me and listened in on my phone conversation, the
>situation would be different.

I think you're wrong here.  Just because your friend owns the physical medium
does not give him the right to monitor your phone calls.  Your phone call is
your intellectual property and you deserve a right to privacy.

Now, suppose your friend had mysterious phone calls showing up on his long
distance bills: this would provide him with some >evidence< that someone was
making long-distance calls using his phone.  In this case he might have to
resort to snooping on people using his phone in order to determine if their
calls are long-distance.  This borders on being illegal, since it invades
your privacy, but it just might be neccessary.  So in order to be as fair
as possible he posts a notice on each of his phones saying he might listen
in to determine who is making long-distance calls.

This borderline legality is comparable to what we as administrators face when
trying to maintain the security of our systems.  This is the reason we have to
put such a banner on our systems.  Does such a banner give blanket protection
to the administrators?  It does not - notice the phrase "In the course of
monitoring individuals improperly using this system, or [...] system
maintenance".  This restricts the authority of the administrator, and I would
imagine that if a legal case were to ensue the administrator had better have
a d*mn good log of the evidence that lead to the monitoring.

BTW: I have yet to figure out why I would monitor an individual while doing
system maintenance.  Anyone have any examples?

>I have a hard time understanding how guests can make demands of their
>hosts.

Because certain rights are just that - rights.  Just because I provide the
forum does not mean I have complete control over everything that goes on
there.  I can stipulate the ground rules and do what I can to enforce them,
but this does *not* give me the right to monitor/document/etc. everything
that goes on there.

>It seems to be the human condition that after having been granted a
>privilege for a long time, we take it for granted and begin to assume
>that it is our right. ie. the "legal right" to:
>    - drive a car
>    - come and go as we please
>    - drink alcohol

Privacy *is* a right, not a privilege.  I agree that many Americans mistake
privileges as rights and you cite several good examples, but this is not one
of them.  The fourth (?) amendment to the Constitution of the United States
makes "unreasonable search and seizure" illegal -- that is, it reinforces our
right to privacy.  Only with due cause can that right be violated -- this is
why Law Enforcement officers are required to obtain warrants to search a
person's premises.

Because it is sometimes necessary to use keystroke-logging to protect the
accunts of authorized users, we must sometimes resort to using it.  Unfor-
tunately that puts us in a precarious situation, and this notice is a means
of making that situation a bit more stable.  I think some of Jyrki's reaction
is justified, but if a Sys. Admin. were to monitor users without sufficient
evidence or without exhausting all other reasonable methods s/he should be
prosecuted.

-John

--
*************************************************************************
* John P. Eisenmenger             Phone: [phone]        *
* Duke University             FAX:   [phone]        *
* Department of Electrical Engineering     Email: [e-mail] (pref)    *
* Box 90291                        [e-mail]        *
* Durham, NC 27708-0291                            *
*                                    *
*  Reports of problems w/EE systems should go to [e-mail]    *
*************************************************************************