NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/org/eff/talk/8288

Internet Message Format | 1993-01-04 | 5.6 KB

Xref: sparky comp.org.eff.talk:8288 alt.comp.acad-freedom.talk:3847 comp.security.misc:2427 alt.privacy:2834 alt.society.civil-liberty:7243
Newsgroups: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
Path: sparky!uunet!mcsun!news.funet.fi!ajk.tele.fi!funic!nntp.hut.fi!usenet
From: [e-mail] (Jyrki Kuoppala)
Subject: Boycotting CERT because of the keystroke monitoring advisory?
Message-ID: <[e-mail]>
Sender: [e-mail] (Usenet pseudouser id)
Nntp-Posting-Host: lusmu.cs.hut.fi
Reply-To: [e-mail] (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Mon, 4 Jan 1993 21:24:39 GMT
Lines: 92

Here's a repost of a message before the holidays:

Newsgroups: comp.org.eff.talk,alt.comp.acad-freedom.talk,comp.security.misc,alt.privacy,alt.society.civil-liberty
From: [e-mail] (Jyrki Kuoppala)
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Message-ID: <[e-mail]>
Date: Fri, 18 Dec 1992 10:02:54 GMT

In article <[e-mail]>, mack23@avalon (Chris Walsh) writes:
>In article <[e-mail]> [e-mail] writes:
>>
>>Though property rights come into it, they are not the only issue.
>
>I'll say!  Various posters have asserted that "If you work for WidgetCo,
>and WidgetCo owns your workstation, plus the associated networking infra-
>structure, then its is OBVIOUS that WidgetCo can monitor your keystrokes."
>
>True.  But folks, not every workstation belongs to a commercial firm!  If
>the CERT advisory were directed solely at such organizations, I'd have no
>beef with it.  The fact, however, is that it had a far broader audience.

Yes, it is for a broad audience.

Earlier I said that property rights are not an issue wrt the CERT
advisory, and that it was not related to companies.  This was based on
my mistaken reading of the advisory - as it was based on the U.S. Dept
of justice advice (order?) to all federal agencies, I though that the
"all systems" on the advisory referred to "all federal systems".
However, it appears I was mistaken - when I asked CERT about this the
answer was that CERT expanded the scope of the advisory and thus it
seems that CERT really means _all_ systems, no matter whether private,
public, government-owned, etc.

A part of my argumentation was based on this misunderstanding of the
advisory (for example the claim where I said that property rights are
not involved).  I apologize for the resulting failure of
communication.  However, my argumentation still applies for systems of
federal agencies and many education sites.

For privately owned commercial and hobby sites property rights do
apply, and whether the property rights override privacy rights depends
is mostly a matter of opinion.  Where I live, I have the impression
that privacy right overrides property rights at least in the case of
the company monitoring private phone calls from company to elsewhere
even if the company pays the bill.  It is a bit unclear whether it is
legal for the company to get the ID information, ie. what number was
called, how long was spoken and when etc. but in practice I think
companies do get such information and the courts probably wouldn't
judge against this.  Also, as a personal opinion I tend to think
that's not a big privacy problem, as long as the workers know what the
situation is and the last few numbers are blanked out as the habit
apparently is - but that it is an unreasonable invasion of privacy to
monitor the contents of the calls.  For work-related calls I think
it's negotiatable, also at certain environments monitoring all calls
might be defensible (places with highly confidential information).

I hope this clears some of the issues wrt property rights.  I sure
don't think there's any _absolute_ right to privacy on company
equipment, and dependig on the situation there may be nothing wrong
with even a policy of "all users are watched all the time" especially
if policy also "company business only" as long as it is negotiated
with and accepted by the workers.  But what CERT is doing is
recommending unilateral announcement of "all users may be monitored
all the time", with no negotation and no negotiated policy of
watching/monitring only on "probable cause".

Thus, I think the CERT advisory is thus even more offensive and
disrespectful of privacy than I originally thought, since they
recommend the taking away of a reasonable expectation of privacy and
thus all means to fight intrusions of privacy from users on _all_
systems, not just those in U.S. federal agenices.

I have communicated about this with CERT, and they don't seem to think
my interpretation of the advisory is incorrect.  Thus it seems that
CERT really supports measures like this, and I repeat and clarify my
proposal that if it continues to do so, people who value privacy
rights should not cooperate with CERT and we as net.citizens should
see if something can be done to get some of the CERT's functions
implemented in a way that respects freedom and people's rights, and
also see if a message can be posted to comp.security.announce
announcing the recommendation not to cooperate with CERT, the reason
for it, and possible alternatives what to do instead of communicating
with CERT wrt security holes, vulnerabilities etc.

I don't know who does CERT's policy decisions and how one might
influence them via other means (possibly organizations like the EFF
and CPSR could work on this) but I do think the most simple thing to
do about an organization doing something you seriously disapprove of
is to stop all support and cooperation with it and suggest others do
the same.

//Jyrki