NetNews Usenet Archive 1992 #18/NN_1992_18.iso/spool/sci/crypt/2973

Internet Message Format | 1992-08-20 | 11.4 KB

Xref: sparky sci.crypt:2973 alt.security:4196 misc.legal:16184
Path: sparky!uunet!pipex!unipalm!uknet!cam-cl!cam-cl!rja14
From: [e-mail] (Ross Anderson)
Newsgroups: sci.crypt,alt.security,misc.legal
Subject: Automatic Teller Machine Writ
Message-ID: <[e-mail]>
Date: 20 Aug 92 13:50:18 GMT
Sender: [e-mail] (The news facility)
Reply-To: [e-mail] (Ross Anderson)
Organization: U of Cambridge Computer Lab, UK
Lines: 286


The following writ has got a fair bit of attention in the UK press. The
plaintiffs, a group of people who have been debited by their bank or
building society for automatic teller machine withdrawals which they
didn't make, want their money back with damages and interest.

The banks and building societies for their part have always denied that
phantom withdrawals take place at all and claim that their systems
are infallible.

In the meantime there are more and more people queuing up to join the
action - about 400 last time I talked to the lawyer - and more and more
cases where crooks are caught using forged cards in ATMs to steal money
from people's accounts, mostly using techniques which have been public
knowledge since at least the mid 1980's and which could have been
forestalled by fairly simple system changes. So in my humble view (and
I'm not a lawyer, just one of the experts assisting them) the banks
don't have a defence.

Anyway, if you want to join the case as a litigant, or you can help as
a witness, the law firm's name and address is at the end of the writ;
the contact is Dennis Whalley and his phone number is 0744 454477.

I am really posting the writ because I feel it has wider relevance.

There has been a lot of discussion recently (on the net and elsewhere)
about digital signature standards, particularly following the NSA/NIST
proposed digital signature algorithm and in the context of the EC's
current `Electronic Signature - the Key to Mobility' program.

The latter has almost admitted that a commercial signature standard
will have to provide guidance on the quality of systems implementation
and the liability of the various participants such as network operators,
service suppliers, hardware and software vendors, service resellers and
customers (EC document RA920007 dicusses the need for research on
these topics).

Future networks may have a very large number of actors whose commercial
offerings may be interdependent in complex and unpredictable ways.
Customers will need an effective way of finding out who to blame when
something goes wrong and everyone tries to pass the buck.

There is also the cost of litigation. In the UK, disgruntled bank
customers could either sue the bank (which would cost more than the
average person is worth) or go to the banking ombudsman (who is paid by
the bankers and seems to believe their propaganda on the infallibility
of ATM systems). The plaintiffs in the current case were lucky that a
group action came along before their claims expired.

For vendors, there is the business issue of how you manage the legal and
organisational aspects of systems risk. Do you hide behind denials and
the cost of litigation, and (if successful for a while) become so
complacent that disaster becomes inevitable, whether in the form of
a big fraud or when you lose a lawsuit andhave to spend millions on
an unplanned system rewrite? Is there not a better way to run things?

All this points in my opinion to a signature arbitration facility, which
would have to be independent and affordable. Note that this is not the
same as a key certification facility, and should in fact be separate (as
the key certification facility is one of the places where things can go
very badly wrong). Specifying and organising such a facility would seem
to be an interesting and relevant problem.

Ross

>**************************************************************************
>
>IN THE HIGH COURT OF JUSTICE
>1992 ORB No.000802
>QUEENS BENCH DIVISION
>
>OFFICAL REFEREE'S BUSINESS
>
>
>BETWEEN
>
>JAMES McCONVILLE
>
>First Plaintiff
>
>and
>
>OTHERS
>
>(LISTED IN SCHEDULE A1 ANNEXED HERETO)
>Plaintiffs
>
>and
>
>
>BARCLAYS BANK PLC
>
>First Defendant
>and
>
>OTHERS
>
>(LISTED IN SCHEDULE A2 ANNEXED HERETO)
>Defendants
>
>
>
>Writ with Statement of Claim Endorsed thereon
>
>**************************************************************************
>
> The Defendants marked as "Banks" in Schedule A2 annexed hereto are
>institutions authorised under the Banking Act 1987 to carry on the
>business of banking which is the business of the acceptance of money
>from, and the collection of cheques for customers and the placing of
>them to the customers' credit; the honouring of cheques or orders drawn
>on the bank by their customers when presented for payment and the
>keeping of some form of current or running accounts in their books in
>which the credits and debits are entered. The Defendants marked as
>"Building Societies" in Schedule A2 annexed hereto are permanent
>societies authorised under the various Building Society Acts. The
>Plaintiffs are all customers of the Defendants with accounts as specified
>in the Plaintiffs' respective Schedules B annexed hereto.
>
>  On dates set out in the respective Schedules B annexed hereto each
>of the said Plaintiffs were supplied with a plastic card containing a
>magnetic stripe to enable it to be used, inter alia, with an Automatic
>Teller Machine (hereinafter referred to as `ATM'). On dates set out in
>the respective Schedules B hereto certain of the said Plaintiffs were
>supplied with a Personal Identification Numbers (hereinafter referred to
>as a `PIN') for each said plastic card. The relevant circumstances
>surrounding the supply of the plastic card and its PIN are set out in the
>respective Schedules B annexed hereto. Unless otherwise stated in the
>respective Schedules B attached hereto the said plastic cards and PINs
>were supplied in the manner particularised below:
>
> The plastic card was supplied inserted in a piece of thin card
>bearing certain terms & conditions regarding the operation of
>the said plastic card. The Plaintiffs no longer have a copy of
>the said thin card.
>
> The PIN associated with each said plastic card was supplied to
>each Plaintiff by sending the same to the Plaintiff by ordinary
>post on a different day to the date when the said plastic card
>was sent. Each PIN was sent in a sealed package upon which
>certain words were printed. The Plaintiffs no longer have a
>copy of the said package.
>
> Subsequently in the circumstances and on the dates set out in the
>respective Schedules B annexed hereto each of the said Plaintiffs had
>their accounts debited with sums which the Defendant alleged had been
>withdrawn from the said account using the said plastic card and PIN. No
>such sums had been withdrawn from the said account using the said
>plastic card and PIN by or on behalf of the Plaintiffs. Accordingly each
>said Defendant was not entitled to debit each said account with the
>alleged withdrawals and the said debiting was a wrongful act and/or was
>a breach of contract.
>
>Pending interrogatories, discovery and the preparation of expert
>reports herein the Plaintiffs rely upon the following matters:
>
> Certain of the Plaintiffs (as particularised in their respective
>Schedules) had never made any ATM withdrawals using their
>plastic cards. As respectively particularised these said Plaintiffs
>did not keep their PIN number with their said cards;
>
> The Plaintiffs will rely upon the admission on behalf of the
>First Defendant in a letter dated 29th April 1992 of faults in
>a computer program which wrongly identifies the branch at
>which withdrawals are attempted and made;
>
> The Plaintiffs who are customers of Defendants identified with
>a `*' in Schedule A will rely on the fact that these said
>Defendants' ATM systems do not have the said systems built
>round security modules in accordance of the recommendations
>of VISA and Mastercard. Accordingly instead of maintaining
>security via automatic updating of master keys using security
>modules the said Defendants rely upon the honesty of their
>own staff in keeping secret the keys they load onto the ATMs.
>
> In respect of those Plaintiffs as particularised in the Schedules
>whose plastic card had been lost and which, allegedly, had later
>been used to debit the respective Plaintiff's account the said
>Plaintiffs say as follows: The PIN number associated with the
>said lost card was not with the card at the time of loss;
>
> Subject to particulars to the contrary in their respective
>Schedules the Plaintiffs all say that the PIN number associated
>with each said plastic card was not disclosed to anyone by the
>Plaintiff;
>
> After making full enquiries as particularised in their respective
>Schedules, each Plaintiff is certain that the secrecy of the PIN
>was not prejudiced in such a way as would have made an ATM
>withdrawal possible if (as is maintained by the Defendants) the
>same could only be performed by possession of the plastic card
>and its respective PIN.
>
> By reason of the matters aforesaid the Plaintiffs have suffered loss
>and damage which is continuing. In respect of each Plaintiff their claim
>is made up as follows:
>
>PARTICULARS
>
># X + Y + Z + I where each term is defined as follows:
>
> X = Monies deducted from each Plaintiff's current account in
>respect of ATM transactions not made by the Plaintiff as
>particularized in their respective Schedule hereto;
>
> Y = Damages for worry and distress arising out of the said
>deductions;
>
> Z = Special Damage as particularized in their respective Schedule
>hereto;
>
> I = Interest on the monies deducted and Special Damages as
>particularized in their respective Schedules for the periods set
>out in the said respective Schedules;
>
>AND THE PLAINTIFFS CLAIM:
>
> (1) # X + Y + Z + I
>
> (2) Additionally or alternatively to `I' daily Interest from date of
>issue of the writ on all damages found due pursuant to Section 35A of
>the Supreme Court Act 1981 at 15 per cent
>
> (3) Any and all interim and final orders for discovery, interrogatories
> and preservation of records relating to and the assets of the
> Plaintiffs.
>
>(4) Costs
>
>(5) Further or other relief
>
>ALISTAIR KELMAN
>
>
>
>This Writ was issued by J. Keith Park & Co of Claughton House 39
>Barrow Street, St Helens, Solicitors for the said Plaintiffs whose
>addresses are shown in Schedule C
>Solicitor Ref: DW/  Tel No:0744-454477
>
>************************************************************************
>
>IN THE HIGH COURT OF JUSTICE
>1992 ORB No.
>QUEENS BENCH DIVISION
>
>OFFICAL REFEREE'S BUSINESS
>
>
>
>
>draft/Schedule A1
>
>Plaintiffs
>1. Joseph R. McConville
>2. Jean McConville
>3. Susan Edith Thomas
>4. Shirley Wilson
>5. Alison Basher
>6. Kevin Clancy
>7. Janette Beatrice Watson
>8. David Albert Clarke
>9. Stephen Francis Raw
>
>************************************************************************
>
>IN THE HIGH COURT OF JUSTICE
>1992 ORB No.
>QUEENS BENCH DIVISION
>
>OFFICAL REFEREE'S BUSINESS
>
>
>
>draft/Schedule A2
>
>
>Defendants  No Security Modules  Bank or Building Society
>
>1. Barclays Bank plc  *          Bank
>2. Midland Bank plc   *          Bank
>3. TSB Bank plc       *          Bank
>4. Nationwide Anglia  *          Building Society
>5. Lloyds Bank plc    *          Bank
>
>************************************************************************