NetNews Usenet Archive 1992 #26/NN_1992_26.iso/spool/comp/org/eff/talk/7002

Text File | 1992-11-14 | 6.1 KB | 129 lines

Newsgroups: comp.org.eff.talk
Path: sparky!uunet!hela.iti.org!cs.widener.edu!ukma!morgan
From: [e-mail] (Wes Morgan)
Subject: Re: Query: Can Universities limit network access &/or 'spy` on users?
References: <[e-mail]>
Message-ID: <[e-mail]>
Organization: University of Kentucky Engineering Computing Center
Sender: [e-mail] (Wes Morgan)
Date: Fri, 13 Nov 1992 19:43:18 GMT
Distribution: na
Lines: 116

[e-mail] (Michael Rogero Brown) wrote:
>A member of ACC stated there that
>the reason students are denied network access is because they use it for
>'frivolous' activies as opposed to 'research' uses.
>
>What infuriates me is HOW WOULD THEY KNOW HOW PEOPLE ARE USING THIS STUFF?
>The only why I see that they would know is if they are spying on student
>activties, ie reading their mail to see if its serious or not, etc.  Frankly
>this is totally unethical, but is it illegal?  I would think users would have
>some right to privacy in their accounts from the sysadms spying on them.

[ I've already replied to Michael; I thought others might take interest ]
[ in this as well.                                                      ]

You should keep in mind that this information can be gathered via several
methods, several of which are non-intrusive.

Let's consider the first question:
    Can we determine what a particular user is doing?

Under Unix, the commands "who", "finger", and "ps" can be used BY ANY USER
to build a fairly good picture of an individual's activity.  Some Unix sys-
tems support the "last" and "lastcomm" utilities, which show the command
history of the specified users; again, these require no special privilege.

Under VMS, the SHOW and FINGER commands give information about a user's
current processes.  Under RSTS/E and TOPS-10, the SYSTAT command gives
this information.

We may debate the propriety of these utilities, but they are available
(in most cases) to all users, without any special privilege.

Question #2:
    Can we determine the network activity of a given system?

There are several packages (and builtin utilities) which will profile
and/or log network activity.  Under Unix, the "netstat" command will
tell you the current connections in use; it does not assign individual
usernames to the connections (but the information from "ps" will enable
you to match them up).  Again, ANY user could do this.

There are several packages which will profile the network activity on
a system level.  For instance, NNStat can log every packet that comes
from or goes to a specific system; I'm sure that other packages can do
the same thing.  Again, note that NNStat does NOT associate a particular
username with the traffic.

You mentioned that there are several systems which are used exclusively
by students.  Were I at FAU, I could easily monitor the traffic to/from
that system, WITHOUT IDENTIFYING SPECIFIC USERS, and draw conclusions about
usage patterns.  If I see that 50% of the network traffic from a given sys-
tem is going to MUDs/IRC/whatever (which are identified by the port number
in the packet), I can draw some conclusions WITHOUT IDENTIFYING SPECIFIC
USERS.

Question #3:
    Can we track email traffic/usage?

Again, there are some utilities which, by default, are available to all users.
Under Unix, many systems support the "mailq" command, which lists all email
messages in the queue for delivery.  Unless the admins specifically restrict
that command, ANY USER could gather such information.

In addition, most mail delivery agents (sendmail, smail, etc.) maintain logs
of all email transactions.  For instance, my logs include:
    Sender's address
    Recipient's address
    Date/time of delivery
    Size
    Status (sent, deferred, error, etc.)
From this information, an admin COULD draw a complete picture of an individual
user's email usage (I have never done so, except on request by the user).  How-
ever, this information is often used to profile email services.  I have a file
which includes the "well known" mailing list addresses; I use this to estimate
our users' participation in such lists.  (NOTE: I do this without digging up
who is subscribed to what list, and I don't even publicize the lists which are
used; it's just beneficial to be able to say "our users are participating with
other universities on a regular basis through XXX mailing lists.")

[ Before you argue that these logs should not be kept, let me point out that ]
[ they are ABSOLUTELY ESSENTIAL in troubleshooting; without them, I would    ]
[ never be able to find/resolve problems in email service.             ]

In addition, many systems run accounting packages which compile various
statistics.  For instance, my systems generate a monthly report which
lists:
    - Total CPU/disk/connect time activity of all users (ranked by
      CPU usage)
    - Total CPU/disk/real time usage of each program on the system
      (ranked by CPU usage)
This information is often required by software licensors; for instance,
some licence costs vary with the amount of CPU used by the licensed program.
It can also be used to measure the impact of services such as Usenet news,
gopher, et cetera. (If "rn", "play", and "empire"  burn up more time than
"cc", "f77", and "ld", your system may be mutating into a "recreational"
role.)  I also use this information to adjust quotas, justify additional
diskspace, and beg for bigger systems.  8)

In conclusion, it is quite possible that your admins have determined/extracted
this information in a non-intrusive fashion.  If you don't trust your admins
(*sigh*), I would suggest that you:
    - Ask for statistics which justify their assertions
    - Ask how the statistics were gathered
    - Ask about the distribution (if any) of the information
    - Ask about the longevity (if any) of the information (some sites
      keep accounting and log files for long periods of time)

Your accusations (explicit and implicit) may not be justified.

--Wes

--
MORGAN@UKCC         |       Wes Morgan       |        ...!ukma!ukecc!morgan
[e-mail]   | Engineering  Computing |   [e-mail]
[e-mail] | University of Kentucky | [e-mail]
  Mailing list for AT&T StarServer S/E  - [e-mail]