Compu-Fix/Compu-Fix.iso/pubnews/cud319.txt

Text File | 1993-03-01 | 41KB | 849 lines

  ****************************************************************************
                  >C O M P U T E R   U N D E R G R O U N D<
                                >D I G E S T<
              ***  Volume 3, Issue #3.19 (June 4, 1991)   **
  ****************************************************************************

MODERATORS:   Jim Thomas / Gordon Meyer  ([e-mail])
ARCHIVISTS:   Bob Krause / / Bob Kusumoto
GUINNESS GURU:  Brendan Kehoe

            +++++     +++++     +++++     +++++     +++++

CONTENTS THIS ISSUE:
File 1: Moderator's Corner
File 2: From the Mailbag
File 3: Thrifty-Tel--Victim or Victimizer?
File 4: The CU in the News
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

USENET readers can currently receive CuD as alt.society.cu-digest.
Back issues are also available on Compuserve (in: DL0 of the IBMBBS sig),
PC-EXEC BBS (414-789-4210), and at 1:100/345 for those on FIDOnet.
Anonymous ftp sites: (1) ftp.cs.widener.edu (192.55.239.132);
                     (2) [e-mail];
                     (3) dagon.acc.stolaf.edu (130.71.192.18).
E-mail server: [e-mail].

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may be reprinted as long as the source is
cited.  Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.  It is assumed
that non-personal mail to the moderators may be reprinted unless
otherwise specified. Readers are encouraged to submit reasoned
articles relating to the Computer Underground.  Articles are preferred
to short responses.  Please avoid quoting previous posts unless
absolutely necessary.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Contributors assume all
            responsibility for assuring that articles submitted do not
            violate copyright protections.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Moderators
Subject: Moderator's Corner
Date: June 4, 1991

********************************************************************
***  CuD #3.19: File 1 of 4: Moderators Corner                   ***
********************************************************************

A few quick notes:

A minor malfunction crashed the new FREE SPEECH BBS for a few days. It
is back up with a new number:
[phone]

FREE SPEECH is intended to provide a forum similar to the former
FACE-TO-FACE BBS for discussion of legal, ethical, technical, and
other issues of interest to computer hobbyists.

******

The CUD issues on CompuServe have been shuffled around a bit.  Recent
issues can be found in DL0 of the IBMBBS SIG and in DL1 of LAWSIG.
Back issues can be found in DL4 of the IBMBBS SIG.  LAWSIG will one
day have all the back issues as well, when I or some other brave soul
takes the time to upload them.  Cooperation between forums, to the
extent of copying the files from IBMBBS to LAWSIG, is apparently not
possible.

******

The Electronic Frontier Foundation (EFF) as received tax-exempt
status.  Pioneer membership rates are $20 a year for students and
low-income supporters, and $40 a year for regular members.  Send your
membership fees and/or additional contributions to:
        The Electronic Frontier Foundation
        155 Second Street
        Cambridge, MA 02141

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Ah, sordid
Subject: From the Mailbag
Date: 3 June, 1991

********************************************************************
***  CuD #3.19: File 2 of 4: From the Mailbag                    ***
********************************************************************

From: "[e-mail] \"Robert McClenon\"
Subject: Rose and Morris Sentences
Date: 20 May 91 23:34:49 EDT

Here are my thoughts on the Len Rose sentencing.  The sentence imposed
on Rose should be compared not only to those of others caught in Sun
Devil cases, such as Riggs, Darden, and Grant, but to that of Robert
Morris Jr.  Rose, Riggs, Darden, and Grant were all given
disproportionate sentences compared to Morris.  Alternatively, Morris
was given an absurdly light sentence of community service compared to
Rose or Riggs.  Rose, Riggs, Darden, and Grant were sent to prison.
Morris was given community service.

Rose, Riggs, Darden, and Grant were prosecuted for what they are
presumed to have been trying to do.  They never did material harm.
Morris was prosecuted for what he did.   It is not established exactly
what he was trying to do, but he did substantial actual harm.

If Riggs, Darden, and Grant were in fact trying to do what it is
alleged that they were trying to do, then they were trying
unsuccessfully to do what Morris did (with or without trying): to
degrade a network to the point of unavailability.  That is the worst
explanation of what Riggs and others were trying to do in the E911
case.  That is what Morris actually did to the Internet on one
dreadful November day.

Why were Rose and Riggs dealt with more harshly than Morris?  Maybe
prosecutors don't understand what the Internet is but they understand
what a conventional telephone company is.  Conceptually the Internet
is a digital telegraph company, not very different from a telephone
company.

By the way, I don't buy the argument, expressed repeatedly in various
digests, that Rose was really only guilty of copyright violations and
not of a crime.  Look at the FBI warning on any rented videotape.
Copyright infringement is a crime, punishable by 5 years in prison.
The issue is not whether Rose committed a crime.  The issue is equity
in sentencing.  Rose committed a crime.  Riggs committed a crime.
Morris committed a crime.  The sentences were disproportionate.

Maybe Morris got off lightly compared to Riggs because no one knows
exactly what Morris's intentions were, while the Legion of Doom talked
at interminable length about theirs.  I submit that no one really
knows what the real intentions of the Legion of Doom were either.
Hackers often engage in grandiose talk.  Pranksters and vandals often
say nothing.  Neither talk at length nor the failure to discuss one's
motives is necessarily informative.  Also, no one knows what Rose's
ultimate motives were.  Presumably he was planning to capture
passwords, but that does not indicate what he planned to do with them.
Morris's real motives are unknown.  Rose's real motives are unknown.
Riggs's real motives are unknown, eclipsed by the wild hacker
rhetoric.  The difference is that Morris did real harm.

Either Morris should have gone to jail or Rose and Riggs should have
gotten community service.  I think all three should have been fined
heavily.  They were.  I think all three should have been given
community service.  Morris was.  Alternatively, all three should have
been jailed.  Two were.  Morris did real harm.  Rose didn't.  The
disparity isn't fair.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: [e-mail]
Subject: Stage.dat, Protections, and FluShotPlus
Date: Thu, 23 May 91 17:46:52 PDT

One of the problems in the recent controversy about Prodigy's
STAGE.DAT file has been that many would-be testers simply didn't have
the tools to catch Prodigy red-handed.  Instead of all the effort
spent re-installing the software on supposedly virgin diskettes and
hard disk subdirectories, we can use some readily available software
to do a more thorough job.  Although there are other pieces of code
that will work as well, I chose the virus-guard FluShotPlus as my
trapping program.  [FluShotPlus may be downloaded from the author,
Ross Greenburg's BBS at [phone].  A commercial version of the
program called Virex-PC is available in the usual locations.]
FluShotPlus works by watching key ares of your system and then
alerting you when a program does not behave according to YOUR rules.
Your rules are established in a file called FLUSHOT.DAT placed in you
root directory.  Another utility in the FSP package will allow you to
change the name and location of this file for greater security, but
let's stick to the default for purposes of this explanation.

Let's also assume that we have installed PRODIGY in C:\PRODIGY.
Assuming those conditions, here is a sample FLUSHOT.DAT file that will
protect your system and monitor file use.

 ----------------------- CUT HERE -------------------------------
R=C:\*.*
W=C:\*.*
E=C:\PRODIGY\CACHE.DAT
E=C:\PRODIGY\CONFIG.SM
E=C:\PRODIGY\DRIVER.SCR
E=C:\PRODIGY\KEYS.TRX
E=C:\PRODIGY\LOG_KEYS.TRX
E=C:\PRODIGY\MODEMS.TXT
E=C:\PRODIGY\MODEMSTR.EXE
E=C:\PRODIGY\PRODIGY.EXE
E=C:\PRODIGY\PROFILE.DAT
E=C:\PRODIGY\STAGE.DAT
E=C:\PRODIGY\TLFD0000.*
E=C:\PRODIGY\VDIPLP.TTX
 ----------------------- CUT HERE -------------------------------

The first two lines prohibit all reads and all writes of all files on
drive C:.  Add more lines to protect files on other drives.  The rest
of the file are EXCEPTION lines -- exceptions to the two rules we set
up in the first two lines.  For example, line 3 allows all access to
C:\PRODIGY\CACHE.DAT.  Any other file access in C:\PRODIGY will
provoke a bell-warning from FluShotPlus.

With this file situated in the root of C:\, all we need do is fire up
FSP.

So far, so good.  This simple setup should allow most Prodigy users to
sleep comfortably.  There is one major problem with this setup: FSP
does not handle graphics screens.  Thus, its warning screen, alerting
you to the type of access being requested, and the offending program,
remain a mystery to you.  I use a frontend to Prodigy called
Prod-Util.  It allows me to compose messages offline and upload them,
and to control the screen dumps more efficiently.  It has other
features, but those are the only two that I use.

No sooner did I have my FluShot.Dat set up than I started a Prodigy
session and got a bell-warning.  I looked all over the subdir, added
to Prod-Util files to the FLUSHOT.DAT list of permitted files and
still I got the warning.  What to do now?  I dug into my code archives
and came up with DOSWatch, a demo program that I got from Crescent
Software when I purchased their wonderful BASIC add-on library PDQ.
This little library allows me to produce the smallest BASIC code
around.  DOSWatch is similar to the other WATCH programs in the PD: it
reports on the activities of the system.  Now, usually, DOSWatch
reports directly to the screen.  But we still had the problem of
PRODIGY being a graphics-based app.  Rather than recode everything to
go into graphics mode, I decided to dump the results of DOSWatch to a
disk file.  I would not be able to stop PRODIGY from looking at my
files, but I would know after the session, which files it had looked
at.

So I skipped the installation of FluShot in order to let DOSWatch
catch Prodigy red-handed.  And sure enough, a few seconds into the
Prodigy program's load, it opened a file called KEYTRACE.AUT. Innocent
enough.  Must be a file where they keep track of where I have been in
the system during a session.  So I sent Prodigy tech support a
message, asking what KEYTRACE.AUT did.  The message came back that all
KEY files are keyboard interfaces.  But they were talking about the
.KEY files, not KEYTRACE.AUT.  So I sent another message asking them
to come clean.  Tell me what the specific file KEYTRACE.AUT did, and
while they were at it, what did the different fields in MODEMS.TXT
control?  They must have thought I was hacking the system or that
something had gone awry, for the next day, I had a call from Prodigy
tech support!  He said again that the file in question was not one of
theirs.

Stupid me!  I had completely forgotten about little PROD-UTIL, working
in the background.  Because I had not given it permission to go TSR on
me, FluShot had dutifully reported it as a violation of my rules.  [By
the way, MODEMS.TXT still remains shrouded in mystery.  Yes, it is a
comma-separated data file, but its contents and their purpose is a
trade secret.  But it only controls S-Registers and the like.  Still a
secret.]

Why narrate my tale of embarassment?  To remind all of us who run
fairly complicated setups that we need to eliminate ALL variables and
do thorough testing before we go public with accusations of
impropriety.

If you would like, I can send you a BASIC program that will create the
Watch exe file.  I have permission from Crescent to distribute my
amended version of their code.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Moderators
Subject: Thrifty-Tel--Victim or Victimizer?
Date: 1 June, 1991

********************************************************************
***  CuD #3.19: File 3 of 4: Thrifty-Tel -- Victim or Victimizer?***
********************************************************************

Thrifty-Tel, an L-D carrier in Southern California seems to have a
nice deal going. The following example of one tariff plan (effective
July 1990) seems reasonable:

  Activation Fee (one time fee)  = $57 Access Fee (monthly) =
  $13.18 Flat Rate (monthly) fee        = $199
     (this allows unlimited calling within the US for the month,
      but calls over 1,500 minutes, or 25 hours, is billed at
      $0.14 a minute)

This comes to about $2,600 a year. Thrifty-Tel's other programs
are comparable to this one.  BUT: There is an interesting
"unauthorized usage" provision stuck in the section entitled
"Miscellaneous Service Features" under "Unauthorized Usage," a
rate change filed with the California Public Utility Commission on Jan
25 '91 and effective March 16 '91:

    _Unauthorized Usage_ Any entity using Thrifty' facilities
    without securing proper authorization either by: (1)
    obtaining authorization by way of a prescription agreement;
    (2) dialing Thrifty's 10xxx FGD access Code; (3) obtaining an
    authorization code from Thrifty Telephone Exchange is subject
    to: (1) a $2,880.00 per day, per line surcharge inaddition to
    the otherwise applicable rates under the "Equal Access
    Service" plan; (2) a $3,000.00 set-up fee; and (3) a $200.00
    per hour labor charge, and (4) payment of all attorney fees
    and costs incurred by Thrifty in collecting the applicable
    charges for unauthorized usage.

If somebody makes $10 calls on three separate days, does this
mean that Thrifty can collect over $10,000? Does anybody have any
idea what the "labor costs" are for (they don't seem to be part
of any other schedule)? Could a few slow attys work for 100 hours
at $250/hr? Is this a subtle form of blackmail? "Pay us and we
won't press criminal charges!"

John Higdon, who brought Thrifty's policy to the attention of the nets
in a post in Telecom Digest over Memorial Day weekend, appeared on
KFI radio in Los Angeles with Thrifty-Tel executive Rebecca Bigeley,
who he described as "a woman with a cause and a gigantic ego." Judging
from his description of the broadcast (see Telecom Digest, V 11, #408,
29 May, '91), she was slick, glib, and rather cavalier about defending
Thrifty-Tel's use of near-obsolete hacker-friendly equipment. John
summed up the KFI dialogue with Rebeca Bigeley as less than
satisfying:

     "Her moral crusade tone created an atmosphere that cuased
     any reason to be introduced into the dicussion to appear as
     being soft on criminal activity." To her it was very simple:
     If these people don't want their lives ruined then they
     should not tamper with her (very vulnerable) system."

Thrifty's address is:
Thrifty Telephone Exchange
   300 Plaza Alicante, Suite 380
   Garden Grove, CA 92640  (714-740-2880)

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: The CU in the News
Date: 4 June, 1991

********************************************************************
***  CuD #3.19: File 4 of 4: Moderators Corner                   ***
********************************************************************

From: [e-mail]
Subject:  Dutch Crackers as opposed to Graham Crackers
Date:     Mon,  6 May 91 22:16 EDT

                        Internet Break-Ins
           Dutch Cracker Easily Accessed U.S. Computers
                         By Mitch Wagner
                    Unix Today, April 29, 1991

Allegations that Dutch crackers have been operating with impunity for
months against U.S. computers has stirred a debate whether systems
administrators have been negligent in failing to close easy, obvious
security holes that have been well-known for years.

Dutch crackers have, since September, been using the Internet to
access computers, most of them Unix machines, at the Kennedy Space
Center, the Pentagon's Pacific meet Command, the Lawrence Livermore
National laboratories and Stanford University.  The techniques they've
used have been simple, well-known and uncreative, and they've found
the job an easy one, say sources. "These are not skilled computer
geniuses like Robert Morris," said Cliff Stoll, author of The Cuckoo's
Egg, who said he's been in contact with some Dutch crackers who may
have committed the break-ins. "These are more like the kind of hacker
I caught, sort of plodding, boring people." Stoll's 1989 book
concerned his pursuit of a cracker.

Techniques include guessing at commonly used passwords, default
passwords that ship with Unix systems and that some users don't bother
to change, and using guest accounts, said Stoll.

The crackers managed to obtain superuser privileges at a system at
Stanford University, said Bill Bauridel, information security officer
at Stanford University Data Center. They used a bug in sendmail - the
same program exploited by Robert Morris to loose a worm on the
Internet in 1988, though Bauridel said the crackers did not use the
sendmail feature that Morris exploited.

The Lawrence Livermore Laboratories computers were only used as a
gateway to other systems, said Bob Borchers, associate director for
computation at the labs.

The crackers have been able to access only non-classified material,
such as routine memos say authorities. So far, no evidence has been
found that they did anything malicious once they broke into a U.S.
site.

The lack of laws governing computer crime in Holland allows crackers
to operate with relative impunity, said Martin de Lange, managing
director of ACE, and Amsterdam-based Unix systems software company.

The impunity combines with an anti-authoritarian atmosphere in Holland
to make cracking a thriving practice, said Stoll.  "There's a national
sense of thumbing one's nose at the Establishment that's promoted and
appreciated in the Netherlands," he said. "Walk down the streets of
Amsterdam and you'll find a thriving population that delights in
finding ways around the Establishment's walls and barriers."

The break-ins became a subject of notoriety after a Dutch television
show called After the News ran film Feb. 2 purporting to be of an
actual cracker break-in, said Henk Bekket, a network manager at
Utrecht University.

Utrecht University in Holland was reported to be the first site broken
into. Bekker said he was able to detect two break-ins, one in October
and one again in January.

The crackers apparently dialed into a campus terminal network that
operates without a password, accessed the campus TCP/IP backbone, and
then accessed another machine on campus-a VAX 11/75-that hooks up to
SURFnet, a national X.25 network in Holland.

>From SURFnet, they were presumably able to crack into an Inter-net
computer somewhere, and from there access the computers in the United
States, said Bekker.

The dial-in to SURFnet gateway has been canceled since the January
attempt, he said. (Presumably, the break-in footage aired Feb. 2 was
either through another channel, or filmed earlier.)

Bekker said he manages a network consisting of a DECsystem 5500 server
and 40 to 50 Sun and VAX VMS workstations.  He noted a break-in to
another machine on campus Jan. 16, and into a machine at the
University of Leyden in October.

A cracker was searching DECnet I password files for accounts with no
password.  The cracker was also breaking into machines over DECnet,
said Bekker. The cracker had a rough idea of the pattern of DECnet
node addresses in Holland, and was trying to guess machine addresses
from there. Node addresses begin with the numerals 28, said Bekker,
and he found log files of the cracker searching for machines at 28.1,
28.2, 28.3 and so on. But the cracker did not know that the actual
sequence goes 28.100, 28.110, and so on.

"Hackers are organized to get together, discuss technologies, and they
openly demonstrate where there are installations prone to break-in,"
de Lange said.  Computer crime in Holland can be prosecuted under laws
covering theft of resources, wiretapping and wire fraud, said Piet
Beertema, of the European Unix User Group, and network manager of the
Center for Mathematics and Computer Science in Amsterdam.

And finding someone to investigate can also be a problem, said Bekker.

"You cannot go to the police and say, 'Hey, someone has broken into my
computer.' They can't do anything about it," he said.

Stoll, the American author, said crackers appear firmly rooted in
Dutch soil.

"There is a history going back more than five years of people getting
together and breaking into computers over there," he said.  "Hacker
clubs have been active there since 1985 or 1986."

But he said it's more than lack of law that has made cracking so
popular. Most industrialized nations have no cracking laws, and those
that have them find prosecution extremely difficult, he said. Dutch
citizens also have an anti-authoritarian spirit, he added.

But Stoll condemmed the crackers.  "This is the sort of behavior that
wrecks the community, spreads paranoia and mistrust," he said. "It
brings a sense of paranoia to a community which is founded on trust."
Because no classified data was accessed, Mike Godwin, attorney for the
Electronic Frontiers Foundation (EFF), cautioned against making too
much of the incidents.

"What did these people do" he said. "There's no sense that they
vandalized systems or got ahold of any classified information." The
itself as an organization fighting to see civil rights guarantees
extended to information systems. The Cambridge, Mass., organization
has been involved in a number of cracker defenses.

The fact that the systems were breached means the data's integrity is
compromised, said Netunann. just because the data isn't classified
doesn't mean it isn't important, he noted. 'Just because you can't get
into classified systems doesn't mean you can't get sensitive
information," he said.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Brendan Kehoe <[e-mail]>
Subject: Long-haul Carriers May Offer Toll-Fraud Monitoring
Date: Wed, 1 May 91 22:50:31 -0400

"Long-haul carriers may offer toll-fraud monitoring:  Services would
                help shield customers from hackers"
               by Anita Taff, Washington Bureau Chief

WASHINGTON D.C. -- Long-distance carriers are considering offering
services that would shield customers from toll fraud by monitoring
network activity for suspicious traffic patterns and tipping off
users before huge costs would be run up, Network World has
learned.

Hackers are defrauding corporations by dialing into their private
branch  exchanges and using stolen authorization codes to dial out
of the switches to remote destinations, sticking the switch owners
with charges ranging from several thousand to, in one case, a
million dollars.

Users have been loathe to report toll fraud because they are
embarrassed about the security breaches or because they have entered
into private settlements with carriers that cannot be disclosed. But
earlier this year, Pacific Mutual Life Insurance Co., exasperated by
$200,000 in fraudulent charges run up during one weekend and lack of
progress in settling the issue with AT&T, turned to the Federal
Communications Commission for help.

The insurance company asked the FCC to open a proceeding in order to
establish guidelines that fairly distribute liability for toll fraud
among users, long distance carriers and customer premises equipment
manufacturers. The company questioned the validity of AT&T's claims
that its tarriffs place the liability for fraud on users' shoulders.
Both AT&T and MCI Communications Corp. oppose Pacific Mutual's
position.

But it is clear something has to be done. Customers lose $500 million
annually to toll fraud, according to the Communications Fraud
Control Association.

"There are two kinds of customers: those who have been victims of
toll fraud and those who are about to [become victims]," said Jim
Snyder, staff member of the systems integrity department at MCI.

According to Snyder, about 80% of the calls placed by hackers go to
one of three places: Columbia, Pakistan and area code 809, which
covers Caribbean countries including the Dominican Republic and
Jamaica. Often, the calls are placed at night or during weekends. It
is this thumbprint that would enable carriers to set up monitoring
services to identify unusual activity. He said MCI is considering
such a service but has not yet decided whether to offer it.

AT&T would also be interested in rolling out such a monitoring
service if customer demand exists, a spokesman said.

Henry Levine, a telecommunications attorney in Washington, D.C. who
helps customers put together Tariff 12 deals, said he knows of
several users that have requested toll-fraud monitoring from AT&T.
He said AT&T is currently beta-testing technology that gives users
real-time access to call detail data, a necessary capability for
real-time monitoring.

US Sprint Communications Co. offers a monitoring service for its
800, UltraWATS, Virtual Private Network, SprintNet and voice mail
customers free of charge, but it is not a daily, around-the-clock
monitoring service, and the typical lag time until user are notified
of problems is 24 hours.

In a filing on behalf of the Securities Industry Association, Visa
USA, Inc., the New York Clearinghouse Association and Pacific
Mutual, Levine urged the agency to require carriers to offer
monitoring services. Network equipment could monitor traffic
according to preset parameters for call volume, off-hour calling and
suspicious area or country codes, he said. If an anomaly is
detected, Levine's proposal suggests that carriers notify users
within 30 minutes. Therefore, users would be held liable for only a
nominal amount of fraudulent charges.

Network World, April 29, 1991 [Volume 8 Number 17].
[161 Worcester Road, Framingham, MA. 01701    508/875-6400
MCI-Mail:390-4868]

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: [e-mail](Joe Abernathy)
Steve Jackson Games story from Houston Chronicle
Date: Thu, 16 May 91 16:40:28 CDT

    Lawsuit alleges rights violations in computer crime crackdown


By JOE ABERNATHY
Copyright 1991, Houston Chronicle

An Austin game publisher has sued the U.S. Secret Service for alleged
civil rights violations in connection with a nationwide crackdown on
computer crime.

Steve Jackson Games, whose case has become a cause celebre in the
computer network community, alleges in the lawsuit that a raid
conducted during OperationSun Devil violated the rights of the company
and its customers to free speech, free association, and a free press.

The lawsuit in federal district court in Austin further claims the
raid was a violation of the protection against unreasonable search and
seizure, and violated the law restricting the government from
searching the office of publishers for work products and other
documents. It seeks unspecified damages.

"This is a lawsuit brought to establish the statutory rights of
businesses and individuals who use computers," said Jackson's
attorney, Sharon Beckman of Boston.  "It's about the First Amendment,
it's about the right to privacy, and it's about unreasonable
government intrusion."

Defendants include the Secret Service; Assistant United States
Attorney William J. Cook in Chicago; Secret Service agents Timothy M.
Foley and Barbara Golden; and Henry M. Kluepfel of Bellcore, a
telephone company research consortium which assisted the agency in its
investigation.

Earl Devaney, special agent in charge of the Secret Service fraud
division, said that his agency was barred from responding to the
allegations contained in the lawsuit.

"Our side of the story can't be told because we're compelled by the
laws that govern us to remain mute," he said. "We'll have to let the
future indictments, if there are any, and the future trials speak for
themselves."

Devaney said the agency recently completed its review of evidence
seized during Operation Sun Devil and has sent it to federal
prosecutors. He couldn't predict how many indictments will result.

The Electronic Frontier Foundation, founded by computer industry
activists after questions arose regarding the legality of several Sun
Devil raids, is paying Jackson's legal fees. James R. George, an
Austin attorney with expertise in constitutional law, represents
Jackson in Texas.

Contending that civil rights normally taken for granted are often
denied to users of computer networks and bulletin boards, the EFF
attorneys designed Jackson's case as a test of how courts will treat
these issues.

"What happened was so clearly wrong," Beckman said.  "Here we have a
completely innocent businessman, a publisher no less, whose
publications are seized, whose computers are seized, whose private
electronic mail is seized, and all for no good reason."

Jackson's firm was raided on March 1, 1990, along with 27 other homes
and businesses across the nation. The Secret Service confiscated
dozens of computers and tens of thousands of computer data disks in
the raids. After several months passed with no charges being filed,
the agency came under increasing fire for Sun Devil.

"They raided the office with no cause, confiscated equipment and data,
and seriously delayed the publication of one big book by confiscating
every current copy," Jackson said. "It very nearly put us out of
business, and we are still extremely shaky."

Seven months after the raid on Jackson's firm, the search warrant was
unsealed, revealing that the firm was not even suspected of
wrongdoing. An employee was suspected of using a company bulletin
board system to distribute a document stolen from the telephone
company.

Bulletin board systems, called BBSs in computer jargon, allow people
with common interests  to share information using computers linked by
telephone.  Jackson's bulletin board, Illuminati, was used to provide
product support for his games - which are played with dice, not
computers.

Beckman said the search warrant affidavit indicates investigators
thought the phone company document was stored on a bulletin board at
the employee's home, and therefore agents had no reason to search the
business.

"Computers or no computers, the government had no justification to
walk through that door," she said.

Beckman said that by seizing the BBS at Steve Jackson Games, the
Secret Service had denied customers the right to association.

"This board was not only a forum for discussion, it was a forum for a
virtual community of people with a common interest in the gaming
field," she said. "Especially for some people who live in a remote
location, this forum was particularly important, and the Secret
Service shut that down."

Jackson was joined in the lawsuit by three New Hampshire residents,
Elizabeth McCoy, Walter Milliken and Steffan O'Sullivan, who used the
Illuminati BBS.

"Another right is privacy," Beckman said. "When the government seized
the Illuminati board, they also seized all of the private electronic
mail that (callers) had stored. There is nothing in the warrant to
suggest there was reason to think there was evidence of criminal
activity in the electronic mail - the warrant doesn't even state that
there was e-mail."

"That, we allege, is a gross violation of the Electronic
Communications Privacy Act," Beckman said.

Mitchell D. Kapor, creator of the popular Lotus spreadsheet program
and co-founder of the Electronic Frontier Foundation, said:

"The EFF believes that it is vital that government, private entities,
and individuals who have violated the Constitutional rights of
individuals be held accountable for their actions. We also hope this
case will help demystify the world of computer users to the general
public and inform them about the potential of computer communities."


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: <[e-mail]>
Subject:  More info on a past article
Date:     Sat,  1 Jun 91 08:27 EDT

                         Court Tosses Inslaw Appeal
                             By Gary H. Anthes
                         Computerworld May 13, 1991

Washington, D.C.- A three-judge panel of the US Court of Appeals throw
out two lower court rulings last week that said the US Department of
Justice had stolen software from Inslaw, Inc. and had conspired to
drive the firm out of business.

The Court of Appeals for the Washington, D.C., circuit did not
consider the validity of the lower court findings but said the
bankruptcy court that first upheld Inslaw's charges had exceeded its
authority.

This is a serious setback for Inslaw, which said it has spent five
years and $6 million in legal fees on the matter, but the company
vowed to fight on. It may ask the full court to reconsider, it may
appeal to the US Supreme Court, or it may go to more specialized
tribunals set up by the government to hear disputes over contracts,
trade secrets, and copyrights, Inslaw President William Hamilton said.

"Not many firms could have lasted this long, and now to have this
happen is just unbelievable. But there's no way in hell we will put up
with it," an obviously embittered Hamilton said. It may cost the tiny
firm "millions more" to reach the next major legal milestone, he said.

Double Trouble
Since the bankruptcy court trial in 1987, Inslaw has learned of
additional alleged wrongdoings by the Justice Department.

"The new evidence indicates that the motive of the [software theft]
was to put Inslaw's software in the hands of private sector friends of
the Reagan/Bush administration and then to award lucrative government
contracts to those political supporters," Hamiliton said.

He said that other evidence suggests that the software was illegally
sold to foreign intelligence agencies.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From:  [e-mail]
Subject:  Time to Copyright Underground Material
Date:     Sat,  1 Jun 91 07:32 EDT

The following article was interesting to read for many reasons but
most importantly about the database on the computer underground. I
wonder if they will also act as a "unofficial" archive site for issues
of Phrack, LoD, CuD, etc. If this is the case, then it might not be a
good idea anymore to provide information to the Internet sites unless
it could be copyrighted. Because on most of the PC BBS's you must
state that you are a non-security and law enforcement type to gain
access. Just a thought.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

                       Systems Security Tips Go On-Line
                             By Michael Alexander
                          Computerworld May 13, 1991

Farifax, Va.-- Information systems security managers, electronic data
processing auditors and others involved in systems protection know
that it can often be difficult to keep on top of security technology
and fast-breaking news. This week, National Security Associates, Inc.,
will officially kick off an on-line service dedicated solely to
computer security.

The repository contains databases of such articles on computer
security that have appeared in 260 publications, computer security
incident reports and vendor security products. One database is devoted
to activity in the computer underground and to techniques used to
compromise systems security.

  "This is a tough industry to keep up with," said Dennis Flanders, a
communications engineer with computer security responsibilities at
Boing Co.  Flanders has been an alpha tester of National Security
Associates' systems for about six months. "Security information is now
being done piecemeal, and you have to go to many sources for
information. The appealing thing about this is [that] all of the
information is in one place."

  The service costs $12.50 per hour. There is a onetime sign-up charge
of $30, which includes $15 worth of access time.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Anonymous
Subject: Justice Dept as Pirates: More Inslaw News
Date:     Tue, 2 June  91 21:19:28 PDT

Source: "Software Pirates," IN THESE TIMES (May 29-June 11, 1991, pp
11-13). Author: Joel Bleifuss.

I found the following article in the latest In These Times.  It's
lengthy, so readers can obtain a copy from their newstands.  The
author summarizes Inslaw Corp.'s case against the U.S. Department of
Justice, which it charges robbed it of its program, conspired to send
the company into bankruptcy, and then initiated a cover-up.

     "In 1987, Judge George Bason, the federal bankruptcy judge for
     Washington, D.C., ruled that 'the Department of Justice took,
     convereted, stole' the Inslaw software "by trickery, fraud and
     deceit." The case is still in the courts."

The author links the Inslaw case to the 1980 arms-for-hostages
allegations of the Bush-Reagan campaign and suggests that foreign
intrigue is the root of the matter.  After a lengthy description of
the case, which has been summarized elsewhere so I won't repeat it,
the author concludes:

          "The St. Louis Post-Dispatch, which has assigned reported
     Phil Linsalata to cover the alleged Inslaw and 1980 scandals, ahs
     called for a congressional inquiry to 'alert the public to the
     pervasiveness of underground government, both legal and illegal.'
     As the May 13 editorial put it, 'If a subterranean network of
     operatives (like that exposed in the Iran-contra investigation)
     still exists, carrying out secret government policies, the very
     survival of a democratic political system based on law requires
     that it be exposed to the light.  (The Inslaw case) may reveal
     pat of an illegal policy that was put in place even before the
     Regan administration had taken office. That is why Congress must
     try to find out the truth behind (allegations that the 1980
     Reagan-Bush campaign arranged a secret arms-for-hostages deal
     with Iran).'
          Only when these allegations are brought to light can justice
     be served.'"

********************************************************************

------------------------------

                         **END OF CuD #3.19**
********************************************************************