The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/cud/cud304.txt

Text File | 2003-06-11 | 42.1 KB | 902 lines

  ****************************************************************************
                  >C O M P U T E R   U N D E R G R O U N D<
                                >D I G E S T<
              ***  Volume 3, Issue #3.04 (January 28, 1991)   **
  ****************************************************************************

MODERATORS:   Jim Thomas / Gordon Meyer  ([e-mail])
ARCHIVISTS:   Bob Krause / Alex Smith / Bob Kusumoto
RESIDENT SYSTEM CRASH VICTIM::  Brendan Kehoe

USENET readers can currently receive CuD as alt.society.cu-digest. Back
issues are also available on Compuserve (in: DL0 of the IBMBBS sig),
PC-EXEC BBS (414-789-4210), and at 1:100/345 for those on FIDOnet.
Anonymous ftp sites: (1) ftp.cs.widener.edu (2) [e-mail]
E-mail server: [e-mail].

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may be reprinted as long as the source is
cited.  Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified. Readers are encouraged to submit reasoned articles relating to
the Computer Underground.  Articles are preferred to short responses.
Please avoid quoting previous posts unless absolutely necessary.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent the
            views of the moderators. Contributors assume all responsibility
            for assuring that articles submitted do not violate copyright
            protections.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

CONTENTS THIS ISSUE:
File 1: Moderators' Corner
File 2: From the Mailbag
File 3: BMUG's ECPA Commentary (reprinted with permission from BMUG
File 4: The CU in the News

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

----------------------------------------------------------------------

********************************************************************
***  CuD #3.04, File 1 of 4: Moderator's corner                  ***
********************************************************************

From: Moderators
Subject: Moderators' Corner
Date: January 28, 1991

++++++++++
In this file:
1. LEN ROSE UPDATE
2. FIRST CONFERENCE ON COMPUTERS, FREEDOM AND PRIVACY
3. FTP INFO AND WIDENER CRASH
++++++++++

+++++++++++++++++++
Len Rose Update
+++++++++++++++++++

Len Rose's trial, originally scheduled for January 28, has been pushed back to
April 1 because of a superceding indictment related to the same facts. Len is
currently represented by Catterton, Kemp, and Mason of Rockville, Md.
The EFF's amicus brief in the case is available from the CuD archives or
directly from EFF.

+++++++++++++++++++++++
First Conference on Computers, Freedom and Privacy
+++++++++++++++++++++++++

Don't forget The First Conference On Computers, Freedom and Privacy coming
up on March 25-28. The conference will be held at the Airport SFO Marriott
Hotel in Burlingame (that's the San Francisco Airport about 15 minutes
south of the city for out-of-towners).  All are invited, but participation
is limited to the first 600 registering.  For more information, contact
[e-mail] or WELL![e-mail]

++++++++++++++++++++++++++++++
FTP Info and Widener Crash
+++++++++++++++++++++++++++++++

The Widener ftp site is experiencing some problems and is down for awhile.
But, the others are currently working.  Back issues of cuds on Compuserve
are in: DL0 of the IBMBBS sig.  Added to the archives: A dozen more state
computer statutes, NIA #69 (which came out last month), Phantasy #4, and a
few other things. An anonymous contributor also deposited about a dozen or
more university computer policies/regulations in the "legal" directory
which are well worth reading. Thanks to the donor!  Brian Peretti also send
over his "Computer Publication and the First Amendment," which we also
recommend.

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From:  Assorted
Subject: From the Mailbag
Date: January 29, 1990

********************************************************************
***  CuD #3.04, File 2 of 4: From the Mailbag                    ***
********************************************************************

Subject: New address for ATI.
From: Ground Zero <[e-mail]>
Date: Tue, 22 Jan 91 18:07:55 EST

Dear ATI Readers:

Hello!!  Those of you who attempted to send mail to us may have noticed
that it bounced back or didn't make it here. Due to some changes in our
home site, ATI now has a new address. Our new address is:

       [e-mail]

As always, do send all correspondence to the above address and NOT the
address this message is comeing from (the one beginning with "zero-list").

Due to changes in our home site, the release of ATI54 has been delayed.
However, we're working on it, and you should expect to see ATI54
within a few days.
     See ya then!

++++++++++++++++++++++++++++++++++++++++++++++++++++

From: Nigel Allen <chinacat!uunet!contact![e-mail]>
Subject: Algorithm: A Newsletter for People Who Enjoy Programming
Date: Thu, 24 Jan 91 04:23 EST

Algorithm: A Newsletter for People Who Enjoy Programming

For one year now, A.K. Dewdney (author of Scientific American's popular
Computer Recreations column) has been publishing a newsletter (or is it a
magazine?) called Algorithm. Appearing bi-monthly, Algorithm features a
wide range of topics in each issue, mostly centered around fascinating
programming projects of the kind we used to see in Computer Recreations.
Besides Dewdney, Clifford Pickover (JBM's graphic genius), Michael Ecker
(formerly of Creative Computing) and Dennis Shasta (creator of the Dr. Ecco
puzzles) also write columns for Algorithm. Each issue features Algoletters
from vendors with projects and ideas to share, the four programming columns
just mentioned, stimulating articles and reviews of weird and wonderful
programs written by individuals and small companies.

The basic vehicle of Algorithm is algorithms. By specifying program ideas
in pseudocode, the publication makes them available in a
language-independent form. The emphasis in mainly recreational and (dare I
say it?) educational. Topics range from fractals and chaos to cellular
automata, scientific simulation and computer games. The scope is wide open
and engaging.

Anyone wishing a free inspection copy of Algorithm should drop a line to
Algorithm, P.O. Box 29237, Westmount Postal Outlet, 785 Wonderland Road,
London, Ontario, CANADA N6K 1M6. Alternatively, they can send me e-mail
([e-mail]) or reply to this message, and I'll forward the
request to Algorithm.

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: [e-mail](Steve Jackson)
Subject: More on What to Say when the Warrant Comes
Date: Sun, 2 Dec 90 12:54:28 cst

(1) Regarding "Don't Talk To The Police" in CuD 2.14: I question the
statement that

>He cannot legally place you under arrest or enter your home without a
>warrant signed by a judge.  If he indicates that he has such a warrant,
>ask to see it.  A person under arrest, or located on premises to be
>searched, generally must be shown a warrant if he requests it and must be
>given a chance to read it.

It is important to be VERY POLITE AND CAREFUL when refusing to cooperate
with police, unless you are locally powerful and have lots of witnesses.
And even then, politeness and care are worthwhile. Your "rights" can
evaporate instantly if you antagonize an officer, especially if there are
no disinterested witnesses. Your friends and family are not disinterested
enough to worry a hostile officer; he may arrest them, too.

Regarding "place you under arrest" - If, in the process of refusing entry
to a police officer, you demonstrate a "bad attitude," the officer may be
motivated to FIND a reason to arrest you. Any display of a weapon, any
possibly-illegal item or situation visible from where the officer stands,
any threat against the officer's person, or (depending on local law) any
behavior the officer can characterize as indicative of drunkenness or drug
use . . . BANG, you're under arrest. And, in some situations, the officers
can now search your home because they arrested you.  If, for instance, they
observed an illegal weapon, they can now reasonably suspect that there are
more. In the process of searching for more weapons, they will naturally
keep their eyes open for the original object of the search.

Regarding "signed warrant" - The general lay public believes, as I did
before March 1, that no search may be conducted if the police cannot show
you a signed search warrant. But *this does not appear to be true.* When my
office was invaded, the agents did *not* show a signed search warrant; they
showed a photocopy with many spaces, including the space for a judge's
signature, STILL BLANK.

Nevertheless, no resistance was made to their search. And it seems that
this is just as well. Later that day, when I asked my attorney what would
have happened if we had objected to the lack of a signature, I was told
"Everybody who resisted the search would have been handcuffed and taken
downtown for obstructing officers in the performance of their duties."

It appears - and I have been trying, to no avail, to get an authoritative
statement on this - that if officers HAVE a signed search warrant - or if
they believe that a judge has signed a copy of their warrant, even if they
themselves don't have a signed copy - then they can conduct a legal search.
In the latter case, they obviously can't show a signed warrant; they don't
have one!

My point is that the common belief that "they have to show you a SIGNED
warrant" may be a misconception that can get a citizen into serious trouble.
We really need to get an authoritative clarification on this.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: "Ofer Inbar" <[e-mail]>
Date: Wed, 23 Jan 91 13:02:55 est
Subject: Discussion of Dark Adept's articles (con't)

In CuD #3.03, file 2, David Daniel wrote a critique of Dark Adept's latest
essay.  Although much of David's essay was well thought out, there are
points which I think he should reconsider.

>manufacture and/or market it.  Mr. Adept expressed his belief that a user
>interface was generic. I'm sure we could find many hard working programmers
>who would heartily disagree as well as corporate executives who have
>overseen the expenditure of many thousands or man-hours and dollars in the
>development of a unique software product. Don't they deserve a return on
>their investment? Mr. Adept denies the existence of license agreements when

It's quite likely that the interface had already been developed by someone
else.  If it were not protected by some other company's legal department,
the corporation in question would never have had to spend thousands of
dollars on developing it in the first place.

If everyone has to spend money reinventing the wheel, it's only fair to
entitle them to some return on their investment.  But wouldn't it be nice
if the wheel was free to begin with?

If someone comes up with some interface that is truly new, they deserve
some protection for a limited time.  If their invention is really
wonderful, they will get back far more than they spent.  This is in fact
the reasoning behind patents.  However, patents have a life of seven years
(I think), which in most markets is a limited time but in the computer
world translates to eternity, since anything new is bound to be obsolete
long before seven years are over.

>their investment? Mr. Adept denies the existence of license agreements when
>he asserts that an inefficient company can tie up a good interface by tying
>it to a bad program. He also denies the idea of a joint marketing venture
>by two or more companies which combine their strongest products.

Mr. Adept does not deny the existence of these possibilities.  Nor, in
fact, does he deny the possiblity of the developer putting it's interface
in the public domain.  His complaint was about giving the developer the
power to tie things up.  Not every company has such enlightened attitudes.
Some, like Adobe, choose to charge exorbitant license fees; PostScript
could have been a unifying standard, but instead we are now seeing a
rebellion against Adobe which will result in several standards confusing
everyone.  Others, like Lotus, choose not to allow anyone to use their
interface, and sue everyone who tries.  Others, like Apple, appropriate
someone else's interface, and then take the same attitude as Lotus does.

>Mr. Adept wrote about the danger of protecting algorithms since they are
>merely mathematical models. Should we consider DOS and BIOS in the same
>category? Should these proprietary packages be freely circulated without
>compensation? It might be an attractive utopian concept but not workable
>within our present system.

Why is it not workable?  DOS and BIOS are far from just algorithms.  On the
other hand, shell sort is a clever algorithm, and I'm certainly glad
someone didn't try to patent it and charge license fees from every
programmer who used it.  Remember the scare when it seemed Unisys was going
to enforce their perceived rights to LZW compression?  Would it be good if
Unisys had the right to outright prohibit a programmer from using LZW
compression without prior written permission from them?

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++=


Subject: Dark Adept's Response to posts
From: Dark Adept <[e-mail]>
Date: Tue, 22 Jan 91 23:57:25 CST

First, I would like to thank everyone who had a comment, criticism, or
suggestion about my previous articles. I take all such comments to heart,
and try to improve my thinking and writing processes with them.

Second, I feel some of the criticisms have been my fault. I will try to
briefly clear these areas up:

1) When refering to IBM's "release" of their operating system, I was
talking about BIOS, not DOS.  DOS is, of course, the property of Microsoft
and/or IBM depending on whether it is MS or PC.  I apologize for this
misunderstanding.  BIOS is IBM's own product.  I did not mean to
misrepresent anyone.

2) My use of the masculine pronouns is intended to be generic.  This usage
comes from how I was taught English.  I stand by it.  I have yet to see an
English grammar manual that states this is an incorrect usage.  I try to
write in standard formal English, and this is how I was taught.

3) "his [first] wife's maiden name" is actually a line from the Hacker's
Anthem by the Cheshire Catalyst.  It was meant as an inside joke.  Still, I
have not met a female system operator -- yet.  I hold no malice toward any
women in the computer field, and I apologize.

4) I thank David Daniel for representing the corporate voice re patents and
copyrights.  However, I never stated DOS and BIOS were algorithms and
should be free. Yet the way they interface programs should be in the public
domain (DoubleDos and 4DOS come to mind?). Also, certainly, proprietary
source and object code should be protected.  I was attempting to say the
output generated (i.e., the interface) and the algorithm that creates it
should not be protected.  I do not know whether this changes his position
or not, but I feel that my position should be clear.

Again, thank all of you for your comments and articles that have responded
to mine.  The more opinions all of us receive, the more all of us can
learn.  This was my goal, and it appears that I have succeeded.

The Dark Adept

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Reprint from BMUG (Berkeley MacIntosh Users' Group)
Subject:  BMUG's ECPA Commentary (reprinted with permission from BMUG
Date:     January, 1991

********************************************************************
***  CuD #3.04, File 3 of 4: The Politics of the ECPA of 1986    ***
********************************************************************

The Politics of the Electronic Communications Privacy Act of 1986

Copyright (C) 1990, Bernard Aboba.  All rights reserved.

The Electronic Communications Privacy Act (ECPA) of 1986 was a landmark
piece of legislation which is likely to affect online services and hobbyist
bulletin boards for many years to come.  Since the ECPA is a complex and
often arcane piece of legislation, it is very hard to understand without
looking at the history of how it came to be.   In understanding the
politics of ECPA, this article relies heavily on the transcripts of the
House Judiciary Committee Hearings on H.R. 3378, which eventually became
the Electronic Communications Privacy Act.

During the hearings on ECPA in 1985-86 only one member of the online
service industry, The Source (subsequently acquired by Compuserve)
submitted an opinion.    Though endorsing the bill, the assessment hinted
at possible long term costs imposed by the lack of preemption of state
standards.  However, this one page assessment hardly made an impression on
the hearings compared with the impressive lineup of spokesmen from the
ACLU, cellular communications firms,  Regional Bell Operating Companies
(RBOC's), broadcasting groups, credit and banking firms, and computer and
telecommunications industry associations, all lined up in support of the
bill.

Only the U.S. Department of Justice, manufacturers of scanning equipment,
and amateur radio associations expressed strong reservations about the
bill. However, since the passage of ECPA, the long term costs of the
legislation and its effects on commercial and hobbyist conferencing systems
have become apparent.  Ironically, none of these effects were anticipated
at the hearings.

Outline of ECPA

Broadened Protection of Communications

The ECPA amended the Omnibus Crime Control and Safe Streets Act of 1968
(which covered wire tapping of common carriers) to prohibit monitoring of
all electronic communications systems not  designed to be accessible by the
public.  This includes voice, data, and video on non-public systems, and
applies to communications regardless of the mode of transmission.

Search and Seizure

To obtain access to communications such as electronic mail, the government
is required to obtain a warrant on probable cause.  Law enforcement must
also obtain a court order based on reasonable suspicion before obtaining
toll records of telephone calls.or gaining access to records of an
electronic communications system which concern specific communications.

Criminal Penalties

Criminal penalties can result from unauthorized access to computers if
messages are obtained or altered.  Felony charges can be brought if the
violation was commited maliciously or  for commercial gain, in which case
the act is punishable by up to one year imprisonment and a $250,000 fine.
In other cases, a term of imprisonment of six months and a maximum fine of
$5,000 is applicable.

Civil Penalties

Civil damages may be pursued for violation of the rights contained in the
act.

Disclosure

Electronic communications systems operators may not disclose electronic
messages without authorization except in special circumstances.  The
Politics of ECPA

The ECPA was supported by the cellular phone, telephone, packet switching,
paging, and broadcasting industries;  private firms owning large
communications networks,  miscellaneous computer and communications trade
associations,  the ACLU and Consumer's Union, and credit bureaus. Law
enforcement agencies were supportive, but skeptical. The only vigorous
opposition came from amateur radio associations,  and manufacturers of
scanning equipment which, while protesting loudly, saw few of their
recommended modifications enacted into law.

Also playing a role were sponsoring legislators, such as Senator Patrick
Leahy of Vermont, and Charles Mathias of Maryland, as well as
Representatives Robert Kastenmeier and Carlos Moorhead.  Senator Leahy, in
his opening remarks at the hearings on the bill, set the stage for the
legislation:

"At this moment phones are ringing, and when they are answered, the message
that comes out is a stream of sounds denoting ones and zeros.... What is
remarkable is the fact that none of these transmissions are protected from
illegal wiretaps, because our primary law, passed back in 1968, failed to
cover data communications, of which computer to computer transmission are a
good example.  When Congress enacted that law,Title III of the Omnibus
Crime Control and Safe Streets Act of 1968, it had in mind a particular
kind of communication - voice - and a particular way of transmitting that
communication - via a common carrier analog telephone network.   Congress
chose to cover only the "aural acquisition" of the contents of a common
carrier wire communication.  The Supreme Court has interpreted that
language to mean that to be covered by Title III, a communication must be
capable of being overheard.  The statue simply fails to cover the
unauthorized interception of data transmissions."   Senator Leahy also had
more practical reasons for supporting the bill.   The rapidly growing U.S.
cellular communications industry had become alarmed by the ease with which
cellular communications could be monitored.  Television sets built during
the period 1966-1982 were capable of picking up cellular conversations on
UHF channels 80-83.  This was possible because cellular communications used
the same frequency modulation techniques utilized in transmitting
television sound. In addition, scanning equipment which  for several
hundred dollars was capable of receiving cellular communications in the 800
Mhz band.     During 1985, several incidents threatened to make the
vulnerability of  cellular communications into front page news.  For
example, private conversations of state legislators in Austin were
intercepted and made available in the public press, with embarrassing
consequences.

This ease of reception threatened the viability of the cellular industry.
In response, according to Richard Colgan of the Association of North
American Radio Clubs, "cellular firms resorted to pervasive
misrepresentation of the actual interception vulnerability of cellular. "
In fairness to the cellular industry, cellular communications does provide
certain inherent protections against interception.  For example, since each
half of the conversation is transmitted on different frequencies, usually
it is only possible to listen in on one side of a conversation.  In
addition, while it is easy to pick up some conversation, it is difficult to
pick up a particular conversation of interest.  Also, the frequencies will
shift during passage from one cell to another.  However, given the
relatively large cell size, frequencies are likely to be stable over the
average life of a call.    In his remarks, Senator Leahy stated that the
ECPA was needed to help the cellular industry get off the ground,  and that
the American people and American business wanted the ECPA.   A more
emotional defense was made by John Stanton, Executive VP of McCaw
Communications, who stated "The inhibition of the growth of cellular
technology and paging technology, forced by the lack of privacy, is
unfair."

Law enforcement interests and businesses were also in favor of the bill.
In 1986, the nation was just becoming aware of the threat posed by computer
crime, and the need for laws allowing prosecution of perpetrators.  The
ECPA was therefore viewed by elements of law enforcement and business as a
vehicle for criminalizing the act of breaking into computers.   Businesses
such as GTE Telenet, EDS, and Chase Manhattan thus supported the ECPA as a
computer crime bill.  Telephone companies such as AT&T even attempted to
tack on additional computer crime provisions covering breaking into to
their switching equipment.

In retrospect, the preoccupation with computer crime distorted evaluations
of the ECPA.  Computer crime was more effectively addressed by state penal
code revisions such as California Penal Code Section 502 - Computer Crime,
and Section 499c - Trade Secrets.   The purpose of ECPA was to insure
privacy rather than to define  the criminal uses of computers.

The cellular industry had no such illusions.  Mr.  Philip Quigley, CEO of
pacTel Mobil Co.  described the economic benefits of ECPA by noting that
without legislation, "defending the right (to privacy) could take years of
litigation."  "Individuals can use scanning devices today... (it is our
intent) to merely excise out... the capability that exists today to zone in
on the channels and the frequencies that are associated with cellular
telephony." Without the ECPA, the industry would have faced incorporation
of expensive encryption technology into their systems.   For example, John
Stanton of McCaw testified that "Encryption devices make it difficult to
roam  from system to system," generated scratchy sound, and required 30%
more investment for the base unit, and 100% for the phone.     Mr. Colgan's
estimated high grade commercial encryption as costing $40 for the
encryption chip (quantity one), plus associated circuitry .  In either
case, the net cost for several million subscribers was estimated in the
tens if not hundreds of millions of dollars.

Industry associations such as ADAPSO pointed out the trade benefits of the
legislation, since Asia had not developed privacy protection, although
Europe had done so.   John Stanton of McCaw commented  that if the U.S.
passed the ECPA, then it would enjoy superior communications privacy to
that available in Europe.

Representatives of the nation's amateur radio enthusiasts were among  the
staunchest opponents of the bill.  Richard Colgan  of the Association of
North American Radio Clubs represented their position.  "While we have no
animosity towards cellular, we cannot sit idly by while they use their
influence to make dubious changes in public policy, largely to benefit
their bottom lines..." In response to the concerns of amateur radio
enthusiasts, and scanner manufacturers, the interception standard was
changed from "willful" to "intentional," so as to allow for "inadvertent"
interceptions.

Manufacturers of scanning equipment were vigorously opposed to ECPA since
the use of their devices was restricted by  the act.  Richard Brown of
Regency Electronics, a manufacturer of radio band scanners,  argued
cellular radio licensees have never had any expectation of privacy,  that
cellular operators, not the public, should bear the burden of securing
cellular communications, and that protecting specific radio frequencies was
imprudent.

This last point deserves elaboration.  Under ECPA, monitoring of cordless
phone frequencies is not prohibited, although it is hard to argue that the
average individual's "expectation of privacy" is any different for a
cordless phone than it would be for a cellular phone.   In fact, an
educated individual might even expect less privacy for a cellular call,
argued  Richard Colgan, because the range of cellular communications is so
much larger than for cordless phones, thus making interception easier.

Among the most careful analyst of the ECPA was the U.S. Department of
Justice, as represented by James Knapp, deputy assistant attorney general
of the criminal division. Knapp concurred with the Amateur Radio
enthusiasts that cellular and cordless phone technology, as well as tone
and voice pagers, were easily intercepted, and therefore could not presume
an "expectation of privacy." Knapp also expressed skepticism about the
wisdom of criminalizing hobbyist behavior.   Knapp was however in favor of
extending coverage to electronic mail.  Finally, he argued for extension of
the crimes for which wire tapping could be authorized, beyond those
enumerated in Title III.  This suggested modification to the act was
subsequently incorporated.

In contrast to the detailed arguments submitted by the parties discussed
above, the one page letter submitted by The Source had a minor impact at
best, suggesting that the ECPA, by not preempting state statutes, could
expose the online service industry to an entangling web of federal and
state statutes.

Analysis of the Economic Effects of ECPA

The parts of ECPA which have ramifications for online services and hobbyist
bulletin boards mostly have to do with access to stored messages.  While
access to services are often offered via a packet switching network,  or
could even be achieved via use of cellular modems or other radio
transmissions, worries about the privacy of such access are not likely to
be major concerns of  customers.

An important aspect of ECPA is the presence of both criminal and civil
penalties.   This provides an important incentive for aggrieved parties to
pursue litigation through contingency fee arrangements.  The implications
of this for the online service business are serious.  For example, the fee
for sending an EasyPlex message on Compuserve is on the order of a few
dollars, depending on the time spent in composing the message.  For that
fee, Compuserve takes on the responsibility of not disclosing the message,
which could conceivably be worth millions to the sender and intended
recipient.


Firms Submitting Opinions on H.R. 3378


Phone Companies

Southwestern Bell
AT&T
Ameritech
Pacific Telesis
Bell South
Northwestern Bell
United States
Telephone Assoc.

Radio

Association of North American Radio Clubs
American Radio Relay League
National Association of Business & Educational Radio

Cellular

PacTel Mobile
McCaw Communications
Motorola
Centel

Hobbyists


Communications

Packet Switching

GTE Telenet

Misc. Associations

Electronic Mail Association
ADAPSO
National Assoc. of Manufacturers
Assoc. of American Railroads
IEEE

Paging

Telocator Network

Computers

Tandy

Law Enforcement

U.S. Dept. of Justice

Online Services

The Source

Citizen's Groups

ACLU
Consumer's Union


Firms with Private Networks

Chase Manhattan
EDS

Scanner Manufacturers

Dynascan
Regency Electronics
Uniden

Credit Bureaus

American Credit Services

Broadcasters

National Assoc. of Broadcasters
Radio-TV News Directors Association
Satellite TV Industry Association
CBS


Source:    Hearings, Committee on the Judiciary, House of
Representatives, H.R. 3378, ECPA, 99th Congress, No. 50, 1986.

Of course, this burden is not theirs alone.  Operators of corporate
communications systems (who were big supporters of ECPA) are also
likely targets.   Indeed,  several ECPA suits against employers and
municipalities have recently been filed.  The potential for
litigation  also exists for hobbyist systems such as computer
bulletin boards.

Government regulations fit into two categories:  economic
regulation, and social regulation.  In the economic category are
price controls on crude oil, and tarriffs.  Equal opportunity
legislation is a regulation of the social type. The cost of a
social regulation can be broken down into two parts.  One is the
cost of complying with the regulation, either by modification of
business practices, or payment of imposed penalties;  another is
the cost of resolving ambiguities in the legislation through
establishment of case law. In the case of ECPA, reflection
discloses that the establishment of precedent is likely to be the
more expensive than compliance.  For example,  for a service to
modify sysop access privileges, and to introduce encryption of
private mail and passwords would probably entail an expenditure on
the order of a few million dollars  for software development and
testing.   In contrast, were only 0.01% of  Compuserve's
subscribers to file an ECPA lawsuit, given 500,000 subscribers, and
average legal fees and penalties per case of $100,000, the bill
would come to over $10 million.

Due to its concentration on cellular industry concerns, the ECPA
concentrates more on insuring  privacy for  users than on limiting
the responsibilities of providers. Due to differences between
messages in transit and stored messages, cellular firms end up
forcing the costs of privacy onto hobbyists and outsiders, while
providers of online services are forced to bear these costs
themselves.  In view of the potentially horrendous litigation
burdens,  there is a strong incentive to limit the ability of
system administrators to read or disclose private mail.

The key to complying with the act is the notion of "expectations of
privacy." This notion governs both the legal aspects of ECPA, and
determinants of end user satisfaction.  Under the ECPA, privacy is
only enforced for systems in which users were lead to "expect
privacy."  Thus a sysop has two alternatives: to explicitly address
those expectations via an education campaign, or to play a game
similar to the cellular industry, in denying that privacy is a
significant issue.  One of the concerns voiced by the cellular
industry in backing ECPA was that their budding industry could ill
afford the cost of solidifying the right to privacy via litigation
or adoption of encryption technology.  Yet that is precisely the
course that the ECPA has forced on the online service industry.
Nor were the concerns of a budding industry entirely genuine.
Within the next two years,  the revenues of cellular communication
firms will exceed those of all the participants in the information
services industry.

Bibliography

1.  Electronic Communications Privacy Act of 1986, Public Law
99-508,  99th Congress, 2nd session.

2.  Hearings of the Committee on the Judiciary, House  of
Representatives, H.R. 3378, Electronic Communications Privacy Act,
99th Congress,  No. 50, 1986.

3.  California Penal Code, Section 502, Computer Crime, 502.7
Obtaining telephone or telegraph services by fraud, 499c, trade
secrets.

4.  Wallace, Jonathan, and Lance Rose, SYSLAW, L.L.M Press, New
York City, 1990

********************************************************************
                           >> END OF THIS FILE <<
***************************************************************************

------------------------------

From: Various
Subject: The CU in the News
Date:  January, 1991

********************************************************************
***  CuD #3.04, File 4 of 4: The CU in the News                  ***
********************************************************************

Subject:  Lotus Drops Suit
From:     Anonymous
Date: Sun, 24 Jan 91 01:21:00 EST

From: New York Times, January 24, 1991, p. C3 (By Lawrence M. Fisher)

SAN FRANCISCO, Jan. 23 - The Lotus Development Corporation and Equifax Inc.
said today that they had canceled plans to sell a database of names,
addresses and marketing information on 120 million United States consumers.

The companies said their decision came after they had received 30,000 calls
and letters from individuals wishing to have their names and personal
information deleted from the database. The companies said they believed the
public misunderstood the product and that the costs of addressing privacy
concerns had made Marketplace:Households no longer viable.

Lotus will also discontinue Market-lace:Business, a similar product with
information on seven million United States businesses, which began shipment
in October. Mr. Manzi said the business product was not viable without the
revenues from the consumer version."

+++++++++++++++++++++++++++++++++++++++++++++++++++

From: cdp![e-mail]
Subject: CPSR FOIA Suits Seeks Gov't Computer Policy
Date: Sun, 13 Jan 91 19:20:35 PST

PRESS RELEASE
Release: Friday, 1/4/91

CPSR Washington Office, 1025 Connecticut Ave., NW, Washington
DC  20036

For more information:

David Sobel
Marc Rotenberg  202/775-1588

LAWSUIT SEEKS BUSH DIRECTIVE ON COMPUTER SECURITY

WASHINGTON - Computer Professionals for Social Responsibility ("CPSR") filed
a lawsuit in Federal District Court today to obtain a classified government
directive on computer security.

The document at issue was signed by President Bush on July 5, 1990.  It is
intended to replace a controversial security policy signed by President
Reagan in 1984.  The Reagan policy, designated  "NSDD 145," put the
super-secret National Security Agency ("NSA") in charge of computer
security, raising concerns about government secrecy.  Congress sought to
limit NSA's role through passage of the Computer Security Act of 1987, which
transferred responsibility for federal computer security to the National
Institute for Standards and Technology, a civilian agency.

The administration contends that the revised directive complies with the
Computer Security Act, but so far has released  to the public only an
unclassified summary of the new directive.  According to Marc Rotenberg,
Director of CPSR's Washington Office, "Computer security policy should not
be made behind closed doors or through the issuance of classified
directives.  At a time when computer technology touches every aspect of our
lives, it is essential that the public be fully informed about our
government's policy."

CPSR first requested a copy of the revised directive from   the Defense
Department under the Freedom of Information Act last August.  The
organization also sought a copy from the National Security Council the
following month.  To date, neither agency has responded to CPSR's requests.

The Freedom of Information Act provides a legal right for individuals to
obtain records held by government agencies.  According to CPSR Legal Counsel
David Sobel, "Agencies are required to respond to requests within ten
working days.  When agencies fail to respond within a reasonable period of
time, requesters often begin legal proceedings to obtain the information."

CPSR is a national membership organization of computer scientists.  Its
membership includes a Nobel Laureate and four recipients of the Turing
Award, the highest honor in computer science.  CPSR has prepared reports and
presented testimony on computer technology issues, including NSDD 145, at
the request of Congressional committees.

The case is CPSR v. National Security Council, et al., Civil Action No.
91-_____, U.S. District Court for the District of Columbia, January 4, 1991.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

From: well![e-mail](Michael Edward Marotta)
Subject: Thoughts on the Bill of Rights
Date: Tue, 22 Jan 91 21:52:34 pst

GRID News. vol 2 nu 2. January 23, 1991.
World GRID Association, P. O. Box 15061, Lansing, MI  48901 USA
--------------------------------------------------------------------
"The Bill of Rights" by Michael E. Marotta. (54 lines)

When agents of the US Secret Service raided publishers in 1990 while chasing
The Legion of Doom, they demonstrated that the paradigms of cyberspace are
not well understood.  Therefore, identifiers must be used to show that this
activity is protected by the Bill of Rights.

Copyright notices are one identifier.  A copyright is earned whenever an
idea achieves physical expression or "realization".  Two copies of the
publication (or two photographs of a work of art) are send to the Library of
Congress along with a registration fee.  Books, sound recordings, and films
may be copyrighted.  A copyright can be given to the mass production of a
work in the public domain, such as the Bible.  You could write out by hand
an original poem, send two xeroxes to the Library of Congress (along with
the registration fee) and earn a copyright on your work.

When the United States joined the Berne Convention in December of 1988
(effective March 1, 1989), life became easier --- perhaps too easy.  By
default, every realization is automatically copyrighted to the creator,
whether or not copies are sent to the Library of Congress.  A copyright
notice on the login screen announces that the BBS contains works of
non-fiction, fiction, art or other production that are protected by the
First Amendment.

The First Amendment also promises that the People have the right to
PEACEABLY ASSEMBLE to seek redress of grievances against the government.  A
BBS is an assembly and can host assemblies.  The Supreme Court has often and
consistently shown that this right to peaceably assemble is also the right
to association.

Most BBSes support message bases.   Discussions on religion are specially
protected by the First Amendment.

The Bill of Rights contains two purposely broad articles, the Ninth and
Tenth.  The Ninth Amendment says that there are more rights than the ones
listed in the Bill of Rights.  The Tenth Amendment limits the federal
government to its enumerated powers and gives all other powers to the States
(except where prohibited) or to the People (apparently without special
reservation or stipulation).  For instance, without stretching the meaning
of "religion" or requiring that we photograph blackboards, it is strongly
argued that there is a Right to Scientific Inquiry.  This strongly
assertable right protects experiments with encryption algorithms.

There may be a Right to Travel.  This would extend to the lawful use of
communication systems to "visit" a computer, whether or not you actually
"enter" the computer.  (Internet syntax tolerates users who chat though not
logged in.)

To the extent that a computer is a weapon, its ownership is protected under
the Second Amendment.  Indeed, when Saddam Hussein's storm troopers rolled
into Kuwait, "Hack Iraq" messages appeared on some systems.

The Bill of Rights is your Best Friend.  Sleep with it.

********************************************************************

------------------------------

                           **END OF CuD #3.04**
********************************************************************