The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/cud/cud437.txt

Text File | 2003-06-11 | 44.1 KB | 930 lines

Computer underground Digest    Thur Aug 20, 1992   Volume 4 : Issue 37

       Editors: Jim Thomas and Gordon Meyer ([e-mail])
       Copy Editor: Etaion Shrdlu, III
       Archivist: Brendan Kehoe
       Shadow-Archivist: Dan Carosone

CONTENTS, #4.37 (Aug 20, 1992)
File 1--Re: Cu Digest, #4.36
File 2--Ripco the Victim of Misinformation?
File 3--Response to Privacy Times Article
File 4--Re: Quick reality check.....
File 5--Pager Fraud Conviction (Telecom Digest Reprint)
File 6--Calif. Woman Convicted in Computerized Tax Refund Scheme
File 7--EFF Receives Dvorak/Zoom Award
File 8--Pac-Bell's Privacy Rings False (CPSR Press Release)
File 9--CPSR 1992 Annual Meeting

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost from [e-mail]. The editors may be
contacted by voice (815-753-6430), fax [phone]) or U.S. mail at:
Jim Thomas, Department of Sociology, NIU, DeKalb, IL 60115.
Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL0 and DL12 of TELECOM; on Genie in the PF*NPC RT
libraries; from America Online in the PC Telecom forum under
"computing newsletters;" on the PC-EXEC BBS at [phone]; and by
anonymous ftp from ftp.eff.org (192.88.144.4) and ftp.ee.mu.oz.au
European distributor: ComNet in Luxembourg BBS (++352) 466893.

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted as long as the source
is cited.  Some authors do copyright their material, and they should
be contacted for reprint permission.  It is assumed that non-personal
mail to the moderators may be reprinted unless otherwise specified.
Readers are encouraged to submit reasoned articles relating to
computer culture and communication.  Articles are preferred to short
responses.  Please avoid quoting previous posts unless absolutely
necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

----------------------------------------------------------------------

Date: Sun, 16 Aug 92 19:13:54 -0700
From: [e-mail](Nelson Bolyard)
Subject: File 1--Re: Cu Digest, #4.36

In article <[e-mail]>
[e-mail](John Higdon) writes:

>After having eight of my residence phone numbers changed, I suddenly
>realized that my Pac*Bell Calling Card was invalid. I called the
>business office and explained that I wanted a new card. No problem. In
>fact, I could select my own PIN. And if I did so, the card would
>become usable almost immediately.

>Do you see where I am going with this? No effort was made to verify
>that I was who I claimed to be, even though my accounts are all
>flagged with a password. (When I reminded the rep that she forgot to
>ask for my password, she was highly embarrassed.) If I had been Joe
>Crook, I would have a nice new Calling Card, complete with PIN, of
>which the bill-paying sucker (me) would not have had any knowledge. By
>the time the smoke cleared, how many calls to the Dominican Republic
>could have been made?

To which [e-mail](Jerry M. Carlin) replies:

>All I can say is that we're trying. As I pointed out earlier in this
>conversation, it all comes down to people. A mistake was made, no
>doubt about it.  Can be do a better job than we are doing? We're
>trying to. Is being Ok enough? As the current advertising slogan says
>"Good enough isn't". This slogan has to translate into real action.

What Rubbish!  It doesn't "come down to people".  At least, it need not.
The _computer_ should enforce the right password to modify the account,
not the customer rep, and the rep should never SEE the customer's password.

The way PACBELL's existing account "password" program apparently works,
(information gleaned entirely from public sources of information, including
postings to TELECOM-digest and the CU digest) the account holder's
password is displayed on a screen, and it is a human's job to verify that
the customer speaks the right value.  This system was obviously designed
by someone who didn't have a CLUE about security.

The system should have been designed so that when an account has a
password, ANY attempt by a customer service representative to access or
modify the account will be blocked until the password is entered by the
rep (who presumably has just gotten it from the person on the phone, the
alleged customer).  I suppose some "supervisor override" password might
exist so accounts could be managed when the real customer was dead, but
any transactions done using the override password would render the user of
that password (e.g. supervisor) _personally_ liable if the actions proved
fraudulent (not properly authorized).

One final note to all this whining about "we're trying".  I'm reminded of
parents who teach their children that it's OK to fail "as long as you
tried your best".  Not one of us who holds a job is ever held up to that
ridiculously low standard of performance.  No business ever survives by
holding itself to that standard.  It's galling that PacBell should expect
us to apply that standard to them, especially given their regulated
monopoly.

If PacBell had any competition as a LEC, and that competitor used
real (not pretend) password account security, they'd stop this whining
and do something about it pronto, while customers went to the competitor
in droves.
--
Nelson Bolyard           MTS Advanced OS Lab           Silicon Graphics, Inc.
[e-mail]     {decwrl,sun}!sgi!whizzer!nelson     415-390-1919
Disclaimer: I do not speak for my employer.
--



------------------------------

Date: Mon, 17 Aug 1992 19:27:13 PDT
From: Jim Thomas <[e-mail]>
Subject: File 2--Ripco the Victim of Misinformation?

The dangers of erroneous or fraudulent information can be demonstrated
in the abuses of Operation Sun Devil and the "Bill Cook cases."
Inaccurate interpretations, questionable "facts" and glib language of
posts were used to weave an imagery of a dangerous national conspiracy
of hackers intent in disrupting or destroying Life-As-We-Know-It. The
Secret Service claimed that a post describing Kermit as a 7-bit
protocol was evidence of a conspiracy; Bill Cook described publicly
available documents as a map of the E911 system, implying that those
who possessed it could endanger national safety and security; Henry
Kluepfel identitied to the Secret Service "hackers" who are presumably
the CuD moderators; BellSouth claimed that information available in a
document costing under $15 was worth several hundred thousand dollars.
These claims were used as the basis for raids, indictments,
prosecutions, and the disruption of lives and business enterprises who
fell victim to the abuse of misinformation.

Ripco BBS was a victim of the Sun Devil raids in May, 1990.  Although
there was no evidence that the sysop, Dr. Ripco, ever engaged in the
crimes for which he and others were suspected, and no user of his
board was indicted for the suspected crimes, and no material on his
board was ever adduced in court in the prosecution of others, he lost
equipment, books, posters, and other items. Dr. Ripco was victim of
misinformation.  Because of the manner in which law enforcement has
written search affidavits and indictments drawing from inaccurate
information, gross reporting of potentially damaging "facts" cannot go
without response.  An article appearing in the July 30 issue of
Privacy Times (PT), written by Evan Hendricks the editor, is the kind
of article that requires a swift reaction.

The article is "Hacker 'Manual' Tells 'Wannabes' how to Penetrate TRW
Database." Although Ripco is mentioned in only one sentence, it is a
damaging choice of words.

The article itself describes a "hacker file" detailing how to obtain
access to a TRW account, login to the TRW system, find and download
information, and interpret the information once obtained.  The
author(s) of the TRW file, dated April, 1992, write in the style of
the juvenile anarchists who fantasize mindless destruction of "The
System," and who self-define themselves as "great criminal minds." The
PT article itself is well-intended: The goal seems to be to
raise the visibility of the security weaknesses of the TRW data base
and simultaneously to dramatize the sociopathic tendencies of those
who, as Cliff Stoll might say, put razor blades in the sand.  But
there is one dangerously inaccurate line in the PT story that cannot
go without response:

         "Entitled 'TRW.Masterfile,' the manual was published on
     the 'Ripco' bulletin board by two authors who identify
     themselves as 'CitiZen-One" and "Evil Priest."

Dr. Ripco responds to this in the following file. But, as a long-time
user of Ripco BBS, I searched my own files and discovered the
following:

1) There is *NO* such TRW file listed in the file lists
2) There is one Evile Priest and one citizen-0ne listed, but
   neither are regular users. As of August 15th, the former
   has not signed on since January, 1992, and the latter hasn't
   signed on since April, 1992. Neither was listed logs prior
   to January, 1992 that I could find.

The TRW file in question can probably be found on a number of boards.
Assuming that the copy I have obtained is identical to the file
reported in PT, it would appear to contain no illegal information.
Although a "how to" manual, it falls within literature protected under
the First Amendment. Although it is poorly written (a Grammatik check
rates it as incomprehensible), poorly conceived and argued, childishly
simplistic, and quite silly, it reveals little about TRW and contains
no proprietary information. To its credit, PT does not sensationalize
the document, and the point of the TRW story is not to create hysteria
about the dangers of hackers, but appears instead to be simply
describing a variant of "anarckidz."

However, CuD *strongly* condemns the unsubstantiated allegation that
the file was "published" on Ripco.  This is a distortion of how files
are created and disseminated and implicates a BBS and its sysop in
activities over which the sysop has no knowledge.  This creates an
association between illegal behaviors and Ripco that is not only
erroneous, but dangerous.  It puts the board and its users at risk for
continued law enforcement excesses on the basis of what appears to be
unsubstantiated claims of the kind that have been previous
justifications for searches and seizures.

Misinformation also creates the possibility that the line will be
picked up by other media and repeated as true. This occured with the
Privacy Times article. James Daley, of Computerword, received a fax of
the PT piece, and repeated the allegation in his own column in the
August 17 issue of Computerworld without checking the accuracy, without
calling Evan Hendricks at Privacy Times, and without calling Ripco.
Daley writes:

    "Two unidentified persons have used the "Ripco" bulletin board
     to electronically publish a detailed manual, complete with
     dial-up numbers, geographical codes and methods for conning
     bureau subscribers into divulging their passwords, for
     penetrating TRW's credit bureau data base." (p. 47)

Seemingly trivial one-liners, like viruses, have a way of spreading
their destructiveness.  And, just parenthetically, if, in a term
paper, a student reproduced material without acknowledging the
original source, as the Computerworld article did in reproducing the
Privacy Times piece without acknowledging the original author, I would
raise the question of plagiarism.

If I am correct in my belief that the files were never available on
Ripco, I wonder why PT (and Computerworld) made the claim that they
were? From what source *did* the writer of the PT article obtain the
files? If the article's allusion to Ripco was based on a line in the
file itself indicating that the authors of the file could be contacted
on Ripco, then why wasn't mention made of other boards (in Florida)
also mentioned?  Why did the writer of the PT article make no attempt
to contact Dr. Ripco? He is accessible, articulate, and quite open.
Ripco's number was included in the file, making contact readily
possible if the author tried.

I contacted the author of the PT article, editor Evan Hendricks.
Evan shared my concern that if the facts were as I presented them,
then the choice of words was unfortunate.  He explained that,
especially in technical matters relating to computer technology, he
relies on informants. In this case, his informants indicated that the
files were "published" (and available) on Ripco. He indicated that he
would have to check with his informants to clarify the apparent
discrepancy between their account and ours. I agree (and fully
sympathize) with Evan on one point: Sometimes secondary facts that are
not immediately relevant to the primary focus of a story appears too
minor to check. I am convinced of Evan's good faith, and readers of
Privacy Times informed CuD that Evan has taken an aggressive and
principled stand against excesses of the Secret Service in Steve
Jackson games.  I also agree that the offending sentence is of the
kind that is normally innocuous and the result of a seemingly minor
informant error translated into a vague phrase. In this case, however,
the phrase could possibly re-appear in an indictment.  Evan must, of
course, check the accuracy of my account in challenging the
availability of the TRW file on Ripco. However, he assured me that if
my account is accurate, he will correct the mistake.

The intent here is not simply to criticize Privacy Times or its
editor.  Evan impressed me as concerned, sincere, and highly
interested in many of the same issues as CuD, EFF, and others.  Of
broader relevance is the way that the media often represent the
computer culture and the ways in which the participants in that
culture respond. In my own experience, most reporters and editors
appreciate being informed of alternative interpretations and accurate
facts. Sometimes "corrections" are over minor and inconsequential
details of no import.  At other times, they can be vitally important
to rectifying potentially damaging depictions. Either way, gentle but
explicit dialogue with the media is crucial to reducing the
misunderstandings offered to the public.  In this case, I am confident
that Privacy Digest and Computerworld will "do the right thing" by
checking the accuracy of their allegations. If they find they were in
error, I am equally confident that they will retract it.

((Despite my criticism of this particular article, Privacy Times is
considered a reputable and helpful source of information on law,
government policy, and other issues related to intrusions into and
protections of Constitutional rights.  It is subscriber-sustained and
contains no advertising.  Examination copies are available, and
subscriptions run $225 a year. For more information, contact Evan
Hendricks, Editor; Privacy Times; PO Box 21501; Washington, D.C.,

((ADDENDUM: Media persons wishing to contact Ripco BBS may do so at
[phone]. If the lines are busy, which they often are because of
its nearly 1,300 users, messages sent to Dr. Ripco at
[e-mail] will be immediately forwarded))

------------------------------

Date: Sun, 17 Aug 92 19:31:08 CDT
From: Dr Ripco <Ripco BBS>
Subject: File 3--Response to Privacy Times Article

In the July 30, 1992 issue of Privacy Times (v12, #15), a story appears
on page one entitled "Hacker 'Manual' Tells Wannabes How To Penetrate
TRW Database'. Within this article my board, "Ripco" is mentioned in a
manner that implies "the manual" is either available or was sanctioned
by myself or the system.

This is totally false.

The way I see it, the author of the article either failed to check
facts or simply irresponsibly reported misinformation. No one from this
newsletter has ever contacted me and to the best of my knowledge ever
attempted the same.

The first sentence of paragraph two reads as follows:

    >"Entitled 'TRW Masterfile,' the manual was published recently on
    >the 'Ripco' bulletin board by two authors who identify themselves
    >as 'CitiZen-One' and 'Evil Priest.'"

This document has never been "published", distributed or been
available in any other form on my system. By checking the logs I have
determined that a user by the name of Evile Preist did call the system
once in January of 92 but no activity was shown on the account. In
April of 92 a user by the name of Citizen-0ne called 5 times and did
in fact upload a file called "TRW_MAST.TXT" on or around April 28th.

That file was immediately removed from the uploads directory by myself
under the strict rules I self-imposed after being victimized by
Operation Sundevil.  The uploads on my system are locked and cannot be
downloaded by anyone until I clear the lock. Therefore, it was
impossible for it to be downloaded during th time it was first
uploaded and removed.

The logs, which I examined using the bulletin board program that
generates a complete listing of uploads and downloads, support my
claim. A record is made every time a file is either uploaded or
downloaded. This file shows one upload, no downloads.

Citizen-0ne and Evile Preist were never regular users of the board. I
do not know either one of them and never have had any contact with
them that I am aware of. Within the TRW_MAST.TXT file, my system along
with its phone number is mentioned but I have no idea why. The cDc
(Cult of the Dead Cow) is also mentioned but this does not appear in
the article.

I cannot control being mentioned in any file. Bulletin board names as
far as I know are not copyrighted or trademarked and it's been a
tradition for people who write files to stick a plug in for their
favorite system or two.  Why my system is mentioned by authors who
appear to rarely use it is beyond me.

I have doubled checked most (if not all) of the files on my system
including a telecommunications newsletter and neither this file nor
any part of it is or ever on my system available to the users.

The two words "published recently" on the Ripco bulletin board
contained in the Privacy Times newsletter (p. 1) is absolutely,
unequivocally, and egregiously false.  Besides, the correct name of
the system is "Ripco ][", because the original "Ripco" was removed
from service by the Secret Service on May 8 of 1990.

                                    Dr. Ripco

------------------------------

Date: Wed, 12 Aug 92 15:57:02 EDT
From: Kim Clancy <[e-mail]>
Subject: File 4--Re: Quick reality check.....

((MODERATORS' NOTE: We heard about the AIS BBS from several readers,
and checked it out. We we impressed by the collection of text files,
the attempt to bring different groups together for the common purposes
of security and civilizing the cyber frontier, and the professionalism
with which the board is run. AIS BBS is a first-rate resource for
security personnel who are concerned with protecting their systems)).

1. What is this Board? (name, number, who runs it (dept & sysop).
What kind of software are you using?  When did the Board go on-line?

The Bulletin Board System (BBS) is run by the Bureau of the Public
Debt's, Office of Automated Information System's Security Branch.  The
mission of the Bureau is to administer Treasury's debt finance
operations and account for the resulting debt.  The OAIS security
branch is responsible for managing Public Debt's computer systems
security.  The AIS BBS is open to the public and the phone number for
the Board is [phone].  There are three sysops, who manage the
Remote Access software.  The BBS operates on a stand-alone pc and is
not connected to any of other Public Debt systems.  The Board is not
used to disseminate sensitive information, and has been up operating
for the past 15 months.

2. What are the goals and purposes of the Board?

The BBS was established to help manage Public Debt's security program.
Security managers are located throughout Public Debt's offices in
Parkersburg, WV and Washington DC.  The security programmers saw a
need to disseminate large amounts of information and provide for
communication between program participants in different locations.
Because the Board was established for internal purposes, the phone
number was not published.  However, the number was provided to others
in the computer security community who could provide information and
make suggestions to help improve the bureau's security program.
Gradually, others became aware of the Board's existence.

3. What kinds of files and/or programs do you have on the Board?
Why/how do you choose the files you have on-line?

There is a wide variety of files posted.  In the beginning, we posted
policy documents, newsletter articles from our internal security
newsletter, bulletins issued by CERT, such as virus warnings, and
others for internal use.  I located some "underground" files that
described techniques for circumventing security on one of the systems
we manage.  The information, from Phrack magazine, was posted for our
security managers to use to strengthen security.  When we were called
by others with the same systems, we would direct them to those files
as well.  Unexpectedly, the "hacker" that had written the file
contacted me through our BBS.  In his article he mentioned several
automated tools that had helped him take advantage of the system.  I
requested that he pass on copies of the programs for our use.  He
agreed.  This is how our "hacker file areas" came to be.  Other
hackers have done the same, and have we also received many files that
may be useful.  It is, indeed, an unusual situation when hackers and
security professionals work together to help secure systems.  However,
this communication has been beneficial in strengthening an already
secure system.

4. Since you and the Secret Service are both part of the U.S.
Treasury, was the Board set up to catch "hackers?"

No, the BBS was designed to manage our internal security program.  We
do not allow individuals to sign on with "handles."  We do not know if
people are hackers when they sign on unless they identify themselves.

5. How did you get the idea to set it up?

The security branch accesses many BBSs on a daily basis for research
purposes, information retrieval and to communicate with others.  Since
our security program is decentralized, the BBS seemed to be an
effective way of communicating with program participants in diverse
locations.

6. What distinguishes your board from sources like CERT, or from
"underground" BBSes?

First, there is a wide diversity to our files, ranging from CERT
advisories to the 40Hex newsletters. Also, many of the files on our
system are posted as a resource we use for the implementation of our
security program.  For example, the Board lists computer based
training modules that we have developed, policy documents, and
position descriptions.  These are files that other security programs
can use to implement or help start their programs.  On the message
side of the BBS, what distinguishes it would have to be the open
interaction between hackers, virus writers, phone phreaks and the
security community.

7.  What kinds of difficulties or problems have you encountered,
either from superiors or from users, in operating the Board?

I can recall few, if any, difficulties from anyone, users or
superiors.  Upper management understands the value of the technology
and has been extremely supportive.  All users have been courteous,
professional, and supportive.  Security professionals constantly thank
us for providing "underground" information for them.  It allows others
in the field to gain access to valuable information without having to
access "underground" systems.  Users appreciate the opportunity to
share their knowledge with others and seem grateful to have an avenue
to communicate with security professionals who will listen to
"hackers" experiences.

8. Can you describe any unusual or humorous experiences you have had
with users while running the Board?

It is unusual for "hackers" and security professionals to work
together to help secure systems, but that is what is occurring on our
system.  I have had requests from other government agencies asking for
resumes of "hackers" that may assist them.   I have been contacted by
numerous government and private agencies asking for our "contacts."  I
just direct them to the BBS and advise that they post messages
regarding the questions they need answered.  If anyone is interested
in helping, they will respond.  It is an unusual situation, but, in my
opinion, I can attest that the information we have received has been
very useful to our security program.

9.  What future plans do you have for improving the hardware, such as
upgrading modem, number of lines, or storage capacity, or for
developing the services of the Board?

Starting July 13th, the Board will be down periodically for system
upgrades.  We are adding an additional phone line, and a 315 mb hard
drive.  Also, we are going to make a few changes to reorganize files.
It is hoped that group information will be more efficient in this
manner.  We are also adding RIME relay net conferences and will carry
topics such as Data Protection.

10. What should potential users know about the Board or your policies
before attempting to receive access?

Users must be aware that we do not allow handles on the BBS.  If they
sign on with a handle it will be deleted.  We also reserve the right
to review all E-mail, public and private.  All users have access to
the BBS upon sign on.  If a user wants access to the "hacker" file
area, they need to send a message to the sysop requesting access.
Potential users should know they are welcome to call in and
communicate with us and others.

------------------------------

Date: 16 Aug 92 16:40:07 GMT
From: [e-mail]
Subject: File 5--Pager Fraud Conviction (Telecom Digest Reprint)

         Angry Callers Help Convict Man Behind Beeper Scheme
                 From {The Milwaukee Journal} 8/16/92

New York, N.Y. - A Manhattan man has been convicted of leaving
messages on thousands of beepers for a telephone number that cost $55
to call.  While the defendant, Michael Brown, 23, never made a dime,
prosecutors said he stood to make millions before he was caught last
year.  They said he tried to defraud thousand of potential victims.

US Atty. Otto Obermaier said Brown hooked up two computers in his
apartment and then attached them to two telephone lines.  On one line,
the computer placed more than 4,000 calls a day to pagers that people
carry with them.  A message said that a return call for
telephone-based informational services should be made to a special 540
number on Brown's second line tied to the second computer.

What the unsuspecting people who returned the calls were not advised
is that it would cost them $55 a call, in violation of a New York
State Public Service Commission regulation requiring operators of toll
numbers to advise incoming callers of the cost so they can hang up
before being charged.  But Brown devised a scheme in which the
computer kept callers on the line for at least 20 seconds, the time
required so they could be billed for $55 by the telephone company.

In a six-day period in February 1991, the first computer spewed out a
total of 26,000 calls.  But the fraud did not last long because irate
subscribers inundated New York Telephone with complaints of the $55
charge.  By the time the company notified federal prosecutors and
disconnected Brown's two lines, he had billed a total of $198,000.
But prosecutors said that he never collected a dime, and that New York
Telephone made no efforts to collect the bills.  After his conviction
last week, Brown faces up to five years in prison and a fine of
$250,000 when he is sentenced on Oct. 28.  He is free on $30,000 bail.

------------------------------

Date: Tue, 18 Aug 92 23:46:20 EDT
From: <[e-mail]>
Subject: File 6--Calif. Woman Convicted in Computerized Tax Refund Scheme

        California Woman Convicted in Income Tax Refund Scheme

Press release from the U.S. Justice Department.
To: National Desk, California Correspondent
Contact: U.S. Department of Justice, 202-514-2007

FRESNO, Calif., Aug. 18 /U.S. Newswire/ -- Acting Assistant Attorney
General James A. Bruton and the United States Attorney for the Eastern
District of California, George L. O'Connell, announced Monday, Aug.
17, that Enedina Ochoa of Turlock, Calif., 26, was convicted by a
federal jury on Friday, Aug. 14, of one count of conspiracy to defraud
the government and 20 counts of assisting others in filing false
income tax refund claims with the Internal Revenue Service.

The jury trial lasted four days before United States District Judge
Oliver W. Wanger.  Wanger ordered Ochoa held in custody pending
sentencing.

Ochoa's scheme exploited the Internal Revenue Service's newly
implemented electronic filing system, which allows filers of refund
claims to receive their refund checks in one or two days.  By causing
large numbers of false refund claims to be electronically filed, Ochoa
and her co-conspirator, Karleena Pulido, fraudulently obtained
approximately $100,000 from the Internal Revenue Service.  Most of the
criminal activity involved 1991 federal income tax returns filed
earlier this year.

Ochoa and Pulido, a Turlock income tax preparer who pled guilty two
weeks ago to conspiracy to defraud the government and 29 counts of
assisting others in filing false claims for income tax refunds,
engaged in a scheme to electronically file false refund claims with
the I.R.S. by recruiting individuals to provide their real names and
social security numbers for use by Pulido on false Forms W-2 which
Pulido fabricated.  Ochoa then assisted the recruited individuals in
electronically filing these false refund claims with the I.R.S. from
electronic return transmitters such as Cash-N-Dash, an income tax
transmittal and check cashing service headquartered in Fresno.  Ochoa
and Pulido then divided divided the refund proceeds among themselves
and the individuals they recruited.

The long-standing I.R.S. system of filing paper returns requires a
taxpayer to wait several weeks before receiving a refund check.  Ochoa
and Pulido face a maximum sentence of ten years imprisonment and a
fine of $250,000 for the conspiracy convictions and five years
imprisonment for each conviction of assisting in the filing of a false
claim.  Sentencing is set for Oct. 19, and Oct. 26, for Pulido and
Ochoa, respectively, before Wanger.

The case is the result of an extensive and ongoing investigation of
electronic filing fraud by special agents of the Internal Revenue
Service's Criminal Investigation Division, and was prosecuted by
Department of Justice Tax Division Trial Attorneys Eric C. Lisann and
Floyd J. Miller.  It is the first prosecution of this type of crime in
this judicial district, and is one of only a very few such cases that
have gone to trial anywhere in the United States since the inception
of the Internal Revenue Service's electronic filing system.  Acting
Assistant Attorney General James Bruton stated, "This

conviction serves as notice that the federal government is committed
to early detection and prosecution of electronic filing schemes.
Blatant abuse of the Internal Revenue Service's computerized refund
program will not be tolerated."  According to Rick Speier, chief of
the Internal Revenue Service's Criminal Investigation Division in San
Jose and Fresno, "as the use of electronic filing increases, the
Internal Revenue Service will continue to be vigilant in identifying
electronic filing schemes organized by unscrupulousindividuals who
seek to exploit the system for criminal purposes."

------------------------------

From: Rita Marie Rouvalis <[e-mail]>
Subject: File 7--EFF Receives Dvorak/Zoom Award
Date: Tue, 18 Aug 92 16:01:17 EDT

    EFF AWARDED DVORAK/ZOOM AWARD FOR EXCELLENCE IN TELECOMMUNICATIONS
                     AT ONE BBSCON IN DENVER

  On August 13, the Electronic Frontier Foundation was the recipient
  of one of twelve Dvorak/Zoom Telecommunications Awards. The
  Dvorak/Zoom awards are to be given annually in order to recognize
  individuals and organizations that have made a difference to
  telecommunications and the BBS conferencing industry.

  The awards were given for the first time at a presentation ceremony
  during One BBSCON in Denver. The EFF was cited for "helping to keep
  telecommunications safe from the potential perils of out-of-control
  legal departments and over zealous law enforcement agencies."  The
  award also noted that the EFF has become "an extremely important
  advocacy group for online telecommunications users."

  Also honored in the awards ceremony were:
      The WELL
      Channel 1 BBS
      Tom Jennings of Fidonet
      Chuck Forsberg for Zmodem
      John Friel III for Qmodem
      Phil Katz for PKZip
      Ward Christensen for Xmodem
      Ward Christensen and Randy Seuss for BBS 1
      Tom Smith for Procomm for Windows
      Marshall Dudley for Doorway
      The Rockwell Design Team for First Single Package
          V.32N.32bis Chipset

  A more detailed report on the activities of ONE BBSCON will be the
  subject of a forthcoming edition of EFFector Online.

------------------------------

Date:         Mon, 10 Aug 1992 15:59:31 PDT
From:         Nikki Draper <[e-mail]>
Subject: File 8--Pac-Bell's Privacy Rings False (CPSR Press Release)

            PACIFIC BELL'S  PHONE PRIVACY RINGS FALSE, SAYS
          COMPUTER PROFESSIONALS FOR SOCIAL RESPONSIBILITY

PALO ALTO, Calif., August 10, 1992 -- Computer Professionals for
Social Responsibility (CPSR), a national alliance of professionals
concerned with the impact of technology on society based here,
expressed deep concern over Pacific Bell's attempt to gut a recent
California Public Utility Commission (PUC) order on Calling-Number
Identification (CNID).  Pacific Bell has requested a rehearing on the
PUC restrictions.  PacBell's proposal will eliminate important safety
and privacy protections in the Commission's order, CPSR charged.  CNID
allows businesses to collect the phone numbers of customers who call
them.

The Commission's order guarantees privacy protections for all
Californians.  PacBell proposes to eliminate a key privacy protection
called Per-Line Blocking with Per-Call Unblocking.  This feature
prevents home numbers from being collected by businesses, unless the
caller decides to give it to them.  Phone companies would prefer to
only offer per-call blocking, a scheme in which caller numbers are
always given out unless the caller remembers to dial a blocking code
before dialing the desired number.

"If this happens, Californians will inevitably receive more junk mail,
more annoying phone calls, and greater invasions of their privacy,
some of which may be dangerous," said CPSR Chair and user interface
expert, Dr. Jeff Johnson.

PacBell claims that CNID would give people more control over their
privacy by providing the phone number from the calling phone.  This is
the wrong technological answer to the problem according to Johnson.
"What people want to know is who is calling, not what phone is being
used.  If my wife's car breaks down and she calls me from a pay phone,
that's a call I want to answer.  CNID doesn't give me any information
that will help me do that."

In PUC hearings held last year, Johnson accused the phone companies of
designing a service that is more useful for businesses in gathering
marketing data than for consumers in screening calls.  Phone companies
are opposed to per-line blocking because it would presumably result in
more numbers being kept private, thereby reducing the value of the
CNID service to business subscribers.

"Phone companies don't want you to block your phone number when you
call movie theaters or appliance stores.  The more times your number
is revealed to businesses, the better!  So they oppose reasonable
blocking options and are pushing an error-prone one," he said.

If only per-call blocking were available, residential phone customers
-- or their children, parents, grandparents, guests  --  would often
forget to dial their blocking code before making a call, resulting in
frequent disclosure of private information to businesses without the
consent, and sometimes even without the knowledge, of the caller.

"Unless PacBell is willing to live within the very reasonable bounds
set by the PUC decision, the concerns of Californians will be far
better served if CNID is simply not offered at all,"  said Johnson.
"Subscriber privacy is more important that Pacific Bell's profits."

Founded in 1981, CPSR is a public interest alliance of computer
scientists and other professionals interested in the impact of
computer technology on society.  As technical experts and informed
citizens, CPSR members provide the public and policy makers with
realistic assessments of the power, promise, and limitations of
computer technology.  It is a national organization, with 21 chapters
throughout the United States.  The organization also has program
offices in Washington D.C. and Cambridge, MA.

For information on CPSR, contact the national office at 415-322-3778
or [e-mail].

------------------------------

Date:         Tue, 18 Aug 1992 15:22:45 PDT
From:         Nikki Draper <[e-mail]>
Subject: File 9--CPSR 1992 Annual Meeting

           COMPUTER PROFESSIONALS FOR SOCIAL RESPONSIBILITY

                           1992 ANNUAL MEETING
                          OCTOBER 17TH AND 18TH

                           STANFORD UNIVERSITY
                          PALO ALTO, CALIFORNIA

In the heat of a presidential campaign, CPSR asks computer
professionals to take a critical look at how politics affects
technology  and how technology affects the political process.
Computer scientists  from across the country will rigorously examine
this years techno - speak to find the substance amid the line noise.

Our annual  meeting is open to everyone who has an interest in
computers, communication, and our role as citizens in a  high-tech
society.

Computer Professionals for Social Responsibility is a national
alliance of professionals dedicated to promoting the responsible use
of computer technology, ensuring that information technology plays a
positive role in society.

***********************************************************************

SATURDAY, OCTOBER 17TH

8 a.m. - 9 a.m.     Registration and Continental Breakfast

9:00 - 9:15         Welcome

9:15 - 10:45        Teledemocracy & Citizen Participation:
                    Beyond the Electronic Town Meeting

Electronic media allow politicians and the general public to
communicate in new ways.  An election year look at the dangers
and the opportunities of electronic democracy.

10:45 - 11:00       Break

11:00-12:30         The Politics of Cryptography

Cryptography is a means of ensuring the privacy and integrity of
electronically transmitted information.  The military/intelligence
establishment has traditionally restricted the development and
dissemination of this technology.  With the end of the Cold War and
the rapid expansion of the electronic network, government policy in
cryptography has come to the forefront.  This panel examines the
current issues.  Moderated by David Sobel, Legal Counsel for CPSR.

12:30 - 2:00        Lunch break

2:00 - 3:30         Everything's Digital!
                    Media Convergence: Hope, Hell, or Hype?

Big industry players are promoting multimedia convergence as the
next technological frontier.  There's smoke, but is there fire?  As all
forms of information congeal into a digital soup, convergence raises
issues of ownership, authorship, integrity and access.  Is convergence
television to the 10th power, a consumer nightmare, or a true vision
of a new creativity?  Moderated by Amy Pearl of Sun Microsystems.

3:30-3:45            Break

3:45-5:00            Envisioning Technology Policy
                     in a Democratic Society

How do we translate our vision of technology's promise into
democratic reality?  A panel of activists looks at the development
of American technology policy and asks the crucial question:  Is it
the vision thing or deep doodoo? CPSR Board member, Jim Davis
moderates.

5:00-7:30            Break

7:30-8:30            No Host Bar at Ming's Villa

8:30-10:30           Banquet at Ming's Villa

Dave Liddle of Interval Research speaks on Computing in the
21st Century.  Announcement and presentation of the Norbert
Wiener Award for Social and Professional Responsibility in
Computing.

SUNDAY, OCTOBER 18TH

8 a.m. - 9 a.m.     Continental Breakfast

9:00 - 9:15         Welcome

9:15- 10:30         CPSR:  How We Have Impact and Why We Win

For over a decade, CPSR has had an important impact on national,
international, state and local technology policy.  To continue our
success, CPSR activists share case studies of our of public policy
successes.  By understanding why we win, we can maximize our
impact in the future.

10:30-10:45        Break

10:45-12:15        Organizing for the Future

A plenary discussion of CPSR's program areas - defining the issues,
building consensus, and setting the agenda.

12:15-2 p.m.         Lunch

2:00-3:00            CPSR Working Groups

Break out groups, based on the morning's plenary, allow participants
to chart CPSR's plans on key program issues:  civil liberties, privacy,
21st Century, reliability and risk, workplace issues, and more.

5 minute break

3:00 - 4:00         Leadership Development Workshops

Break out sessions on leadership development, organizing on the
net, chapter development, and more.

4:00-4:15           Break

4:15-5:30           Reports, evaluation, and President's message.

 ***********************************************************************

Name _____________________________________________________

Address ___________________________________________________

City__________________________State ________Zip Code_________

Telephone__________________________________________________

Important:  Registration is on a first come, first serve basis.  We
expect these events will sell out, so it is important that you return
the registration form as soon as possible to guarantee places at the
meeting and banquet.

EARLY REGISTRATION (received by 10/9/92)

CPSR Member
Meeting and banquet      $85
Meeting only             $45
Banquet only             $40

Nonmember
Meeting and banquet      $95
Meeting only             $50
Banquet only             $45

By adding $40 for a one-year CPSR membership, you can become
eligible for member prices. CPSR also offers a sliding scale fee for
registration to the meeting.  If you are interested, call the National
Office at 415-322-3778, for details or send us email at
[e-mail]

LATE REGISTRATION (received after 10/9/92)

CPSR Member
Meeting and banquet     $95
Meeting only            $50
Banquet only            $45

Nonmember
Meeting and banquet     $105
Meeting only            $55
Banquet only            $50


I want a vegetarian dinner at the Banquet.  _____YES ______NO

BRING SOMEONE WHO IS NOT A CPSR MEMBER TO THE ANNUAL MEETING, AND GET $5.00 OFF
 YOUR REGISTRATION FEE!!

I can't attend the Annual Meeting, but I want to support the work of
CPSR.  I've enclosed a tax deductible contribution to help create a
successful organization.  Total enclosed $___________

Please send me _____ brochures to hand out to my friends and
colleagues.  Make check payable to CPSR. Mail to:
CPSR
P.O. Box 717,
Palo Alto, CA 94301

For more information on CPSR call 415-322-3778 or send email to
[e-mail]

------------------------------

End of Computer Underground Digest #4.37
************************************