The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/cud/cud778.txt

Text File | 2003-06-11 | 41.7 KB | 817 lines

Computer underground Digest    Sun  Oct 1, 1995   Volume 7 : Issue 78
                           ISSN  1004-042X

       Editors: Jim Thomas and Gordon Meyer ([e-mail]
       Archivist: Brendan Kehoe
       Shadow Master: Stanton McCandlish
       Field Agent Extraordinaire:   David Smith
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest

CONTENTS, #7.78 (Sun, Oct 1, 1995)

File 1--System Administration as a Criminal Activity
File 2--Learn to Love CoS
File 3--"The Emperor's Virtual Clothes"
File 4--Cu Digest Header Info (unchanged since 19 Apr, 1995)

CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION APPEARS IN
THE CONCLUDING FILE AT THE END OF EACH ISSUE.

---------------------------------------------------------------------

From: "John S. Quarterman" <[e-mail]>
Subject: File 1--System Administration as a Criminal Activity
Date: Sat, 23 Sep 95 15:06:18 -0500

((MODERATORS' NOTE: John S. Quarterman is author of THE MATRIX:
COMPUTER NETWORKS AND CONFERENCING SYSTEMS WORLDWIDE, which has become
a classic on networking and telecommunications. The following is
reprinted with permission)).

System Administration as a Criminal Activity
or, the Strange Case of Randal Schwartz

Copyright (c) 1995
John S. Quarterman
[e-mail]

      From Matrix News, 5(9), September 1995
      Please redistribute this article.
      [e-mail], http://www.mids.org
      [phone], fax: [phone]

The other week (16 Aug 1995) I went to our local UNIX User's Group
(CACTUS: Capital Area of Central Texas UNIX system User's Group)
meeting and heard Randal Schwartz tell a strange tale.  I'd heard
parts of it before, but the details were more peculiar than the gist.

The gist is that a few mistakes in judgment can easily make a system
administrator into a convicted felon.

Randal began Intel in early 1988, and worked there continuously
(except for two weeks in late 1988) until the end of 1993.  While
working at Intel iWarp (which later became part of SSD, the
Supercomputer System Division), he had recommended they maintain basic
security by following some standard procedures, such as using good
passwords.  (This really is basic, as any security expert from DIA to
NSA to CERT, the Internet's Computer Emergency Response Team, can tell
you.)  He had started checking their passwords by running crack in
mid-1991.

Crack is a program familiar to most system administrators today (and
one distributed by CERT; see ftp://cert.org/pub/tools/crack/).  What
crack does is to attempt to crack a set of passwords, typically as
found in a UNIX /etc/passwd file.  Randal was quite familiar with
crack, having served as a beta tester for crack version 3.  He left
SSD in the middle of 1992 to work for a different Intel division (HF),
and crack was still running in SSD at that time (on autopilot).

While working for Intel, Randal had started giving week-long training
courses for other organizations around the country.  These were about
Perl, a popular programming language invented by Larry Wall.  Since
these courses involved travel, he arranged ways to read his mail at
Intel over the Internet while he was still working for Intel but not
physically present.  This seemed prudent, since, starting in late
1993, he had become responsible for deploying DNS (Domain Name System)
servers throughout Intel.  Since DNS handles the basic mapping of
symbolic hostnames (such as ssd.intel.com) to IP addresses (such as
137.46.3.5), a broken DNS server can adversely affect almost every
other TCP/IP service.  Thus it was useful to know quickly of any
problems with Intel's DNS servers.  Intel has previously told MIDS
that everyone in their company from the President down uses there
enterprise TCP/IP network, so we can see how they would want it to
continue working.

Randal had co-authored a popular book for O'Reilly and Associates
(ORA) about Perl (*Programming Perl*, published January 1991).  He
also took the obvious next step with his training material, and wrote
another Perl book (*Learning Perl*, published November 1993).  He had
an account on ORA's machines, and figured they wouldn't mind if he did
a little testing there.  Against ORA's password files, crack found one
(1) password out of about 200.  And the ORA system administrator,
Tanya Herlick, had already discovered that bad password, so it was
cleaned up almost before Randal even found it (not that either of them
knew what the other was doing at the time).  Thus ORA was a good
comparison case for reasonably good security.

In late 1993, while working for Intel, but in a different division (as
a system administrator for HF), Randal ran crack against the password
file of an SGI machine in SSD where he had an account to support prior
work for SSD.  It found one password straight out of the dictionary
(user ronb password deacon).  This is very bad because it is an
ordinary dictionary word, which makes it easy to crack simply by
trying numerous dictionary words; a task that any programmer can
accomplish.

Randal decided to see how far the problem extended.  He was no longer
working for SSD, but he was currently a system administrator in a
different division, and he was consulting for corporate on the DNS
project.  Security is traditionally part of a system administrator's
job, and a security problem in one division is a security problem in
the whole company if it's on the corporate network, since a
compromised account on one machine can be used as a base to attack
other machines.  This particular user also had an account on the main
SSD server cluster.  Randal guessed that that account would have the
same password.  One might well say the prudent course would have been
to inform the current SSD system administrators of the problem.  But
Randal decided to try it himself.  It was the same.

Randal decided to test the password file for the main SSD cluster.  He
pulled its passwd file over to a fast machine and ran crack on it, and
similarly for other machines in that division.  Crack broke 48 out of
600 passwords.

So, it was clear that Intel's security was not very good.  Crack had
found about 50 likely ways an outsider might break in.  Randal thought
he was doing his employer a big favor by discovering these weak spots
in the company fence.  One of them was particularly bad, since it was
a vice-president's account, and the password was pre$ident, which is
an ordinary dictionary word with one letter (the most obvious letter,
S) replaced with a dollar sign.

Unfortunately, Randal was waiting until he had relatively final
results before informing regular SSD staff of what he was doing.
Meanwhile, one of them noticed that he was running crack, and told his
manager.  The manager, rather than approaching Randal about it,
reported it up the hierarchy.  Evidently many of the powers that be at
Intel thought they had discovered a corporate spy.

Three days later, Randal discovered something was amiss when police
arrived at his house on 1 November 1993.  About half a dozen of them
took all his computer equipment.  Having watched too many episodes of
Dragnet, he figured it was some sort of mistake, and the police would
clear it up if he just cooperated with them and told them anything
they wanted to know.  Unfortunately, real police are paid to find
things to charge people with, and they also kept his computers for 40
days, including the one with his checkbook on it.  He was also
terminated from Intel within the same two hour period as the raid.

He did have the consolation of learning that his new book, just
released on the same day, was selling like hotcakes.

What Randal didn't know was that the report up the Intel hierarchy had
resulted in criminal charges being filed against him.  Oregon has a
vague law against ``altering'' or ``transporting'' computerized
information, with the distinction between the two not being clear.
The D.A. considered moving a password file between two Intel machines
to be at least transporting.  So Randal stood accused of stealing
information from Intel, even though even the D.A. never alleged that
anything left Intel's premises.  Stood accused on three (3) criminal
felony counts.

The indictment was handed down 14 March 1994.  The three felony counts
of Computer Crime according to Oregon State Law are:

 Count 1: altering without authorization two computer systems.

 Counts 2 and 3: accessing a computer with intent to commit theft.

The first count has to do with the remote mail access.  It seems
Intel's interpretation was that Randal had ``altered'' their systems
by, for example, putting a .forward file in his login directory to
cause his mail to be forwarded elsewhere.  The defense attorney
apparently also wanted to show use of Intel accounts for non-Intel
business.

The other two counts have to do with the passwords he discovered on
other people's accounts by running crack.  What he was accused of
stealing (theft) was password files.

Meanwhile, the system administrator at ORA, Tanya Herlick, was
informed by the FBI that someone had allegedly broken into her
systems.  She was at a systems administration conference at the time.
As chance would have it, a security session was scheduled for the same
afternoon, so she asked the assembled administrators what they would
do in her situation.  Their advice was to do the standard things (run
tcpwrapper, install COPS, reinstall old binaries, etc.).  She says:

What no one knew at the time was that this was not a typical hacker
 breakin.  It wasn't a breakin at all in fact.  This did not keep me
 from having a heart attack at the conference however.  I mean,
 someone comes up to you and says "The FBI called and said someone
 hacked your main server."  And you were 2,000 miles away and afraid
 to log on (and definitely not as root)? What would you do?

She didn't know that the alleged perpetrator was Randal, which would
have been interesting, since he was known to her audience through his
books and tutorials and through USENET and the Internet.  She says:

 If I had known it was Randal, I possibly wouldn't have even brought
 it up!  ... Not because Randal is any kind of white knight or
 anything, but because I knew he had an account on our system so it
 couldn't have been a breakin.  I found out early the next morning
 that it was him.  I ran into Tim (O'Reilly) after I found out and it
 turned out that he already knew cause Randal had called him.

What she actually did was to disable Randal's account for a couple of
days and then reinstate it after talking to him.

The case went to a jury trial.  Some of the jury members apparently
did own computers, but of course anybody who might do anything
remotely resembling system administration was rejected.  This is
evidently common practice these days; a jury of your peers means
nobody that does what you do.

The ORA systems administrator testified (by telephone) for the defense
at the trial, saying that Randal still had his account at ORA and they
had no intention of taking any legal action against him.  Tim O'Reilly
(founder and President of ORA) even spoke up for Randal when asked by
the press.

Tanya Herlick says:

 If Randal had come to me and asked if he could run crack I would have
 said no.  It was presumptuous of him to think we wouldn't mind.  If
 anything, a system admin should know this better than other users.
 However, it is not a crime.  Just inappropriate (I wish I could have
 had the chance to say this at the trial, but I didn't).

Nonetheless, Randal was found guilty on all counts, on 25 July 1995.

The deciding factor may have been the prosecutor's final summary, in
which he made the analogy of letting a carpenter into your house to
fix the garage and finding him upstairs rifling your personal papers.
Never mind that the analogy is not apt, if for no other reason because
Randal *was* fixing the garage, to the best of his abilities and of
his understanding of his job description.  The jury didn't know that.

Randal is now a convicted felon, unable to vote, hold public office,
serve on a jury, or fulfill government contracts.  And he's already
spent $112,000 in legal fees, with an expection of a total of $140,000
just for the first trial.  All for helping his employer.

Why did this happen?

It wasn't because of the regular Intel staff.  Apparently they tried
to get their bosses to talk to Randal directly, and were told that
that would not be possible.

It was of course partly because Randal made mistakes.  For example,
one might count not keeping both Intel and ORA informed, and trying
the account with the deacon password.  He readily admits he made
mistakes, and has apologized to Intel more than once in public for
doing so.

But if Intel thought he had exceeded his authority as a systems
administrator or had shown poor judgment, they had plenty of recourse
available to them by traditional methods, ranging from a talk in his
supervisor's office to a cut in pay to being summarily fired and
walked out the gate.  Instead they brought criminal charges.

Randal also made mistakes during the legal proceedings.  The police
did read him his Miranda rights, and he now knows that ``you have the
right to remain silent'' is a very good phrase to consider without
speaking.

And he made at least one bad mistake during the trial.  When asked by
the prosecutor whether he had done what he had done for personal gain,
he thought about it and considered that helping his employer would
make him look good, bring in more consulting, maybe increase his pay,
etc., and said (one may well say foolishly), ``yes.'' The prosecutor,
no dummy, brought this up during his summation.

It may be relevant that that the prosecutor apparently remarked, in a
news conference after the verdict, that it would send a message that
Oregon was "safe for business".  It may also be relevant that Intel is
the largest employer in the state.  Not that this case (or the problem
it represents, anyway) is specifically about Intel; it could have
happened at any largish company or university.

System adminstrators almost always work in very vague job
descriptions, with little or no demarcation of the scope of their
activities or when or to whom they should report them.  Consultants
work under even more vague job descriptions, because they can't even
be required to work at specific hours or told when to work on specific
tasks or the IRS won't consider them to be consultants.  Intel is not
alone or even unusual in having no clear usage guidelines about their
systems.  The risk of the hierarchy at any large organization getting
incensed at some (to them) clerical worker running something called
``crack'' and finding out that, for example, high level executives
have bad (not to mention embarrassing) passwords, is always with us.

The nature of system administration leads to all sorts of
possibilities of civil or criminal charges.  If not crack, how about
illegal transportation of company property off the premises (taking
source listings home to study)?  Or illegal use of university
communications facilities for political purposes (sending an
electronic mail message to your Congress member)?  Or illegal export
of controlled processes (such as PGP, in the Phil Zimmermann case)?
Or, if the U.S. Senate has its way, ``making available'' files that
some D.A. chooses to consider ``indecent''?  The possibilities are
numerous.  They aren't limited to system administrators, either.  The
nature of, oh, library work has become so involved with computers and
networks these days that librarians, or professors, or schoolteachers,
or, yes, secretaries could be subject to the same difficulties.

Once again, Randal made mistakes.  The nature of Randal's mistakes was
such that you or I could easily have made them or others quite like
them.

The response to Randal's mistakes was out of all proportion to what he
did, under any reasonable interpretation by people knowledgable of the
nature of his work.  We're not talking Kevin Mitnich here; this is not
about a KGB-funded malicious cracker.  For that matter, the liberties
Randal took were small compared to those certain well-known trackers
of wiley hackers have taken in their self-appointed detective work.
We're not even talking Robert Morris Jr., where the alleged
perpetrator clearly was, for whatever reason, at least using lots of
computers in organizations that had not given him any permission.
We're talking a system administrator trying to do his job and being
branded a felon for simple mistakes in who he informed and when.

Sentencing in Randal's case is scheduled for 11 September.  The
sentence could involve any or all of jail time, a hefty fine, damages,
and a requirement not to leave the state.

It is possible to request leniency from the judge.  Letters of support
for Randal Schwartz to be put before the judge should be sent to his
lawyer's office so they can be presented to the judge as a package.
Randal's lawyer's address is:

      Marc Sussman
      503-221-0520
      135 SW Ash
      Suite 600
      Portland OR 97204

      Re: Randal Schwartz

Or send mail to [e-mail] to find out how else you can
assist Randal, for example financially.  That electronic mail address
goes to an autoresponder which will also send you Randal's short version
of the story.

On a personal note, I'd like to say that I actually had never met
Randal until he came to Austin recently.  However, when he sent me a
note in advance asking for a guest account on our Internet Service
Provider (Zilker Internet Park) so he could read his mail, read news,
look at web pages, etc., without having to call long distance back to
Portland, I had no hesitation in providing him one.  Yes, I knew he was
a convicted felon.  I also knew he was the co-author of *Learning Perl*
and *Programming Perl*, which are two of the most useful books about
one of the most useful programming languages I've ever encountered.  I
also knew a number of people he had taught Perl in his classes.  And I
had heard a version of his story before.  This man should not be
labeled a criminal.  He is, in fact, a pillar of the UNIX and Internet
communities (see his web page, http://www.teleport.com/~merlyn).  The
World Wide Web, for example, would not have grown as quickly and as
easily as it did without Perl, nor without Randal's efforts to
promulgate Perl.

Does being a pillar of the community make one immune from criminal
activity?  No (just ask Ivan Boesky).  However, I do not see how simple
timing mistakes while attempting to do one's job in the generally
accepted manner constitute felonious behavior.

Randal is taking this whole thing rather philosophically.  He thinks
the main benefit that could come out of it would be to prevent future
erroneous felony charges of this kind.

Much of the above account does come from Randal.  I have no reason
to doubt that he is telling the truth, but of course there may always
be more to the story.

If anyone has reports that cast a different light on the matter, do
send them in.  So far, the worst I've heard has been someone claiming
to know that Randal had ``broken into at least one system previously.''
This turned out to be an allusion to him running crack on ORA's
systems, which is something that he not only readily admits but
discussed at some length at the CACTUS meeting.  If he really did find
that crack could break no (zero) passwords on ORA's machines, it would
seem that ``broken into'' would be a rather inaccurate description.
Not to mention he already had accounts on ORA's machines.

Could it be that once someone is charged with criminal activity the
networked community considers that they must have done something to
deserve it?  If so, the networked world is much like the rest of the
world, indeed.  Actually, the discussion online has been mostly in
favor of Randal.  Incidentally, we have not yet received input from
Intel, but we would be happy to print some when we get it.

The discussion in the mainstream press has been mostly nonexistant.
Except for the local Portland newspaper and television station,
apparently no major news medium has carried the story.
So, it appears that *Matrix News* is the first national and
international publication to break the story.

====================================================================

Date: Fri, 15 Sep 1995 03:41:02 -0700
To: [e-mail] (John Quarterman)
Subject--Re--test

[This message was generated automatically because you sent me mail
containing @FUND on a line by itself, or sent mail to [e-mail].
I did not read the rest of your note -- merlyn]

On March 14th, 1994, I was indicted on three felony counts of Computer
Crime according to Oregon State Law.  The "victim" and accuser is
Intel Corporation (yes, the multinational microchip manufacturer), a
client of mine for five years running, and possessor of vastly greater
financial, time, and legal resources than I could ever muster up.

On July 25th, 1995, I was convicted of those same counts.

On September 11th, 1995, the sentencing went as follows (counts are
described later):

Count 1, reduced to a misdemeanor, 5 years probation, 90 days jail to
begin september 1, *1998*.  However, 60 days before this date I can
petition the court to demonstrate excellent behavior and
rehabilitation, and they may dismiss the jailtime.  Disclosure
required (see below).

Count 2, 2 years probation, 480 hours of community service, disclosure
required (see below).

Count 3, 2 years probation, 480 hours of community service (hours
count for both counts 2 and 3, so it's 480 total, not 960).
Disclosure required (see below).

Restitution hearing still to be set. Intel is asking for an additional
$9,000 over the original $63,000.

Disclosure: I must not become either a contract employee or employee
without my potential employer becoming fully aware of my conviction.

I attend my "probation induction" meeting on September 20th.  More
details then.

The charges are as follows:

Count 1: altering without authorization two computer systems.

Counts 2 and 3: accessing a computer with intent to commit theft.

First, let me say that I am sorry that I caused Intel any grief or
hardship, and that in hindsight, I should have been clearer about my
intention and actions.  I'll never get to work at Intel again, and my
mistakes may even make it nearly impossible to get any work at any
location that respects Intel's beliefs about me.

However, my actions were motivated by my desire to give Intel the best
possible value for the money they were paying me.  At no time did I
*intend* to have any harm come to Intel, and any damage they may claim
resulted from their mopping up on things that I *might* have done but
they couldn't tell I hadn't.

In short, count 1 comes from me having installed two different methods
of accessing my Intel e-mail through the Internet while I was away but
still working for Intel.  I was responsible for the timely deployment
of the DNS servers for the entire corporation, and a system
administrator on some network support machines, and I wanted to keep
on top of developing situations.  I believed at the time that I was
complying with the intent of every rule I was aware of regarding the
setup of these access methods, but it became clear at the trial that
my understanding was very different from their understanding.

Count 1 is also based on a law about which we have raised
constitutional questions of overbreadth and vagueness.  We always
thought these issues would require appellate examination.

Counts 2 and 3, as I understand it, result from their claim that I
committed "theft" of a password file from the SSD division by
copying it to a machine in the HF division where I was working and
that by running crack (the password guesser) on the file, I also
committed "theft" of the passwords.  I was a sysadm for SSD about a
year and a half previous, and I still had an active account on a lab
machine at SSD.  I had discovered that a user at SSD had picked a
dictionary word ("deacon") for a password on the lab machine.
Fearing that the SSD folks had stopped running crack regularly, I
copied the SSD password file (using the cracked password from the lab
machine) and found that my fears were justified.  (The vice
president's password was "pre$ident", for example.) However, I now
had vital information that I had obtained through the use of a cracked
password, and I was in an awkward situation.  Before I reported the
findings to SSD, a co-worker noticed the crack runs (they were 6-8
days long!) running under my own userID on the systems that we shared
at HF, and feared the worst: that I had turned into a spy and was
actually stealing secrets.

Yes, as you can see, I made a number of bone-headed mistakes (not
getting the rules about internet access clear, not reporting the
single bad cracked password, and not immediately reporting the results
of the crack run), and I probably should have been terminated for
those mistakes, but NONE OF THE ACTS WERE BASED ON MALICIOUS INTENT.

I have fought the charges using money out of my pocket and
borrowed on credit cards, and the goodwill of many special Net
Citizens such as the folks at the Electronic Frontier Foundation.

If you'd like to help, you may choose to *pay* me for "services
rendered" by me to you which you had formerly received for free.  Any
such money will be disclosed as income, and thus not tax-deductable
unless you're a business and want to file a 1099 on me.  If you wish
to contribute in blind faith that this David vs. Goliath story might
make sense when the smoke clears, send a check made out to
"Stonehenge" to:

   Stonehenge Consulting Services
   attn: Legal Defense Fund
   4470 SW Hall Suite 107
   Beaverton, Oregon 97005-2122

I regret that I cannot accept credit-card payments.  If you cannot
send a check, please buy a copy of the Llama book for a friend or the
library (or for yourself)!

((list of contributors deleted ... CuD Moderators))

------------------------------

Date: 26 Sep 95 09:38:22 EDT
From: Lance Rose <[e-mail]>
Subject: File 2--Learn to Love CoS

Church of Scientology: Sit Back & Watch the Show

Reports of CoS' setbacks in its case against Lerma are swiftly making the
rounds on the Net.  One gets the impression of Net denizens pumping their
fists in the air, another victory in the Net's struggles against the Church.
And indeed, the Church has taken on the Net full bore: with this lawsuit,
the Ehrlich lawsuit, the harassment of anonymous remailers, and all the
rest, now followed with as much detailed attention as the O.J. case by a
significant proportion of onliners.

However, those holding the attitude of being (at least vicariously)
part of a war against CoS are, I submit, just wasting their time.
Those *actually* at war with CoS are: (1) the guys who probably are
may be violating their copyrights, and (2) the online operations
dragged into it by the CoS.

As to (1), don't hold your breath waiting for gross copyright
violations to be endorsed by any court.  There may be some interesting
rulings on fair use on the Net, but that's as far as it will go. And
if these guys are actually violating copyrights, why go to the mat for
them? Seems to me it would be far better to put one's energies into
supporting outfits that don't rip others off.  And the fact that the
defendants have been posting entire CoS tracts, or large chunks of
them, puts the burden on them to justify their activities.

As to (2), any online services and the like dragged into the CoS
battles deserve all the support they can get.  They deserve not to be
implicated in CoS' battles against identified, alleged infringers. If
anyone wants to help them out, they certainly should.

But what about the rest of us?  Should we really be considering CoS
the "bad guy" here?  Perhaps they're doing all of us on the Net
(except their specific targets) an enormous favor.

Up to now, we've had a lot of flowery talk about the Net's resistance
to any form of censorship.  But until CoS was aroused, how many
deliberate, focused and persistent attacks on the Net distribution
system have we actually seen? None.

CoS is giving us all an opportunity to see just how robust and
adaptive the Net really is.  No more flowery talk.  Let's see how well
the Internet "routes around" censorship outfits like CoS.

Why waste time reviling CoS?  They're the first real Beta tester for
the Net's supposed resistance to power games, and they're real, real
eager.  Look at the hackers, who say they perform the valuable
function of showing supposedly secure systems their security holes in
advance of an actual hostile threat. CoS is performing precisely the
same function for the Net as a whole, and they're bringing in tools
and weapons far beyond the means of most hackers. They're not only
trying to cancel stuff out online (and I imagine, getting better at it
over time) in the hacker arena, they've also got a bevy of lawyers
using every legal trick in the book out in the land of courts and
cops.

In sum, CoS is doing a service for the bulk of the Net by showing us
what our expectations properly should be regarding attacks by powerful
groups against Net activities.

Why is recognition of this aspect of the CoS affair barely ever even
mentioned?  I believe it may be due to an early manifestation of
something very interesting: the emergence of Net mind, colonizing the
consciousnesses of those who spend a lot of time here. If CoS makes
various attacks against the Net, the Net does not just "route around"
it; it develops an attitude of resistance against the hostile invader,
and that attitude is distributed to a significant portion of
individual Net users. CoS is the bad guy. True Net believers rally
against them. We go to war until the invader is hopefully expelled.
Perhaps in the minds of Net faithful there's a little pledge of
allegiance, "to the collective, of the united believers on the
Internet" or some such once per morning, or around the clock.

If this is occurring, then I must issue a caution: keep your own mind.
Groupthink on the Net can be just another fascistic environment, if
we're not careful.  The proper response to CoS is not to form into its
mirror image, but to act on a more mature basis as a collective of
independently thinking individuals.  If we're capable of that.

Please understand I'm not saying that the wrongful targets of CoS
agendas should just grin and bear it.  They should fight back like
hell, and kick some butt (except for those who might actually be in
the wrong). And anyone who's moved to help defend wrongful targets of
CoS should certainly extend that help.

But for the rest of us, we serve ourselves best by watching the CoS
debacle unfold.  Learn what it tells us about the true strengths and
weaknesses of the Net.  Without tests like this, we'd be so busy
slapping each other on the back about the Net's resistance to attack
that when a real, general attack comes (such as a crypto-castrated
Net, courtesy of our national governments), we'd all be goners. And in
order to have a clear look, it would probably be best to stop looking
at CoS as "the problem", and start looking at it as part of the
solution.

                                       - Lance Rose

------------------------------

From: Alan Janesch <[e-mail]>
To: [e-mail]
Subject: File 3--"The Emperor's Virtual Clothes"

Per your request, here's the news release on Dinty W. Moore's new book,
"The Emperor's Virtual Clothes."

THE INTERNET WON'T CHANGE US, IT'LL JUST SPEED THINGS UP, SAYS PENN
STATE AUTHOR

University Park, Pa. -- The Internet is: a. the greatest thing since
sliced bread; b. the work of the devil; c. going to change every
aspect of our lives, including the way we think; d. pretty much the
same as the rest of our lives, although maybe a little bit faster.

        Dinty W. Moore (yes, that's his real name), a Penn State English
professor and author of "The Emperor's Virtual Clothes: The Naked Truth
about Internet Culture," says the correct answer is "d."
        "Most of what's being predicted or touted about the Internet is an
exaggeration," says Moore. "It's neither as wonderful as its proponents
claim nor as horrifying as its critics believe. What I've found is that the
Internet is not going to change who we are, change the way we think and the
way we learn, or change the essential way that we communicate, much less
transform our culture, alter the political process, or rearrange the
balance of world power. What the Internet is doing is making it faster and
easier for people with similar interests to find each other and talk to
each other -- no matter where in the world they live."
        The bottom line, Moore says, is that the information highway is
simply speeding things up, not changing our destination.
        "We are talking about a machine here: a pretty interesting one, but
basically a big machine that spits data across long distances. Despite what
varied sorts of machines we have at our disposal, despite all the uploads
and downloads and listservers in the world, we are still going to be the
same human beings, the same contentious, territorial, ridiculous, lovely,
procastinating souls," Moore writes in his new book.
        "Wherever the human race is headed -- and I'm not sure where that
is -- the Net may get us there faster, but we are still headed the same
way. The electronic culture won't change the content of our lives, it will
simply change the pace."
        Moore ought to know. To do the book, which is being published this
month by Algonquin Books, he spent eight months trolling the Internet --
the loose, decentralized network that links upwards of 35 million computer
users worldwide.
        A former documentary filmmaker and UPI reporter, Moore met the
Internet's denizens on their own turf (on-line) and even interviewed some
of them face-to-face. (Moore, by the way, is named not after the famous
beef stew, but for a character in the early-1900s comic strip, "Bringing Up
Father.") Through his research, Moore found that the Internet, more than
anything else, mirrors human existence in all its various forms -- the good
as well as the bad and the ugly.
        That means that while you can indeed find "flames" (insulting
language), "cybersex" (basically, talking dirty via real-time electronic
mail) and pornography on the Internet, Moore says, you can also find
intelligent, thoughtful people who care about ideas and issues and who also
care about the people in their Internet communities.
        Moore says what surprised him most about the Internet "is how much
this cold, sterile electronic medium is really opening up communications
with other human beings for select groups of people -- not for everybody,
but for instance for people who are housebound, who have anxiety disorders
or agoraphobia, who have some sort of real or perceived secret that they
are unwilling to share with anybody in a face-to-face situation. Here, they
can go on-line and bare their souls and hear other people say, 'You know, I
feel that way, too,' or 'You know, you can get help for that,' or 'You
know, you're not so bad, that's a normal feeling.' People find this
positive and healing, and it enhances their lives."
        One of Moore's discoveries was a group of "virtual" friends who
have met through an electronic community called the Cellar, a small
bulletin board system (BBS) based in Montgomery County, about a 45-minute
drive north of Philadelphia.
        What makes this group different from the thousands of BBS's
scattered around the world is that once or twice a year they power down
their computers, flip off the high-resolution monitors, and leave home for
a face-to-face GTG (get-together) at the home of the Cellar's owner.
        The Cellar dwellers, Moore says, were not "awkward, ashen-faced
computer junkies. Well, okay, there were a few. But I was surprised by just
how interesting they were, and how sociable, compared to my own
preconceptions. I was also surprised by how well they could cook."
        One other surprise for Moore was how easily the Cellar's
heterosexual males accepted its "transgendered" subculture. For example,
one patron of the Cellar is a married man with two daughters who has always
sent messages as "Janice" and never refers to what he calls his "birth
gender." Some of the Cellar's patrons are surprised when they discover
"Janice" is not a woman, but on the whole they are very accepting.
        "Gender-switching on the Internet is probably confusing to a lot of
people, but some people find it extremely freeing," says Moore. "They like
to lose themselves in a fantasy, and as far as I can determine this is a
pretty benign, harmless way for them to do it."
        Moore devotes a chapter to the dark side of the Net -- on-line
child stalking by pedophiles, pornography, hate messages, flames, and so on
-- but he doesn't buy into "the current hysteria to regulate the Internet."
        "The Internet will sort itself out, just as any other innovation in
our society has sorted itself out," Moore says. "Society hasn't yet figured
out a way to deal with on-line crimes or other undesirable behavior. But we
have managed to deal with these kinds of things in other areas and I think
we will in this venue, too."
        Illegal or other unsavory activities on the Net "are really an
infinitesmal part of what's happening there, but they've been exploded into
a gigantic headline," says Moore.
        "The Internet is no scarier than the real world. In fact, it's less
scary. You can get flamed, you can get approached, you can get frightening
things said to you. But the people who do these things are thousands of
miles away and they don't really know who you are, so they can't really get
at you."
        Moore has put his money where his mouth is by listing his e-mail
address in the book. "Hopefully, readers of the book will ask me questions,
blow off steam, pay me a compliment. I'm not giving them my home address,
so they can't throw eggs at my house. I'm not giving them my phone number,
so they can't call me up at three in the morning. All they can do is fill
my electronic mailbox with e-mail, and if they're too tough on me I can
always erase their messages."

*aj*

Editors: For a review copy of "The Emperor's Virtual Clothes: The Naked
Truth about Internet Culture," contact Beverley Smith at Algonquin Books of
Chapel Hill, [phone].

------------------------------

Date: Sun, 19 Apr 1995 22:51:01 CDT
From: CuD Moderators <[e-mail]>
Subject: File 4--Cu Digest Header Info (unchanged since 19 Apr, 1995)

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost electronically.

CuD is available as a Usenet newsgroup: comp.society.cu-digest

Or, to subscribe, send a one-line message:  SUB CUDIGEST  your name
Send it to  [e-mail]
The editors may be contacted by voice (815-753-0303), fax [phone])
or U.S. mail at:  Jim Thomas, Department of Sociology, NIU, DeKalb, IL
60115, USA.

To UNSUB, send a one-line message:   UNSUB CUDIGEST
Send it to  [e-mail]
(NOTE: The address you unsub must correspond to your From: line)

Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
libraries and in the VIRUS/SECURITY library; from America Online in
the PC Telecom forum under "computing newsletters;"
On Delphi in the General Discussion database of the Internet SIG;
on RIPCO BBS [phone] (and via Ripco on  internet);
and on Rune Stone BBS (IIRGWHQ) [phone].
CuD is also available via Fidonet File Request from
1:11/70; unlisted nodes and points welcome.

EUROPE:  In BELGIUM: Virtual Access BBS:  [phone] (ringdown)
         Brussels: STRATOMIC BBS [phone]:291/[e-mail]
         In ITALY: ZERO! BBS: [phone]
         In LUXEMBOURG: ComNet BBS:  [phone]

  UNITED STATES:  etext.archive.umich.edu (192.131.22.8)  in /pub/CuD/
                  ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/
                  aql.gatech.edu (128.61.10.53) in /pub/eff/cud/
                  world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/
                  wuarchive.wustl.edu in /doc/EFF/Publications/CuD/
  EUROPE:         nic.funet.fi in pub/doc/cud/ (Finland)
                  ftp.warwick.ac.uk in pub/cud/ (United Kingdom)

  JAPAN:          ftp://www.rcac.tdi.co.jp/pub/mirror/CuD

The most recent issues of CuD can be obtained from the
Cu Digest WWW site at:
  URL: http://www.soci.niu.edu:80/~cudigest/

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted for non-profit as long
as the source is cited. Authors hold a presumptive copyright, and
they should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified.  Readers are encouraged to submit reasoned articles
relating to computer culture and communication.  Articles are
preferred to short responses.  Please avoid quoting previous posts
unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

------------------------------

End of Computer Underground Digest #7.78
************************************