The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/n_z/nia_63.txt

Text File | 2003-06-11 | 45.7 KB | 796 lines

   Founded By:    |  _                        _______
 Guardian Of Time |  __      N.I.A.   _      ___   ___  Are you on any WAN? are
   Judge Dredd    |  ____     ___    ___    ___     ___ you on Bitnet, Internet
------------------+  _____    ___    ___    ___     ___  Compuserve, MCI Mail,
  X           /      ___ ___  ___    ___    ___________  Sprintmail, Applelink,
   +---------+       ___  ___ ___    ___    ___________    Easynet, MilNet,
   | 31OCT90 |       ___   ______    ___    ___     ___    FidoNet, et al.?
   | File 63 |       ___    _____    ___    ___     ___ If so please drop us a
   +---------+               ____     _     __      ___        line at
                              ___           _       ___ [e-mail]
        Other World BBS        __
           Text Only            _    Network Information Access
                                       Ignorance, There's No Excuse.

               SECTION III COMPUTER SECURITY CONTROLS AND THE LAW
                                Guardian Of Time

                 NIA---NIA---NIA---NIA---NIA---NIA---NIA---NIA

Well I rushed to get this one out in time for Halloween, so here is part III
of my series on Computer Security Controls, I hope that you will enjoy it.

Lord Macduff, I hope you enjoy ALL of those VAX Manuals you are reading, and
don't forget WRITE SOMETHING!

                 NIA---NIA---NIA---NIA---NIA---NIA---NIA---NIA





STANDARDS OF DUE CARE

The follow the leader strategy of employing generally used controls in data
processing is motivated in part by the legal concept of standards of due
care.  It is becoming possible to lose more in damages from a civil action
such as a stockholders' suit or citizens' suit against the government after
an accidental or intentionally caused act than directly from the act itself.
Liability for the violation by a provider of computer services towards any
other ( customer, data subject, affected third party, stockholder ) can
arise through a conscious act of malice with intent to cause harm, through
reckless disregard of the consequences to the person harmed or through
negligent performance or failure to perform.  For such liability to attach,
a duty of care must be owed to the victim of the act.  Once responsibility
is established, the provider having the responsibility is requried to act as
a prudent person.

the action sof another person in the same position or the general practice
of the computer services industry are useful in establishing the standard of
care against which individual performance will be measured.  However,
industry practice is not a complete answer. In the TJ Hooper case, which
concnerned the failure of a large tug boat operator to use radio receivers
in 1932 to avoid inclement weather, Judge Learned Hand Stated:

IS IT THEN A FINAL ANSWER THAT THE BUSINESS HAD NOT YET ADOPTED RECEIVING
SETS? THERE ARE, NO DOUBT, CASES WHERE COURTS SEEM TO MAKE THE GENERAL
PRACTICE OF THE CALLING (INDUSTRY) THE STANDARD OF PROPER DILIGENCE;...
INDEED IN MOST CASES REASONABLE PRUDENCE IS IN FACT COMMON PRUDENCE, BUT
STRICTLY IT IS NEVER ITS MEASURE; A WHOLE CALLING (INDUSTRY) MAY HAVE UNDULY
LAGGED IN THE ADOPTION OF NEW AND AVAILABLE DEVICES.  IT ( THE INDUSTRY )
MAY NEVER SET ITS OWN TESTS, HOWEVER PERSUASIVE BE ITS USAGES.  COURTS MUST
IN THE END SAY WHAT IS REQUIRED; THERE ARE PRECAUTIONS SO IMPERATIVE THAT
EVEN THEIR UNIVERSAL REGARD WILL NOT EXCUSE THEIR OMISSION (60F.2D. 737,730)
(2ND CIR. 1932, CERT, DENIED 287 US 662 ( 1932 ).

No definitive answer or test can establish a standard of due care on grounds
of common practice in an industry or on prudence based on use of available
devices whether generally adopted or not.  In 1955, the Circuit Court of
Appeals for the Sixth Circuit held that the failure to use radar by an
aircraft in 1948 was excusable because no commercially feasible aircraft
radar system was available (Northwest Airlines v. Glenn L. Martin Co. 224,
F.2d 120, 129-130).  In 1977, the US District court for the Southern
District for New York held an airline liable for a robbery for failure to
take appropriate precautions, despite the provision of an armed guard in
front of the locked unmarked storage area and the argument that the airline
had taken the same degree of precautions that other airlines had.
(Manufacturers Hanover Trust Co. v. Alitalia Airlines, 429 F.Supp.
964(1977)).  Further, professionals may not always rely on generally
accepted practices.  In US v. Simon (425 F. 2d. 796 [2nd Cir. 1969]) the
United States Court of Appeals for the Second Circuit held that, even in a
criminal case, generally accepted accounting principles were not necessarily
the measure of accountants' liability for allegedly misleading statements in
a footnote to the financial statements.

The concept of standard of due care will arise w/ in creasing frequency as
disputes over computer-related loss end in litigation.  Computer security
administrators must be aware of standard of due care issues that arise and
take acction to conform to the outcome.

APPLYING LEGAL CONCEPTS TO COMPUTER SERVICES

One area where the courts have had some difficulty in applying legal
concepts to computers is in determining exactly how to characterize computer
services from a legal point of view.  The courts have generally held that
basic legal principles requiring a person to exercise reasonable care do not
change simply because a computer is involved.  The courts have generally
stated that those who use computers must do so w/ care, and they have not
been sympathetic to defenses asserting good faith mistakes resulting from
reliance on faulty computer data.  In Ford Motor Credit Co. v. Swarens (447
S.W. 2d. 53 [Ky. 1964]), for example, a finance company wrongfully
repossessed the plaintiff's car after he had proven on two occasions that he
was current in his payments by showing cancelled checks to agents of the
defendant.  The finance company defended on the basis that an admitted error
w/ respect to the plaintiff's account had ocurred as a result of a computer
error.  The court rejected this defense stating:

FORD EXPLAINS THAT THIS WHOLE INCIDENT OCCURRED B/C OF A MISTAKE BY A
COMPUTER.  MEN FEED DATA TO A COMPUTER AND MEN INTERPRET THE ANSWER THE
COMPUTER SPEWS FORTH.  IN THIS COMPUTERIZED AGE, THE LAW MUST REQUIRE THAT
MEN IN THE USE OF COPUTERIZED DATA REGARD THOSE W/ WHOM THEY ARE DEALING AS
MORE IMPORTANT THAN A PERFORATION ON A CARD.  TRUST IN THE INFALLIBILITY OF
A COMPUTER IS HARDLY A DEFENSE, WHEN THE OPPORTUNITY TO AVOID THE ERROR IS
AS APPARENT AND REPEATED AS WAS HERE PRESENTED.

It is clear, therefore, that excessive reliance on computer data w/out
proper safeguards to ensure the reliability and accuracy of the information
may constitute the failure to exercise due care, and in some cases may even
result in the award of punitive damages.

PROFESSIONAL STANDARD OF CARE

There is clearly a duty to exercise resonable care in using computers.
Depending on the legal characterization given to contracts to supply
computer equipment and services, a higher standard of care may be required
of suppliers of computer services.  Such an argument would be based on the
teory that programmers and others who provide computer services hold
themselves out as professionals w/ special expertise.  As such
professionals, they arguable should be held to the level of care that would
be exercised by a reasonable member of the profession under similar
circumstances.

In Triangle Underwriters v. Honeywell, Inc (604 F. 2d. 737 [2nd Cir. 1979])
for example, the court found that Honeywell agreed to deliver a completed
computer system to Triangle and not to run a continuous data processing
service.  Triangle tried to argue not only that Honeywell been negligent in
failing to design and deliever a workable system, but also that the wrong
continued during the period in which Honeywell comployees attempted to
repair the malfunctioning system.  Triangle argued that Honeywell had
engaged in professional malpractice, and that the continuous treatment
theory should apply so that the statue of limitations would not commence to
run until the professional relationship had ended.  The district court noted
that the continuous treatment theory had been applied by New York courts to
nonmedical professionals such as lawyers, accountants, and architects, but
it declined to apply the theory to Honeywell.  "In the case at bar ... the
necessary continuing professional relationship did not exist.  Honeywell was
not responsible for the continuous running of a data prcessing system for
Triangle."

Although the court thus refused to accept the plaintiff's theory of
professional malpractice on the facts of that case, the decision leaves open
the possiblity that the doctrin might be applied in a future case to person
who privide computer services for a client on an ongoing basis.

STRICT LIABILITY

There is further issue of whether those who provide computer services should
be strictly liable in tort for injury to others due to malfunctions of the
equipment.  The doctrine of strict liability arose out of cases invovling
the sale of goods, and it has been said that:

PROFESSIONAL SERVICES DO NOT ORDINARILY LEND THEMSELVES TO THE DOCTRINE OF
TORT LIABILITY W/OUT FAULT B/C THEY LACK THE ELEMENTS WHICH GAVE RISE TO THE
DOCTRINE.  THERE IS NO MASS PRODUCTION OF GOODS OR A LARGE BODY OF DISTANT
CONSUMERS WHOM IT WOULD BE UNFAIR TO REQUIRE TO TRACE THE ARTICLE THEY USED
ALONG THE CHANNELS OF TRADE TO THE ORIGNAL MANUFACTURER AND THERE TO
PINPOINT AN ACT OF NEGLIGENCE REMOTE FROM THEIR KNOWLEDGE AND EVEN FROM
THEIR ABILITY TO INQUIRE.  THUS, PROFESSIONAL SERVICES FORM A MARKED
CONTRAST TO CONSUMER PRODUCTS CASES AND EVEN IN THOSE JURISDICTIONS WHICH
HAVE ADOPTED A RULE OF STRICT PRODUCTS LIABILITY A MAJORITY OF DECISIONS
HAVE DECLINED TO APPLY IT TO PROFESSIONAL SERVICES.  THE REASON FOR THE
DISTINCTION IS SUCCINCTLY STATED BY TRAYNOR, J., IN GAGNE V. BERTRAN, 43
CAL. 2D 481, 275 P. 2D 15, 20-21 (1954): "[T]HE GENERAL RULE IS APPLICABLE
THAT THOSE WHO SELL THEIR SERVICES FOR THE GUIDANCE OF OTHERS IN THEIR
ECONOMIC, FINANCIAL, AND PERSONAL AFFAIRS ARE NOT LIABLE IN THE ABSENCE OF
NEGLIGENCE OR INTENTIONAL MISCONDUCT. ... THOSE WHO HIRE [EXPERTS] ... ARE
NOT JUSTIFIED IN EXPECTING INFALLIBITY, BUT CAN EXPECT ONLY RESONALBE CARE
AND COMPETENCE.  THEY PURCHASE SERICE, NOT INSURANCE (CT/EAST, INC. V.
FINANCIAL SERVICES, INC., 5CLSR 817 [1975]).

Under this traditional approach, a finding that an agreement to provide
computer equipment constituted either a sale of goods on the one hand or a
contract for professional services on the other would appear to decide the
issue of whether the doctrine of strict liability would apply.  Following
this line of reasoning, if an agreement to provide a computer package was
construed as an agreement for professional services, then the provider could
not be strictly liable in tort for any malfunction.

Traditional legal theories, however, cannot always be applied w/out
difficulty to novel concepts such as computer agreements.  It may be more
appropriate, therefore, to adopt the approach used by a federal court in
Wisconsin in Johnson v. Sears, Roebuck & Co. (355 F. Supp. 1065 [ED Wis.
1973]).  In Johnson, the plaintiff argued that the hospitals that treated
her for injuries had done so negligently and that they were strictly liable
in tort.  The court decided the issue of the applicability of strict
liability to the sale of services by analyzing blood transfusion cases that
held hospitals strictly liable in tort for providing blood containing
impurities to patients.  The court rejected the sales/service analysis and
stated that the decision to impose strict liability should be made on an ad
hoc basis by examining the facts involved in each particular case.  The
court reasoned that the "... decision should not be based on a technical or
artificial distinction between sales and services.  Rather, I must determine
if the policies which support the imposition of strict liability would be
furthered by its imposition in this case."

STATUTORY SOURCES OF LIABILITY FOR RELIANCE ON INACCURATE COMPUTER-BASED
DATA

Regardless of whether suppliers of computer services should be held to a
higher standard of care or subject to strict liability in tort clearly the
common law duty exists to exercise reasonalbe care to ascertain the accuracy
of information furnished by a computer before relying on such data.  This
duty becomes particularly important when computer data are relied on in
making periodic reports required by the federal securities laws.  Management
has a duty to maintain accurate records and third parties have the duty to
verify the accuracy of information supplied by management.

MANAGEMENTS RESPONSIBILITIES:  Various provisions of the Securities Act of
1933 (the 1933 Act) and the Securities Exchange Acot of 1934 (The 1934 Act)
impose liability for making false or misleading statements of a material
fact or for failing to state a material fact necessary to make statements
made not misleading, in the light of the circumstances under which they were
made.  These provisions create a duty on the part of reporting companies to
file accurate reports and to maintain accurate records.  The foreign Corrupt
Practices Act of 1977 (FCPA) codified this duty to maintain accurate
records.

A recent bank embezzlement of 21.3$ million illustrates the importance of
complying w/ the FCPA's requirement of establishing a system of internal
accounting controls.  The management of an entity is responsible for
establishing and maintaining adequate internal controls, and it is worth
noting that the complaint in a shareholder's derivative suit now being
argued before the United States District Court for the Southern District of
Texas relies partly on an allegation that management failed to do so.
management risks exposure to significant potential liability, therefore, if
it fails to institute and enforce internal controls sufficient to comply w/
the FCPA.

Internal controls should ensure that data produced by a computer are
accurate and reliable.  This means that restrictions should be put on access
to computer records and on who has the capability to enter information or
alter data in the computer.  "Audit Trails" should also be used to create
documentary evidence of transactions and of who made particular data entry.
Finally, electronic record keeping systems are only as trustworth as the
people who use them, and it is imperative that a security system be
established to help preclude unauthorized person from gaining access to the
computer or altering information in the system.

ACCOUNTANTS' RESPONSIBILITIES:  The 21.3$ million bank embezzlement raises
substantial questions about the sufficiency of the auditing procedures of a
bank or other company that uses an electronic data processing system for the
storage and representation of assets.  The role of an accountant performing
an independent audit is to furnish anopinion that the accounts of the
company being audited are in proper order and that they fairly present the
company's financial position.  It seems obvious, therefore, that an
independent accountant performing an audit of a company that uses an EDP
system should examine the reliability of the system and the controls on it
before issuing an opinion.  Otherwise, the accountant's certification of the
company's financial statements would have no reliable basis.  The Second
Standard of Field Work of the Generally Accepted Auditing Standards approved
and adopted by the membership ofthe American Institute of Certified Public
Accountants (AICPA) states that "[t]here is to be a proper study and
evaluation of the existing internal control as a basis for reliance thereon
and for the determination of the resultant extent of the tests to which
auditing procedures are to be restricted" (American Institue  of Certified
Public Accountants, Statement on Auditing Standards No, 1, Sec. 150.02.
[1973]).  This Standard of Field Work requires an auditor to study and
evaluate a corporation's system of interal control to establish a basis for
reliance thereon in formulating an opinion on the fairness of the
corporation's financial statements, and this basic duty does not vary w/ the
use of different methods of data processing as the Standard states:

SINCE THE DEFINITION AND RELATED BASIC CONCEPTS OF ACCOUNTING CONTROL ARE
EXPRESSED IN TERMS OF OBJECTIVES, THEY ARE INDEPENDENT OF THE METHOD OF DATA
PROCESSING USED; CONSEQUENTLY, THEY APPLY EUQLLY TO MANUAL, MECHANICAL, AND
ELECTRONIC DATA PROCESSING SYSTEMS. HOWEVER, THE ORGANIZATION AND PROCEDURES
REQUIRED TO ACCOMPLISH THOSE OBJECTIVES MAY BE INFLUENCED BY THE METHOD OF
DATA PRCOESSING USED.

The AICPA has recognized that "[t]he increasing use of computers for
processing accounting and other business information has introduced
additional problems in reviewing and evaluating internal control for audit
purposes," and it has issued a Statement on the Effects of EDP on the
Auditor's Study and Evaluation of Internal Control.  This Statement provides
that:

WHEN EDP IS USED IN SIGNIFICANT ACCOUNTING APPLICATIONS, THE AUDITOR SHOULD
CONSIDER THE EDP ACTIVITY IN HIS STUDY AND EVALUATION OF ACCOUNTING CONTROL.
THIS IS TRUE WHETHER THE USE OF EDP IN ACCOUNTING APPLICATIONS IS LIMITED OR
EXTENSIVE AND WHETHER THE EDP FACILITIES ARE OPERATED UNDER THE DIRECTION OF
THE AUDITOR'S CLIENT OR A THIRD PARTY.

When Auditing a coporation w/ an EDP system, therefore, an auditor should
thoroughly examine the system to evaludate its control feautres.  To conduct
his examination properly, however, the auditor must have sufficient
expertise to enable him to understand entirely the particular EDP system
invloved.

CONCLUSIONS ON APPLYING LEGAL CONCEPTS

Everyone who uses or supplies computer services has a common law duty to
exercise resonable care to ensure that information supplied by the computer
is accurate and reliable.  The federal securities laws impose additional
duties on management to keep accurate records and to devise and maintain a
system of internal accounting controls sufficient to provide reasonable
assurances that transactions are executed in accordance w/ management's
authorization and are accurately recorded.  Finally, accountants who audit
companies w/ EDP systems have a duty to review the company's system of
internal controls and to disclose any material deficiencies to management
and possibly to the public through notes to its certification of financial
statements.

These various duties illustrate the necessity of taking steps to ensure the
reliability of computer systems.  A well-designed system of internal control
is crucial to safeguard against the improper use of the computer.  Internal
control begins w/ the computer equipment itself.  When converting to an EDP
record keeping system, management should get outside advice on the type of
system required and on the controls that should be built into the system.
Management should fully understand what the computer programs in the system
are designed to do and that the computer can do only what it is told and
nothing more.  This can be an important method of preventing fraud, and
management should demand that internal controls be put into the system, b/c
otherwise the programmer may not do so.

Once controls are built into the computer system itself, internal controls
hsould be established and maintained to prevent unauthorized access to the
system.  The internal controls should cover all phases of EDP and include
input, processing, and output controls.  An overall plan of organization and
operation should be devised containing controls over access to EDP
equipment, as well as provisions for effective supervision and rotation of
personnel, and the plan should be strictly enforced.  Rinally, an internal
auditing process should be established to provide independent document
counts or totals of significant data fields.

The independent accountant plays a major role in preventing unauthorized
persons from gaining access to the computer system.  Through his review of a
company's internal controls, an accountant can detect possible weaknesses
and recommend useful changes.  It is very important, therefore, that outside
auditors closely scrutinize a company's internal control system.  A rigorous
independent audit makes up the final stage of an overall plan to help
prevent the production of inaccurate computer based data.

PROTECTING PROPRIETARY INTERESTS IN COMPUTER PROGRAMS

Discussions w/ legal counsel at several of the field sites revealed
considerable concern about proprietary interests in computer programs.
Little communication exists between lawyers and data processing managers,
and areas of their mutal concers are not often addressed.  Communication is
even more important today as programs and data files are increasingly viewed
by management as valuable, intangible assets of their organizations.  In
addition, government and business organizations are increasingly acquiring
commercially available computer programs where proprietary interests of
providers and users must be protected.  Selection of generally used controls
will be strongly influenced by the need to preserve proprietary rights to
computer programs.

PROBLEMS ADDRESSED

Protecting proprietary interests in computer programs in a multifaceted task
that requires knowledge of the law, computer programs, and security.  Few
data processing managers have this expertise in-house, but all owners and
custodians of computer programs can and should add to their skills and
knowledge from other sources of expertise.

Those invloved w/ computer programs--owners, users, custodians, employees,
and competitors--have two conflicting goals; sometimes the same party
pursues both goals simultaneously for different products.  One goal is to
protect the computer program, either to ensure a competitive advantage by
preventing others from using the computer program or to charge for its use
or disclosure.  The other goal is to ignore protection so that the computer
programs can be used and transferred at will and w/out cost.  The particular
goal sought by an organization depends on its values, purposes, and
policies; however, the data processing manager should understand the
boundaries of fair and legal business practice that apply to users,
custodians, and owners of computer programs, as well as to competitors.

THE NATURE OF COMPUTER PROGRAMS

Before the types of comptuer programs involved are identified, it is helpful
to know why the laws differentiate computer programs from other parts of
computer systems.  A computer program is a form of intellectual property (a
valuable, intangible asset consisting of ideas, process, and methods) that
is relatively new and eludes analogy to previously existing products.
Debate continues as to whether computer programs are products, technical
processes, or professional services.  Computer programs are thus unique as a
subject of treatment under existing law, and applying the law requires
adapting current legal concepts of particular forms of computer programs.
Computer programs are developed to run in specific types of computers (such
as operating systems) or are machine independent (such as many application
programs).  They may be in human-readable form or machine-readable form.
Some computer programs are translated into different programming languages
or converted to run on different computers.

FORMS OF LEGAL PROTECTION

The five forms of legal protection that can apply to computer programs are
patent, copyright, trade secret, trademark and contract.

PATENTS:_Patent protection is a federal statutory right giving the inventor
or his assignee exlusive rights to make, use, or sell a product or process
for 17 years.  An invention must meet several criteria to receive patent
protection.  First, it must involve statutory subject matter (I.E., physical
methods, apparatus, compositions of matter, devices, and improvements).  It
cannot consist merely of an idea or a formual.  Furthermore, the invention
must be new, useful, not obvious, and must be described according to patent
regulations in a properly filed and prosecuted patent application.

The status of patent protection for computer programs until 1981 was
ambiguous.  In three dicisons the US Supreme Court held that parrticular
computer programs were unaptentable b/c of failure to meet one or more of
the tests described previously.  The Court declined to patent what it felt
was merely a formula, it had held a process non-patentable for obviousness,
and it had refused a patent when the only novelty involved was the form of
carrying out a nonpatentable step.

In 1981, however, the Supreme Court handed down two decisions that may have
some effect on future patentability claims.  These cases invlved computer
programs that are part of inventions otehrwise eligible for patent.  In one
case, the Court decided that a process control computer program for curing
synthetic rubber should not be denied a patent simply b/c it uses an
algorithm (an ordered set of insturctions) and a computer.  The US Patent
Office must still determine whether the entire process is novel enough to
warrant issuing a patent.

In a companion case, the Court let stand a lower court ruling that a module
of the Honeywell Series 60 Level 64 computer system should be considered for
patent.  The module, which includes electronic circuits and a computer
program fixed in the circuits, is a storage and retrieval device using
internal storage registers.  Again, the device must meed the novelty
requirement before a patent is issued.  Note that these decisions invlove
computer progams that are part of a patentable device or process; these
decisions do not reverse past rulings that computer programs are not
patentable.

Even if there were a major change in computer programs patent policy, few
owners would seek patent status for their computer programs.  The patent
process is lengthy and expensive and requires full disclosure of the idea.
Furthermore, a patent has only a 50% chance of surviving a challenge to its
validity in the courts.  For those few programs that really do represent
technological breakthroughs, however, a patent would provide the exclusive
right to use or sell the program for 17 years (patents are nonrenewable).

COPYRIGHTS:_Copyright is the federal statutory protection for an author's
writings.  Written works created since 01JAN78 are protected by the new
copyright law, which provides exclusive rights to the author or his assignee
for the copyright, publication, broadcast, translation, adaptation, display,
and performance of the idea contained in the work from the time it is embodied
in tangible form.  This protection is lost in the writing is published w/out
copyright notice, which consists of the word copyright (or copyright symbol),
the date, and the author's name.  This notice must be affixed so that it
attracts the attention of third parties(I.E., On the first or inside front
page of a book or pamphlet).  In late 1980 a federal copyright bill was enacted
explicitly to cover computer programs and data bases.

Copyright is inexpensive and can be obtained quickly.  One required and one
optinal copy along w/ minor filing fees must be submitted to the Copyright
Office.  The second copy can be the first and last 25 pages of the program.
Although optional, the second coy is a prerequisite for bringing an
infringement suit and for some remedies such as statutory damages and the
award of attorney fees.  The coyright remains in effect for 50 years beyond
the death of the author and is nonrenewable.

B/c copyright protects only against copying and requires disclosure of the
idea, its usefulness is limited for some programs.  However, it can be
adequate protection for inexpensive package programs sold in the multiple
copy market.  The function of such programs is not unique; the value to the
owner lies in selling thousands of copies.

TRADE SECRETS:_A trade secret is a right protected by state rather than
federal law.  It is defined in many states as a secret formula, pattern,
scheme, or device used in the operation of a business that gives the
organization a competitive advantage over those who do not know it.
computer programs have qualified as trade secrets in a number of court
cases.

The requirement for trade secret status is that the item must remain secret.
Absolute secrecy is not required; for example, if the secret is disclosed
only to people bound (by virtue of their relationship or by contract) to
keep it confidential, trade secret status is maintained regardless of how
many people know it.  Confidential realationships include employees, agents
in a fiduciary or trust relationship, and thieves.  To prevent thieves from
profiting from ill-gotten knowledge, the laws hold that they are in a
constructive trust relationship.  A contract is used to bind licensees and
joint venture partners or investors.  In some states these people are bound
even w/out a contract.

Once the secret is disclosed w/out a requirement of confidentiality, or is
disclosed to someone who does not know its secret character, the trade
secret status is lost forever.  (Trade secrets are often disclosed
carelessly to user groups and at technical meetings.)  If the secret is not
disclosed, however, the protection can last forever.

Employees who learn the secret in the course of their duties are bound not
to misappropriate it b/c of their trust relationship.  Many employees do not
realize the comprehensive nature of that trust should be educated by their
employers before they injure both the employer and themselves by using computer
programs developed for an employer for their own purposes.

TRADEMARKS:_Trademark protection provides the exclusive right to use a
symbol to identify goods and services.  Trademark rights take effect upon
use in commerce.  Registration w/ the US Patent Office or a state agency is
not necessary to obtain trademark status, but it helps greatly in exercising
trademark rights.  Trademark protection exists at both the federal and state
levels.  The protected symbol can be both a trade name and a logo (E.G.
XYZ).  The protection afforded by the trademark is limited to the name or
logo.  The program content itself is not protected.  B/c the major benefit
of trademark protection is to prevent another product from being given the
same name, this protection is useful only for programs that will be
marketed.

CONTRACTS:_Copies of computer programs are ordinarily transferred to others
in the course of doing business (sometimes in source language form);
therefore, transfer is frequently accompanied by an agreement to keep the
computer program confidential.  Patented and copyrighted computer programs
can be transferred using contracts that have more restrictive provisions
that the patent or copyright laws requires.  The owner can, for example,
contract w/ another not to disclose copyrighted computer progras.  In
addition, damages for disclosure or unauthorized copying, complex formulas
for royalty payment for legitimate use, and the ownership of enhancements
and changes to the computer program can also be delineated in a contract.

SELECTING THE RIGHT PROTECTION

The type of protection that is best for a particular computer program
depends on several factors:

(1) The longer the lifespan of the program, the more likely that the
    expensive investment of patent protection will be worthwhile.

(2) The higher the value of the program, the more money that can
    reasonably be spent of protection

(3) Algorithms that must be disclosed widely are (if otherwise worth the
    investment) best protected by patent, which precludes use as well as
    duplication.  Copyright protects only against copying, and trade secret
    protection is irrevocably lost if the algorithm is inadvertently
    disclosed outside a confidential relationship.

(4) The most expensive protection is patent; the least expensive is
    copyright.

(5) Patents take the longest time to obtain; the other forms offer almost
    immediate protection.

(6) A patent protects against recreation; trade secret protection is lost
    if the program can be recreated.

These factors are summarized in TABLE 1.

UNRESOLVED LEGAL ISSUES

Two unresolved but imprtant legal issues affect the analysis summarized in
TABLE 1.  The first is the patentability of computer programs discussed
previously.  The data processing manager and corporate counsel should keep
track of the continuing legal debate in this area.  The second unresolved
issue is the legal relationship between copyright and trade secret
protection when both are used for the same product.  Trade secret protection
has been held by the US Supreme Court to be compatible w/ patent protection,
but the Court has yet to decide whether a trade secret can be copyrighted to
protect the secret in case it is disclosed.

TABLE 1.

DECISION TABLE FOR TYPES OF LEGAL PROTECTION
|---------------------------------------------------------------|
|DECISION FACTOR                  | HIGH     | MEDIUM  | LOW    |
|---------------------------------------------------------------|
|ESTIMATED LIFESPAN OF THE PROGRAM| C OR TS  | P       | C OR TS|
|VALUE OF THE PROGRAM TO THE OWNER| P, C, TS | P, C, TS| C, TS  |
|NEED TO DISCLOSE THE PROGRAM     |          |         |        |
|TO OTHERS                        |  P, C    | TS, C   | TS     |
|OWNER'S EXPENSE BUDGET           |  P, TS, C| TS, C   | C      |
|TIME SENSITIVITY                 |  TS, C   | P, TS, C| P, TS  |
|SUSCEPTIBILITY TO REVERSE        |          |         |        |
|ENGINEERING                      |  P       | P, TS   | TS, C  |
|---------------------------------------------------------------|
 NOTES C=COPYRIGHT, P=PATENT, TS=TRADE SECRET

The policies underlying the two forms of protection conflict:  federal
copyright protection contemplates disclosure, while state trade secret
protection requires nondisclosure w/out an obligation for further
disclosure.  According to some legal scholars, a court could rule that a
copyrighted program is not eligible for trade secret protection.  Other
legal scholars argue that since the disclosure requirement for federal
patent protection has not preempted trade secret protection, the Supreme
Court should also uphold the right of computer program owners to receive
both trade secret and copyright protection.

SUGGESTED CONTROLS

B/c of these critical and unresolved legal issues, developers should
carefully evaluate the types of protection and rmain alert to changes in the
laws.  At present,often the best alternative is to copyright computer
programs and then license or disclose the computer program using agreements
that restrict use, transfer, and disclosure.  This approach should not
conflict w/ existing copyright law theory, and it achieves the same secrecy
afforded by trade secret protection.

Embodying the program in electronic circuitry is another alternative that
should be considered.  It cannot be altered by the user and inhibits copying
and user enhancements.  In addition, the recent Supreme Court decision
suggests that programs in such form can receive patent protection if they
are parts of patentable devices.  W/out patent protection, they are
susceptible to recreation and thus to loss of trade secret status.

to provide notice of the proprietary rights of computer-related materials,
the owner should put a human-readable notice on all materials a user will
see.  The notice can be placed on a computer terminal that displays the
program, on listings, on manuals, on containers of machine-readable
material, and in the program itself.  A suggested form of notice is:

THIS IS AN UNPUBLISHED WORK PROTECTED UNDER THE COPYRIGHT LAW OF 1976.  IT
IS OWNED BY XYZ COMPANY, ALL RIGHTS RESERVED.  ANY UNAUTHORIZED DISCLOSURE,
DUPLICATION, OR USE IS A VIOLATION OF CIVIL AND CRIMINAL LAW.

If licensed, a reference to the license can be included in the notice.

IF THE WORK IS PUBLISHED, IT SHOULD HAVE THE FORMAL COPYRIGHT NOTICE
ATTACHED IN LIEU OF THE ABOVE STATEMENT.  THE INTENTIONAL OMISSION OF THE
COPYRIGHT WILL CAUSE THE OWNER TO LOSE HIS COPYRIGHT; AN UNINTENTIONAL
OMISSION CAN BE REMEDIED.

EMPLOYER-EMPLOYEE RELATIONSHIPS

Many problems covering computer programs protection arise from the
employer-employee relationship, where two philosophies often conflict.  One
philosophy is that the products of the employee belong to the employer; the
other is that employees should be free to change jobs during their careers
and to use the expertise gained in one job in new work situations.

Although some employers might argue that all work done during employment
belongs to them, and some employees might claim that their creations are
theirs exclusively, the laws do not generally support either claim.  State
laws vary on this question; however, the prevailing view is that programs
written or developed as a specific task assigned by the employer belong
exclusively to the employer, and that programs written or developed solely
by the employee, using the employee's own time/resources, belong exclusively
to the employee.  Most controversy over computer program ownership falls in
the gray area between these two positions.

The following discussion centers on trade secret law since patent and
copyright protection are less helpful.  Patent protection for computer
programs is ambiguous and hence rarely used, and most companies have a
well-established patent assignment policy.  On the other hand, the new
copyright law is explicit regarding work for hire:

IN THE CASE OF A WORK MADE FOR HIRE, THE EMPLOYER OR OTHER PERSON FOR WHOM
THE WORK WAS PREPARED IS CONSIDERED THE AUTHOR FOR PURPOSES OF THIS TITLE,
AND, UNLESS THE PARTIES HAVE EXPRESSLY AGREED OTHERWISE IN A WRITTEN
INSTRUMENT SIGNED BY THEM, OWNS ALL OF THE RIGHTS COMPRISED IN THE
COPYRIGHT.

Conflicts of trade secret ownership between employers and employees for
other than assigned work are usually resolved based on the resources used.
Employees who develop new computer programs on their own time, at home, on a
personally owned terminal, but using employer computer time may be found to
own the programs; however, the employer may be given a royalty-free license
to use the programs in its business.  A more complex question concerns
employees working at home on flextime or w/ an employer-owned terminal or
microcomputer.  In such cases, proof of whose resources are used in
development is more difficult to establish.

legal battles over program ownership are very costly to both sides and
consume enormous amounts of time/energy.  Often a court formulates a
compromise so that neither side actually wins.  To avoid going to court over
program ownership, employers should have an explicit policy regarding
employee-developed programs.  This policy can be part of an
organization-wide trade secret protection plan developed by management and
legal counsel.

A basic control requires that each employee involved in developing computer
programs should be required to sign an agreement concerning ownership of
computer programs at the time of hire.  A formal emplyment or secrecy
agreement or an informal letter to the employer can be used.  Since both
types of agreement are legally effective, management style should determine
which approach is used.  The informal letter is friendlier, but the awesome
contract form may make a more lasting impression on the employee.

If a simple letter is used, the following format is recommended for the key
paragraph:

ALL COMPUTER PROGRAMS WRITTEN BY ME, EITHER ALONE OR W/ OTHERS, DURING THE
PERIOD OF MY EMPLOYMENT, COMMENCING ON _______________, 19__, AND UP TO AND
INCLUDING A PERIOD OF ____________ AFTER TERMINATION, WHETHER OR NOT
CONCEIVED OR MADE DURING MY REGULAR WORKING HOURS, ARE THE SOLE PROPERTY OF
THE COMPANY.

This important control prevents misunderstanding and protects the employer
against legal action.

Employees may use skills developed during previous jobs; however, they may
not use trade secrets disclosed to or produced by them during those jobs.
This is enjoinable behavior and may result in the award of damages to the
former emplyer.  Departing employees should take nothing tangible from the
old job -- listings, notebooks, tapes, documents, or copies of any kind,
including lists of specific customers.  Prospective employers should
carefully avoid crossing the fine line between hiring someone to provide
expertise in a particular area and hiring someone to provide knowledge of a
competitor's proprietary products or business plan.  Spcial care is required
when more than one employee is hired from the same company.

Another essential control requires that departing employees should be
reminded during the exit interview that no materials or proprietary concepts
received during employment can be used at the new job.  They should be asked
to read and sign a statement that acknowledges their understanding of this
point.  The statement should also affirm that no materials have been removed
from the employer's premises and that all those previoulsy in the employee's
possession have been returned.  Employers should obtain the employee's new
address in case later contract is necessary.

During the exit interview, employees should have the opportunity to clarify
gray areas -- programs they wrote on their own time using company terminals
and company computer time, innovations they developed that the company never
used, and so on.  Permitting a departing employee to use an invention that
will not cause loss of competitive advantage can ensure a friendly and loyal
colleague in the marketplace.  In any case, legal counsel should be involved
in these sessions, b/c an attorne experienced in trade secret law can interpret
the naunces of the interview more effectively and can emphasize the consequences
of unfair competitive conduct.

GUIDELINES FOR COMPUTER PROGRAM USERS

Users who obtain computer programs outside of contractual or other
confidential relationships that preclude competitive action can legally
recreate the programs and use them freely even if they know they are trade
secrets.  In addition, users who obtain computer programs from third parties
w/out any knowledge that they are proprietary are free to use them.  In such
cases the third party may be liable to the owner for misappropriation.
Computer program users should note, however, that intentional wrongful use
in this situation may lead to criminal and civil liability for infringement
or misappropriation.

Patented inventions can only be used w/ the owner's permission.  The alleged
infringer, however, can challenge the validity of the patent in court and,
if successful, can defeat the patentee's exclusive right to use the
invention.

Another problem concerns the owernship of a user-made change or enhancement
that significantly alters the constitution of the computer program.  Neither
copyright nor trade secret law is explicit n this point.  Many vendor-user
agreements require the user to return all copies of the computer program at
the end of the term; however, few vendores forbid user changes and
enhancements or ask for royalties from new works embodying or based on their
computer programs.  Some agreements contain provisions that any and all
changes belong to the vendor.  Thus, the computer program user should pay
special attention to contract provisions regarding changes and enhancements.
In the absence of a specific agreement, the user takes some risk but has a
fair chance of surviving a challenge that user-made changes infringe on the
vendor's rights.

RECOMMENDED COURSE OF ACTION

The data processing manager should understand the legal alternatives for
protecting computer programs and adopt prudent controls used by others under
similar circumstances.  If the organization uses computer programs developed
and owned by outside parties, this understanding and use of controls can
prevent legal problems and can ensure that the terms of the agreement for
using the computer programs are proper.  for organizations that develop
computer programs in-house, a corporate policy based on a thorough knowledge
of the laws is a basic control that can prevent misunderstandings between
management and development personnel.

Such a policy can also ensure that the company does not lose a competitive
advantage b/c of unathorized disclosure or copying of programs.  B/c the
laws in this are are subject to change, the data processing manager should
stay in close touch w/ the organization's legal counsel to keep pace w/ the
latest developments.

Meeting standards of due care and protecting proprietary interests in
computer programs are examples of common sources of motivation and need to
adopt generally used controls.  Consideration of these common sources of
motivation and need, as well as the generally used controls (many found in
the study of the field sites), leads to a new computer security concept
presented in the next section.

                                END OF PART III

              NIA---NIA---NIA---NIA---NIA---NIA---NIA---NIA---NIA


Current List Of BBS's that carry ALL of Network Information Access Files:

BBS NAME           PHONE NUMBER    SYSOP(S)                        SOFTWARE
--- ----           ----- ------    --------                        --------
Metamorphis Alpha  713/475-9055    Starchilde/Moonchilde           TAG
Pier 7             713/477-2681    Slice/Mouser                    Quick
The End Over!      713/821-4174    Chester                         TAG
The Enigma         713/852-7121    Odysseus/Volker/Brutus          Telegard
Talk Radio         713/941-0917    Sir Lawrence/Lord MacDuff       TAG

All Boards are 24 Hours unless otherwise noted...