The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / phrack2 / phrack45.t20 < prev next >

Wrap

Text File | 2003-06-11 | 70.5 KB | 1,213 lines

==Phrack Magazine== Volume Five, Issue Forty-Five, File 20 of 28 **************************************************************************** The Senator Markey Hearing Transcripts [To obtain your own copy of this hearing and the other related ones, contact the U.S. Government Printing Office (202-512-0000) and ask for Serial No. 103-53, known as "Hearings Before The Subcommittee on Telecommunications and Finance of the Committee on Energy and Commerce, House of Representatives, One Hundred Third Congress, First Session, April 29 and June 9, 1993".] ---------------------------------------------------------------------- Mr. MARKEY. If you could close the door, please, we could move on to this very important panel. It consists of Mr. Donald Delaney, who is a senior investigator for the New York State Police. Mr. Delaney has instructed telecommunications fraud at the Federal Law Enforcement Training Center and has published chapters on computer crime and telecommunications fraud. Dr. Peter Tippett is an expert in computer viruses and is the director of security products for Symantec Corporation in California. Mr. John J. Haugh is chairman of Telecommunications Advisors Incorporated, a telecommunications consulting firm in Portland, Oreg., specializing in network security issues. Dr. Haugh is the editor and principal author of two volumes entitled "Toll Fraud" and "Telabuse" in a newsletter entitled "Telecom and Network Security Review." Mr. Emmanuel Goldstein is the editor-in-chief of "2600: The Hacker Quarterly." Mr. Goldstein also hosts a weekly radio program in New York called "Off The Hook." Mr. Michael Guidry is chairman and founder of the Guidry Group, a security consulting firm specializing in telecommunications issues. The Guidry Group works extensively with the cellular industry in its fight against cellular fraud. We will begin with you, Mr. Delaney, if we could. You each have 5 minutes. We will be monitoring that. Please try to abide by the limitation. Whenever you are ready, please begin. STATEMENTS OF DONALD P. DELANEY, SENIOR INVESTIGATOR, NEW YORK STATE POLICE; JOHN J. HAUGH, CHAIRMAN, TELECOMMUNICATIONS ADVISORS; EMMANUEL GOLDSTEIN, PUBLISHER, 2600 MAGAZINE; PETER S. TIPPETT, DIRECTOR, SECURITY AND ENTERPRISE PRODUCTS, SYMANTEC CORP.; AND MICHAEL A. GUIDRY, CHIEF EXECUTIVE OFFICER, THE GUIDRY GROUP Mr. DELANEY. Thank you, Mr. Chairman, for the invitation to testify today. As a senior investigator with the New York State Police, I have spent more than 3 years investigating computer crime and telecommunications fraud. I have executed more than 30 search warrants and arrested more than 30 individuals responsible for the entire spectrum of crime in this area. I authored two chapters in the "Civil and Criminal Investigating Handbook" published by McGraw Hill entitled "Investigating Computer Crime and Investigating Telecommunications Fraud." Periodically I teach a 4-hour block instruction on telecommunications fraud at the Federal Law Enforcement Training Center in Georgia. Although I have arrested some infamous teenagers, such as Phiber Optic, ZOD, and Kong, in some cases the investigations were actually conducted by the United States Secret Service. Because Federal law designates a juvenile as one less than 18 years of age and the Federal system has no means of prosecuting a juvenile, malicious hackers, predominately between 13 and 17 years of age, are either left unprosecuted or turned over to local law enforcement. In some cases, local law enforcement were either untrained or unwilling to investigate the high-tech crime. In examining telecommunications security, one first realizes that all telecommunications is controlled by computers. Computer criminals abuse these systems not only for free service but for a variety of crimes ranging from harassment to grand larceny and illegal wiretapping. Corporate and Government espionage rely on the user-friendly networks which connect universities, military institutions, Government offices, corporate research and development computers. Information theft is common from those companies which hold our credit histories. Their lack of security endanger each of us, but they are not held accountable. One activity which has had a financial impact on everyone present is the proliferation of call sell operations. Using a variety of methods, such as rechipped cellular telephones, compromised PBX remote access units, or a combination of cellular phone and international conference lines, the entrepreneur deprives the telephone companies of hundreds of millions of dollars each year. These losses are passed on to each of us as higher rates. The horrible PBX problem exists because a few dozen finger hackers crack the codes and disseminate them to those who control the pay phones. The major long distance carriers each have the ability to monitor their 800 service lines for sudden peaks in use. A concerted effort should be made by the long distance carriers to identify the finger hackers, have the local telephone companies monitor the necessary dialed number recorders, and provide local law enforcement with timely affidavits. Those we have arrested for finger hacking the PBX's have not gone back into this type of activity or crime. The New York State Police have four newly trained investigators assigned to investigate telecommunications fraud in New York City alone. One new program sponsored by AT&T is responsible for having trained police officers from over 75 departments about this growing blight in New York State alone. Publications, such as "2600," which teach subscribers how to commit telecommunications crime are protected by the First Amendment, but disseminating pornography to minors is illegal. In that many of the phone freaks are juveniles, I believe legislation banning the dissemination to juveniles of manuals on how to commit crime would be appropriate. From a law enforcement perspective, I applaud the proposed Clipper chip encryption standard which affords individuals protection of privacy yet enables law enforcement to conduct necessary court-ordered wiretaps, and with respect to what was being said in the previous conversation, last year there were over 900 court-ordered wiretaps in the United States responsible for the seizure of tons of illicit drugs coming into this country, solving homicides, rapes, kidnappings. If we went to an encryption standard without the ability for law enforcement to do something about it, we would have havoc in the United States -- my personal opinion. In New York State an individual becomes an adult at 16 years old and can be prosecuted as such, but if a crime being investigated is a Federal violation he must be 18 years of age to be prosecuted. Even in New York State juveniles can be adjudicated and given relevant punishment, such as community service. I believe that funding law enforcement education programs regarding high-tech crime investigations, as exists at the Federal Law Enforcement Training Center's Financial Frauds Institute, is one of the best tools our Government has to protect its people with regard to law enforcement. Thank you. Mr. WYDEN [presiding]. Thank you very much for a very helpful presentation. Let us go next to Mr. Haugh. We welcome you. It is a pleasure to have an Oregonian, particularly an Oregonian who has done so much in this field, with the subcommittee today. I also want to thank Chairman Markey and his excellent staff for all their efforts to make your attendance possible today. So, Mr. Haugh, we welcome you, and I know the chairman is going to be back here in just a moment. STATEMENT OF JOHN J. HAUGH Mr. HAUGH. Thank you, Mr. Wyden. We expended some 9,000 hours, 11 different people, researching the problem of toll fraud, penetrating telecommunications systems, and then stealing long distance, leading up to the publication of our two-volume reference work in mid-1992. We have since spent about 5,000 additional hours continuing to monitor the problem, and we come to the table with a unique perspective because we are vender, carrier, and user independent. In the prior panel, the distinguished gentleman from AT&T, for whom I have a lot of personal respect, made the comment that the public justifiably is confident that the national wire network is secure and that the problem is wireless. With all due respect, that is a laudable goal, but as far as what is going on today, just practical reality, that comment is simply incorrect, and if the public truly is confident that the wired network is secure, that confidence is grossly misplaced. We believe 35,000 users will become victimized by toll fraud this year, 1993. We believe the national problem totals somewhere between $4 and $5 billion. It is a very serious national problem. We commend the chairman and this committee for continuing to attempt to draw public attention and focus on the problem. The good news, as we see it, over the last 3 years is that the severity of losses has decreased. There is better monitoring, particularly on the part of the long distance carriers, there is more awareness on the part of users who are being more careful about monitoring and managing their own systems, as a result of which the severity of loss is decreasing. That is the good news. The bad news is that the frequency is greatly increasing, so while severity is decreasing, frequency is increasing, and I will give you some examples. In 1991 we studied the problem from 1988 to 1991 and concluded that the average toll fraud loss was $168,000. We did a national survey from November of last year to March of this year, and the average loss was $125,000, although it was retrospective. Today we think the average loss is $30,000 to $60,000, which shows a rather dramatic decline. The problem is, as the long distance thieves, sometimes called hackers, are rooted out of one system, one user system, they immediately hop into another one. So severity is dropping, but frequency is increasing. Everybody is victimized. You have heard business users with some very dramatic and very sad tales. The truth is that everybody is victimized; the users are victimized; the long distance carriers are victimized; the cellular carriers are victimized, the operator service providers; the co-cod folks, the aggregators and resellers are victimized; the LEC's and RBOC's, to a limited extent, are victimized; and the vendors are victimized by being drawn into the problem. Who is at fault? Everybody is at fault. The Government is at fault. The FCC has taken a no-action, apathetic attitude toward toll fraud. That Agency is undermanned, it is understaffed, it is underfunded, it has difficult problems -- no question about that -- but things could and should be done by that Agency that have not been done. The long distance carriers ignored the problem for far too long, pretended that they could not monitor when, in fact, the technology was available. They have done an outstanding job over the last 2 years of getting with it and engaging themselves fully, and I would say the long distance carriers, at the moment, are probably the best segment of anyone at being proactive to take care of the problem. Users too often ignored security, ignored their user manuals, failed to monitor, failed to properly manage. There has been improvement which has come with the public knowledge of the problem. CPE venders, those folks who manufactured the systems that are so easy to penetrate, have done an abysmally poor job of engineering into the systems security features. They have ignored security. Their manuals didn't deal with security. They are starting to now. They are doing a far better job. More needs to be done. The FCC, in particular, needs to become active. This committee needs to focus more attention on the problem, jawbone, keep the heat on the industry, the LEC's and the RBOC's in particular. The LEC's and the RBOC's have essentially ignored the problem. They are outside the loop, they say, yet the LEC's and the RBOC's collected over $21 billion last year in access fees for connecting their users to the long distance networks. How much of that $21 billion did the LEC's and the RBOC's reinvest in helping to protect their users from becoming victimized and helping to combat user-targeted toll fraud? No more than $10 million, one-fifth of 1 percent. Many people in the industry feel the LEC's and the RBOC's are the one large group that has yet to seriously come to the table. Many in the industry -- and we happen to agree -- feel that 3 to 4 percent of those access fees should be reinvested in protecting users from being targeted by the toll fraud criminals. The FCC should become more active. The jawboning there is at a minimal level. There was one show hearing last October, lots of promises, no action, no regulation, no initiatives, no meetings. A lot could be done. Under part 68, for example, the FCC, which is supposed to give clearance to any equipment before it is connected into the network, they could require security features embedded within that equipment. They could prevent things like low-end PBX's from being sold with three-digit barrier codes that anyone can penetrate in 3 to 5 minutes. Thank you, Mr. Chairman. Mr. MARKEY. THANK YOU, MR. HAUGH, VERY MUCH. Mr. Goldstein, let's go to you next. STATEMENT OF EMMANUEL GOLDSTEIN Mr. GOLDSTEIN. Thank you, Mr. Chairman, and thank you to this committee for allowing me the opportunity to speak on behalf of those who, for whatever reason, have no voice. I am in the kind of unique position of being in contact with those people known as computer hackers throughout the world, and I think one of the misconceptions that I would like to clear up, that I have been trying to clear up, is that hackers are analogous to criminals. This is not the case. I have known hundreds of hackers over the years, and a very, very small percentage of them are interested in any way in committing any kind of a crime. I think the common bond that we all have is curiosity, an intense form of curiosity, something that in many cases exceeds the limitations that many of us would like to put on curiosity. The thing is though, you cannot really put a limitation on curiosity, and that is something that I hope we will be able to understand. I like to parallel the hacker culture with any kind of alien culture because, as with any alien culture, we have difficulty understanding its system of values, we have difficulty understanding what it is that motivates these people, and I hope to be able to demonstrate through my testimony that hackers are friendly people, they are curious people, they are not out to rip people off or to invade people's privacy; actually, they are out to protect those things because they realize how valuable and how precious they really are. I like to draw analogies to where we are heading in the world of high technology, and one of the analogies I have come up with is to imagine yourself speeding down a highway, a highway that is slowly becoming rather icy and slippery, and ask yourself the question of whether or not you would prefer to be driving your own car or to be somewhere inside a large bus, and I think that is kind of the question we have to ask ourselves now. Do we want to be in control of our own destiny as far as technology goes, or do we want to put all of our faith in somebody that we don't even know and maybe fall asleep for a little while ourselves and see where we wind up? It is a different answer for every person, but I think we need to be able to at least have the opportunity to choose which it is that we want to do. Currently, there is a great deal of suspicion, a great deal of resignation, hostility, on behalf of not simply hackers but everyday people on the street. They see technology as something that they don't have any say in, and that is why I particularly am happy that this committee is holding this hearing, because people, for the most part, see things happening around them, and they wonder how it got to that stage. They wonder how credit files were opened on them; they wonder how their phone numbers are being passed on through A&I and caller ID. Nobody ever went to these people and said, "Do you want to do this? Do you want to change the rules?" The thing that hackers have learned is that any form of technology can and will be abused, whether it be calling card numbers or the Clipper chip. At some point, something will be abused, and that is why it is important for people to have a sense of what it is that they are dealing with and a say in the future. I think it is also important to avoid inequities in access to technology, to create a society of haves and have-nots, which I feel we are very much in danger of doing to a greater extent than we have ever done before. A particular example of this involves telephone companies, pay phones to be specific. Those of us who can make a telephone call from, say, New York to Washington, D.C., at the cheapest possible rate from the comfort of our own homes will pay about 12 cents for the first minute. However, if you don't have a phone or if you don't have a home, you will be forced to pay $2.20 for that same first minute. What this has led to is the proliferation of what are known as red boxes. I have a sample (indicating exhibit). Actually, this is tremendously bigger than it needs to be. A red box can be about a tenth of the size of this. But just to demonstrate the sound that it takes for the phone company to believe that you have put a quarter into the phone (brief tone is played), that is it, that is a quarter. Now we can say this is the problem, this huge demonic device here is what is causing all the fraud, but it is not the case. This tape recorder here (same brief tone is played) does the same thing. So now we can say the tones are the problem, we can make tones illegal, but that is going to be very hard to enforce. I think what we need to look at is the technology itself: Why are there gaping holes in them? and why are we creating a system where people have to rip things off in order to get the same access that other people can get for virtually nothing? I think a parallel to that also exists in the case of cellular phones. I have a device here (indicating exhibit) which I won't demonstrate, because to do so would be to commit a Federal crime, but by pressing a button here within the course of 5 seconds we will be able to hear somebody's private, personal cellular phone call. Now the way of dealing with privacy with cellular phone calls is to make a law saying that it is illegal to listen. That is the logic we have been given so far. I think a better idea would be to figure out a way to keep those cellular phone calls private and to allow people to exercise whatever forms of privacy they need to have on cellular phone calls. So I think we need to have a better understanding both from the legislative point of view and in the general public as far as technology in itself, and I believe we are on the threshold of a very positive, enlightened period, and I see that particularly with things like the Internet which allow people access to millions of other people throughout the world at very low cost. I think it is the obligation of all of us to not stand in the way of this technology, to allow it to go forward and develop on its own, and to keep a watchful eye on how it develops but at the same time not prevent it through overlegislation or overpricing. Thank you very much for the opportunity to speak. Mr. MARKEY. Thank you, Mr. Goldstein. Dr. Tippett. STATEMENT OF PETER S. TIPPETT Mr. TIPPET. Thank you. I am Peter Tippett from Symantec Corporation, and today I am also representing the National Computer Security Association and the Computer Ethics Institute. Today is Computer Virus Awareness Day, in case you are not aware, and we can thank Jack Fields, Representative Fields, for sponsoring that day on behalf of the Congress, and I thank you for that. We had a congressional briefing this morning in which nine representatives from industry, including telecommunications and aerospace and the manufacturing industry, convened, and for the first time were willing to talk about their computer virus problems in public. I have got to tell you that it is an interesting problem, this computer virus problem. It is a bit different from telephone fraud. The virus problem is one which has probably among the most misrepresentation and misunderstanding of these various kinds of fraud that are going on, and I would like to highlight that a little bit. But before I do, I would like to suggest what we know to be the costs of computer viruses just in America. The data I am representing comes from IBM and DataQuest, a Dunn and Bradstreet company, it is the most conservative interpretation you could make from this data. It suggests that a company of only a thousand computers has a virus incident every quarter, that a typical Fortune 500 company deals with viruses every month, that the cost to a company with only a thousand computers is about $170,000 a year right now and a quarter of a million dollars next year. If we add these costs up, we know that the cost to United States citizens of computer viruses just so far, just since 1990, exceeds $1 billion. When I go through these sorts of numbers, most of us say, well, that hype again, because the way the press and the way we have heard about computer viruses has been through hype oriented teachings. So the purpose here is not to use hype and not to sort of be alarmist and say the world is ending, because the world isn't ending per se, but to suggest that there isn't a Fortune 500 company in the United States who hasn't had a computer virus problem is absolutely true, and the sad truth about these viruses is that the misconceptions are keeping us from doing the right things to solve the problem, and the misconceptions stem from the fact that companies that are hit by computer viruses, which is every company, refused to talk about that until today. There are a couple of other unique things and misconceptions about computer viruses. One is that bulletin boards are the leading source of computer viruses. Bulletin boards represent the infancy of the superhighway, I think you could say, and there are a lot of companies that make rules in their company that you are not allowed to use bulletin boards because you might get a virus. In fact, it is way in the low, single-digit percents. It may be as low as 1 percent of computer viruses that are introduced into companies come through some route via a bulletin board. We are told that some viruses are benign, and, in fact, most people who write computer viruses think that their particular virus is innocuous and not harmful. It turns out that most virus authors, as we just heard from Mr. Goldstein, are, in fact, curious people and not malicious people. They are young, and they are challenged, and there is a huge game going on in the world. There is a group of underground virus bulletin boards that we call virus exchange bulletin boards in which people are challenged to write viruses. The challenge works like this: If you are interested and curious, you read the threads of communication on these bulletin boards, and they say, you know, "If you want to download some viruses, there's a thousand here on the bulletin board free for your downloading," but you need points. Well, how do you get points? Well, you upload some viruses. Well, where do you get some viruses from? If you upload the most common viruses, they are not worth many points, so you have to upload some really good, juicy viruses. Well, the only way to get those is to write them, so you write a virus and upload your virus, and then you gain acceptance into the culture, and when you gain acceptance into the culture you have just added to the problem. It is interesting to know that the billion dollars that we have spent since 1990 on computer viruses just in the United States is due to viruses that were written in 1988 and 1987. Back then, we only had one or two viruses a quarter, new, introduced into the world. This year we have a thousand new computer viruses introduced into our community, and it won't be for another 4 or 5 years before these thousand viruses that are written now will become the major viruses that hurt us in the future. So virus authors don't believe they are doing anything wrong, they don't believe that they are being harmful, and they don't believe that what they do is dangerous, and, in fact, all viruses are. Computer crime laws don't have anything to do with computer virus writers, so we heard testimony this morning from Scott Charney of the Department of Justice who suggested that authorized access is the biggest law you could use, and, in fact, most viruses are brought into our organizations in authorized ways, because users who are legitimate in the organizations accidentally bring these things in, and then they infect our companies. In summary, I think that we need to add a little bit of specific wording in our computer crime legislation that relates particularly to computer viruses and worms. We need, in particular, to educate. We need to go after an ethics angle. We need to get to the point where Americans think that writing viruses or doing these other kinds of things that contaminate our computer superhighways are akin to contaminating our expressways. In the sixties we had a big "Keep America Beautiful" campaign, and most Americans would find it unthinkable to throw their garbage out the window of their car, but we don't think it unthinkable to write rogue programs that will spread around our highway. Thank you. Mr. MARKEY. Thank you, Dr. Tippett. Mr. Guidry. STATEMENT OF MICHAEL A. GUIDRY Mr. GUIDRY. Thank you, Mr. Chairman, for giving me the opportunity to appear before this subcommittee, and thank you, subcommittee, for giving me this opportunity. The Guidry Group is a Houston-based security consulting firm specializing in telecommunication issues. We started working in telecommunication issues in 1987 and started working specifically with the cellular industry at that time. When we first started, we were working with the individual carriers across the United States, looking at the hot points where fraud was starting to occur, which were major metropolitan cities of course. In 1991, the Cellular Telephone Industry Association contacted us and asked us to work directly with them in their fight against cellular fraud. The industry itself has grown, as we all know, quite rapidly. However, fraud in the industry has grown at an unbelievable increase, actually faster than the industry itself, and as a result of that fraud now is kind of like a balloon, a water balloon; it appears in one area, and when we try to stamp it out it appears in another area. As a result, what has happened is, when fraud first started, there was such a thing as subscription fraud, the same type of fraud that occurred with the land line telecommunication industry. That subscription fraud quickly changed. Now what has occurred is, technology has really stepped in. First, hackers, who are criminals or just curious people, would take a telephone apart, a cellular phone apart, and change the algorithm on the chip, reinsert the chip into the telephone, and cause that telephone to tumble. Well, the industry put its best foot forward and actually stopped, for the most part, the act of tumbling in cellular telephones. But within the last 18 months something really terrible has happened, and that is cloning. Cloning is the copying of the MIN and and ESN number, and, for clarification, the MIN is the Mobile Identification Number that is assigned to you by the carrier, and the ESN number is the Electronic Cellular Number that is given to the cellular telephone from that particular manufacturer. As a result, now we have perpetrators, or just curious people, finding ways to copy the MIN and the ESN, thereby victimizing the cellular carrier as well as the good user, paying subscriber. This occurs when the bill is transmitted by the carrier to the subscriber and he says something to the effect of, "I didn't realize that I had made $10,000 worth of calls to the Dominican Republic," or to Asia or Nicaragua or just any place like that. Now what has happened is, those clone devices have been placed in the hands of people that we call ET houses, I guess you would say, and they are the new immigrants that come into the United States for the most part that do not have telephone subscriptions on the land line or on the carrier side from cellular, and now they are charged as much as $25 for 15 minutes to place a call to their home. Unfortunately, though, the illicit behavior of criminals has stepped into this network also. Now we have gang members, drug dealers, and gambling, prostitution, vice, just all sorts of crime, stepping forward to use this system where, by using the cloning, they are avoiding law enforcement. Law enforcement has problems, of course, trying to find out how to tap into those telephone systems and record those individuals. Very recently, cloning has even taken a second step, and that is now something that we term the magic phone, and the magic phone works like this: Instead of cloning just one particular number, it clones a variety of numbers, as many as 14 or 66, thereby distributing the fraud among several users, which makes it almost virtually impossible for us to detect at an early stage. In response to this, what has happened? A lot of legitimate people have started to look at using the illegitimate cellular services. They are promised that this is a satellite phone or just a telephone that if they pay a $2,500 fee will avoid paying further bills. So now it has really started to spread. Some people in major metropolitan areas, such as the Southwest, Northeast, and Southeast, have started running their own mini-cellular companies by distributing these cloning phones to possible clients and users, collecting the fee once a month to reactivate the phone if it is actually denied access. The cellular industry has really stepped up to the plate I think the best they can right now in trying to combat this by working with the switch manufacturers and other carriers, 150 of them to date with the cellular telephone industry, as well as the phone manufacturers, and a lot of companies have started looking at software technology. However, these answers will not come to pass very soon. What we must have is strong legislation. We have been working for the last 18 months, specifically with the Secret Service and a lot of local, State, and Federal law enforcement agencies. The Service has arrested over 100 people involved in cellular fraud. We feel very successful about that. We also worked with local law enforcement in Los Angeles to form the L.A. Blitz, and we arrested an additional 26 people and seized 66 illegal telephones and several computers that spread this cloning device. However, now we have a problem. U.S. Title 18, 1029, does not necessarily state cellular or wireless. It is very important, and I pray that this committee will look at revising 1029 and changing it to include wireless and cellular. I think wireless communications, of course, like most people, is the wave of the future, and it is extremely important that we include that in the legislation so that when people are apprehended they can be prosecuted. Thank you, sir. Mr. MARKEY. Thank you, Mr. Guidry, very much. We will take questions now from the subcommittee members. Let me begin, Mr. Delaney. I would like you and Mr. Goldstein to engage in a conversation, if we could. This is Mr. Goldstein's magazine, "The Hacker Quarterly: 2600," and for $4 we could go out to Tower Records here in the District of Columbia and purchase this. It has information in it that, from my perspective, is very troubling in terms of people's cellular phone numbers and information on how to crack through into people's private information. Now you have got some problems with "The Hacker Quarterly," Mr. Delaney. Mr. DELANEY. Yes, sir. Mr. MARKEY. And your problem is, among other things, that teenagers can get access to this and go joy riding into people's private records. Mr. DELANEY. Yes, sir. In fact, they do. Mr. MARKEY. Could you elaborate on what that problem is? And then, Mr. Goldstein, I would like for you to deal with the ethical implications of the problem as Mr. Delaney would outline them. Mr. DELANEY. Well, the problem is that teenagers do read the "2600" magazine. I have witnessed teenagers being given free copies of the magazine by the editor-in-chief. I have looked at a historical perspective of the articles published in "2600" on how to engage in different types of telecommunications fraud, and I have arrested teenagers that have read that magazine. The publisher, or the editor-in-chief, does so with impunity under the cloak of protection of the First Amendment. However, as I indicated earlier, in that the First Amendment has been abridged for the protection of juveniles from pornography, I also feel that it could be abridged for juveniles being protected from manuals on how to commit crime -- children, especially teenagers, who are hackers, and who, whether they be mischievous or intentionally reckless, don't have the wherewithal that an adult does to understand the impact of what he is doing when he gets involved in this and ends up being arrested for it. Mr. MARKEY. Mr. Goldstein, how do we deal with this problem? Mr. GOLDSTEIN. First of all, "2600" is not a manual for computer crime. What we do is, we explain how computers work. Very often knowledge can lead to people committing crimes, we don't deny that, but I don't believe that is an excuse for withholding the knowledge. The article on cellular phones that was printed in that particular issue pretty much goes into detail as to how people can track a cellular phone call, how people can listen in, how exactly the technology works. These are all things that people should know, and perhaps if people had known this at the beginning they would have seen the security problems that are now prevalent, and perhaps something could have been done about it at that point. Mr. MARKEY. Well, I don't know. You are being a little bit disingenuous here, Mr. Goldstein. Here, on page 17 of your spring edition of 1993, "How to build a pay TV descrambler." Now that is illegal. Mr. GOLDSTEIN. Not building. Building one is not illegal. Mr. MARKEY. Oh, using one is illegal? Mr. GOLDSTEIN. Exactly. Mr. MARKEY. I see. So showing a teenager, or anyone, how to build a pay TV descrambler is not illegal. But what would they do then, use it as an example of their technological prowess that they know how to build one? Would there not be a temptation to use it, Mr. Goldstein? Mr. GOLDSTEIN. It is a two-way street, because we have been derided by hackers for printing that information and showing the cable companies exactly what the hackers are doing. Mr. MARKEY. I appreciate it from that perspective, but let's go over to the other one. If I am down in my basement building a pay TV descrambler for a week, am I not going to be tempted to see if it works, Mr. Goldstein? Or how is it that I then prove to myself and my friends that I have actually got something here which does work in the real world? Mr. GOLDSTEIN. It is quite possible you will be tempted to try it out. We don't recommend people being fraudulent -- Mr. MARKEY. How do you know that it works, by the way? Mr. GOLDSTEIN. Actually, I have been told by most people that is an old version that most cable companies have gotten beyond. Mr. MARKEY. So this wouldn't work then? Mr. GOLDSTEIN. It will work in some places, it won't work in all places. Mr. MARKEY. Oh, it would work? It would work in some places? Mr. GOLDSTEIN. Most likely, yes. But the thing is, we don't believe that because something could be used in a bad way, that is a reason to stifle the knowledge that goes into it. Mr. MARKEY. That is the only way this could be used. Is there a good way in which a pay TV descrambler could be used that is a legal way? Mr. GOLDSTEIN. Certainly, to understand how the technology works in the first place, to design a way of defeating such devices in the future or to build other electronic devices based on that technology. Mr. MARKEY. I appreciate that, but it doesn't seem to me that most of the subscribers to "2600" magazine -- Mr. GOLDSTEIN. That is interesting that you are pointing to that. That is our first foray into cable TV. We have never even testified on the subject before. Mr. MARKEY. I appreciate that. Well, let's move on to some of your other forays here. What you have got here, it seems to me, is a manual where you go down Maple Street and you just kind of try the door on every home on Maple Street. Then you hit 216 Maple Street, and the door is open. What you then do is, you take that information, and you go down to the corner grocery store, and you post it: "The door of 216 Maple is open." Now, of course, you are not telling anyone to steal, and you are not telling anyone that they should go into 216 Maple. You are assuming that everyone is going to be ethical who is going to use this information, that the house at 216 Maple is open. But the truth of the matter is, you have got no control at this point over who uses that information. Isn't that true, Mr. Goldstein? Mr. GOLDSTEIN. The difference is that a hacker will never target an individual person as a house or a personal computer or something like that. What a hacker is interested in is wide open, huge data bases that contain information about people, such as TRW. A better example, I feel, would be one that we tried to do 2 years ago where we pointed out that the Simplex Lock Corporation had a very limited number of combinations on their hardware locks that they were trying to push homeowners to put on their homes, and we tried to alert everybody as to how insecure these are, how easy it is to get into them, and people were not interested. Hackers are constantly trying to show people how easy it is to do certain things. Mr. MARKEY. I appreciate what you are saying. From one perspective, you are saying that hackers are good people out there, almost like -- what are they called? -- the Angels that patrol the subways of New York City. Mr. GOLDSTEIN. Guardian Angels. I wouldn't say that though. Mr. MARKEY. Yes, the Guardian Angels, just trying to protect people. But then Mr. Delaney here has the joy riders with the very same information they have taken off the grocery store bulletin board about the fact that 216 Maple is wide open, and he says we have got to have some laws on the books here to protect against it. So would you mind if we passed, Mr. Goldstein, trespassing laws that if people did, in fact, go into 216 and did do something wrong, that we would be able to punish them legally? Would you have a problem with that? Mr. GOLDSTEIN. I would be thrilled if computer trespassing laws were enforced to the same degree as physical trespassing laws, because then you would not have teenage kids having their doors kicked in by Federal marshals and being threatened with $250,000 fines, having all their computer equipment taken and having guns pointed at them. You would have a warning, which is what you get for criminal trespass in the real world, and I think we need to balance out the real world -- Mr. MARKEY. All right. So you are saying, on the one hand, you have a problem that you feel that hackers are harassed by law enforcement officials and are unduly punished. We will put that on one side of the equation. But how about the other side? How about where hackers are violating people's privacy? What should we do there, Mr. Goldstein? Mr. GOLDSTEIN. When a hacker is violating a law, they should be charged with violating a particular law, but that is not what I see today. I see law enforcement not having a full grasp of the technology. A good example of this was raids on people's houses a couple of years ago where in virtually every instance a Secret Service agent would say, "Your son is responsible for the AT&T crash on Martin Luther King Day," something that AT&T said from the beginning was not possible. Mr. MARKEY. Again, Mr. Goldstein, I appreciate that. Let's go to the other side of the problem, the joy rider or the criminal that is using this information. What penalties would you suggest to deal with the bad hacker? Are there bad hackers? Mr. GOLDSTEIN. There are a few bad hackers. I don't know any myself, but I'm sure there are. Mr. MARKEY. I assume if you knew any, you would make sure we did something about them. But let's just assume there are bad people subscribing. What do we do about the bad hacker? Mr. GOLDSTEIN. Well, I just would like to clarify something. We have heard here in testimony that there are gang members and drug members who are using this technology. Now, are we going to define them as hackers because they are using the technology? Mr. MARKEY. Yes. Well, if you want to give them another name, fine. We will call them hackers and crackers, all right? Mr. GOLDSTEIN. I think we should call them criminals. Mr. MARKEY. So the crackers are bad hackers, all right? If you want another word for them, that is fine, but you have got the security of individuals decreasing with the sophistication of each one of these technologies, and the crackers are out there. What do we do with the crackers who buy your book? Mr. GOLDSTEIN. I would not call them crackers. They are criminals. If they are out there doing something for their own benefit, selling information -- Mr. MARKEY. Criminal hackers. What do we do with them? Mr. GOLDSTEIN. There are existing laws. Stealing is still stealing. Mr. MARKEY. OK. Fine. Dr. Tippett. Mr. TIPPETT. I think that the information age has brought on an interesting dilemma that I alluded to earlier. The dilemma is that the people who use computers don't have parents who used computers, and therefore they didn't get the sandbox training on proper etiquette. They didn't learn you are not supposed to spit in other people's faces or contaminate the water that we drink, and we have a whole generation now of 100 million in the United States computer users, many of whom can think this through themselves, but, as we know, there is a range of people in any group, and we need to point out the obvious to some people. It may be the bottom 10 percent. Mr. MARKEY. What the problem is, of course, is that the computer hacker of today doesn't have a computer hacker parent, so parents aren't teaching their children how to use their computers because parents don't know how to use computers. So what do we do? Mr. TIPPETT. It is incumbent upon us to do the same kind of thing we did in the sixties to explain that littering wasn't right. It is incumbent upon us to take an educational stance and for Congress to credit organizations, maybe through a tax credit or through tax deductions, for taking those educational opportunities and educating the world of people who didn't have sandbox training what is good and what is bad about computing. So at least the educational part needs to get started, because I, for one, think that probably 90 percent of the kids -- most of the kids who do most of the damage that we have all described up here, in fact, don't really believe they are doing any damage and don't have the concept of the broadness of the problem that they are doing. The 10 percent of people who are criminal we could go after potentially from the criminal aspect, but the rest we need to get after from a plain, straight ahead educational aspect. Mr. MARKEY. I appreciate that. I will just say in conclusion -- and this is for your benefit, Mr. Goldstein. When you pass laws, you don't pass laws for the good people. What we assume is that there are a certain percent of people -- 5 percent, 10 percent; you pick it -- who really don't have a good relationship with society as a whole, and every law that we pass, for the most part, deals with those people. Now, as you can imagine, when we pass death penalty statutes, we are not aiming it at your mother and my mother. It is highly unlikely they are going to be committing a murder in this lifetime. But we do think there is a certain percentage that will. It is a pretty tough penalty to have, but we have to have some penalty that fits the crime. Similarly here, we assume that there is a certain percentage of pathologically damaged people out there. The cerebral mechanism doesn't quite work in parallel with the rest of society. We have to pass laws to protect the rest of us against them. We will call them criminal hackers. What do we do to deal with them is the question that we are going to be confronted with in the course of our hearings? Let me recognize the gentleman from Texas, Mr. Fields. Mr. FIELDS. Thank you, Mr. Chairman. Just for my own edification, Mr. Goldstein, you appear to be intelligent; you have your magazine, so obviously you are entrepreneurial. For me personally, I would like to know, why don't you channel the curiosity that you talk about into something that is positive for society? And, I'm going to have to say to you, I don't think it is positive when you invade someone else's privacy. Mr. GOLDSTEIN. I agree. Mr. FIELDS. Whether it is an individual or a corporation. Mr. GOLDSTEIN. Well, I would like to ask a question in return then. If I discover that a corporation is keeping a file on me and I access that corporation's computer and find out or tell someone else, whose privacy am I invading? Or is the corporation invading my privacy? You see, corporations are notorious for not volunteering such information: "By the way, we are keeping files on most Americans and keeping track of their eating habits and their sexual habits and all kinds of other things." Occasionally, hackers stumble on to information like that, and you are much more likely to get the truth out of them because they don't have any interest to protect. Mr. FIELDS. Are you saying with this book that is what you are trying to promote? because when I look through this book, I find the same thing that the chairman finds, some things that could actually lead to criminal behavior, and when I see all of these codes regarding cellular telephones, how you penetrate and listen to someone's private conversation, I don't see where you are doing anything for the person, the person who is actually doing the hacking. I see that as an invasion of privacy. Mr. GOLDSTEIN. All right. I need to explain something then. Those are not codes, those are frequencies. Those are frequencies that anybody can listen to, and by printing those frequencies we are demonstrating how easy it is for anybody to listen to them. Now if I say that by tuning to 871 megahertz you can listen to a cellular phone call, I don't think I am committing a crime, I think I am explaining to somebody. What I have done at previous conferences is hold up this scanner and press a button and show people how easy it is to listen, and those people, when they get into their cars later on in the day, they do not use their cellular telephones to make private calls of a personal nature because they have learned something, and that is what we are trying to do, we are trying to show people how easy it is. Now, yes, that information can be used in a bad way, but to use that as an excuse not to give out the information at all is even worse, and I think it is much more likely that things may be fixed, the cellular industry may finally get its act together and start protecting phone calls. The phone companies might make red boxes harder to use or might make it easier for people to afford phone calls, but we will never know if we don't make it public. Mr. FIELDS. I want to be honest with you, Mr. Goldstein. I think it is frightening that someone like you thinks there is a protected right in invading someone else's privacy. Mr. Guidry, let me turn to you. How does a hacker get the codes that you were talking about a moment ago -- if I understood what you were saying correctly, the manual ID number, the other cellular numbers that allow them to clone? Mr. GUIDRY. Well, unfortunately, "2600" would be a real good bet to get those, and we have arrested people and found those manuals in their possession. The other way is quite simply just to what we call dumpster dive, and that is to go to cellular carriers where they may destroy trash. Unfortunately, some of it is shredded and put back together, some of it is not shredded, and kids, criminals, go into those dumpsters, withdraw that information, piece it together, and then experiment with it. That information then is usually sold for criminal activity to avoid prosecution. Mr. FIELDS. You are asking the subcommittee to include wireless and cellular, and I think that is a good recommendation. I think certainly that is one that we are going to take as good counsel. But it appears that much of what you are talking about is organized activity, and my question is, does the current punishment scheme actually fit the crime, or should we also look at increasing punishment for this type of crime? Mr. GUIDRY. I would strongly suggest that we increase the punishment for this sort of crime. It is unfortunate that some hackers take that information and sell it for criminal activity, and, as a result, if prosecution is not stiff enough, then it far outweighs the crime. Mr. FIELDS. What is the punishment now for this type of cellular fraud? Mr. GUIDRY. Right now, it can be as high as $100,000 and up to 20 years in the penitentiary. Mr. FIELDS. Mr. Delaney, do you feel that that is adequate? Mr. DELANEY. Under New York State law, which is what I deal with, as opposed to the Federal law, we can charge a host of felonies with regard to one illicit telephone call if you want to be creative with the law. Sections 1029 and 1039 really cover just about everything other than the cellular concern and the wireless concern. However, I think the thing that is not dealt with is the person who is running the call sell operations. The call selling operations are the biggest loss of revenue to the telephone companies, cellular companies. Whether they are using PBX's or call diverters or cellular phones, this is where all the fraud is coming from, and there is only a handful of people who are originating this crime. We have targeted these people in New York City right now, and the same thing is being done in Los Angeles and Florida, to determine who these people are that use just the telephone to hack out the codes on PBX's, use ESN readers made by the Curtis Company to steal the ESN and MIN's out of the air and then to disseminate this to the street phones and to the cellular phones that are in cars and deprive the cellular industry of about $300 million a year, and the rest of the telecommunications networks in the United States probably of about $1 billion a year, due to the call sell operations. In one particular case that we watched, as a code was hacked out on a PBX in a company in Massachusetts, the code was disseminated to 250 street phones within the period of a week. By the end of the month, a rather small bill of $40,000 was sent to the company, small only because they were limited by the number of telephone lines going through that company. Had it been a larger company whose code had been cracked by the finger hacker, the bill would have been in the hundreds of thousands of dollars, or over $1 million as typically some of the bills have been. But this is a relatively small group of people creating a tremendous problem in the United States, and a law specifically dealing with a person who is operating as an entrepreneur, running a call selling operation, I think would go far to ending one of the biggest problems we have. Mr. FIELDS. Let me ask so I understand, Mr. Delaney and Mr. Guidry, because I am a little confused, or maybe I just didn't understand the testimony, are these individual hackers acting separately, or are these people operating within a network, within an organization? Mr. DELANEY. These finger hackers are the people that control the network of people that operate telephone booths and cellular phones for reselling telephone service. These finger hackers are not computer hackers. Mr. FIELDS. When you say finger hackers, is this one person operating independently, or is that finger hacker operating in concert -- Mr. GUIDRY. No. He has franchised. He has franchised out. He actually sells the computer and the software and the cattail to do this to other people, and then they start their own little group. Now it is going internationally. Mr. FIELDS. Explain to me, if the chairman would permit -- Mr. MARKEY. Please. Mr. FIELDS. Explain to me the franchise. Mr. GUIDRY. What happens is, let's pretend we are in Los Angeles right now and I have the ability to clone a phone that is using a computer, a cattail, we call it, that goes from the computer, the back of the computer, into the telephone, and I have the diskette that tells me how to change that program. I can at some point sell the cloning. You can come to me, and I can clone your phone. However, that is one way for me to make money. The best way for me to make money is to buy computers, additional diskettes, and go to Radio Shack or some place and make additional cattails and say, "I can either clone your phone for $1,500, or what you can do for $5,000 is start your own company." So you say, "Well, wow, that's pretty good, because how many times would I have to sell one phone at from $500 to $1,500 to get my initial investment back?" As a result now, you have groups, you have just youngsters as well as organized crime stepping in. The Guidry Group has worked in the Philippines on this, we have worked in Mexico, the Dominican Republic, Chile, Argentina, and next week I will be in London and in Rome. It is so bad, sir, that now intelligence agencies in Rome have told me -- and that is what I am going there for -- that organized crime seems to think that telecommunications fraud is more lucrative, unfortunately, than drugs, and it is darned sure more lucrative in the Los Angeles, probably New York, and Miami areas, because right now prosecution is not that strong. It is unfortunate that all of law enforcement is not trained, nor could they be, to pick up on someone standing on a corner using an illegitimate phone. Mr. FIELDS. How would a person know where to get their telephone cloned? Mr. GUIDRY. Let me tell you what happens. Normally when we go into a major metropolitan city, or we also check the computer bulletin boards, a lot of times that information is there. Most of the time, though, it is in magazines, like green sheets, which are free advertisements saying, "Call anywhere in the world. Come to --" a location, or, "Call this number." Also in Los Angeles, for some reason, they seem to advertise a lot in sex magazines, and people will simply buy a sex magazine and there will be a statement in there, "Earn money the fast way. Start your own telecommunications company." And then we will follow up on that tip and work with the Secret Service to try to apprehend those people. Mr. FIELDS. Mr. Haugh. Mr. HAUGH. If I could just add a few comments, it would be most unfortunate if this denigrates into a discussion of adolescents who are curious and so-called finger hackers. The truth of the matter is that the toll fraudsters are adults, they are organized, they are smart, they are savvy, and the drug dealers in particular are learning very quickly that it is far more lucrative, far less dangerous, to go into the telecom crime business. "Finger hacking" is a term, but the truth is, war dialers, speed dialers, modems, automated equipment now will hack and crack into systems and break the codes overnight. While the criminal sleeps, his equipment penetrates those systems. He gets up in the morning, and he has got a print sheet of new numbers that his equipment penetrated overnight. We have interviewed the criminals involved. These so-called idle curiosity adolescents are being paid up to $10,000 a month for new codes. I don't call that curiosity, I call that venality. We are talking a $4 billion problem. The chairman came up with the Maple Street example. I think even better yet, Mr. Chairman, the truth is that 216 Maple had a security device on the door and a code, and what Mr. Goldstein and his ilk do is sell that code through selling subscriptions to these periodicals. There is a big difference, in my opinion, between saying, "216 Maple is open" -- that is bad enough -- than to say, "You go to 216 Maple, and push 4156, and you can get in the door." But we are talking about crime, we are talking about adults, we are talking about organized crime, perhaps not in the Cosa Nostra sense, but even the Cosa Nostra is wising up that they can finance some of these operations, and in New York and Los Angeles, in particular, the true Mafia is now beginning to finance some of these telecom fraud operations. Mr. FIELDS. Mr. Guidry, one last question. Is it the Secret Service that is at the forefront of Federal activity? Mr. GUIDRY. Yes, sir, it is. Mr. FIELDS. Do they have the resources to adequately deal with this problem? Mr. GUIDRY. No, sir. The problem is growing so rapidly that they are undermanned in this area but have asked for additional manpower. Mr. FIELDS. Is this a priority for the Secret Service? Mr. GUIDRY. Yes, sir, it is. Mr. FIELDS. Thank you, Mr Chairman. Mr. MARKEY. The gentleman's time has expired. Again, it is a $4 to $5 billion problem. Mr. HAUGH. That is what our research indicated. Mr. MARKEY. There were 35,000 victims last year alone. Mr. HAUGH. Yes, sir, and this is only users, large users. Now it can be businesses, nonprofits. There is a university on the East Coast that just this last week got hit for $490,000, and the fraud is continuing. Mr. MARKEY. The gentleman from Ohio. Mr. OXLEY. Thank you, Mr. Chairman. Let me ask the witnesses: Other than making the penalties tougher for this type of activity, what other recommendations, if any, would any of you have that we could deal with, that our subcommittee should look at, and the Judiciary Committee, I assume, for what we might want to try to accomplish? Mr. Haugh? Mr. HAUGH. I happen to disagree with a couple of the witnesses who have indicated tougher penalties. I mean it sounds great. You know, that is the common instant reaction to anything, expand the penalties. I happen to think 20 years is plenty enough for criminal penetration of a telecom system, and there are a few housekeeping things that could be done. The problem isn't the adequacy of the law, the laws are pretty adequate, and, as Mr. Delaney indicated, you have a violation someplace, you have got a State law and a Federal law, both, and if you are a smart prosecutor, there are about eight different ways you can go after these criminals. The truth is, we have got inadequate enforcement, inadequate funding, inadequate pressure on the part of the Congress on the FCC to make more proactive efforts and to put more heat on the industry to coordinate. The truth is that the carriers compete with each other fiercely. They, with some limited exceptions, don't share appropriate information with each other. The LEC's and the RBOC's hide behind privacy; they hide behind other excuses not to cooperate with law enforcement and with the rest of the industry as effectively as they should. So I think putting the heat on the industry, putting the heat on the FCC, more adequately funding the FCC, more adequately funding the Secret Service, and having hearings like this that focus on the problem is the answer and not expanding the penalty from 20 years to 25 years. Nobody gets 20 years anyway, so expanding the 20 years is, to me, not the answer. Mr. OXLEY. What is the average sentence for something like that? Mr. HAUGH. I think the average toll fraud criminal who actually goes to jail -- and they are few and far between -- spends 3 to 6 months, and they are out. Now recidivism levels are low, I agree with Mr. Delaney. Once you catch them, they rarely go back to it. So it isn't a question of putting them in jail forever, it is a question of putting them in jail. The certainty of punishment level is very low. We talked to a drug dealer in New York City who left the drug business to go into toll fraud because he told me he can make $900,000 a year -- nontaxable income, he called it -- and never ever worry about going to jail. Mr. DELANEY. In New York City, I have never seen anybody go to jail on a first offense for anything short of armed robbery, let alone telephone fraud. They typically get 200 hours of community service, depending upon the judge. These people that I am speaking about are not the computer hackers that we were speaking about earlier, these are the people that are the finger hackers that break into the PBX's around the country. These are immigrants in the United States, they are adults, they know how to operate a telephone. They sit there generally -- almost every one that we have arrested so far uses a Panasonic memory telephone, and they sit there night and day try ing to hack out the PBX codes. They go through all the default codes of the major manufacturers of PBX's. They know that much. We don't have a single person in New York City, that I know of, that is hacking PBX's with a computer. The long distance carriers can see patterns of hacking into 800 lines, which are typically the PBX's, and they can see that it is being done by telephone, by finger hacking a telephone key pad, as opposed to a computer. The war dialing programs that Mr. Haugh referred to are typically used by the computer hackers to get these codes, but they create only a minuscule amount of the fraud that is ongoing in the country. The great majority is generated by the finger hackers who then disseminate those codes to the telephone booths and the call selling operations that operate out of apartments in New York City. In one apartment with five telephones in it that operates 16 hours a day for 365 days a year selling telephone service at $10 for 20 minutes, you take in $985,000. It is a very profitable business. One of the individuals we arrested that said he did this because it was more profitable and less likely that he be caught than in selling drugs was murdered several months after we arrested him in the Colombian section of Queens because he was operating as an independent. It is a very controlled situation in New York City, and different ethnicities throughout New York City control the call sell operations in their neighborhoods, and everyone in those neighborhoods knows where they can go to make an illicit phone call or to get a phone cloned, whether it is a reprogrammed phone or rechipped. Mr. OXLEY. Mr. Guidry, did you have a comment? Mr. GUIDRY. Well, I think that we really do need to enforce the laws and we need to make some statutory changes in title 18, section 1029 to include cellular and wireless. I have been in courtrooms where really savvy defense attorneys say, "Well, it does not specifically indicate cellular or wireless," and that raises some question in the jury's mind, and I would just as soon that question not be there. Mr. OXLEY. Thank you. Mr. Chairman, I see we have got a vote, and I yield back the balance of my time. Mr. MARKEY. Thank you. We are going to have each one of you make a very brief summary statement to the committee if you could, and then we are going to adjourn the hearing. As you know, the Federal Communications Commission will be testifying before this subcommittee next week. We have a great concern that, although they held an all-day hearing on toll fraud last October, while we thought they were going to move ahead in an expeditious fashion, that, with a lot of good information, it has all sat on the shelf since that time. We expected them to act on that information to establish new rules protecting consumers and pushing carriers to do a lot more than they have done thus far to protect their networks. In light of recent court decisions holding that consumers are always liable I think that action by the FCC is long overdue, and at the FCC authorization hearing next week I expect to explore this issue with the commissioners in depth, so you can be sure of that, Mr. Haugh. Let's give each of you a 1-minute summation. Again, we will go in reverse order and begin with you, Mr. Guidry. Mr. GUIDRY. Thank you, sir. Telecommunications fraud, of course, is going internationally, and as it goes internationally and starts to franchise and get more organized, we are going to have to figure out a better way to combat it. Industry itself right now is putting its best foot forward. However, I would ask this committee to strongly look at changing some of this legislation and to also increase law enforcement's efforts through manpower. Thank you very much, sir. Mr. MARKEY. Thank you. Mr. Haugh. Mr. HAUGH. I agree with Mr. Guidry that there are some housekeeping changes that need to be made, and the particular title and section he referred to should definitely be amended to include more clearly wireless. The overall problem is an immense one; it is a very serious one; it is a complicated one. Everybody is at fault. Finger pointing has been carried to an extreme. Again, I think the long distance carriers, the big three -- AT&T, MCI, and Sprint -- have done a superb job of coming up to speed with monitoring. They are starting to cooperate better. They have really come to the table. The laggards are the LEC's and the RBOC's, the CPE manufacturers, and the FCC. In fairness to the FCC, they are understaffed, undermanned, underfunded. They can't even take care of all their mandated responsibilities right now, let alone take on new chores. All that said, there is a great deal the FCC can do -- jawboning, regulations, pushing the LEC's and the RBOC's, in particular, to get real, get serious -- and I would urge this committee -- applaud your efforts and urge you to continue that. Mr. MARKEY. Thank you. Dr. Tippett. Mr. TIPPETT. Thank you. The computer virus issue is a little bit different than the toll fraud issue. In fact, there are no significant laws that deal with viruses, and, in fact, the fact that there are no laws gives the people who write viruses license to write them. The typical statement you read is, "It's not illegal, and I don't do anything that is illegal." So in the computer virus arena we do need laws. They don't need to be fancy; they don't need to be extensive. There are some suggestions of approaches to virus legislation in my written testimony. We also need education, and I would encourage Congress to underwrite some education efforts that the private sector could perform in various ways, perhaps through tax incentives or tax credits. The problem is growing and large. It exceeds $1 billion already in the United States, and it is going to be a $2 billion problem in 1994. As bad as toll fraud seems, this virus issue is, oddly, more pervasive and less interesting to a whole lot of people, and I think it needs some higher attention. Mr. MARKEY. Thank you. Mr. Goldstein. Mr. GOLDSTEIN. Thank you. I would like to close by cautioning the subcommittee and all of us not to mix up these two very distinct worlds we are talking about, the world of the criminal and the world of the experimenter, the person that is seeking to learn. To do so will be to create a society where people are afraid to experiment and try variations on a theme because they might be committing some kind of a crime, and at the same time further legislation could have the effect of not really doing much for drug dealers and gangsters, who are doing far more serious crimes than making free phone calls, and it is not likely to intimidate them very much. I think the answer is for all of us to understand specifically what the weaknesses in the technology are and to figure out ways to keep it as strong and fortress-like as possible. I do think it is possible with as much research as we can put into it. Thank you. Mr. MARKEY. Thank you, Mr. Goldstein. Mr. Delaney. Mr. DELANEY. Last year, the Secret Service and the FBI arrested people in New York City for conducting illegal wiretaps. The ability to still do that by a hacker exists in the United States. Concerned with privacy, I am very happy to see that something like the Clipper chip is going to become available to protect society. I do hope, though, that we will always have for the necessary law enforcement investigation the ability to conduct those wiretaps. Without it, I see chaos. But with respect to the cellular losses, the industry is coming along a very rapid rate with technology to save them money in the future, because with encryption nobody will be able to steal their signals either. Mr. MARKEY. Thank you, Mr. Delaney. I apologize. There is a roll call on the Floor, and I only have 3 minutes to get over there to make it. You have all been very helpful to us here today. It is a very tough balancing act, but we are going to be moving aggressively in this area. And we are going to need all of you to stay close to us so that we pass legislation that makes sense. This hearing is adjourned. Thank you. [Whereupon, at 12:16 p.m., the subcommittee was adjourned.]