Hacker Chronicles 1/HACKER1.ISO/cud3/cud322c.txt

Text File | 1992-09-20 | 33KB | 561 lines

------------------------------

From: "William  Vajk (igloo)" <[e-mail]>
Date: Sun, 2 Jun 91 18:00:40 CDT
Subject: Punishment and Control: Reply to Gene Spafford

********************************************************************
***  CuD #3.22: File 3 of 3: Punishment and Control              ***
********************************************************************

In CUD 3.14, Gene Spafford wrote:

> There is little doubt that law enforcement has sometimes been overzealous
> or based on ignorance.  That is especially true as concerns computer-related
> crimes, although it is not unique to that arena.

I am concerned that while computer related interests isn't the only area in
which law enforcement has fallen so far short of the mark as to be noticeable,
it is the basis for one of the first relatively large scale interactions
between law enforcement and middle class. This is the reason for so many of us
noting cases which have acquired a notoriety exceeding past norms where the
investigation involved a lower class. Such treatments have been the usual fare
for the economically disadvantaged, sometimes those culturally distinct (see
the movie _Chinatown_ for an excellent example.) Complaints on their behalf
haven't been nearly as widespread in spite of the similarities of the behavior
by law enforcement. It isn't new. It is simply new to "us."

I have some serious reservations about the Chicago Police Department which
has declared war on "gangs." Possibly other such declarations have been
undertaken elsewhere as well. Just so we understand up front, I do not
condone criminal behavior. But my understandings of these events is confounded
by the difficulties I have in determining in advance of some criminal behavior
or another just what actually constitutes a gang. How does one determine what
is an Italian-American Sports Club, and which one is a sinister mob
organization. How does one differentiate a group of young men, wearing
identical attire while walking across town to play basketball in a park from
another group, walking about their turf, and the Boy Scouts.

A discussion I just had with the Public Relations officer at the Chicago
Police Department did little to help. The distinguishing characteristics
are looser and far more evasive than those mentioned by Pastor Niemoeller.
The PR officer told me they have something "better than an educated guess"
on which to base whether or not an individual or small group is gang related;
whether or not to question (should we call it harass) citizens within a
community. In the end, we are permitting the police to use personal judgment
in many ways. The personal judgment they have been using has now been brought
into play in middle class communities. Guess what. We're complaining about it.

I am concerned that Spafford's comments can be read to be forgiving and
conciliatory in nature where it regards errors made by professional law
enforcement. Officer Nemeth in California (see CUD 3.15) has said that he's
learning as he goes along. That's a hell of an answer to give some poor fellow
who was attempting to access a published bbs number after you've broken two of
his doors, confiscated his equipment, and subjected him to interrogation which
assumed guilt instead of trying to develop information in a reasonable manner
before using one of the most intrusive tactics permitted by law. There's an
entire mentality which we see exercised in the modern prototypical police
investigation. Officer Nemeth draws some conclusions of dubious worth even
after knowing the facts and that there will be no prosecution, "Hopson and the
other suspects should have given up after the first failed attempt" of trying
to gain access to a computer. "The laws are funny. You don't have to prove
malicious intent when you're talking about computer tampering. The first
attempt you might say was an honest mistake. More than that, you have to
wonder."    ^^^^^^^^^        ^^^^^^^^^^^^^^

I suggest we put a rotary combination padlock on Nemeth's locker at work. Any
time he misses getting it on the first try, he takes the day off....at his
expense. But let's add a bit more realism. Someone should gently but
erratically shake his arm to emulate a bit of line noise.

The prosecutor in the case, Stephen Brown, didn't believe the police
overreacted in their investigation. "They had a legitimate concern." Is having
a legitimate concern reason to secure search warrants and damage property?
Aren't there any less intrusive investigatory techniques available? Of course
there are. The police didn't know where to begin their investigation of this
suspected criminal activity. I wasn't surprised at all to learn that PacBell
security knew. Given the involvement of yet another telephone company, is
the outcome, the overreaction, any surprise?????

We understand and feel compassion for one whose home has been violated by
burglars. Often we hear that they no longer feel comfortable in their own
home. Their inner feelings of security, something most of us take for granted,
have been damaged, sometimes irreparably. It is obvious in hindsight that
Nemeth's actions were unnecessary and counterproductive. I would not want him
on the local police force in my town. I am most concerned regarding his
ability to exercise judgment appropriate to the circumstances. But what is
worse by far is that some consider his investigative techniques acceptable.

N.B.    Police brutality doesn't begin at the end of a
        nightstick or hose. It begins with an attitude.

If you hire someone to write a bit of computer code for you which is to
perform some specific function, do you accept their learning to do that
task on the job and at your expense acceptable professionalism? I dare
say you wouldn't. Had you hired them with the understanding that they are
beginners and in training, then it would be considered acceptable.

Neither I nor any citizen in this nation has accepted the proviso that our
law enforcement agents are beginners learning the trade as they go along.
We demand the height of professionalism from them, each and every one. We
have granted them the extremes of the use of deadly force. I, for one, don't
take that lightly. I demand they be professionals and culpable for their
actions, whether working on my behalf or not. Spafford talks about
responsibility, let it begin with those who are PAID to be responsible and
have been evading that duty, manufacturers of software and law enforcement.

Who pays them to be responsible? We all do.

> Reporting of some of these incidents has also been incorrect.

Yes, Gene. In article [e-mail] you misspoke and assisted
in proliferation of such incorrect reports :

 "The information I have available from various sources
  indicates that the investigation is continuing, others
  are likely to be charged, and there MAY be some national
  security aspects to parts of the discussion that have
  yet to be disclosed."

Need I voice the obvious and ask how any "responsible" individual should
handle errors they have made? Need I voice the obvious and ask a simple
question.  What has Gene Spafford done to correct errors he has made? Has
his behavior in these matters met the criteria for responsibility he demands
>from others?

> Obviously, we all wish to act to prevent future such abuses,
> especially as they apply to computers.

'To thine own self be true' seems so appropriate right about here. Did you
wish to issue any corrections or retractions regarding some of your past
articles ?

> However, that being the case does not mean that everyone accused under
> the law is really innocent and the target of "political" persecution.

One of the elements common to propagandizing is to create a set of false issues
which sound like something your opposition might have said. In this instance,
I would appreciate most sincerely either having you repeat the source of such
a statement (by someone other than an obvious lunatic) in these newsgroups, or
to have you revise your statement into something more resembling the actual
circumstances.

> That is certainly not reality; in some cases the individuals charged
> are clearly at fault.

There are any number eventually found responsible and "at fault." I
haven't seen much mention made of them on the networks. See below for
one such case followed up. Is part of your problem, Gene, the fact that
we haven't been flogging dead horses on the net; the fact we haven't been
publishing news about those caught, prosecuted, and sentenced fairly? Given
another [name deleted] mentality I am certain we could find a volunteer.

> By representing all of them as innocents and victims, you further
> alienate the moderates who would otherwise be sympathetic to the
> underlying problems.  By trying to represent every individual charged
> with computer abuse as an innocent victim, you are guilty of the same
> thing you condemn law enforcement of when they paint all "hackers" as
> criminals.

Really, this is a bit much. We presume innocence for all until they are
actually adjudged guilty. They are thus, at most, represented as suspects
until a verdict is handed down. But of course there are some folks who prejudge
the outcomes and place articles on the network explaining the involvements
of national security in the cases.........

Gaining momentum here, Gene? You laid the groundwork for a lie earlier,
in true propagandist style, and rush in for the kill in this paragraph.
Nowhere has anyone claimed every individual charged with computer abuse an
innocent victim. The other case of computer abuse in Naperville, Illinois
late last year had to do with an employee of Spiegel.

Michael H. Ferrell was charged with creating bogus invoices illegally
collecting sizable sums of money. He was also charged with authorizing
refunds to his credit cards using their cash registers. Although his scheme
resulted in a computer tampering charge (because it is a relatively new and
sexy action at the moment) he is more guilty in the ordinary sense of fraud
laws designed to protect against abuse of trust. Abbreviated charges (press
release) are available in CUD 3.00. He was found guilty (two of the charges
were nolle pros) and sentenced as follows :

24 months probation

240 hours of public service work

restitution of $30,861.85

periodic imprisonment (weekends) for 6 weekends. Two to be served immediately,
and four subject to future motion to vacate to be filed 2/26/1993.

Here's a guy who really stole something. Money, lots in fact.

> In particular, you portray Len Rose as an innocent whose life has been
> ruined through no fault of his own, and who did nothing to warrant
> Federal prosecution.  That is clearly not the case.  Len has acknowledged
> that he was in possession of, and trafficking in, source code he knew was
> proprietary.

I believe you would do well to look up the definition of the term (and
charge) of trafficking. There were no monetary considerations or agreements.
In fact, similar charges were brought against Neidorf. The fact that the case
was dropped precluded a proper addressing of such issues as exchange of
information (proprietary or not) without financial consideration. One of the
original charges brought against Len involved the retransmittal by Neidorf of
the same login.c program back to Len. Raises the same issue we are going to be
examining regarding Express Mail where the U.S. Postal Inspectors are arresting
recipients of packages known by the US Postal Service to contain contraband
and delivered in spite of that knowledge.

Such a distancing by investigative and prosecutorial powers from rationality
is quite troubling. If someone from LA were to express mail a reefer to
Spaf, we might all be reading about a faculty member at Purdue arrested for
possession of a controlled substance. Need we ask about the culpability of
the sender?

Many other questions also have not been answered because of Len's plea
bargain. It seems that AT&T source code (according to one of the Foley
affidavits) bears legends which claim both proprietary rights and a
copyright. You stipulate proprietary. The dual labeling of the original
software should do a lot to remove it from consideration as truly proprietary
information. The laws regarding copyrights require that all copyright material
is subject to deposit at the Library of Congress, where any citizen has a
right to read and review.

If this is the case, then possession is not illegal, because the text is
protected from commercial exploitation by the copyright laws and Len should
not have been charged with criminal. Copyright violation is a matter for civil
suit. If someone makes 1000 copies of your newly released book and sends it to
friends and associates, is it reasonable to expect a criminal prosecution by
the U. S. Government, or will your publisher be required to undertake a civil
suit for damages? Does it matter whether the copies are electronic or paper?

Furthermore, if he sends all 1000 copies across state lines in a single
package, has he violated federal laws regarding stolen goods valued
at over $ 5000? Each unit is valued at $29.95 by the publisher. Does the
fact that he sent 1000 copies individually packaged across state lines negate
that federal interest? And when one bears in mind that the laws were
originally aimed at automobiles, the connotation assumes tangible goods
of substantial value, not tidbits of some larger intellectual property
which may or might not withstand as yet unresolved testing for proprietary
status, notwithstanding questions regarding the cost/value haphazardly
assigned for the sake of federal prosecution. Login.c, a program of some
approximately 2000 lines of code, has a value in excess of $ 5000?  Official
representatives of AT&T have made such representations. The individual making
such an assessment has obviously crossed to the other side of the looking
glass and is presently enjoying tea with Alice and the Mad Hatter. In the end,
of course, all the original charges were supplanted.

What would have happened had Len chosen to modify the login.c version which
was written by David Ihnat and placed in the public domain? Which laws would
then have been broken? The entire rationale supported by your article, Gene,
falls apart into itty bitty pieces. Poor judgment alone is not a violation of
any laws.

What would have happened if Len sent the modified AT&T login.c file across
state lines in 10 line increments, to be recombined at the receiving end?
The challenges many  of us feel are appropriate to such understandings haven't
been possible to date.

And finally, although by no means of least importance, the entire business
of ownership of any single piece of AT&T software, whether source code
or binaries needs to be examined. The ONLY owner is AT&T. Everyone who pays
fees is licensed to use the software. Thus enters yet another dilemma.
Possession is not licensed. Can possession be criminalized? Given this view,
new questions arise. Use licensing concepts are not new nor are they unique.

> The login changes were the source of the fraud charge.

Perhaps you should reread the original 5 count indictment and examine the
genesis of the adjustments the government made to the charges in the year plus
>from beginning to settlement. The government's actions aren't at all pretty.
To say the real source of all charges is itself suspect would be an
understatement. The government kept digging around and throwing stuff at the
ceiling till something kinda stuck. And here's Gene Spafford pointing his
finger saying "Aha!" Sure reminds me of Salem. In science, how one acquires
data is just as important as the data itself. This doesn't change when it
comes to human interactions and the law.

> It is certainly security-related, and the application of the law
> appears to be appropriate.

There was a recent post made to the network regarding a serious security
flaw in the Interactive port of Unix to the 80386 machine. The article
and all the pertinent information was posted from abroad. If one reads
the law to which you refer carefully, every system administrator whose system
forwarded or displayed that article is chargeable and could be found guilty
under the same law. Indeed, the author of the article probably could have
been arrested had it originated here in the United States.

The law is erroneous in intent and stupid. It represents a feeble attempt to
gloss over technological problems and solve them by social restrictions which
are known not to work. The only workable solutions lie within the technology
which contains the faults.

Admissions were made recently by AT&T regarding internal security. Several
appear in the May 13, 1991 issue of BellLabs News. The document is copyright
with all rights reserved so I won't quote from it. Bell Labs reports on a
study run of their own internal terminals. They discovered inadequate
protections exercised by employees affecting (infecting) about 15% of their
sample. This comes from a company which lays claims to closely guarded
proprietary software? I rather think that a false claim. I had a discussion
with a former AT&T employee. Given these circumstances, it wouldn't be at all
difficult for an ex employee (and there are plenty of them about now-a-days...
some apparently still angry at their former employer) to enter a facility, log
in to the internal networks, and purloin proprietary secrets.

Interestingly in the same issue is a discussion regarding the newer speed
at which software is now being developed. One of the features is the
reuse of software in segments. Perhaps something akin to production line
tactics, with interchangeable parts. Comes right back around once more to
there being but a single severely flawed Unix port for the 80386 CPU. If you
have a security problem for one product, you'll have the same flaw in all of
them. There are advantages and disadvantages to everything.

At the end of the included (CUD 3.14) article, Spafford discuss
responsibility. It isn't as though manufacturers of software have exercised
sufficient of the legally mandate "prudent man" behaviors when it comes to
generating or safeguarding data and code. Almost adult children regularly
access sensitive information in computers all over this country at will.
Care to draw a conclusion regarding efforts by the industry to protect their
information? There is a well known and established "attractive nuisance"
consideration in liability actions. Culpability is thus shared by the
careless. Historically courts have forgiven criminal trespass of juveniles
and sustained lawsuits and judgments against those who are careless with
things known to attract the juvenile mind. In all states it is a violation
of the law to leave ones keys in the ignition of an automobile. In some
states this provision is actually enforced with fines levied against
offenders.

> By the comments Len made in the code, he certainly knew what he was
> doing, and he knew how the code was likely to be used: certainly not
> as a security aid.  As somebody with claimed expertise in Unix as a
> consultant, he surely knew the consequences of distributing this
> patched code.

I don't give a nit. You and I and anyone familiar with system administration
knows that it only takes moments to install a trap door if a reasonably
knowledgeable individual has access to root privileges. This permits
subsequent iterations of improvement, usually equally undetected. It doesn't
take a Len_Rose_Modified_Code to achieve such goals. The self-evident
question which arises out of reviewing the court documents relating
to Len Rose is simply "why did they prosecute him?" Reading it all and
understanding most of it, I still raise the question.

Other than an insult to AT&T's sensitivities, I don't understand all the
hoopla associated with a relatively uninspired piece of what might best be
called 'theftware.' It actually has about as much value in real terms as any
other trophy. It has to do with the memory of acquisition. The swordfish on
the wall it is hardly tradable, being of no worth to anyone other than the
individual who worked to acquire it.

I'm not responding to the balance of your "Len Rose is an idiot and a
criminal" tirade. You obviously do lack sufficient information to make the
caliber of judgments you've attempted. It would be interesting to know what
your reactions might be were to suddenly be privy to, at the very least, *all*
those documents which constitute the complete court record to date. They are
court records, and available. Would you undertake writing a computer related
article, perhaps about an operating system, with as little to back up your
opinions as you have regarding computer crimes?

Please note that my position in writing this article is not to support Len's
cause to the exclusion of harsh realities. My interest in undertaking this
discussion is directed towards promoting understanding of the irrationality of
governmental behavior in this period of relative conservatism. I believe the
pendulum is newly swung too far.

Gene, none of the issues you've been so freely spouting off about are as
simple and straightforward as you imply. There are basically two levels of
publicly available information. The first is press releases by law enforcement
personnel, the second is the somewhat more complete court record. I really
shouldn't have to point out that press releases by law enforcement have
historically been highly skewed. Anyone can go back to some case or another
which had a press release by the prosecutor, and then read what eventually
transpired in court. Even if the individual discussed was guilty, there is
invariably a wide gap between the realities of the case and the publicity
statements made by prosecutors. And if one has the chance to interview those
who were directly involved in the case (on both sides,) the conclusions tend
to deviate even further from the understandings promulgated by the press
releases originally issued by the prosecution.

I have many reservations about the way the prosecutions have been run,
evidence handled, and the incestuous relationships between plaintiff,
prosecutor, and expert witness. What, for example, isn't readily apparent
in the published and court records in the Naperville case is the simple fact
that that Interactive office might just as well be a department of the labs
across the street. This is the old Lachman Associates, captive contractor to
the labs. The very building occupied by Interactive is owned by Bell Labs,
Murray Hill. I didn't know that till I visited the Du Page County Tax
Collector's office (on a hunch.) The lab's grounds crews cross the street to
mow the lawns. Therefore the plaintiff is AT&T. Every witness, including
those expected to provide expert testimony on behalf of the government, are
AT&T dependents for their livelihood. Sort of like getting into a dispute
with a merchant in a town where you are the only outsider, and everyone else
involved has a familial relationship.

But let's look even a bit deeper. Len was hired at Interactive to be on
assignment across the street at the labs. Not only that, but he was
interviewed at the labs by lab personnel. He was hired and started work on a
Monday morning. Len was terminated on Friday morning. Friday afternoon, a man
we all have heard about and a seemingly wannabe Telco employee, Tim Foley of
the US Secret Service, arrived at at Len's apartment to question him and read
him a Miranda warning. On Monday, local authorities (the Naperville Police
Department with Foley's assistance)  had secured a search warrant and an
arrest warrant. One of these days I'm going to ask the question why the motion
requesting AT&T assistance on the raid to search Len's Naperville apartment
was approved by a judge but was undated. It COULD be pure oversight, but
given the context of the rest of the story, everything has become highly
suspect. At best, it was a very very bad procedural error.

Len was incarcerated on $ 50,000 bond. Interesting fact in itself, as the
bond level for most local violent crimes is only about $ 10,000, to which bond
was reduced on request by Len's attorney a week later. Vengeance by a
prosecutor effectively under AT&T control, perhaps????

> I share a concern of many computer professionals about the application
> of law to computing, and the possible erosion of our freedoms.
> However, I also have a concern about the people who are attempting to
> abuse the electronic frontier and who are contributing to the decline
> in our freedoms.

Thus far, it seems most computer laws have been written at the behest of
special interests instead of the public interest. The laws already inflict
restrictions contrary to generally understood and accepted constitutional
provisions. It seems that at every turn where a serious conflict has taken
place and law enforcement became involved, the government has taken every
possible action to prevent the constitutional challenges which are important
to reforming and refining societal understandings of these issues.

> Trying to defend the abusers is likely to result in a loss of
> sympathy for the calls to protect the innocent, too.

I cannot understand how anyone can make such a statement with a straight
face. It is essential to our system of justice that even (especially)
the obviously guilty get a good defense. If I were witness to my father's
murder, I would demand the killer have a good defense team in spite of the
fact I would do all in my power to see the person convicted.

Our system of justice is far from perfect, but it sure beats the dickens
out of whatever might be considered second best. We're not going to be
able to maintain our relative fairness is we go about spiffing down the
defense to suit someone's set of prejudices. I am glad the American Nazi
Party has the right to march in Skokie, in spite of the fact I detest their
platform. So long as the worse of my enemies is treated fairly, there's a
chance I too will receive fair treatment.

> However, I certainly do not want to ask people to rally around
> the cases of Robert Morris or Len Rose as examples of government
> excess, because I don't think they were, and neither would a
> significant number of reasonable people who examine the cases.

I wonder if, upon reading the court documents in the Maryland case for Len
Rose, you would consider the motions filed by Carlos M. Recio on May 21, 1990
to be a reasonable understanding of the excesses exercised by the government.

Recio studied the case at that time and prepared, as Len's attorney, a
voicing of serious concerns regarding the validity of the search warrant
obtained by Foley et troupe. In fact, they exercised what we know as a
'general warrant.'

"They seized Len Rose's Army medals from the master bedroom which were
contained in a chest of drawers." It is clear they knew this seizure, as page
3 of the inventory spells out "Bag w/ Misc Papers + Army Commendation Medals."
Thus, it was no oversight or accident.

Recio continues:

"The SS searched through the Rose family photo albums, removing a picture of
Len Rose and several photographs of computer equipment that he had taken for
insurance purposes."

More evidence????? More excess?

"The SS seized the Rose family's files (mortgage, loans, credit card bills,
army records, marriage paperwork, diplomas, resumes', etc.)."

I can see it now. Len's marriage paperwork was potentially additional evidence
of criminality. Mortgage papers, more criminality....and so on with diplomas
and army records.

Please bear in mind that the basis for requesting a search warrant was to
determine whether or not Len Rose was indeed the individual known as
"terminus" and that he was indeed the individual who had transmitted the
login.c program to Neidorf. That was the crime for which the government
was seeking evidence. What is very clear in the record is that the government
did in fact embark on a witch hunt, overtly seizing all sorts of things totally
unrelated to their case, as in the colonial examples of general warrants,
attempting to build prosecutable offenses out of thin air.

It then became not "in the ordinary course" of an investigation that other
issues surfaced, but as a direct result of the violation by the government
of the very laws they are sworn to uphold.

The usual course for charges originating on such a basis is dismissal, because
it is not in the best interest of the citizens or the state to reward law
enforcement officers for violating the rights of the citizens in order to
build a case for prosecution. In scientific rationale, evolutionary aspects
eventually will soon resolve the issues. Law enforcement will learn to keep
within guidelines while improving their conviction statistics, and if the
criminal escape this time, and he repeats, it is likely he will be caught
and better prosecuted in the next instance (by that recently improved law
enforcement.) And if the criminal reforms as a result of the close call, of
what benefit is incarceration or punishment?

Excessive? Actually yes, Gene, it was quite excessive. Now, to substantiate
your claim, go find yourself a "significant" sized group of individuals
prepared to take the time to seriously examine the Rose case, and when they're
done, let's then compare results. In the meantime, if you really believe the
case is important enough to elicit your commentary, read the documents proper
and stop with reliance on second or third hand information.

Twice now, regarding the resultants of the E-911 case you've been long on
assumptions, short on proof. Twice now, regarding the resultants of the E-911
case you've been long on promises, short on results. Given this history, I
ask, would a "responsible"  man now seek truth and publish it, or retire
>from this discussion.

This article isn't so much a defense of Len Rose as it is an indictment of the
prosecutions. I also feel it is necessary to point out in no uncertain terms
that those who support law enforcement blindly do themselves and their
community a disservice. There is little doubt that many well intentioned
individuals serve us well in careers supporting the justice system. There
has been movement by all branches at the federal level of law enforcement to
assume guilt before investigation and to trample rights freely utilizing the
immunity originally granted in order to protect officers making honest mistakes
as a standard operating procedure instead of an exceptional circumstance.

The complaints on the net have, for the most part, been related to our own
back yard. Computers are the baby here. Yet overall we see the same sorts
of problems creeping into the justice system everywhere. Historically we have
written our laws in such ways as to empower law enforcement personnel to
capture criminals and bring them to trial while limiting offense to the
sensibilities of the general population. The diverse thresholds of offense we
have regarding police actions are based on our niche in society. Because I
have become more concerned regarding police officers questioning long haired
men at roadside, spread eagled against a rattletrap of a car, doesn't imply
that my niche has changed. It does show that along with many others the level
at which I take offense has changed with the incursion of similar tactics by
police into the middle class middle aged community, the community to which I
belong. The activities of this community haven't changed. The actions taken by
the police have. We note, sadly, that finding or creating of "probable cause"
is used to bring my neighbors personal and financial grief.

So beware, Gene Spafford. The past immunities offered by class and perhaps
occupation are doing nothing for us these days. Nor is it enough to be
squeaky clean. Nor is it enough to have the general appearance of being
squeaky clean. You are now required to preemptively make every law
enforcement officer whose path you cross believe you are squeaky clean. If you
fail, you won't go to jail (probably) nor will you be fined (probably.) But it
can cost a lot of money in legal defense to keep oneself out of jail and
to maintain a void criminal record.

Bill Vajk

********************************************************************

------------------------------

                         **END OF CuD #3.22**
********************************************************************