RISKS-LIST: RISKS-FORUM Digest  Sunday, 24 January 1988  Volume 6 : Issue 13

        FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS 
   ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Contents:
  U.S. Fears Satellites Damaged (PGN)
  Signal-light malfunction blamed in L.A. train wreck (PGN)
  Big Error on Benefits by a State Computer (PGN)
  London Underground Ticket Machine fraud (John Pettitt)
  The responsibility of and for `bringing us C and Unix' (Geraint Jones)
  Risks in technology transfer policy (Alan Wexelblat)
  Technology transfer policy and Halley's Comet probe (Alex Colvin)
  Non-ionizing radiation (John Nowack, Jonathan Thornburg)
  Books about SDI software -- a request (Dan Jones)
    [Large but marginal backlog on New Year's Evils, SSNs, viruses, ...]

The RISKS Forum is moderated.  Contributions should be relevant, sound, in good
taste, objective, coherent, concise, nonrepetitious.  Diversity is welcome. 
Contributions to RISKS@CSL.SRI.COM, Requests to RISKS-Request@CSL.SRI.COM.
 > > > > > > > > > PLEASE LIST SUBJECT in SUBJECT: LINE. < < < < < < < < <
  For Vol i issue j, FTP SRI.COM, CD STRIPE:<RISKS>, GET RISKS-i.j.
  Volume summaries in (i, max j) = (1,46),(2,57),(3,92),(4,97),(5,85).

----------------------------------------------------------------------

Date: Sun 24 Jan 88 14:10:34-PST
From: Peter G. Neumann <NEUMANN@csl.sri.com>
Subject: U.S. Fears Satellites Damaged

Subtitle -- Soviets used lasers to cripple equipment, sources contend.

Washington, by Richard Sale (UPI, 24 January 1988).

U.S. intelligence agencies are convinced Soviet laser attacks have damaged
supersophisticated U.S. spy satellites deployed to monitor missile and
spacecraft launches, administration sources said.  These sources said they
believe the Soviets fired ground-based lasers to cripple optical equipment
attempting to scan launches at Tyuratam, the major Soviet space center, to
obtain a variety of sensitive military information.  Administration
intelligence sources said they fear that other vital U.S. reconnaissance
satellites will soon be endangered because six new Soviet laser battle stations
are under construction...  "There is no way you can protect the optical sensors
on satellites" from laser attacks, an Air Force official said. ...

Intelligence sources acknowledged that the Pentagon also has trained
ground-based lasers on Soviet spacecraft, sometimes in attempts to disrupt
their sensors. ...

  [From the San Francisco Examiner and Chronicle, front page, 24 Jan 88.  The
  article goes on to consider reports that some spacecraft malfunctions may
  have been due to laser "hosing", e.g., a KH-11 or Code 1010 satellite, which
  was permanently damaged in 1978.  Seems unlikely -- the technology was not
  very well advanced then?  PGN]

  [However, the risks of laser interference or accidental triggering are worth
  noting.  Adding to the risks of computing in SDI, might such a concerted
  attack of simultaneous laser bursts on many satellite sensors be mistakenly
  detected as the launch of a nuclear attack!?  PGN]

------------------------------

Date: Sun 24 Jan 88 14:28:53-PST
From: Peter G. Neumann <NEUMANN@csl.sri.com>
Subject: Signal-light malfunction blamed in L.A. train wreck

PICO RIVERA, Los Angeles County (AP, 24 Jan 88)

A malfunctioning signal light appeared to have caused a freight train to crash
into a parked train, killing a man and igniting a fire that consumed a church
and a store, a railroad official said Saturday.  A 72-car freight train
traveling about 40 mph to 45 mph slammed into a parked 67-car freight train
at 10:30 p.m. Friday after a signal light about a mile from the impact gave 
the green go-ahead light, an official said.  Damage to the trains and
buildings was estimated at $2.3 million.

  [From the San Francisco Sunday Examiner and Chronicle.  The identical story
  appeared TWICE in the same issue on 24 January 1988 -- on page B-5 and also
  on page B-7, although with different headlines.  The headline guy must have
  been napping, or else the story was intended to illustrate the importance of
  redundancy.  PGN]

  [Ironically, the Federal Communcations Commission recently approved plans
  for a nationwide computerized train-control system -- inspired by the
  collision on 4 January 1987 of three speeding Conrail locomotives and an
  Amtrak passenger train, klling 16 and injuring 176 near Chase, MD, with
  losses estimated at over $40 million.  The FCC's private radio bureau
  reported that "This terrible collision could have been avoided had the
  locomotives been under the control of a central computer."  This popular
  view assumes that such computer systems always work correctly, and that
  people always program them correctly.  PGN]

------------------------------

Date: Sun 24 Jan 88 14:15:34-PST
From: Peter G. Neumann <NEUMANN@csl.sri.com>
Subject: Big Error on Benefits by a State Computer

By Perry Lang, San Francisco Chronicle, 21 January 1988.

"Thousands of Californians have been charged for unemployment and disability
insurance benefits they never received because of a computer snafu in
Sacramento.  One of the state's computers, which tallied ... benefits for 1987,
malfunctioned and moved the decimal place two spaces to the right -- producing
dollar amounts that were up to 100 times more than they should have been. ...
[A]bout 60,000 people throughout the state received erroneous statements."

   [Computer malfunction? or program error? or human error on input?  PGN]

------------------------------

Date: Mon Jan 18 13:50:11 1988
From: pyrltd!jpp%mcvax@uunet.UU.NET
From: jpp@slxsys.specialix.co.uk (John Pettitt)
Subject: London Underground Ticket Machine fraud
Organization: Specialix International, London, UK.

Reproduced without permission from "datalink" monday 11 jan 1988

London Underground's controversioal UKL 150 million computerised ticket
system could create a fare dodgers' paradise. ...  The system, based on
sophisticated real time software developed by Logica, has been criticised
because it allows adults to purchase child tickets and travel on the
Undergroud without being visualy checked by ticket collectors. ... Now
security consultants have confirmed that the new type of ticket, which uses
a magnetic strip holding details of the fare, will be easier to forge that
the traditional printed type.

John Maxfield, and anti-hacking consultant in Detroit, says similar tickets
have already been beaten by teenagers in the US.  He said:  "San Francisco
metro caught a gang forging the tickets there last January.  The gang had
used pasteboard and cassette tape to make duplicates."

A spokesman for Westinghouse Cubic, which manuafctures the new ticket
barriers, at first denied its system had been breached in the US.  But a
spokesman later admited:  "With the right know-how, of course anything in
the world can be duplicated, including our tickets."

Can any US readers of comp.risks add any further info on the SF incident ?

John Pettitt, Specialix, Giggs Hill Rd, Thames Ditton, Surrey, England, KT7 0TR
{backbone}!mcvax!ukc!pyrltd!slxsys!jpp               jpp@slxsys.specialix.co.uk
Tel: +44-1-398-9422         Fax: +44-1-398-7122          Telex: 918110 SPECIX G

    [Considering how easy this is to do in SF's BART and in DC's METRO, we 
    might just as well NOT discuss it here.  But the vulnerability -- a 
    playback copycat attack -- has been well known for many years.  PGN]

------------------------------

Date:    Sat, Jan 23 15:15:10 1988 GMT
From: Geraint Jones <geraint%prg.oxford.ac.uk@NSS.Cs.Ucl.AC.UK>
Subject: The responsibility of and for `bringing us C and Unix'

I take issue with some of Peter Neumann's editorial comment (RISKS 6.11,
after the continuing discussion of Sun clock problems traced to mishandled
side-effects in C expressions).  I accept that the programmer was at fault,
that we should always be aware that we are at risk of being allowed to make
mistakes; but `the people who brought us C and Unix' _do_ share the fault.

    UNIX is moderately wonderful; because of that, you will scarcely find a
convenient and powerful desktop computer which does not use UNIX, and I for
one would not choose to use one.  Choose UNIX, and you get C; and that's the
fault of all `the people who brought us C and Unix', including the few
individuals who had the good (and just one or two bad) ideas in the first
place, all the universities and companies who have popularised and modified
UNIX, and those of us who use it.

    C was a pretty neat idea when you compare it with what else was about
fifteen years ago, and without it UNIX could not have been knocked up as it
was.  The technology exists, and has existed for years, to check that the
arguments of a function are side-effect free.  Ten years ago, I used a BCPL
compiler that would decide whether or not it was safe to call arguments to
`macros' (manifest functions) by substitution.  Where are the C compilers that
check for such things?  I write C programs only because `the market' has
created a near monopoly in portable programs in the community in which I work.

    The C macro-substitution mechanism cries out to be misused, and we
_should_ kick up a fuss about it.  Such things should not be allowed to
continue.  Peter Neumann reminds us to ``Know your requirements before you
start designing, programming, or simply using a computer system.'' Well, I
do; I want to write programs which correctly implement the algorithms I
design.  I want the software tools that I use to make it as difficult as
possible for me to make a fool of myself; yes, even at the expense of making
it harder to write programs. Now, where do I get them?               gj

    [RISKS are in the eye of the beholder.  ALL COMPUTING entails certain
    risks.  If you want perfectly safe programming languages and operating
    systems, you would be most unhappy with the constraints.  The only
    program you could write would be THE NULL PROGRAM, and even that would not
    be safe if nonstop real-time positive control were required.  On one hand 
    we have people who will tell us that they can produce 10 million lines of
    code that will work adequately without system testing.  On the other hand
    we have systems and languages that hinder any such efforts.  Ultimately we
    need truly gifted programmers.  Ken Thompson is one.  But there probably
    aren't more than a handful anywhere approximating him in the country.
    Besides, people that creative would be badly matched to the task of trying
    to write 10 million lines of code.  Creativity often is best exercised when
    the results are not what was expected.

    You might look at Modula 2 and C++.  But don't expect fool-proof operating
    systems.  There aren't any.  By the way, we should not trust any programs
    developed by fools -- even with perfect tools.  PGN]

------------------------------

Date:     Sat, 23 Jan 88 14:22:06 EST
From: Alex Colvin <mac3n@babbage.acc.virginia.edu>
Subject:  Technology transfer policy and Halley's Comet probe (RISKS-6.12)

In regard to the discussion of technology transfer policy:  Scientific
American noted that on the Soviet Halley's Comet probe the only experiment
not controlled by a microprocessor was an American contribution.

                       [I presume you are implying that this is a RISK.  
                       It might even be a BLESSING IN D' SKIES?  PGN]

------------------------------

Date:     Fri 08 Jan 1988 17:20 CDT
From:     John Nowack KA9EYT <MISS042%ECNCDC.BITNET@CUNYVM.CUNY.EDU>
Subject:  Non-ionizing radiation

When I read the study about non-ionizing radiation, I seemed to remember an
article in a similar vein, and about an hour at the library dug it up.  It's
actually a series of articles published in QST, the technical magizine of
the American Radio Relay League.  The following comes from QST, Vol. LXII,
No. 9, September 1978, p. 31.  For more information on this same subject see
QST Vol. LXII, No. 6, June 1978, pp. 11-13, and for more info on the risks
of chemical exposure see part 2 of that article in No. 7, July, 1978,
pp. 37-38.  Most towns with an active ham population will have a club that
will more than likely have given a subscription to this publication to a
local public or university library.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
John Nowack -- KA9EYT (aka The Black Knight)
(A member of the Society for the Prevention of Injustice to Tuna (S.P.I.T.))

MISS042@ECNCDC.BITNET >>======> Western Illinois University (A Member of
                                   the Mid-Illinois Computer Coopertive;
                                   Educational Computing Network)

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=%< cut here -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
The following disclaimer heads the article:
The publishers of QST assume no reponsibility for statements made by
correspondents.

                 How Dangerous is RF Radiation?
                      by: J. E. Kearmen, W1XZ
                          RFD, Collinsville, CT
                               06022

Workers at Motorola have recently conducted experiments of great interest to
most amateurs.  Their results have been published in several IEEE publications
(see end for info).  I'm grateful to Mr. Ronald Brecher, WA2EUN, who supplied
a copy of the March, 1977 document.
  The experimenters constructed a simulated human head and torso and exposed
it to the radiated fields from 150 and 160 MHz, 6 watt handheld transceivers.
Both radios were equipped with helical, or "rubber duck" antennas.  In
addition, tests were performed with a 1/4 wavelength antenna installed on the
450 MHz unit.  A thermal probe was used to measure temperature rise due to
exposure.  These experiments were performed because of a concern that the
newer, high-power units might pose a health hazard.  Previous measurments of
the field strength surrounding these radios had indicated that a field
intensity exceeding 10 mW/cm2 might exist.  This is a safety standard for human
exposure to RF energy at higher frequencies.
  Beacause the field would be concentrated by a probe causing nontypical,
localized heating, the probes were removed while the transmitter was operating.
The "dummy" was exposed for from 15 to 60 seconds.  After power was removed,
the probe was again inserted and the temperature change was determined.  Steps
were taken to prevent thermal transients caused by the insertion and removal
of the probe.  It would have been possible for heating to occur in small
areas not being monitored by a probe. To look for "hot spots", an IR
(infrared) scanner was used to take thermograms of the dummy.
  Assuming the transceiver was positioned as it would be during normal
operation, no significant heating effects were noticed on either band. Even at
450 MHz, the temperature rise was slight.  At a shallow probe depth (0.2 in.
or 5 mm), the greatest temperature rise was less than 1 degree C.  (Actually
10 degree C, at the eyebrows - jcn) At deeper probe penetrations, the
temperature rise was less.  Attempting to determine possible hazards from a
measurement of radiated field intensity may cause misleading results.  The
low total energy and high field impeadence which exist when such radios are
brought in close proximity to the body will result in lower energy transfer
than field strength measurements alone would seem to indicate.  For example,
at a point two inches (50 mm) from the helical antenna of the 150 MHz
transmitter (Fig 1 (a good drawing of the measured temperatures -jcn)), a
Narda field probe measured a maximum field intensity of 168 mW/cm2.  This
value greatly exceeds the 10 mW/cm2 exposure standard.  Measurements based on
the penetrating effects at the same point indicate a maximum power flow density
in tissue of 2.8 mW/cm2.  On 450 MHz, with the same spacing from the 1/4
wavelength *whip* antenna (Fig 3), a maximum radiated intensity of 16 mW/cm2
was found.  Power-flow density was only 2.5 mW/cm2.  The radiation meter
indicates a hazardous condition, while actual measurement of the effects
shows this is not the case.  Power *absorption* in all cases was less than
1 mW/cm2.
  IR thermograms did not detect any unusual hot spots.  A health hazard
exists when the tip of the antenna is close to the eye (whithin 0.2 inch or
5 mm) and the transmitter is operated.  In this case, an rf burn will result
on the cornea.  The thick plastic cap on the tip of the antenna makes this
unlikely to occur.  When the radios are held in the normal position for use,
no hazard exists.
  While these tests were performed for 150 and 450 MHz, I think it safe to
assume we need not fear our 220 MHz rigs either.  These tests point out the
fallacy of using radiated field intensity as a criterion of saftey.  Some
consumer publications have begun to measure field strength radiated from
CB radios.  Comsumers have been warned not to stand too close to the mobile
whip while a 5-watt CB transmitter is operating, due to the high field
strength!  These papers have shown that radiated power may greatly exceed that
which is absorbed and converted into heat.  Amateurs should continue to
exercise prudence when using uhf and microwave equipment, of course.  It
does seem that our portable transceivers pose no threat to our health.

------------------------------

Date: Sat, 9 Jan 88 20:21:02 PST
From: Jonathan_Thornburg%UBC.MAILNET@um.cc.umich.edu
Subject: cancer, ham radio operators, and Poisson statistics

Perhaps I'm missing something, but the AP story quoted in Risks 6.3
about cancer death rates among ham radio operators doesn't seem to
me to show anything abnormal --- the deviations from expectation are
about what you'd expect from random fluctuations.  For example, for
the leukemia case (29 exp vs 36 obs), *chance* *fluctuations* *alone*
will cause the number of deaths to be at least 36, about 10% of the
time.  In other words, if we hypothesise that there's no excess, then
this experiment (still) has a 10% chance of seeing excesses at least
as large as those observed.
 
The other rates quoted give similar results.  The probability that
all these rates would simultaneously deviate by these amounds is
rather small, but this sort of statistical "inference" is frowned on
by the pros --- it risks a "shotgun effect" in which you check (say)
100 different types of cancer, find 5%-chance-occurence sized excesses
in 5 of them (quite unsuprisingly), then report just those 5 and say
that the chances of getting these excesses in all 5 is (5%)**5 = one
chance in 3 million.
 
Of course, the AP reporter may well have garbled things, but the data
in the story don't seem to prove (*) any excess death rates.
 
(*)     I'm using "prove" in it's normal statistical sense, ie "prove
        at a 95% or better confidence level".

------------------------------

Date: Thu, 21 Jan 88 22:07 EDT
From: DMJ%Vms.Cis.Pittsburgh.Edu@VB.CC.CMU.EDU
Subject: Books about SDI software

I am going to be writing a report on the feasibility of the software for SDI.
Have any RISKS readers seen any good books or articles on the subject?  If so,
would you mind mailing me a reference, and maybe a few sentence abstract.  I
will post a complete list if anyone is interested.  Thanks in advance.
								
Dan Jones, dmj3@cisunx.uucp, dmj3%unix.cis.pittsburgh.edu@ub.cc.cmu.edu

   [RESPONSES TO Dan, PLEASE.  Completed list from Dan to RISKS, please... PGN]

------------------------------

End of RISKS-FORUM Digest
************************