💾 Archived View for aphrack.org › issues › phrack38 › 14.gmi captured on 2021-12-03 at 14:04:38. Gemini links have been rewritten to link to archived content
-=-=-=-=-=-=-
==Phrack Inc.==
Volume Four, Issue Thirty-Eight, File 14 of 15
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
PWN PWN
PWN Phrack World News PWN
PWN PWN
PWN Issue XXXVIII / Part Two of Three PWN
PWN PWN
PWN Compiled by Dispater & Friends PWN
PWN PWN
PWN Special Thanks to Datastream Cowboy PWN
PWN PWN
PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN PWN
What's Wrong With The Computer Crime Statute? February 17, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By Thomas A. Guidoboni (ComputerWorld)(Page 33)
"Defense and prosecution agree the 1986 Computer Fraud
and Abuse Act is flawed but differ on how to fix it."
It has become an annual ritual, since the birth of the Internet worm, for
Congress to consider amendments to the 1986 Computer Fraud and Abuse Act. At
this point, the U.S. Department of Justice can be expected to advocate three
things: an expansion of the federal role in the investigation and prosecution
of computer crimes, the creation of new categories of offenses, and harsher
penalties, including perhaps the current darling of the department, forfeiture
of property.
Since the law is of recent origin, was substantially revised in 1986 and proved
more than adequate to prosecute and convict Robert T. Morris, there seems
little justification for expansion of its coverage.
Nevertheless, if Congress is determined to review and revise the provisions of
the act, there are several narrow, but significant, amendments that are clearly
warranted. Of primary importance is the definition of terms. The core of the
law suffers from a lack of clarity. Offenses are described by reference to
"authorized" or "unauthorized access," yet these terms are not defined
anywhere.
Perilously Vague
In a universe that consists of broad computer networks, bulletin boards, E-mail
and anonymous file-transfer protocols, and one in which permissions and rights
are established by custom, usage and private understandings, a person is left
to speculate at his peril as to what conduct is permitted and what is
prohibited by this vague language.
The Computer Fraud and Abuse Act should be amended to give precise content to
the concepts of "access" and "authorization," thereby providing fair warning of
illegal conduct.
A second change for the better regarding the act would be to create a
distinction between those computer intruders who unintentionally cause a
monetary loss and those who maliciously cause such harm.
The present law, as interpreted in the Morris case, recognizes no such
distinction. This is contrary to long-standing notions of fairness in our
system of criminal law, which acknowledges that between two persons who cause
the same harm, the one who intended that result is more culpable than the one
who did not.
A third part of the statute that needs revision relates to computerized medical
records. It is too broad because it includes as felonious conduct the
unauthorized access to such records that "potentially modifies or impairs"
medical treatment or care. Virtually every unauthorized access to computers
containing medical records carries this potential. A better solution would be
simply to make any "unauthorized access" of computerized medical records data a
misdemeanor, with the intentional modification or destruction of such data
designated as a felony.
Amend, But Don't Expand
These slight but important amendments would serve to clarify and improve a
basically sound law without stifling the creativity of persons akin to those
who have been responsible for many of the advances in computer technology in
this country. More expansive revisions are ill-advised, as they may
unnecessarily encroach on evolving privacy and free-expression interests.
A broadening of federal involvement is also inappropriate. Nearly every state
has enacted laws against computer fraud and abuse and, as Congress recognized
in 1986, federal jurisdiction should be limited to cases where there is a
compelling federal interest. This might include instances where computers
belonging to the federal government or to financial institutions are involved,
or cases where the crime itself is interstate in nature. Furthermore, other
computer crimes should be left to prosecution by the individual states, as is
presently the case.
In sum, the 1986 Computer Fraud and Abuse Act would benefit from some
clarification, but expansion of its coverage and wholesale revisions are both
ill-advised and unnecessary.
Note: Thomas A Guidoboni is an attorney with Bonner & O'Connell in Washington,
D.C. He represented Robert T. Morris in the Internet virus case.
_______________________________________________________________________________
Private Social Security Data Sold to Information Brokers February 29, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
By R.A. Zaldivar (San Jose Mercury News)
Washington, D.C. -- The privacy of 200 million Americans with records at the
Social Security Administration is threatened by an illegal trade in pilfered
computer files. Computerization has dramatically improved our ability to serve
the public," Social Security Deputy Commissioner Louis Enoff told a Senate
panel. "However, it has also made confidentiality more difficult."
Two executives of Nationwide Electronic Tracking, a Tampa, Florida, company,
pleaded guilty to conspiracy charges in January for their part in a national
network selling Social Security records. Twenty-three people, including agency
employees and police officials, have been indicted in the case -- the largest
known theft of government computer data. "Information brokers" will pay Social
Security employees $25 for a person's earnings history and then sell the data
for as much as $300. Their growing list of customers includes lawyers, private
investigators, employers, and insurance companies.
Social Security records contain a mother lode of information that includes not
only a person's past earnings but names of employers, family history and even
bank account numbers of people who receive benefits by direct deposit. The
information can be used to find people or to make decisions on hiring, firing,
suing or lending, said Larry Morey, deputy inspector general of the Health and
Human Services Department.
"Here we have a large-scale invasion of the Social Security system's
confidentiality," said Senator Daniel P. Moynihan, D-N.Y., chairman of the
Social Security subcommittee.
Information from other government data bases with records on individuals --
such as the FBI's National Criminal Information Center -- is also available on
the underground market. All a broker needs is the cooperation of a clerk at a
computer terminal.
Congress may revise privacy laws to increase penalties for illegally disclosing
information in the private files of individuals.
Enoff said Social Security is studying ways to improve computer security, as
well as keeping closer tabs on employees with access to files, and stressing to
its workers that unauthorized disclosure of information is a federal crime.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Related articles can be found in Phrack World News, Issue 37, Part One:
Indictments of "Information Brokers" January 1992
Taken from The Privacy Journal
SSA, FBI Database Violations Prompt Security Evaluations January 13, 1992
By Kevin M. Baerson (Federal Computer Week)(Pages 1, 41)
_______________________________________________________________________________
Back to Act I March 3, 1992
~~~~~~~~~~~~~
Taken from Communications Daily (Page 2)
"Supreme Court Lets Stand Ruling That FCC Ban On Indecency Is Unconstitutional"
FCC's 24-hour ban on indecent programming is unconstitutional, U.S. Supreme
Court ruled in refusing to consider unanimous U.S. Appeals Court, D.C.,
decision. Supreme Court action also effectively overruled December 1988 rider
to Senate appropriations bill directing FCC to ban all indecent programming.
Last summer, en banc Appeals Court had refused to reconsider May decision by
unanimous 3-judge panel that FCC ban is unconstitutional.
FCC, with support of Justice Department, had asked Supreme Court to reconsider
case. Coalition of 14 intervenors, including Action for Children's TV (ACT),
had opposed FCC in Appeals Court and Supreme Court. En banc Appeals Court said
that none of 13 judges who participated "requested the taking of a vote" on
whether to rehear case. On Supreme Court, Justices Sandra O'Connor and Byron
White voted to reconsider case. FCC's definition of indecency: "Language or
material that depicts or describes, in terms patently offensive as measured by
contemporary community standards . . . sexual or excretory activities or
organs." Agency has fined several stations for indecent programming in the
last year.
With loss in Supreme Court, FCC official told us "we don't have any choices
left" but to permit such programming to be broadcast. "We're back to Act I."
Source predicted, and other FCC officials agreed, that agency soon will issue
rulemaking to make a ban on indecent programming later than 8 p.m. Same
sources expect Congress once again to take up issue.
ACT President Peggy Charren said: "It's very exciting for ACT to have won one
for the First Amendment. We always knew it's preposterous for the FCC to try
to ban speech at 3 o'clock in the morning to protect children . . . It's very
satisfying to have this particular [conservative] Supreme Court agree with us."
NAB (which also was intervernor in case) Associate General Counsel Steve
Bookshester said Supreme Court "correctly" acted in not reviewing lower court
decision: "Now, it's up to the Commission to adopt new procedures to determine
when such material is permitted to be broadcast." Washington attorney Timothy
Dyk, who represented intervenors, said: "I think it's a very happy result . . .
The Court of Appeals decision is exactly where it should be in terms of a safe
harbor."
_______________________________________________________________________________
Drug Enforcement Data Are Vulnerable Through Phone Lines March 4, 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Taken from Communications Daily (Page 5)
Classified information in computers of Drug Enforcement Administration (DEA) is
at risk, General Accounting Office (GAO) said in a report. It said DEA doesn't
provide adequate protection of classified information because too many people
have access to computers that store data, and computers with classified
information are hooked into nonsecure telephone lines, making them vulnerable
to outside intrusion.
Report, Computer Security: DEA Is Not Adequately Protecting National Security
Information (GAO/IMTEC-92-31), said it found several instances of lax physical
and electronic security at DEA computers in several locations. Although there
are no known instances of security breaches, "these disturbing security
weaknesses pose serious risks that could potentially hinder DEA's mission and
threaten the lives of federal agents," the report said. The report found that
DEA isn't complying with standard security guidelines outlined by National
Security Agency.
In preliminary findings, GAO was so concerned with security weaknesses that it
called in Department of Justice on January 9 and furnished it with a "limited
official use" version of its report to give DEA time to correct problems, said
Rep. Wise (D-W.Va.), chairman of House Government Operations Subcommittee, who
ordered the investigation. He said other government agencies should be wary of
sharing information with DEA until security problems have been eliminated.
Calls to DEA on progress of follow-up security procedures weren't returned.
Findings are "indicative" of typical "apathetic security attitude" that the
government has, said David Banisar, security expert for Computer Professionals
for Social Responsibility.
GAO investigators found DEA couldn't adequately identify what computers used
classified information. "DEA cannot ensure that adequate safeguards are in
place for protecting national security information," report said. In spite of
federal guidelines, GAO found that DEA hasn't "completed a risk analysis" of
computer system. Some classified computers were found to be operated in areas
where contractors -- with no security clearances -- moved around with no
restrictions. No computers were found to be "tempest" hardened, meaning
electronic emissions from keyboards can't be picked up.
In light of concern on outside intrusion from "hackers," GAO found several DEA
computers were connected by phone lines "that are not encrypted" -- which it
described as clear violation of national security guidelines. The report said
"unauthorized individuals can intercept or monitor information emanating from
and transmitted by" the agency without being detected. Classified information
was found to be stored on hard disks in an "inadvertent" manner, allowing for
the possibility that computers, when resold, still might hold data. One such
occurrence, recorded by GAO in its report, occurred last year when sensitive
grand jury information on informants was left on surplus computers sold by DoJ
at a public auction.
The report said that DEA has acknowledged weaknesses "and is taking action to
correct them."
_______________________________________________________________________________
BBS Controversy Brews Close To Home March 1992
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Taken from Puget Sound Computer User
Special Thanks: Peter Marshall in Telecom Digest
In a case before the Public Utility Commission of Oregon, US West is
maintaining three phone lines connected to a free-access BBS in a residence
should be billed at business rates. Because of the similarities in tariffs
>from state to state and US West's position in the case, many are predicting
that if US West prevails, the company will be authorized to raise all Oregon
BBS lines to business rates and try to raise rates for BBS lines in US West's
remaining 13 states.
The case started when Tony Wagner, a Portland system operator, received a
letter from US West in October, 1991. In the letter, Communications Consultant
Sandi Ouelette said "Bulletin board services are considered a business,
therefore, subject to business rates ..."
One Seattle attorney interested in telecommunications said these attempts by
the phone companies to raise rates for BBSes are "just another attempt to swipe
people's communication."
_______________________________________________________________________________
1-800-54-PRIVACY March 10, 1992
~~~~~~~~~~~~~~~~
Taken from Communications Daily
American Newspaper Publishers Association (ANPA) President Cathleen Black asked
American Paper Institute to support the newspaper industry's fight against
RHCs, warning that the market for paper could drop if phone companies are
allowed to expand activities into information services. Increased electronic
classified ads and other services could lead to cutbacks in demand for
newsprint, Black said. Newspaper producers, traditionally allied with ANPA,
said they would study the matter.
Meanwhile, full-page newspaper ads placed by ANPA and allied Consumer
Federation, Graphic Communications International Union, National Newspaper
Association, and Weatherline have generated thousands of calls to an 800 number
>from readers concerned about potential invasions of privacy by telephone
companies. The latest ad ran in the March 7 Washington Post, under the
headline: "Unless they're stopped, the Bells will know more about you than
even the IRS." The ad advised callers to dial 1-800-547-7482, referred to in
the telephone message as "1-800-54-privacy."
Gary Slack, of the Chicago PR firm Slack, Brown & Myers, which is coordinating
the 800 campaign, said that the angle in the ad has become an effective weapon
against RHCs because "there are a lot of people concerned about privacy."
Callers are sent a 4-page letter signed by Black and "action guidelines" for
asking legislators to support bills by Representative Cooper (D-Tenn.)
(HR-3515) and Senator Inouye (D-Hawaii) (S-2112) that would restrict RHC entry
into information services. ANPA has argued that, through data on telephone
bills, information can be collected about callers.
RHCs didn't have the incentive to use that data before, but now with the
ability to offer information services, they do, ANPA said. ANPA generally
doesn't pay for ads, but offers them to newspapers to run when they have space,
a spokesman said. Pacific Telesis Vice-President Ronald Stowe said ANPA ads
"show desperation and questionable ethics." He said ANPA is using some of same
tactics it has accused RHCs of using, including collecting information on
subscribers. ANPA ads are "really sewer-level stuff," Stowe said: "There are
enough legitimate issues that ought to be debated."