From: mmm@cup.portal.com
Subject: The RISKS of Posting to the Net
Date: Thu, 23 May 91 11:58:07 PDT
Newsgroups: comp.risks

I just had an interesting visit from the FBI.  It seems that a posting I made
to sci.space several months ago had filtered through channels, caused the FBI
to open (or re-open) a file on me, and an agent wanted to interview me, which I
did voluntarily.

My posting concerned destruct systems for missiles.  I had had a chance to look
at the manual on the destruct system used on the Poseidon and Polaris A3
missiles, and was shocked at the vulnerability of the system which triggers the
system.  In my posting, I commented that the system seemed less secure than
many garage-door openers.  It uses a set of three tones, in which two tones are
presented, then one tone is taken away and the third tone is applied.  The only
classified parts of the system are the frequencies of the second and third
tones.

On the net, I asked whether tone control systems like this are still used for
missile destruct systems.  By e-mail, I received an answer from a person who
was currently designing a destruct system, and he indeed confirmed that not
only are tone-control destruct systems still used, they are a requirement of
some test ranges.  (However, he thought it would be difficult to send a bogus
destruct command because of the need to blot out one of the tones which is
transmitted continuously from ground control; it would be far easier to insert
a bogus flight control command and send the missile toward a city.)

A few months later, I received a message from my sysop asking me to call a
person at Patrick Air Force Base who wanted to get in touch with me.  This guy
was real concerned that I had revealed "sensitive" information.  He said he
kept his copy of my posting in his safe!  I guess he didn't know that it had
already been distributed throughout the industrialized world.  He didn't want
to say anything about the subject over the phone.  He asked whether I would be
willing to be interviewed by an investigator.  I agreed, and he said I would be
contacted within 24 hours by someone locally.  That was the last I heard of
him.  I suppose he talked to someone who knew more about destruct systems, and
was reassured that it isn't possible because it hasn't happened yet.

Two days ago, more than half a year after my original posting, I got a message
that someone from the Palo Alto office of the FBI wanted to talk to me.  I
called him, and we agreed to meet this morning.  He didn't seem too concerned
with the technical aspects of my posting -- I guess he also had his own experts
to consult.  He mostly seemed to be checking me out to see if I was plotting to
blow up a missile.  He was also very interested in how the net works.  I told
him all about the net.  He wanted to know if there was any sort of censorship
or control over what goes on the net, and I explained it was mostly
after-the-fact control, for example if you post a commercial advertisement the
management of your site will get a ton of e-mail asking that your account be
cancelled.

He asked whether someone could post an offer for $10,000 for blueprints of a
missile or something, and I said there isn't any sort of censorship that would
prevent that sort of thing.  But the closest thing to a request for information
on performing a crime that I knew of was a couple years ago when someone asked
in the chemistry newsgroup about methods for electrically igniting a chemical.
I told him about the controversy that caused, though I omitted my role in
answering the original poster's question :-)

I also told him about newsgroups like alt.drugs, rec.pyrotech, etc.  He took
copious notes.  He asked about the equipment needed to access the net.  I told
him about computers and modems and Portal.  I should contact Portal management
to see if I get a bonus if he signs up as a customer :-)

The only surprise came at the end of the interview.  He asked if I had any
questions.  I said I was curious how my posting ended up in his hands.  Before
he could answer, I said I suppose you were contacted by that guy at Patrick Air
Force Base.  This surprised him, and he said he knew of no involvement by
anyone at Patrick Air Force Base.  I asked how he _did_ know about my posting,
and he said he couldn't answer that.  I then went on to tell him about the
controversy over Uunet, and their role in supplying archives of Usenet traffic
on tape to the FBI, and he seemed surprised by that also.

So what's the RISK here?  None to me, because I was a perfectly innocent party.
I suppose some people would be really concerned to learn that their postings to
the net are being monitored for possible illegal activity.  But I would be far
more concerned if they weren't.  The fact that two independent investigations
were started is reassuring to me, because it shows that the government is not
totally brain-dead with regard to possible threats to their big projects.
Certainly if _I_ were FBI director, I would consider Usenet to be a great
resource.  I'd learn all about computer crime, recreational drugs that aren't
illegal yet, low-tech ways of building bombs, how to contact Earth First!,
etc., etc.