****************************************************************************
>C O M P U T E R U N D E R G R O U N D<
>D I G E S T<
*** Volume 2, Issue #2.17 (December 16, 1990) **
****************************************************************************
MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet)
ARCHIVISTS: Bob Krause / Alex Smith
RESIDENT INSOMNIAC: Brendan Kehoe
USENET readers can currently receive CuD as alt.society.cu-digest.
COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views. CuD material may be reprinted as long as the source is
cited. Some authors, however, do copyright their material, and those
authors should be contacted for reprint permission.
It is assumed that non-personal mail to the moderators may be reprinted
unless otherwise specified. Readers are encouraged to submit reasoned
articles relating to the Computer Underground.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DISCLAIMER: The views represented herein do not necessarily represent the
views of the moderators. Contributors assume all responsibility
for assuring that articles submitted do not violate copyright
protections.
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
CONTENTS:
File 1: Moderators' Corner
File 2: From the Mailbag
File 3: EFF Response to Atlanta Sentencing Memorandum
File 4: Some Thoughts on the Atlanta Sentencing
File 5: Earning your Stripes
File 6: Playgrounds of the Mind: Cyberspace
File 7: The CU in the News
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
----------------------------------------------------------------------
********************************************************************
*** CuD #2.17: File 1 of 7: Moderator's corner ***
********************************************************************
From: Moderators
Subject: Moderators' Corner
Date: December 16, 1990
++++++++++
In this file:
1. LEN ROSE UPDATE
2. FTP FILES
++++++++++
+++++++++++++++++++++
Len Rose Update
+++++++++++++++++++++
Len Rose will go to trial in Baltimore in late January barring any
extensions. He asked us to pass on his thanks to the many, many people who
responded to his request for witnesses. Len is still unemployed and is
prevented from seeking menial work because his leg remains in a cast and he
cannot stand for extended periods of time. He sends his thanks to those who
have helped in financially and emotionally during this period. Those
wishing to help him through the holidays are encouraged to send donations
to:
Len Rose Donation
c/o Sheldon Zenner
Katten, Muchin and Zavis
525 W. Monroe, Suite 1600
Chicago, IL 60606
Checks should be made out to either Sheldon Zenner or Len Rose.
+++++++++++++++
FTP Files
+++++++++++++++
A few more state statutes have been added to the ftp site along with a few
legal papers. The complete NIA (Network Information Access, #s 1-67) will
also be up by Christmas. DAVE BANISAR has been helpful in expanding the
legal documents.
The EFF NEWSLETTER, which just came out, will also be added. We encourage
people to ftp it and upload it elsewhere. Their first issue is excellent
(we reprint their response to the Riggs sentencing memo in file 3).
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
From: Various
Subject: From the Mailbag
Date: December 16, 1990
********************************************************************
*** CuD #2.17: File 2 of 7: From the Mailbag ***
********************************************************************
From: Robert McClenon <76476.337@COMPUSERVE.COM>
Subject: Cowboys and Indians and the cyberfrontier
Date: 11 Dec 90 00:54:55 EST
The question was posed as to whether hackers are cowboys seeking new
territory to stake out. Maybe. But I propose a different (electronic)
frontier metaphor. Cowboys lived on the frontier in what they perceived to
be freedom but did not understand the limits of the world and eventually
wasted the commons. There were another group of people, living further out
on the frontier, who in general did understand the limits of the world and
the interdependency of all things, and who had their own tribal culture and
ethic that was not well understood by outsiders. They were called by many
names and called themselves by many names, but at the time most outsiders
called them Indians. Their society was tribal, but most tribes had an
organization that at the same time was mostly democratic and yet placed a
great deal of authority and respect in a chief. They had a few enemies.
Principal among their enemies were the federal cavalry. The objective of
the cavalry was in general to herd the Indians onto reservations as a step
toward fencing in the free range, and some of the cavalry had the secondary
wish to massacre a few Indians in the process. The cavalry often waited
for a provocation, which sometimes came from rogue Indians who interfered
with the white man's property, by raiding his sheep, or with his
communication, by cutting telegraph lines or harassing the pony express.
I suggest that the BBS community are comparable to Indians, living
peacefully on the frontier, in harmony with the world, and mostly
respecting the authority of the chiefs (sysops), although not without
complaining. Hackers are rogue Indians, who threaten communication and
property. It does not take much of a provocation to bring on the feds.
And the feds do not respect the Indian culture and have shown a willingness
to slaughter Indian chiefs who tried to cooperate with the feds in
controlling the rogue Indians.
What are the conclusions? The rogue Indians threaten the continued
existence of the Indians. The worse rogues are the feds, who do not seem
to respect anyone's law, even their own. The only long-term hope for the
Indians is to maintain their own discipline.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
From: wex@PWS.BULL.COM
Subject: A Philosophical Reminder
Date: Mon, 10 Dec 90 13:41:49 est
Not to rain on Dark Adept's parade since I largely agree with him, but...
The ancient wizards he refers to, and whom he credits with things such as
Physics and Philosophy, were but pale imitations of their Greek, Babylonian,
and Chinese forbears. It was these men (for women were systematically
excluded) who -- as far as we know -- founded such things as Philosophy.
The alchemists (and similar "wizards") were indeed similar to (some) hackers
in that they were unsystematic dabblers in things that were supposed to be
forbidden. But credit where credit is due, please. It was people like
Descartes and Russell who systematized and made Western science what it
became.
--Alan Wexelblat phone: (508)294-7485
Bull Worldwide Information Systems internet: wex@pws.bull.com
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
From: Electronic Frontier Foundation
Subject: EFF Response to Atlanta Sentencing Memorandum
Date: December 10, 1990
********************************************************************
*** CuD #2.17: File 3 of 7: EFF Response to Atlanta Sentencing ***
********************************************************************
EFF News #1.00: Article 7 of 7:
How Prosecutors Misrepresented the Atlanta Hackers
Although the Electronic Frontier Foundation is opposed to unauthorized
computer entry, we are deeply disturbed by the recent sentencing of Bell
South hackers/crackers Riggs, Darden, and Grant. Not only are the sentences
disproportionate to the nature of the offenses these young men committed,
but, to the extent the judge's sentence was based on the prosecution's
sentencing memorandum, it relied on a document filled with
misrepresentations.
Robert J. Riggs, Franklin E. Darden, Jr., and Adam E. Grant were sentenced
Friday, November 16 in federal court in Atlanta. Darden and Riggs had each
pled guilty to a conspiracy to commit computer fraud, wire fraud,
access-code fraud, and interstate transportation of stolen property. Grant
had pled guilty to a separate count of possession of access codes with
intent to defraud.
All received prison terms; Grant and Darden, according to a Department of
Justice news release, "each received a sentence of 14 months incarceration
(7 in a half-way house) with restitution payments of $233,000." Riggs, said
the release, "received a sentence of 21 months incarceration and $233,000
in restitution." In addition, each is forbidden to use a computer, except
insofar as such use may be related to employment, during his
post-incarceration supervision.
The facts of the case, as related by the prosecution in its sentencing
memorandum, indicate that the defendants gained free telephone service and
unauthorized access to BellSouth computers, primarily in order to gain
knowledge about the phone system. Damage to the systems was either minimal
or nonexistent. Although it is well-documented that the typical motivation
of phone-system hackers is curiosity and the desire to master complex
systems (see, e.g., HACKERS: HEROES OF THE COMPUTER REVOLUTION, Steven
Levy, 1984), the prosecution attempts to characterize the crackers as major
criminals, and misrepresents facts in doing so.
Examples of such misrepresentation include:
1) Misrepresenting the E911 file.
The E911 file, an administrative document, was copied by Robert Riggs and
eventually published by Craig Neidorf in the electronic magazine PHRACK.
Says the prosecution: "This file, which is the subject of the Chicago
[Craig Neidorf] indictment, is noteworthy because it contains the program
for the emergency 911 dialing system. As the Court knows, any damage to
that very sensitive system could result in a dangerous breakdown in police,
fire, and ambulance services. The evidence indicates that Riggs stole the
E911 program from BellSouth's centralized automation system (i.e., free run
of the system). Bob Kibler of BellSouth Security estimates the value of the
E911 file, based on R&D costs, is $24,639.05."
This statement by prosecutors is clearly false. Defense witnesses in the
Neidorf case were prepared to testify that the E911 document was not a
program, that it could not be used to disrupt 911 service, and that the
same information could be ordered from Bell South at a cost of less than
$20. Under cross-examination, the prosecution's own witness admitted that
the information in the E911 file was available in public documents, that
the notice placed on the document stating that it was proprietary was
placed on all Bell South documents (without any prior review to determine
whether the notice was proper), and that the document did not pose a danger
to the functioning of the 911 system.
2) Guilt by association.
The prosecution begins its memorandum by detailing two crimes: 1) a plot
to plant "logic bombs" that would disrupt phone service in several states,
and 2) a prank involving the rerouting of calls from a probation office in
Florida to "a New York Dial-A-Porn number."
Only after going to some length describing these two crimes does the
prosecution state, in passing, that *the defendants were not implicated in
these crimes.*
3) Misrepresentation of motives.
As we noted above, it has been documented that young phone-system hackers
are typically motivated by the desire to understand and master large
systems, not to inflict harm or to enrich themselves materially. Although
the prosecution concedes that "[defendants claimed that they never
personally profited from their hacking activities, with the exception of
getting unauthorized long distance and data network service," the
prosecutors nevertheless characterize the hackers' motives as similar to
those of extortionists: "Their main motivation [was to] obtain power
through information and intimidation." The prosecutors add that "In
essence, stolen information equalled power, and by that definition, all
three defendants were becoming frighteningly powerful."
The prosecution goes to great lengths describing the crimes the defendants
*could* have committed with the kind of knowledge they had gathered. The
prosecution does not mention, however, that the mere possession of
*dangerous* (and non-proprietary) information is not a crime, nor does it
admit, explicitly, that the defendants never conspired to cause such damage
to the phone system.
Elsewhere in the memorandum, the prosecution attempts to suggest the
defendants' responsibility in another person's crime. Because the
defendants "freely and recklessly disseminated access information they had
stolen," says the memorandum, a 15-year-old hacker committed $10,000 in
electronic theft. Even though the prosecution does not say the defendants
intended to facilitate that 15-year-old's alleged theft, the memorandum
seeks to implicate the defendants in that theft.
4) Failure to acknowledge the outcome of the Craig Neidorf case.
In evaluating defendants' cooperation in the prosecution of Craig Neidorf,
the college student who was prosecuted for his publication of the E911
text file in an electronic newsletter, the government singles out Riggs as
being less helpful than the other two defendants, and recommends less
leniency because of this. Says the memorandum: "The testimony was somewhat
helpful, though the prosecutors felt defendant Riggs was holding back and
not being as open as he had been in the earlier meeting." The memorandum
fails to mention, however, that Riggs's testimony tended to support
Neidorf's defense that he had never conspired with Riggs to engage in the
interstate transportation of stolen property or that the case against
Neidorf was dropped. Riggs's failure to implicate Neidorf in a crime he did
not commit appears to have been taken by prosecutors as a lack of
cooperation, even though Riggs was simply telling the truth.
Sending a Message to Hackers?
Perhaps the most egregious aspect of the government's memorandum is the
argument that Riggs, Grant, and Darden should be imprisoned, not for what
*they* have done, but send the right "message to the hacking community."
The government focuses on the case of Robert J. Morris Jr., the
computer-science graduate student who was sentenced to a term of probation
in May of this year for his reckless release of the worm program that
disrupted many computers connected to the Internet. Urging the court to
imprison the three defendants, the government remarked that "hackers and
computer experts recall general hacker jubilation when the judge imposed a
probated sentence. Clearly, the sentence had little effect on defendants
Grant, Riggs, and Darden."
The government's criticism is particularly unfair in light of the fact
that the Morris sentencing took place almost a year *after* the activities
leading to the defendants' convictions! (To have been deterred by the
Morris sentencing the Atlanta defendants would have to have been able to
foretell the future.)
The memorandum raises other questions besides those of the prosecutors'
biased presentation of the facts. The most significant of these is the
government's uncritical acceptance of BellSouth's statement of the damage
the defendants did to its computer system. The memorandum states that "In
all, [the defendants] stole approximately $233,880 worth of
logins/passwords and connect addresses (i.e., access information) from
BellSouth. BellSouth spend approximately $1.5 million in identifying the
intruders into their system and has since then spent roughly $3 million
more to further secure their network."
It is unclear how these figures were derived. The stated cost of the
passwords is highly questionable: What is the dollar value of a password?
What is the dollar cost of replacing a password?
And it's similarly unclear that the defendants caused BellSouth to spend
$4.5 million more than they normally would have spent in a similar period
to identify intruders and secure their network. Although the government's
memorandum states that "[t]he defendants ... have literally caused
BellSouth millions of dollars in expenses by their actions," the actual
facts as presented in the memorandum suggest that BellSouth had *already
embarked upon the expenditure of millions of dollars* before it had heard
anything about the crimes the defendants ultimately were alleged to have
committed. Moreover, if the network was insecure to begin with, wouldn't
BellSouth have had to spend money to secure it regardless of whether the
security flaws were exploited by defendants?
The Neidorf case provides an instructive example of what happens when
prosecutors fail to question the valuations a telephone company puts on its
damages. But the example may not have been sufficiently instructive for the
federal prosecutors in Atlanta.
Not only are there questions about the justice of the restitution
requirement in the sentencing of Riggs, Darden, and Grant, but there also
are Constitutional issues raised by the prohibition of access to computers.
The Court's sentencing suggests a belief that anything the defendants do
with computers is likely to be illegal; it ignores the fact that computers
are a communications medium, and that the prohibition goes beyond
preventing future crimes by the defendants--it treads upon their rights to
engage in lawful speech and association.
EFF does not support the proposition that computer intrusion and
long-distance theft should go unpunished. But we find highly disturbing the
misrepresentations of facts in the prosecutors' sentencing memorandum as
they seek disproportionate sentences for Riggs, Darden, and Grant--stiff
sentences that supposedly will "send a message" to the hackers and
crackers.
The message this memorandum really sends is that the government's
presentation of the facts of this case has been been heavily biased by its
eagerness to appear to be deterring future computer crime.
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
From: The Advocate / return deleted
Subject: Some Thoughts on the Atlanta Sentencing
Date: Tue, 11 Dec 90 15:37:23 -0500
********************************************************************
*** CuD #2.17: File 4 of 7: Thoughts on the Atlanta Sentencing ***
********************************************************************
I find the statement in the sentencing memo "these three had acquired
tremendous information, enough to become frighteningly powerful" to be the
key to the governments prosecution.
The governemnt has always feared those who have gained power outside of the
channels of normal authority, and sought to destroy all those who have
gained this power.
The FBI sought to destroy King and the SCLC, not because he was a bad man,
but because he threatened the status quo. The Black Panthers threatened
the status quo and they were destroyed. Read the history of organized
labor. Every initial unionization attempt was met with violence and legal
assault, until the unions became part of the establishment. Jesus was
crucified because he threatened the order.
Now hackers have started to seize information and power. That power is a
potential force for good or evil. That power could shake the world as they
know it. So now all forces of law enforcement have begun to turn on those
who may threaten the order.
I would recommend that all those who wish to hack, listen to "Ruby, an
intergalactic gumshoe". It's a radio drama from the people who did the
"fourth tower of Inverness"(best guess). There there is an organization
called the digital circus, who build wrestling robots. THey wrestle
against the rulers machines. They never win, but always come a little
closer before throwing the match.
I would suggest that the sentencing memo serve as a warning to all other
hackers.
SQUEALERS NEVER PROSPER.........
John Doe the indiana stool pigeon, got for his troubles,
a search warrant and indictment.
The atlanta three got for their guilty plea and cooperation
about 8 years and $250,000 in punishment.
I have been around criminal lawyers and investigators, for the better part
of my life. I cannot suggest any case where cooperation brings help. Now
all of them are also vulnerable on civil charges.
Had they all sat odwn, said prove the case and fought it out, they would
have done no worse. and probably could have demolished the case with Dr
Dennings testimony. But no, they squealed. Someone ought to slap around
their attorneys.
Craig Neidorf had it right with sheldon zenner. Fight all the way.
Don't fight the good fight. Fight with every drop of blood you have.
Fight constitutionality. fight civilly. fight in the press. fight in the
legislature.
If you are indicted, use your rights. Subpoena every document of the
firms opposing you. They claim billions in damages, subpoena all their
operating records. get their expense records of top officials. Use your
subpoena rights to find dirt on their witnesses. It's there, you just
have to look for it.
IF there is going to be a computer underground, then it's going to have to
learn how to fight and win in the courts and legislatures and public
opinion. that means controlling our excesses. learning how to measure
performance, and developing ethics.
Ethics. The Dark adept wrote about these. Why break into yet another TSO
machine? Don't damage data. Learn to respect privacy rights. IF you find
a security bug, publish it, but learn how to offer your services to fix
these. Learn to realize that trespassing via computer is no different then
trespass by foot. Create playlands. The LOTS machine at stanford provided
many a safe outlet. Get these machines going at the larger colleges. Why
can't their still be LOTS?
Learn to realize limits, as well. well best of luck for those of you out
there.
I remain, The Advocate.
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
Subject: Earning your Stripes
From: Silver Surfer
Date: Tue, 11 Dec 90 07:06 EDT
********************************************************************
*** CuD #2.17: File 5 of 7: Earning your Stripes ***
********************************************************************
In an article by Katie Hafner entitled "Morris Code", she describes a long
standing tradition that computer security experts have earned their stripes
by defeating the computer's barriers. But now instead of earning pin
stripes, hackers are earning their prison stripes for defeating computer's
barriers. What has happened to change the norms and values in the computer
world in the last 10 to 15 years?
Now it is a crime to pursue forbidden unlawful computer knowledge. Just
recently the "Atlanta Three" (Robert Riggs, Adam Grant and Franklin Darden)
have been sentenced to prison terms for breaking into the BellSouth
computer systems. It is stated by the government that these individuals
have a vast knowledge concerning computer and telecommunication services.
So with this aptitude they are being sent to prison where they might learn
a lesson. What lesson might they learn, I do not know. It is hard to
believe that the government would not impose a fine on them and community
service similar to what Morris received (but then again I bet none of their
fathers are at the NSA..or could afford the lawyers Morris's family
provided their son).
I think the "Atlanta Three" should be viewed as technological clepto
maniacs. They would pursue information and knowledge even though they knew
the means were illegal. You could say that their value system of right and
wrong was skewed. But is this a reason to imprison these young men? Their
critics site the millions of dollars lost (just like the thousands of
dollars for the 911 manuscript ....it's revised net value is under $20 now)
and the threat to life they could have caused through network disruption.
The key words are COULD HAVE CAUSED. They never actually caused loss of
life or injury to anyone. If that was the case, I would drive them to
prison myself.
So the federal government has issued a message to hackers and phreaks, that
the only stripes you can earn now are prison stripes.
********************************************************************
>> END OF THIS FILE <<
***************************************************************************
------------------------------
From: Silicon Surfer /
Return to The Skeptic Tank's main Index page.
The views and opinions stated within this web page are those of the
author or authors which wrote them and may not reflect the views and
opinions of the ISP or account user which hosts the web page. The
opinions may or may not be those of the Chairman of The Skeptic Tank.