Computer Underground Digest Volume 3, Issue #3.19 (June 4, 1991)

**************************************************************************** >C O M P U T E R U N D E R G R O U N D< >D I G E S T< *** Volume 3, Issue #3.19 (June 4, 1991) ** **************************************************************************** MODERATORS: Jim Thomas / Gordon Meyer (TK0JUT2@NIU.bitnet) ARCHIVISTS: Bob Krause / / Bob Kusumoto GUINNESS GURU: Brendan Kehoe +++++ +++++ +++++ +++++ +++++ CONTENTS THIS ISSUE: File 1: Moderator's Corner File 2: From the Mailbag File 3: Thrifty-Tel--Victim or Victimizer? File 4: The CU in the News +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ USENET readers can currently receive CuD as alt.society.cu-digest. Back issues are also available on Compuserve (in: DL0 of the IBMBBS sig), PC-EXEC BBS (414-789-4210), and at 1:100/345 for those on FIDOnet. Anonymous ftp sites: (1) ftp.cs.widener.edu (192.55.239.132); (2) cudarch@chsun1.uchicago.edu; (3) dagon.acc.stolaf.edu (130.71.192.18). E-mail server: archive-server@chsun1.uchicago.edu. COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. CuD material may be reprinted as long as the source is cited. Some authors, however, do copyright their material, and those authors should be contacted for reprint permission. It is assumed that non-personal mail to the moderators may be reprinted unless otherwise specified. Readers are encouraged to submit reasoned articles relating to the Computer Underground. Articles are preferred to short responses. Please avoid quoting previous posts unless absolutely necessary. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Contributors assume all responsibility for assuring that articles submitted do not violate copyright protections. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Moderators Subject: Moderator's Corner Date: June 4, 1991 ******************************************************************** *** CuD #3.19: File 1 of 4: Moderators Corner *** ******************************************************************** A few quick notes: A minor malfunction crashed the new FREE SPEECH BBS for a few days. It is back up with a new number: (618) 943-2102 FREE SPEECH is intended to provide a forum similar to the former FACE-TO-FACE BBS for discussion of legal, ethical, technical, and other issues of interest to computer hobbyists. ****** The CUD issues on CompuServe have been shuffled around a bit. Recent issues can be found in DL0 of the IBMBBS SIG and in DL1 of LAWSIG. Back issues can be found in DL4 of the IBMBBS SIG. LAWSIG will one day have all the back issues as well, when I or some other brave soul takes the time to upload them. Cooperation between forums, to the extent of copying the files from IBMBBS to LAWSIG, is apparently not possible. ****** The Electronic Frontier Foundation (EFF) as received tax-exempt status. Pioneer membership rates are $20 a year for students and low-income supporters, and $40 a year for regular members. Send your membership fees and/or additional contributions to: The Electronic Frontier Foundation 155 Second Street Cambridge, MA 02141 ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Ah, sordid Subject: From the Mailbag Date: 3 June, 1991 ******************************************************************** *** CuD #3.19: File 2 of 4: From the Mailbag *** ******************************************************************** From: "76476.337@compuserve.com \"Robert McClenon\" Subject: Rose and Morris Sentences Date: 20 May 91 23:34:49 EDT Here are my thoughts on the Len Rose sentencing. The sentence imposed on Rose should be compared not only to those of others caught in Sun Devil cases, such as Riggs, Darden, and Grant, but to that of Robert Morris Jr. Rose, Riggs, Darden, and Grant were all given disproportionate sentences compared to Morris. Alternatively, Morris was given an absurdly light sentence of community service compared to Rose or Riggs. Rose, Riggs, Darden, and Grant were sent to prison. Morris was given community service. Rose, Riggs, Darden, and Grant were prosecuted for what they are presumed to have been trying to do. They never did material harm. Morris was prosecuted for what he did. It is not established exactly what he was trying to do, but he did substantial actual harm. If Riggs, Darden, and Grant were in fact trying to do what it is alleged that they were trying to do, then they were trying unsuccessfully to do what Morris did (with or without trying): to degrade a network to the point of unavailability. That is the worst explanation of what Riggs and others were trying to do in the E911 case. That is what Morris actually did to the Internet on one dreadful November day. Why were Rose and Riggs dealt with more harshly than Morris? Maybe prosecutors don't understand what the Internet is but they understand what a conventional telephone company is. Conceptually the Internet is a digital telegraph company, not very different from a telephone company. By the way, I don't buy the argument, expressed repeatedly in various digests, that Rose was really only guilty of copyright violations and not of a crime. Look at the FBI warning on any rented videotape. Copyright infringement is a crime, punishable by 5 years in prison. The issue is not whether Rose committed a crime. The issue is equity in sentencing. Rose committed a crime. Riggs committed a crime. Morris committed a crime. The sentences were disproportionate. Maybe Morris got off lightly compared to Riggs because no one knows exactly what Morris's intentions were, while the Legion of Doom talked at interminable length about theirs. I submit that no one really knows what the real intentions of the Legion of Doom were either. Hackers often engage in grandiose talk. Pranksters and vandals often say nothing. Neither talk at length nor the failure to discuss one's motives is necessarily informative. Also, no one knows what Rose's ultimate motives were. Presumably he was planning to capture passwords, but that does not indicate what he planned to do with them. Morris's real motives are unknown. Rose's real motives are unknown. Riggs's real motives are unknown, eclipsed by the wild hacker rhetoric. The difference is that Morris did real harm. Either Morris should have gone to jail or Rose and Riggs should have gotten community service. I think all three should have been fined heavily. They were. I think all three should have been given community service. Morris was. Alternatively, all three should have been jailed. Two were. Morris did real harm. Rose didn't. The disparity isn't fair. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Eric_R_Smith@CUP.PORTAL.COM Subject: Stage.dat, Protections, and FluShotPlus Date: Thu, 23 May 91 17:46:52 PDT One of the problems in the recent controversy about Prodigy's STAGE.DAT file has been that many would-be testers simply didn't have the tools to catch Prodigy red-handed. Instead of all the effort spent re-installing the software on supposedly virgin diskettes and hard disk subdirectories, we can use some readily available software to do a more thorough job. Although there are other pieces of code that will work as well, I chose the virus-guard FluShotPlus as my trapping program. [FluShotPlus may be downloaded from the author, Ross Greenburg's BBS at (212) 889-6438. A commercial version of the program called Virex-PC is available in the usual locations.] FluShotPlus works by watching key ares of your system and then alerting you when a program does not behave according to YOUR rules. Your rules are established in a file called FLUSHOT.DAT placed in you root directory. Another utility in the FSP package will allow you to change the name and location of this file for greater security, but let's stick to the default for purposes of this explanation. Let's also assume that we have installed PRODIGY in C:\PRODIGY. Assuming those conditions, here is a sample FLUSHOT.DAT file that will protect your system and monitor file use. ----------------------- CUT HERE ------------------------------- R=C:\*.* W=C:\*.* E=C:\PRODIGY\CACHE.DAT E=C:\PRODIGY\CONFIG.SM E=C:\PRODIGY\DRIVER.SCR E=C:\PRODIGY\KEYS.TRX E=C:\PRODIGY\LOG_KEYS.TRX E=C:\PRODIGY\MODEMS.TXT E=C:\PRODIGY\MODEMSTR.EXE E=C:\PRODIGY\PRODIGY.EXE E=C:\PRODIGY\PROFILE.DAT E=C:\PRODIGY\STAGE.DAT E=C:\PRODIGY\TLFD0000.* E=C:\PRODIGY\VDIPLP.TTX ----------------------- CUT HERE ------------------------------- The first two lines prohibit all reads and all writes of all files on drive C:. Add more lines to protect files on other drives. The rest of the file are EXCEPTION lines -- exceptions to the two rules we set up in the first two lines. For example, line 3 allows all access to C:\PRODIGY\CACHE.DAT. Any other file access in C:\PRODIGY will provoke a bell-warning from FluShotPlus. With this file situated in the root of C:\, all we need do is fire up FSP. So far, so good. This simple setup should allow most Prodigy users to sleep comfortably. There is one major problem with this setup: FSP does not handle graphics screens. Thus, its warning screen, alerting you to the type of access being requested, and the offending program, remain a mystery to you. I use a frontend to Prodigy called Prod-Util. It allows me to compose messages offline and upload them, and to control the screen dumps more efficiently. It has other features, but those are the only two that I use. No sooner did I have my FluShot.Dat set up than I started a Prodigy session and got a bell-warning. I looked all over the subdir, added to Prod-Util files to the FLUSHOT.DAT list of permitted files and still I got the warning. What to do now? I dug into my code archives and came up with DOSWatch, a demo program that I got from Crescent Software when I purchased their wonderful BASIC add-on library PDQ. This little library allows me to produce the smallest BASIC code around. DOSWatch is similar to the other WATCH programs in the PD: it reports on the activities of the system. Now, usually, DOSWatch reports directly to the screen. But we still had the problem of PRODIGY being a graphics-based app. Rather than recode everything to go into graphics mode, I decided to dump the results of DOSWatch to a disk file. I would not be able to stop PRODIGY from looking at my files, but I would know after the session, which files it had looked at. So I skipped the installation of FluShot in order to let DOSWatch catch Prodigy red-handed. And sure enough, a few seconds into the Prodigy program's load, it opened a file called KEYTRACE.AUT. Innocent enough. Must be a file where they keep track of where I have been in the system during a session. So I sent Prodigy tech support a message, asking what KEYTRACE.AUT did. The message came back that all KEY files are keyboard interfaces. But they were talking about the .KEY files, not KEYTRACE.AUT. So I sent another message asking them to come clean. Tell me what the specific file KEYTRACE.AUT did, and while they were at it, what did the different fields in MODEMS.TXT control? They must have thought I was hacking the system or that something had gone awry, for the next day, I had a call from Prodigy tech support! He said again that the file in question was not one of theirs. Stupid me! I had completely forgotten about little PROD-UTIL, working in the background. Because I had not given it permission to go TSR on me, FluShot had dutifully reported it as a violation of my rules. [By the way, MODEMS.TXT still remains shrouded in mystery. Yes, it is a comma-separated data file, but its contents and their purpose is a trade secret. But it only controls S-Registers and the like. Still a secret.] Why narrate my tale of embarassment? To remind all of us who run fairly complicated setups that we need to eliminate ALL variables and do thorough testing before we go public with accusations of impropriety. If you would like, I can send you a BASIC program that will create the Watch exe file. I have permission from Crescent to distribute my amended version of their code. ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Moderators Subject: Thrifty-Tel--Victim or Victimizer? Date: 1 June, 1991 ******************************************************************** *** CuD #3.19: File 3 of 4: Thrifty-Tel -- Victim or Victimizer?*** ******************************************************************** Thrifty-Tel, an L-D carrier in Southern California seems to have a nice deal going. The following example of one tariff plan (effective July 1990) seems reasonable: Activation Fee (one time fee) = $57 Access Fee (monthly) = $13.18 Flat Rate (monthly) fee = $199 (this allows unlimited calling within the US for the month, but calls over 1,500 minutes, or 25 hours, is billed at $0.14 a minute) This comes to about $2,600 a year. Thrifty-Tel's other programs are comparable to this one. BUT: There is an interesting "unauthorized usage" provision stuck in the section entitled "Miscellaneous Service Features" under "Unauthorized Usage," a rate change filed with the California Public Utility Commission on Jan 25 '91 and effective March 16 '91: _Unauthorized Usage_ Any entity using Thrifty' facilities without securing proper authorization either by: (1) obtaining authorization by way of a prescription agreement; (2) dialing Thrifty's 10xxx FGD access Code; (3) obtaining an authorization code from Thrifty Telephone Exchange is subject to: (1) a $2,880.00 per day, per line surcharge inaddition to the otherwise applicable rates under the "Equal Access Service" plan; (2) a $3,000.00 set-up fee; and (3) a $200.00 per hour labor charge, and (4) payment of all attorney fees and costs incurred by Thrifty in collecting the applicable charges for unauthorized usage. If somebody makes $10 calls on three separate days, does this mean that Thrifty can collect over $10,000? Does anybody have any idea what the "labor costs" are for (they don't seem to be part of any other schedule)? Could a few slow attys work for 100 hours at $250/hr? Is this a subtle form of blackmail? "Pay us and we won't press criminal charges!" John Higdon, who brought Thrifty's policy to the attention of the nets in a post in Telecom Digest over Memorial Day weekend, appeared on KFI radio in Los Angeles with Thrifty-Tel executive Rebecca Bigeley, who he described as "a woman with a cause and a gigantic ego." Judging from his description of the broadcast (see Telecom Digest, V 11, #408, 29 May, '91), she was slick, glib, and rather cavalier about defending Thrifty-Tel's use of near-obsolete hacker-friendly equipment. John summed up the KFI dialogue with Rebeca Bigeley as less than satisfying: "Her moral crusade tone created an atmosphere that cuased any reason to be introduced into the dicussion to appear as being soft on criminal activity." To her it was very simple: If these people don't want their lives ruined then they should not tamper with her (very vulnerable) system." Thrifty's address is: Thrifty Telephone Exchange 300 Plaza Alicante, Suite 380 Garden Grove, CA 92640 (714-740-2880) ******************************************************************** >> END OF THIS FILE << *************************************************************************** ------------------------------ From: Various Subject: The CU in the News Date: 4 June, 1991 ******************************************************************** *** CuD #3.19: File 4 of 4: Moderators Corner *** ******************************************************************** From: Silicon.Surfer@unixville.edu Subject: Dutch Crackers as opposed to Graham Crackers Date: Mon, 6 May 91 22:16 EDT Internet Break-Ins Dutch Cracker Easily Accessed U.S. Computers By Mitch Wagner Unix Today, April 29, 1991 Allegations that Dutch crackers have been operating with impunity for months against U.S. computers has stirred a debate whether systems administrators have been negligent in failing to close easy, obvious security holes that have been well-known for years. Dutch crackers have, since September, been using the Internet to access computers, most of them Unix machines, at the Kennedy Space Center, the Pentagon's Pacific meet Command, the Lawrence Livermore National laboratories and Stanford University. The techniques they've used have been simple, well-known and uncreative, and they've found the job an easy one, say sources. "These are not skilled computer geniuses like Robert Morris," said Cliff Stoll, author of The Cuckoo's Egg, who said he's been in contact with some Dutch crackers who may have committed the break-ins. "These are more like the kind of hacker I caught, sort of plodding, boring people." Stoll's 1989 book concerned his pursuit of a cracker. Techniques include guessing at commonly used passwords, default passwords that ship with Unix systems and that some users don't bother to change, and using guest accounts, said Stoll. The crackers managed to obtain superuser privileges at a system at Stanford University, said Bill Bauridel, information security officer at Stanford University Data Center. They used a bug in sendmail - the same program exploited by Robert Morris to loose a worm on the Internet in 1988, though Bauridel said the crackers did not use the sendmail feature that Morris exploited. The Lawrence Livermore Laboratories computers were only used as a gateway to other systems, said Bob Borchers, associate director for computation at the labs. The crackers have been able to access only non-classified material, such as routine memos say authorities. So far, no evidence has been found that they did anything malicious once they broke into a U.S. site. The lack of laws governing computer crime in Holland allows crackers to operate with relative impunity, said Martin de Lange, managing director of ACE, and Amsterdam-based Unix systems software company. The impunity combines with an anti-authoritarian atmosphere in Holland to make cracking a thriving practice, said Stoll. "There's a national sense of thumbing one's nose at the Establishment that's promoted and appreciated in the Netherlands," he said. "Walk down the streets of Amsterdam and you'll find a thriving population that delights in finding ways around the Establishment's walls and barriers." The break-ins became a subject of notoriety after a Dutch television show called After the News ran film Feb. 2 purporting to be of an actual cracker break-in, said Henk Bekket, a network manager at Utrecht University. Utrecht University in Holland was reported to be the first site broken into. Bekker said he was able to detect two break-ins, one in October and one again in January. The crackers apparently dialed into a campus terminal network that operates without a password, accessed the campus TCP/IP backbone, and then accessed another machine on campus-a VAX 11/75-that hooks up to SURFnet, a national X.25 network in Holland. >From SURFnet, they were presumably able to crack into an Inter-net computer somewhere, and from there access the computers in the United States, said Bekker. The dial-in to SURFnet gateway has been canceled since the January attempt, he said. (Presumably, the break-in footage aired Feb. 2 was either through another channel, or filmed earlier.) Bekker said he manages a network consisting of a DECsystem 5500 server and 40 to 50 Sun and VAX VMS workstations. He noted a break-in to another machine on campus Jan. 16, and into a machine at the University of Leyden in October. A cracker was searching DECnet I password files for accounts with no password. The cracker was also breaking into machines over DECnet, said Bekker. The cracker had a rough idea of the pattern of DECnet node addresses in Holland, and was trying to guess machine addresses from there. Node addresses begin with the numerals 28, said Bekker, and he found log files of the cracker searching for machines at 28.1, 28.2, 28.3 and so on. But the cracker did not know that the actual sequence goes 28.100, 28.110, and so on. "Hackers are organized to get together, discuss technologies, and they openly demonstrate where there are installations prone to break-in," de Lange said. Computer crime in Holland can be prosecuted under laws covering theft of resources, wiretapping and wire fraud, said Piet Beertema, of the European Unix User Group, and network manager of the Center for Mathematics and Computer Science in Amsterdam. And finding someone to investigate can also be a problem, said Bekker. "You cannot go to the police and say, 'Hey, someone has broken into my computer.' They can't do anything about it," he said. Stoll, the American author, said crackers appear firmly rooted in Dutch soil. "There is a history going back more than five years of people getting together and breaking into computers over there," he said. "Hacker clubs have been active there since 1985 or 1986." But he said it's more than lack of law that has made cracking so popular. Most industrialized nations have no cracking laws, and those that have them find prosecution extremely difficult, he said. Dutch citizens also have an anti-authoritarian spirit, he added. But Stoll condemmed the crackers. "This is the sort of behavior that wrecks the community, spreads paranoia and mistrust," he said. "It brings a sense of paranoia to a community which is founded on trust." Because no classified data was accessed, Mike Godwin, attorney for the Electronic Frontiers Foundation (EFF), cautioned against making too much of the incidents. "What did these people do" he said. "There's no sense that they vandalized systems or got ahold of any classified information." The itself as an organization fighting to see civil rights guarantees extended to information systems. The Cambridge, Mass., organization has been involved in a number of cracker defenses. The fact that the systems were breached means the data's integrity is compromised, said Netunann. just because the data isn't classified doesn't mean it isn't important, he noted. 'Just because you can't get into classified systems doesn't mean you can't get sensitive information," he said. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Brendan Kehoe Subject: Long-haul Carriers May Offer Toll-Fraud Monitoring Date: Wed, 1 May 91 22:50:31 -0400 "Long-haul carriers may offer toll-fraud monitoring: Services would help shield customers from hackers" by Anita Taff, Washington Bureau Chief WASHINGTON D.C. -- Long-distance carriers are considering offering services that would shield customers from toll fraud by monitoring network activity for suspicious traffic patterns and tipping off users before huge costs would be run up, Network World has learned. Hackers are defrauding corporations by dialing into their private branch exchanges and using stolen authorization codes to dial out of the switches to remote destinations, sticking the switch owners with charges ranging from several thousand to, in one case, a million dollars. Users have been loathe to report toll fraud because they are embarrassed about the security breaches or because they have entered into private settlements with carriers that cannot be disclosed. But earlier this year, Pacific Mutual Life Insurance Co., exasperated by $200,000 in fraudulent charges run up during one weekend and lack of progress in settling the issue with AT&T, turned to the Federal Communications Commission for help. The insurance company asked the FCC to open a proceeding in order to establish guidelines that fairly distribute liability for toll fraud among users, long distance carriers and customer premises equipment manufacturers. The company questioned the validity of AT&T's claims that its tarriffs place the liability for fraud on users' shoulders. Both AT&T and MCI Communications Corp. oppose Pacific Mutual's position. But it is clear something has to be done. Customers lose $500 million annually to toll fraud, according to the Communications Fraud Control Association. "There are two kinds of customers: those who have been victims of toll fraud and those who are about to [become victims]," said Jim Snyder, staff member of the systems integrity department at MCI. According to Snyder, about 80% of the calls placed by hackers go to one of three places: Columbia, Pakistan and area code 809, which covers Caribbean countries including the Dominican Republic and Jamaica. Often, the calls are placed at night or during weekends. It is this thumbprint that would enable carriers to set up monitoring services to identify unusual activity. He said MCI is considering such a service but has not yet decided whether to offer it. AT&T would also be interested in rolling out such a monitoring service if customer demand exists, a spokesman said. Henry Levine, a telecommunications attorney in Washington, D.C. who helps customers put together Tariff 12 deals, said he knows of several users that have requested toll-fraud monitoring from AT&T. He said AT&T is currently beta-testing technology that gives users real-time access to call detail data, a necessary capability for real-time monitoring. US Sprint Communications Co. offers a monitoring service for its 800, UltraWATS, Virtual Private Network, SprintNet and voice mail customers free of charge, but it is not a daily, around-the-clock monitoring service, and the typical lag time until user are notified of problems is 24 hours. In a filing on behalf of the Securities Industry Association, Visa USA, Inc., the New York Clearinghouse Association and Pacific Mutual, Levine urged the agency to require carriers to offer monitoring services. Network equipment could monitor traffic according to preset parameters for call volume, off-hour calling and suspicious area or country codes, he said. If an anomaly is detected, Levine's proposal suggests that carriers notify users within 30 minutes. Therefore, users would be held liable for only a nominal amount of fraudulent charges. Network World, April 29, 1991 [Volume 8 Number 17]. [161 Worcester Road, Framingham, MA. 01701 508/875-6400 MCI-Mail:390-4868] +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: edtjda@MAGIC322.CHRON.COM(Joe Abernathy) Steve Jackson Games story from Houston Chronicle Date: Thu, 16 May 91 16:40:28 CDT Lawsuit alleges rights violations in computer crime crackdown By JOE ABERNATHY Copyright 1991, Houston Chronicle An Austin game publisher has sued the U.S. Secret Service for alleged civil rights violations in connection with a nationwide crackdown on computer crime. Steve Jackson Games, whose case has become a cause celebre in the computer network community, alleges in the lawsuit that a raid conducted during OperationSun Devil violated the rights of the company and its customers to free speech, free association, and a free press. The lawsuit in federal district court in Austin further claims the raid was a violation of the protection against unreasonable search and seizure, and violated the law restricting the government from searching the office of publishers for work products and other documents. It seeks unspecified damages. "This is a lawsuit brought to establish the statutory rights of businesses and individuals who use computers," said Jackson's attorney, Sharon Beckman of Boston. "It's about the First Amendment, it's about the right to privacy, and it's about unreasonable government intrusion." Defendants include the Secret Service; Assistant United States Attorney William J. Cook in Chicago; Secret Service agents Timothy M. Foley and Barbara Golden; and Henry M. Kluepfel of Bellcore, a telephone company research consortium which assisted the agency in its investigation. Earl Devaney, special agent in charge of the Secret Service fraud division, said that his agency was barred from responding to the allegations contained in the lawsuit. "Our side of the story can't be told because we're compelled by the laws that govern us to remain mute," he said. "We'll have to let the future indictments, if there are any, and the future trials speak for themselves." Devaney said the agency recently completed its review of evidence seized during Operation Sun Devil and has sent it to federal prosecutors. He couldn't predict how many indictments will result. The Electronic Frontier Foundation, founded by computer industry activists after questions arose regarding the legality of several Sun Devil raids, is paying Jackson's legal fees. James R. George, an Austin attorney with expertise in constitutional law, represents Jackson in Texas. Contending that civil rights normally taken for granted are often denied to users of computer networks and bulletin boards, the EFF attorneys designed Jackson's case as a test of how courts will treat these issues. "What happened was so clearly wrong," Beckman said. "Here we have a completely innocent businessman, a publisher no less, whose publications are seized, whose computers are seized, whose private electronic mail is seized, and all for no good reason." Jackson's firm was raided on March 1, 1990, along with 27 other homes and businesses across the nation. The Secret Service confiscated dozens of computers and tens of thousands of computer data disks in the raids. After several months passed with no charges being filed, the agency came under increasing fire for Sun Devil. "They raided the office with no cause, confiscated equipment and data, and seriously delayed the publication of one big book by confiscating every current copy," Jackson said. "It very nearly put us out of business, and we are still extremely shaky." Seven months after the raid on Jackson's firm, the search warrant was unsealed, revealing that the firm was not even suspected of wrongdoing. An employee was suspected of using a company bulletin board system to distribute a document stolen from the telephone company. Bulletin board systems, called BBSs in computer jargon, allow people with common interests to share information using computers linked by telephone. Jackson's bulletin board, Illuminati, was used to provide product support for his games - which are played with dice, not computers. Beckman said the search warrant affidavit indicates investigators thought the phone company document was stored on a bulletin board at the employee's home, and therefore agents had no reason to search the business. "Computers or no computers, the government had no justification to walk through that door," she said. Beckman said that by seizing the BBS at Steve Jackson Games, the Secret Service had denied customers the right to association. "This board was not only a forum for discussion, it was a forum for a virtual community of people with a common interest in the gaming field," she said. "Especially for some people who live in a remote location, this forum was particularly important, and the Secret Service shut that down." Jackson was joined in the lawsuit by three New Hampshire residents, Elizabeth McCoy, Walter Milliken and Steffan O'Sullivan, who used the Illuminati BBS. "Another right is privacy," Beckman said. "When the government seized the Illuminati board, they also seized all of the private electronic mail that (callers) had stored. There is nothing in the warrant to suggest there was reason to think there was evidence of criminal activity in the electronic mail - the warrant doesn't even state that there was e-mail." "That, we allege, is a gross violation of the Electronic Communications Privacy Act," Beckman said. Mitchell D. Kapor, creator of the popular Lotus spreadsheet program and co-founder of the Electronic Frontier Foundation, said: "The EFF believes that it is vital that government, private entities, and individuals who have violated the Constitutional rights of individuals be held accountable for their actions. We also hope this case will help demystify the world of computer users to the general public and inform them about the potential of computer communities." +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Subject: More info on a past article Date: Sat, 1 Jun 91 08:27 EDT Court Tosses Inslaw Appeal By Gary H. Anthes Computerworld May 13, 1991 Washington, D.C.- A three-judge panel of the US Court of Appeals throw out two lower court rulings last week that said the US Department of Justice had stolen software from Inslaw, Inc. and had conspired to drive the firm out of business. The Court of Appeals for the Washington, D.C., circuit did not consider the validity of the lower court findings but said the bankruptcy court that first upheld Inslaw's charges had exceeded its authority. This is a serious setback for Inslaw, which said it has spent five years and $6 million in legal fees on the matter, but the company vowed to fight on. It may ask the full court to reconsider, it may appeal to the US Supreme Court, or it may go to more specialized tribunals set up by the government to hear disputes over contracts, trade secrets, and copyrights, Inslaw President William Hamilton said. "Not many firms could have lasted this long, and now to have this happen is just unbelievable. But there's no way in hell we will put up with it," an obviously embittered Hamilton said. It may cost the tiny firm "millions more" to reach the next major legal milestone, he said. Double Trouble Since the bankruptcy court trial in 1987, Inslaw has learned of additional alleged wrongdoings by the Justice Department. "The new evidence indicates that the motive of the [software theft] was to put Inslaw's software in the hands of private sector friends of the Reagan/Bush administration and then to award lucrative government contracts to those political supporters," Hamiliton said. He said that other evidence suggests that the software was illegally sold to foreign intelligence agencies. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Silicon.Surfer@unixville.edu Subject: Time to Copyright Underground Material Date: Sat, 1 Jun 91 07:32 EDT The following article was interesting to read for many reasons but most importantly about the database on the computer underground. I wonder if they will also act as a "unofficial" archive site for issues of Phrack, LoD, CuD, etc. If this is the case, then it might not be a good idea anymore to provide information to the Internet sites unless it could be copyrighted. Because on most of the PC BBS's you must state that you are a non-security and law enforcement type to gain access. Just a thought. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Systems Security Tips Go On-Line By Michael Alexander Computerworld May 13, 1991 Farifax, Va.-- Information systems security managers, electronic data processing auditors and others involved in systems protection know that it can often be difficult to keep on top of security technology and fast-breaking news. This week, National Security Associates, Inc., will officially kick off an on-line service dedicated solely to computer security. The repository contains databases of such articles on computer security that have appeared in 260 publications, computer security incident reports and vendor security products. One database is devoted to activity in the computer underground and to techniques used to compromise systems security. "This is a tough industry to keep up with," said Dennis Flanders, a communications engineer with computer security responsibilities at Boing Co. Flanders has been an alpha tester of National Security Associates' systems for about six months. "Security information is now being done piecemeal, and you have to go to many sources for information. The appealing thing about this is [that] all of the information is in one place." The service costs $12.50 per hour. There is a onetime sign-up charge of $30, which includes $15 worth of access time. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ From: Anonymous Subject: Justice Dept as Pirates: More Inslaw News Date: Tue, 2 June 91 21:19:28 PDT Source: "Software Pirates," IN THESE TIMES (May 29-June 11, 1991, pp 11-13). Author: Joel Bleifuss. I found the following article in the latest In These Times. It's lengthy, so readers can obtain a copy from their newstands. The author summarizes Inslaw Corp.'s case against the U.S. Department of Justice, which it charges robbed it of its program, conspired to send the company into bankruptcy, and then initiated a cover-up. "In 1987, Judge George Bason, the federal bankruptcy judge for Washington, D.C., ruled that 'the Department of Justice took, convereted, stole' the Inslaw software "by trickery, fraud and deceit." The case is still in the courts." The author links the Inslaw case to the 1980 arms-for-hostages allegations of the Bush-Reagan campaign and suggests that foreign intrigue is the root of the matter. After a lengthy description of the case, which has been summarized elsewhere so I won't repeat it, the author concludes: "The St. Louis Post-Dispatch, which has assigned reported Phil Linsalata to cover the alleged Inslaw and 1980 scandals, ahs called for a congressional inquiry to 'alert the public to the pervasiveness of underground government, both legal and illegal.' As the May 13 editorial put it, 'If a subterranean network of operatives (like that exposed in the Iran-contra investigation) still exists, carrying out secret government policies, the very survival of a democratic political system based on law requires that it be exposed to the light. (The Inslaw case) may reveal pat of an illegal policy that was put in place even before the Regan administration had taken office. That is why Congress must try to find out the truth behind (allegations that the 1980 Reagan-Bush campaign arranged a secret arms-for-hostages deal with Iran).' Only when these allegations are brought to light can justice be served.'" ******************************************************************** ------------------------------ **END OF CuD #3.19** ********************************************************************