NetNews Usenet Archive 1992 #31/NN_1992_31.iso/spool/misc/legal/computin/2411

Text File | 1993-01-01 | 5.7 KB | 138 lines

Newsgroups: misc.legal.computing
Path: sparky!uunet!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!gatech!concert!unccsun.uncc.edu!rrb-mac.uncc.edu!rrb
From: Bob Blackmun <[e-mail]>
Subject: Re: Player rights on MUDs
Message-ID: <[e-mail]>
X-Xxmessage-Id: <[e-mail]>
X-Xxdate: Thu, 31 Dec 92 15:24:28 GMT
Sender: [e-mail]
Nntp-Posting-Host: rrb-mac.uncc.edu
Organization: UNC Charlotte
X-Useragent: Nuntius v1.1.1d14
References: <[e-mail]>
Date: Thu, 31 Dec 1992 20:21:55 GMT
Lines: 122

As some of you probably already know, the issue of notification to users
has been discussed at some length as a result of the following that was
sent out and later posted:

| From [e-mail] Mon Dec 7 14:38:57 1992
| From: CERT Advisory <[e-mail]> | Date: Mon, 7 Dec
92 14:16:56 EST
| To: [e-mail]
| Subject: CERT Advisory - Keystroke Logging Banner
| Organization: Computer Emergency Response Team : 412-268-7090 |
|
| CA-92:19    CERT Advisory
|    December 7, 1992
|    Keystroke Logging Banner
|
|
-----------------------------------------------------------------------
-----
|
| The CERT Coordination Center has received information from the United
States
| Department of Justice, General Litigation and Legal Advice Section,
Criminal
| Division, regarding keystroke monitoring by computer systems
administrators,
| as a method of protecting computer systems from unauthorized access.
|

| The information that follows is based on the Justice Department's
advice
| to all federal agencies. CERT strongly suggests adding a notice banner
| such as the one included below to all systems. Sites not covered by U.S.
| law should consult their legal counsel.
|
|
-----------------------------------------------------------------------
-----
|
|    The legality of such monitoring is governed by 18 U.S.C. section 2510
|    et seq. That statute was last amended in 1986, years before the words
|    "virus" and "worm" became part of our everyday vocabulary. Therefore,
|    not surprisingly, the statute does not directly address the propriety
|    of keystroke monitoring by system administrators.
|
|    Attorneys for the Department have engaged in a review of the statute
|    and its legislative history. We believe that such keystroke monitoring
|    of intruders may be defensible under the statute. However, the statute
|    does not expressly authorize such monitoring. Moreover, no court has
|    yet had an opportunity to rule on this issue. If the courts were to
|    decide that such monitoring is improper, it would potentially give rise
|    to both criminal and civil liability for system administrators.
|    Therefore, absent clear guidance from the courts, we believe it is
|    advisable for system administrators who will be engaged in such
|    monitoring to give notice to those who would be subject to monitoring
|    that, by using the system, they are expressly consenting to such
|    monitoring. Since it is important that unauthorized intruders be given
|    notice, some form of banner notice at the time of signing on to the
|    system is required. Simply providing written notice in advance to only
|    authorized users will not be sufficient to place outside hackers on
|    notice.
|
|    An agency's banner should give clear and unequivocal notice to
|    intruders that by signing onto the system they are expressly consenting
|    to such monitoring. The banner should also indicate to authorized
|    users that they may be monitored during the effort to monitor the
|    intruder (e.g., if a hacker is downloading a user's file, keystroke
|    monitoring will intercept both the hacker's download command and the
|    authorized user's file). We also understand that system administrators
|    may in some cases monitor authorized users in the course of routine
|    system maintenance. If this is the case, the banner should indicate
|    this fact. An example of an appropriate banner might be as follows:
|
|
|
|    This system is for the use of authorized users only.
|    Individuals using this computer system without authority, or in
|    excess of their authority, are subject to having all of their
|    activities on this system monitored and recorded by system
|    personnel.
|
|    In the course of monitoring individuals improperly using this
|    system, or in the course of system maintenance, the activities
|    of authorized users may also be monitored.
|
|    Anyone using this system expressly consents to such monitoring
|    and is advised that if such monitoring reveals possible
|    evidence of criminal activity, system personnel may provide the
|    evidence of such monitoring to law enforcement officials.
|
|
|
|
-----------------------------------------------------------------------
-----
| Each site using this suggested banner should tailor it to their precise
| needs. Any questions should be directed to your organization's legal
| counsel.
|
|
-----------------------------------------------------------------------
-----
| The CERT Coordination Center wishes to thank Robert S. Mueller, III,
| Scott Charney and Marty Stansell-Gamm from the United States Department
| of Justice for their help in preparing this Advisory.
|
|
-----------------------------------------------------------------------
-----
| If you believe that your system has been compromised, contact the CERT
| Coordination Center or your representative in FIRST (Forum of Incident
| Response and Security Teams).
|
| Internet E-mail: [e-mail]
| Telephone: [phone] (24-hour hotline)
|    CERT personnel answer 7:30 a.m.-6:00 p.m. EST(GMT-5)/EDT(GMT-4),
|    on call for emergencies during other hours.
|
| CERT Coordination Center
| Software Engineering Institute
| Carnegie Mellon University
| Pittsburgh, PA 15213-3890
|