Play and Learn 2/19941.ZIP/19941/PUBE/CUD326.TXT

Text File | 1994-02-05 | 40.2 KB | 792 lines

Computer Underground Digest--Thu Jul 18 17:22:30 CDT 1991 (Vol #3.26)

         Moderators: Jim Thomas and Gordon Meyer ([e-mail])

Contents of Issue 3.26, July 27, 1991:

File 1:          Moderators' Corner
File 2:          The Vajk-Spaf-Leichter dialogue continues......
File 3:          The TERMINUS of Len Rose
File 4:          "Computer Crime" paper by Brian Peretti available
File 5:          Doc Savage Sentenced (NEWSBYTES Reprint)
File 6:          CompuServe Responds to Policy and Operations Questions

Administratia:

           ARCHIVISTS: ROB KRAUSE, BOB KUSUMOTO, AND BRENDAN KEHOE

CuD is available via electronic mail at no cost. Printed copies are
available by subscription.  Single copies are available for the costs
of reproduction and mailing.

Issues of CuD can be found in the Usenet alt.society.cu-digest news
group, on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG,
and DL0 and DL12 of TELECOM, by FidoNet file request from 1:100/345,
on Genie, on the PC-EXEC BBS at [phone], and by anonymous ftp
from ftp.cs.widener.edu, chsun1.uchicago.edu, and
dagon.acc.stolaf.edu.  To use the U. of Chicago email server, send
mail with the subject "help" (without the quotes) to
[e-mail].

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted as long as the source
is cited.  Some authors do copyright their material, and they should
be contacted for reprint permission.  It is assumed that non-personal
mail to the moderators may be reprinted unless otherwise specified.
Readers are encouraged to submit reasoned articles relating to the
Computer Underground.  Articles are preferred to short responses.
Please avoid quoting previous posts unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
             responsibility for ensuring that articles submitted do not
             violate copyright protections.

----------------------------------------------------------------------

Date: July 18, 1991
From: "The Moderataors" <[e-mail]>
Subject: File 1-- Moderators' Corner

NEW CuD FORMAT:  The responses to the new format have been
overwhelmingly favorable, so it will replace the old format.  Thanks
to Gene Spafford who provided us with a digest maker that we hope to
have working soon.

READING THE NEW FORMAT: Usenet readers should soon be able to read CuD
as individual messages, making replies easier (thanks to Chip
Rosenthal). Those who get it as "mail" on Unix system can break the
single file up into individual files (depending on the system and
what's set up on it) with "burst" or, the easiest, with "inc". Those
receiving CuD on an IBM-type machine appear limited to a large file,
but if anybody has suggests on how to burst on VMS, pass them along.

MA/PHD THESES AND DISSERTATIONS: We're compiling a list of anybody
currently working on a thesis or dissertation on computer culture,
computer crime, or other related topics. If you, or somebody you know,
is doing this, please pass along the names and snail-mail and email
address. This includes international researchers as well as those in
North America.

LEN ROSE: Len Rose began his prison term in North Carolina this month.
Barring surprises, he should be out next May.  He could use some
"cheery" mail. His address is:

  LEN ROSE
  FEDERAL PRISON CAMP
  SEYMOUR JOHNSON AFB
  CALLER BOX 8004
  GOLDSBORO, NC 27531-5000

------------------------------

Date: Mon, 15 Jul 91 02:21:46 CDT
From: "William  Vajk (igloo)" <[e-mail]>
Subject: File 2-- The Vajk-Spaf-Leichter dialogue continues......

More Questions....
====================

I have read Jerry Leichter's response in CuD 3.24, and have received
mail from Thomas Klotzbach which has also been submitted by him for
publication in CuD.

As a direct result of the issues raised by these two gentlemen, I
spent the better part of a day in one of the law libraries provided by
Cook County, Illinois, for use by the public. Instead of having
answers, the review of copyright laws in 17 USC only created more new
questions, which I'll address another time in yet another article.

Briefly stated, copyright laws do the best job of protecting tangible
goods wherein the expression constitutes the primary value. In other
cases where a visual rendition is possible but does not represent the
real value of the object, as with musical scores, the public
production rights also glean protection, but the primary purpose is to
preclude unauthorized reproduction of tangible medium versions.

It would seem that copyright protections for source code, as in UNIX
source code, is rather minimal. Indeed, rereading the Rose indictment
from Maryland and the plea bargain, copyright is never mentioned. In
detail, the Rose case becomes further complicated in that he received
the code from a bailee.

Klotzbach is correct in one comment that there are criminal aspects to
copyright violations. They fall, however, in a particularly narrow
range, requiring willful action AND profit motive on part of the
miscreant. If you don't sell it, copyright law isn't applicable to
prosecution as a criminal.

I was unable to discover the exact requirements currently mandate for
deposit of software in order to support a copyright. The Rose
indictment calls the source code "confidential and proprietary." It is
confidential in an AT&T security employee's dream, and that's about
the extent. Leichter suggests that AT&T could claim to have never
published the source code. This would be true if sale or offer to sell
were a requirement. 17 USC addresses these issues with the term "vend"
instead of "sell." The source code we're talking about has been
published all right, and is in no way entitled to a "trade secret"
status.

Leichter defends the errors made by law enforcement, stipulating that
they have to learn how to deal with computer crime. Agreed, in
principle, but not in detail. The problems I am addressing have to do
with the general approach law enforcement seems to be taking to
solving all crime these days. The Constitution hasn't changed
recently. Essentially the same rules have applied to investigations.
What does an officer have to learn about computer criminality in order
to keep him from kicking in two doors because some law abiding
individual tried to get into a bbs that was no longer a bbs ? What
does he have to be taught in order to have the patience necessary to
simply wait for the guy to get home from work, and ask a few questions
? We are seeing some of the fallout from our permissiveness regarding
RICO.

These issues have nothing to do with computer criminality as opposed
to using sensible investigative techniques. Are we in an age where
we've been subjected to so many shoot-em-up cops versus the bad guys
TV shows that people here on usenet, among the best educated, most
sensible souls in the US, can accept kicking in doors and summary
confiscation of personal property as a valid and reasonable outcome
from calling the wrong phone number a few times ?

We have a nation which based its laws on personal freedoms and rights
before any other consideration. Let's please try to remember the
importance of this simple philosophy.

CuD 3.25 arrived as I was finishing this article. A couple of points
for Gene Spafford to contemplate come to mind. He asks why it is that
I criticize him personally. The answer is simple. The way the articles
by Spafford have been written, it is impossible to separate the
concepts from the man. His style is the same in Communications of the
ACM. Interestingly, I have been criticized by him exactly in the same
way as he complained regarding my statements about him. I expected it.
I suppose Spafford didn't. These opinions are pretty personal. They
can hardly be discussed at arm's length.  It is not any more remote to
ask if readers find statements hypocritical, or the individual (see
Spafford's comments in referenced CuD.) I am not insulted by
Spafford's opinion. He holds it, he's entitled to it, I won't argue
the point. (Where do you cut notches, Spaf? :-)

Spafford asks a direct question of me to which I am happy to reply:

> If Joe Random were to shoot someone in front of witnesses, he would
> be innocent under the law until a jury returned a verdict in a trial,
> but he would NOT be innocent of the act. Would any witness to the
> crime, or anyone who spoke to the witness, then be equally condemned
> by Mr. Vajk for saying "Joe was not innocent of murder" before the
> conclusion of the trial?

Yes.

A witness can justly say "I saw him shoot the guy." A person who spoke
to a witness might reasonably say "He said he saw Joe Random shoot the
guy." Anyone can say "I believe Joe is guilty" and still be fair and
reasonable.  But to state someone IS guilty is the duty of the jury
(or judge.) We, all of us, have reserved that right to the judicial
process. I cannot fathom why anyone would be inclined to change that
now. When one begins to assume these responsibilities on themselves,
it becomes easy to victimize even individuals who haven't been charged
with crimes by painting them with a wide black brush of presumed
guilt. We've seen it happen, right here on this network. It has also
been called the tyranny imposed by the self-righteous.

And finally:

> ...one cannot champion free speech without also embracing the responsibility
> to to respect others who choose to exercise that right -- disagreement with
> views should not become contempt for people who (appear to) espouse them.

Of course it is possible to respect another's right to freedom of
expression while holding them in contempt. I respect the rights of
Nazis to march in Skokie.  If asked to testify regarding their rights,
I would most likely state that 'I believe this swill must be permitted
to march. Please issue the necessary permits.' I certainly will never
respect them in any way.

I don't, however, see anything hypocritical about respecting some
particular individual for some aspects regarding them, and detest
other aspects concurrently. Most of us aren't particularly narrow.

------------------------------

Date: Tue, 09 Jul 91 21:28:26 CDT
From: "Craig Neidorf" <[e-mail]>
Subject: File 3-- The TERMINUS of Len Rose

                    The TERMINUS of LEN ROSE

                        by Craig Neidorf
                       ([e-mail])

            (Adapted from 2600 Magazine, Spring 1990)

     As most readers of 2600 Magazine and Computer Underground Digest
should know, I am Knight Lightning, and I used to be the editor and
publisher of Phrack, a magazine similar to 2600, but not available in
a hardcopy format.  In my capacity as editor and publisher I often
received text files and other articles submitted for publication.
Actually, this is how the majority of the material found in Phrack was
acquired.  Outside of articles written by Taran King or myself, there
was no staff, merely a loose, unorganized group of free-lancers who
sent us material from time-to-time.

     One such free-lance writer was Len Rose, known to some as
Terminus.  To the best of my knowledge at the time, Len was a Unix
consultant who ran his own system on UUCP called Netsys.  Netsys was a
major electronic mail station for messages passing through UUCP.
Terminus was no stranger to Phrack.  Taran King had interviewed him
for Phrack Pro-Phile 10, found in Phrack's fourteenth issue.
     Prior to the end of 1988, I had very little contact with Terminus
and we were reintroduced when he contacted me through the Internet.
He was very excited that Phrack still existed over the course of the
years and he wanted to send us an article.  However, Len was a
professional Unix consultant, holding contracts with major
corporations and organizations across the country and quite reasonably
(given the corporate mentality) he assumed that these companies would
not understand his involvement with Phrack.  Nevertheless, he did send
Phrack an article back in 1988.  It was a computer program actually
that was called "Yet Another File on Hacking Unix" and the name on the
file was >Unknown User<, adopted from the anonymous posting feature of
the once famous Metal Shop Private bulletin board.
     The file itself was a password cracking program.  Such programs
were then and are still today publicly available intentionally so that
system managers can run them against their own password files in order

     "An example is the password cracker in COPS, a package
     that checks a Unix system for different types of
     vulnerabilities.  The complete package can be obtained
     by anonymous FTP from ftp.uu.net.  Like the password
     cracker published in Phrack, the COPS cracker checks
     whether any of the words in an on-line dictionary
     correspond to a password in the password file."
     (Dorothy Denning, Communications of the ACM,
     March 1991, p. 28)

Perhaps if more people used them, we would not have incidents
like the Robert Morris Worm, Cliff Stoll's KGB agents, or the
recent crisis involving system intruders from the Netherlands.

     Time passed and eventually we come to January 1990.  At some
point during the first week or two of the new year, I briefly logged
on to my account on the VM mainframe on the University of
Missouri-Columbia and saw that I had received electronic mail from Len
Rose.  There was a brief letter followed by some sort of program.
From the text I saw that the program was Unix-based, an operating
system I was virtually unfamiliar with at the time.  I did not
understand the significance of the file or why Len had sent it to me,
however, since I was logged in remotely from St. Louis, I decided to
let it sit until I arrived back at school a few days later.  In the
meantime I had noticed some copyright markings on the file and sent a
letter to a friend at Bellcore Security asking about the legalities in
having or publishing such material.  As it turns out this file was
never published in Phrack.

     Although Taran King and I had already decided not to publish this
file, other events made sure that our decision was mandatory.  Upon
returning to University of Missouri-Columbia (for the new semester) on
January 12, 1990, we discovered that all access to our accounts on the
mainframe of the University of Missouri had been revoked without
explanation.  On January 18, 1990 I was visited by the U.S. Secret
Service for reasons unrelated to the Unix program Len Rose had sent.
That same day under obligation from a subpoena issued by a Federal
District Court judge, the University turned over all files from my
mainframe account to the U.S. Secret Service including the Unix file.
Included below is the text portion of that file:

     "Here is a specialized login for System V 3.2 sites.
     I presume that any competent person can get it working
     on other levels of System V.  It took me about 10
     minutes to make the changes and longer to write the
     README file and this bit of mail."

     "It comes from original AT&T SVR3.2 sources, so it's
     definitely now something you wish to get caught with.
     As people will probably tell you, it was originally
     part of the port to an AT&T 3B2 system.  Just so that
     I can head off any complaints, tell them I also
     compiled it with a minimal change on a 386 running AT&T
     Unix System V 3.2 (they'll have to fiddle with some
     defines, quite simple to do).  Any changes I made are
     bracketed with comments, so if they run into something
     terrible tell them to blame AT&T and not me."

     "I will get my hands on some Berkeley 4.3 code and do
     the same thing if you like (it's easy of course)."

In the text of the program it also reads:

     "WARNING:  This is AT&T proprietary source code.  Do
     NOT get caught with it."

and;

   "   Copyright (c) 1984 AT&T
       All Rights Reserved

     * THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T *
     * The copyright notice above does not evidence any    *
     * actual or intended publication of such source code. *"

     As it turned out the program that Len Rose had sent was
modified to be a Trojan horse program that could capture accounts
and passwords, saving them into a file that could later be
retrieved.  However, knowing how to write a Trojan horse login
program is no secret.  For example;

     "such programs have been published in The Cuckoo's Egg
     by Clifford Stoll and an article by Grampp and Morris.
     Also in his ACM turing lecture, Ken Thompson, one of
     the Bell Labs coauthors of Unix, explained how to
     create a powerful Trojan horse that would allow its
     author to log onto any account with either the password
     assigned to the account or a password chosen by the
     author."(Dorothy Denning, Communications of the ACM,
     March 1991, p. 29-30)

Between the Unix 3.2 source code, the Unix password cracking
file, and the added fact that Terminus was a subscriber to
Phrack, Len Rose was raided by the United States Secret Service
(including SSA Tim Foley who was the case agent in U.S. v.
Neidorf) at his Middletown, Maryland home on February 1, 1990.
The actual search on his home was another atrocity in and of
itself.

     "For five hours, the agents -- along with two Bellcore
     employees -- confined <Len> Rose to his bedroom for
     questioning and the computer consultant's wide, Sun,
     in another room while they searched the house.

     The agents seized enough computers, documents, and
     personal effects -- including Army medals, Sun Rose's
     personal phone book, and sets of keys to their house
     -- to fill a 14-page list in a pending court case."
     (No Kid Gloves For The Accused, Unix Today!,
     June 11, 1990, page 1)

     It was also reported that the agents did serious damage to
the physical house itself.  Len was left without the computers
that belonged to him and that he desperately needed to support
himself and his family financially.  Essentially Len went into
bankruptcy and furthermore now he was blacklisted by AT&T.

    This culminated in a May 15, 1990 indictment of Len Rose at
age 31.  There were five counts charging Len with violations of
the 1986 Computer Fraud and Abuse Act and Wire Fraud.  The total
maximum penalty he faced was 32 years in prison and fines of
$950,000.   Furthermore, the U.S. Attorney's office in Baltimore
insisted that Len was a member of the Legion of Doom, a claim
that Len and known LOD members have consistently denied.  It did
finally become clear that Terminus was not a member.

     This was just the beginning of another long saga of bad luck
for Len Rose.  He had no real lawyer, he had no money, and he had
no job.  Furthermore, Len suffered a broken leg after rescuing
his son during a camping trip.

     Eventually Len found work with a company in Naperville,
Illinois (DuPage County <Chicago suburbs>) with a Unix consulting
firm called InterActive and he had a new lawyer named Jane Macht.
The future began to look a little brighter temporarily.  The
problem was that within a week InterActive was making claims that Len
had copied Unix source code from them.  Illinois State Police and SSA
Tim Foley (what is HE doing here!?) came to Len's new home and took
him away.  In addition to the five count indictment in Baltimore, now
Len was facing criminal charges from the State of Illinois.  It was at
this point, attorney Sheldon T. Zenner, who had successfully defended
me took on the responsibility of defending Len against the state
charges.

     Len's spin of bad luck was not over yet.  Assistant U.S. Attorney
William Cook in Chicago wanted a piece of the action, in part perhaps
to redeem himself from his highly publicized defeat in U.S. v.
Neidorf.  A third possible indictment for Len seemed inevitable.  In
fact, there were statements made that I personally was to have been
subpoenaed to testify before the grand jury about Len, but this never
took place.

     As time passed and court dates kept being delayed, Len was barely
surviving; running out of money and options.  His wife wanted to leave
him and take away his children, he could not find work, he was looking
at two serious indictments for sure, and a possible third, and he just
could not take it any longer.

     Len's legal arguments were strong in many respects and it is
widely believed that if he had fought the charges that he may very
well have been able to prove his innocence.  Unfortunately, the pile
up of multiple indictments, in a legal system that defines justice in
terms of how much money you can afford to spend defending yourself,
took its toll.  The U.S. Attorney in Baltimore did not want to try the
case and they offered Len a deal, part of which was that Assistant
U.S. Attorney Cook got something as well.  Len would agree to plead
guilty to two wire fraud charges, one in Baltimore, one in Chicago.
The U.S. Attorney's office would offer a recommendation of a prison
sentence of 10 months, the State of Illinois would drop it's charges,
and Len would eventually get his computer equipment back.

     In the weeks prior to accepting this decision I often spoke with
Len, pleading with him to fight based on the principles and importance
of the issues, no matter what the costs.  However, I was blinded by
idealism while Len still had to face the reality.

     Len Rose was sentenced in June and began serving his time on July
10, 1990.  He got his computer equipment back, but only under the
agreement that he sell all of it.

     United States v. Rose was not a case about illegal intrusion into
other people's computers.  Despite this the Secret Service and AT&T
called his case a prime example of a hacker conspiracy.  In reality it
was only an example of blind justice and corporate power.  Like many
criminal cases of this type, it is all a question of how much justice
can a defendant afford -- How much of this type of *injustice* can the
American public afford?

                         -- -- -- -- --

A Few Words About Law Enforcement and the Len Rose case...

     As a person who has been involved with the legal process
repeatedly over the last couple of years I have learned and
discovered some of the realities behind the rumors and the myths.
In the Spring 1991 issue 2600, I authored an article titled "The
Terminus of Len Rose" and unfortunately the meaning behind the
article was lost on some of the readers whom I admire greatly.

     Through my unique experiences at meetings like the 13th
Annual National Computer Security Conference in Washington D.C. and
the first conference on Computers, Freedom, & Privacy in San
Francisco, I have come into contact and had discussions with both the
people who help create the laws as well as those who actively enforce
them.  I have learned a lot about what actually takes place behind the
scenes and why.  More than anything else, I discovered that my views
on several issues were not so very far from theirs and they taught me
why certain realities were so.  What they said made sense and I
realized that I was indeed wrong about some issues and situations.  I
was even more wrong in my expectations of the individuals themselves.
These people are decent folks just like you and me.  Despite the
highly publicized incidents of the past couple of years, the vast
majority of these people are not out there trying to destroy someone's
life just to make a name for themselves or to put a notch on their
desk.  They believe in their work like a sacred religious mission.  At
the same time they have families, hobbies, like to go to the movies,
play video games, take vacations during the holidays, and everything
else.

     In the article about Len Rose, I did not intend to imply that the
prosecution or the prosecutors were malicious (although the frantic
raid on Len's house may have been a bit out of order), but rather that
the legal process itself can be a difficult road for a non-wealthy
defendant to travel, especially when faced with many indictments at
once.  Len Rose was never charged with actually breaking into a
computer, but he was called a hacker (under the negative definition)
just the same.  That is not fair.  I believe that the prosecutors
acted in the way they thought best and were not out to deny Rose of
his constitutional rights, but the issues of law and computers that
clashed here make things confusing for everyone including myself.

     The fact of the matter is that the system does have flaws in it
which arise and are corrected over time.  These flaws arose in my own
case and cost me dearly until the system caught its flaw and corrected
itself.  I am not here to tell you that Len Rose was a saint or that
he did not do anything wrong.  Indeed in the past month I have heard
complaints from several people about bad business deals with Len and
mishaps concerning stolen computer equipment.  I don't know all of the
details behind those allegations and considering where Len is today,
those questions are moot.  I must admit that Len's transportation of
Unix source code strikes me as a form of copyright infringement or
perhaps software piracy, but Rose did not even make an attempt to
profit financially from this venture.  The value of what he actually
transported and his guilt or innocence of these statutes was never put
to the test because the prosecution did not seek to use these more
appropriate statutes concerning piracy or copyright infringement.  I
still wonder why.

     While I believe that the prosecutors involved with his case are
honest, hardworking, and highly motivated people, it strikes me as
being overly harsh to see a very bright, non-violent offender who did
not even commit a crime for money go to prison when his formidable
talents could have been put to good use elsewhere.

     In conclusion I think there may be a rare bad apple mucking up
the legal process from time to time, but it is my firm belief that the
prosecutors and law enforcement officials in our system overall are
dedicated to doing the right thing and going after offenders that they
truly believe to be committing real crimes.  Up to this point I've
only been able to watch and learn about their work from an outsider's
viewpoint, but one day I may be interested in participating from their
perspective.  As a group in general, the law enforcement community has
earned my respect and appreciation.

------------------------------

Date: July 28, 1991
From: "The Moderataors" <[e-mail]>
Subject: File 4-- "Computer Crime" paper by Brian Peretti available

Brian J. Peretti has finished the latest draft of his paper:
"Computer Crime:  Current Practices, Problems and Proposed Solutions".
Here is a brief excerpt from the introduction. The complete paper is
available in the CuD ftp sites.

++++++++++++++++++

Within   recent   years,   computer  crime   has   become  a
preoccupation with law  enforcement officials.  In  California, a
group of  West German  hackers using  phone lines  and satellite
hookups, gained  unauthorized access into  civilian and  military
computers and  stole sensitive documents  that were  sold to  the
Soviet  Union.   A  young  New York  programmer  broke  into  a
Washington computer to  run a program that he could  not run from his
personal  computer.  After  Southeastern Bell Stated  that a document
published in an  electronic publication was  valued at more than
$75,000 the publisher was arrested and brought to trial before the
discovery that  the document could be publicly  bought from the
company  for $12.6  The Chaos Computer  Club, a Hamburg, Germany,
club,  went   into  government  computers   and  access information
and gave it to reporters.  In May,  1988, the United States government
launched Operation Sun Devil, which lead to the seizure  of  23,000
computer  disks  and  40  computers.   In addition,  poor police
performance  has  also  been  blamed  on computers.

Since  its  creation,  the computer  has  become  increasing important
in society.  The law, as  in the past, has  not been able   to  evolve
as   quickly   as   the   rapidly   expanding technology.  This  lack
of movement on the  part of governments shows a lack  of understanding
with the area.  The need to create a  comprehensive  regulation   or
code  of  ethics   has  become increasing necessary.

Due   to  the   nature  of   computer   systems  and   their
transnational   connections   through   telephone   lines,   an
individual  state's action will only stop the problems associated with
computer crime if many  states join together.  The patchwork of
legislation that  exists  covers  only a  small  part of  the problem.
To  adequately address computer crime,  greater efforts must   be
made  within  the  computer  community  to  discourage unauthorized
computer access, countries must strengthen and

co-ordinated  their computer related  laws, as well  as proper
enforcement mechanism created, computer program copyright laws be
enhanced  and computer systems  should be created  to allow those who
wish to  explore computer systems which will  not disrupt the users of
computer systems.

This paper will first set out a definition of computer crime and  why
laws  or regulation  by the  computer community  must be created.
Section  II will  then discuss  the United  States law concerning
computer crime and  why it needs  to be strengthened.  Section  III
will  discuss the  proposed  Israeli computer  crime bill, Britain's
Computer Misuse  Act and  Ghana's proposed  law.  Section IV will
discuss what can be done by  both the government and  computer  owners
and  users  to  make  computer  crime less possible.
<The rest is available from the CuD ftp archives>

------------------------------

Date: July 28, 1991
From: "The Moderataors" <[e-mail]>
Subject: File 5-- Doc Savage Sentenced (NEWSBYTES Reprint)

(Moderators' Note: Readers should note well the final paragraphs of
this article. It is the first case that we're aware of in which the
prosecutor opposed the judges intention to imprison.  Gail Thackeray's
arguments against incarceration are compelling and productive. Sadly,
such logic is the exception and not the rule, but perhaps her example
will spread).

SUNDEVIL DEFENDANT "DOC SAVAGE" SENTENCED 7/17/91

PHOENIX, ARIZONA, U.S.A., 1991 JUL 17(NB) -- The Maricopa County
Arizona County Attorney's Office has announced the sentencing Baron
Majette, 20 , also known as "Doc Savage", for computer-related crimes
uncovered in the joint federal / state investigation known as
"Sundevil".

Majette was arrested on March 27th of this year and charged with a
number of felony charges relating to unauthorized use of telephone
facilities of Toys 'R Us to make calls worth approximately $8,000,
illegal access of TRW's credit data base and use of information
obtained therein to obtain in excess of $50,000 in cash, goods, and
services, and stealing of credit cards from U.S. Mail boxes and use of
the cards to obtain approximately $10,000 in cash, goods and services.
If convicted of the charges, Majette faced a possible jail sentence of
15 years and the requirement to make restitution for the full amount
of the alleged losses endured by the firms and individuals.

In late May, Majette pleaded guilty to an amended charge of a single
count of computer fraud, felony third degree. The reduced charge was a
result of an agreement between Mark Berardoni, the public defender
assigned to Majette; Janet Black, Majette's probation officer and the
Maricopa County Arizona County Attorney's Office. Under the reduced
charges, Majette's maximum term of incarceration was reduced from the
aforementioned 15 years to 5.

On July 16th, when the actual sentence was to be imposed, a further
agreement between the prosecution, defense and parole service  was
presented to the presiding judge, Justice Gottsfield, and, after
discussion, became the actual sentence. The court decision imposed the
following:

-- Majette will remain in jail for up to two months while he awaits
placement in a "Shock Incarceration" program (Majette has been in jail
since his March 27th arrest because of parole violation related to an
earlier crime). Assistant County Attorney Gail Thackeray told
Newsbytes that Shock Incarceration is a 120 day program which
"provides both intensive counseling and military-like discipline and
exercise."

-- Upon his release from Shock Incarceration, Majette will enter a 5
year period of "intensive probation". Under Arizona procedures, the
subject must provide the probation officer, on a weekly basis, a
schedule for the next week's activities. In the event that the
schedule has to be modified in any way, the probation office must be
called before the new schedule is acted on.

-- During the time of intensive probation, the probation officer may
visit or call the subject at any time of day or night to insure
compliance with the schedule.

-- If, at some point after a year of intensive probation, the
probation officer feels that the subject has followed the rules and
shown that intensive procedure is no longer warranted, the subject and
probation officer may recommend to the sentencing judge that the
subject be transferred to normal probation. In normal probation, the
subject advises the officer weekly of progress and problems. There is
not the hovering presence felt in intensive probation, according to
Thackeray. Additionally, the subject may be released from any form of
probation at the petition of the probation office and subject and
approval, after hearing, of the sentencing judge.

-- If, on the other hand, Majette violates the terms of his probation,
he is liable for incarceration in prison for the remainder of his
probationary period.

-- Majette was also ordered to make restitution to the parties
victimized by his activities by paying a sum of $19,774.03 to those
involved. The sum is to be paid on a monthly basis over the course of
his sentence. Additionally, he was ordered to make payments to help
defray the cost of his probationary supervision.

Under the terms of his probation, Majette is subject to the following
conditions said by Thackeray to be unique to his type of offense:

-- He may not use any computer connected to a modem or communications
network without the prior permission of his probation officer.

In the event that he takes a job that brings him into contact with
computer activities, he must notify someone in the employer's office
of the restrictions on his computer use and must discuss the planned
activities with his probation officer.

-- He is not to communicate or associate with "members of the computer
underground" (defined as persons such as those known to have or
reasonably believed to have been involved in theft of communications
services, computer fraud or related activities). In the event that any
such individuals contact him, he must report the contact to his
probation officer (According to Thackeray, this stipulation is
intended for Majette' s protection -- "In the event that the
contacting party is investigated or arrested and phone records show a
call to Majette, his notification to his probation officer of the call
will stand as proof that he was not involved in any conspiracy with the
other individual. His notification responsibility in no way requires
him to cooperate with authorities in the location or apprehension of
another individual and such cooperation is neither expected nor
desired.").

Transcripts of the sentencing hearing reportedly show that it was the
intention of Judge Gottsfield to sentence Majette to a straight five
years in prison but was dissuaded by the combined recommendations of
the prosecution, defense and probation office. Thackeray explained to
Newsbytes the rationale of the prosecution in recommending a lighter
sentence -- "Usually computer hackers who get into trouble for
activities of this nature are kids or young adults who are not the
type to be in trouble for any other criminal activities. The point of
sentencing in these cases should be rehabilitation. If we can break
the pattern of illegal behavior, society will benefit from Majette's
participation. If we simply locked him up for 5 years, neither he nor
society would benefit."

(Barbara E. McMullen & John F. McMullen/19910717)

------------------------------

Date: 02 Jul 91 19:15:10 EDT
From: "76012,300 Brad Hicks" <[e-mail]>
Subject: File 6-- CompuServe Responds to Policy and Operations Questions

Attn: Computer Underground Digest
In TELECOM Digest #11.507, John Higdon writes:

  > If I really am responsible for every article and pass-through
  > e-mail message that writes to my disk drive, then I lack the
  > facilities (mostly manpower) to remain an intermediate UUCP site.


John, in every meeting of four or more sysops I have been at in the
last three years, I have heard this one argued.  I have submitted this
exact question to maybe a half-dozen lawyers.  The only thing that ALL
agreed upon was that until we have three or more cases prosecuted in
the federal courts, no one knows whether you are liable or not.

Mike Godwin, the EFF's attorney, told a bunch of us that he's been
researching this exact question for most of a year, and so far it
comes down to three broad categories:

 (1) ENTIRELY PRIVATE, ONE-TO-ONE MAIL

Covered by the Electronic Communications Privacy Act.  Sysop/sysadmin
is not liable for content; may read for technical reasons such as to
check service; may not disclose to anyone for any reason without a
court order.  (Aside: Since the search warrant at Steve Jackson Games
said nothing about third-party mail, in the seizure of Illuminati BBS
the aptly-acronymed SS almost certainly violated ECPA over this very
issue.)

 (2) ENTIRELY PUBLIC MAIL ON ONLY ONE SYSTEM (local BBS messages)

Only limited case law, but it does appear that the sysop is liable in
general.  More cases or new laws will be necessary to determine WHEN
the sysop becomes liable ... e.g., if somebody posts a Sprint access
number on your BBS, you are definitely liable if it is still there a
month later.  But what about the next day?  An hour later?  Five
seconds later?  Nobody knows until the lawyers fight it out.  Godwin
thinks it comes down to "if the sysop could reasonably have known
about it"--and then some poor ignorant bunch of jurors will get to
decide how often a "resonable sysop" checks his mail.

(3) WIDELY-DISTRIBUTED PUBLIC MAIL (newsgroups, echomail, mail lists,
etc.)

No readily applicable law.  No CLEAR precedent ... but the few
half-precedents, taken from the world of ham packet-radio repeaters,
suggests that in fact, you are liable for any public message residing
on your system, even if it originated elsewhere.  If you allow your
system to forward public messages before you clear them, you may find
yourself charged with moving illegal messages across state lines.

As an ex-sysop of seven years' experience, #3 horrifies and terrifies
me.  I almost got caught in this trap myself, when a Dallas TV station
tried to persuade police that as the conference moderator on
MagickNet, I personally was responsible for a message on MagickNet
offering assistance to a man seeking to smuggle his daughter out of
the country so his inlaws couldn't take her away.  (Note: message from
someone else, to a third party outside the country, and the hue and
cry arose two days before I even saw the message.)

Maybe common sense will prevail in the courtroom.  (And maybe chickens
have teeth.)  Maybe Congress will pass clear, reasonable, technically
feasible legislation to clarify the issue and President Bush will sign
it.  (And maybe we =can= balance the budget in 1993.) Or maybe the
Rehnquist court will recognize this as an important freedom-of-speech,
freedom-of-association, freedom-of-press issue and grant appropriate
protection.  (And maybe we'll find a universally popular solution to
the abortion issue tomorrow after lunch, and everybody will agree to
it.)

------------------------------

************************************
End of Computer Underground Digest #3.26