**************************************************************************** >C O M P U T E R U N D E R G R O U N D< >D I G E S T< *** Volume 1, Issue #1.22 (July 14, 1990) ** **************************************************************************** MODERATORS: Jim Thomas / Gordon Meyer ARCHIVISTS: Bob Krause / Alex Smith REPLY TO: TK0JUT2@NIU.bitnet COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Contributors assume all responsibility for assuring that articles submitted do not violate copyright protections. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ File 1: Moderators' Comments File 2: From the Mailbag: More on CU and Free Speech File 3: Response to "Problems of Evidence" (Mike Godwin) File 4: What to do When the Police come a'knocking (Czar Donic) File 5: Observations on the Law (Mike Godwin) File 6: Electronic Frontier Fund Press Releases ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ *************************************************************** *** CuD #1.22, File 1 of 6: Moderators' Comments *** *************************************************************** ++++++++++ In this file: 1) Electronic Frontier Fund formed 2) CuD's Readership Survey (reminder) 3) SummerCon '90 4) Errata +++++++++++++++++++++++++++++ ELECTRONIC FRONTIER FUND +++++++++++++++++++++++++++++ The Electronic Frontier Fund has been officially announced. The EFF's mission statement, press release, "Electronic Bill of Rights," and Legal Summary are in File #6 of this issue. The opening day press release and other documents have been combined into a single file and is available from both archive sites (FTP and Krause). The length of the file is about 950 lines. +++++++++++++++++++ CuD SURVEY +++++++++++++++++++ Bob Krause has the readership survey about ready. Those who responded generally thought the survey to be a good idea. There were no negative comments, so it should be going out in a week or two. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% SUMMERCON '90 Week of July 27th St. Louis %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% SummerCon, an annual event where the CU elite gather to party, meet friends, and generally have a good time, returns! This years event is being hosted by Aristotle and Forest Ranger. CuD wishes them the best and welcomes any reports/reviews that attendees wish to contribute. +++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++++ ERRATA (from 1.14) +++++++++++++ In CuD 1.14, we erroneously announced that a PHRACK file to be used for evidence announced the beginning of The Phoenix Project BBS. In fact, the file made no specific reference to the BBS of the same name. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END THIS FILE + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= *************************************************************** *** CuD #1.22, File 2 of 6: Mail--More on Harassment *** *************************************************************** To: tk0jut2%niu.BITNET@cunyvm.cuny.edu Subject: Lines of Communication Date: 8 Jul 90 22:37:00 PDT (Sun) From: john@bovine.ati.com(John Higdon) It was most refreshing to see some balanced comment on the subject of opinions and viewpoints. Having been outraged by some of the underhanded tactics of law enforcement, I have been also a little troubled by the inability of some CU types to hear or allow others to hear alternative points of view. A recent incident comes to mind. Some months ago, there appeared an article in Telecom Digest from someone who lamented the advent of CPID. His objections were hardly mainstream: with CPID it became risky to "hack" authorization codes for long distance carriers. I was annoyed on two counts. First was the assumption that CPID would pose any more risk than ANI, something that long distance carriers have had available for years, and second, that somehow searching for authorization codes was advancing the state of hacking in the field of computing or telephony. I posted a straight-forward article expressing my opinion. Mind you, my background includes healthy amounts of hacking, mainly in the field of telephony, with exploits dating back to the sixties. A significant portion of my knowledge of the telephone network (a knowledge which now puts food on my table) was obtained through what can only be described as questionable means. My pointed response rose from the indignations of a "real" hacker over the antics of what appeared to be a schlep. No sooner did that response appear in the Digest, my e-mailbox filled with the most vitriolic, in many cases juvenile, threats one can possibly imagine. Most of the hate mail was anonymous, with mighty computer lords demonstrating their power over e-mail and threatening unspecified retaliation. I answered all that carried a legitimate return address, inviting the writer to take me on in the Telecom forum if he (they were all from males) thought I was out of line. None did. However, the incident confirmed my original premise: the concept of simply stealing authorization codes was a product of juvenile minds. For a time it appeared that this forum was becoming a strident, whiney, self-pitying club. Anything law enforcement did was bad; anything any hacker anywhere did was noble and cause-supporting. We're all adults here. We all know there are two sides to any situation. As a hacker, my wish would be that commercial systems designers put a lot more effort into security. If hackers can't get in in the first place, there wouldn't be the need for SS raids and the seizure of private computer systems. The age-old concept of "security through obscurity" will not suffice any longer. Some of the apparent tactics of our law enforcement agencies appear to be questionable at the very least. No doubt some innocent bystanders are being, to put it mildly, grossly inconvenienced. But let's not as a group lapse into self-righteousness, or try to silence those who have an opposing point of view. **John Higdon | P. O. Box 7648 | +1 408 723 1395 john@bovine.ati.com | San Jose, CA 95150 | M o o ! =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END THIS FILE + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= *************************************************************** *** CuD #1.22, File 3 of 6: Response to "CU Harassment" *** *************************************************************** Date: Sun, 8 Jul 90 16:51:10 -0500 From: mnemonic@ccwf.cc.utexas.edu(Mike Godwin) To: TK0JUT2%NIU.BITNET@UICVM.uic.edu Some responses to Mr. Anonymous: RE Point 1 ("misleading" references to punishments): It is true that there are a range of punishments available in cases such as this one. But it is false to conclude that the judge has either the right or necessarily the inclination to sentence leniently. Regarding the former: Federal judges' discretion has been greatly limited by the adoption of the Federal Sentencing Guidelines. Increasingly, judges have complained that they are not allowed by the Sentencing Guidelines to sentence leniently. Regarding the latter: Judges may be likely to accept prosecutors' characterization of all computer hackers as serious criminals, which means the judges won't be likely to use whatever discretion they have to be lenient. So, how did Robert Morris get such a lenient sentence? Answer: Unless I'm mistaken, he was prosecuted for *much less serious crimes* than the LoD defendants have been indicted for. Morris was not charged with theft or fraud, as I recall. This makes it incredibly misleading for Mr. A to compare the Morris case with the Neidorf/Riggs prosecution. RE Point 2 (Confiscation of equipment): There is no doubt that it's more convenient and more efficient for federal law-enforcement agents to seize evidence for inspection. The question is not whether there are alternative means for conducting these investigations, but whether all the necessary interests have been served. One of these interests is every citizen's right not to be deprived of property by the government without due process of law, and without just compensation. Even if Mr. A believes "due process of law" has occurred in, say, the seizures at Steve Jackson Games, *where's the "just compensation"*? Jackson probably has no remedy at all under federal law, thanks to exceptions in the Federal Tort Claims Act. RE Point 3 (What computer criminals will say when caught): Mr. A is perfectly correct to note that that suspects, and especially guilty ones, will characterize their actions as being comparatively innocent. But this is true in all federal prosecutions, regardless of whether the crimes involve computers, and regardless of whether the defendants are truly innocent. Mr. A suggests that "it doesn't matter" why the defendants did what they did. In this, he demonstrates a basic ignorance of criminal law--it is *central* to prosecution of major crimes that the defendants be proved beyond a reasonable doubt to have criminal intent. Therefore, what the defendants were thinking *does* matter--indeed, for most federal prosecutions, the defendant's mental state is the single most important issue to be resolved at trial. Except for purely regulatory offenses (which typically carry only minor penalties), the criminal law is designed to punish (and deter) acts by people with criminal mental states. Proving criminal defendants' mental states to a jury's satisfaction has not been an insuperable task for federal prosecutors up to now, by the way. RE Point 4 (Law enforcement access to the Net): Mr. A is also correct to note that relatively few law-enforcement officials have Net access, and fewer still understand the relevant electronic subculture. This is precisely why it is dangerous for them to go forward and characterize ALL hackers as serious criminals. Some hackers clearly are criminals. But many of them are motivated by the same sense of exploration that motivates federal prosecutors to discover new uses for the wire-fraud statute. The courts are capable of distinguishing between the merely adventurous and the criminal--but misunderstandings on the part of prosecutors can make it more difficult for judges and juries to make those distinctions. And, of course, willingness to seize lots of property as evidence and to prosecute 19-year-old hackers afflicted with braggadocio creates ancillary chilling affects the consequences of which none of us probably would like. The current indictments against Neidorf and Riggs characterize their use of BBS "handles" and their erasure of computer logs that recorded their entry into computer systems as fraudulent misrepresentations. In effect, the federal prosecutors have decided that anyone who uses a BBS "pen name" is misrepresenting himself and thereby opening himself up to fraud prosecutions. Only persons ignorant of the current American BBS subculture can draw such a conclusion. **Mike =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END THIS FILE + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= *************************************************************** *** CuD #1.22, File 4 of 6: The Czar's Guide to Law *** *************************************************************** THE CZAR'S GUIDE TO THE YOUNG CRIMINAL ACCUSED OF USING COMPUTERS With the hyperactivity of law enforcement officials and the current attitudes of the public in general, it is probably time to consider what to do in case of a bust. I would guess that just about everybody receiving the Computer Underground Digest has violated some sort of law somewhere in someone's mind involving computers. This is not to say that all the readers of this publication are really criminals -- just that the laws are so broadly interpreted so as so make anyone with a modem a criminal. For example, if you have ever downloaded shareware and not used it, but didn't delete it, and had it for over 15 days, you could be violating copyright laws if the author put some sort of announcement to the effect that such were the terms of agreement. This means that you could very well be raided someday. Nothing is more gratuitous than free legal advice given to a defendant who has already engaged counsel, especially if the giver of such advice is not an attorney. However, as someone close to me was so arrested (and the charges later dropped), I thought you might be able to benefit from our experience. It does not matter what the computer crime is, how extensive, how serious the charges, etc. What matters is how you deal with the system when it comes knocking on your door. There may be warning signs. You could get a call or a preliminary visit from a member of the Secret Service, a call from security from a local phone company, a visit from a local policeman, news that someone you know has been busted, anything like that. At that point, you are legally free to say whatever you want, but it is best if you give the impression that you are willing to cooperate. Of course, any specific details you give will be noted. They can not be used in evidence against you, but that will not stop them from making the attempt in the future. I would indicate that I was very willing to help but that, right now, I had a number of pressing things to do and that I would like to talk tomorrow when I had much more time and could go into more detail. Right now, I'd say, my mother was calling. Everyone, to paraphrase Thoreau, should have such a mother. I would hardly advise anybody to destroy evidence since that is a crime itself, but it would seem to me that at this point a lot of material you have had around the house has been bringing you bad luck. A lot of paper and printouts are a definite fire hazard and should not be left lying around. Also, old data never does you any good -- it would be wise to format most of your ala disks several times. Better yet, treat yourself to some new ones and maybe your luck will change. All those old, dusty disks simply clutter things up. It's time to reorganize. The search warrant usually takes a while to get, but most judges take the path of least resistance and will issue one on fairly flimsy grounds. Now you must realize that most police officers are not used to dealing with computer people and that they do not like the ones they do have to deal with at work. The are used more to searches in the case of narcotics, illegal weapons, etc. You can not expect them, then, to be overly polite when they do knock on your door. Do not let this frighten you into telling them all sorts of things. During the search, however, it helps to have someone there crying. Also, act limply, as if you have lost the will to live. This will usually placate the more professional ones who should realize thereby that you are not going to shoot at them. This behavior is simply designed to keep you from being beaten or otherwise abused. It does not help your case legally although, if they do beat or otherwise try to intimidate you, and you can document it, a prosecutor will feel less exuberant about taking the case to court. They will probably place you under arrest at this point, reading you your rights. Once they do, you are under no obligation to say anything, but I would advise you to say "I want an attorney." An alternative is "I want a lawyer." You can respond to their "good guy" questions about the weather and such, but then when the questions come back to the topic of computers you had best repeat the above sentence(s). In fact, the more times you say it the better if it ever gets to court, but do not say it gratuitously so as to arouse the macho defensiveness that some officers may have. Realize that the arresting officer is not a legal scholar and that he is no more culpable in this arrest than is the postman for bringing you a bill. The real fighting lies ahead. One final point: it is wise to become acquainted with an attorney before any of this happens. One thing is quite certain: nothing you say to the arresting officers is likely to help your case. While they are carrying out your computer, your floppies, your printouts, your telephones, your answering machine, your radio, your tapes, watch them. Remember the irrelevant material they seize. This fact may be helpful in court as well and it may well help dissuade the prosecutor from doing anything much with the case. In one case, they took copies of the Federal Register, a tape of Mozart's 23rd piano concerto (Horowitz), and Gordon Meyer's thesis. The constant repetition of "I want my Mozart back" irritated the prosecutor no end and lessened enthusiasm for the case. (They also picked up pieces of grass the cat had brought in). None of this is legally relevant, but then a lot they do is